@privos_ai/app-server 0.1.0 → 0.4.0

package/dist/workload/workload-identity.js

@@ -0,0 +1,451 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+export const DEFAULT_WORKLOAD_SOCKET = '/run/privos/identity.sock';
+export class WorkloadIdentityError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = 'WorkloadIdentityError';
+    }
+}
+export class WorkloadPermissionDeniedError extends WorkloadIdentityError {
+    requiredScope;
+    constructor(requiredScope) {
+        super('PERMISSION_DENIED', 'The installation does not grant this capability.', 403);
+        this.requiredScope = requiredScope;
+        this.name = 'WorkloadPermissionDeniedError';
+    }
+}
+function encode(value) {
+    return Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+}
+function thumbprint(jwk) {
+    return crypto
+        .createHash('sha256')
+        .update(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }))
+        .digest('base64url');
+}
+function normalizedHtu(value) {
+    const url = new URL(value);
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+}
+function validateHubOrigin(value) {
+    if (typeof value !== 'string')
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    const url = new URL(value);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    }
+    return url.origin;
+}
+function parseBinding(attestation, nonce, publicJwk, now) {
+    const parts = attestation.split('.');
+    if (parts.length !== 3 || parts.some((part) => !part)) {
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    }
+    if (payload.type !== 'node-workload-attestation' ||
+        payload.nonce !== nonce ||
+        payload.dpopJkt !== thumbprint(publicJwk) ||
+        !Number.isInteger(payload.iat) ||
+        !Number.isInteger(payload.exp) ||
+        Number(payload.iat) > Math.floor(now / 1_000) + 30 ||
+        Number(payload.exp) < Math.floor(now / 1_000) ||
+        Number(payload.exp) - Number(payload.iat) > 60) {
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    }
+    return payload.protocolVersion === 3 ? bindingFromGenerationAttestation(payload) : bindingFromReplicaAttestation(payload);
+}
+/**
+ * A node running an App Library generation attests the generation instead of a
+ * standalone replica: the installation is the runtime installation, the receipt
+ * is the approval receipt, and the epoch is the authorization epoch. All three
+ * generation hashes are canonical-JSON SHA-256 in base64url, never the
+ * `sha256:<hex>` digest form the replica attestation uses.
+ */
+function bindingFromGenerationAttestation(payload) {
+    const identifiers = [
+        'workspaceId',
+        'runtimeInstallationId',
+        'mcpAppId',
+        'replicaId',
+        'clusterId',
+        'deploymentId',
+        'generationId',
+    ];
+    const artifactHashes = ['approvalReceiptHash', 'resourceManifestHash', 'runtimeResourceInventoryHash'];
+    if (identifiers.some((field) => typeof payload[field] !== 'string' || String(payload[field]).length === 0) ||
+        artifactHashes.some((field) => typeof payload[field] !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(String(payload[field]))) ||
+        typeof payload.manifestDigest !== 'string' ||
+        !/^sha256:[a-f0-9]{64}$/.test(payload.manifestDigest) ||
+        !Number.isInteger(payload.authorizationEpoch) ||
+        Number(payload.authorizationEpoch) < 1 ||
+        !Number.isInteger(payload.generationNumber) ||
+        Number(payload.generationNumber) < 1) {
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    }
+    return {
+        workspaceId: String(payload.workspaceId),
+        installationId: String(payload.runtimeInstallationId),
+        mcpAppId: String(payload.mcpAppId),
+        replicaId: String(payload.replicaId),
+        receiptHash: String(payload.approvalReceiptHash),
+        grantEpoch: Number(payload.authorizationEpoch),
+        generation: {
+            clusterId: String(payload.clusterId),
+            deploymentId: String(payload.deploymentId),
+            generationId: String(payload.generationId),
+            generationNumber: Number(payload.generationNumber),
+            manifestDigest: payload.manifestDigest,
+            resourceManifestHash: String(payload.resourceManifestHash),
+            runtimeResourceInventoryHash: String(payload.runtimeResourceInventoryHash),
+        },
+    };
+}
+function bindingFromReplicaAttestation(payload) {
