@qduc/term2 0.14.0 → 0.16.0

package/dist/gateway/launcher.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { Term2Gateway, type GatewayLaunchConfig } from './gateway.js';
+/**
+ * Deployment launcher seam. Production provisioning supplies this configuration
+ * from a secret/configuration manager; there are deliberately no insecure defaults.
+ */
+export declare function launchGateway(config: GatewayLaunchConfig): Promise<Term2Gateway>;
+//# sourceMappingURL=launcher.d.ts.map

package/dist/gateway/launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../../source/gateway/launcher.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEtE;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAStF"}

package/dist/gateway/launcher.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import { Term2Gateway } from './gateway.js';
+/**
+ * Deployment launcher seam. Production provisioning supplies this configuration
+ * from a secret/configuration manager; there are deliberately no insecure defaults.
+ */
+export async function launchGateway(config) {
+    const gateway = Term2Gateway.create(config);
+    const stop = async () => {
+        await gateway.shutdown();
+    };
+    process.once('SIGTERM', stop);
+    process.once('SIGINT', stop);
+    await gateway.start();
+    return gateway;
+}
+if (import.meta.url === `file://${process.argv[1]}`) {
+    throw new Error('gateway launcher requires explicit platform configuration');
+}
+//# sourceMappingURL=launcher.js.map

package/dist/gateway/launcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../source/gateway/launcher.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAA4B,MAAM,cAAc,CAAC;AAEtE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAA2B;IAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;AAC/E,CAAC"}

package/dist/gateway/lifecycle.d.ts

@@ -0,0 +1,12 @@
+export type GatewayWorkerHandle = {
+    close: () => Promise<void> | void;
+};
+export declare class GatewayLifecycle {
+    #private;
+    get state(): 'running' | 'draining' | 'stopped';
+    get activeWorkerCount(): number;
+    assertAccepting(): void;
+    registerWorker(worker: GatewayWorkerHandle): () => void;
+    shutdown(graceMs: number): Promise<void>;
+}
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/gateway/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../source/gateway/lifecycle.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,qBAAa,gBAAgB;;IAI3B,IAAI,KAAK,IAAI,SAAS,GAAG,UAAU,GAAG,SAAS,CAE9C;IACD,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IACD,eAAe,IAAI,IAAI,CAEtB;IAED,cAAc,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,IAAI,CAStD;IAEK,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7C;CACF"}

package/dist/gateway/lifecycle.js

@@ -0,0 +1,38 @@
+export class GatewayLifecycle {
+    #state = 'running';
+    #workers = new Set();
+    get state() {
+        return this.#state;
+    }
+    get activeWorkerCount() {
+        return this.#workers.size;
+    }
+    assertAccepting() {
+        if (this.#state !== 'running')
+            throw new Error('gateway is not accepting sessions');
+    }
+    registerWorker(worker) {
+        this.assertAccepting();
+        this.#workers.add(worker);
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.#workers.delete(worker);
+        };
+    }
+    async shutdown(graceMs) {
+        if (this.#state === 'stopped')
+            return;
+        this.#state = 'draining';
+        const workers = [...this.#workers];
+        await Promise.race([
+            Promise.all(workers.map((worker) => worker.close())),
+            new Promise((resolve) => setTimeout(resolve, Math.max(0, graceMs))),
+        ]);
+        this.#state = 'stopped';
+        this.#workers.clear();
+    }
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/gateway/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../source/gateway/lifecycle.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,gBAAgB;IAC3B,MAAM,GAAuC,SAAS,CAAC;IAC9C,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEnD,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IACD,eAAe;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACtF,CAAC;IAED,cAAc,CAAC,MAA2B;QACxC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,EAAE;YACV,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACtC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACpD,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;SAC1E,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/gateway/pairing.d.ts

@@ -0,0 +1,25 @@
+import { TrustedClientsStore } from './trusted-clients.js';
+type PairingOptions = {
+    enabled: boolean;
+    otpTtlMs?: number;
+    maxAttempts?: number;
+    trustStore: TrustedClientsStore;
+    now?: () => number;
+    printOtp?: (otp: string) => void;
+};
+export declare class PairingError extends Error {
+    readonly code: 'pairing_required' | 'pairing_invalid' | 'pairing_unavailable' | 'pairing_not_allowed';
+    constructor(code: PairingError['code']);
+}
+export declare class GatewayPairing {
+    #private;
+    constructor(options: PairingOptions);
+    get enabled(): boolean;
+    register(publicKeyPem: string, otp: string): Promise<{
+        paired: true;
+        kid: string;
+        fingerprint: string;
+    }>;
+}
+export {};
+//# sourceMappingURL=pairing.d.ts.map

package/dist/gateway/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../source/gateway/pairing.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAMhF,KAAK,cAAc,GAAG;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,mBAAmB,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAClC,CAAC;AAEF,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;IAEtG,YAAY,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAIrC;CACF;AAED,qBAAa,cAAc;;IAUzB,YAAY,OAAO,EAAE,cAAc,EAQlC;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,IAAI,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAgC7G;CAqBF"}

