@namzu/sdk 48.3.1 → 50.0.0

package/dist/pals/activity/source.js

@@ -0,0 +1,235 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { parseSessionLogLine } from '../../session/log-hash.js';
+import { SessionLogChain } from '../../store/session-log/chain.js';
+import { SESSION_RECORD_MAX_BYTES } from '../../types/session/records.js';
+import { isEntityId } from '../../utils/id.js';
+import { projectPalActivity } from './projection.js';
+export class PalActivityAccessDeniedError extends Error {
+    name = 'PalActivityAccessDeniedError';
+    constructor() {
+        super('Current Pal activity observation permission is required.');
+    }
+}
+export class PalActivityIntegrityError extends Error {
+    name = 'PalActivityIntegrityError';
+    constructor() {
+        super('Pal activity journal ownership or anchor evidence is invalid or incomplete.');
+    }
+}
+export class PalActivityReadLimitError extends Error {
+    name = 'PalActivityReadLimitError';
+    constructor() {
+        super('The Pal activity byte budget cannot cover another complete record and its anchors.');
+    }
+}
+const positive = z.number().int().positive().safe();
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const pointer = z
+    .object({
+    seq: positive,
+    offset: z.number().int().nonnegative().safe(),
+    length: positive.max(SESSION_RECORD_MAX_BYTES),
+    sha256: digest,
+})
+    .strict();
+const scopeSchema = z
+    .object({
+    tenantId: z.custom((v) => isEntityId(v, 'tenant')),
+    projectId: z.custom((v) => isEntityId(v, 'project')),
+    sessionId: z.custom((v) => isEntityId(v, 'session')),
+    palId: z.string().uuid(),
+    profileRevision: positive,
+})
+    .strict();
+const cursorSchema = z
+    .object({
+    v: z.literal(1),
+    scopeHash: digest,
+    root: pointer,
+    after: pointer,
+    generation: z.number().int().nonnegative().safe(),
+})
+    .strict();
+function samePointer(one, two) {
+    return (one.seq === two.seq &&
+        one.offset === two.offset &&
+        one.length === two.length &&
+        one.sha256 === two.sha256);
+}
+function immutableCursor(value) {
+    return Object.freeze({
+        ...value,
+        root: Object.freeze({ ...value.root }),
+        after: Object.freeze({ ...value.after }),
+    });
+}
+/** Bounded original-byte reads, with current host consent and exact Pal-root admission. */
+export function createPalActivitySource(options) {
+    const scope = Object.freeze(scopeSchema.parse(options.scope));
+    const { pals, authorize, openJournal } = options;
+    if (typeof authorize !== 'function' || typeof openJournal !== 'function')
+        throw new TypeError('Pal activity requires explicit authorization and original-journal ports.');
+    return {
+        scope,
+        async read(input) {
+            const { signal } = input;
+            const maxRecords = positive.max(256).parse(input.maxRecords);
+            const maxReadBytes = positive.max(16 * 1024 * 1024).parse(input.maxReadBytes);
+            const supplied = input.cursor ? cursorSchema.parse(input.cursor) : undefined;
+            signal.throwIfAborted();
+            if ((await authorize(scope, signal)) !== true)
+                throw new PalActivityAccessDeniedError();
+            signal.throwIfAborted();
+            const definition = pals.getRevision(scope.palId, scope.profileRevision);
+            if (definition.id !== scope.palId || definition.revision !== scope.profileRevision)
+                throw new PalActivityIntegrityError();
+            const workspace = definition.workspace;
+            const scopeHash = createHash('sha256')
+                .update(JSON.stringify([
+                'pal-activity/1',
+                scope.tenantId,
+                scope.projectId,
+                scope.palId,
+                scope.profileRevision,
+                scope.sessionId,
+                workspace,
+            ]))
+                .digest('hex');
+            if (supplied && supplied.scopeHash !== scopeHash)
+                throw new PalActivityIntegrityError();
+            const journal = await openJournal(scope, signal);
+            signal.throwIfAborted();
+            if (journal.log.sessionId !== scope.sessionId)
+                throw new PalActivityIntegrityError();
+            const bytes = journal.bytes;
+            const size = await bytes.size();
+            signal.throwIfAborted();
+            if (!Number.isSafeInteger(size) || size < 1)
+                throw new PalActivityIntegrityError();
+            if ((await authorize(scope, signal)) !== true)
+                throw new PalActivityAccessDeniedError();
+            signal.throwIfAborted();
+            let readBytes = 0;
