@mdbase-dev/sdk 0.0.0-stage → 0.1.0-beta.149

package/dist/app-host/private-persistence.js

@@ -0,0 +1,257 @@
+/** Fixed-purpose PUBLIC bootstrap outcome custody, not account/password/secret
+ * custody. Unexported until persistent-platform/restart qualification completes. */
+import { LOCAL_APPLICATION_BUILD, localApplicationHttpOrigin } from "../application/local-build.js";
+import { decode, encode } from "../cbor.js";
+import { uuidToBytes } from "../codec.js";
+import { collectionDisplayName } from "./collection-display-name.js";
+const MAX_PLAIN = 264 * 1024;
+export const APP_PRIVATE_BOOTSTRAP_CIPHER_MAX = MAX_PLAIN + 256;
+const bad = () => new Error("app private bootstrap custody unavailable; preserve storage and reopen");
+const equal = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+const hex = (b) => Array.from(b, v => v.toString(16).padStart(2, "0")).join("");
+export class AppWebPrivateBootstrapPersistence {
+    source;
+    key;
+    store;
+    noise;
+    pins;
+    root;
+    keys;
+    aad;
+    displayName;
+    constructor(source, receipt, key, store, noise, options = {}) {
+        this.source = source;
+        this.key = key;
+        this.store = store;
+        this.noise = noise;
+        try {
+            const requestedName = options.displayName;
+            this.displayName = requestedName === undefined ? undefined : collectionDisplayName(requestedName);
+            if (this.displayName !== undefined && source.purpose !== "create")
+                throw bad();
+            this.pins = Object.freeze({ accountId: source.accountId, connectorId: source.connectorId, deviceId: source.deviceId,
+                installationId: source.installationId, collection: source.collection, purpose: source.purpose, cpOrigin: source.cpOrigin, logOrigin: source.logOrigin });
+            const ids = [this.pins.accountId, this.pins.connectorId, this.pins.deviceId, this.pins.installationId, this.pins.collection].map(uuidToBytes);
+            if (ids.some(b => b.every(v => v === 0)) || !["create", "enrol"].includes(this.pins.purpose))
+                throw bad();
+            for (const raw of [source.cpOrigin, source.logOrigin]) {
+                const u = new URL(raw), loopback = options.allowLoopbackHttp === true && u.protocol === "http:" && (LOCAL_APPLICATION_BUILD ? localApplicationHttpOrigin(raw) : ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname));
+                if ((!loopback && u.protocol !== "https:") || u.origin !== raw || u.username || u.password)
+                    throw bad();
+            }
+            if (!(source.rootPublicKey instanceof Uint8Array) || source.rootPublicKey.length !== 32 || source.rootPublicKey.every(v => v === 0))
+                throw bad();
+            this.root = new Uint8Array(source.rootPublicKey);
+            this.keys = [receipt.signPublicKey, receipt.kemPublicKey, receipt.noisePublicKey].map(b => {
+                if (!(b instanceof Uint8Array) || b.length !== 32 || b.every(v => v === 0))
+                    throw bad();
+                return new Uint8Array(b);
+            });
+            this.checkReceipt(receipt);
+            if (key.type !== "secret" || key.extractable || key.algorithm.name !== "AES-GCM" || key.algorithm.length !== 256 || !key.usages.includes("encrypt") || !key.usages.includes("decrypt"))
+                throw bad();
+            // Separate from Noise platform AAD; no nonce, token, r or secret is stored.
+            this.aad = encode(["mdbase/v1/app-private-bootstrap-platform", ...ids, this.pins.purpose, source.cpOrigin, source.logOrigin, this.root]);
+            this.check(new AbortController().signal);
+        }
+        catch {
+            throw bad();
+        }
+    }
+    check(signal) {
+        try {
+            if (signal.aborted || this.source.isCurrent() !== true || this.source.approvalMode !== "password-ak1" ||
+                !equal(this.source.rootPublicKey, this.root) || Object.entries(this.pins).some(([k, v]) => this.source[k] !== v))
+                throw bad();
+        }
+        catch {
+            throw bad();
+        }
+    }
+    checkReceipt(value) {
+        if (value.connectorId !== this.pins.connectorId || value.deviceId !== this.pins.deviceId || value.installationId !== this.pins.installationId)
+            throw bad();
+        const keys = [value.signPublicKey, value.kemPublicKey, value.noisePublicKey];
+        if (keys.some((b, i) => !(b instanceof Uint8Array) || b.length !== 32 || b.every(v => v === 0) || !equal(b, this.keys[i])))
+            throw bad();
+    }
+    commit(marker) {
+        this.checkReceipt(marker);
+        if (this.pins.purpose !== "enrol" || marker.collection !== this.pins.collection || typeof marker.acknowledged !== "boolean" ||
+            !(marker.sasCommitment instanceof Uint8Array) || marker.sasCommitment.length !== 32 || marker.sasCommitment.every(v => v === 0))
+            throw bad();
+        return new Uint8Array(marker.sasCommitment);
+    }
+    markerCopy(marker, commit) {
+        return Object.freeze({ connectorId: this.pins.connectorId, deviceId: this.pins.deviceId, installationId: this.pins.installationId,
+            collection: this.pins.collection, signPublicKey: new Uint8Array(this.keys[0]), kemPublicKey: new Uint8Array(this.keys[1]),
+            noisePublicKey: new Uint8Array(this.keys[2]), sasCommitment: new Uint8Array(commit), acknowledged: marker.acknowledged });