+    const identifiers = ['workspaceId', 'installationId', 'mcpAppId', 'replicaId'];
+    if (identifiers.some((field) => typeof payload[field] !== 'string' || String(payload[field]).length === 0) ||
+        typeof payload.receiptHash !== 'string' ||
+        !/^sha256:[a-f0-9]{64}$/.test(payload.receiptHash) ||
+        !Number.isInteger(payload.grantEpoch) ||
+        Number(payload.grantEpoch) < 1) {
+        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+    }
+    return {
+        workspaceId: String(payload.workspaceId),
+        installationId: String(payload.installationId),
+        mcpAppId: String(payload.mcpAppId),
+        replicaId: String(payload.replicaId),
+        receiptHash: payload.receiptHash,
+        grantEpoch: Number(payload.grantEpoch),
+    };
+}
+function parseScopes(value) {
+    if (typeof value !== 'string')
+        throw new WorkloadIdentityError('TOKEN_RESPONSE_INVALID', 'The workload token response is invalid.');
+    const scopes = value.split(/\s+/).filter(Boolean);
+    if (new Set(scopes).size !== scopes.length ||
+        scopes.some((scope) => !/^[a-z][a-z0-9-]*(?::[a-z][a-z0-9-]*)+$/.test(scope))) {
+        throw new WorkloadIdentityError('TOKEN_RESPONSE_INVALID', 'The workload token response is invalid.');
+    }
+    return scopes.sort();
+}
+function capabilitiesEqual(left, right) {
+    return JSON.stringify({ ...left, updatedAt: 0 }) === JSON.stringify({ ...right, updatedAt: 0 });
+}
+function retryAllowed(method, mode) {
+    if (mode === 'never')
+        return false;
+    if (mode === 'idempotent')
+        return true;
+    return ['GET', 'HEAD', 'OPTIONS', 'PUT', 'DELETE'].includes(method);
+}
+export class WorkloadIdentityClient {
+    socketPath;
+    fetchImplementation;
+    brokerRequester;
+    now;
+    refreshSkewMs;
+    privateJwk;
+    publicJwk;
+    token;
+    ready = false;
+    context;
+    monitor;
+    listeners = new Set();
+    capabilities;
+    constructor(options = {}) {
+        const normalized = typeof options === 'string' ? { socketPath: options } : options;
+        this.socketPath = normalized.socketPath ?? process.env.PRIVOS_WORKLOAD_SOCKET ?? DEFAULT_WORKLOAD_SOCKET;
+        this.fetchImplementation = normalized.fetch ?? fetch;
+        this.brokerRequester = normalized.brokerRequest;
+        this.now = normalized.now ?? Date.now;
+        this.refreshSkewMs = normalized.refreshSkewMs ?? 30_000;
+        const pair = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+        this.privateJwk = pair.privateKey.export({ format: 'jwk' });
+        this.publicJwk = pair.publicKey.export({ format: 'jwk' });
+        this.capabilities = Object.freeze({
+            status: this.isAvailable() ? 'pairing' : 'unavailable',
+            scopes: Object.freeze([]),
+            updatedAt: this.now(),
+            ...(this.isAvailable() ? {} : { reason: 'BROKER_UNAVAILABLE' }),
+        });
+    }
+    isAvailable() {
+        return Boolean(this.brokerRequester) || fs.existsSync(this.socketPath);
+    }
+    proof(input) {
+        const header = encode({ alg: 'ES256', typ: 'dpop+jwt', jwk: this.publicJwk });
+        const payload = encode({
+            htu: normalizedHtu(input.htu),
+            htm: input.htm.toUpperCase(),
+            iat: Math.floor(this.now() / 1_000),
+            jti: crypto.randomUUID(),
+            ...(input.nonce ? { nonce: input.nonce } : {}),
+            ...(input.ath ? { ath: input.ath } : {}),
+        });
+        const signingInput = Buffer.from(`${header}.${payload}`, 'utf8');
+        const key = crypto.createPrivateKey({ key: this.privateJwk, format: 'jwk' });
+        const signature = crypto.sign('sha256', signingInput, { key, dsaEncoding: 'ieee-p1363' }).toString('base64url');
+        return `${header}.${payload}.${signature}`;
+    }
+    updateCapabilities(input) {
+        const next = Object.freeze({
+            ...input,
+            scopes: Object.freeze([...input.scopes].sort()),
+            updatedAt: this.now(),
+        });
+        if (capabilitiesEqual(this.capabilities, next))
+            return;
+        this.capabilities = next;
+        for (const listener of this.listeners) {
+            try {
+                listener(next);
+            }
+            catch {
+                // A consumer callback must never break token refresh or expose credentials through an error path.
