@provian/mcp 0.0.0-stage → 1.2.1

package/dist/core/disclosure-request.js

@@ -0,0 +1,400 @@
+"use strict";
+/**
+ * REQUESTER-NAMED DISCLOSURE — the second part of a signed challenge.
+ *
+ * Beyond predicates, a signed challenge may NAME what it wants to see from the presenter's own
+ * record: a specific PE by one of its output digests (`kind: 'pe'`), or PEs witnessed by a named
+ * issuer or signer (`kind: 'witness'`); each request may name specific FIELDS of the record (dotted
+ * paths into the act's pricing projection) and elect CONTENT (`description`, `intent`,
+ * `artifacts`, `fact_tier`). The predicate grammar is frozen; disclosure requests are a distinct
+ * part of the challenge, committed by their own `disclosures=` line in the signing string ONLY
+ * when present, so every pre-existing challenge signs byte-identical bytes.
+ *
+ * The presenter ELECTS per request: `disclosed` (with the matching records it holds, proven to the
+ * anchored root) or `declined` (signed as declined). Nothing is disclosed without an election; the
+ * floor of every disclosed record is METADATA (pe id, hash, action type, time, the witness facts
+ * the relay verified at issuance); fields and content appear only when requested AND elected.
+ * Standing is always present (disclosures ride the reputation tier). Disclosures travel only inside
+ * the requester-bound presentation; the relay retains nothing; nothing surfaces in the Commons.
+ *
+ * This module is the single source of the shapes, the canonical forms and the digests. Mirrored
+ * byte-for-byte (modulo the hash primitive import) in the SDK (`src/disclosure-request.ts`), the
+ * MCP core and the app (`src/core/presentation/disclosureRequest.ts`); the fixed vectors in
+ * `disclosure-request.test.ts` are pinned identically in each package.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DISCLOSURE_ELECTIONS = exports.DISCLOSURE_CONTENT_ELECTIONS = exports.DISCLOSURE_RECORD_MAX_BYTES = exports.DISCLOSURE_RECORDS_MAX_TOTAL = exports.DISCLOSURE_RECORDS_MAX_LIMIT = exports.DISCLOSURE_RECORDS_DEFAULT_LIMIT = exports.DISCLOSURE_FIELD_PATH_MAX_DEPTH = exports.DISCLOSURE_FIELDS_MAX = exports.DISCLOSURE_REQUESTS_MAX = void 0;
+exports.canonicalJson = canonicalJson;
+exports.isDisclosureFieldPath = isDisclosureFieldPath;
+exports.canonicalDisclosureRequest = canonicalDisclosureRequest;
+exports.disclosureRequestKey = disclosureRequestKey;
+exports.normalizeDisclosureRequests = normalizeDisclosureRequests;
+exports.disclosureRequestMatches = disclosureRequestMatches;
+exports.challengeDisclosuresDigest = challengeDisclosuresDigest;
+exports.canonicalDisclosureAnswers = canonicalDisclosureAnswers;
+exports.disclosureAnswersDigest = disclosureAnswersDigest;
+exports.readFieldPath = readFieldPath;
+exports.parseDisclosureAnswers = parseDisclosureAnswers;
+exports.recordMatchesRequest = recordMatchesRequest;
+exports.recordFloor = recordFloor;
+exports.disclosureCommitment = disclosureCommitment;
+exports.disclosureCommitmentDigest = disclosureCommitmentDigest;
+const crypto_1 = require("crypto");
+exports.DISCLOSURE_REQUESTS_MAX = 16;
+exports.DISCLOSURE_FIELDS_MAX = 32;
+exports.DISCLOSURE_FIELD_PATH_MAX_DEPTH = 6;
+exports.DISCLOSURE_RECORDS_DEFAULT_LIMIT = 10;
+exports.DISCLOSURE_RECORDS_MAX_LIMIT = 50;
+/** Every disclosed record of one presentation, across requests. */
+exports.DISCLOSURE_RECORDS_MAX_TOTAL = 50;
+/** Canonical bytes of one disclosed record (fields + content), a hard cap against a data channel. */
+exports.DISCLOSURE_RECORD_MAX_BYTES = 64 * 1024;
+exports.DISCLOSURE_CONTENT_ELECTIONS = ['description', 'intent', 'artifacts', 'fact_tier'];
+exports.DISCLOSURE_ELECTIONS = ['disclosed', 'declined'];
+const HEX64_RE = /^[0-9a-f]{64}$/;
+const FIELD_SEGMENT_RE = /^[A-Za-z0-9_-]{1,64}$/;
+/** An issuer or signer name: a root fingerprint (64 hex), `chain:<name>`, a hostname, a device id. */
+const WITNESS_NAME_RE = /^[A-Za-z0-9:._-]{1,128}$/;
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function sha256hex(input) {
+    return (0, crypto_1.createHash)('sha256').update(input, 'utf8').digest('hex');
+}
+/**
+ * Canonical JSON (sorted keys, no whitespace, undefined members dropped) — the same rule the meter
+ * wire uses, carried here so this module stays dependency-free in every package.