+    }
+    copy(metadata) {
+        if (metadata.displayName !== this.displayName || metadata.collection !== this.pins.collection || metadata.deviceId !== this.pins.deviceId || metadata.logOrigin !== this.pins.logOrigin ||
+            !(metadata.rootPublicKey instanceof Uint8Array) || !equal(metadata.rootPublicKey, this.root) || !(metadata.genesisItem instanceof Uint8Array) ||
+            !metadata.genesisItem.length || metadata.genesisItem.length > 256 * 1024 || !/^sha256:[0-9a-f]{64}$/.test(metadata.expectedGenesis) ||
+            metadata.approval !== (this.pins.purpose === "create" ? "creator" : "pending"))
+            throw bad();
+        return Object.freeze({ collection: this.pins.collection, deviceId: this.pins.deviceId, logOrigin: this.pins.logOrigin,
+            rootPublicKey: new Uint8Array(this.root), genesisItem: new Uint8Array(metadata.genesisItem), expectedGenesis: metadata.expectedGenesis, approval: metadata.approval,
+            ...(this.displayName === undefined ? {} : { displayName: this.displayName }) });
+    }
+    async hashChecked(metadata, signal) {
+        const domain = new TextEncoder().encode("mdbase/v1/chain"), bytes = new Uint8Array(1 + domain.length + metadata.genesisItem.length);
+        bytes[0] = domain.length;
+        bytes.set(domain, 1);
+        bytes.set(metadata.genesisItem, 1 + domain.length);
+        const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+        this.check(signal);
+        if (metadata.expectedGenesis !== `sha256:${hex(hash)}`)
+            throw bad(); // not native signature verification
+    }
+    async read(options) {
+        let plain = null;
+        try {
+            this.check(options.signal);
+            const borrowed = await this.store.read(options);
+            this.check(options.signal);
+            if (borrowed === null)
+                return null;
+            if (!(borrowed instanceof Uint8Array) || !borrowed.length || borrowed.length > APP_PRIVATE_BOOTSTRAP_CIPHER_MAX)
+                throw bad();
+            const encrypted = new Uint8Array(borrowed), decodedOuter = decode(encrypted);
+            if (!(decodedOuter instanceof Map))
+                throw bad();
+            const outer = decodedOuter;
+            if (outer.size !== 3 || outer.get(0) !== 1)
+                throw bad();
+            const iv = outer.get(1), body = outer.get(2);
+            if (!(iv instanceof Uint8Array) || iv.length !== 12 || !(body instanceof Uint8Array) || body.length < 16 || body.length > MAX_PLAIN + 16)
+                throw bad();
+            plain = new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: new Uint8Array(iv), additionalData: new Uint8Array(this.aad), tagLength: 128 }, this.key, new Uint8Array(body)));
+            this.check(options.signal);
+            if (plain.length > MAX_PLAIN)
+                throw bad();
+            const decodedRecord = decode(plain);
+            if (!(decodedRecord instanceof Map))
+                throw bad();
+            const record = decodedRecord;
+            const legacy = record.get(0) === 1 && record.size === 4;
+            if (!legacy && !(record.get(0) === 2 && record.size === 5))
+                throw bad();
+            if ((legacy ? null : record.get(4)) !== (this.displayName ?? null))
+                throw bad();
+            const keys = record.get(1);
+            if (!Array.isArray(keys) || keys.length !== 3 || keys.some((b, i) => !(b instanceof Uint8Array) || !equal(b, this.keys[i])))
+                throw bad();
+            const commit = record.get(2);
+            if (this.pins.purpose === "create" ? commit !== null : !(commit instanceof Uint8Array) || commit.length !== 32 || commit.every(v => v === 0))
+                throw bad();
+            const raw = record.get(3);
+            let metadata = null;
+            if (raw !== null) {
+                if (!Array.isArray(raw) || raw.length !== 2 || !(raw[0] instanceof Uint8Array) || typeof raw[1] !== "string")
+                    throw bad();
+                metadata = this.copy({ ...this.pins, rootPublicKey: this.root, genesisItem: raw[0], expectedGenesis: raw[1], approval: this.pins.purpose === "create" ? "creator" : "pending",
+                    ...(this.displayName === undefined ? {} : { displayName: this.displayName }) });
+                await this.hashChecked(metadata, options.signal);
+            }
+            return { encrypted, value: { commit: commit === null ? null : new Uint8Array(commit), metadata } };
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            plain?.fill(0);
+        }
+    }
+    async write(value, expected, options) {
+        let plain = null, encrypted = null;
+        try {
+            this.check(options.signal);
+            plain = encode(new Map([[0, 2], [1, this.keys.map(b => new Uint8Array(b))], [2, value.commit],
+                [3, value.metadata === null ? null : [value.metadata.genesisItem, value.metadata.expectedGenesis]], [4, this.displayName ?? null]]));
+            if (plain.length > MAX_PLAIN)
+                throw bad();
+            const iv = crypto.getRandomValues(new Uint8Array(12));
+            const body = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: new Uint8Array(this.aad), tagLength: 128 }, this.key, new Uint8Array(plain)));
+            this.check(options.signal);