+            const read = async (offset, length) => {
+                signal.throwIfAborted();
+                if (length > maxReadBytes - readBytes)
+                    throw new PalActivityReadLimitError();
+                readBytes += length;
+                const raw = await bytes.read(offset, length);
+                signal.throwIfAborted();
+                if (raw.byteLength !== length)
+                    throw new PalActivityIntegrityError();
+                return Uint8Array.from(raw);
+            };
+            const lineAt = async (offset) => {
+                const parts = [];
+                let length = 0;
+                while (offset + length < size) {
+                    const available = maxReadBytes - readBytes;
+                    if (available === 0)
+                        throw new PalActivityReadLimitError();
+                    const chunk = await read(offset + length, Math.min(1024, available, size - offset - length));
+                    const newline = chunk.indexOf(10);
+                    const part = newline < 0 ? chunk : chunk.subarray(0, newline + 1);
+                    parts.push(part);
+                    length += part.byteLength;
+                    if (length > SESSION_RECORD_MAX_BYTES)
+                        throw new PalActivityReadLimitError();
+                    if (newline >= 0)
+                        return Buffer.concat(parts);
+                }
+                throw new PalActivityIntegrityError();
+            };
+            const first = await lineAt(0);
+            let root;
+            try {
+                root = new SessionLogChain({ head: null, sessionId: scope.sessionId }).accept(first, 0);
+            }
+            catch {
+                throw new PalActivityIntegrityError();
+            }
+            const owner = root.record;
+            if (owner.type !== 'session_started' ||
+                owner.parent ||
+                owner.forkedFrom ||
+                owner.tenantId !== scope.tenantId ||
+                owner.projectId !== scope.projectId ||
+                owner.cwd !== workspace ||
+                owner.origin?.protocol !== 'desktop' ||
+                owner.origin.externalSessionId !==
+                    JSON.stringify(['namzu-pal', scope.palId, scope.profileRevision, scope.sessionId]))
+                throw new PalActivityIntegrityError();
+            if ((await read(size - 1, 1))[0] !== 10)
+                throw new PalActivityIntegrityError();
+            let after = root.pointer;
+            let generation = root.record.gen;
+            if (supplied) {
+                const anchorEnd = supplied.after.offset + supplied.after.length;
+                if (!samePointer(root.pointer, supplied.root) ||
+                    !Number.isSafeInteger(anchorEnd) ||
+                    anchorEnd > size ||
+                    supplied.after.seq < 1 ||
+                    (supplied.after.seq > 1 && supplied.after.offset < root.pointer.length))
+                    throw new PalActivityIntegrityError();
+                let anchor;
+                try {
+                    anchor = parseSessionLogLine(await read(supplied.after.offset, supplied.after.length));
+                }
+                catch (error) {
+                    signal.throwIfAborted();
+                    if (error instanceof PalActivityReadLimitError)
+                        throw error;
+                    throw new PalActivityIntegrityError();
+                }
+                if (anchor.sha256 !== supplied.after.sha256 ||
+                    anchor.record.sessionId !== scope.sessionId ||
+                    anchor.record.seq !== supplied.after.seq ||
+                    anchor.record.gen !== supplied.generation ||
+                    (supplied.after.seq === 1 && !samePointer(supplied.after, root.pointer)))
+                    throw new PalActivityIntegrityError();
+                after = supplied.after;
+                generation = anchor.record.gen;
+            }
+            const chain = new SessionLogChain({
+                head: after,
+                sessionId: scope.sessionId,
+                gen: generation,
+            });
+            const facts = [];
+            let scannedRecords = 0;
+            while (chain.end < size && scannedRecords < maxRecords) {
+                const raw = await lineAt(chain.end);
+                let entry;
+                let fact;
+                try {
+                    entry = chain.accept(raw, chain.end);
+                    fact = projectPalActivity(entry, scopeHash);
+                }
+                catch {
+                    throw new PalActivityIntegrityError();
+                }
+                scannedRecords++;
