@qduc/term2 0.13.0 → 0.15.0

package/dist/gateway/assertion.js

@@ -0,0 +1,146 @@
+import { createPublicKey, createSign, createVerify, randomUUID } from 'node:crypto';
+import { ASSERTION_PURPOSES, isAssertionPurpose, } from './contracts.js';
+const MAX_ASSERTION_LIFETIME_SECONDS = 60;
+const DEFAULT_CLOCK_SKEW_SECONDS = 5;
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+export class GatewayAssertionError extends Error {
+    code;
+    constructor(code) {
+        super('gateway assertion rejected');
+        this.name = 'GatewayAssertionError';
+        this.code = code;
+    }
+}
+const encode = (value) => Buffer.from(JSON.stringify(value)).toString('base64url');
+const decode = (value) => JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+export function createGatewayAssertion(options) {
+    const now = options.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const lifetime = options.lifetimeSeconds ?? MAX_ASSERTION_LIFETIME_SECONDS;
+    if (!Number.isInteger(lifetime) || lifetime < 1 || lifetime > MAX_ASSERTION_LIFETIME_SECONDS) {
+        throw new Error('assertion lifetime must be between 1 and 60 seconds');
+    }
+    if (!options.subject || !options.issuer || !options.audience || !options.kid)
+        throw new Error('assertion identity is required');
+    const header = { alg: 'RS256', typ: 'JWT', kid: options.kid };
+    const claims = {
+        iss: options.issuer,
+        aud: options.audience,
+        sub: options.subject,
+        purpose: options.purpose,
+        iat: now,
+        nbf: now - DEFAULT_CLOCK_SKEW_SECONDS,
+        exp: now + lifetime,
+        jti: options.jti ?? randomUUID(),
+        ver: 1,
+        ...(options.workspaceId === undefined ? {} : { workspaceId: options.workspaceId }),
+        ...(options.sessionId === undefined ? {} : { sessionId: options.sessionId }),
+    };
+    const input = `${encode(header)}.${encode(claims)}`;
+    const signer = createSign('RSA-SHA256');
+    signer.update(input);
+    signer.end();
+    return `${input}.${signer.sign(options.privateKey).toString('base64url')}`;
+}
+/** Verifies and consumes one internal BFF assertion. Failures reveal no detail to callers. */
+export class AssertionVerifier {
+    #issuer;
+    #audience;
+    #keys;
+    #ledger;
+    #clock;
+    #clockSkew;
+    constructor(options) {
+        if (!options.issuer || !options.audience || (options.publicKeys instanceof Map && options.publicKeys.size === 0)) {
+            throw new Error('gateway assertion configuration is incomplete');
+        }
+        const entries = options.publicKeys instanceof Map ? [...options.publicKeys.entries()] : Object.entries(options.publicKeys);
+        if (entries.length === 0)
+            throw new Error('gateway assertion configuration is incomplete');
+        this.#keys = new Map(entries.map(([kid, key]) => [kid, createPublicKey(key)]));
+        this.#issuer = options.issuer;
+        this.#audience = options.audience;
+        this.#ledger = options.replayLedger;
+        this.#clock = options.clock ?? (() => Date.now() / 1000);
+        this.#clockSkew = options.clockSkewSeconds ?? DEFAULT_CLOCK_SKEW_SECONDS;
+        if (!Number.isFinite(this.#clockSkew) || this.#clockSkew < 0 || this.#clockSkew > 30)
+            throw new Error('invalid gateway clock skew');
+    }
+    verify(token, expectedPurpose) {
+        let header;
+        let claims;
+        let input;
+        let signature;
+        try {
+            const pieces = token.split('.');
+            if (pieces.length !== 3 || pieces.some((piece) => !piece || !BASE64URL.test(piece)))
+                throw new Error();
+            input = `${pieces[0]}.${pieces[1]}`;
+            header = decode(pieces[0]);
+            claims = decode(pieces[1]);
+            signature = Buffer.from(pieces[2], 'base64url');
+        }
+        catch {
+            throw new GatewayAssertionError('malformed');
+        }
+        if (header.alg !== 'RS256' || header.typ !== 'JWT' || typeof header.kid !== 'string') {
+            throw new GatewayAssertionError('malformed');
+        }
+        const key = this.#keys.get(header.kid);
+        if (!key)
+            throw new GatewayAssertionError('unknown_key');
+        const verifier = createVerify('RSA-SHA256');
+        verifier.update(input);
+        verifier.end();
+        if (!verifier.verify(key, signature))
+            throw new GatewayAssertionError('invalid_signature');
+        if (!isClaims(claims))
+            throw new GatewayAssertionError('invalid_claims');
+        const now = this.#clock();
+        if (claims.iss !== this.#issuer || claims.aud !== this.#audience || claims.ver !== 1) {
+            throw new GatewayAssertionError('invalid_claims');
+        }
+        if (expectedPurpose !== undefined && claims.purpose !== expectedPurpose)
+            throw new GatewayAssertionError('wrong_purpose');
+        if (claims.nbf > now + this.#clockSkew)
+            throw new GatewayAssertionError('not_yet_valid');
+        if (claims.exp <= now - this.#clockSkew)
+            throw new GatewayAssertionError('expired');
+        if (claims.exp <= claims.iat || claims.exp - claims.iat > MAX_ASSERTION_LIFETIME_SECONDS) {
+            throw new GatewayAssertionError('invalid_claims');
+        }
+        if (!this.#ledger.record({ ...claims, sessionId: claims.sessionId }, Math.floor(now))) {
+            throw new GatewayAssertionError('replay');
+        }
+        return claims;
+    }
+}
+function isClaims(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    if (typeof candidate.iss !== 'string' ||
+        typeof candidate.aud !== 'string' ||
+        typeof candidate.sub !== 'string' ||
+        candidate.sub.length === 0 ||
+        !isAssertionPurpose(candidate.purpose) ||
+        !Number.isInteger(candidate.iat) ||
+        !Number.isInteger(candidate.nbf) ||
+        !Number.isInteger(candidate.exp) ||
+        typeof candidate.jti !== 'string' ||
+        candidate.jti.length === 0 ||
+        candidate.ver !== 1 ||
+        (candidate.workspaceId !== undefined && typeof candidate.workspaceId !== 'string') ||
+        (candidate.sessionId !== undefined && typeof candidate.sessionId !== 'string'))
+        return false;
+    if (candidate.purpose === 'workspace_list' ||
+        candidate.purpose === 'session_list' ||
+        candidate.purpose === 'model_list') {
+        return candidate.workspaceId === undefined && candidate.sessionId === undefined;
+    }
+    if (candidate.purpose === 'session_create')
+        return typeof candidate.workspaceId === 'string' && candidate.sessionId === undefined;
+    return ((candidate.workspaceId === undefined || typeof candidate.workspaceId === 'string') &&
+        typeof candidate.sessionId === 'string');
+}
+export const assertionPurposes = [...ASSERTION_PURPOSES];
+//# sourceMappingURL=assertion.js.map

