@privos_ai/app-server 0.4.0 → 0.6.1

package/dist/relay/standalone-readiness.d.ts

@@ -0,0 +1,33 @@
+import { type LoadedStandaloneIdentity } from './standalone-identity.js';
+export type StandaloneReadinessReason = 'IDENTITY_NOT_LOADED' | 'RELAY_NOT_AUTHENTICATED' | 'MANIFEST_LINT_INVALID' | 'MANIFEST_DRIFT';
+export type StandaloneReadinessResult = Readonly<{
+    ok: boolean;
+    status: number;
+    body: Readonly<{
+        ok: boolean;
+        status: 'ready' | 'not_ready';
+        mode: 'standalone-production';
+        reason?: StandaloneReadinessReason;
+        detail?: string;
+        fingerprint?: string;
+    }>;
+}>;
+export type StandaloneReadinessCheckOptions = Readonly<{
+    /** Resolve current identity fresh on every check (rotation-safe). Defaults to `loadStandaloneIdentity`. */
+    loadIdentity?: (filePath?: string) => LoadedStandaloneIdentity;
+    filePath?: string;
+    /** True only while the Relay WebSocket is open and past the authenticated handshake. */
+    isRelayAuthenticated: () => boolean;
+    /** The app's own published manifest object (parsed `privos-app.json`), recomputed fresh each check. */
+    resolveManifest: () => unknown | Promise<unknown>;
+}>;
+/** Recomputes the local manifest's canonical digest and compares it to the digest pinned at pairing. */
+export declare function checkManifestDigestDrift(manifest: unknown, pinnedManifestDigest: string): Readonly<{
+    drift: boolean;
+    canonicalManifestHash: string;
+    lintValid: boolean;
+    lintErrors: readonly string[];
+}>;
+/** Builds a `ready.check` callback compatible with `HttpIngressAppOptions`. */
+export declare function createStandaloneReadinessCheck(options: StandaloneReadinessCheckOptions): () => Promise<StandaloneReadinessResult>;
+//# sourceMappingURL=standalone-readiness.d.ts.map

package/dist/relay/standalone-readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-readiness.d.ts","sourceRoot":"","sources":["../../src/relay/standalone-readiness.ts"],"names":[],"mappings":"AAaA,OAAO,EAGN,KAAK,wBAAwB,EAC7B,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,yBAAyB,GAClC,qBAAqB,GACrB,yBAAyB,GACzB,uBAAuB,GACvB,gBAAgB,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;QACd,EAAE,EAAE,OAAO,CAAC;QACZ,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;QAC9B,IAAI,EAAE,uBAAuB,CAAC;QAC9B,MAAM,CAAC,EAAE,yBAAyB,CAAC;QACnC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC;IACtD,2GAA2G;IAC3G,YAAY,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,KAAK,wBAAwB,CAAC;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,uGAAuG;IACvG,eAAe,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC,CAAC;AAEH,wGAAwG;AACxG,wBAAgB,wBAAwB,CACvC,QAAQ,EAAE,OAAO,EACjB,oBAAoB,EAAE,MAAM,GAC1B,QAAQ,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,qBAAqB,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAQhH;AAED,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,+BAA+B,GACtC,MAAM,OAAO,CAAC,yBAAyB,CAAC,CAiD1C"}

package/dist/relay/standalone-readiness.js

@@ -0,0 +1,80 @@
+/**
+ * Readiness contract for `standalone-production` mode, matching the managed
+ * workload's `/health` (process alive) + `/ready` JSON shape so operator
+ * dashboards built against one mode work unmodified against the other.
+ *
+ * `/ready` is ok only when all of: the identity file loaded and validated,
+ * the pinned trust configuration is structurally valid, the Relay connection
+ * is currently authenticated, the local manifest lints clean, and the local
+ * manifest's canonical digest still matches the digest pinned at pairing
+ * (`MANIFEST_DRIFT` otherwise — the standalone analogue of the managed
+ * image-label digest check).
+ */
+import { lintManifest } from '../manifest-tools.js';
+import { loadStandaloneIdentity, StandaloneIdentityError, } from './standalone-identity.js';
+/** Recomputes the local manifest's canonical digest and compares it to the digest pinned at pairing. */
+export function checkManifestDigestDrift(manifest, pinnedManifestDigest) {
+    const lint = lintManifest(manifest);
+    return Object.freeze({
+        drift: lint.canonicalManifestHash !== pinnedManifestDigest,
+        canonicalManifestHash: lint.canonicalManifestHash,
+        lintValid: lint.valid,
+        lintErrors: lint.errors,
+    });
+}
+/** Builds a `ready.check` callback compatible with `HttpIngressAppOptions`. */
+export function createStandaloneReadinessCheck(options) {
+    const loadIdentity = options.loadIdentity ?? ((filePath) => loadStandaloneIdentity({ filePath }));
+    return async function check() {
+        let identity;
+        try {
+            identity = loadIdentity(options.filePath);
+        }
+        catch (error) {
+            const detail = error instanceof StandaloneIdentityError ? error.message : 'Standalone identity is not loaded.';
+            return notReady('IDENTITY_NOT_LOADED', detail);
+        }
+        if (!options.isRelayAuthenticated()) {
+            return notReady('RELAY_NOT_AUTHENTICATED', 'The Relay WebSocket is not currently authenticated.', identity.fingerprint);
+        }
+        let manifest;
+        try {
+            manifest = await options.resolveManifest();
+        }
+        catch (error) {
+            return notReady('MANIFEST_LINT_INVALID', `Failed to resolve the local manifest: ${error instanceof Error ? error.message : String(error)}`, identity.fingerprint);
+        }
+        const digestCheck = checkManifestDigestDrift(manifest, identity.trust.affinity.manifestDigest);
+        if (!digestCheck.lintValid) {
+            return notReady('MANIFEST_LINT_INVALID', digestCheck.lintErrors.join('; '), identity.fingerprint);
+        }
+        if (digestCheck.drift) {
+            return notReady('MANIFEST_DRIFT', `Local manifest digest ${digestCheck.canonicalManifestHash} does not match the digest pinned at pairing (${identity.trust.affinity.manifestDigest}).`, identity.fingerprint);
+        }
+        return Object.freeze({
+            ok: true,
+            status: 200,
+            body: Object.freeze({
+                ok: true,
+                status: 'ready',
+                mode: 'standalone-production',
+                fingerprint: identity.fingerprint,
+            }),
+        });
+    };
+}
+function notReady(reason, detail, fingerprint) {
+    return Object.freeze({
+        ok: false,
+        status: 503,
+        body: Object.freeze({
+            ok: false,
+            status: 'not_ready',
+            mode: 'standalone-production',
+            reason,
+            detail,
+            ...(fingerprint ? { fingerprint } : {}),
+        }),
+    });
+}
+//# sourceMappingURL=standalone-readiness.js.map