+                if (fact)
+                    facts.push(fact);
+                after = entry.pointer;
+                generation = entry.record.gen;
+            }
+            if ((await bytes.size()) < size)
+                throw new PalActivityIntegrityError();
+            signal.throwIfAborted();
+            if ((await authorize(scope, signal)) !== true)
+                throw new PalActivityAccessDeniedError();
+            signal.throwIfAborted();
+            return Object.freeze({
+                scope,
+                facts: Object.freeze(facts),
+                cursor: immutableCursor({ v: 1, scopeHash, root: root.pointer, after, generation }),
+                complete: chain.end === size,
+                scannedRecords,
+                readBytes,
+            });
+        },
+    };
+}
+//# sourceMappingURL=source.js.map

package/dist/pals/activity/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../../src/pals/activity/source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAwB,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAsB,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAUpD,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACpC,IAAI,GAAG,8BAA8B,CAAA;IACvD;QACC,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAClE,CAAC;CACD;AACD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACjC,IAAI,GAAG,2BAA2B,CAAA;IACpD;QACC,KAAK,CAAC,6EAA6E,CAAC,CAAA;IACrF,CAAC;CACD;AACD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACjC,IAAI,GAAG,2BAA2B,CAAA;IACpD;QACC,KAAK,CAAC,oFAAoF,CAAC,CAAA;IAC5F,CAAC;CACD;AAED,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAA;AACnD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;AACjD,MAAM,OAAO,GAAG,CAAC;KACf,MAAM,CAAC;IACP,GAAG,EAAE,QAAQ;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;IAC7C,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC9C,MAAM,EAAE,MAAM;CACd,CAAC;KACD,MAAM,EAAE,CAAA;AACV,MAAM,WAAW,GAAG,CAAC;KACnB,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,MAAM,CAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAgC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAgC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACnF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACxB,eAAe,EAAE,QAAQ;CACzB,CAAC;KACD,MAAM,EAAE,CAAA;AACV,MAAM,YAAY,GAAG,CAAC;KACpB,MAAM,CAAC;IACP,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAA;AACV,SAAS,WAAW,CAAC,GAAkB,EAAE,GAAkB;IAC1D,OAAO,CACN,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;QACnB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QACzB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CACzB,CAAA;AACF,CAAC;AACD,SAAS,eAAe,CAAC,KAAwB;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,KAAK;QACR,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;KACxC,CAAC,CAAA;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,OAAiC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAChD,IAAI,OAAO,SAAS,KAAK,UAAU,IAAI,OAAO,WAAW,KAAK,UAAU;QACvE,MAAM,IAAI,SAAS,CAAC,0EAA0E,CAAC,CAAA;IAChG,OAAO;QACN,KAAK;QACL,KAAK,CAAC,IAAI,CAAC,KAA6B;YACvC,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;YACxB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAC5D,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;YAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC5E,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,4BAA4B,EAAE,CAAA;YACvF,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAA;YACvE,IAAI,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC,eAAe;gBACjF,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACtC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YACtC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;iBACpC,MAAM,CACN,IAAI,CAAC,SAAS,CAAC;gBACd,gBAAgB;gBAChB,KAAK,CAAC,QAAQ;gBACd,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,KAAK;gBACX,KAAK,CAAC,eAAe;gBACrB,KAAK,CAAC,SAAS;gBACf,SAAS;aACT,CAAC,CACF;iBACA,MAAM,CAAC,KAAK,CAAC,CAAA;YACf,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACvF,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;YAChD,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACpF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;YAC3B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YAC/B,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;YAClF,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,4BAA4B,EAAE,CAAA;YACvF,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,IAAI,SAAS,GAAG,CAAC,CAAA;YACjB,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,MAAc,EAAuB,EAAE;gBAC1E,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,IAAI,MAAM,GAAG,YAAY,GAAG,SAAS;oBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;gBAC5E,SAAS,IAAI,MAAM,CAAA;gBACnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;gBAC5C,MAAM,CAAC,