+            }
+        }
+    }
+    contextCapabilities(status, scopes, reason) {
+        const binding = this.context?.binding;
+        this.updateCapabilities({
+            status,
+            scopes,
+            ...(binding
+                ? {
+                    workspaceId: binding.workspaceId,
+                    installationId: binding.installationId,
+                    mcpAppId: binding.mcpAppId,
+                    replicaId: binding.replicaId,
+                    receiptHash: binding.receiptHash,
+                    grantEpoch: binding.grantEpoch,
+                }
+                : {}),
+            ...(reason ? { reason } : {}),
+        });
+    }
+    async attest() {
+        const nonce = crypto.randomBytes(24).toString('base64url');
+        const broker = await this.requestBroker({ op: 'attest', publicJwk: this.publicJwk, nonce });
+        if (!broker ||
+            broker.ok !== true ||
+            typeof broker.attestation !== 'string' ||
+            typeof broker.hubKid !== 'string' ||
+            !broker.hubPublicJwk ||
+            thumbprint(broker.hubPublicJwk) !== broker.hubKid) {
+            throw new WorkloadIdentityError('HUB_IDENTITY_INVALID', 'The workload broker Hub identity is invalid.');
+        }
+        const hubOrigin = validateHubOrigin(broker.hubOrigin);
+        const binding = parseBinding(broker.attestation, nonce, this.publicJwk, this.now());
+        this.context = { hubOrigin, hubKid: broker.hubKid, hubPublicJwk: broker.hubPublicJwk, binding };
+        return { broker: { ...broker, hubOrigin }, nonce };
+    }
+    requestBroker(request) {
+        if (this.brokerRequester)
+            return this.brokerRequester(request);
+        if (!fs.existsSync(this.socketPath)) {
+            return Promise.reject(new WorkloadIdentityError('BROKER_UNAVAILABLE', 'The PrivOS workload identity broker is unavailable.'));
+        }
+        return new Promise((resolve, reject) => {
+            const socket = net.createConnection(this.socketPath);
+            let buffer = '';
+            const timeout = setTimeout(() => socket.destroy(new WorkloadIdentityError('BROKER_UNAVAILABLE', 'The PrivOS workload identity broker timed out.')), 5_000);
+            socket.setEncoding('utf8');
+            socket.once('connect', () => socket.write(`${JSON.stringify(request)}\n`));
+            socket.on('data', (chunk) => {
+                buffer += chunk;
+                if (buffer.length > 32_768) {
+                    socket.destroy(new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.'));
+                    return;
+                }
+                const end = buffer.indexOf('\n');
+                if (end < 0)
+                    return;
+                clearTimeout(timeout);
+                socket.end();
+                try {
+                    const parsed = JSON.parse(buffer.slice(0, end));
+                    if (!parsed.ok)
+                        throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker denied identity.');
+                    resolve(parsed);
+                }
+                catch (error) {
+                    reject(error instanceof WorkloadIdentityError ? error : new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.'));
+                }
+            });
+            socket.once('error', (error) => {
+                clearTimeout(timeout);
+                reject(error);
+            });
+        });
+    }
+    async ensureReady() {
+        if (this.ready)
+            return;
+        this.contextCapabilities('pairing', []);
+        const { broker, nonce } = await this.attest();
+        const target = `${broker.hubOrigin}/api/v1/mcp-workload.ready`;
+        const response = await this.fetchImplementation(target, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', dpop: this.proof({ htu: target, htm: 'POST', nonce }) },
+            body: JSON.stringify({ attestation: broker.attestation }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            this.contextCapabilities('stale', [], 'READINESS_DENIED');
+            throw new WorkloadIdentityError('READINESS_DENIED', 'PrivOS did not accept workload readiness.', response.status);
+        }
+        this.ready = true;
+        this.contextCapabilities('paired', []);
+    }
+    async issueAccessToken() {
+        await this.ensureReady();
+        const { broker, nonce } = await this.attest();
+        const target = `${broker.hubOrigin}/api/v1/mcp-workload.token`;
+        const response = await this.fetchImplementation(target, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', dpop: this.proof({ htu: target, htm: 'POST', nonce }) },
+            body: JSON.stringify({ attestation: broker.attestation }),
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) {
+            this.token = undefined;
+            this.contextCapabilities('stale', [], 'TOKEN_DENIED');
+            throw new WorkloadIdentityError('TOKEN_DENIED', 'PrivOS did not issue workload authorization.', response.status);
+        }
+        let body;
+        try {
+            body = await response.json();
+        }
+        catch {
+            throw new WorkloadIdentityError('TOKEN_RESPONSE_INVALID', 'The workload token response is invalid.');
+        }
+        if (typeof body.access_token !== 'string' ||
+            body.access_token.length < 32 ||
