@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/candidate-execution-workspace-admin.types.d.ts

@@ -0,0 +1,71 @@
+import type { Sha256Digest } from './canonical-hash';
+export type CandidateExecutionWorkspaceAuthorizationStatusV1 = 'READY' | 'LEASED' | 'RESETTING' | 'RETIRED' | 'REVOKED';
+export type AuthorizeCandidateExecutionWorkspaceInputV1 = {
+    readonly mode: 'first';
+    readonly sourceWorkspaceId: string;
+    readonly executionWorkspaceId: string;
+    readonly expectedGeneration: 'none';
+    readonly expectedPriorStatus: 'none';
+} | {
+    readonly mode: 'recover';
+    readonly slotId: string;
+    readonly expectedAuthorizationId: string;
+    readonly sourceWorkspaceId: string;
+    readonly executionWorkspaceId: string;
+    readonly expectedGeneration: number;
+    readonly expectedPriorStatus: 'RETIRED' | 'REVOKED';
+};
+export interface RevokeCandidateExecutionWorkspaceInputV1 {
+    readonly slotId: string;
+    readonly expectedAuthorizationId: string;
+    readonly expectedGeneration: number;
+    readonly reason: string;
+}
+export interface CandidateExecutionWorkspaceAuthorizationRefV1 {
+    readonly authorizationId: string;
+    readonly generation: number;
+    readonly status: CandidateExecutionWorkspaceAuthorizationStatusV1;
+    readonly authorizationDigest: Sha256Digest;
+}
+interface CandidateExecutionWorkspaceAdminReceiptBaseV1 {
+    readonly schemaVersion: 'nexusclaw.candidate-execution-workspace-admin-receipt/v1';
+    readonly receiptId: string;
+    readonly sourceWorkspaceId: string;
+    readonly executionWorkspaceId: string;
+    readonly slotId: string;
+    readonly actorId: string;
+    readonly stepUpProofDigest: Sha256Digest;
+    readonly idempotencyKeyHash: string;
+    readonly requestFingerprint: Sha256Digest;
+    readonly auditId: string;
+    readonly outboxId: string;
+    readonly outboxDedupeKey: string;
+    readonly outboxEventDigest: Sha256Digest;
+    readonly resultDigest: Sha256Digest;
+    readonly createdAt: string;
+}
+export type CandidateExecutionWorkspaceAdminReceiptV1 = (CandidateExecutionWorkspaceAdminReceiptBaseV1 & {
+    readonly operation: 'authorize_first';
+    readonly beforeAuthorization: null;
+    readonly afterAuthorization: CandidateExecutionWorkspaceAuthorizationRefV1 & {
+        readonly generation: 1;
+        readonly status: 'READY';
+    };
+}) | (CandidateExecutionWorkspaceAdminReceiptBaseV1 & {
+    readonly operation: 'authorize_recover';
+    readonly beforeAuthorization: CandidateExecutionWorkspaceAuthorizationRefV1 & {
+        readonly status: 'RETIRED' | 'REVOKED';
+    };
+    readonly afterAuthorization: CandidateExecutionWorkspaceAuthorizationRefV1 & {
+        readonly status: 'READY';
+    };
+}) | (CandidateExecutionWorkspaceAdminReceiptBaseV1 & {
+    readonly operation: 'revoke';
+    readonly beforeAuthorization: CandidateExecutionWorkspaceAuthorizationRefV1 & {
+        readonly status: 'READY' | 'LEASED' | 'RESETTING';
+    };
+    readonly afterAuthorization: CandidateExecutionWorkspaceAuthorizationRefV1 & {
+        readonly status: 'REVOKED';
+    };
+});
+export {};

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/candidate-execution-workspace-admin.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=candidate-execution-workspace-admin.types.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/candidate-execution-workspace-admin.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate-execution-workspace-admin.types.js","sourceRoot":"","sources":["../../src/agent-executable-assets/candidate-execution-workspace-admin.types.ts"],"names":[],"mappings":""}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/canonical-hash.d.ts

@@ -0,0 +1,124 @@
+import type { AiAuthoringContextDigestSetV1, AiAuthoringContextLockV2, AiAuthoringContextManifestV2 } from './ai-authoring-context.types';
+import type { JsonValue } from './json-value';
+/** Lowercase `sha256:<64 hex>`. */
+export type Sha256Digest = `sha256:${string}`;
+/**
+ * RFC 8785 JSON Canonicalization Scheme serialization.