package/dist/gateway/assertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../source/gateway/assertion.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AACpG,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAGnB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAIrC,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,CAQO;IAEpB,YAAY,IAAmC;QAC7C,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpG,MAAM,MAAM,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;AAgBnH,MAAM,UAAU,sBAAsB,CAAC,OAA+B;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,IAAI,8BAA8B,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,8BAA8B,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9D,MAAM,MAAM,GAA2B;QACrC,GAAG,EAAE,OAAO,CAAC,MAAM;QACnB,GAAG,EAAE,OAAO,CAAC,QAAQ;QACrB,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,0BAA0B;QACrC,GAAG,EAAE,GAAG,GAAG,QAAQ;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE;QAChC,GAAG,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;KAC7E,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,EAAE,CAAC;IACb,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7E,CAAC;AAWD,8FAA8F;AAC9F,MAAM,OAAO,iBAAiB;IACnB,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,KAAK,CAAiC;IACtC,OAAO,CAAe;IACtB,MAAM,CAAe;IACrB,UAAU,CAAS;IAE5B,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,YAAY,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YACjH,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GACX,OAAO,CAAC,UAAU,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC3F,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,EAAE;YAClF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,eAAkC;QACtD,IAAI,MAA+B,CAAC;QACpC,IAAI,MAAe,CAAC;QACpB,IAAI,KAAa,CAAC;QAClB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACvG,KAAK,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAA4B,CAAC;YACtD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrF,MAAM,IAAI,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,qBAAqB,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAC3F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,eAAe;YACrE,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,8BAA8B,EAAE,CAAC;YACzF,MAAM,IAAI,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IACE,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC;QACtC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;QAChC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;QAChC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC;QAChC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAC1B,SAAS,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC;QAClF,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC;QAE9E,OAAO,KAAK,CAAC;IACf,IACE,SAAS,CAAC,OAAO,KAAK,gBAAgB;QACtC,SAAS,CAAC,OAAO,KAAK,cAAc;QACpC,SAAS,CAAC,OAAO,KAAK,YAAY,EAClC,CAAC;QACD,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,gBAAgB;QACxC,OAAO,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC;IACxF,OAAO,CACL,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC;QAClF,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CACxC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC"}

