@openrig/cli 0.4.8 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatch-buffer.js

@@ -0,0 +1,64 @@
+// M1 A4a — the gateway-side DISPATCH BUFFER: durable OutboundDecisions held until the
+// connector Acks (contract a305310d). This is what makes connector-outage -> no-loss ->
+// ack-gated drain PROVABLE (proof-9). It is a DISTINCT store from the connector-side
+// slice-11 delivery ledger (SeenStore/DeadLetterStore) — the two are NEVER merged
+// (conflating them re-creates the drift class the arch verdict called out).
+//
+// Durability = the slice-11 atomic pattern (write a temp sibling + rename): a decision is
+// persisted BEFORE it is dispatched, and removed ONLY after its Ack. decisionId is the
+// idempotency key — re-dispatching an un-Acked decision produces a byte-identical dup.
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getOpenRigHome } from "../../openrig-compat.js";
+export function dispatchBufferPath(home = getOpenRigHome()) {
+    return join(home, "gateway", "dispatch-buffer.json");
+}
+function readState(path) {
+    if (!existsSync(path))
+        return { pending: [] };
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return { pending: Array.isArray(raw.pending) ? raw.pending : [] };
+    }
+    catch {
+        // A corrupt buffer fails CLOSED to empty rather than throwing — a dispatch buffer
+        // that can't be read must not wedge the gateway; the un-Acked decisions are lost
+        // only if the file itself is corrupt (a separate durability incident), never silently
+        // dropped on a clean read.
+        return { pending: [] };
+    }
+}
+function writeState(path, state) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(state, null, 0), { mode: 0o600 });
+    renameSync(tmp, path);
+}
+/** The durable gateway dispatch buffer. Restart-surviving: `pending()` reads from disk.
+ *  Idempotent on decisionId — enqueuing the same decisionId twice keeps ONE record. */
+export class DispatchBuffer {
+    path;
+    constructor(home = getOpenRigHome()) {
+        this.path = dispatchBufferPath(home);
+    }
+    /** Persist a decision BEFORE dispatch (durable-first). Idempotent by decisionId. */
+    enqueue(decision) {
+        const state = readState(this.path);
+        if (state.pending.some((d) => d.decisionId === decision.decisionId))
+            return; // already durable
+        state.pending.push(decision);
+        writeState(this.path, state);
+    }
+    /** Ack-gated DRAIN: remove a decision only once the connector has Acked it. */
+    ack(decisionId) {
+        const state = readState(this.path);
+        const next = state.pending.filter((d) => d.decisionId !== decisionId);
+        if (next.length !== state.pending.length)
+            writeState(this.path, { pending: next });
+    }
+    /** The un-Acked decisions (restart-surviving) — what a re-dispatch replays on recovery. */
+    pending() {
+        return readState(this.path).pending;
+    }
+}
+//# sourceMappingURL=dispatch-buffer.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatch-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-buffer.js","sourceRoot":"","sources":["../../../src/domain/gateway/dispatch-buffer.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,0FAA0F;AAC1F,uFAAuF;AACvF,uFAAuF;AAEvF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,MAAM,UAAU,kBAAkB,CAAC,OAAe,cAAc,EAAE;IAChE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;AACvD,CAAC;AAMD,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;QAClF,iFAAiF;QACjF,sFAAsF;QACtF,2BAA2B;QAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAkB;IAClD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;uFACuF;AACvF,MAAM,OAAO,cAAc;IACR,IAAI,CAAS;IAC9B,YAAY,OAAe,cAAc,EAAE;QACzC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,oFAAoF;IACpF,OAAO,CAAC,QAA0B;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,kBAAkB;QAC/F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,UAAkB;QACpB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,2FAA2F;IAC3F,OAAO;QACL,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;IACtC,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.d.ts