+            body.token_type !== 'DPoP' ||
+            typeof body.expires_in !== 'number' ||
+            !Number.isFinite(body.expires_in) ||
+            body.expires_in <= 0 ||
+            body.expires_in > 600) {
+            throw new WorkloadIdentityError('TOKEN_RESPONSE_INVALID', 'The workload token response is invalid.');
+        }
+        const scopes = parseScopes(body.scope ?? '');
+        const token = { value: body.access_token, expiresAt: this.now() + body.expires_in * 1_000, scopes };
+        this.token = token;
+        this.contextCapabilities('active', scopes);
+        return token;
+    }
+    async getAccessToken(options = {}) {
+        if (!options.forceRefresh && this.token && this.token.expiresAt - this.now() > this.refreshSkewMs)
+            return this.token.value;
+        return (await this.issueAccessToken()).value;
+    }
+    async getEffectiveCapabilities(options = {}) {
+        await this.getAccessToken(options);
+        return this.capabilities;
+    }
+    peekEffectiveCapabilities() {
+        return this.capabilities;
+    }
+    toJSON() {
+        return { type: 'WorkloadIdentityClient', capabilities: this.capabilities };
+    }
+    [Symbol.for('nodejs.util.inspect.custom')]() {
+        return this.toJSON();
+    }
+    onCapabilitiesChanged(listener) {
+        this.listeners.add(listener);
+        return () => this.listeners.delete(listener);
+    }
+    requireCapability(scope) {
+        if (!this.capabilities.scopes.includes(scope)) {
+            throw new WorkloadIdentityError('CAPABILITY_NOT_GRANTED', `The optional capability "${scope}" is not granted.`);
+        }
+    }
+    startCapabilityMonitor(intervalMs = 60_000) {
+        if (!Number.isFinite(intervalMs) || intervalMs < 5_000)
+            throw new RangeError('Capability monitor interval must be at least 5000 ms.');
+        if (!this.monitor) {
+            this.monitor = setInterval(() => {
+                void this.getEffectiveCapabilities({ forceRefresh: true }).catch(() => undefined);
+            }, intervalMs);
+            this.monitor.unref();
+        }
+        return () => this.stopCapabilityMonitor();
+    }
+    stopCapabilityMonitor() {
+        if (this.monitor)
+            clearInterval(this.monitor);
+        this.monitor = undefined;
+    }
+    async performAuthorizedFetch(target, init, token) {
+        const headers = new Headers(init.headers);
+        headers.set('authorization', `DPoP ${token}`);
+        headers.set('dpop', this.proof({
+            htu: target.toString(),
+            htm: init.method ?? 'GET',
+            ath: crypto.createHash('sha256').update(token, 'utf8').digest('base64url'),
+        }));
+        return this.fetchImplementation(target, { ...init, headers });
+    }
+    async authorizedFetch(input, init = {}) {
+        await this.ensureReady();
+        const context = await this.brokerContext();
+        const target = new URL(input, context.hubOrigin);
+        if (target.origin !== context.hubOrigin) {
+            throw new WorkloadIdentityError('TARGET_ORIGIN_INVALID', 'Workload authorization can only be sent to the bound PrivOS Hub.');
+        }
+        const { retryMode = 'safe-methods', requiredScope: _requiredScope, ...requestInit } = init;
+        const method = (requestInit.method ?? 'GET').toUpperCase();
+        const token = await this.getAccessToken();
+        const response = await this.performAuthorizedFetch(target, requestInit, token);
+        if (response.status !== 401)
+            return response;
+        this.token = undefined;
+        this.contextCapabilities('stale', [], 'AUTHORIZATION_STALE');
+        if (!retryAllowed(method, retryMode))
+            return response;
+        const retryToken = await this.getAccessToken({ forceRefresh: true });
+        return this.performAuthorizedFetch(target, requestInit, retryToken);
+    }
+    async authorizedRequest(input, init = {}) {
+        const response = await this.authorizedFetch(input, init);
+        if (response.status === 403)
+            throw new WorkloadPermissionDeniedError(init.requiredScope);
+        if (response.status === 401) {
+            throw new WorkloadIdentityError('AUTHORIZATION_STALE', 'Workload authorization is stale.', 401);
+        }
+        return response;
+    }
+    async brokerContext() {
+        if (!this.context)
+            await this.attest();
+        if (!this.context)
+            throw new WorkloadIdentityError('BROKER_RESPONSE_INVALID', 'The workload broker response is invalid.');
+        return this.context;
+    }
+    dispose() {
+        this.stopCapabilityMonitor();
+        this.token = undefined;
+        this.listeners.clear();
+    }
+}
+let defaultClient;
+export function getWorkloadIdentityClient() {
+    defaultClient ??= new WorkloadIdentityClient();
+    return defaultClient;
+}
+//# sourceMappingURL=workload-identity.js.map