+ *
+ * Implements the canonical serialization: UTF-8, lexicographic key ordering by
+ * UTF-16 code units, minimal number serialization, and string escaping per
+ * RFC 8785 §3.2.2/§3.2.3. Rejects `undefined`/`bigint`/`symbol`/`function` and
+ * non-finite numbers — only the JSON subset is canonicalizable.
+ */
+export declare function canonicalJsonString(value: JsonValue): string;
+/** SHA-256 over raw file bytes; no normalization. Returns `sha256:<hex>`. */
+export declare function rawByteDigest(bytes: Uint8Array): Sha256Digest;
+/** SHA-256 over a UTF-8 string's raw bytes. */
+export declare function rawStringDigest(s: string): Sha256Digest;
+/** SHA-256 over RFC 8785 canonical JSON of `value`, UTF-8 encoded. */
+export declare function canonicalJsonDigest(value: JsonValue): Sha256Digest;
+/**
+ * Compute the four non-recursive AI context-pack digests from the manifest and
+ * the exact raw content-file bytes it declares (design §17.1).
+ *
+ * `contentFiles` MUST contain only manifest content files. Both self files are
+ * rejected, every declared raw digest is rechecked, and undeclared/missing or
+ * duplicate paths fail closed before any composite digest is returned.
+ */
+export declare function aiAuthoringContextDigests(manifest: AiAuthoringContextManifestV2, contentFiles: Readonly<Record<string, Uint8Array>>): AiAuthoringContextDigestSetV1;
+/** Build the explicitly non-authoritative lock used by offline context packs. */
+export declare function unsignedAiAuthoringContextLock(digests: AiAuthoringContextDigestSetV1): AiAuthoringContextLockV2;
+/**
+ * `releaseItemSetDigest = SHA256(RFC8785(sorted plannedItems.map(
+ *   {itemKind,canonicalKey,checksum,descriptorHash:descriptorHash ?? null})))`.
+ * Sort key: `(itemKind, canonicalKey)`. Content-addressed — derivable before
+ * any owner UUID exists, so dry-run and stage produce identical digests.
+ */
+export interface ReleaseItemDigestInput {
+    readonly itemKind: string;
+    readonly canonicalKey: string;
+    readonly checksum: Sha256Digest;
+    readonly descriptorHash: Sha256Digest | null;
+}
+export declare function releaseItemSetDigest(items: ReadonlyArray<ReleaseItemDigestInput>): Sha256Digest;
+/**
+ * `portableBundleDigest = SHA256` over transitive semantic inventories, rows
+ * `<bundle-relative-path> NUL <semanticEntryDigest> LF` sorted by UTF-8 bytes.
+ * Excludes `bindings/` and all `.nexusclaw/` generated files. Caller supplies
+ * the already-sorted (path, digest) rows; this helper is the pure reduction.
+ */
+export declare function portableBundleDigest(rows: ReadonlyArray<{
+    readonly path: string;
+    readonly semanticEntryDigest: Sha256Digest;
+}>): Sha256Digest;
+/**
+ * `materializedItemRefsDigest` — post-stage digest that each resolver proves
+ * matches its content hash. Computed after DB refs materialise; differs from
+ * the pre-stage `releaseItemSetDigest` only by persistence fields.