@@ -0,0 +1,32 @@
+import type { DispatchBuffer } from "./dispatch-buffer.js";
+import { type CapabilityDescriptor, type OutboundDecision } from "./protocol.js";
+export interface DispatcherDeps {
+    buffer: DispatchBuffer;
+    /** The transport write (a framed unix-socket send in prod; an in-memory sink in tests). */
+    send: (decision: OutboundDecision) => void;
+    /** Injectable id source (tests pin decisionIds; prod = a UUID). */
+    newDecisionId?: () => string;
+}
+export type DispatchResult = {
+    ok: true;
+    decisionId: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare class GatewayDispatcher {
+    private readonly deps;
+    private descriptor;
+    constructor(deps: DispatcherDeps);
+    /** Handshake — record the connector's advertised capabilities. */
+    onCapability(descriptor: CapabilityDescriptor): void;
+    get connectorId(): string | undefined;
+    /** Dispatch an outbound decision. proof-9: pre-handshake OR an unadvertised op is REFUSED,
+     *  never attempted. Durable-first: persisted to the buffer BEFORE the transport send. */
+    dispatch(op: string, entityBindingRef: string, payload: unknown): DispatchResult;
+    /** The connector Acked a decision — drain it from the durable buffer. */
+    onAck(decisionId: string): void;
+    /** On (re)connect: re-send every un-Acked decision (no-loss across a connector outage). */
+    replayPending(): void;
+}
+//# sourceMappingURL=dispatcher.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/dispatcher.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAkB,KAAK,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,2FAA2F;IAC3F,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC3C,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,qBAAa,iBAAiB;IAEhB,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,UAAU,CAAmC;gBACxB,IAAI,EAAE,cAAc;IAEjD,kEAAkE;IAClE,YAAY,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAIpD,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED;6FACyF;IACzF,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;IAchF,yEAAyE;IACzE,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI/B,2FAA2F;IAC3F,aAAa,IAAI,IAAI;CAGtB"}

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.js

@@ -0,0 +1,50 @@
+// M1 A4a — the gateway MODULE's core logic (the OS process's brain), transport-injected so
+// it is unit-testable without a real socket. The thin spawn wrapper + the unix-socket
+// transport wire this to the connector; here is the ruled behavior (contract a305310d):
+//   - handshake: until a CapabilityDescriptor arrives, dispatch is refused.
+//   - dispatch: an op MUST be advertised (proof-9: unadvertised = refused, NOT attempted);
+//     durable-FIRST (enqueue to the dispatch buffer before send).
+//   - ack: drains the decision from the buffer (ack-gated drain).
+//   - replayPending: on (re)connect, re-send every un-Acked decision — connector-outage ->
+//     no-loss; decisionId keeps the re-send a byte-identical dup, never a second record.
+import { randomUUID } from "node:crypto";
+import { isAdvertisedOp } from "./protocol.js";
+export class GatewayDispatcher {
+    deps;
+    descriptor;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Handshake — record the connector's advertised capabilities. */
+    onCapability(descriptor) {
+        this.descriptor = descriptor;
+    }
+    get connectorId() {
+        return this.descriptor?.connectorId;
+    }
+    /** Dispatch an outbound decision. proof-9: pre-handshake OR an unadvertised op is REFUSED,
+     *  never attempted. Durable-first: persisted to the buffer BEFORE the transport send. */
+    dispatch(op, entityBindingRef, payload) {
+        if (!this.descriptor) {
+            return { ok: false, error: "dispatch refused: no capability descriptor yet (handshake incomplete)" };
+        }
+        if (!isAdvertisedOp(this.descriptor, op)) {
+            return { ok: false, error: `dispatch refused: op "${op}" is not advertised by connector ${this.descriptor.connectorId} (unadvertised ops are refused, not attempted)` };
+        }
+        const decisionId = (this.deps.newDecisionId ?? randomUUID)();
+        const decision = { kind: "outbound_decision", decisionId, op, entityBindingRef, payload };
+        this.deps.buffer.enqueue(decision); // durable BEFORE dispatch
+        this.deps.send(decision);
+        return { ok: true, decisionId };
+    }
+    /** The connector Acked a decision — drain it from the durable buffer. */
+    onAck(decisionId) {
+        this.deps.buffer.ack(decisionId);
+    }
+    /** On (re)connect: re-send every un-Acked decision (no-loss across a connector outage). */
+    replayPending() {
+        for (const decision of this.deps.buffer.pending())
+            this.deps.send(decision);
+    }
+}
+//# sourceMappingURL=dispatcher.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../../src/domain/gateway/dispatcher.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,sFAAsF;AACtF,wFAAwF;AACxF,4EAA4E;AAC5E,2FAA2F;AAC3F,kEAAkE;AAClE,kEAAkE;AAClE,2FAA2F;AAC3F,yFAAyF;AAEzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAoD,MAAM,eAAe,CAAC;AAcjG,MAAM,OAAO,iBAAiB;IAEC;IADrB,UAAU,CAAmC;IACrD,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;IAAG,CAAC;IAErD,kEAAkE;IAClE,YAAY,CAAC,UAAgC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IACtC,CAAC;IAED;6FACyF;IACzF,QAAQ,CAAC,EAAU,EAAE,gBAAwB,EAAE,OAAgB;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,oCAAoC,IAAI,CAAC,UAAU,CAAC,WAAW,gDAAgD,EAAE,CAAC;QAC1K,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,0BAA0B;QAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,UAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,2FAA2F;IAC3F,aAAa;QACX,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.d.ts