cAAc,EAAE,CAAA;gBACvB,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM;oBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;gBACpE,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC5B,CAAC,CAAA;YACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAuB,EAAE;gBAC5D,MAAM,KAAK,GAAiB,EAAE,CAAA;gBAC9B,IAAI,MAAM,GAAG,CAAC,CAAA;gBACd,OAAO,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;oBAC/B,MAAM,SAAS,GAAG,YAAY,GAAG,SAAS,CAAA;oBAC1C,IAAI,SAAS,KAAK,CAAC;wBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;oBAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CACvB,MAAM,GAAG,MAAM,EACf,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,CACjD,CAAA;oBACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBACjC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAA;oBACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAChB,MAAM,IAAI,IAAI,CAAC,UAAU,CAAA;oBACzB,IAAI,MAAM,GAAG,wBAAwB;wBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;oBAC5E,IAAI,OAAO,IAAI,CAAC;wBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBAC9C,CAAC;gBACD,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACtC,CAAC,CAAA;YACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAA;YAC7B,IAAI,IAAqB,CAAA;YACzB,IAAI,CAAC;gBACJ,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxF,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACtC,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAA;YACzB,IACC,KAAK,CAAC,IAAI,KAAK,iBAAiB;gBAChC,KAAK,CAAC,MAAM;gBACZ,KAAK,CAAC,UAAU;gBAChB,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;gBACjC,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;gBACnC,KAAK,CAAC,GAAG,KAAK,SAAS;gBACvB,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,SAAS;gBACpC,KAAK,CAAC,MAAM,CAAC,iBAAiB;oBAC7B,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBAEnF,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACtC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;YAC9E,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAA;YACxB,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAA;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAA;gBAC/D,IACC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACzC,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;oBAChC,SAAS,GAAG,IAAI;oBAChB,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;oBACtB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;oBAEvE,MAAM,IAAI,yBAAyB,EAAE,CAAA;gBACtC,IAAI,MAA8C,CAAA;gBAClD,IAAI,CAAC;oBACJ,MAAM,GAAG,mBAAmB,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBACvF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,CAAC,cAAc,EAAE,CAAA;oBACvB,IAAI,KAAK,YAAY,yBAAyB;wBAAE,MAAM,KAAK,CAAA;oBAC3D,MAAM,IAAI,yBAAyB,EAAE,CAAA;gBACtC,CAAC;gBACD,IACC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM;oBACvC,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;oBAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,GAAG;oBACxC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,UAAU;oBACzC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;oBAExE,MAAM,IAAI,yBAAyB,EAAE,CAAA;gBACtC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;gBACtB,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA;YAC/B,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC;gBACjC,IAAI,EAAE,KAAK;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,EAAE,UAAU;aACf,CAAC,CAAA;YACF,MAAM,KAAK,GAAsB,EAAE,CAAA;YACnC,IAAI,cAAc,GAAG,CAAC,CAAA;YACtB,OAAO,KAAK,CAAC,GAAG,GAAG,IAAI,IAAI,cAAc,GAAG,UAAU,EAAE,CAAC;gBACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;gBACnC,IAAI,KAAsB,CAAA;gBAC1B,IAAI,IAA4B,CAAA;gBAChC,IAAI,CAAC;oBACJ,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAA;oBACpC,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACR,MAAM,IAAI,yBAAyB,EAAE,CAAA;gBACtC,CAAC;gBACD,cAAc,EAAE,CAAA;gBAChB,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC1B,KAAK,GAAG,KAAK,CAAC,OAAO,CAAA;gBACrB,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA;YAC9B,CAAC;YACD,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACtE,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,4BAA4B,EAAE,CAAA;YACvF,MAAM,CAAC,cAAc,EAAE,CAAA;YACvB,OAAO,MAAM,CAAC,MAAM,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC3B,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBACnF,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI;gBAC5B,cAAc;gBACd,SAAS;aACT,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/pals/activity/subscription-policy.d.ts

@@ -0,0 +1,38 @@
+import type { PalIngressAuthorizationRequest } from '../communication/ingress-types.js';
+import type { PalMessageAuthorization } from '../communication/types.js';
+import type { PalActivitySubscriptionAuthorizationRequest, PalActivitySubscriptionStore } from './subscription-types.js';
+export interface PalActivitySubscriptionPermission {