+ */
+function canonicalJson(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error('canonical_json_non_finite_number');
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'string' || typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map((v) => (v === undefined ? 'null' : canonicalJson(v))).join(',') + ']';
+    if (typeof value === 'object') {
+        const obj = value;
+        const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+        return '{' + keys.map((k) => JSON.stringify(k) + ':' + canonicalJson(obj[k])).join(',') + '}';
+    }
+    throw new Error(`canonical_json_unsupported_type:${typeof value}`);
+}
+const FORBIDDEN_FIELD_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+/** A dotted field path into the pricing projection: 1..6 segments of `[A-Za-z0-9_-]{1,64}`. */
+function isDisclosureFieldPath(path) {
+    if (typeof path !== 'string' || path.length === 0 || path.length > 256)
+        return false;
+    const segments = path.split('.');
+    // Prototype-chain names are refused in every path (Security Invariant #6), never read around.
+    return segments.length <= exports.DISCLOSURE_FIELD_PATH_MAX_DEPTH
+        && segments.every((s) => FIELD_SEGMENT_RE.test(s) && !FORBIDDEN_FIELD_SEGMENTS.has(s));
+}
+function normalizeFields(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw) || raw.length > exports.DISCLOSURE_FIELDS_MAX)
+        return null;
+    const out = new Set();
+    for (const f of raw) {
+        if (!isDisclosureFieldPath(f))
+            return null;
+        out.add(f);
+    }
+    return [...out].sort();
+}
+function normalizeContent(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw) || raw.length > exports.DISCLOSURE_CONTENT_ELECTIONS.length)
+        return null;
+    const out = new Set();
+    for (const c of raw) {
+        if (typeof c !== 'string' || !exports.DISCLOSURE_CONTENT_ELECTIONS.includes(c))
+            return null;
+        out.add(c);
+    }
+    return [...out].sort();
+}
+function normalizeDigest(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const d = raw.trim().toLowerCase().replace(/^sha256:/, '').replace(/^0x/, '');
+    return HEX64_RE.test(d) ? d : null;
+}
+function normalizeWitnessName(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (typeof raw !== 'string')
+        return null;
+    const n = raw.trim().toLowerCase();
+    return WITNESS_NAME_RE.test(n) ? n : null;
+}
+/**
+ * Parse ONE untrusted disclosure request into its canonical form, fail-closed (`null` on anything
+ * malformed: an unknown kind, a digest that is not 64 hex, a witness request naming neither issuer
+ * nor signer, a bad field path, an unknown content election, a limit outside 1..50).