package/dist/gateway/contracts.d.ts

@@ -0,0 +1,124 @@
+import type { SessionRuntime } from '../core/index.js';
+export declare const ASSERTION_PURPOSES: readonly ['workspace_list', 'session_list', 'model_list', 'session_create', 'session_read', 'message_submit', 'interaction_resolve', 'abort', 'events_connect'];
+export type AssertionPurpose = (typeof ASSERTION_PURPOSES)[number];
+export type GatewayAssertionClaims = {
+    iss: string;
+    aud: string;
+    sub: string;
+    purpose: AssertionPurpose;
+    iat: number;
+    nbf: number;
+    exp: number;
+    jti: string;
+    ver: 1;
+    workspaceId?: string;
+    sessionId?: string;
+};
+export type WorkspaceAlias = {
+    workspaceId: string;
+    label: string;
+    access: 'read' | 'read_write';
+};
+export type WorkspaceGrantBffRecord = {
+    workspaceId: string;
+    ownerUserId: string;
+    label: string;
+    access: 'read' | 'read_write';
+};
+export type WorkspaceGrant = {
+    workspaceId: string;
+    ownerUserId: string;
+    label: string;
+    kind: 'local' | 'ssh';
+    localRoot?: string;
+    sshTargetId?: string;
+    remoteRoot?: string;
+    access: 'read' | 'read_write';
+    enabled: boolean;
+};
+export type SshTarget = {
+    sshTargetId: string;
+    host: string;
+    port: number;
+    username: string;
+    remoteRootAllowlist: string[];
+    knownHostsProfile: string;
+    agentProfileId: string;
+    enabled: boolean;
+};
+export type GatewayManifest = {
+    version: number;
+    grants: WorkspaceGrant[];
+    sshTargets?: SshTarget[];
+    sha256?: string;
+};
+export type SessionBinding = {
+    sessionId: string;
+    ownerUserId: string;
+    workspaceId: string;
+    grantVersion: number;
+    canonicalRoot: string;
+    access: 'read' | 'read_write';
+};
+export type SecretFreeWorkerSettings = {
+    providerId: string;
+    modelId: string;
+    brokerCapabilityId: string;
+    /** Canonical real path used by both the settings snapshot and execution context. */
+    executionRoot: string;
+    envPolicyVersion: 1;
+};
+export type NormalizedProviderRequest = {
+    messages: readonly Record<string, unknown>[];
+    tools?: readonly Record<string, unknown>[];
+};
+export type NormalizedProviderResponse = {
+    text?: string;
+    finishReason?: string;
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+    };
+};
+export type NormalizedProviderChunk = {
+    type: 'text' | 'reasoning' | 'tool_call' | 'usage' | 'done' | 'error';
+    value?: string;
+};
+export type ProviderBrokerCapability = {
+    capabilityId: string;
+    providerId: string;
+    modelId: string;
+    request(input: NormalizedProviderRequest): Promise<NormalizedProviderResponse>;
+    stream(input: NormalizedProviderRequest): AsyncIterable<NormalizedProviderChunk>;
+};
+export type GatewaySafeLogMetadata = {
+    schemaVersion: 1;
+    sessionId?: string;
+    workspaceId?: string;
+    grantVersion?: number;
+    access?: 'read' | 'read_write';
+    principalRef?: string;
+    providerId?: string;
+    modelId?: string;
+    correlationId: string;
+    operation: 'startup' | 'workspace_list' | 'session_list' | 'model_list' | 'session_create' | 'session_read' | 'message_submit' | 'interaction_resolve' | 'abort' | 'events_connect' | 'shutdown';
+    outcome: 'allowed' | 'denied' | 'failed' | 'interrupted';
+    reasonCode?: string;
+};
+export type GatewaySessionComposition = {
+    sessionId: string;
+    binding: SessionBinding;
+    executionContext: import('../services/execution-context.js').ExecutionContext;
+    settings: SecretFreeWorkerSettings;
+    providerBroker: ProviderBrokerCapability;
+    env: Readonly<Record<string, string>>;
+    spawnOptions: {
+        cwd: string;
+        env: Readonly<Record<string, string>>;
+        gatewayMode: true;
+    };
+    runtime?: SessionRuntime;
+    dispose(): Promise<void> | void;
+};
+export declare const isAssertionPurpose: (value: unknown) => value is AssertionPurpose;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/gateway/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../source/gateway/contracts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,eAAO,MAAM,kBAAkB,YAC7B,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,OAAO,EACP,gBAAgB,CACR,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,CAAC,CAAC;IACP,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,YAAY,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oFAAoF;IACpF,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,CAAC,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC7C,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CAC5C,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACzD,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,aAAa,CAAC,uBAAuB,CAAC,CAAC;CAClF,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EACL,SAAS,GACT,gBAAgB,GAChB,cAAc,GACd,YAAY,GACZ,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,qBAAqB,GACrB,OAAO,GACP,gBAAgB,GAChB,UAAU,CAAC;IACf,OAAO,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC;IACxB,gBAAgB,EAAE,OAAO,kCAAkC,EAAE,gBAAgB,CAAC;IAC9E,QAAQ,EAAE,wBAAwB,CAAC;IACnC,cAAc,EAAE,wBAAwB,CAAC;IACzC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtC,YAAY,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACtC,WAAW,EAAE,IAAI,CAAC;KACnB,CAAC;IACF,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACjC,CAAC;AAEF,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,KAAK,IAAI,gBAC2B,CAAC"}