+            encrypted = encode(new Map([[0, 1], [1, iv], [2, body]]));
+            const stored = await this.store.compareAndSet(expected, encrypted, options);
+            this.check(options.signal);
+            if (stored !== true)
+                throw bad(); // unknown/applied-then-thrown remains preserved; no retry/undo
+        }
+        catch {
+            throw bad();
+        }
+        finally {
+            plain?.fill(0);
+            encrypted?.fill(0);
+        }
+    }
+    async pendingCreate(scope, options) {
+        this.check(options.signal);
+        this.checkReceipt(scope);
+        if (this.pins.purpose !== "create" || scope.collection !== this.pins.collection || scope.displayName !== this.displayName)
+            throw bad();
+        const existing = await this.read(options);
+        this.check(options.signal);
+        if (existing)
+            return;
+        await this.write({ commit: null, metadata: null }, null, options);
+    }
+    async privateEnrolPending(marker, options) {
+        this.check(options.signal);
+        const commit = this.commit(marker), owned = this.markerCopy(marker, commit);
+        if (owned.acknowledged)
+            throw bad();
+        const existing = await this.read(options);
+        this.check(options.signal);
+        if (existing && !equal(existing.value.commit, commit))
+            throw bad();
+        try {
+            await this.noise.privateEnrolPending(owned, options);
+            this.check(options.signal);
+        }
+        catch {
+            throw bad();
+        }
+        if (!existing)
+            await this.write({ commit, metadata: null }, null, options);
+    }
+    async completed(metadata, options) {
+        this.check(options.signal);
+        const owned = this.copy(metadata);
+        await this.hashChecked(owned, options.signal);
+        const existing = await this.read(options);
+        this.check(options.signal);
+        if (!existing)
+            throw bad();
+        if (existing.value.metadata) {
+            if (!equal(existing.value.metadata.genesisItem, owned.genesisItem) || existing.value.metadata.expectedGenesis !== owned.expectedGenesis)
+                throw bad();
+            return;
+        }
+        await this.write({ ...existing.value, metadata: owned }, existing.encrypted, options);
+    }
+    async privateEnrolAcknowledged(marker, options) {
+        this.check(options.signal);
+        const commit = this.commit(marker), owned = this.markerCopy(marker, commit);
+        const existing = await this.read(options);
+        this.check(options.signal);
+        if (!existing?.value.metadata || !equal(existing.value.commit, commit))
+            throw bad();
+        try {
+            await this.noise.privateEnrolAcknowledged(owned, options);
+            this.check(options.signal);
+        }
+        catch {
+            throw bad();
+        }
+    }
+    async restoredCompletion(options) {
+        const existing = await this.read(options);
+        this.check(options.signal);
+        return existing?.value.metadata ? this.copy(existing.value.metadata) : null;
+    }
+}
+//# sourceMappingURL=private-persistence.js.map

package/dist/app-host/private-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-persistence.js","sourceRoot":"","sources":["../../src/app-host/private-persistence.ts"],"names":[],"mappings":"AAAA;oFACoF;AACpF,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AACpG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAkB,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;AAC7B,MAAM,CAAC,MAAM,gCAAgC,GAAG,SAAS,GAAG,GAAG,CAAC;AAChE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;AACtG,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,CAAa,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvG,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAS5F,MAAM,OAAO,iCAAiC;IAMf;IACV;IAAiC;IACjC;IAPF,IAAI,CAAuL;IAC3L,IAAI,CAAa;IACjB,IAAI,CAAwB;IAC5B,GAAG,CAAa;IAChB,WAAW,CAAqB;IACjD,YAA6B,MAA2B,EAAE,OAAqC,EAC5E,GAAc,EAAmB,KAAwC,EACzE,KAAmF,EACpG,UAAiE,EAAE;QAHxC,WAAM,GAAN,MAAM,CAAqB;QACrC,QAAG,GAAH,GAAG,CAAW;QAAmB,UAAK,GAAL,KAAK,CAAmC;QACzE,UAAK,GAAL,KAAK,CAA8E;QAEpG,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC;YAC1C,IAAI,CAAC,WAAW,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YAClG,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC/E,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACjH,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3J,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9I,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC1G,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1N,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;oBAAE,MAAM,GAAG,EAAE,CAAC;YAC1G,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACjJ,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACxF,IAAI,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBAAE,MAAM,GAAG,EAAE,CAAC;gBAAC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;YACpH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAK,GAAG,CAAC,SAA6B,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACzN,4EAA4E;YAC5E,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,0CAA0C,EAAE,GAAG,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACzI,IAAI,CAAC,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;IAC1B,CAAC;IACO,KAAK,CAAC,MAAmB;QAC/B,IAAI,CAAC;YAAC,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