+ */
+function canonicalDisclosureRequest(raw) {
+    if (!isRecord(raw))
+        return null;
+    const fields = normalizeFields(raw.fields);
+    if (fields === null)
+        return null;
+    const content = normalizeContent(raw.content);
+    if (content === null)
+        return null;
+    const tail = {
+        ...(fields !== undefined && fields.length > 0 ? { fields } : {}),
+        ...(content !== undefined && content.length > 0 ? { content } : {}),
+    };
+    if (raw.kind === 'pe') {
+        const digest = normalizeDigest(raw.output_digest);
+        if (digest === null)
+            return null;
+        const issuer = normalizeWitnessName(raw.issuer);
+        if (issuer === null)
+            return null;
+        for (const k of Object.keys(raw))
+            if (!['kind', 'output_digest', 'issuer', 'fields', 'content'].includes(k))
+                return null;
+        return { kind: 'pe', output_digest: digest, ...(issuer !== undefined ? { issuer } : {}), ...tail };
+    }
+    if (raw.kind === 'witness') {
+        const issuer = normalizeWitnessName(raw.issuer);
+        const signer = normalizeWitnessName(raw.signer);
+        if (issuer === null || signer === null)
+            return null;
+        if (issuer === undefined && signer === undefined)
+            return null;
+        let limit = exports.DISCLOSURE_RECORDS_DEFAULT_LIMIT;
+        if (raw.limit !== undefined) {
+            if (typeof raw.limit !== 'number' || !Number.isInteger(raw.limit) || raw.limit < 1 || raw.limit > exports.DISCLOSURE_RECORDS_MAX_LIMIT)
+                return null;
+            limit = raw.limit;
+        }
+        for (const k of Object.keys(raw))
+            if (!['kind', 'issuer', 'signer', 'limit', 'fields', 'content'].includes(k))
+                return null;
+        return { kind: 'witness', ...(issuer !== undefined ? { issuer } : {}), ...(signer !== undefined ? { signer } : {}), limit, ...tail };
+    }
+    return null;
+}
+/** The order-independent identity of a request (its canonical JSON). */
+function disclosureRequestKey(req) {
+    return canonicalJson(req);
+}
+/**
+ * Parse an untrusted request list, fail-closed: `[]` for absent, `null` when it is not a list, is
+ * over the cap, carries a malformed entry, or names the same request twice.
+ */
+function normalizeDisclosureRequests(raw) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw) || raw.length > exports.DISCLOSURE_REQUESTS_MAX)
+        return null;
+    const out = [];
+    const seen = new Set();
+    for (const entry of raw) {
+        const c = canonicalDisclosureRequest(entry);
+        if (c === null)
+            return null;
+        const key = disclosureRequestKey(c);
+        if (seen.has(key))
+            return null;
+        seen.add(key);
+        out.push(c);
+    }
+    return out.sort((a, b) => disclosureRequestKey(a).localeCompare(disclosureRequestKey(b)));
+}
+/** Two requests are the same when their canonical forms are byte-identical. */
+function disclosureRequestMatches(a, b) {
+    return disclosureRequestKey(a) === disclosureRequestKey(b);
+}
+/** sha256 hex of the canonical, sorted request list — the `disclosures=` signing-string commitment. */
+function challengeDisclosuresDigest(requests) {
+    const sorted = [...(requests ?? [])].sort((a, b) => disclosureRequestKey(a).localeCompare(disclosureRequestKey(b)));
+    return sha256hex(canonicalJson(sorted));
+}
+/** The canonical, order-independent form of the answers — what the presenter's proof of possession
+ *  and the Provian signature commit to (elections AND records). */
+function canonicalDisclosureAnswers(answers) {
+    return [...answers]
+        .map((a) => ({
+        request: a.request,
+        election: a.election,
+        ...(a.election === 'disclosed' ? { records: [...(a.records ?? [])].sort((x, y) => x.pe_id.localeCompare(y.pe_id)) } : {}),
+    }))
+        .sort((a, b) => disclosureRequestKey(a.request).localeCompare(disclosureRequestKey(b.request)));
+}
+/** sha256 hex of the canonical answers — the `disclosures=` line of the claims digest. */
+function disclosureAnswersDigest(answers) {
+    return sha256hex(canonicalJson(canonicalDisclosureAnswers(answers)));
+}
+/** Read a dotted path off a plain object; `null` when any segment is absent. */
+function readFieldPath(source, path) {
+    let cur = source;
+    for (const seg of path.split('.')) {
+        if (Array.isArray(cur)) {
+            const i = Number(seg);
+            if (!Number.isInteger(i) || i < 0 || i >= cur.length)
+                return null;
+            cur = cur[i];
+        }
+        else if (isRecord(cur) && Object.prototype.hasOwnProperty.call(cur, seg)) {
+            cur = cur[seg];
+        }
+        else {
+            return null;
+        }
+    }
+    return cur === undefined ? null : cur;
+}
+/** Parse an untrusted answer list structurally (elections and record floors); `null` when malformed. */