+ */
+export declare function materializedItemRefsDigest(refs: ReadonlyArray<{
+    readonly itemKind: string;
+    readonly canonicalKey: string;
+    readonly revisionRef: string;
+    readonly checksum: Sha256Digest;
+    readonly descriptorHash: Sha256Digest | null;
+}>): Sha256Digest;
+/**
+ * `releaseEnvelopeDigest = SHA256(RFC8785({
+ *   releaseSetId, sourceLockDigest, releaseItemSetDigest,
+ *   materializedItemRefsDigest, evidencePayloadHash,
+ *   approvalId, previousReleaseSetId }))`.
+ */
+export declare function releaseEnvelopeDigest(input: {
+    readonly releaseSetId: string;
+    readonly sourceLockDigest: Sha256Digest;
+    readonly releaseItemSetDigest: Sha256Digest;
+    readonly materializedItemRefsDigest: Sha256Digest;
+    readonly evidencePayloadHash: Sha256Digest;
+    readonly approvalId: string;
+    readonly previousReleaseSetId?: string;
+}): Sha256Digest;
+/**
+ * `stageRequestFingerprint = SHA256(RFC8785({
+ *   sourceLockDigest, releaseItemSetDigest, materializedItemRefsDigest,
+ *   planDigest, expectedActiveReleaseSetId, expectedGeneration }))`
+ * (executable-asset design §5.3 line 1308, task 4.19).
+ *
+ * This is the **only** stage domain replay fingerprint. The
+ * `UNIQUE(workspace_id, agent_api_name, stage_request_key_hash)` index is the
+ * only replay key; `stage_request_key_hash` is the caller-supplied idempotency
+ * key hash and `stage_request_fingerprint` is this digest over the exact plan
+ * + expected head. Same key + same fingerprint replays the same candidate;
+ * same key + different fingerprint returns `IDEMPOTENCY_KEY_CONFLICT`; a new
+ * key may create a new release set with the same source lock.
+ *
+ * `expectedActiveReleaseSetId` is `'none'` when the head is NULL (first
+ * release); otherwise the active release-set id. `expectedGeneration` is the
+ * head generation the stage expects to land against.
+ */
+export declare function stageRequestFingerprint(input: {
+    readonly sourceLockDigest: Sha256Digest;
+    readonly releaseItemSetDigest: Sha256Digest;
+    readonly materializedItemRefsDigest: Sha256Digest;
+    readonly planDigest: Sha256Digest;
+    readonly expectedActiveReleaseSetId: string;
+    readonly expectedGeneration: number;
+}): Sha256Digest;
+/**
+ * Compute a self-digest over an object while EXCLUDING one or more of its own
+ * fields (e.g. `sourceLockDigest`, `releaseEnvelopeDigest`). This is the
+ * generic primitive behind `sourceLockDigest` and similar self-excluding
+ * digests: callers pass the object and the field name(s) to omit.
+ */
+export declare function selfExcludingDigest(obj: Record<string, JsonValue>, omit: ReadonlyArray<string>): Sha256Digest;
+/**
+ * RFC 6901 JSON Pointer escape helper (used by Flow input mappings and
+ * diagnostics). Escapes `~` to `~0` and `/` to `~1`.
+ */
+export declare function escapeJsonPointer(s: string): string;
+/** Parse a `sha256:<hex>` digest into its hex part; throws if malformed. */
+export declare function parseSha256(digest: string): {
+    hex: string;
+};
+/** Type guard for the `sha256:<64 hex>` literal form. */
+export declare function isSha256Digest(s: string): s is Sha256Digest;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/canonical-hash.js

@@ -0,0 +1,366 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalJsonString = canonicalJsonString;
+exports.rawByteDigest = rawByteDigest;
+exports.rawStringDigest = rawStringDigest;
+exports.canonicalJsonDigest = canonicalJsonDigest;
+exports.aiAuthoringContextDigests = aiAuthoringContextDigests;
+exports.unsignedAiAuthoringContextLock = unsignedAiAuthoringContextLock;
+exports.releaseItemSetDigest = releaseItemSetDigest;
+exports.portableBundleDigest = portableBundleDigest;
+exports.materializedItemRefsDigest = materializedItemRefsDigest;
+exports.releaseEnvelopeDigest = releaseEnvelopeDigest;
+exports.stageRequestFingerprint = stageRequestFingerprint;
+exports.selfExcludingDigest = selfExcludingDigest;
+exports.escapeJsonPointer = escapeJsonPointer;
+exports.parseSha256 = parseSha256;
+exports.isSha256Digest = isSha256Digest;
+/**
+ * Deterministic canonicalization and digest helpers.