package/dist/gateway/contracts.js

@@ -0,0 +1,13 @@
+export const ASSERTION_PURPOSES = [
+    'workspace_list',
+    'session_list',
+    'model_list',
+    'session_create',
+    'session_read',
+    'message_submit',
+    'interaction_resolve',
+    'abort',
+    'events_connect',
+];
+export const isAssertionPurpose = (value) => typeof value === 'string' && ASSERTION_PURPOSES.includes(value);
+//# sourceMappingURL=contracts.js.map

package/dist/gateway/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../source/gateway/contracts.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,qBAAqB;IACrB,OAAO;IACP,gBAAgB;CACR,CAAC;AA8IX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC9E,OAAO,KAAK,KAAK,QAAQ,IAAK,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC"}

package/dist/gateway/gateway.d.ts

@@ -0,0 +1,72 @@
+import { createGatewayAssertion } from './assertion.js';
+import { GatewayLifecycle } from './lifecycle.js';
+import { WorkspaceAdmission, type WorkspaceBoundaryProbe } from './workspace-admission.js';
+import { composeGatewaySession, type GatewaySessionCompositionOptions, type WorkerBoundaryProbe } from './worker-boundary.js';
+import type { GatewayAssertionClaims, GatewayManifest, GatewaySafeLogMetadata, ProviderBrokerCapability, SessionBinding } from './contracts.js';
+import { GatewayServer } from './server.js';
+import type { RuntimeFactory } from './runtime-factory.js';
+import { type PendingInteractionDto, type SessionProjectionSource } from './persistence/projection.js';
+import { ServerSession } from './server-session.js';
+import type { GatewayPersistenceCoordinator } from './persistence/coordinator.js';
+declare const INTERACTION_METRICS: readonly ['interaction_presented', 'interaction_updated', 'interaction_resolved', 'interaction_stale', 'interaction_duplicate', 'interaction_sanitization_rejected', 'interaction_continuation_failed'];
+type InteractionMetric = (typeof INTERACTION_METRICS)[number];
+export type GatewayLaunchConfig = {
+    enabled: boolean;
+    socketPath: string;
+    manifestPath: string;
+    manifestSha256?: string;
+    replayDbPath: string;
+    issuer: string;
+    audience: string;
+    publicKeys: ReadonlyMap<string, string | Buffer> | Record<string, string | Buffer>;
+    providerBroker?: ProviderBrokerCapability;
+    providerProbe?: WorkerBoundaryProbe;
+    workerSandboxAvailable?: boolean;
+    workspaceBoundaryProbe?: WorkspaceBoundaryProbe;
+    tmpDir?: string;
+    sshEnabled?: boolean;
+    allowWrite?: boolean;
+    autoApprove?: boolean;
+    allowUnsandboxed?: boolean;
+    auditWriter?: (record: GatewaySafeLogMetadata) => Promise<void>;
+    /** Required for production admission; retained optional for legacy control-plane fixtures. */
+    runtimeFactory?: RuntimeFactory;
+    /** Optional plan-03 durable index/log/journal owner. */
+    persistence?: GatewayPersistenceCoordinator;
+};
+export declare class GatewayStartupError extends Error {
+    constructor();
+}
+export declare function assertGatewayStartup(config: GatewayLaunchConfig, manifest?: GatewayManifest): GatewayManifest;
+/** Gateway control plane. Runtime/session protocols remain private RPC consumers. */
+export declare class Term2Gateway {
+    #private;
+    private constructor();
+    static create(config: GatewayLaunchConfig): Term2Gateway;
+    get server(): GatewayServer;
+    get admission(): WorkspaceAdmission;
+    get lifecycle(): GatewayLifecycle;
+    get manifestVersion(): number;