@@ -0,0 +1,25 @@
+export { OPERATOR_HUMAN_DEFAULT_SLOT } from "./human-registry.js";
+/** The identity a registered human contributes to admission (a projection of the A3
+ *  fragment; the resolver only needs the key + address for admission). */
+export interface RegisteredEntity {
+    entityId: string;
+    address: string;
+}
+export type ExternalResolution = {
+    kind: "registered";
+    entityId: string;
+} | {
+    kind: "scheme";
+    scheme: string;
+    handle: string;
+} | {
+    kind: "unregistered";
+    local: string;
+    error: string;
+};
+/** Resolve the `local` part of a `<local>@external` ref against the registered entities.
+ *  A scheme form (`local` contains ':') is the literal-scheme mode — a one-off address,
+ *  never a registry lookup. Otherwise the registered mode: `local` is the entityId. An
+ *  absent entity is a LOUD structured teaching refusal, never a silent/agent-class fall. */
+export declare function resolveExternal(local: string, entities: readonly RegisteredEntity[]): ExternalResolution;
+//# sourceMappingURL=external-admission.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-admission.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/external-admission.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE;0EAC0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAG3D;;;4FAG4F;AAC5F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,kBAAkB,CAgBxG"}

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.js

@@ -0,0 +1,41 @@
+// M1 A4b — @external entity-admission. Contract 2a57d099 (sealed): resolve a
+// <local>@external destination against the human registry (A3). Home = the daemon
+// gateway-path (topologyValidateRig / 4b, queue-side) + the A4 gateway (connector-side),
+// arch-ruled 8cd30094. This module is the RESOLVER; the daemon-side registry READER
+// (loads the projection entities) + the gate wiring consume it.
+//
+// The four ruled outcomes (never silent, NEVER an agent-class downgrade):
+//   registered   mike@external            -> entity found (prefs applied downstream)
+//   scheme        slack:U012AB3CD@external -> a one-off ADDRESS (never a registry entry;
+//                                            connector #1 delivers it directly)
+//   unregistered  stranger@external        -> LOUD structured teaching refusal
+//   (unresolved inbound with no target)    -> the default HUMAN slot human-operator@kernel
+//
+// proof-2 captures BOTH refusal texts: the DOMAIN-level bounce (a token NOT in the
+// closed set falls through to unknown_destination_rig, from A1/A2) AND the ENTITY-level
+// teaching refusal here (valid @external domain, entity absent).
+// The default HUMAN operator identity — re-exported from its canonical home in the
+// human-registry (ONE source, no dup). See there for the concept-1/concept-2 note.
+export { OPERATOR_HUMAN_DEFAULT_SLOT } from "./human-registry.js";
+/** Resolve the `local` part of a `<local>@external` ref against the registered entities.
+ *  A scheme form (`local` contains ':') is the literal-scheme mode — a one-off address,
+ *  never a registry lookup. Otherwise the registered mode: `local` is the entityId. An
+ *  absent entity is a LOUD structured teaching refusal, never a silent/agent-class fall. */
+export function resolveExternal(local, entities) {
+    const colon = local.indexOf(":");
+    if (colon > 0 && colon < local.length - 1) {
+        return { kind: "scheme", scheme: local.slice(0, colon), handle: local.slice(colon + 1) };
+    }
+    const found = entities.find((e) => e.entityId === local);
+    if (found)
+        return { kind: "registered", entityId: found.entityId };
+    return {
+        kind: "unregistered",
+        local,
+        error: `'${local}@external' names no registered human (no gateway/humans/${local}.yaml fragment). ` +
+            `Register the human first: rig gateway human add ${local} --display-name … --binding … --delivery-class …; ` +
+            `or address a human that is already registered. ` +
+            `(This is a virtual-domain reference — it was NOT downgraded to an agent seat.)`,
+    };
+}
+//# sourceMappingURL=external-admission.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-admission.js","sourceRoot":"","sources":["../../../src/domain/gateway/external-admission.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,kFAAkF;AAClF,yFAAyF;AACzF,oFAAoF;AACpF,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,qFAAqF;AACrF,yFAAyF;AACzF,gFAAgF;AAChF,+EAA+E;AAC/E,2FAA2F;AAC3F,EAAE;AACF,mFAAmF;AACnF,wFAAwF;AACxF,iEAAiE;AAEjE,mFAAmF;AACnF,mFAAmF;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAelE;;;4FAG4F;AAC5F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAqC;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK;QACL,KAAK,EACH,IAAI,KAAK,2DAA2D,KAAK,mBAAmB;YAC5F,mDAAmD,KAAK,oDAAoD;YAC5G,iDAAiD;YACjD,gFAAgF;KACnF,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process-main.d.ts

