@jinn-network/client 0.1.9 → 0.2.0

package/dist/task-creator/proofs/ipfs-cid.js

@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * CID validation at configuration boundaries. Decode enough multibase and
+ * varint structure to distinguish a CID from a readable label; a prefix match
+ * such as `bafy...` is not an IPFS publication reference.
+ */
+const BASE58BTC = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const BASE32 = 'abcdefghijklmnopqrstuvwxyz234567';
+export function isIpfsCid(value) {
+    if (value.startsWith('Qm')) {
+        const bytes = decodeBase58(value);
+        // CIDv0 is specifically a sha2-256 multihash: code 0x12, length 0x20.
+        return bytes?.length === 34 && bytes[0] === 0x12 && bytes[1] === 0x20;
+    }
+    if (!value.startsWith('b'))
+        return false;
+    const bytes = decodeBase32(value.slice(1));
+    if (!bytes)
+        return false;
+    const version = readVarint(bytes, 0);
+    if (!version || version.value !== 1)
+        return false;
+    const codec = readVarint(bytes, version.next);
+    if (!codec)
+        return false;
+    const hashCode = readVarint(bytes, codec.next);
+    if (!hashCode)
+        return false;
+    const hashLength = readVarint(bytes, hashCode.next);
+    if (!hashLength || hashLength.value <= 0)
+        return false;
+    return hashLength.next + hashLength.value === bytes.length;
+}
+function decodeBase58(value) {
+    const bytes = [0];
+    for (const char of value) {
+        const digit = BASE58BTC.indexOf(char);
+        if (digit < 0)
+            return null;
+        let carry = digit;
+        for (let index = bytes.length - 1; index >= 0; index -= 1) {
+            const next = bytes[index] * 58 + carry;
+            bytes[index] = next & 0xff;
+            carry = next >>> 8;
+        }
+        while (carry > 0) {
+            bytes.unshift(carry & 0xff);
+            carry >>>= 8;
+        }
+    }
+    for (const char of value) {
+        if (char !== '1')
+            break;
+        bytes.unshift(0);
+    }
+    return Uint8Array.from(bytes);
+}
+function decodeBase32(value) {
+    const bytes = [];
+    let accumulator = 0;
+    let bits = 0;
+    for (const char of value) {
+        const digit = BASE32.indexOf(char);
+        if (digit < 0)
+            return null;
+        accumulator = (accumulator << 5) | digit;
+        bits += 5;
+        while (bits >= 8) {
+            bits -= 8;
+            bytes.push((accumulator >>> bits) & 0xff);
+        }
+    }
+    if (bits !== 0 && (accumulator & ((1 << bits) - 1)) !== 0)
+        return null;
+    return Uint8Array.from(bytes);
+}
+function readVarint(bytes, start) {
+    let value = 0;
+    let shift = 0;
+    for (let index = start; index < bytes.length && shift <= 28; index += 1, shift += 7) {
+        const byte = bytes[index];
+        value |= (byte & 0x7f) << shift;
+        if ((byte & 0x80) === 0)
+            return { value, next: index + 1 };
+    }
+    return null;
+}
+/**
+ * Hermetic tests deliberately use readable non-CID labels. Never admit those
+ * labels in an operator process; production must receive an actual CID.
+ */
+export function isTestOnlyIpfsCidFixture(value) {
+    return process.env.VITEST !== undefined && /^bafy-test-only-[a-z0-9-]+$/u.test(value);
+}
+export function isAcceptedIpfsCid(value) {
+    return isIpfsCid(value) || isTestOnlyIpfsCidFixture(value);
+}
+//# sourceMappingURL=ipfs-cid.js.map

package/dist/task-creator/proofs/ipfs-cid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipfs-cid.js","sourceRoot":"","sources":["../../../src/task-creator/proofs/ipfs-cid.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;GAIG;AACH,MAAM,SAAS,GAAG,4DAA4D,CAAC;AAC/E,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,sEAAsE;QACtE,OAAO,KAAK,EAAE,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,GAAG,EAAE,GAAG,KAAK,CAAC;YACxC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;YAC3B,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YAC5B,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM;QACxB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3B,WAAW,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,KAAa;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/dist/task-creator/proofs/live-proof.d.ts

@@ -0,0 +1,99 @@
+import { type JinnDifferentialProofSource, type PublicRepoProofFixture } from './public-repo-fixtures.js';