+    readonly v: 1;
+    readonly subscriptionId: string;
+    readonly revision: number;
+    readonly observe: boolean;
+    readonly disclose: boolean;
+    readonly receive: boolean;
+    readonly wake: boolean;
+}
+export interface PalActivitySubscriptionPermissionUpdate extends Omit<PalActivitySubscriptionPermission, 'v' | 'revision'> {
+    readonly expectedRevision: number;
+}
+export declare class PalActivitySubscriptionPermissionConflictError extends Error {
+    readonly name = "PalActivitySubscriptionPermissionConflictError";
+}
+/** Explicit local operator consent. Missing rules deny and each phase rereads current records. */
+export declare class DiskPalActivitySubscriptionPolicy {
+    private readonly root;
+    private readonly secure;
+    private readonly subscriptions;
+    private readonly records;
+    constructor(options: {
+        root: string;
+        subscriptions: PalActivitySubscriptionStore;
+        secureDirectory?: (path: string) => void;
+    });
+    private directory;
+    private location;
+    private checked;
+    get(id: string): Promise<PalActivitySubscriptionPermission | null>;
+    update(input: PalActivitySubscriptionPermissionUpdate): Promise<PalActivitySubscriptionPermission>;
+    authorizeSubscription(request: PalActivitySubscriptionAuthorizationRequest): Promise<PalMessageAuthorization>;
+    authorizeIngress(input: PalIngressAuthorizationRequest): Promise<PalMessageAuthorization>;
+}
+//# sourceMappingURL=subscription-policy.d.ts.map

package/dist/pals/activity/subscription-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-policy.d.ts","sourceRoot":"","sources":["../../../src/pals/activity/subscription-policy.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAA;AAEvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAA;AAExE,OAAO,KAAK,EACX,2CAA2C,EAC3C,4BAA4B,EAC5B,MAAM,yBAAyB,CAAA;AAEhC,MAAM,WAAW,iCAAiC;IACjD,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;IACb,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACtB;AACD,MAAM,WAAW,uCAChB,SAAQ,IAAI,CAAC,iCAAiC,EAAE,GAAG,GAAG,UAAU,CAAC;IACjE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CACjC;AACD,qBAAa,8CAA+C,SAAQ,KAAK;IACxE,SAAkB,IAAI,oDAAmD;CACzE;AAoBD,kGAAkG;AAClG,qBAAa,iCAAiC;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA8B;IAC5D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAQvB;gBACW,OAAO,EAAE;QACpB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,4BAA4B,CAAA;QAC3C,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KACxC;IAUD,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,QAAQ;IAmBhB,OAAO,CAAC,OAAO;IAOT,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAIlE,MAAM,CACX,KAAK,EAAE,uCAAuC,GAC5C,OAAO,CAAC,iCAAiC,CAAC;IAkBvC,qBAAqB,CAC1B,OAAO,EAAE,2CAA2C,GAClD,OAAO,CAAC,uBAAuB,CAAC;IAkC7B,gBAAgB,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAsD/F"}

package/dist/pals/activity/subscription-policy.js

@@ -0,0 +1,183 @@
+import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { z } from 'zod';
+import { DiskRevisionRecordStore } from '../../store/kv/revision-record-store.js';
+import { defineSchema } from '../../store/schema.js';
+import { observationRouteKeySchema, observationSourceSchema, } from '../communication/ingress-schema.js';
+import { addressSchema, freezeCommunicationValue } from '../communication/schema.js';
+import { subscriptionSchema } from './subscription-schema.js';
+export class PalActivitySubscriptionPermissionConflictError extends Error {
+    name = 'PalActivitySubscriptionPermissionConflictError';
+}
+const permissionSchema = z
+    .object({
+    v: z.literal(1),
+    subscriptionId: z.string().uuid(),
+    revision: z.number().int().positive().safe(),
+    observe: z.boolean(),
+    disclose: z.boolean(),
+    receive: z.boolean(),
+    wake: z.boolean(),
+})
+    .strict();
+const updateSchema = permissionSchema
+    .omit({ v: true, revision: true })
+    .extend({ expectedRevision: z.number().int().nonnegative().safe() });
+const denied = () => ({
+    allow: false,
+    reason: 'No current permission for this exact Pal activity subscription.',
+});
+/** Explicit local operator consent. Missing rules deny and each phase rereads current records. */
+export class DiskPalActivitySubscriptionPolicy {
+    root;
+    secure;
+    subscriptions;
+    records = new DiskRevisionRecordStore(defineSchema({
+        kind: 'pal-activity-subscription-permission',
+        current: 1,
+        migrations: {},
+    }), 'Pal activity subscription permission', (value) => value.revision);
+    constructor(options) {
+        this.root = resolve(options.root);
+        this.subscriptions = options.subscriptions;
+        this.secure =
+            options.secureDirectory ??