@@ -0,0 +1,7 @@
+import { type GatewayProcessHandle } from "./gateway-process.js";
+export declare const GATEWAY_SOCKET_ENV = "OPENRIG_GATEWAY_SOCKET";
+export declare const GATEWAY_RECONNECT_MS_ENV = "OPENRIG_GATEWAY_RECONNECT_MS";
+/** Start the gateway process from environment config. Returns the handle (undefined if the
+ *  required socket path is missing — the entry sets a non-zero exit code and returns). */
+export declare function mainFromEnv(env?: NodeJS.ProcessEnv): GatewayProcessHandle | undefined;
+//# sourceMappingURL=gateway-process-main.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-process-main.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/gateway-process-main.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,wBAAwB,iCAAiC,CAAC;AAEvE;0FAC0F;AAC1F,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,oBAAoB,GAAG,SAAS,CAsBlG"}

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process-main.js

@@ -0,0 +1,40 @@
+// M1 A4a — the gateway process ENTRY POINT: the file the daemon spawns as a separate OS process
+// (`node dist/domain/gateway/gateway-process-main.js`). Thin by design — it reads its config from
+// the environment the spawn wrapper sets, starts the long-lived runGatewayProcess brain, and wires
+// clean SIGTERM/SIGINT shutdown. All behavior lives in gateway-process.ts (unit-tested in-process);
+// this file only exists to be an executable node entry.
+import { pathToFileURL } from "node:url";
+import { runGatewayProcess } from "./gateway-process.js";
+export const GATEWAY_SOCKET_ENV = "OPENRIG_GATEWAY_SOCKET";
+export const GATEWAY_RECONNECT_MS_ENV = "OPENRIG_GATEWAY_RECONNECT_MS";
+/** Start the gateway process from environment config. Returns the handle (undefined if the
+ *  required socket path is missing — the entry sets a non-zero exit code and returns). */
+export function mainFromEnv(env = process.env) {
+    const socketPath = env[GATEWAY_SOCKET_ENV];
+    if (!socketPath) {
+        process.stderr.write(`[gateway] ${GATEWAY_SOCKET_ENV} is required\n`);
+        process.exitCode = 2;
+        return undefined;
+    }
+    const reconnectRaw = env[GATEWAY_RECONNECT_MS_ENV];
+    const reconnectMs = reconnectRaw !== undefined && Number.isFinite(Number(reconnectRaw)) && Number(reconnectRaw) > 0
+        ? Number(reconnectRaw) : undefined;
+    const handle = runGatewayProcess({
+        socketPath,
+        home: env.OPENRIG_HOME,
+        reconnectMs,
+        onError: (e) => process.stderr.write(`[gateway] socket error: ${e.message}\n`),
+        onProtocolError: (m) => process.stderr.write(`[gateway] protocol refuse: ${m}\n`),
+    });
+    const shutdown = () => { handle.stop(); process.exit(0); };
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+    process.stdout.write(`[gateway] up on ${socketPath}\n`);
+    return handle;
+}
+// Self-run guard: only auto-start when executed directly as `node gateway-process-main.js`,
+// never when imported (the daemon/tests import mainFromEnv without side effects).
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    mainFromEnv();
+}
+//# sourceMappingURL=gateway-process-main.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-process-main.js","sourceRoot":"","sources":["../../../src/domain/gateway/gateway-process-main.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,oGAAoG;AACpG,wDAAwD;AAExD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAA6B,MAAM,sBAAsB,CAAC;AAEpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEvE;0FAC0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,kBAAkB,gBAAgB,CAAC,CAAC;QACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC;QACjH,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,UAAU;QACV,IAAI,EAAE,GAAG,CAAC,YAAY;QACtB,WAAW;QACX,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,OAAO,IAAI,CAAC;QAC9E,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,IAAI,CAAC;KAClF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,UAAU,IAAI,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4FAA4F;AAC5F,kFAAkF;AAClF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/E,WAAW,EAAE,CAAC;AAChB,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process.d.ts