+import { type MintedEnvironmentBindingV1 } from '../../solver-types/_swe-rebench-v2-minted-pool.js';
+import { type JinnDifferentialAttesterPolicyV1 } from '../environment/jinn-differential-policy.js';
+import { type ReceiptBoundJinnDifferentialProof } from './differential-receipt-bound-proof.js';
+export type PublicRepoProofId = PublicRepoProofFixture['id'];
+type PublicRepoProofTarget = JinnDifferentialProofSource | PublicRepoProofFixture;
+export type LivePublicRepoProofConfig = {
+    fixture: PublicRepoProofTarget;
+    rpcUrl: string;
+    registryUrl: string;
+    /** Name of a pre-configured Docker credential helper, never credential data. */
+    registryCredentialRef: string;
+    minterOperator: `0x${string}`;
+    solverOperator: `0x${string}`;
+    evaluatorOperator: `0x${string}`;
+    candidatesFile: string;
+    /** Required only for the real Jinn #1422 route; absent for synthetic parser-contract coverage. */
+    differentialAdmission?: ReceiptBoundJinnDifferentialProof;
+    /** Exact-source policy passed intact to the external network runner. */
+    jinnEnvironmentPolicy?: {
+        ipfsGatewayUrl: string;
+        environment: MintedEnvironmentBindingV1;
+        approvedAttesters: JinnDifferentialAttesterPolicyV1['approvedAttesters'];
+    };
+};
+/** A secret-free handoff document for an existing network/factory runner. */
+export type PublicRepoNetworkProofDocumentV1 = {
+    schemaVersion: 'jinn.task-creator.public-repo-network-proof.v1';
+    fixture: {
+        id: PublicRepoProofId;
+        repo: string;
+        baseCommit: string;
+        fixCommit: string;
+        instanceId: string;
+    };
+    rpcUrl: string;
+    registry: {
+        url: string;
+        credentialRef: string;
+    };
+    operators: {
+        minter: `0x${string}`;
+        solver: `0x${string}`;
+        evaluator: `0x${string}`;
+    };
+    candidatesFile: string;
+    differentialAdmission?: {
+        receiptCid: string;
+        receiptHash: `sha256:${string}`;
+    };
+    /** Runner must fetch this signed spec and re-apply the canonical Jinn policy before launch. */
+    jinnEnvironmentPolicy?: {
+        ipfsGatewayUrl: string;
+        environment: MintedEnvironmentBindingV1;
+        approvedAttesters: JinnDifferentialAttesterPolicyV1['approvedAttesters'];
+    };
+};
+export interface LivePublicRepoProofParseOptions {
+    fetchEnvironmentSpec?: (gatewayUrl: string, cid: string) => Promise<unknown>;
+}
+export type NetworkFactoryRunner = (bin: string, args: string[], options: {
+    env: NodeJS.ProcessEnv;
+}) => Promise<void>;
+export declare function publicRepoProofFixture(id: PublicRepoProofId): PublicRepoProofTarget;
+/**
+ * Parse only identifiers, endpoints, paths, and credential-helper names.
+ * Credentials/private keys are deliberately neither accepted nor read here.
+ */
+export declare function parseLivePublicRepoProofConfig(id: PublicRepoProofId, env?: NodeJS.ProcessEnv, options?: LivePublicRepoProofParseOptions): Promise<LivePublicRepoProofConfig>;
+/** The mint-admission step invokes the existing generator-compatible CLI. */
+export declare function publicRepoProofMintCommand(config: LivePublicRepoProofConfig): {
+    bin: 'yarn';
+    args: string[];
+};
+/**
+ * Execute only after the caller opts in.  This function never creates keys or
+ * accepts secret material; Docker’s configured credential helper owns registry
+ * authentication and the existing operator config owns signing authority.
+ */
+export declare function executeMintAdmission(config: LivePublicRepoProofConfig): Promise<void>;
+/**
+ * Serialize exactly the non-secret network inputs that a separate factory
+ * runner needs. This is intentionally not the mint command: a runner must
+ * create/post, coordinate the three distinct operators, and record delivery
+ * and verdict evidence before it can claim a network proof.
+ */
+export declare function networkProofConfigDocument(config: LivePublicRepoProofConfig): PublicRepoNetworkProofDocumentV1;
+/**
+ * Launch an explicitly configured factory/network orchestrator.  The caller
+ * must supply that runner (for example, an operator-owned deployment wrapper)
+ * because mint admission alone cannot prove task posting, delivery, or a
+ * verdict. The temporary configuration contains no credential material.