,cAAc;gBACzG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAA8B,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;QAC/J,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;IACxB,CAAC;IACO,YAAY,CAAC,KAAmC;QACtD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,MAAM,GAAG,EAAE,CAAC;QAC3J,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7E,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;IAC3I,CAAC;IACO,MAAM,CAAC,MAAsC;QACnD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS;YACzH,CAAC,CAAC,MAAM,CAAC,aAAa,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QAC/I,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IACO,UAAU,CAAC,MAAsC,EAAE,MAAkB;QAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;YAC/H,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,YAAY,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;YAC3H,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,EAAE,aAAa,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/H,CAAC;IACO,IAAI,CAAC,QAAqC;QAChD,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS;YACrL,CAAC,CAAC,QAAQ,CAAC,aAAa,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,YAAY,UAAU,CAAC;YAC7I,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YACnI,QAAQ,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QAC9F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YACnH,aAAa,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YACnK,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAC,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACO,KAAK,CAAC,WAAW,CAAC,QAAqC,EAAE,MAAmB;QAClF,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpI,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,eAAe,KAAK,UAAU,GAAG,CAAC,IAAI,CAAC,EAAE;YAAE,MAAM,GAAG,EAAE,CAAC,CAAC,oCAAoC;IAC3G,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,OAAgC;QACjD,IAAI,KAAK,GAAsB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxG,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,CAAC,CAAC,QAAQ,YAAY,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,gCAAgC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAC7H,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC,CAAC,YAAY,YAAY,GAAG,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,YAAyC,CAAC;YACzG,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACxD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,EAAE,YAAY,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS,GAAG,EAAE;gBAAE,MAAM,GAAG,EAAE,CAAC;YACtJ,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvN,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,GAAG,EAAE,CAAC;YAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,aAAa,YAAY,GAAG,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,aAA0C,CAAC;YAC5G,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YAChF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACtK,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,GAAG,EAAE,CAAC;YACxL,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,QAAQ,GAAuC,IAAI,CAAC;YACnF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,UAAU,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ;oBAAE,MAAM,GAAG,EAAE,CAAC;gBAC1H,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;oBAC3K,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,IAAI,CAAC,WAAW,EAAC,CAAC,EAAE,CAAC,CAAC;gBAChF,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;QACnH,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,KAAkB,EAAE,QAA2B,EAAE,OAAgC;QACnG,IAAI,KAAK,GAAsB,IAAI,EAAE,SAAS,GAAsB,IAAI,CAAC;QACzE,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3B,KAAK,GAAG,MAAM,CAAC,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;gBAC9G,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACvI,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,GAAG,EAAE,CAAC;YAAC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACjG,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACzM,SAAS,GAAG,MAAM,CAAC,IAAI,GAAG,CAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACxG,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM,GAAG,EAAE,CAAC,CAAC,+DAA+D;QACnG,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,KAAoG,EAAE,OAAgC;QACxJ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAAE,MAAM,GAAG,EAAE,CAAC;QACvI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,QAAQ;YAAE,OAAO;QAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,CAAC,mBAAmB,CAAC,MAAsC,EAAE,OAAgC;QAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,KAAK,CAAC,YAAY;YAAE,MAAM,GAAG,EAAE,CAAC;QAC7I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAO,EAAE,MAAM,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QACpE,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;QAChH,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,QAAqC,EAAE,OAAgC;QACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,GAAG,EAAE,CAAC;QAClG,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;gBAAE,MAAM,GAAG,EAAE,CAAC;YAAC,OAAO;QAC/J,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,KAAK,CAAC,wBAAwB,CAAC,MAAsC,EAAE,OAAgC;QACrG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAO,EAAE,MAAM,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QACrF,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC;QAAC,CAAC;IACvH,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,OAAgC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrJ,CAAC;CACF"}

package/dist/app-host/scoped-sign-in-session.d.ts

@@ -0,0 +1,49 @@