package/dist/relay/standalone-readiness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standalone-readiness.js","sourceRoot":"","sources":["../../src/relay/standalone-readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EACN,sBAAsB,EACtB,uBAAuB,GAEvB,MAAM,0BAA0B,CAAC;AA+BlC,wGAAwG;AACxG,MAAM,UAAU,wBAAwB,CACvC,QAAiB,EACjB,oBAA4B;IAE5B,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,IAAI,CAAC,qBAAqB,KAAK,oBAAoB;QAC1D,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;QACjD,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,UAAU,EAAE,IAAI,CAAC,MAAM;KACvB,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,8BAA8B,CAC7C,OAAwC;IAExC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,QAAiB,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAE3G,OAAO,KAAK,UAAU,KAAK;QAC1B,IAAI,QAAkC,CAAC;QACvC,IAAI,CAAC;YACJ,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,KAAK,YAAY,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC;YAC/G,OAAO,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,yBAAyB,EAAE,qDAAqD,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzH,CAAC;QAED,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,QAAQ,CACd,uBAAuB,EACvB,yCAAyC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACjG,QAAQ,CAAC,WAAW,CACpB,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC,uBAAuB,EAAE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,QAAQ,CACd,gBAAgB,EAChB,yBAAyB,WAAW,CAAC,qBAAqB,iDAAiD,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,EACrJ,QAAQ,CAAC,WAAW,CACpB,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,EAAE,EAAE,IAAa;gBACjB,MAAM,EAAE,OAAgB;gBACxB,IAAI,EAAE,uBAAgC;gBACtC,WAAW,EAAE,QAAQ,CAAC,WAAW;aACjC,CAAC;SACF,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAiC,EAAE,MAAc,EAAE,WAAoB;IACxF,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,EAAE,EAAE,KAAc;YAClB,MAAM,EAAE,WAAoB;YAC5B,IAAI,EAAE,uBAAgC;YACtC,MAAM;YACN,MAAM;YACN,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC;KACF,CAAC,CAAC;AACJ,CAAC"}

package/dist/runtime-mode.d.ts

@@ -0,0 +1,25 @@
+export type RuntimeMode = 'managed' | 'standalone-production' | 'development';
+export type RuntimeModeResolution = Readonly<{
+    mode: RuntimeMode;
+    reason: string;
+    workloadSocketPath: string;
+    standaloneIdentityFilePath: string;
+}>;
+export type RuntimeModeErrorCode = 'AMBIGUOUS_RUNTIME_IDENTITY' | 'PRODUCTION_WITHOUT_IDENTITY';
+export declare class RuntimeModeError extends Error {
+    readonly code: RuntimeModeErrorCode;
+    constructor(code: RuntimeModeErrorCode, message: string);
+}
+export type ResolveRuntimeModeOptions = Readonly<{
+    env?: NodeJS.ProcessEnv;
+    /** Override for tests; defaults to `PRIVOS_WORKLOAD_SOCKET` / the SDK default. */
+    workloadSocketPath?: string;
+    /** Override for tests; defaults to `PRIVOS_STANDALONE_IDENTITY_FILE` / the SDK default. */
+    standaloneIdentityFilePath?: string;
+    /** Injectable presence check for the workload socket; defaults to `fs.existsSync`. */
+    workloadSocketExists?: (path: string) => boolean;
+    /** Injectable presence check for the standalone identity file; defaults to the real file check. */
+    standaloneIdentityExists?: (path: string) => boolean;
+}>;
+export declare function resolveRuntimeMode(options?: ResolveRuntimeModeOptions): RuntimeModeResolution;
+//# sourceMappingURL=runtime-mode.d.ts.map

package/dist/runtime-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-mode.d.ts","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,uBAAuB,GAAG,aAAa,CAAC;AAE9E,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,EAAE,WAAW,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,0BAA0B,EAAE,MAAM,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,4BAA4B,GAAG,6BAA6B,CAAC;AAEhG,qBAAa,gBAAiB,SAAQ,KAAK;aAEzB,IAAI,EAAE,oBAAoB;gBAA1B,IAAI,EAAE,oBAAoB,EAC1C,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,kFAAkF;IAClF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACrD,CAAC,CAAC;AAEH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,GAAG,qBAAqB,CAuDjG"}