+ */
+export declare function executeNetworkFactoryProof(config: LivePublicRepoProofConfig, options?: {
+    env?: NodeJS.ProcessEnv;
+    run?: NetworkFactoryRunner;
+    fetchEnvironmentSpec?: (gatewayUrl: string, cid: string) => Promise<unknown>;
+}): Promise<void>;
+export {};

package/dist/task-creator/proofs/live-proof.js

@@ -0,0 +1,419 @@
+// SPDX-License-Identifier: Apache-2.0
+import { existsSync, readFileSync } from 'node:fs';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { JINN_MONO_DIFFERENTIAL_PROOF_SOURCE, UNJS_DESTR_PUBLIC_REPO_PROOF, resolvePublicRepoProofRecipe, } from './public-repo-fixtures.js';
+import { parseMintedEnvironmentBindingV1, } from '../../solver-types/_swe-rebench-v2-minted-pool.js';
+import { createMintedEnvironmentVerifier } from '../../solver-types/_swe-rebench-v2-minted-environment-verifier.js';
+import { parseJinnDifferentialAttesterPolicyV1, } from '../environment/jinn-differential-policy.js';
+import { fetchFromIpfs } from '../../adapters/mech/ipfs.js';
+import { isAcceptedIpfsCid } from './ipfs-cid.js';
+import { bindJinnDifferentialReceiptToProof, } from './differential-receipt-bound-proof.js';
+const REQUIRED_KEYS = [
+    'JINN_TASK_CREATOR_RPC_URL',
+    'JINN_TASK_CREATOR_REGISTRY_URL',
+    'JINN_TASK_CREATOR_REGISTRY_AUTH_REF',
+    'JINN_TASK_CREATOR_MINTER_OPERATOR',
+    'JINN_TASK_CREATOR_SOLVER_OPERATOR',
+    'JINN_TASK_CREATOR_EVALUATOR_OPERATOR',
+    'JINN_TASK_CREATOR_CANDIDATES_FILE',
+];
+const JINN_DIFFERENTIAL_RECEIPT_KEYS = [
+    'JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_PATH',
+    'JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_CID',
+    'JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_HASH',
+];
+const JINN_ENVIRONMENT_POLICY_KEYS = [
+    'JINN_TASK_CREATOR_IPFS_GATEWAY_URL',
+    'JINN_TASK_CREATOR_JINN_APPROVED_ATTESTERS',
+];
+// This value is deliberately a helper *name*, not a token, password, URL, or
+// arbitrary opaque string. It is copied into both human-visible preflight
+// output and the temporary network-runner document, so allowing credential
+// material here would turn a supposedly secret-free boundary into a leak.
+const DOCKER_CREDENTIAL_HELPER_REF = /^docker-credential-[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+export function publicRepoProofFixture(id) {
+    return id === 'jinn-mono' ? JINN_MONO_DIFFERENTIAL_PROOF_SOURCE : UNJS_DESTR_PUBLIC_REPO_PROOF;
+}
+/**
+ * Parse only identifiers, endpoints, paths, and credential-helper names.
+ * Credentials/private keys are deliberately neither accepted nor read here.
+ */
+export async function parseLivePublicRepoProofConfig(id, env = process.env, options = {}) {
+    const fixture = publicRepoProofFixture(id);
+    const required = isJinnDifferentialProofSource(fixture)
+        ? [...REQUIRED_KEYS, ...JINN_DIFFERENTIAL_RECEIPT_KEYS, ...JINN_ENVIRONMENT_POLICY_KEYS]
+        : REQUIRED_KEYS;
+    const missing = required.filter((key) => !env[key]?.trim());
+    if (missing.length > 0) {
+        throw new Error(`public-repository live proof missing required configuration: ${missing.join(', ')}`);
+    }
+    const rpcUrl = validUrl(env.JINN_TASK_CREATOR_RPC_URL, 'JINN_TASK_CREATOR_RPC_URL');
+    const registryUrl = validUrl(env.JINN_TASK_CREATOR_REGISTRY_URL, 'JINN_TASK_CREATOR_REGISTRY_URL');
+    const registryCredentialRef = dockerCredentialHelperRef(env.JINN_TASK_CREATOR_REGISTRY_AUTH_REF);
+    const operators = [
+        env.JINN_TASK_CREATOR_MINTER_OPERATOR,
+        env.JINN_TASK_CREATOR_SOLVER_OPERATOR,
+        env.JINN_TASK_CREATOR_EVALUATOR_OPERATOR,
+    ];
+    if (!operators.every((value) => /^0x[0-9a-fA-F]{40}$/u.test(value))) {
+        throw new Error('public-repository live proof operator identities must be 20-byte 0x addresses');
+    }
+    if (new Set(operators.map((value) => value.toLowerCase())).size !== operators.length) {
+        throw new Error('public-repository live proof requires distinct minter, solver, and evaluator operators');
+    }
+    const candidatesFile = env.JINN_TASK_CREATOR_CANDIDATES_FILE;
+    if (!existsSync(candidatesFile)) {
+        throw new Error(`public-repository live proof candidates file does not exist: ${candidatesFile}`);
+    }
+    const differentialReceipt = isJinnDifferentialProofSource(fixture)
+        ? readJinnDifferentialReceiptReference(env)
+        : undefined;