+import { AppWebSignInSession, type AppWebSignInSessionOptions, type AppWebSignInSnapshot } from "./web-sign-in-session.js";
+import { type AppFileAction } from "./installation-sign-in.js";
+/** Worker-owned collection actor routing. A replacement uses the SAME protected
+ * SDK sign-in/native lifecycle in a new local slot; no credential, receipt or
+ * cached listing is copied from the original installation into that slot. */
+export declare class AppScopedSignInSession<Connection> {
+    readonly original: AppWebSignInSession<Connection>;
+    private readonly scoped;
+    private readonly listeners;
+    private readonly unsubscribe;
+    private focus;
+    private approvalOwner;
+    private foreground;
+    private readonly quarantined;
+    private closing;
+    private readonly rootGuard;
+    private readonly options;
+    private readonly onAbort;
+    constructor(options: Readonly<AppWebSignInSessionOptions<Connection>>);
+    private check;
+    private changed;
+    subscribe(listener: () => void): () => void;
+    private removed;
+    private collections;
+    getSnapshot(): AppWebSignInSnapshot;
+    viewFor(id: string | null, options?: {
+        readonly bystander?: boolean;
+    }): AppWebSignInSnapshot;
+    private compose;
+    connection(id?: string | null): Connection | null;
+    heldCollections(): string[];
+    private child;
+    start(): Promise<AppWebSignInSnapshot>;
+    authorize(options?: {
+        readonly collectionHint?: string | null;
+    }): Promise<AppWebSignInSnapshot>;
+    openCollection(id: string): Promise<AppWebSignInSnapshot>;
+    releaseCollection(id: string): Promise<AppWebSignInSnapshot>;
+    forget(id: string): Promise<AppWebSignInSnapshot>;
+    deleteCollection(id: string, name: string): Promise<AppWebSignInSnapshot>;
+    requestFileAccess(id: string, actions: readonly AppFileAction[], reason: string): Promise<AppWebSignInSnapshot>;
+    pollFileAccess(requestId: string): Promise<AppWebSignInSnapshot>;
+    refreshCollectionList(): Promise<AppWebSignInSnapshot>;
+    setForeground(active: boolean): void;
+    approvalWindowClosed(): void;
+    renewExpiredPairing(): Promise<AppWebSignInSnapshot>;
+    signOut(): Promise<AppWebSignInSnapshot>;
+    close(): Promise<void>;
+}

package/dist/app-host/scoped-sign-in-session.js

@@ -0,0 +1,243 @@
+import { AppWebSignInSession } from "./web-sign-in-session.js";
+import { AppInstallationSignInError } from "./installation-sign-in.js";
+import { createAppSignInRootGuard } from "./owner.js";
+/** Worker-owned collection actor routing. A replacement uses the SAME protected
+ * SDK sign-in/native lifecycle in a new local slot; no credential, receipt or
+ * cached listing is copied from the original installation into that slot. */
+export class AppScopedSignInSession {
+    original;
+    scoped = new Map();
+    listeners = new Set();
+    unsubscribe;
+    focus = null;
+    approvalOwner = null;
+    foreground = true;
+    quarantined = new Set();
+    closing = null;
+    rootGuard;
+    options;
+    onAbort = () => { void this.close().catch(() => { }); };
+    constructor(options) {
+        // Without a lock port the original protected store still refuses opening.
+        // The bridge is private to this fixed composition, not a public bypass flag.
+        this.rootGuard = options.locks ? createAppSignInRootGuard(options.locks, options, options.signal) : null;
+        this.options = Object.freeze({ ...options, locks: this.rootGuard?.locks ?? options.locks });
+        this.original = new AppWebSignInSession(this.options);
+        this.unsubscribe = this.original.subscribe(() => this.changed());
+        options.signal.addEventListener("abort", this.onAbort, { once: true });
+    }
+    check() { if (this.closing || this.options.signal.aborted)
+        throw new AppInstallationSignInError("fenced"); }
+    changed() { if (!this.closing)
+        for (const listener of [...this.listeners])
+            try {
+                listener();
+            }
+            catch { /* publication cannot interrupt ownership */ } }
+    subscribe(listener) { this.listeners.add(listener); return () => { this.listeners.delete(listener); }; }
+    removed(session, id) {
+        return session.scopeWasRemoved(id);
+    }
+    collections() {
+        const context = this.original.scopeRecoveryContext();
+        const rows = this.original.getSnapshot().collections.filter(c => !Object.hasOwn(context?.references ?? {}, c.collectionId) && !this.removed(this.original, c.collectionId));
+        for (const [id, actor] of this.scoped)
+            if (!this.removed(actor.session, id))
+                rows.push(...actor.session.getSnapshot().collections.filter(c => c.collectionId === id));
+        return Object.freeze(rows);
+    }
+    getSnapshot() { return this.compose(this.focus); }
+    viewFor(id, options = {}) { return this.compose(id, options); }
+    compose(id, options = {}) {
+        const actor = id === null ? undefined : this.scoped.get(id);
+        const session = actor?.session ?? this.original;
+        let view = session.viewFor(id, options);
+        if (!options.bystander && this.approvalOwner?.getSnapshot().status === "authorizing")
+            view = this.approvalOwner.viewFor(id);
+        // A cancelled/expired fresh attempt is still a removed collection of the
+        // ORIGINAL signed-in account, not a global sign-out or new consent.