package/dist/runtime-mode.js

@@ -0,0 +1,72 @@
+/**
+ * Resolves exactly one of the three supported runtime modes so an app never
+ * has to hand-roll the decision (or silently default into the wrong one):
+ *
+ * - `managed`   — a workload identity socket is present (current production
+ *                 cluster-routed path).
+ * - `standalone-production` — a paired standalone identity file is present
+ *                 (phase 3); Relay transport with mandatory assertion
+ *                 verification, `NODE_ENV=production` allowed.
+ * - `development` — neither is present; only permitted when `NODE_ENV` is
+ *                 not `production` (the current, unchanged legacy behavior).
+ *
+ * Precedence is managed > standalone-production > development. Both a
+ * workload socket AND a standalone identity file present is a configuration
+ * error, never a silent pick — running both at once means either stale
+ * leftover state from a prior deployment mode, or a misconfigured host, and
+ * guessing which one the operator meant would be unsafe.
+ */
+import fsSync from 'node:fs';
+import { DEFAULT_WORKLOAD_SOCKET } from './workload/workload-identity.js';
+import { DEFAULT_STANDALONE_IDENTITY_FILE, standaloneIdentityFileExists } from './relay/standalone-identity.js';
+export class RuntimeModeError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'RuntimeModeError';
+    }
+}
+export function resolveRuntimeMode(options = {}) {
+    const env = options.env ?? process.env;
+    const workloadSocketPath = options.workloadSocketPath ?? env.PRIVOS_WORKLOAD_SOCKET ?? DEFAULT_WORKLOAD_SOCKET;
+    const standaloneIdentityFilePath = options.standaloneIdentityFilePath ?? env.PRIVOS_STANDALONE_IDENTITY_FILE ?? DEFAULT_STANDALONE_IDENTITY_FILE;
+    const workloadSocketExists = options.workloadSocketExists ?? ((path) => fsSync.existsSync(path));
+    const standaloneIdentityExists = options.standaloneIdentityExists ?? ((path) => standaloneIdentityFileExists({ filePath: path }));
+    const managedPresent = workloadSocketExists(workloadSocketPath);
+    const standalonePresent = standaloneIdentityExists(standaloneIdentityFilePath);
+    if (managedPresent && standalonePresent) {
+        throw new RuntimeModeError('AMBIGUOUS_RUNTIME_IDENTITY', `Both a managed workload identity socket (${workloadSocketPath}) and a standalone identity file ` +
+            `(${standaloneIdentityFilePath}) are present. Refusing to silently pick a runtime mode — remove ` +
+            'whichever one does not apply to this deployment (stale leftover state from a prior mode is the usual cause).');
+    }
+    if (managedPresent) {
+        return Object.freeze({
+            mode: 'managed',
+            reason: `workload identity socket present at ${workloadSocketPath}`,
+            workloadSocketPath,
+            standaloneIdentityFilePath,
+        });
+    }
+    if (standalonePresent) {
+        return Object.freeze({
+            mode: 'standalone-production',
+            reason: `standalone identity file present at ${standaloneIdentityFilePath}`,
+            workloadSocketPath,
+            standaloneIdentityFilePath,
+        });
+    }
+    if ((env.NODE_ENV ?? '').trim() === 'production') {
+        throw new RuntimeModeError('PRODUCTION_WITHOUT_IDENTITY', 'NODE_ENV=production requires either a managed workload identity socket ' +
+            `(${workloadSocketPath}) or a paired standalone identity file (${standaloneIdentityFilePath}). ` +
+            'Development mode (relaxed verification) is never permitted in production — pair the app first ' +
+            'with pairOverWebSocket, or deploy it behind the managed workload broker.');
+    }
+    return Object.freeze({
+        mode: 'development',
+        reason: 'no managed workload socket or standalone identity file present, and NODE_ENV is not production',
+        workloadSocketPath,
+        standaloneIdentityFilePath,
+    });
+}
+//# sourceMappingURL=runtime-mode.js.map

package/dist/runtime-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-mode.js","sourceRoot":"","sources":["../src/runtime-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAahH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAEzB;IADjB,YACiB,IAA0B,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAsB;QAI1C,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAcD,MAAM,UAAU,kBAAkB,CAAC,UAAqC,EAAE;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC;IAC/G,MAAM,0BAA0B,GAC/B,OAAO,CAAC,0BAA0B,IAAI,GAAG,CAAC,+BAA+B,IAAI,gCAAgC,CAAC;IAC/G,MAAM,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzG,MAAM,wBAAwB,GAC7B,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1G,MAAM,cAAc,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;IAChE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,0BAA0B,CAAC,CAAC;IAE/E,IAAI,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CACzB,4BAA4B,EAC5B,4CAA4C,kBAAkB,mCAAmC;YAChG,IAAI,0BAA0B,mEAAmE;YACjG,8GAA8G,CAC/G,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,uCAAuC,kBAAkB,EAAE;YACnE,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,uCAAuC,0BAA0B,EAAE;YAC3E,kBAAkB;YAClB,0BAA0B;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CACzB,6BAA6B,EAC7B,yEAAyE;YACxE,IAAI,kBAAkB,2CAA2C,0BAA0B,KAAK;YAChG,gGAAgG;YAChG,0EAA0E,CAC3E,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,gGAAgG;QACxG,kBAAkB;QAClB,0BAA0B;KAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/runtime.d.ts