+    const jinnAttesterPolicy = isJinnDifferentialProofSource(fixture)
+        ? parseJinnDifferentialAttesterPolicyV1(env.JINN_TASK_CREATOR_JINN_APPROVED_ATTESTERS.split(',').map((value) => value.trim()).filter(Boolean), 'JINN_TASK_CREATOR_JINN_APPROVED_ATTESTERS')
+        : undefined;
+    const ipfsGatewayUrl = isJinnDifferentialProofSource(fixture)
+        ? validUrl(env.JINN_TASK_CREATOR_IPFS_GATEWAY_URL, 'JINN_TASK_CREATOR_IPFS_GATEWAY_URL')
+        : undefined;
+    const differentialAdmission = await assertExplicitEnvironmentCandidates(candidatesFile, fixture, registryUrl, differentialReceipt, jinnAttesterPolicy && ipfsGatewayUrl ? {
+        ipfsGatewayUrl,
+        attesterPolicy: jinnAttesterPolicy,
+        fetchEnvironmentSpec: options.fetchEnvironmentSpec ?? fetchFromIpfs,
+    } : undefined);
+    return {
+        fixture,
+        rpcUrl,
+        registryUrl,
+        registryCredentialRef,
+        minterOperator: operators[0],
+        solverOperator: operators[1],
+        evaluatorOperator: operators[2],
+        candidatesFile,
+        ...(differentialAdmission ? { differentialAdmission } : {}),
+        ...(differentialAdmission && jinnAttesterPolicy && ipfsGatewayUrl ? {
+            jinnEnvironmentPolicy: {
+                ipfsGatewayUrl,
+                environment: differentialAdmission.environment,
+                approvedAttesters: jinnAttesterPolicy.approvedAttesters,
+            },
+        } : {}),
+    };
+}
+/** The mint-admission step invokes the existing generator-compatible CLI. */
+export function publicRepoProofMintCommand(config) {
+    return {
+        bin: 'yarn',
+        args: ['jinn', 'solver-nets', 'mint-tasks', 'swe-rebench-v2', '--candidates', config.candidatesFile],
+    };
+}
+/**
+ * Execute only after the caller opts in.  This function never creates keys or
+ * accepts secret material; Docker’s configured credential helper owns registry
+ * authentication and the existing operator config owns signing authority.
+ */
+export async function executeMintAdmission(config) {
+    if (process.env.JINN_TASK_CREATOR_MINT_EXECUTE !== '1') {
+        throw new Error('refusing mint admission: set JINN_TASK_CREATOR_MINT_EXECUTE=1 after reviewing the runbook');
+    }
+    const command = publicRepoProofMintCommand(config);
+    await new Promise((resolve, reject) => {
+        const child = spawn(command.bin, command.args, { cwd: process.cwd(), stdio: 'inherit' });
+        child.once('error', reject);
+        child.once('close', (code) => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`public-repository mint command exited ${code ?? 'without a status'}`));
+        });
+    });
+}
+/**
+ * Serialize exactly the non-secret network inputs that a separate factory
+ * runner needs. This is intentionally not the mint command: a runner must
+ * create/post, coordinate the three distinct operators, and record delivery
+ * and verdict evidence before it can claim a network proof.
+ */
+export function networkProofConfigDocument(config) {
+    return {
+        schemaVersion: 'jinn.task-creator.public-repo-network-proof.v1',
+        fixture: {
+            id: config.fixture.id,
+            repo: config.fixture.repo,
+            baseCommit: config.fixture.baseCommit,
+            fixCommit: config.fixture.fixCommit,
+            instanceId: config.fixture.instanceId,
+        },
+        rpcUrl: config.rpcUrl,
+        registry: { url: config.registryUrl, credentialRef: config.registryCredentialRef },
+        operators: {
+            minter: config.minterOperator,
+            solver: config.solverOperator,
+            evaluator: config.evaluatorOperator,
+        },
+        candidatesFile: config.candidatesFile,
+        ...(config.differentialAdmission ? {
+            differentialAdmission: {
+                receiptCid: config.differentialAdmission.receiptCid,
+                receiptHash: config.differentialAdmission.receiptHash,
+            },
+        } : {}),
+        ...(config.jinnEnvironmentPolicy ? { jinnEnvironmentPolicy: config.jinnEnvironmentPolicy } : {}),
+    };
+}
+/**
+ * Launch an explicitly configured factory/network orchestrator.  The caller
+ * must supply that runner (for example, an operator-owned deployment wrapper)
+ * because mint admission alone cannot prove task posting, delivery, or a
+ * verdict. The temporary configuration contains no credential material.