package/dist/workload/workload-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity.js","sourceRoot":"","sources":["../../src/workload/workload-identity.ts"],"names":[],"mappings":"AAAA,OAAO,MAA2B,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAmEnE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAE9B;IAEA;IAHjB,YACiB,IAA+B,EAC/C,OAAe,EACC,MAAe;QAE/B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAA2B;QAE/B,WAAM,GAAN,MAAM,CAAS;QAG/B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACrC,CAAC;CACD;AAED,MAAM,OAAO,6BAA8B,SAAQ,qBAAqB;IAC3C;IAA5B,YAA4B,aAAsB;QACjD,KAAK,CAAC,mBAAmB,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAC;QADzD,kBAAa,GAAb,aAAa,CAAS;QAEjD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AAyBD,SAAS,MAAM,CAAC,KAAc;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IAClC,OAAO,MAAM;SACX,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;SAC1E,MAAM,CAAC,WAAW,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACtI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3G,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,KAAa,EAAE,SAAqB,EAAE,GAAW;IAC3F,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,IACC,OAAO,CAAC,IAAI,KAAK,2BAA2B;QAC5C,OAAO,CAAC,KAAK,KAAK,KAAK;QACvB,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,SAAS,CAAC;QACzC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE;QAClD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAC7C,CAAC;QACF,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,OAAO,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;AAC3H,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,OAAgC;IACzE,MAAM,WAAW,GAAG;QACnB,aAAa;QACb,uBAAuB;QACvB,UAAU;QACV,WAAW;QACX,WAAW;QACX,cAAc;QACd,cAAc;KACL,CAAC;IACX,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,8BAA8B,CAAU,CAAC;IAChH,IACC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QACtG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzH,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;QAC1C,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;QACrD,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC;QACtC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,EACnC,CAAC;QACF,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAChD,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC9C,UAAU,EAAE;YACX,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YAC1C,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;YAC1C,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAClD,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,oBAAoB,EAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC1D,4BAA4B,EAAE,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC;SAC1E;KACD,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CAAC,OAAgC;IACtE,MAAM,WAAW,GAAG,CAAC,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;IACxF,IACC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;QACtG,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;QACvC,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAC7B,CAAC;QACF,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACxC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;IACpI,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,IACC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QACtC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC5E,CAAC;QACF,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA2B,EAAE,KAA4B;IACnF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAoC;IACzE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACjB,UAAU,CAAS;IACnB,mBAAmB,CAAsB;IACzC,eAAe,CAAmB;IAClC,GAAG,CAAe;IAClB,aAAa,CAAS;IACtB,UAAU,CAAa;IACvB,SAAS,CAAa;IAC/B,KAAK,CAAe;IACpB,KAAK,GAAG,KAAK,CAAC;IACd,OAAO,CAAyB;IAChC,OAAO,CAAkC;IAChC,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;IAC9E,YAAY,CAAwB;IAE5C,YAAY,UAAkD,EAAE;QAC/D,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACnF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC;QACzG,IAAI,CAAC,mBAAmB,GAAG,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,aAAa,CAAC;QAChD,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACtC,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,MAAM,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;YACjC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa;YACtD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,oBAA6B,EAAE,CAAC;SACxE,CAAC,CAAC;IACJ,CAAC;IAED,WAAW;QACV,OAAO,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxE,CAAC;IAEO,KAAK,CAAC,KAAiE;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC;YACtB,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;YAC7B,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE;YAC5B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACnC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;YACxB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChH,OAAO,GAAG,MAAM,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,KAA+C;QACzE,MAAM,IAAI,GAA0B,MAAM,CAAC,MAAM,CAAC;YACjD,GAAG,KAAK;YACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,iBAAiB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC;YAAE,OAAO;QACvD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC;gBACJ,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACR,kGAAkG;YACnG,CAAC;QACF,CAAC;IACF,CAAC;IAEO,mBAAmB,CAAC,MAAuC,EAAE,MAAyB,EAAE,MAAkC;QACjI,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QACtC,IAAI,CAAC,kBAAkB,CAAC;YACvB,MAAM;YACN,MAAM;YACN,GAAG,CAAC,OAAO;gBACV,CAAC,CAAC;oBACA,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC9B;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,IACC,CAAC,MAAM;YACP,MAAM,CAAC,EAAE,KAAK,IAAI;YAClB,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,CAAC,MAAM,CAAC,YAAY;YACpB,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,MAAM,EAChD,CAAC;YACF,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,EAAE,8CAA8C,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC;QAChG,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IAEO,aAAa,CAAC,OAAgC;QACrD,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,qDAAqD,CAAC,CAAC,CAAC;QAC/H,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC,oBAAoB,EAAE,gDAAgD,CAAC,CAAC,EACvH,KAAK,CACL,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC3B,MAAM,IAAI,KAAK,CAAC;gBAChB,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;oBAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC,CAAC;oBACjH,OAAO;gBACR,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,GAAG,GAAG,CAAC;oBAAE,OAAO;gBACpB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC;oBACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAA2C,CAAC;oBAC1F,IAAI,CAAC,MAAM,CAAC,EAAE;wBAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;oBACnH,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,MAAM,CAAC,KAAK,YAAY,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC,CAAC;gBAC3J,CAAC;YACF,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9B,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,CAAC;YACf,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QAChB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,4BAA4B,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;YACtG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC1D,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,EAAE,2CAA2C,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,4BAA4B,CAAC;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;YACtG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;YACtD,MAAM,IAAI,qBAAqB,CAAC,cAAc,EAAE,8CAA8C,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,IAA6F,CAAC;QAClG,IAAI,CAAC;YACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAiB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;QACtG,CAAC;QACD,IACC,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACrC,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;YAC7B,IAAI,CAAC,UAAU,KAAK,MAAM;YAC1B,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;YACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,CAAC;YACpB,IAAI,CAAC,UAAU,GAAG,GAAG,EACpB,CAAC;YACF,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC;QACpG,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC;IACd,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAsC,EAAE;QAC5D,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3H,OAAO,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,UAAsC,EAAE;QACtE,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,yBAAyB;QACxB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM;QACL,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5E,CAAC;IAED,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACtB,CAAC;IAED,qBAAqB,CAAC,QAAuD;QAC5E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,wBAAwB,EAAE,4BAA4B,KAAK,mBAAmB,CAAC,CAAC;QACjH,CAAC;IACF,CAAC;IAED,sBAAsB,CAAC,UAAU,GAAG,MAAM;QACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,KAAK;YAAE,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QACtI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;gBAC/B,KAAK,IAAI,CAAC,wBAAwB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnF,CAAC,EAAE,UAAU,CAAC,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC3C,CAAC;IAED,qBAAqB;QACpB,IAAI,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,MAAW,EAAE,IAAiB,EAAE,KAAa;QACjF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;YACtB,GAAG,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;YACzB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1E,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAmB,EAAE,OAA0B,EAAE;QACtE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,EAAE,kEAAkE,CAAC,CAAC;QAC9H,CAAC;QACD,MAAM,EAAE,SAAS,GAAG,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC;QAC3F,MAAM,MAAM,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC/E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC;YAAE,OAAO,QAAQ,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAmB,EAAE,OAA0B,EAAE;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,qBAAqB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,aAAa;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,EAAE,0CAA0C,CAAC,CAAC;QAC1H,OAAO,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,OAAO;QACN,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACD;AAED,IAAI,aAAiD,CAAC;AAEtD,MAAM,UAAU,yBAAyB;IACxC,aAAa,KAAK,IAAI,sBAAsB,EAAE,CAAC;IAC/C,OAAO,aAAa,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@privos_ai/app-server",
-  "version": "0.1.0",
+  "version": "0.4.0",
   "description": "Business-agnostic PrivOS MCP App server runtime — Direct HTTP + Relay WebSocket",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "privos-app-lint": "./dist/manifest-lint-cli.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -25,6 +28,14 @@
     "./relay": {
       "types": "./dist/relay/relay-client.d.ts",
       "import": "./dist/relay/relay-client.js"
+    },
+    "./workload": {
+      "types": "./dist/workload/index.d.ts",
+      "import": "./dist/workload/index.js"
+    },
+    "./manifest-tools": {
+      "types": "./dist/manifest-tools.d.ts",
+      "import": "./dist/manifest-tools.js"
     }
   },
   "files": [
@@ -41,6 +52,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
+    "manifest:lint": "npm run build --silent && node dist/manifest-lint-cli.js",
     "pack:check": "npm pack --dry-run"
   },
   "peerDependencies": {