@@ -2,7 +2,7 @@ import { MCP_UI_MIME, type AppDescriptor } from './app-descriptor.js';
 import { type AuthOptions, type CallerCredential } from './auth/user-token.js';
 import type { ToolCallContext } from './context/tool-call-context.js';
 import type { ApplicationMcpRequest, JsonRpcErrorObject, JsonRpcId, McpResponse, ParsedInbound } from './protocol/types.js';
-import type { VerifiedRuntimeDispatchAssertionV3 } from './workload/dispatch-assertion.js';
+import type { VerifiedRuntimeAuthorizationV3 } from './workload/dispatch-assertion.js';
 export type AppMcpHandler = (request: ApplicationMcpRequest, context: ToolCallContext) => Promise<unknown>;
 export type CallerCredentialExtractor<TIngress> = (ingress: TIngress) => CallerCredential | undefined | Promise<CallerCredential | undefined>;
 export type AppErrorMapper = (error: unknown, context: ToolCallContext) => JsonRpcErrorObject | undefined;
@@ -52,6 +52,7 @@ export type DispatchOutcome = {
     warning: string;
     response?: McpResponse;
 };
+type ContextFinalizer = (context: ToolCallContext) => void;
 export declare const DEFAULT_MAX_MESSAGE_BYTES: number;
 export declare const DEFAULT_MAX_BUFFERED_BYTES: number;
 /** Distinguish number `1` from string `"1"` without separator collisions. */
@@ -78,11 +79,13 @@ export declare class AppServerRuntime {
         credentialResolution?: CallerCredentialResolution;
         traceId?: string;
         signal?: AbortSignal;
-        runtimeAuthorization?: VerifiedRuntimeDispatchAssertionV3;
+        runtimeAuthorization?: VerifiedRuntimeAuthorizationV3;
+        /** Per-request verifier pinned by the authenticated workload broker. */
+        auth?: AuthOptions;
     }): Promise<ToolCallContext>;
-    dispatchParsed(parsed: ParsedInbound, context: ToolCallContext): Promise<DispatchOutcome>;
-    dispatchObject(raw: unknown, context: ToolCallContext): Promise<DispatchOutcome>;
-    dispatchText(text: string, context: ToolCallContext): Promise<DispatchOutcome>;
+    dispatchParsed(parsed: ParsedInbound, context: ToolCallContext, finalizeContext?: ContextFinalizer): Promise<DispatchOutcome>;
+    dispatchObject(raw: unknown, context: ToolCallContext, finalizeContext?: ContextFinalizer): Promise<DispatchOutcome>;
+    dispatchText(text: string, context: ToolCallContext, finalizeContext?: ContextFinalizer): Promise<DispatchOutcome>;
     private handleRequest;
     private log;
 }
@@ -103,4 +106,5 @@ export interface RelayCallerAuthSurface {
 export declare function relayCallerAuthSurface(message: Record<string, unknown>): RelayCallerAuthSurface;
 export declare function resolveCallerCredential<TIngress>(extract: CallerCredentialExtractor<TIngress> | undefined, ingress: TIngress): Promise<CallerCredentialResolution>;
 export declare function ephemeralSessionScope(prefix?: string): string;
+export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,WAAW,EACX,KAAK,aAAa,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAkBtE,OAAO,KAAK,EACX,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,aAAa,EACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,kCAAkC,CAAC;AAE3F,MAAM,MAAM,aAAa,GAAG,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,eAAe,KACpB,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,yBAAyB,CAAC,QAAQ,IAAI,CACjD,OAAO,EAAE,QAAQ,KACb,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG,CAC5B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,eAAe,KACpB,kBAAkB,GAAG,SAAS,CAAC;AAEpC,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,WAAW,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,eAAe,CAAC;KACzB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,aAAa,CAAC;IACvB,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE;AAED,8DAA8D;AAC9D,MAAM,MAAM,0BAA0B,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,eAAe,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,oBAAoB,GAAG,kBAAkB,CAAA;CAAE,GAC3F;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAKzE,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AACzD,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAE1D,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAEtD;AAED,qBAAa,gBAAgB;IAC5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;gBAEnC,IAAI,EAAE,uBAAuB;IAIzC,SAAS,IAAI,QAAQ,CACpB,IAAI,CACH,aAAa,EACX,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,CACpB,CACD;IAUD,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,cAAc;IAOhB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC;IAK3C,YAAY,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC9B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,uCAAuC;QACvC,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;QAClD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,oBAAoB,CAAC,EAAE,kCAAkC,CAAC;KAC1D,GAAG,OAAO,CAAC,eAAe,CAAC;IAwEtB,cAAc,CACnB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC;IAqJrB,cAAc,CACnB,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC;IAIrB,YAAY,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,eAAe,GACtB,OAAO,CAAC,eAAe,CAAC;YAIb,aAAa;IA2C3B,OAAO,CAAC,GAAG;CAGX;AAoCD,qEAAqE;AACrE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7C,GAAG,gBAAgB,GAAG,SAAS,CAW/B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,sBAAsB,CAyBxB;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EACrD,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,GAAG,SAAS,EACxD,OAAO,EAAE,QAAQ,GACf,OAAO,CAAC,0BAA0B,CAAC,CAerC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,SAAQ,GAAG,MAAM,CAE5D"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAEA,OAAO,EAEN,WAAW,EACX,KAAK,aAAa,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAkBtE,OAAO,KAAK,EACX,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,aAAa,EACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAEvF,MAAM,MAAM,aAAa,GAAG,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,OAAO,EAAE,eAAe,KACpB,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB,MAAM,MAAM,yBAAyB,CAAC,QAAQ,IAAI,CACjD,OAAO,EAAE,QAAQ,KACb,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG,CAC5B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,eAAe,KACpB,kBAAkB,GAAG,SAAS,CAAC;AAEpC,MAAM,WAAW,kBAAkB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,WAAW,GAAG,MAAM,CAAC;IACvC,UAAU,CAAC,KAAK,EAAE;QACjB,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,eAAe,CAAC;KACzB,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,aAAa,GAAG,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3E,OAAO,EAAE,aAAa,CAAC;IACvB,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAClE;AAED,8DAA8D;AAC9D,MAAM,MAAM,0BAA0B,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC,MAAM,MAAM,eAAe,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,oBAAoB,GAAG,kBAAkB,CAAA;CAAE,GAC3F;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAEzE,KAAK,gBAAgB,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAC;AAK3D,eAAO,MAAM,yBAAyB,QAAkB,CAAC;AACzD,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAE1D,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAEtD;AAED,qBAAa,gBAAgB;IAC5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;gBAEnC,IAAI,EAAE,uBAAuB;IAIzC,SAAS,IAAI,QAAQ,CACpB,IAAI,CACH,aAAa,EACX,iBAAiB,GACjB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,CACpB,CACD;IAUD,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,cAAc;IAOhB,iBAAiB,IAAI,OAAO,CAAC,aAAa,CAAC;IAK3C,YAAY,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC9B,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,uCAAuC;QACvC,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;QAClD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,oBAAoB,CAAC,EAAE,8BAA8B,CAAC;QACtD,wEAAwE;QACxE,IAAI,CAAC,EAAE,WAAW,CAAC;KACnB,GAAG,OAAO,CAAC,eAAe,CAAC;IAyEtB,cAAc,CACnB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,eAAe,EACxB,eAAe,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,eAAe,CAAC;IAsJrB,cAAc,CACnB,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,eAAe,EACxB,eAAe,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,eAAe,CAAC;IAIrB,YAAY,CACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,eAAe,EACxB,eAAe,CAAC,EAAE,gBAAgB,GAChC,OAAO,CAAC,eAAe,CAAC;YAIb,aAAa;IA2C3B,OAAO,CAAC,GAAG;CAGX;AAoCD,qEAAqE;AACrE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAChD,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7C,GAAG,gBAAgB,GAAG,SAAS,CAW/B;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,sBAAsB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,sBAAsB,CAyBxB;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EACrD,OAAO,EAAE,yBAAyB,CAAC,QAAQ,CAAC,GAAG,SAAS,EACxD,OAAO,EAAE,QAAQ,GACf,OAAO,CAAC,0BAA0B,CAAC,CAerC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,SAAQ,GAAG,MAAM,CAE5D"}

package/dist/runtime.js

@@ -92,10 +92,11 @@ export class AppServerRuntime {
         if (!resolution.credential.token) {
             return { ...base, identityState: 'invalid' };
         }
-        if (!this.opts.auth) {
+        const auth = input.auth ?? this.opts.auth;
+        if (!auth) {
             return { ...base, identityState: 'invalid' };
         }
-        const verified = await verifyUserToken(resolution.credential.token, this.opts.auth, resolution.credential.assertedUserId);
+        const verified = await verifyUserToken(resolution.credential.token, auth, resolution.credential.assertedUserId);
         if (!verified.ok) {
             return {
                 ...base,
@@ -117,7 +118,7 @@ export class AppServerRuntime {
                 : verified.actor.roomId,
         };
     }
-    async dispatchParsed(parsed, context) {
+    async dispatchParsed(parsed, context, finalizeContext) {
         if (parsed.kind === 'response') {
             return { type: 'no_response', reason: 'ignored_response' };
         }
@@ -190,6 +191,7 @@ export class AppServerRuntime {
             ...context,
             signal: abort.signal,
         };
+        finalizeContext?.(requestContext);
         // Keep in-flight until the underlying handler settles (even after timeout response).
         const work = this.handleRequest(message.method, message.id, message.params, requestContext).finally(() => {
             this.deleteInFlight(context.sessionScope, message.id);
@@ -236,11 +238,11 @@ export class AppServerRuntime {
             return { type: 'response', response: errorResponse(message.id, error) };
         }
     }
-    async dispatchObject(raw, context) {
-        return this.dispatchParsed(parseJsonRpcMessage(raw), context);
+    async dispatchObject(raw, context, finalizeContext) {
+        return this.dispatchParsed(parseJsonRpcMessage(raw), context, finalizeContext);
     }
-    async dispatchText(text, context) {
-        return this.dispatchParsed(parseJsonText(text), context);
+    async dispatchText(text, context, finalizeContext) {
+        return this.dispatchParsed(parseJsonText(text), context, finalizeContext);
     }
     async handleRequest(method, id, params, context) {
         if (method === 'initialize') {