+ *
+ * The SINGLE owner of every hash/digest algorithm on the executable-workforce
+ * surface (design §10.1, §10.3, §5.3, §17.1). Pure functions only — no Node
+ * service, database, network, or filesystem dependency. `node:crypto` is used
+ * solely as a primitive (it is a built-in, not a service).
+ *
+ * Invariants enforced here and by tests:
+ * - Hash algorithm is SHA-256; external form lowercase `sha256:<64 hex>`.
+ * - JSON hashes use RFC 8785 JSON Canonicalization Scheme (JCS) over UTF-8.
+ * - No digest field hashes itself (each formula excludes its own field).
+ * - Raw file digests use raw bytes (no silent newline/Unicode normalization).
+ */
+const node_crypto_1 = require("node:crypto");
+const contract_versions_1 = require("./contract-versions");
+const HEX = '0123456789abcdef';
+/**
+ * RFC 8785 JSON Canonicalization Scheme serialization.
+ *
+ * Implements the canonical serialization: UTF-8, lexicographic key ordering by
+ * UTF-16 code units, minimal number serialization, and string escaping per
+ * RFC 8785 §3.2.2/§3.2.3. Rejects `undefined`/`bigint`/`symbol`/`function` and
+ * non-finite numbers — only the JSON subset is canonicalizable.
+ */
+function canonicalJsonString(value) {
+    const parts = [];
+    serializeCanonical(value, parts);
+    return parts.join('');
+}
+function serializeCanonical(value, out) {
+    switch (typeof value) {
+        case 'string':
+            out.push(serializeString(value));
+            return;
+        case 'number':
+            out.push(serializeNumber(value));
+            return;
+        case 'boolean':
+            out.push(value ? 'true' : 'false');
+            return;
+        case 'object':
+            if (value === null) {
+                out.push('null');
+                return;
+            }
+            if (Array.isArray(value)) {
+                out.push('[');
+                for (let i = 0; i < value.length; i++) {
+                    if (i > 0)
+                        out.push(',');
+                    serializeCanonical(value[i], out);
+                }
+                out.push(']');
+                return;
+            }
+            serializeObject(value, out);
+            return;
+        default:
+            // undefined / bigint / symbol / function — not JSON.
+            throw new Error('canonicalJsonString: value is not JSON-serializable');
+    }
+}
+function serializeObject(obj, out) {
+    out.push('{');
+    const keys = Object.keys(obj);
+    // RFC 8785 §3.2.3: lexicographic order by UTF-16 code unit.
+    keys.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    let first = true;
+    for (const key of keys) {
+        const v = obj[key];
+        if (typeof v === 'undefined')
+            continue;
+        if (!first)
+            out.push(',');
+        first = false;
+        out.push(serializeString(key), ':');
+        serializeCanonical(v, out);
+    }
+    out.push('}');
+}
+function serializeString(s) {
+    let out = '"';
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c === 0x22)
+            out += '\\"';
+        else if (c === 0x5c)
+            out += '\\\\';
+        else if (c >= 0x20 && c < 0x7f)
+            out += s[i];
+        else if (c === 0x08)
+            out += '\\b';
+        else if (c === 0x09)
+            out += '\\t';
+        else if (c === 0x0a)
+            out += '\\n';
+        else if (c === 0x0c)
+            out += '\\f';
+        else if (c === 0x0d)
+            out += '\\r';
+        else if (c < 0x10000)
+            out += '\\u' + hex4(c);
+        else {
+            // Surrogate pair.