@@ -0,0 +1,20 @@
+import { type GatewayConnection } from "./transport.js";
+export interface GatewayProcessOpts {
+    socketPath: string;
+    home?: string;
+    /** Re-dial cadence while disconnected (also the heartbeat/keepalive tick). */
+    reconnectMs?: number;
+    onError?: (error: Error) => void;
+    onProtocolError?: (error: string) => void;
+}
+export interface GatewayProcessHandle {
+    /** The live connection (undefined between a drop and the next successful re-dial). */
+    connection(): GatewayConnection | undefined;
+    connected(): boolean;
+    /** Tear down: clears the heartbeat and closes the socket (lets the process exit). */
+    stop(): void;
+}
+/** Start the gateway process brain. Returns a handle for lifecycle/tests. Idempotent re-dials are
+ *  safe: the durable buffer replays un-Acked decisions on every (re)connect (no-loss). */
+export declare function runGatewayProcess(opts: GatewayProcessOpts): GatewayProcessHandle;
+//# sourceMappingURL=gateway-process.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-process.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/gateway-process.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,UAAU,IAAI,iBAAiB,GAAG,SAAS,CAAC;IAC5C,SAAS,IAAI,OAAO,CAAC;IACrB,qFAAqF;IACrF,IAAI,IAAI,IAAI,CAAC;CACd;AAED;0FAC0F;AAC1F,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,oBAAoB,CAmChF"}

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process.js

@@ -0,0 +1,51 @@
+// M1 A4a — the gateway OS PROCESS runner: the long-lived brain the daemon spawns. It out-dials
+// the connector socket (transport.ts), and — critically — STAYS ALIVE across a connector outage.
+//
+// Liveness (lesson idle-process-needs-refd-handle): a connected socket is a ref'd libuv handle,
+// but during an outage there is NO open socket, so the event loop would empty and the process
+// would SILENTLY EXIT. A ref'd heartbeat interval is the keepalive AND the re-dial driver: while
+// disconnected it re-dials every reconnectMs; while connected it is a cheap no-op. We never park
+// on `new Promise(() => {})` (no ref'd handle -> silent exit) — the interval is the anchor.
+import { DispatchBuffer } from "./dispatch-buffer.js";
+import { connectGateway } from "./transport.js";
+/** Start the gateway process brain. Returns a handle for lifecycle/tests. Idempotent re-dials are
+ *  safe: the durable buffer replays un-Acked decisions on every (re)connect (no-loss). */
+export function runGatewayProcess(opts) {
+    const reconnectMs = opts.reconnectMs ?? 1000;
+    const buffer = new DispatchBuffer(opts.home);
+    let conn;
+    let connected = false;
+    let stopped = false;
+    const dial = () => {
+        if (stopped || connected)
+            return;
+        connected = true; // optimistic: onClose flips it back if the dial fails/drops
+        conn = connectGateway({
+            socketPath: opts.socketPath,
+            buffer,
+            onError: opts.onError,
+            onProtocolError: opts.onProtocolError,
+            onClose: () => { connected = false; conn = undefined; }, // heartbeat re-dials next tick
+        });
+    };
+    dial();
+    // Ref'd heartbeat: keeps the event loop alive during an outage AND drives re-dial. NOT unref'd —
+    // the whole point is that the process does not exit while it owes the connector delivery.
+    const heartbeat = setInterval(() => { if (!connected)
+        dial(); }, reconnectMs);
+    return {
+        connection: () => conn,
+        connected: () => connected,
+        stop: () => {
+            stopped = true;
+            clearInterval(heartbeat);
+            try {
+                conn?.close();
+            }
+            catch { /* best-effort */ }
+            conn = undefined;
+            connected = false;
+        },
+    };
+}
+//# sourceMappingURL=gateway-process.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-process.js","sourceRoot":"","sources":["../../../src/domain/gateway/gateway-process.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,iGAAiG;AACjG,EAAE;AACF,gGAAgG;AAChG,8FAA8F;AAC9F,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAE5F,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAA0B,MAAM,gBAAgB,CAAC;AAmBxE;0FAC0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAmC,CAAC;IACxC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAG,GAAS,EAAE;QACtB,IAAI,OAAO,IAAI,SAAS;YAAE,OAAO;QACjC,SAAS,GAAG,IAAI,CAAC,CAAC,4DAA4D;QAC9E,IAAI,GAAG,cAAc,CAAC;YACpB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,+BAA+B;SACzF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,EAAE,CAAC;IACP,iGAAiG;IACjG,0FAA0F;IAC1F,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS;QAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAE9E,OAAO;QACL,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI;QACtB,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1B,IAAI,EAAE,GAAG,EAAE;YACT,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,IAAI,CAAC;gBAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAClD,IAAI,GAAG,SAAS,CAAC;YACjB,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/gateway/human-registry.d.ts