package/dist/runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACN,qBAAqB,EACrB,WAAW,GAEX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGN,eAAe,GACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA+D3E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,EAAa;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAU,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,gBAAgB;IAC5B;;;OAGG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,IAAI,CAA0B;IAE/C,YAAY,IAA6B;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,SAAS;QAUR,OAAO;YACN,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,IAAI,yBAAyB;YAC/E,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;YAClF,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,qBAAqB;YACnF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;YAClF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;SAClF,CAAC;IACH,CAAC;IAEO,aAAa;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;QACxD,OAAO,CAAC,CAAC;IACV,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,EAAa;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;IAC5E,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,EAAa;QACtD,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAEO,cAAc,CAAC,YAAoB,EAAE,EAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KASlB;QACA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,IAAI,GAAoB;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,UAAU,CAAC,EAAE;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,SAAS;YACxB,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,KAAK,MAAM;gBAC9D,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAEpE,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,iEAAiE;YACjE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE;gBACtC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,UAAU,CAAC,UAAU,CAAC,KAAK,EAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EACd,UAAU,CAAC,UAAU,CAAC,cAAc,CACpC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACN,GAAG,IAAI;gBACP,aAAa,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACpE,CAAC;QACH,CAAC;QAED,IACC,KAAK,CAAC,oBAAoB;YAC1B,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,KAAK,MAAM;gBAC1D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,oBAAoB,CAAC,MAAM;gBAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EACtC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO;YACN,GAAG,IAAI;YACP,aAAa,EAAE,UAAU;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,KAAK,MAAM;gBAClE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM;gBACnC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;SACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,MAAqB,EACrB,OAAwB;QAExB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5D,CAAC;QAED,oFAAoF;QACpF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;oBAC5B,MAAM;oBACN,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACxB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxD,CAAC;YAED,+DAA+D;YAC/D,yEAAyE;YACzE,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE;oBAClC,MAAM;oBACN,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACxB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC9D,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE;gBACpC,MAAM;gBACN,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,eAAe,EAAE,iCAAiC,EAAE;oBAChE,IAAI,EAAE,wBAAwB;iBAC9B,CAAC,CACF;aACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACxD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,WAAW,EAAE,6BAA6B,CAAC,CACxD;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;;gBACrC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,cAAc,GAAoB;YACvC,GAAG,OAAO;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC;QAEF,qFAAqF;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAC9B,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,MAAM,EACd,cAAc,CACd,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE3E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,cAAc,EAAE,oBAAoB,EAAE;wBAClD,IAAI,EAAE,oBAAoB;qBAC1B,CAAC,CACF;iBACD,CAAC;YACH,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC1C,MAAM;gBACN,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,yEAAyE;YACzE,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAC1C,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,eAAe,CAAC;gBAC7C,MAAM;gBACN,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACzE,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,GAAY,EACZ,OAAwB;QAExB,OAAO,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,IAAY,EACZ,OAAwB;QAExB,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAEO,KAAK,CAAC,aAAa,CAC1B,MAAc,EACd,EAAa,EACb,MAAe,EACf,OAAwB;QAExB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,OAAO,qBAAqB,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAI,MAAkC,EAAE,GAAG,CAAC;YACrD,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChE,OAAO;oBACN,QAAQ,EAAE;wBACT;4BACC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;4BACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,WAAW;4BAC9C,IAAI,EAAE,IAAI;yBACV;qBACD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,EAAE;gBAC7D,IAAI,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA0B;YACtC,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE,MAAyC;YACjD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAEO,GAAG,CAAC,KAAa,EAAE,MAA+B;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;CACD;AAED,KAAK,UAAU,eAAe,CAC7B,IAAgB,EAChB,KAAsB,EACtB,EAAU;IAEV,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI;YACJ,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACvB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,CACL,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE;wBAC7C,IAAI,EAAE,cAAc;wBACpB,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;qBACjC,CAAC,CACF,CAAC;gBACH,CAAC,EAAE,EAAE,CAAC,CAAC;YACR,CAAC,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAC;QACjD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACA,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,OAAO;QACN,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,eAAe;KACvB,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,sBAAsB,CACrC,OAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,UAAU,GAAI,MAAkC,CAAC,KAAK,CAAC;QAC7D,IACC,UAAU;YACV,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAC7D,CAAC;YACF,MAAM,UAAU,GAAI,UAAsC,CAAC,UAAU,CAAC;YACtE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,CAAC;iBAC3D,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9F,OAAO,CAAC,KAAK,GAAG,EAAE,GAAI,OAAO,CAAC,KAAiC,EAAE,UAAU,EAAE,CAAC;YAC/E,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAwD,EACxD,OAAiB;IAEjB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC;SAClF,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAM,GAAG,KAAK;IACnD,OAAO,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACd,CAAC"}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACN,qBAAqB,EACrB,WAAW,GAEX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGN,eAAe,GACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACN,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,mBAAmB,EACnB,aAAa,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAiE3E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1D,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,EAAa;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAU,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,gBAAgB;IAC5B;;;OAGG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1C,IAAI,CAA0B;IAE/C,YAAY,IAA6B;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,SAAS;QAUR,OAAO;YACN,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,IAAI,yBAAyB;YAC/E,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;YAClF,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,qBAAqB;YACnF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;YAClF,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;SAClF,CAAC;IACH,CAAC;IAEO,aAAa;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;QACxD,OAAO,CAAC,CAAC;IACV,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,EAAa;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;IAC5E,CAAC;IAEO,WAAW,CAAC,YAAoB,EAAE,EAAa;QACtD,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAEO,cAAc,CAAC,YAAoB,EAAE,EAAa;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,iBAAiB;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/B,OAAO,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAWlB;QACA,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,IAAI,GAAoB;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,UAAU,CAAC,EAAE;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,SAAS;YACxB,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,KAAK,MAAM;gBAC9D,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,MAAM,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;QAEF,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAEpE,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,iEAAiE;YACjE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE;gBACtC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAClC,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,UAAU,CAAC,UAAU,CAAC,KAAK,EAC3B,IAAI,EACJ,UAAU,CAAC,UAAU,CAAC,cAAc,CACpC,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACN,GAAG,IAAI;gBACP,aAAa,EAAE,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACpE,CAAC;QACH,CAAC;QAED,IACC,KAAK,CAAC,oBAAoB;YAC1B,CAAC,KAAK,CAAC,oBAAoB,CAAC,oBAAoB,KAAK,MAAM;gBAC1D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,oBAAoB,CAAC,MAAM;gBAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EACtC,CAAC;YACF,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO;YACN,GAAG,IAAI;YACP,aAAa,EAAE,UAAU;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,KAAK,CAAC,oBAAoB,EAAE,oBAAoB,KAAK,MAAM;gBAClE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM;gBACnC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM;SACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,MAAqB,EACrB,OAAwB,EACxB,eAAkC;QAElC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5D,CAAC;QAED,oFAAoF;QACpF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE;oBAC5B,MAAM;oBACN,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACxB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YACxD,CAAC;YAED,+DAA+D;YAC/D,yEAAyE;YACzE,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,wBAAwB,EAAE;oBAClC,MAAM;oBACN,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,oBAAoB;oBAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;iBACxB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;YAC9D,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAE9B,IAAI,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE;gBACpC,MAAM;gBACN,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,eAAe,EAAE,iCAAiC,EAAE;oBAChE,IAAI,EAAE,wBAAwB;iBAC9B,CAAC,CACF;aACD,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACxD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,WAAW,EAAE,6BAA6B,CAAC,CACxD;aACD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;;gBACrC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,cAAc,GAAoB;YACvC,GAAG,OAAO;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CAAC;QACF,eAAe,EAAE,CAAC,cAAc,CAAC,CAAC;QAElC,qFAAqF;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAC9B,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,MAAM,EACd,cAAc,CACd,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE3E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAClD,OAAO;oBACN,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,aAAa,CACtB,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,cAAc,EAAE,oBAAoB,EAAE;wBAClD,IAAI,EAAE,oBAAoB;qBAC1B,CAAC,CACF;iBACD,CAAC;YACH,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC;gBAC1C,MAAM;gBACN,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,yEAAyE;YACzE,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAEjC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAC1C,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,eAAe,CAAC;gBAC7C,MAAM;gBACN,QAAQ,EAAE,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClF,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACxB,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACzE,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,GAAY,EACZ,OAAwB,EACxB,eAAkC;QAElC,OAAO,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,YAAY,CACjB,IAAY,EACZ,OAAwB,EACxB,eAAkC;QAElC,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,aAAa,CAC1B,MAAc,EACd,EAAa,EACb,MAAe,EACf,OAAwB;QAExB,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,OAAO,qBAAqB,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,GAAG,GAAI,MAAkC,EAAE,GAAG,CAAC;YACrD,IAAI,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChE,OAAO;oBACN,QAAQ,EAAE;wBACT;4BACC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG;4BACrB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,IAAI,WAAW;4BAC9C,IAAI,EAAE,IAAI;yBACV;qBACD;iBACD,CAAC;YACH,CAAC;QACF,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,EAAE;gBAC7D,IAAI,EAAE,gBAAgB;aACtB,CAAC,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAA0B;YACtC,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE,MAAyC;YACjD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAEO,GAAG,CAAC,KAAa,EAAE,MAA+B;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;CACD;AAED,KAAK,UAAU,eAAe,CAC7B,IAAgB,EAChB,KAAsB,EACtB,EAAU;IAEV,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,IAAI;YACJ,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACvB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,CACL,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE;wBAC7C,IAAI,EAAE,cAAc;wBACpB,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE;qBACjC,CAAC,CACF,CAAC;gBACH,CAAC,EAAE,EAAE,CAAC,CAAC;YACR,CAAC,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe;IAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAC;QACjD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACA,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,OAAO;QACN,KAAK;QACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,eAAe;KACvB,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,sBAAsB,CACrC,OAAgC;IAEhC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7B,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpE,MAAM,UAAU,GAAI,MAAkC,CAAC,KAAK,CAAC;QAC7D,IACC,UAAU;YACV,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1B,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAC7D,CAAC;YACF,MAAM,UAAU,GAAI,UAAsC,CAAC,UAAU,CAAC;YACtE,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,CAAC;iBAC3D,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9F,OAAO,CAAC,KAAK,GAAG,EAAE,GAAI,OAAO,CAAC,KAAiC,EAAE,UAAU,EAAE,CAAC;YAC/E,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAwD,EACxD,OAAiB;IAEjB,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC;SAClF,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAM,GAAG,KAAK;IACnD,OAAO,GAAG,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW,CAAC,KAAoC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/workload/dispatch-assertion.d.ts