+ */
+export async function executeNetworkFactoryProof(config, options = {}) {
+    const env = options.env ?? process.env;
+    if (env.JINN_TASK_CREATOR_NETWORK_EXECUTE !== '1') {
+        throw new Error('refusing network/factory execution: set JINN_TASK_CREATOR_NETWORK_EXECUTE=1 after reviewing the runbook');
+    }
+    const orchestrator = env.JINN_TASK_CREATOR_NETWORK_ORCHESTRATOR;
+    if (!orchestrator || !isAbsolute(orchestrator) || !existsSync(orchestrator)) {
+        throw new Error('network/factory execution requires JINN_TASK_CREATOR_NETWORK_ORCHESTRATOR as an existing absolute executable path');
+    }
+    if (isJinnDifferentialProofSource(config.fixture)) {
+        const policy = config.jinnEnvironmentPolicy;
+        if (!policy)
+            throw new Error('Jinn network/factory execution requires the verified Jinn environment policy binding');
+        await assertJinnEnvironmentPolicyBeforeLaunch({
+            fixture: config.fixture,
+            environment: policy.environment,
+            ipfsGatewayUrl: policy.ipfsGatewayUrl,
+            attesterPolicy: { approvedAttesters: policy.approvedAttesters },
+            fetchEnvironmentSpec: options.fetchEnvironmentSpec ?? fetchFromIpfs,
+        });
+    }
+    const dir = await mkdtemp(join(tmpdir(), 'jinn-public-repo-network-proof-'));
+    const configPath = join(dir, 'network-proof.json');
+    try {
+        await writeFile(configPath, `${JSON.stringify(networkProofConfigDocument(config), null, 2)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+        const run = options.run ?? defaultNetworkFactoryRunner;
+        await run(orchestrator, ['--task-creator-public-repo-config', configPath], {
+            env: safeNetworkFactoryEnvironment(env),
+        });
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+function validUrl(value, key) {
+    try {
+        const parsed = new URL(value);
+        if (!['http:', 'https:'].includes(parsed.protocol))
+            throw new Error('scheme');
+        // This URL is printed at preflight and persisted in the temporary factory
+        // handoff. Disallow common inline credential locations rather than
+        // accidentally turning an RPC or registry token into logged config data.
+        if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+            throw new Error('credential material');
+        }
+        return parsed.toString();
+    }
+    catch {
+        throw new Error(`${key} must be an http(s) URL without credential material`);
+    }
+}
+function dockerCredentialHelperRef(value) {
+    if (!DOCKER_CREDENTIAL_HELPER_REF.test(value)) {
+        throw new Error('JINN_TASK_CREATOR_REGISTRY_AUTH_REF must name a docker credential-helper (for example docker-credential-ghcr), not credential material');
+    }
+    return value;
+}
+async function assertExplicitEnvironmentCandidates(path, fixture, registryUrl, differentialReceipt, jinnEnvironmentPolicy) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        throw new Error(`public-repository live proof candidates file is not valid JSON: ${path}`);
+    }
+    const candidates = Array.isArray(raw) ? raw : [raw];
+    if (candidates.length === 0) {
+        throw new Error('public-repository live proof candidates file must contain at least one candidate');
+    }
+    const recipe = resolvePublicRepoProofRecipe(fixture);
+    const registryHost = new URL(registryUrl).host;
+    let bound;
+    for (const [index, rawCandidate] of candidates.entries()) {
+        if (!isRecord(rawCandidate))
+            throw new Error(`candidate ${index} must be an object`);
+        const poolTask = rawCandidate['poolTask'];
+        if (!isRecord(poolTask))
+            throw new Error(`candidate ${index} requires poolTask`);
+        assertExactFixturePoolTask(poolTask, fixture, index);
+        const rawEnvironment = rawCandidate['environment'];
+        if (rawEnvironment === undefined)
+            throw new Error(`candidate ${index} requires an explicit v2 environment binding`);
+        let environment;
+        try {
+            environment = parseMintedEnvironmentBindingV1(rawEnvironment);
+        }
+        catch (error) {
+            throw new Error(`candidate ${index} has an invalid environment binding: ${errorMessage(error)}`);
+        }
+        if (environment.image.reference.startsWith('localhost:') || !environment.image.reference.startsWith(`${registryHost}/`)) {
+            throw new Error(`candidate ${index} environment image must bind the configured registry host ${registryHost}`);
+        }
+        if (environment.parser.id !== recipe.parser.id ||
+            environment.parser.version !== recipe.parser.version ||
+            environment.parser.digest !== recipe.parser.digest ||
+            environment.parser.bundleId !== recipe.parser.bundleId) {
+            throw new Error(`candidate ${index} environment parser does not match the approved ${recipe.recipeId} recipe`);
+        }
+        if (isJinnDifferentialProofSource(fixture)) {
+            if (!differentialReceipt) {
+                throw new Error('Jinn proof candidate requires a generated differential receipt reference');
+            }
+            if (!jinnEnvironmentPolicy) {
+                throw new Error('Jinn proof candidate requires an approved attester policy and IPFS gateway');
+            }
+            await assertJinnEnvironmentPolicyBeforeLaunch({
+                fixture,
+                environment,
+                ipfsGatewayUrl: jinnEnvironmentPolicy.ipfsGatewayUrl,
+                attesterPolicy: jinnEnvironmentPolicy.attesterPolicy,
+                fetchEnvironmentSpec: jinnEnvironmentPolicy.fetchEnvironmentSpec,
+            });