+                ((path) => {
+                    if (process.platform !== 'win32')
+                        chmodSync(path, 0o700);
+                });
+        this.directory(this.root);
+    }
+    directory(path) {
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+        const stat = lstatSync(path);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(path) !== path)
+            throw new Error('Pal activity permissions require real directories without aliases.');
+        this.secure(path);
+    }
+    location(id) {
+        const key = z.string().uuid().parse(id);
+        this.directory(this.root);
+        const directory = join(this.root, key);
+        this.directory(directory);
+        const revisionsDir = join(directory, 'revisions');
+        this.directory(revisionsDir);
+        for (const name of readdirSync(revisionsDir)) {
+            if (!/^[1-9][0-9]*\.json$/u.test(name))
+                continue;
+            const stat = lstatSync(join(revisionsDir, name));
+            if (!stat.isFile() || stat.isSymbolicLink())
+                throw new Error('Pal permission commits must be real files.');
+        }
+        return {
+            legacyPath: join(directory, 'permission.json'),
+            revisionsDir,
+            publishLegacyProjection: false,
+        };
+    }
+    checked(input, id) {
+        const { schemaVersion: _schemaVersion, ...value } = permissionSchema
+            .extend({ schemaVersion: z.literal(1).optional() })
+            .parse(input);
+        if (value.subscriptionId !== id)
+            throw new Error('Foreign Pal subscription permission.');
+        return freezeCommunicationValue(value);
+    }
+    async get(id) {
+        const record = await this.records.read(this.location(id));
+        return record === null ? null : this.checked(record, id);
+    }
+    async update(input) {
+        const captured = updateSchema.parse(input);
+        if (!(await this.subscriptions.get(captured.subscriptionId)))
+            throw new Error('Unknown Pal activity subscription.');
+        return this.records.transact(this.location(captured.subscriptionId), (stored) => {
+            const current = stored === null ? null : this.checked(stored, captured.subscriptionId);
+            if ((current?.revision ?? 0) !== captured.expectedRevision)
+                throw new PalActivitySubscriptionPermissionConflictError('Subscription permission changed; reload before updating.');
+            const { expectedRevision, ...values } = captured;
+            const record = this.checked({ ...values, v: 1, revision: expectedRevision + 1 }, values.subscriptionId);
+            return { record, result: record };
+        });
+    }
+    async authorizeSubscription(request) {
+        const phase = z.enum(['observe', 'disclose', 'receive', 'accept']).parse(request.phase);
+        const permitted = (rule) => phase === 'accept' ? rule?.observe && rule.disclose && rule.receive : rule?.[phase];
+        const captured = freezeCommunicationValue(subscriptionSchema.parse(request.subscription));
+        const stored = await this.subscriptions.get(captured.id);
+        const subscription = stored ? freezeCommunicationValue(subscriptionSchema.parse(stored)) : null;
+        if (!subscription?.enabled ||
+            subscription.configurationRevision !== captured.configurationRevision ||
+            !isDeepStrictEqual(subscription.scope, captured.scope) ||
+            !isDeepStrictEqual(subscription.recipient, captured.recipient))
+            return denied();
+        const observed = await this.get(subscription.id);
+        if (!permitted(observed))
+            return denied();
+        const current = await this.subscriptions.get(subscription.id);
+        if (!current?.enabled ||
+            current.configurationRevision !== captured.configurationRevision ||
+            !isDeepStrictEqual(current.scope, captured.scope) ||
+            !isDeepStrictEqual(current.recipient, captured.recipient))
+            return denied();
+        const rule = await this.get(subscription.id);
+        if (!rule || !permitted(rule))