+function parseDisclosureAnswers(raw) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (!Array.isArray(raw) || raw.length > exports.DISCLOSURE_REQUESTS_MAX)
+        return null;
+    const out = [];
+    const seen = new Set();
+    let total = 0;
+    for (const entry of raw) {
+        if (!isRecord(entry))
+            return null;
+        const request = canonicalDisclosureRequest(entry.request);
+        if (request === null)
+            return null;
+        const key = disclosureRequestKey(request);
+        if (seen.has(key))
+            return null;
+        seen.add(key);
+        if (entry.election !== 'disclosed' && entry.election !== 'declined')
+            return null;
+        if (entry.election === 'declined') {
+            if (entry.records !== undefined)
+                return null;
+            out.push({ request, election: 'declined' });
+            continue;
+        }
+        if (!Array.isArray(entry.records))
+            return null;
+        const limit = request.kind === 'witness' ? request.limit : 1;
+        if (entry.records.length > limit)
+            return null;
+        const records = [];
+        const ids = new Set();
+        for (const r of entry.records) {
+            const rec = parseDisclosedRecord(r);
+            if (rec === null || ids.has(rec.pe_id))
+                return null;
+            ids.add(rec.pe_id);
+            records.push(rec);
+            total += 1;
+            if (total > exports.DISCLOSURE_RECORDS_MAX_TOTAL)
+                return null;
+        }
+        out.push({ request, election: 'disclosed', records });
+    }
+    return out;
+}
+function parseDisclosedRecord(raw) {
+    if (!isRecord(raw))
+        return null;
+    if (typeof raw.pe_id !== 'string' || raw.pe_id.length === 0 || raw.pe_id.length > 256)
+        return null;
+    const hash = normalizeDigest(raw.pe_hash);
+    if (hash === null)
+        return null;
+    if (typeof raw.action_type !== 'string' || raw.action_type.length === 0 || raw.action_type.length > 128)
+        return null;
+    if (typeof raw.timestamp !== 'number' || !Number.isSafeInteger(raw.timestamp) || raw.timestamp < 0)
+        return null;
+    const w = raw.witness;
+    if (!isRecord(w) || (w.kind !== 'hardware' && w.kind !== 'chain' && w.kind !== 'device'))
+        return null;
+    const witness = { kind: w.kind };
+    for (const k of ['scheme', 'issuer', 'signer', 'measurement', 'region', 'ref']) {
+        if (w[k] === undefined)
+            continue;
+        if (typeof w[k] !== 'string' || w[k].length > 256)
+            return null;
+        witness[k] = w[k];
+    }
+    const rec = { pe_id: raw.pe_id, pe_hash: hash, action_type: raw.action_type, timestamp: raw.timestamp, witness };
+    if (raw.output_digest !== undefined) {
+        const d = normalizeDigest(raw.output_digest);
+        if (d === null)
+            return null;
+        rec.output_digest = d;
+    }
+    if (raw.fields !== undefined) {
+        if (!isRecord(raw.fields))
+            return null;
+        for (const k of Object.keys(raw.fields))
+            if (!isDisclosureFieldPath(k))
+                return null;
+        rec.fields = raw.fields;
+    }
+    if (raw.content !== undefined) {
+        if (!isRecord(raw.content))
+            return null;
+        for (const k of Object.keys(raw.content))
+            if (!exports.DISCLOSURE_CONTENT_ELECTIONS.includes(k))
+                return null;
+        rec.content = raw.content;
+    }
+    try {
+        if (canonicalJson(rec).length > exports.DISCLOSURE_RECORD_MAX_BYTES)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return rec;
+}
+/**
+ * Does a record satisfy the request it answers? `pe`: the record carries the named digest (and the
+ * issuer when named). `witness`: the record's witness carries the named issuer / signer.
+ */
+function recordMatchesRequest(record, request) {
+    if (request.kind === 'pe') {
+        if (record.output_digest !== request.output_digest)
+            return false;
+        if (request.issuer !== undefined && record.witness.issuer !== request.issuer)
+            return false;
+        return true;
+    }
+    if (request.issuer !== undefined && record.witness.issuer !== request.issuer)
+        return false;
+    if (request.signer !== undefined && record.witness.signer !== request.signer)
+        return false;
+    return true;
+}
+/** The floor-only view of a record: no fields, no content — what a declined-content request yields. */
+function recordFloor(record) {
+    const { fields: _f, content: _c, ...floor } = record;
+    return floor;
+}
+/**
+ * The PRESENTER'S commitment: what it elected and WHICH records (by id + hash) it put forward —
+ * everything the presenter can know before the relay derives the witness facts. Its sha256 is the
+ * `disclosures=` line of the claims digest the proof of possession signs; the relay-derived facts,
+ * fields and content are covered by the Provian signature over the payload, and a verifier checks
+ * every field against the anchored act record itself.