@@ -137,13 +137,34 @@ export declare function verifyRuntimeDispatchAssertionV3(input: {
 export declare function extractRuntimeDispatchRelayEnvelopeV3(value: unknown): RuntimeDispatchRelayEnvelopeV3;
 export declare function assertRuntimeDispatchRelayAffinityV3(authorization: RuntimeDispatchRelayAuthorizationV3, verified: VerifiedRuntimeDispatchAssertionV3): void;
 export type VerifiedClusterDispatchAssertionV3 = Readonly<{
+    verificationPath: 'managed-cluster-v3';
+    protocolVersion: 3;
+    type: 'hub-dispatch-assertion';
+    issuer: string;
     jti: string;
     issuedAt: number;
     expiresAt: number;
+    workspaceId: string;
+    deploymentId: string;
+    generationId: string;
+    generationNumber: number;
+    runtimeInstallationId: string;
+    mcpAppId: string;
+    manifestDigest: string;
+    resourceManifestHash: string;
+    runtimeResourceInventoryHash: string;
+    runtimeApprovalReceiptHash: string;
+    runtimeAuthorizationEpoch: number;
     authorizationContext: 'workspace' | 'room';
     roomId?: string;
     authorizationBindingId?: string;
+    bindingReceiptHash?: string;
+    bindingEpoch?: number;
+    /** Signed immediate attribution only; never workload authority. */
+    actor?: VerifiedDispatchActor;
 }>;
+/** Immutable authorization normalized onto ToolCallContext by any v3 ingress. */
+export type VerifiedRuntimeAuthorizationV3 = VerifiedRuntimeDispatchAssertionV3 | VerifiedClusterDispatchAssertionV3;
 /**
  * Verify the dispatch a Hub routes to an App Library runtime through its
  * cluster. The assertion reuses the replica `typ` but carries generation

package/dist/workload/dispatch-assertion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-assertion.d.ts","sourceRoot":"","sources":["../../src/workload/dispatch-assertion.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAyEpE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEtF,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,8BAA8B,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,4FAA4F;IAC5F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,2FAA2F;IAC3F,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,yBAAyB,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,8BAA8B,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,CAAC,EAAE,IAAI,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACZ,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,WAAW,+BAA+B;IAC/C,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED,uHAAuH;AACvH,qBAAa,sCAAuC,YAAW,+BAA+B;IAIjF,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAHrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAEvB,QAAQ,SAAkC;IAIvE,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO;CAerD;AAED,MAAM,MAAM,8BAA8B,GAAG,CAC5C,IAAI,EAAE,0BAA0B,KAC5B,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE9D,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC;IAC/D,cAAc,CAAC,EAAE,+BAA+B,CAAC;IACjD,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sGAAsG;IACtG,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;CAChD,CAAC,CAAC;AAEH,KAAK,iCAAiC,GAAG,yBAAyB,GAAG,QAAQ,CAAC;IAC7E,4BAA4B,EAAE,MAAM,CAAC;IACrC,0BAA0B,EAAE,MAAM,CAAC;IACnC,yBAAyB,EAAE,MAAM,CAAC;CAClC,CAAC,CAAC;AAEH,KAAK,uBAAuB,GAAG,iCAAiC,GAAG,QAAQ,CAAC;IAC3E,eAAe,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,gCAAgC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAC3C,CAAC,uBAAuB,GAAG,QAAQ,CAAC;IAAE,oBAAoB,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,GAC3E,CAAC,uBAAuB,GACxB,QAAQ,CAAC;IACR,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC5B,CAAC,CAAC,CAAC;AAEP,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,aAAa,EAAE,mCAAmC,CAAC;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAAC;AAqKH,wBAAgB,yCAAyC,CACxD,KAAK,EAAE,OAAO,GACZ,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAkEzC;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAanF;AAsBD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEjE;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAO3G;AAED,kGAAkG;AAClG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBnE;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,yBAAyB,CAAC;IACpC,6FAA6F;IAC7F,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,kCAAkC,CAAC,CA+D9C;AAED,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,8BAA8B,CAqCpG;AAED,wBAAgB,oCAAoC,CACnD,aAAa,EAAE,mCAAmC,EAClD,QAAQ,EAAE,kCAAkC,GAC1C,IAAI,CAQN;AA0CD,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,kCAAkC,CA4FrC;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,yBAAyB,CA6D5B"}
+{"version":3,"file":"dispatch-assertion.d.ts","sourceRoot":"","sources":["../../src/workload/dispatch-assertion.ts"],"names":[],"mappings":"AAAA,OAAe,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAyEpE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEtF,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,8BAA8B,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,4FAA4F;IAC5F,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,2FAA2F;IAC3F,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,UAAU,CAAC;IACzB,QAAQ,EAAE,yBAAyB,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,8BAA8B,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,wFAAwF;IACxF,sBAAsB,CAAC,EAAE,IAAI,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,QAAQ,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACZ,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,WAAW,+BAA+B;IAC/C,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED,uHAAuH;AACvH,qBAAa,sCAAuC,YAAW,+BAA+B;IAIjF,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAHrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAEvB,QAAQ,SAAkC;IAIvE,OAAO,CAAC,KAAK,EAAE,4BAA4B,GAAG,OAAO;CAerD;AAED,MAAM,MAAM,8BAA8B,GAAG,CAC5C,IAAI,EAAE,0BAA0B,KAC5B,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE9D,MAAM,MAAM,yBAAyB,GAAG,QAAQ,CAAC;IAChD,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,sBAAsB,GAAG,8BAA8B,CAAC;IAC/D,cAAc,CAAC,EAAE,+BAA+B,CAAC;IACjD,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sGAAsG;IACtG,iBAAiB,CAAC,EAAE,2BAA2B,CAAC;CAChD,CAAC,CAAC;AAEH,KAAK,iCAAiC,GAAG,yBAAyB,GAAG,QAAQ,CAAC;IAC7E,4BAA4B,EAAE,MAAM,CAAC;IACrC,0BAA0B,EAAE,MAAM,CAAC;IACnC,yBAAyB,EAAE,MAAM,CAAC;CAClC,CAAC,CAAC;AAEH,KAAK,uBAAuB,GAAG,iCAAiC,GAAG,QAAQ,CAAC;IAC3E,eAAe,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,gCAAgC,CAAC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,MAAM,kCAAkC,GAC3C,CAAC,uBAAuB,GAAG,QAAQ,CAAC;IAAE,oBAAoB,EAAE,WAAW,CAAA;CAAE,CAAC,CAAC,GAC3E,CAAC,uBAAuB,GACxB,QAAQ,CAAC;IACR,oBAAoB,EAAE,MAAM,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC5B,CAAC,CAAC,CAAC;AAEP,MAAM,MAAM,mCAAmC,GAAG,QAAQ,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC,CAAC;AAEH,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,aAAa,EAAE,mCAAmC,CAAC;IACnD,YAAY,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAAC;AAqKH,wBAAgB,yCAAyC,CACxD,KAAK,EAAE,OAAO,GACZ,OAAO,CAAC,KAAK,IAAI,sBAAsB,CAkEzC;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAanF;AAsBD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEjE;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAO3G;AAED,kGAAkG;AAClG,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAmBnE;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,yBAAyB,CAAC;IACpC,6FAA6F;IAC7F,kBAAkB,CAAC,EAAE,mCAAmC,CAAC;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,OAAO,CAAC,kCAAkC,CAAC,CA+D9C;AAED,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,OAAO,GAAG,8BAA8B,CAqCpG;AAED,wBAAgB,oCAAoC,CACnD,aAAa,EAAE,mCAAmC,EAClD,QAAQ,EAAE,kCAAkC,GAC1C,IAAI,CAQN;AA4DD,MAAM,MAAM,kCAAkC,GAAG,QAAQ,CAAC;IACzD,gBAAgB,EAAE,oBAAoB,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,4BAA4B,EAAE,MAAM,CAAC;IACrC,0BAA0B,EAAE,MAAM,CAAC;IACnC,yBAAyB,EAAE,MAAM,CAAC;IAClC,oBAAoB,EAAE,WAAW,GAAG,MAAM,CAAC;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,CAAC,EAAE,qBAAqB,CAAC;CAC9B,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,MAAM,8BAA8B,GACvC,kCAAkC,GAClC,kCAAkC,CAAC;AAEtC;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,kCAAkC,CAoHrC;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;CACb,GAAG,yBAAyB,CA6D5B"}