+        if (actor && view.status === "signed_out")
+            view = { ...this.original.viewFor(null), selectedCollectionId: null, status: "unselected", problem: null, approval: view.approval };
+        const candidates = new Set([...this.original.removedScopeIds(), ...Object.keys(this.original.scopeRecoveryContext()?.references ?? {})]);
+        const removedScopeIds = Object.freeze([...candidates].filter(cid => {
+            const scoped = this.scoped.get(cid)?.session;
+            return !scoped || this.removed(scoped, cid) || scoped.getSnapshot().status === "signed_out";
+        }));
+        const accountLabel = actor && view.problem === "recovery_account_mismatch" ? this.original.scopeRecoveryContext()?.accountLabel : null;
+        const nativeGrants = new Map((this.original.getSnapshot().signIn?.nativeGrants ?? []).map(c => [c.collection_id, c]));
+        const account = this.original.getSnapshot().signIn?.accountId;
+        for (const child of this.scoped.values())
+            for (const c of child.session.getSnapshot().signIn?.nativeGrants ?? [])
+                if (c.account_id === account)
+                    nativeGrants.set(c.collection_id, c);
+        const signIn = view.signIn ? Object.freeze({ ...view.signIn, nativeGrants: Object.freeze([...nativeGrants.values()]) }) : null;
+        return Object.freeze({ ...view, signIn, collections: this.collections(), removedScopeIds, ...(accountLabel ? { recoveryAccountLabel: accountLabel } : {}) });
+    }
+    connection(id = this.focus) {
+        if (id === null || this.closing)
+            return null;
+        const actor = this.scoped.get(id);
+        if (actor)
+            return actor.session.connection(id);
+        if (Object.hasOwn(this.original.scopeRecoveryContext()?.references ?? {}, id))
+            return null;
+        return this.original.connection(id);
+    }
+    heldCollections() { return [...new Set([...this.original.heldCollections(), ...[...this.scoped.values()].flatMap(actor => actor.session.heldCollections())])]; }
+    child(id, reference, accountId, fresh = false) {
+        const existing = this.scoped.get(id);
+        if (existing) {
+            if (existing.reference !== reference)
+                throw new AppInstallationSignInError("fenced");
+            return existing.session;
+        }
+        const session = new AppWebSignInSession({ ...this.options, owner: `${this.options.owner ?? `app:${this.options.appId}`}:scope:${reference}`,
+            requestedCreateCollections: false, freshRequestedCreateCollections: false, recoveryFor: Object.freeze({ accountId, collectionId: id }), autoSelect: "never", storeMode: fresh ? "fresh" : "existing" });
+        const stop = session.subscribe(() => this.changed());
+        this.scoped.set(id, { reference, session, stop });
+        session.setForeground(this.foreground);
+        return session;
+    }
+    async start() {
+        this.check();
+        await this.original.start();
+        this.check();
+        const context = this.original.scopeRecoveryContext();
+        if (context)
+            for (const [id, reference] of Object.entries(context.references))
+                if (reference !== null) {
+                    const session = this.child(id, reference, context.accountId);
+                    try {
+                        await session.start();
+                    }
+                    catch { /* failed original child ledger remains visibly blocked, never replaced */ }
+                    this.check();
+                }
+        this.changed();
+        return this.getSnapshot();
+    }
+    async authorize(options = {}) {
+        this.check();
+        const id = options.collectionHint ?? null;
+        if (this.approvalOwner?.getSnapshot().status === "authorizing")
+            throw new AppInstallationSignInError("busy");
+        const context = this.original.scopeRecoveryContext(), actor = id === null ? undefined : this.scoped.get(id);
+        if (id === null || !context || (!Object.hasOwn(context.references, id) && !this.removed(this.original, id))) {
+            this.approvalOwner = this.original;
+            await this.original.authorize(options);
+            this.check();
+            return this.getSnapshot();
+        }
+        this.focus = id;
+        if (this.quarantined.has(id))
+            throw new AppInstallationSignInError("recovery_required");
+        let reference = context.references[id], freshSlot = false;
+        if (actor && (this.removed(actor.session, id) || actor.session.canAbandonWrongAccount())) {
+            // Only an explicit gesture can abandon a definite pre-proof wrong-account
+            // browser attempt. Both IDs come from a NEW protected local slot, not a
+            // new window on the old IDs; the old CP pending row expires naturally.
+            // This actor has only the requested collection. Its isolated erasure
+            // cannot touch the global actor, shared journals or other scopes.