+ */
+function disclosureCommitment(answers) {
+    return canonicalDisclosureAnswers(answers).map((a) => ({
+        request: a.request,
+        election: a.election,
+        ...(a.election === 'disclosed' ? { records: (a.records ?? []).map((r) => ({ pe_id: r.pe_id, pe_hash: r.pe_hash })) } : {}),
+    }));
+}
+function disclosureCommitmentDigest(answers) {
+    return sha256hex(canonicalJson(disclosureCommitment(answers)));
+}
+//# sourceMappingURL=disclosure-request.js.map

package/dist/core/disclosure-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disclosure-request.js","sourceRoot":"","sources":["../../src/core/disclosure-request.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AA2GH,sCAcC;AAKD,sDAMC;AA0CD,gEAgCC;AAGD,oDAEC;AAMD,kEAcC;AAGD,4DAEC;AAGD,gEAGC;AAID,gEAQC;AAGD,0DAEC;AAGD,sCAcC;AAGD,wDAmCC;AA6CD,oDASC;AAGD,kCAGC;AAgBD,oDAMC;AAED,gEAEC;AA9YD,mCAAoC;AAEvB,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAC7B,QAAA,qBAAqB,GAAG,EAAE,CAAC;AAC3B,QAAA,+BAA+B,GAAG,CAAC,CAAC;AACpC,QAAA,gCAAgC,GAAG,EAAE,CAAC;AACtC,QAAA,4BAA4B,GAAG,EAAE,CAAC;AAC/C,mEAAmE;AACtD,QAAA,4BAA4B,GAAG,EAAE,CAAC;AAC/C,qGAAqG;AACxF,QAAA,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,QAAA,4BAA4B,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAG5F,QAAA,oBAAoB,GAAG,CAAC,WAAW,EAAE,UAAU,CAAU,CAAC;AAGvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD,sGAAsG;AACtG,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAwEnD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACvH,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,KAAK,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzG,+FAA+F;AAC/F,SAAgB,qBAAqB,CAAC,IAAa;IACjD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,8FAA8F;IAC9F,OAAO,QAAQ,CAAC,MAAM,IAAI,uCAA+B;WACpD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,6BAAqB;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,oCAA4B,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAE,oCAAkD,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3G,GAAG,CAAC,GAAG,CAAC,CAAsB,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CAAC,GAAY;IACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACzH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;IACrG,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,KAAK,GAAG,wCAAgC,CAAC;QAC7C,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,oCAA4B;gBAAE,OAAO,IAAI,CAAC;YAC5I,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC3H,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;IACvI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wEAAwE;AACxE,SAAgB,oBAAoB,CAAC,GAA+B;IAClE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;IACtD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,+BAAuB;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,+EAA+E;AAC/E,SAAgB,wBAAwB,CAAC,CAA6B,EAAE,CAA6B;IACnG,OAAO,oBAAoB,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,uGAAuG;AACvG,SAAgB,0BAA0B,CAAC,QAA2D;IACpG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,OAAO,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;mEACmE;AACnE,SAAgB,0BAA0B,CAAC,OAAoC;IAC7E,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1H,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,0FAA0F;AAC1F,SAAgB,uBAAuB,CAAC,OAAoC;IAC1E,OAAO,SAAS,CAAC,aAAa,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,SAAgB,aAAa,CAAC,MAAe,EAAE,IAAY;IACzD,IAAI,GAAG,GAAY,MAAM,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAClE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3E,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;AACxC,CAAC;AAED,wGAAwG;AACxG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,+BAAuB;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QACjF,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,oCAA4B;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACrH,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChH,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtG,MAAM,OAAO,GAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACjC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAK,CAAC,CAAC,CAAC,CAAY,CAAC,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;IAC1I,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5B,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,IAAI,CAAE,oCAAkD,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5H,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC;QACH,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,mCAA2B;YAAE,OAAO,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAiC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,MAAuB,EAAE,OAAmC;IAC/F,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,aAAa,KAAK,OAAO,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AACvG,SAAgB,WAAW,CAAC,MAAuB;IACjD,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AASD;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,OAAoC;IACvE,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3H,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAAoC;IAC7E,OAAO,SAAS,CAAC,aAAa,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/core/genesis-offer.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The Genesis offer line — LEADS the MCP server's startup output (stdio banner on
+ * stderr) and its initialize `instructions` while the Genesis window is open, and
+ * is absent after it closes. A runtime date check: the line retires itself at the
+ * window's end with no republish or redeploy.
+ *
+ * SHARED CORE — canonical in `provian-mcp/src/core/`, mirrored into
+ * `provian-backend/src/mcp/core/` (scripts/sync-mcp-core.sh). Edit only the
+ * canonical copy. The relay's hosted bootstrap script builder also reads this
+ * constant from the mirror, so the backend defines it exactly once.
+ */
+/**
+ * 2027-01-01T00:00:00Z in ms — the Genesis window's END (exclusive). This is the
+ * relay's checked-in Genesis campaign manifest `window.end_ms`
+ * (PROPOSED_GENESIS_CAMPAIGN_POLICY, open through December 31, 2026) and the
+ * live PVT9 kernel's on-chain `genesisEndsAt` (1798761600 s). If the manifest
+ * or the kernel ever moves the close, move this with it.
+ */
+export declare const GENESIS_WINDOW_END_MS = 1798761600000;
+export declare const GENESIS_OFFER_LINE = "Genesis is open through December 31, 2026: a new agent wallet receives 74.25 PVT net from a 75 PVT gross grant.";
+/** True while the Genesis window is open (strictly before its end instant). */
+export declare function isGenesisWindowOpen(nowMs?: number): boolean;
+/** The lines to lead the output with: the offer while open, nothing after. */
+export declare function genesisOfferLines(nowMs?: number): string[];
+//# sourceMappingURL=genesis-offer.d.ts.map

package/dist/core/genesis-offer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"genesis-offer.d.ts","sourceRoot":"","sources":["../../src/core/genesis-offer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,gBAAoB,CAAC;AAEvD,eAAO,MAAM,kBAAkB,oHACoF,CAAC;AAEpH,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,MAAmB,GAAG,OAAO,CAEvE;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAmB,GAAG,MAAM,EAAE,CAEtE"}

package/dist/core/genesis-offer.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * The Genesis offer line — LEADS the MCP server's startup output (stdio banner on
+ * stderr) and its initialize `instructions` while the Genesis window is open, and
+ * is absent after it closes. A runtime date check: the line retires itself at the
+ * window's end with no republish or redeploy.
+ *
+ * SHARED CORE — canonical in `provian-mcp/src/core/`, mirrored into
+ * `provian-backend/src/mcp/core/` (scripts/sync-mcp-core.sh). Edit only the
+ * canonical copy. The relay's hosted bootstrap script builder also reads this
+ * constant from the mirror, so the backend defines it exactly once.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENESIS_OFFER_LINE = exports.GENESIS_WINDOW_END_MS = void 0;
+exports.isGenesisWindowOpen = isGenesisWindowOpen;
+exports.genesisOfferLines = genesisOfferLines;
+/**
+ * 2027-01-01T00:00:00Z in ms — the Genesis window's END (exclusive). This is the
+ * relay's checked-in Genesis campaign manifest `window.end_ms`
+ * (PROPOSED_GENESIS_CAMPAIGN_POLICY, open through December 31, 2026) and the
+ * live PVT9 kernel's on-chain `genesisEndsAt` (1798761600 s). If the manifest
+ * or the kernel ever moves the close, move this with it.
+ */
+exports.GENESIS_WINDOW_END_MS = 1798761600000;
+exports.GENESIS_OFFER_LINE = 'Genesis is open through December 31, 2026: a new agent wallet receives 74.25 PVT net from a 75 PVT gross grant.';
+/** True while the Genesis window is open (strictly before its end instant). */
+function isGenesisWindowOpen(nowMs = Date.now()) {
+    return Number.isFinite(nowMs) && nowMs < exports.GENESIS_WINDOW_END_MS;
+}
+/** The lines to lead the output with: the offer while open, nothing after. */
+function genesisOfferLines(nowMs = Date.now()) {
+    return isGenesisWindowOpen(nowMs) ? [exports.GENESIS_OFFER_LINE] : [];
+}
+//# sourceMappingURL=genesis-offer.js.map

package/dist/core/genesis-offer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"genesis-offer.js","sourceRoot":"","sources":["../../src/core/genesis-offer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAeH,kDAEC;AAGD,8CAEC;AApBD;;;;;;GAMG;AACU,QAAA,qBAAqB,GAAG,aAAiB,CAAC;AAE1C,QAAA,kBAAkB,GAC7B,iHAAiH,CAAC;AAEpH,+EAA+E;AAC/E,SAAgB,mBAAmB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,6BAAqB,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,SAAgB,iBAAiB,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAC1D,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,0BAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/core/harness-tool-vocabulary.d.ts

@@ -0,0 +1,55 @@
+/**
+ * harness-tool-vocabulary — the ONE list of tool names a self-report may seal
+ * verbatim (review 2: a tool NAME must never carry prose).