package/dist/workload/dispatch-assertion.js

@@ -495,6 +495,19 @@ const CLUSTER_DISPATCH_V3_ROOM_KEYS = [
     'bindingReceiptHash',
     'roomId',
 ];
+/** Optional signed attribution claims understood by this SDK generation. */
+const CLUSTER_DISPATCH_V3_OPTIONAL_KEYS = ['actor'];
+const CLUSTER_DISPATCH_V3_ACTOR_KEYS = ['subject', 'username', 'roomId'];
+function validClusterDispatchActorV3(value) {
+    if (!isRecord(value))
+        return false;
+    const extra = Object.keys(value).filter((key) => !CLUSTER_DISPATCH_V3_ACTOR_KEYS.includes(key));
+    return (extra.length === 0 &&
+        typeof value.subject === 'string' &&
+        value.subject.length >= 1 &&
+        (value.username === undefined || typeof value.username === 'string') &&
+        (value.roomId === undefined || typeof value.roomId === 'string'));
+}
 /**
  * Verify the dispatch a Hub routes to an App Library runtime through its
  * cluster. The assertion reuses the replica `typ` but carries generation
@@ -506,18 +519,8 @@ export function verifyClusterDispatchAssertionV3(input) {
     const generation = input.context.binding.generation;
     if (!generation)
         throw new Error('dispatch_assertion_invalid');
-    const parts = input.compact.split('.');
-    if (parts.length !== 3)
-        throw new Error('dispatch_assertion_invalid');
-    let header;
-    let payload;
-    try {
-        header = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
-        payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-    }
-    catch {
-        throw new Error('dispatch_assertion_invalid');
-    }
+    const parsed = parseRuntimeDispatchCompactV3(input.compact);
+    const { header, payload } = parsed;
     if (!isRecord(header) ||
         !isRecord(payload) ||
         !exactKeys(header, RUNTIME_DISPATCH_V3_HEADER_KEYS) ||
@@ -528,11 +531,16 @@ export function verifyClusterDispatchAssertionV3(input) {
         throw new Error('dispatch_assertion_invalid');
     }
     const key = crypto.createPublicKey({ key: input.context.hubPublicJwk, format: 'jwk' });
-    if (!crypto.verify('sha256', Buffer.from(`${parts[0]}.${parts[1]}`, 'utf8'), { key, dsaEncoding: 'ieee-p1363' }, Buffer.from(parts[2], 'base64url')))
+    if (!crypto.verify('sha256', Buffer.from(`${parsed.encodedHeader}.${parsed.encodedPayload}`, 'ascii'), { key, dsaEncoding: 'ieee-p1363' }, parsed.signature))
         throw new Error('dispatch_assertion_invalid');
     const now = input.now ?? Math.floor(Date.now() / 1000);
     const room = payload.authorizationContext === 'room';
-    if (!exactKeys(payload, room ? CLUSTER_DISPATCH_V3_ROOM_KEYS : CLUSTER_DISPATCH_V3_COMMON_KEYS) ||
+    const presentOptionalKeys = CLUSTER_DISPATCH_V3_OPTIONAL_KEYS.filter((key) => payload[key] !== undefined);
+    if (!exactKeys(payload, [
+        ...(room ? CLUSTER_DISPATCH_V3_ROOM_KEYS : CLUSTER_DISPATCH_V3_COMMON_KEYS),
+        ...presentOptionalKeys,
+    ]) ||
+        (payload.actor !== undefined && !validClusterDispatchActorV3(payload.actor)) ||
         payload.protocolVersion !== 3 ||
         payload.type !== 'hub-dispatch-assertion' ||
         payload.aud !== 'privos-mcp-app' ||
@@ -583,11 +591,36 @@ export function verifyClusterDispatchAssertionV3(input) {
         throw new Error('dispatch_assertion_replayed');
     replay.set(payload.jti, Number(payload.exp));
     return Object.freeze({
+        verificationPath: 'managed-cluster-v3',
+        protocolVersion: 3,
+        type: 'hub-dispatch-assertion',
+        issuer: String(payload.iss),
         jti: payload.jti,
         issuedAt: Number(payload.iat),
         expiresAt: Number(payload.exp),
+        workspaceId: String(payload.workspaceId),
+        deploymentId: String(payload.deploymentId),
+        generationId: String(payload.generationId),
+        generationNumber: Number(payload.generationNumber),
+        runtimeInstallationId: String(payload.runtimeInstallationId),
+        mcpAppId: String(payload.mcpAppId),
+        manifestDigest: String(payload.manifestDigest),
+        resourceManifestHash: String(payload.resourceManifestHash),
+        runtimeResourceInventoryHash: String(payload.runtimeResourceInventoryHash),
+        runtimeApprovalReceiptHash: String(payload.runtimeApprovalReceiptHash),
+        runtimeAuthorizationEpoch: Number(payload.runtimeGrantEpoch),
         authorizationContext: room ? 'room' : 'workspace',
-        ...(room ? { roomId: String(payload.roomId), authorizationBindingId: String(payload.authorizationBindingId) } : {}),
+        ...(room
+            ? {
+                roomId: String(payload.roomId),
+                authorizationBindingId: String(payload.authorizationBindingId),
+                bindingReceiptHash: String(payload.bindingReceiptHash),
+                bindingEpoch: Number(payload.bindingEpoch),
+            }
+            : {}),
+        ...(payload.actor !== undefined
+            ? { actor: Object.freeze({ ...payload.actor }) }
+            : {}),
     });
 }
 export function verifyDispatchAssertion(input) {