+            return denied();
+        return {
+            allow: true,
+            grant: {
+                id: `pal-subscription:${subscription.id}:${phase}`,
+                revision: String(rule.revision),
+            },
+        };
+    }
+    async authorizeIngress(input) {
+        if (!('kind' in input) || input.kind !== 'observation')
+            return denied();
+        const request = freezeCommunicationValue(z
+            .object({
+            kind: z.literal('observation'),
+            phase: z.enum(['accept', 'deliver', 'wake']),
+            source: observationSourceSchema,
+            routeKey: observationRouteKeySchema,
+            recipient: addressSchema,
+        })
+            .parse(input));
+        const id = z.string().uuid().parse(request.source.subscriptionId);
+        const phase = z.enum(['accept', 'deliver', 'wake']).parse(request.phase);
+        const stored = await this.subscriptions.get(id);
+        const subscription = stored ? freezeCommunicationValue(subscriptionSchema.parse(stored)) : null;
+        if (!subscription?.enabled ||
+            request.routeKey.kind !== 'observation' ||
+            request.routeKey.subscriptionId !== id ||
+            !isDeepStrictEqual(request.source.scope, subscription.scope) ||
+            !isDeepStrictEqual(request.routeKey.scope, subscription.scope) ||
+            !isDeepStrictEqual(request.recipient, subscription.recipient) ||
+            !isDeepStrictEqual(request.routeKey.recipient, subscription.recipient))
+            return denied();
+        const observed = await this.get(id);
+        if (!observed?.observe ||
+            !observed.disclose ||
+            !observed.receive ||
+            (phase === 'wake' && !observed.wake))
+            return denied();
+        const current = await this.subscriptions.get(id);
+        if (!current?.enabled ||
+            current.configurationRevision !== subscription.configurationRevision ||
+            !isDeepStrictEqual(current.scope, subscription.scope) ||
+            !isDeepStrictEqual(current.recipient, subscription.recipient))
+            return denied();
+        const rule = await this.get(id);
+        if (!rule?.observe || !rule.disclose || !rule.receive || (phase === 'wake' && !rule.wake))
+            return denied();
+        return {
+            allow: true,
+            grant: {
+                id: `pal-subscription:${id}:${phase}`,
+                revision: String(rule.revision),
+            },
+        };
+    }
+}
+//# sourceMappingURL=subscription-policy.js.map

package/dist/pals/activity/subscription-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscription-policy.js","sourceRoot":"","sources":["../../../src/pals/activity/subscription-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EACN,yBAAyB,EACzB,uBAAuB,GACvB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AAEpF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAmB7D,MAAM,OAAO,8CAA+C,SAAQ,KAAK;IACtD,IAAI,GAAG,gDAAgD,CAAA;CACzE;AACD,MAAM,gBAAgB,GAAG,CAAC;KACxB,MAAM,CAAC;IACP,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CACjB,CAAC;KACD,MAAM,EAAE,CAAA;AACV,MAAM,YAAY,GAAG,gBAAgB;KACnC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACjC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AACrE,MAAM,MAAM,GAAG,GAA4B,EAAE,CAAC,CAAC;IAC9C,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,iEAAiE;CACzE,CAAC,CAAA;AAEF,kGAAkG;AAClG,MAAM,OAAO,iCAAiC;IAC5B,IAAI,CAAQ;IACZ,MAAM,CAAwB;IAC9B,aAAa,CAA8B;IAC3C,OAAO,GAAG,IAAI,uBAAuB,CACrD,YAAY,CAAC;QACZ,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,EAAE;KACd,CAAC,EACF,sCAAsC,EACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CACzB,CAAA;IACD,YAAY,OAIX;QACA,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;QAC1C,IAAI,CAAC,MAAM;YACV,OAAO,CAAC,eAAe;gBACvB,CAAC,CAAC,IAAI,EAAE,EAAE;oBACT,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACzD,CAAC,CAAC,CAAA;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACO,SAAS,CAAC,IAAY;QAC7B,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC9E,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IACO,QAAQ,CAAC,EAAU;QAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACtC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;YAChD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;gBAC1C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/D,CAAC;QACD,OAAO;YACN,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAC9C,YAAY;YACZ,uBAAuB,EAAE,KAAK;SAC9B,CAAA;IACF,CAAC;IACO,OAAO,CAAC,KAAc,EAAE,EAAU;QACzC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,GAAG,gBAAgB;aAClE,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;aAClD,KAAK,CAAC,KAAK,CAAC,CAAA;QACd,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACxF,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,EAAU;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QACzD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,KAAK,CAAC,MAAM,CACX,KAA8C;QAE9C,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC1C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/E,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;YACtF,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,gBAAgB;gBACzD,MAAM,IAAI,8CAA8C,CACvD,0DAA0D,CAC1D,CAAA;YACF,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,CAAA;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAC1B,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,GAAG,CAAC,EAAE,EACnD,MAAM,CAAC,cAAc,CACrB,CAAA;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;QAClC,CAAC,CAAC,CAAA;IACH,CAAC;IACD,KAAK,CAAC,qBAAqB,CAC1B,OAAoD;QAEpD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACvF,MAAM,SAAS,GAAG,CAAC,IAA8C,EAAE,EAAE,CACpE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAA;QACpF,MAAM,QAAQ,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/F,IACC,CAAC,YAAY,EAAE,OAAO;YACtB,YAAY,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB;YACrE,CAAC,iBAAiB,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YACtD,CAAC,iBAAiB,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;YAE9D,OAAO,MAAM,EAAE,CAAA;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAChD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAC7D,IACC,CAAC,OAAO,EAAE,OAAO;YACjB,OAAO,CAAC,qBAAqB,KAAK,QAAQ,CAAC,qBAAqB;YAChE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;YACjD,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;YAEzD,OAAO,MAAM,EAAE,CAAA;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,EAAE,CAAA;QAC9C,OAAO;YACN,KAAK,EAAE,IAAI;YACX,KAAK,EAAE;gBACN,EAAE,EAAE,oBAAoB,YAAY,CAAC,EAAE,IAAI,KAAK,EAAE;gBAClD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B;SACD,CAAA;IACF,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAqC;QAC3D,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;YAAE,OAAO,MAAM,EAAE,CAAA;QACvE,MAAM,OAAO,GAAG,wBAAwB,CACvC,CAAC;aACC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YAC9B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,EAAE,uBAAuB;YAC/B,QAAQ,EAAE,yBAAyB;YACnC,SAAS,EAAE,aAAa;SACxB,CAAC;aACD,KAAK,CAAC,KAAK,CAAC,CACd,CAAA;QACD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QACjE,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC/F,IACC,CAAC,YAAY,EAAE,OAAO;YACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa;YACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,KAAK,EAAE;YACtC,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;YAC5D,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;YAC9D,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;YAC7D,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;YAEtE,OAAO,MAAM,EAAE,CAAA;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnC,IACC,CAAC,QAAQ,EAAE,OAAO;YAClB,CAAC,QAAQ,CAAC,QAAQ;YAClB,CAAC,QAAQ,CAAC,OAAO;YACjB,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAEpC,OAAO,MAAM,EAAE,CAAA;QAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChD,IACC,CAAC,OAAO,EAAE,OAAO;YACjB,OAAO,CAAC,qBAAqB,KAAK,YAAY,CAAC,qBAAqB;YACpE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;YACrD,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;YAE7D,OAAO,MAAM,EAAE,CAAA;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACxF,OAAO,MAAM,EAAE,CAAA;QAChB,OAAO;YACN,KAAK,EAAE,IAAI;YACX,KAAK,EAAE;gBACN,EAAE,EAAE,oBAAoB,EAAE,IAAI,KAAK,EAAE;gBACrC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC/B;SACD,CAAA;IACF,CAAC;CACD"}