+            try {
+                const result = await actor.session.signOut();
+                if (result.signOutResult?.local !== "erased")
+                    throw new AppInstallationSignInError("recovery_required");
+                await actor.session.close();
+                actor.stop();
+                this.scoped.delete(id);
+                this.check();
+            }
+            catch (error) {
+                this.quarantined.add(id);
+                throw error;
+            }
+            const fresh = await this.original.prepareScopedRecovery(id, actor.reference);
+            this.check();
+            reference = fresh.reference;
+            freshSlot = true;
+        }
+        else if (reference === null || reference === undefined) {
+            const fresh = await this.original.prepareScopedRecovery(id);
+            this.check();
+            reference = fresh.reference;
+            freshSlot = true;
+        }
+        const session = this.child(id, reference, context.accountId, freshSlot);
+        await session.start();
+        this.check();
+        this.approvalOwner = session;
+        await session.authorize({ collectionHint: id });
+        this.check();
+        this.changed();
+        return this.getSnapshot();
+    }
+    async openCollection(id) {
+        this.check();
+        this.focus = id;
+        const actor = this.scoped.get(id);
+        if (!actor && Object.hasOwn(this.original.scopeRecoveryContext()?.references ?? {}, id))
+            throw new AppInstallationSignInError("refused");
+        await (actor?.session ?? this.original).openCollection(id);
+        this.check();
+        return this.getSnapshot();
+    }
+    async releaseCollection(id) { await (this.scoped.get(id)?.session ?? this.original).releaseCollection(id); return this.getSnapshot(); }
+    async forget(id) { await (this.scoped.get(id)?.session ?? this.original).forget(id); return this.getSnapshot(); }
+    async deleteCollection(id, name) { await (this.scoped.get(id)?.session ?? this.original).deleteCollection(id, name); return this.getSnapshot(); }
+    async requestFileAccess(id, actions, reason) { await (this.scoped.get(id)?.session ?? this.original).requestFileAccess(id, actions, reason); return this.getSnapshot(); }
+    async pollFileAccess(requestId) {
+        const session = [...this.scoped.values()].find(actor => actor.session.getSnapshot().fileAccess?.requestId === requestId)?.session ?? this.original;
+        await session.pollFileAccess(requestId);
+        return this.getSnapshot();
+    }
+    async refreshCollectionList() {
+        await this.original.refreshCollectionList();
+        for (const actor of this.scoped.values()) {
+            this.check();
+            await actor.session.refreshCollectionList();
+        }
+        this.changed();
+        return this.getSnapshot();
+    }
+    setForeground(active) { this.check(); this.foreground = active; this.original.setForeground(active); for (const actor of this.scoped.values())
+        actor.session.setForeground(active); }
+    approvalWindowClosed() { (this.approvalOwner ?? this.original).approvalWindowClosed(); }
+    async renewExpiredPairing() { await (this.approvalOwner ?? this.original).renewExpiredPairing(); return this.getSnapshot(); }
+    async signOut() {
+        this.check();
+        for (const [id, actor] of this.scoped) {
+            const result = await actor.session.signOut();
+            if (result.signOutResult?.local !== "erased") {
+                this.quarantined.add(id);
+                throw new AppInstallationSignInError("recovery_required");
+            }
+            await actor.session.close();
+            actor.stop();
+            this.scoped.delete(id);
+        }
+        await this.original.signOut();
+        this.focus = null;
+        this.approvalOwner = null;
+        this.quarantined.clear();
+        this.changed();
+        return this.getSnapshot();
+    }
+    close() {
+        if (this.closing)
+            return this.closing;
+        this.closing = Promise.resolve().then(async () => {
+            for (const actor of this.scoped.values()) {
+                await actor.session.close();
+                actor.stop();
+            }
+            await this.original.close();
+            await this.rootGuard?.close();
+            this.options.signal.removeEventListener("abort", this.onAbort);
+            this.unsubscribe();
+            this.scoped.clear();
+            this.listeners.clear();
+        });
+        return this.closing;
+    }
+}
+//# sourceMappingURL=scoped-sign-in-session.js.map

package/dist/app-host/scoped-sign-in-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-sign-in-session.js","sourceRoot":"","sources":["../../src/app-host/scoped-sign-in-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,mBAAmB,EAA6D,MAAM,0BAA0B,CAAC;AACzH,OAAO,EAAC,0BAA0B,EAAqB,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAEpD;;6EAE6E;AAC7E,MAAM,OAAO,sBAAsB;IACxB,QAAQ,CAAkC;IAClC,MAAM,GAAG,IAAI,GAAG,EAA2F,CAAC;IAC5G,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAClC,WAAW,CAAa;IACjC,KAAK,GAAkB,IAAI,CAAC;IAC5B,aAAa,GAA2C,IAAI,CAAC;IAC7D,UAAU,GAAG,IAAI,CAAC;IACT,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,OAAO,GAAyB,IAAI,CAAC;IAC5B,SAAS,CAAqD;IAC9D,OAAO,CAAmD;IAC1D,OAAO,GAAG,GAAG,EAAE,GAAE,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA2C,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC;IAC/G,YAAY,OAAyD;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzG,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,EAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAC,IAAI,EAAE,IAAI,EAAC,CAAC,CAAC;IACvE,CAAC;IACO,KAAK,KAAU,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC;IAChH,OAAO,KAAU,IAAI,CAAC,IAAI,CAAC,OAAO;QAAC,KAAI,MAAM,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAAC,IAAI,CAAC;gBAAA,QAAQ,EAAE,CAAC;YAAA,CAAC;YAAC,MAAM,CAAC,CAAA,4CAA4C,CAAA,CAAC,CAAA,CAAC;IAC5J,SAAS,CAAC,QAAoB,IAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,GAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA,CAAC,CAAC,CAAA,CAAC;IACpH,OAAO,CAAC,OAAwC,EAAE,EAAU;QAClE,OAAO,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IACO,WAAW;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5K,KAAI,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM;YAAC,IAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC;QAClK,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,WAAW,KAA0B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC;IACtE,OAAO,CAAC,EAAiB,EAAE,UAA0C,EAAE,IAAyB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA,CAAC;IAC1H,OAAO,CAAC,EAAiB,EAAE,UAA0C,EAAE;QAC7E,MAAM,KAAK,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC;QAChD,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,MAAM,KAAK,aAAa;YAAE,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5H,yEAAyE;QACzE,oEAAoE;QACpE,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY;YAAE,IAAI,GAAG,EAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAC,CAAC;QAC7K,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzI,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;YAC7C,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,YAAY,CAAC;QAC9F,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,YAAY,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QACvI,MAAM,YAAY,GAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,CAAC,aAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,MAAM,OAAO,GAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5D,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAC,KAAI,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE;gBAAC,IAAG,CAAC,CAAC,UAAU,KAAG,OAAO;oBAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAC,CAAC,CAAC,CAAC;QAC5K,MAAM,MAAM,GAAC,IAAI,CAAC,MAAM,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,IAAI,CAAC,MAAM,EAAC,YAAY,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,EAAC,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;QACrH,OAAO,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAC,oBAAoB,EAAE,YAAY,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC;IAC3J,CAAC;IACD,UAAU,CAAC,KAAoB,IAAI,CAAC,KAAK;QACvC,IAAI,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,eAAe,KAAc,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC;IAChK,KAAK,CAAC,EAAU,EAAE,SAAiB,EAAE,SAAiB,EAAE,KAAK,GAAG,KAAK;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YAAA,IAAG,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAC,MAAM,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,QAAQ,CAAC,OAAO,CAAC;QAAA,CAAC;QAC5H,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAa,EAAC,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,SAAS,EAAE;YACpJ,0BAA0B,EAAE,KAAK,EAAE,+BAA+B,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAC,SAAS,EAAE,YAAY,EAAE,EAAE,EAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAC,CAAC,CAAC;QACvM,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC,CAAC;QAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACrD,IAAI,OAAO;YAAC,KAAI,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAC,IAAG,SAAS,KAAK,IAAI,EAAE,CAAC;oBAClG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC7D,IAAI,CAAC;wBAAA,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;oBAAA,CAAC;oBAAC,MAAM,CAAC,CAAA,0EAA0E,CAAA,CAAC;oBAC/G,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,UAAqD,EAAE;QACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC;QACxD,IAAI,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,MAAM,KAAK,aAAa;YAAE,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,KAAK,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5G,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC;YACnC,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;QACxF,IAAI,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;QAC1D,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC;YACzF,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC7C,IAAI,MAAM,CAAC,aAAa,EAAE,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;gBACxG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAA,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;QAC5I,CAAC;aAAM,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;QAC3H,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAAC,MAAM,OAAO,CAAC,SAAS,CAAC,EAAC,cAAc,EAAE,EAAE,EAAC,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/H,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,UAAU,IAAI,EAAE,EAAE,EAAE,CAAC;YAAE,MAAM,IAAI,0BAA0B,CAAC,SAAS,CAAC,CAAC;QACzI,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IACtG,CAAC;IACD,KAAK,CAAC,iBAAiB,CAAC,EAAU,IAAkC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA,CAAC;IAC5K,KAAK,CAAC,MAAM,CAAC,EAAU,IAAkC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA,CAAC;IACtJ,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,IAAY,IAAkC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA,CAAC;IAC9L,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,OAAiC,EAAE,MAAc,IAAkC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA,CAAC;IAChP,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,SAAS,KAAK,SAAS,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC;QACnJ,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IACD,KAAK,CAAC,qBAAqB;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;QAC5C,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAAA,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,MAAM,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAAA,CAAC;QACrG,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,aAAa,CAAC,MAAe,IAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;QAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA,CAAC;IAChM,oBAAoB,KAAU,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAA,CAAC;IAC5F,KAAK,CAAC,mBAAmB,KAAmC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA,CAAC;IAC1J,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAI,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,aAAa,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAAA,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,IAAI,0BAA0B,CAAC,mBAAmB,CAAC,CAAC;YAAA,CAAC;YACpI,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IACnJ,CAAC;IACD,KAAK;QACH,IAAG,IAAI,CAAC,OAAO;YAAC,OAAO,IAAI,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC/C,KAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAAA,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAA,CAAC;YACrF,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,WAAW,EAAE,CAAC;YAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/app-host/setup-engine.d.ts

@@ -0,0 +1,14 @@
+import { WasmRuntime } from "../runtime/wasm.js";
+import { type AppResourceAssessment, type AppResourceDecisions } from "./collection-control.js";
+import type { ModelResourcePlan } from "./collection-setup-types.js";
+/** Confirmed `[path, source]` rows in strictly ascending path order. */
+export type AppSetupInventory = readonly (readonly [string, string])[];
+export declare class AppSetupEngine extends WasmRuntime {
+    private readonly native;
+    private constructor();
+    static create(bytes: BufferSource): Promise<AppSetupEngine>;
+    /** Passing decisions (even `{}`) asks for the review. */
+    assess(manifest: unknown, inventory: AppSetupInventory, decisions?: AppResourceDecisions): AppResourceAssessment;
+    plan(manifest: unknown, expected: string, inventory: AppSetupInventory, decisions?: AppResourceDecisions): ModelResourcePlan;
+    private call;
+}