+            const cp = 0x10000 + (((c & 0x3ff) << 10) | (s.charCodeAt(++i) & 0x3ff));
+            out += '\\u' + hex4(0xd800 + (cp >> 10)) + '\\u' + hex4(0xdc00 + (cp & 0x3ff));
+        }
+    }
+    return out + '"';
+}
+function hex4(n) {
+    return (HEX[(n >> 12) & 0xf] +
+        HEX[(n >> 8) & 0xf] +
+        HEX[(n >> 4) & 0xf] +
+        HEX[n & 0xf]);
+}
+/**
+ * RFC 8785 §3.2.2 minimal number serialization. Uses `Number.prototype` output
+ * for the JSON numeric grammar; rejects non-finite (NaN/Infinity) values.
+ */
+function serializeNumber(n) {
+    if (!Number.isFinite(n)) {
+        throw new Error('canonicalJsonString: non-finite number is not JSON');
+    }
+    if (Object.is(n, -0))
+        return '0';
+    // JSON.stringify matches RFC 8785's required output for all finite doubles
+    // (shortest round-trip). Both engines produce the same minimal form here.
+    return JSON.stringify(n);
+}
+// ---- raw byte hashing -------------------------------------------------------
+function sha256Bytes(bytes) {
+    const h = (0, node_crypto_1.createHash)('sha256');
+    h.update(bytes);
+    return h.digest('hex');
+}
+function utf8Bytes(s) {
+    return new TextEncoder().encode(s);
+}
+/** SHA-256 over raw file bytes; no normalization. Returns `sha256:<hex>`. */
+function rawByteDigest(bytes) {
+    return `sha256:${sha256Bytes(bytes)}`;
+}
+/** SHA-256 over a UTF-8 string's raw bytes. */
+function rawStringDigest(s) {
+    return rawByteDigest(utf8Bytes(s));
+}
+/** SHA-256 over RFC 8785 canonical JSON of `value`, UTF-8 encoded. */
+function canonicalJsonDigest(value) {
+    return rawStringDigest(canonicalJsonString(value));
+}
+// ---- Composite digests (design §5.3 / §10.2 / §10.3) -----------------------
+const AI_CONTEXT_SELF_FILES = new Set([
+    'context-manifest.json',
+    'context-lock.json',
+]);
+/**
+ * Compute the four non-recursive AI context-pack digests from the manifest and
+ * the exact raw content-file bytes it declares (design §17.1).
+ *
+ * `contentFiles` MUST contain only manifest content files. Both self files are
+ * rejected, every declared raw digest is rechecked, and undeclared/missing or
+ * duplicate paths fail closed before any composite digest is returned.
+ */
+function aiAuthoringContextDigests(manifest, contentFiles) {
+    const entries = [...manifest.files];
+    const declared = new Set();
+    for (const entry of entries) {
+        if (!entry.path ||
+            AI_CONTEXT_SELF_FILES.has(entry.path) ||
+            declared.has(entry.path)) {
+            throw new Error('AI_CONTEXT_TAMPERED');
+        }
+        declared.add(entry.path);
+    }
+    const actualPaths = Object.keys(contentFiles);
+    if (actualPaths.some((path) => AI_CONTEXT_SELF_FILES.has(path)) ||
+        actualPaths.length !== declared.size ||
+        actualPaths.some((path) => !declared.has(path))) {
+        throw new Error('AI_CONTEXT_TAMPERED');
+    }
+    const rows = entries.map((entry) => {
+        const bytes = contentFiles[entry.path];
+        if (!bytes || rawByteDigest(bytes) !== entry.digest) {
+            throw new Error('AI_CONTEXT_TAMPERED');
+        }
+        return { path: entry.path, digest: entry.digest };
+    });
+    rows.sort((a, b) => Buffer.from(a.path, 'utf8').compare(Buffer.from(b.path, 'utf8')));
+    const contentDigest = rawStringDigest(rows.map((row) => `${row.path}\u0000${row.digest}\n`).join(''));
+    const { generatedAt: _generatedAt, expiresAt: _expiresAt, ...manifestContent } = manifest;
+    const manifestContentDigest = canonicalJsonDigest(manifestContent);
+    const manifestEnvelopeDigest = canonicalJsonDigest({
+        manifestContentDigest,