+ *
+ * WHY. On the self-report lanes (the loopback witness endpoint and the MCP
+ * report tools) the tool name is written by the agent. "Normalize to a token"
+ * was not enough: `refactored billing module for Acme Corp` became
+ * `refactored_billing_module_for_Acme_Corp` prose with underscores. So a name
+ * is sealed verbatim ONLY when it is a real harness tool name — one of the names
+ * the transcript extractors recognise from Claude Code, OpenClaw, Codex, Gemini
+ * CLI and Grok Build (the harnesses whose records the daemon reads). Any other
+ * name is sealed as `h:` + the first 12 hex of sha256(name): the same name
+ * always seals the same token (so counts and repeats stay meaningful), and the
+ * text never leaves the device.
+ *
+ * THE REPORTING APP TOO (review 3). A self-report's `source_app` (and the
+ * compute block's `framework`, which carries the same value) is agent-written as
+ * well: `refactored billing for acme` slugged to `refactored_billing_for_acme`
+ * was prose with underscores again. So `source_app` follows the same rule: a
+ * name in the app vocabulary below (harnesses, agent platforms, generic runners)
+ * is sealed verbatim as its lowercase slug, anything else as `h:` + 12 hex.
+ *
+ * ONE DEFINITION, CARRIED BYTE-IDENTICAL. This file lives in the SDK
+ * (`provian-agent-sdk/src/observer/`), the relay (`provian-backend/src/mcp/core/`,
+ * which the relay's self-report reduction and the hosted MCP tools both import)
+ * and the stdio MCP package (`provian-mcp/src/core/`). The packages cannot
+ * import one another, so `scripts/check-mcp-tool-parity.mjs` byte-compares the
+ * three and `harness-tool-vocabulary-parity.test.ts` (backend) pins them.
+ */
+/** Tool names the harness transcript extractors recognise, sealed verbatim. */
+export declare const HARNESS_TOOL_NAMES: readonly string[];
+/**
+ * Reporting-app names a self-report may seal verbatim as `source_app` /
+ * `compute.framework` — lowercase slugs of the agent harnesses the daemon reads,
+ * agent platforms, and generic runners. A label, never a sentence.
+ */
+export declare const HARNESS_APP_NAMES: readonly string[];
+/** The source_app sealed when none is given. */
+export declare const DEFAULT_SOURCE_APP = "local_process";
+/** A name already sealed as a hash token (`h:` + 12 lowercase hex). */
+export declare const HASHED_TOOL_NAME_RE: RegExp;
+/**
+ * The name a self-report seals: a harness tool name verbatim, an already-hashed
+ * token as-is, anything else `h:` + the first 12 hex of sha256(trimmed name).
+ * Null for a non-string or empty name.
+ */
+export declare function sealedToolName(raw: unknown): string | null;
+/**
+ * The `source_app` a self-report seals (and its `compute.framework`): the
+ * lowercase slug when it is in the app vocabulary, an already-hashed token
+ * as-is, anything else `h:` + the first 12 hex of sha256(the full slug).
+ * A non-string or empty value is `local_process`.
+ */
+export declare function sealedSourceApp(raw: unknown): string;
+//# sourceMappingURL=harness-tool-vocabulary.d.ts.map

package/dist/core/harness-tool-vocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-tool-vocabulary.d.ts","sourceRoot":"","sources":["../../src/core/harness-tool-vocabulary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,+EAA+E;AAC/E,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAkB9C,CAAC;AAIH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAY7C,CAAC;AAIH,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAM1D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASpD"}