+    get interactionMetrics(): Readonly<Record<InteractionMetric, number>>;
+    start(): Promise<void>;
+    createSession(claims: GatewayAssertionClaims, options?: Omit<GatewaySessionCompositionOptions, 'binding' | 'providerBroker' | 'providerProbe'>, correlationId?: string): Promise<ReturnType<typeof composeGatewaySession> | ServerSession>;
+    shutdown(graceMs?: number): Promise<void>;
+}
+export declare function classifyInteractionResolution(interaction: SessionProjectionSource['interaction'], hasLiveSnapshot: boolean): 'interaction_not_resolvable' | 'interaction_already_resolved' | null;
+export type InteractionResolveRequest = {
+    revision: number;
+    answer: string;
+    rejectionReason?: string;
+    approvalAnswer?: string;
+};
+export declare function isInteractionResolveRequest(body: unknown): body is InteractionResolveRequest;
+declare function isPublicEventEnvelope(event: import('./persistence/contracts.js').AgentEventEnvelope): boolean;
+declare function interactionDtoFromSnapshot(snapshot: {
+    interactionId?: number;
+    approval: unknown;
+    askUserAnswers: readonly unknown[];
+    currentAskUserQuestionIndex: number;
+}, interactionId: string, revision: number): PendingInteractionDto;
+export { createGatewayAssertion, interactionDtoFromSnapshot, isPublicEventEnvelope };
+export type { SessionBinding };
+//# sourceMappingURL=gateway.d.ts.map

package/dist/gateway/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../source/gateway/gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAEL,kBAAkB,EAElB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAS3D,OAAO,EAEL,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAerC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,6BAA6B,EAA2B,MAAM,8BAA8B,CAAC;AAQ3G,QAAA,MAAM,mBAAmB,YACvB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,CACzB,CAAC;AACX,KAAK,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAwD9D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACnF,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,wDAAwD;IACxD,WAAW,CAAC,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,cAGC;CACF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,eAAe,CAmB7G;AAED,qFAAqF;AACrF,qBAAa,YAAY;;IAiBvB,OAAO,eAsBN;IAgqBD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,YAAY,CASvD;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IACD,IAAI,SAAS,IAAI,kBAAkB,CAElC;IACD,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IACD,IAAI,eAAe,IAAI,MAAM,CAE5B;IACD,IAAI,kBAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAMpE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3B;IAEK,aAAa,CACjB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,CAAC,EAAE,IAAI,CAAC,gCAAgC,EAAE,SAAS,GAAG,gBAAgB,GAAG,eAAe,CAAC,EAChG,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,GAAG,aAAa,CAAC,CAmGnE;IAEK,QAAQ,CAAC,OAAO,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7C;CACF;AAwCD,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,uBAAuB,CAAC,aAAa,CAAC,EACnD,eAAe,EAAE,OAAO,GACvB,4BAA4B,GAAG,8BAA8B,GAAG,IAAI,CAItE;AAiDD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,yBAAyB,CAa5F;AA8BD,iBAAS,qBAAqB,CAAC,KAAK,EAAE,OAAO,4BAA4B,EAAE,kBAAkB,GAAG,OAAO,CAmDtG;AAcD,iBAAS,0BAA0B,CACjC,QAAQ,EAAE;IACR,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,2BAA2B,EAAE,MAAM,CAAC;CACrC,EACD,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAQvB;AAsOD,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AACrF,YAAY,EAAE,cAAc,EAAE,CAAC"}