+            if (rawCandidate['fixCommit'] !== fixture.fixCommit) {
+                throw new Error(`candidate ${index} fixCommit must equal reviewed Jinn fix ${fixture.fixCommit}`);
+            }
+            const testPatch = poolTask['test_patch'];
+            if (typeof testPatch !== 'string')
+                throw new Error(`candidate ${index} poolTask.test_patch must be a string`);
+            const candidateAdmission = rawCandidate['differentialAdmission'];
+            if (!isRecord(candidateAdmission) || candidateAdmission['receipt'] === undefined) {
+                throw new Error(`candidate ${index} requires the generated differential admission receipt content`);
+            }
+            if (candidateAdmission['receiptHash'] !== differentialReceipt.receiptHash) {
+                throw new Error(`candidate ${index} differential receipt hash does not match the configured generated receipt`);
+            }
+            if (candidateAdmission['receiptCid'] !== differentialReceipt.receiptCid) {
+                throw new Error(`candidate ${index} differential receipt CID does not match the configured generated receipt CID`);
+            }
+            const candidateReceipt = candidateAdmission['receipt'];
+            const current = await bindJinnDifferentialReceiptToProof({
+                source: fixture,
+                receipt: differentialReceipt.rawReceipt,
+                receiptCid: differentialReceipt.receiptCid,
+                receiptHash: differentialReceipt.receiptHash,
+                environment,
+                testPatch,
+            });
+            const candidate = await bindJinnDifferentialReceiptToProof({
+                source: fixture,
+                receipt: candidateReceipt,
+                receiptCid: differentialReceipt.receiptCid,
+                receiptHash: differentialReceipt.receiptHash,
+                environment,
+                testPatch,
+            });
+            if (candidate.receiptHash !== current.receiptHash) {
+                throw new Error(`candidate ${index} differential receipt content does not match the configured generated receipt`);
+            }
+            if (bound && bound.receiptHash !== current.receiptHash) {
+                throw new Error('Jinn proof candidates must bind one generated differential receipt');
+            }
+            bound = current;
+        }
+    }
+    return bound;
+}
+function assertExactFixturePoolTask(poolTask, fixture, index) {
+    const expected = {
+        instance_id: fixture.instanceId,
+        repo: fixture.repo,
+        base_commit: fixture.baseCommit,
+        language: fixture.language,
+    };
+    for (const [field, value] of Object.entries(expected)) {
+        if (poolTask[field] !== value) {
+            throw new Error(`candidate ${index} poolTask.${field} must equal selected fixture ${value}`);
+        }
+    }
+    if (typeof poolTask['test_patch'] !== 'string' || poolTask['test_patch'].trim() === '') {
+        throw new Error(`candidate ${index} poolTask.test_patch must be a non-empty public test patch`);
+    }
+    if (isJinnDifferentialProofSource(fixture) && poolTask['fix_commit'] !== fixture.fixCommit) {
+        throw new Error(`candidate ${index} poolTask.fix_commit must equal reviewed Jinn fix ${fixture.fixCommit}`);
+    }
+}
+function isJinnDifferentialProofSource(fixture) {
+    return fixture.evidenceKind === 'differential-admission-receipt-required';
+}
+function readJinnDifferentialReceiptReference(env) {
+    const path = env.JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_PATH;
+    const receiptCid = env.JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_CID;
+    const receiptHash = env.JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_HASH;
+    if (!isAcceptedIpfsCid(receiptCid)) {
+        throw new Error('JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_CID must be an IPFS CID');
+    }
+    if (!/^sha256:[0-9a-f]{64}$/u.test(receiptHash)) {
+        throw new Error('JINN_TASK_CREATOR_DIFFERENTIAL_RECEIPT_HASH must be a sha256 digest');
+    }
+    try {
+        return {
+            rawReceipt: JSON.parse(readFileSync(path, 'utf8')),
+            receiptCid,
+            receiptHash: receiptHash,
+        };
+    }
+    catch (error) {
+        throw new Error(`could not read generated Jinn differential receipt ${path}: ${errorMessage(error)}`);
+    }
+}
+async function assertJinnEnvironmentPolicyBeforeLaunch(args) {
+    const verifier = createMintedEnvironmentVerifier({
+        ipfsGatewayUrl: args.ipfsGatewayUrl,
+        fetchEnvironmentSpec: args.fetchEnvironmentSpec,
+        jinnDifferentialAttesterPolicy: args.attesterPolicy,
+    });
+    const poolTask = {
+        instance_id: args.fixture.instanceId,
+        repo: args.fixture.repo,
+        base_commit: args.fixture.baseCommit,
+    };
+    await verifier.verify({
+        binding: args.environment,
+        poolTask: poolTask,
+    });
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+const defaultNetworkFactoryRunner = (bin, args, options) => new Promise((resolve, reject) => {
+    const child = spawn(bin, args, { cwd: process.cwd(), env: options.env, stdio: 'inherit' });
+    child.once('error', reject);
+    child.once('close', (code) => {
+        if (code === 0)
+            resolve();
+        else
+            reject(new Error(`network/factory orchestrator exited ${code ?? 'without a status'}`));
+    });
+});
+/**
+ * The runner receives only configuration references plus the minimal process
+ * plumbing needed for Docker credential helpers and an existing operator home.
+ * It never inherits private-key, password, or arbitrary secret variables from
+ * this wrapper.