@@ -0,0 +1,124 @@
+export declare const HUMAN_ENTITY_CLASSES: Set<string>;
+export declare const HUMAN_CONNECTOR_KINDS: Set<string>;
+export declare const HUMAN_BINDING_ROLES: Set<string>;
+export declare const HUMAN_DELIVERY_CLASSES: Set<string>;
+export declare const ENTITY_ID_PATTERN: RegExp;
+export declare const ADDRESS_DOMAIN = "external";
+export declare const HANDLE_PATTERN: RegExp;
+export interface HumanConnectorBinding {
+    kind: "slack";
+    connectorRef: string;
+    /** POINTER at the connector's vault (secrets-on-connector) — NEVER the secret. */
+    secretsRef: string;
+    /** Per-BINDING routing: EXACTLY ONE primary per entity = the default channel. */
+    role: "primary" | "secondary";
+    /** A6 v3: the platform-native id of this human on the connector (e.g. Slack user id).
+     *  OPTIONAL — a handle-less binding is OUTBOUND-ONLY (delivery works; it is NOT
+     *  inbound-resolvable, so an inbound event on it fails admission LOUDLY). REQUIRED to be
+     *  inbound-resolvable. UNIQUE per kind across ALL bindings of ALL humans (one platform id =
+     *  exactly one human; a duplicate is a registration conflict, REFUSED). */
+    handle?: string;
+}
+export interface HumanPrefs {
+    /** Per-ENTITY loudness — a SELECTION from the notifications register (spec §6);
+     *  A3 carries it, never redefines it. Forward-compatible if the register grows. */
+    deliveryClass: "A" | "B" | "C" | "D";
+    /** The AWAY preset (optional). */
+    away?: boolean;
+}
+export interface HumanFragment {
+    entityId: string;
+    class: "human";
+    displayName: string;
+    /** The registered @external ref, = <entityId>@external by convention. */
+    address: string;
+    connectorBindings: HumanConnectorBinding[];
+    prefs: HumanPrefs;
+}
+export type ValidateResult = {
+    ok: true;
+    fragment: HumanFragment;
+} | {
+    ok: false;
+    error: string;
+};
+/** add-time == load-time validation. Returns the typed fragment or a loud error.
+ *  Structural + closed-enum + the two cross-field invariants (>=1 binding,
+ *  exactly-one-primary-per-entity). Does NOT touch the filesystem. */
+export declare function validateHumanFragment(raw: unknown): ValidateResult;
+export declare function humansDir(home?: string): string;
+export declare function projectionPath(home?: string): string;
+/** The default HUMAN operator identity — the fallback HUMAN when admission resolves no
+ *  addressable entity. NOT a fragment (never an entities[] entry) and NOT the inbound
+ *  routing destination (that is the operator-AGENT operator-agent@kernel, which has its
+ *  own home in the slack connector config — a different seat). Named with the human-seat
+ *  PREFIX convention so it classifies as human-CLASS (isHumanSeatSessionRef); the parity
+ *  test pins that, killing the '-human'-suffix footgun class. Canonical home for this
+ *  constant — external-admission.ts imports it (ONE source, no dup). */
+export declare const OPERATOR_HUMAN_DEFAULT_SLOT = "human-operator@kernel";
+export type ProjectResult = {
+    ok: true;
+    body: string;
+    entities: HumanFragment[];
+} | {
+    ok: false;
+    error: string;
+};
+/** Generate the canonical registry projection from the fragments (the ONE generator
+ *  used by both the write path and the drift/load check). Load-time validation is the
+ *  SAME validateHumanFragment as add-time; the filename must equal <entityId>.yaml
+ *  (collision-free key). Entities are sorted by entityId for a stable, diffable body. */
+export declare function projectHumans(home?: string): ProjectResult;
+export type SlackHandleResolution = {
+    kind: "registered";
+    entityId: string;
+    address: string;
+} | {
+    kind: "unregistered";
+    handle: string;
+    error: string;
+};
+/** A6 v3 pins 2+3 — resolve an INBOUND connector handle to its registered human. Walks every