+        generatedAt: manifest.generatedAt,
+        expiresAt: manifest.expiresAt ?? null,
+        target: (manifest.target ?? null),
+    });
+    const lockDigest = canonicalJsonDigest({
+        contentDigest,
+        manifestContentDigest,
+        manifestEnvelopeDigest,
+    });
+    return {
+        contentDigest,
+        manifestContentDigest,
+        manifestEnvelopeDigest,
+        lockDigest,
+    };
+}
+/** Build the explicitly non-authoritative lock used by offline context packs. */
+function unsignedAiAuthoringContextLock(digests) {
+    return {
+        schemaVersion: contract_versions_1.AI_AUTHORING_CONTEXT_LOCK_SCHEMA_VERSION,
+        ...digests,
+        signatureAlgorithm: contract_versions_1.AI_CONTEXT_SIGNATURE_ALG_NONE,
+        signature: '',
+    };
+}
+function releaseItemSetDigest(items) {
+    const sorted = [...items].sort((a, b) => {
+        const k = a.itemKind.localeCompare(b.itemKind);
+        return k !== 0 ? k : a.canonicalKey.localeCompare(b.canonicalKey);
+    });
+    const projected = sorted.map((i) => ({
+        itemKind: i.itemKind,
+        canonicalKey: i.canonicalKey,
+        checksum: i.checksum,
+        descriptorHash: i.descriptorHash ?? null,
+    }));
+    return canonicalJsonDigest(projected);
+}
+/**
+ * `portableBundleDigest = SHA256` over transitive semantic inventories, rows
+ * `<bundle-relative-path> NUL <semanticEntryDigest> LF` sorted by UTF-8 bytes.
+ * Excludes `bindings/` and all `.nexusclaw/` generated files. Caller supplies
+ * the already-sorted (path, digest) rows; this helper is the pure reduction.
+ */
+function portableBundleDigest(rows) {
+    const sorted = [...rows].sort((a, b) => Buffer.from(a.path, 'utf8').compare(Buffer.from(b.path, 'utf8')));
+    let payload = '';
+    for (const r of sorted) {
+        payload += `${r.path}\u0000${r.semanticEntryDigest}\n`;
+    }
+    return rawStringDigest(payload);
+}
+/**
+ * `materializedItemRefsDigest` — post-stage digest that each resolver proves
+ * matches its content hash. Computed after DB refs materialise; differs from
+ * the pre-stage `releaseItemSetDigest` only by persistence fields.
+ */
+function materializedItemRefsDigest(refs) {
+    const sorted = [...refs].sort((a, b) => {
+        const k = a.itemKind.localeCompare(b.itemKind);
+        return k !== 0 ? k : a.canonicalKey.localeCompare(b.canonicalKey);
+    });
+    return canonicalJsonDigest(sorted.map((r) => ({
+        itemKind: r.itemKind,
+        canonicalKey: r.canonicalKey,
+        revisionRef: r.revisionRef,
+        checksum: r.checksum,
+        descriptorHash: r.descriptorHash ?? null,
+    })));
+}
+/**
+ * `releaseEnvelopeDigest = SHA256(RFC8785({
+ *   releaseSetId, sourceLockDigest, releaseItemSetDigest,
+ *   materializedItemRefsDigest, evidencePayloadHash,
+ *   approvalId, previousReleaseSetId }))`.
+ */
+function releaseEnvelopeDigest(input) {
+    const payload = {
+        releaseSetId: input.releaseSetId,
+        sourceLockDigest: input.sourceLockDigest,
+        releaseItemSetDigest: input.releaseItemSetDigest,
+        materializedItemRefsDigest: input.materializedItemRefsDigest,
+        evidencePayloadHash: input.evidencePayloadHash,
+        approvalId: input.approvalId,
+        ...(input.previousReleaseSetId !== undefined
+            ? { previousReleaseSetId: input.previousReleaseSetId }
+            : {}),
+    };
+    return canonicalJsonDigest(payload);
+}
+/**
+ * `stageRequestFingerprint = SHA256(RFC8785({
+ *   sourceLockDigest, releaseItemSetDigest, materializedItemRefsDigest,
+ *   planDigest, expectedActiveReleaseSetId, expectedGeneration }))`
+ * (executable-asset design §5.3 line 1308, task 4.19).