+ */
+function safeNetworkFactoryEnvironment(source) {
+    const safe = {};
+    for (const key of ['PATH', 'HOME', 'JINN_HOME', 'DOCKER_CONFIG', 'SSL_CERT_FILE', 'SSL_CERT_DIR', 'TMPDIR', 'TMP', 'TEMP']) {
+        if (source[key] !== undefined)
+            safe[key] = source[key];
+    }
+    return safe;
+}
+//# sourceMappingURL=live-proof.js.map

package/dist/task-creator/proofs/live-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-proof.js","sourceRoot":"","sources":["../../../src/task-creator/proofs/live-proof.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,4BAA4B,GAG7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,+BAA+B,GAEhC,MAAM,mDAAmD,CAAC;AAE3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,mEAAmE,CAAC;AACpH,OAAO,EACL,qCAAqC,GAEtC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,kCAAkC,GAEnC,MAAM,uCAAuC,CAAC;AA0D/C,MAAM,aAAa,GAAG;IACpB,2BAA2B;IAC3B,gCAAgC;IAChC,qCAAqC;IACrC,mCAAmC;IACnC,mCAAmC;IACnC,sCAAsC;IACtC,mCAAmC;CAC3B,CAAC;AAEX,MAAM,8BAA8B,GAAG;IACrC,6CAA6C;IAC7C,4CAA4C;IAC5C,6CAA6C;CACrC,CAAC;AAEX,MAAM,4BAA4B,GAAG;IACnC,oCAAoC;IACpC,2CAA2C;CACnC,CAAC;AAEX,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,4BAA4B,GAAG,sDAAsD,CAAC;AAE5F,MAAM,UAAU,sBAAsB,CAAC,EAAqB;IAC1D,OAAO,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,4BAA4B,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,EAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG,EACpC,UAA2C,EAAE;IAE7C,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,OAAO,CAAC;QACrD,CAAC,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,8BAA8B,EAAE,GAAG,4BAA4B,CAAC;QACxF,CAAC,CAAC,aAAa,CAAC;IAClB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gEAAgE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,yBAA0B,EAAE,2BAA2B,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,8BAA+B,EAAE,gCAAgC,CAAC,CAAC;IACpG,MAAM,qBAAqB,GAAG,yBAAyB,CAAC,GAAG,CAAC,mCAAoC,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG;QAChB,GAAG,CAAC,iCAAkC;QACtC,GAAG,CAAC,iCAAkC;QACtC,GAAG,CAAC,oCAAqC;KAC1C,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,cAAc,GAAG,GAAG,CAAC,iCAAkC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,gEAAgE,cAAc,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,OAAO,CAAC;QAChE,CAAC,CAAC,oCAAoC,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,OAAO,CAAC;QAC/D,CAAC,CAAC,qCAAqC,CACnC,GAAG,CAAC,yCAA0C,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EACtG,2CAA2C,CAC5C;QACH,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,cAAc,GAAG,6BAA6B,CAAC,OAAO,CAAC;QAC3D,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,kCAAmC,EAAE,oCAAoC,CAAC;QACzF,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,qBAAqB,GAAG,MAAM,mCAAmC,CACrE,cAAc,EACd,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,kBAAkB,IAAI,cAAc,CAAC,CAAC,CAAC;QACrC,cAAc;QACd,cAAc,EAAE,kBAAkB;QAClC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,aAAa;KACpE,CAAC,CAAC,CAAC,SAAS,CACd,CAAC;IACF,OAAO;QACL,OAAO;QACP,MAAM;QACN,WAAW;QACX,qBAAqB;QACrB,cAAc,EAAE,SAAS,CAAC,CAAC,CAAkB;QAC7C,cAAc,EAAE,SAAS,CAAC,CAAC,CAAkB;QAC7C,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAkB;QAChD,cAAc;QACd,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,qBAAqB,IAAI,kBAAkB,IAAI,cAAc,CAAC,CAAC,CAAC;YAClE,qBAAqB,EAAE;gBACrB,cAAc;gBACd,WAAW,EAAE,qBAAqB,CAAC,WAAW;gBAC9C,iBAAiB,EAAE,kBAAkB,CAAC,iBAAiB;aACxD;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC;KACrG,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAiC;IAC1E,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACzF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;;gBACrB,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,IAAI,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,OAAO;QACL,aAAa,EAAE,gDAAgD;QAC/D,OAAO,EAAE;YACP,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;YACrB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YACzB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YACnC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;SACtC;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,MAAM,CAAC,qBAAqB,EAAE;QAClF,SAAS,EAAE;YACT,MAAM,EAAE,MAAM,CAAC,cAAc;YAC7B,MAAM,EAAE,MAAM,CAAC,cAAc;YAC7B,SAAS,EAAE,MAAM,CAAC,iBAAiB;SACpC;QACD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;YACjC,qBAAqB,EAAE;gBACrB,UAAU,EAAE,MAAM,CAAC,qBAAqB,CAAC,UAAU;gBACnD,WAAW,EAAE,MAAM,CAAC,qBAAqB,CAAC,WAAW;aACtD;SACF,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAiC,EACjC,UAII,EAAE;IAEN,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,IAAI,GAAG,CAAC,iCAAiC,KAAK,GAAG,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,sCAAsC,CAAC;IAChE,IAAI,CAAC,YAAY,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,CAAC;QAC5C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QACrH,MAAM,uCAAuC,CAAC;YAC5C,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE;YAC/D,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,aAAa;SACpE