+ *  human's bindings of `connectorKind` for one whose `handle` equals `handle`:
+ *   - a match          -> registered (admit as that entity; its address is the human-class source)
+ *   - no match         -> unregistered LOUD teaching (admit-iff-registered — never fabricate a
+ *                         human seat from a raw platform id; a handle-LESS binding is outbound-only
+ *                         and simply never matches, so it fails inbound here, loudly).
+ *  Cross-fragment uniqueness (projectHumans) guarantees at most one match. */
+export declare function resolveSlackHandle(handle: string, entities: readonly HumanFragment[], connectorKind?: "slack"): SlackHandleResolution;
+/** (Re)write the generated projection from the current fragments. Atomic. */
+export declare function writeProjection(home?: string): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    error: string;
+};
+export type AddHumanResult = {
+    ok: true;
+    path: string;
+    fragment: HumanFragment;
+} | {
+    ok: false;
+    error: string;
+};
+/** The verb-add writer: validate (add-time) -> atomic write the ONE fragment file ->
+ *  re-project. Operators never hand-create the fragment YAML; the verb owns it.
+ *  NO SILENT CLOBBER (mirrors hosts-registry addHostEntry): an existing entityId is
+ *  REFUSED unless `replace` is passed explicitly — a re-run must not silently replace
+ *  a human's data (managed-config data-safety class). */
+export declare function addHumanFragment(raw: unknown, home?: string, opts?: {
+    replace?: boolean;
+}): AddHumanResult;
+export type LoadResult = {
+    ok: true;
+    entities: HumanFragment[];
+} | {
+    ok: false;
+    error: string;
+};
+/** Load the registry via the projection, but REFUSE a hand-edited/drifted projection:
+ *  the fragments are truth, so the on-disk projection must byte-match a fresh one.
+ *  This is the drift pin's runtime half (the vitest parity pin is the CI half). */
+export declare function loadHumanRegistry(home?: string): LoadResult;
+//# sourceMappingURL=human-registry.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/human-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-registry.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/human-registry.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,oBAAoB,aAAqB,CAAC;AACvD,eAAO,MAAM,qBAAqB,aAAqB,CAAC;AACxD,eAAO,MAAM,mBAAmB,aAAoC,CAAC;AACrE,eAAO,MAAM,sBAAsB,aAAgC,CAAC;AAGpE,eAAO,MAAM,iBAAiB,QAAwC,CAAC;AAIvE,eAAO,MAAM,cAAc,aAAa,CAAC;AAQzC,eAAO,MAAM,cAAc,QAAsB,CAAC;AAOlD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B;;;;+EAI2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;uFACmF;IACnF,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IACrC,kCAAkC;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;IAC3C,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAMjC;;sEAEsE;AACtE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CA2FlE;AAGD,wBAAgB,SAAS,CAAC,IAAI,GAAE,MAAyB,GAAG,MAAM,CAEjE;AACD,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAyB,GAAG,MAAM,CAEtE;AAED;;;;;;wEAMwE;AACxE,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAQnE,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;yFAGyF;AACzF,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAyB,GAAG,aAAa,CAqC5E;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D;;;;;;8EAM8E;AAC9E,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,aAAa,EAAE,EAClC,aAAa,GAAE,OAAiB,GAC/B,qBAAqB,CAiBvB;AAcD,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAAyB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAM1H;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;yDAIyD;AACzD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,MAAyB,EAC/B,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAC/B,cAAc,CA4BhB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;mFAEmF;AACnF,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAAyB,GAAG,UAAU,CAW7E"}