+ *
+ * This is the **only** stage domain replay fingerprint. The
+ * `UNIQUE(workspace_id, agent_api_name, stage_request_key_hash)` index is the
+ * only replay key; `stage_request_key_hash` is the caller-supplied idempotency
+ * key hash and `stage_request_fingerprint` is this digest over the exact plan
+ * + expected head. Same key + same fingerprint replays the same candidate;
+ * same key + different fingerprint returns `IDEMPOTENCY_KEY_CONFLICT`; a new
+ * key may create a new release set with the same source lock.
+ *
+ * `expectedActiveReleaseSetId` is `'none'` when the head is NULL (first
+ * release); otherwise the active release-set id. `expectedGeneration` is the
+ * head generation the stage expects to land against.
+ */
+function stageRequestFingerprint(input) {
+    return canonicalJsonDigest({
+        sourceLockDigest: input.sourceLockDigest,
+        releaseItemSetDigest: input.releaseItemSetDigest,
+        materializedItemRefsDigest: input.materializedItemRefsDigest,
+        planDigest: input.planDigest,
+        expectedActiveReleaseSetId: input.expectedActiveReleaseSetId,
+        expectedGeneration: input.expectedGeneration,
+    });
+}
+/**
+ * Compute a self-digest over an object while EXCLUDING one or more of its own
+ * fields (e.g. `sourceLockDigest`, `releaseEnvelopeDigest`). This is the
+ * generic primitive behind `sourceLockDigest` and similar self-excluding
+ * digests: callers pass the object and the field name(s) to omit.
+ */
+function selfExcludingDigest(obj, omit) {
+    const omitSet = new Set(omit);
+    const filtered = {};
+    for (const key of Object.keys(obj)) {
+        if (!omitSet.has(key)) {
+            filtered[key] = obj[key];
+        }
+    }
+    return canonicalJsonDigest(filtered);
+}
+/**
+ * RFC 6901 JSON Pointer escape helper (used by Flow input mappings and
+ * diagnostics). Escapes `~` to `~0` and `/` to `~1`.
+ */
+function escapeJsonPointer(s) {
+    return s.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+/** Parse a `sha256:<hex>` digest into its hex part; throws if malformed. */
+function parseSha256(digest) {
+    const m = /^sha256:([0-9a-f]{64})$/.exec(digest);
+    if (!m) {
+        throw new Error(`parseSha256: not a valid sha256 digest: ${digest}`);
+    }
+    return { hex: m[1] };
+}
+/** Type guard for the `sha256:<64 hex>` literal form. */
+function isSha256Digest(s) {
+    return /^sha256:[0-9a-f]{64}$/.test(s);
+}
+//# sourceMappingURL=canonical-hash.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/canonical-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-hash.js","sourceRoot":"","sources":["../../src/agent-executable-assets/canonical-hash.ts"],"names":[],"mappings":";;AAuCA,kDAIC;AA8GD,sCAEC;AAGD,0CAEC;AAGD,kDAEC;AAiBD,8DAiEC;AAGD,wEASC;AAeD,oDAYC;AAQD,oDAWC;AAOD,gEAsBC;AAQD,sDAqBC;AAoBD,0DAgBC;AAQD,kDAYC;AAMD,8CAEC;AAGD,kCAMC;AAGD,wCAEC;AAzbD;;;;;;;;;;;;;GAaG;AACH,6CAAoD;AACpD,2DAG6B;AAW7B,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,KAAgB;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB,EAAE,GAAa;IACzD,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACX,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,OAAO;QACT,KAAK,QAAQ;YACX,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,OAAO;QACT,KAAK,SAAS;YACZ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnC,OAAO;QACT,KAAK,QAAQ;YACX,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,IAAI,CAAC,GAAG,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACzB,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC;gBACrC,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,eAAe,CAAC,KAAkC,EAAE,GAAG,CAAC,CAAC;YACzD,OAAO;QACT;YACE,qDAAqD;YACrD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAA8B,EAAE,GAAa;IACpE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,CAAC,KAAK,WAAW;YAAE,SAAS;QACvC,IAAI,CAAC,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,KAAK,GAAG,KAAK,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACpC,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aACxB,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,MAAM,CAAC;aAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI;YAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;aACvC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,IAAI,KAAK,CAAC;aAC7B,IAAI,CAAC,GAAG,OAAO;YAAE,GAAG,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;aACxC,CAAC;YACJ,kBAAkB;YAClB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;YACzE,GAAG,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CACL,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAE;QACrB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAE;QACpB,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAE;QACpB,GAAG,CAAC,CAAC,GAAG,GAAG,CAAE,CACd,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACjC,2EAA2E;IAC3E,0EAA0E;IAC1E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAEhF,SAAS,WAAW,CAAC,KAAiB;IACpC,MAAM,CAAC,GAAS,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IACrC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,6EAA6E;AAC7E,SAAgB,aAAa,CAAC,KAAiB;IAC7C,OAAO,UAAU,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,+CAA+C;AAC/C,SAAgB,eAAe,CAAC,CAAS;IACvC,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,sEAAsE;AACtE,SAAgB,mBAAmB,CAAC,KAAgB;IAClD,OAAO,eAAe,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,+EAA+E;AAE/E,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,uBAAuB;IACvB,mBAAmB;CACpB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CACvC,QAAsC,EACtC,YAAkD;IAElD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IACE,CAAC,KAAK,CAAC,IAAI;YACX,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,IACE,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;QACpC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CACjE,CAAC;IAEF,MAAM,aAAa,GAAG,eAAe,CACnC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAC/D,CAAC;IACF,MAAM,EACJ,WAAW,EAAE,YAAY,EACzB,SAAS,EAAE,UAAU,EACrB,GAAG,eAAe,EACnB,GAAG,QAAQ,CAAC;IACb,MAAM,qBAAqB,GAAG,mBAAmB,CAC/C,eAAuC,CACxC,CAAC;IACF,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;QACjD,qBAAqB;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;QACrC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAyB;KAC1D,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,aAAa;QACb,qBAAqB;QACrB,sBAAsB;KACvB,CAAC,CAAC;IACH,OAAO;QACL,aAAa;QACb,qBAAqB;QACrB,sBAAsB;QACtB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAgB,8BAA8B,CAC5C,OAAsC;IAEtC,OAAO;QACL,aAAa,EAAE,4DAAwC;QACvD,GAAG,OAAO;QACV,kBAAkB,EAAE,iDAA6B;QACjD,SAAS,EAAE,EAAE;KACd,CAAC;AACJ,CAAC;AAeD,SAAgB,oBAAoB,CAAC,KAA4C;IAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;KACzC,CAAC,CAAC,CAAC;IACJ,OAAO,mBAAmB,CAAC,SAAsB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,oBAAoB,CAClC,IAA0F;IAE1F,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,mBAAmB,IAAI,CAAC;IACzD,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAME;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IACH,OAAO,mBAAmB,CACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;KACzC,CAAC,CAAc,CACjB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,KAQrC;IACC,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,mBAAmB,CAAC,OAAoB,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,uBAAuB,CAAC,KAOvC;IACC,OAAO,mBAAmB,CAAC;QACzB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;QAC5D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAChC,CAAC,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,GAA8B,EAC9B,IAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,CAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAqB,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,CAAS;IACzC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,4EAA4E;AAC5E,SAAgB,WAAW,CAAC,MAAc;IACxC,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AACxB,CAAC;AAED,yDAAyD;AACzD,SAAgB,cAAc,CAAC,CAAS;IACtC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC"}