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAC9F,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,2BAA2B,CAAC;QACvD,MAAM,GAAG,CAAC,YAAY,EAAE,CAAC,mCAAmC,EAAE,UAAU,CAAC,EAAE;YACzE,GAAG,EAAE,6BAA6B,CAAC,GAAG,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9E,0EAA0E;QAC1E,mEAAmE;QACnE,yEAAyE;QACzE,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,qDAAqD,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,wIAAwI,CAAC,CAAC;IAC5J,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,mCAAmC,CAChD,IAAY,EACZ,OAA8B,EAC9B,WAAmB,EACnB,mBAAkG,EAClG,qBAIC;IAED,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mEAAmE,IAAI,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,KAAoD,CAAC;IACzD,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,oBAAoB,CAAC,CAAC;QACjF,0BAA0B,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,cAAc,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,8CAA8C,CAAC,CAAC;QACpH,IAAI,WAA+D,CAAC;QACpE,IAAI,CAAC;YACH,WAAW,GAAG,+BAA+B,CAAC,cAAc,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,wCAAwC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,EAAE,CAAC;YACxH,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,6DAA6D,YAAY,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IACE,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE;YAC1C,WAAW,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO;YACpD,WAAW,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM;YAClD,WAAW,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EACtD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,mDAAmD,MAAM,CAAC,QAAQ,SAAS,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,uCAAuC,CAAC;gBAC5C,OAAO;gBACP,WAAW;gBACX,cAAc,EAAE,qBAAqB,CAAC,cAAc;gBACpD,cAAc,EAAE,qBAAqB,CAAC,cAAc;gBACpD,oBAAoB,EAAE,qBAAqB,CAAC,oBAAoB;aACjE,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,2CAA2C,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,uCAAuC,CAAC,CAAC;YAC9G,MAAM,kBAAkB,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;YACjE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjF,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,gEAAgE,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,kBAAkB,CAAC,aAAa,CAAC,KAAK,mBAAmB,CAAC,WAAW,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,4EAA4E,CAAC,CAAC;YAClH,CAAC;YACD,IAAI,kBAAkB,CAAC,YAAY,CAAC,KAAK,mBAAmB,CAAC,UAAU,EAAE,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,+EAA+E,CAAC,CAAC;YACrH,CAAC;YACD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,kCAAkC,CAAC;gBACvD,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,mBAAmB,CAAC,UAAU;gBACvC,UAAU,EAAE,mBAAmB,CAAC,UAAU;gBAC1C,WAAW,EAAE,mBAAmB,CAAC,WAAW;gBAC5C,WAAW;gBACX,SAAS;aACV,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,kCAAkC,CAAC;gBACzD,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,gBAAgB;gBACzB,UAAU,EAAE,mBAAmB,CAAC,UAAU;gBAC1C,WAAW,EAAE,mBAAmB,CAAC,WAAW;gBAC5C,WAAW;gBACX,SAAS;aACV,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,+EAA+E,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YACD,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,QAAiC,EACjC,OAA8B,EAC9B,KAAa;IAEb,MAAM,QAAQ,GAA2B;QACvC,WAAW,EAAE,OAAO,CAAC,UAAU;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,UAAU;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,aAAa,KAAK,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,4DAA4D,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,6BAA6B,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,qDAAqD,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACpC,OAA8B;IAE9B,OAAO,OAAO,CAAC,YAAY,KAAK,yCAAyC,CAAC;AAC5E,CAAC;AAED,SAAS,oCAAoC,CAC3C,GAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,2CAA4C,CAAC;IAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,0CAA2C,CAAC;IACnE,MAAM,WAAW,GAAG,GAAG,CAAC,2CAA4C,CAAC;IACrE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClD,UAAU;YACV,WAAW,EAAE,WAAiC;SAC/C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uCAAuC,CAAC,IAMtD;IACC,MAAM,QAAQ,GAAG,+BAA+B,CAAC;QAC/C,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,8BAA8B,EAAE,IAAI,CAAC,cAAc;KACpD,CAAC,CAAC;IACH,MAAM,QAAQ,GAA2D;QACvE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;QACpC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;QACvB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;KACrC,CAAC;IACF,MAAM,QAAQ,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,IAAI,CAAC,WAAW;QACzB,QAAQ,EAAE,QAAoB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,2BAA2B,GAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAChH,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3F,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3B,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,IAAI,IAAI,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,MAAyB;IAC9D,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAU,EAAE,CAAC;QACpI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}