package/dist/gateway/pairing.js

@@ -0,0 +1,107 @@
+import { randomInt, timingSafeEqual } from 'node:crypto';
+import { TrustedClientsError, TrustedClientsStore } from './trusted-clients.js';
+const DEFAULT_OTP_TTL_MS = 5 * 60_000;
+const DEFAULT_MAX_ATTEMPTS = 3;
+const OTP_LENGTH = 6;
+export class PairingError extends Error {
+    code;
+    constructor(code) {
+        super('gateway pairing rejected the request');
+        this.name = 'PairingError';
+        this.code = code;
+    }
+}
+export class GatewayPairing {
+    #enabled;
+    #ttlMs;
+    #maxAttempts;
+    #trustStore;
+    #now;
+    #printOtp;
+    #otp;
+    #mutation = Promise.resolve();
+    constructor(options) {
+        this.#enabled = options.enabled;
+        this.#ttlMs = positive(options.otpTtlMs ?? DEFAULT_OTP_TTL_MS, 'otpTtlMs');
+        this.#maxAttempts = positive(options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS, 'maxAttempts');
+        this.#trustStore = options.trustStore;
+        this.#now = options.now ?? Date.now;
+        this.#printOtp = options.printOtp ?? ((otp) => console.log(`PAIRING OTP: ${otp}`));
+        if (this.#enabled && this.#trustStore.size === 0)
+            this.#issueOtp();
+    }
+    get enabled() {
+        return this.#enabled;
+    }
+    async register(publicKeyPem, otp) {
+        return this.#serialize(async () => {
+            if (!this.#enabled)
+                throw new PairingError('pairing_unavailable');
+            if (this.#trustStore.size > 0)
+                throw new PairingError('pairing_not_allowed');
+            const current = this.#otp;
+            if (!current || current.expiresAt <= this.#now()) {
+                this.#otp = undefined;
+                throw new PairingError('pairing_required');
+            }
+            if (!constantTimeOtpEqual(current.value, otp)) {
+                current.attemptsRemaining -= 1;
+                if (current.attemptsRemaining <= 0) {
+                    this.#otp = undefined;
+                    this.#issueOtp();
+                }
+                throw new PairingError('pairing_invalid');
+            }
+            let trusted;
+            try {
+                trusted = TrustedClientsStore.normalizePublicKey(publicKeyPem);
+            }
+            catch {
+                throw new PairingError('pairing_invalid');
+            }
+            this.#otp = undefined;
+            try {
+                const saved = this.#trustStore.add(trusted.publicKeyPem);
+                return { paired: true, kid: saved.kid, fingerprint: saved.fingerprint };
+            }
+            catch (error) {
+                if (error instanceof TrustedClientsError)
+                    throw new PairingError('pairing_unavailable');
+                throw error;
+            }
+        });
+    }
+    async #serialize(operation) {
+        const previous = this.#mutation;
+        let release;
+        this.#mutation = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+        }
+    }
+    #issueOtp() {
+        const otp = randomInt(0, 1_000_000).toString().padStart(OTP_LENGTH, '0');
+        this.#otp = { value: otp, expiresAt: this.#now() + this.#ttlMs, attemptsRemaining: this.#maxAttempts };
+        this.#printOtp(otp);
+    }
+}
+function constantTimeOtpEqual(expected, supplied) {
+    if (typeof supplied !== 'string' || !/^\d{6}$/.test(supplied)) {
+        const safe = Buffer.alloc(OTP_LENGTH, 0);
+        timingSafeEqual(Buffer.from(expected, 'utf8'), safe);
+        return false;
+    }
+    return timingSafeEqual(Buffer.from(expected, 'utf8'), Buffer.from(supplied, 'utf8'));
+}
+function positive(value, name) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error(`${name} must be a positive integer`);
+    return value;
+}
+//# sourceMappingURL=pairing.js.map

package/dist/gateway/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../source/gateway/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhF,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAM,CAAC;AACtC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,UAAU,GAAG,CAAC,CAAC;AAWrB,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAyF;IAEtG,YAAY,IAA0B;QACpC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IAChB,QAAQ,CAAU;IAClB,MAAM,CAAS;IACf,YAAY,CAAS;IACrB,WAAW,CAAsB;IACjC,IAAI,CAAe;IACnB,SAAS,CAAwB;IAC1C,IAAI,CAAmE;IACvE,SAAS,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE7C,YAAY,OAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,EAAE,aAAa,CAAC,CAAC;QACzF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACrE,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB,EAAE,GAAW;QAC9C,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE;YAChC,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC,kBAAkB,CAAC,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;gBAC/B,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;oBACtB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,CAAC;gBACD,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,mBAAmB,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBACzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB;oBAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,CAAC,CAAC;gBACxF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAI,SAA2B;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7C,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,CAAC;QACf,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,SAAS;QACP,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QACvG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,QAAgB;IAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACzC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/gateway/persistence/admission-persistence.d.ts

@@ -0,0 +1,82 @@
+import type { LogEvent } from '../../services/logging/conversation-log-events.js';
+import { type AdmissionRecord, type AdmissionResult, type DurableEventCandidate } from './contracts.js';
+import type { GatewayCriticalPersistence } from './session-persistence.js';
+import { GatewaySessionIndex } from './session-index.js';
+export declare function normalizedBodyHash(body: unknown): string;
+export type AdmissionLookup = {
+    readonly kind: 'new';
+} | {
+    readonly kind: 'replayed';
+    readonly record: AdmissionRecord;
+} | {
+    readonly kind: 'conflict';
+    readonly record: AdmissionRecord;
+};
+export type GatewayMessageAdmissionRuntime = {
+    prepareMessage(input: unknown, ids: {
+        turnId: string;
+        clientRequestId: string;
+    }): Promise<{
+        kind: 'prepared';
+        leaseId: string;
+        turnId: string;
+    } | {
+        kind: 'rejected';
+        reason: 'busy' | 'queue_full' | 'closed';
+    }>;
+    commitMessage(leaseId: string): Promise<void>;
+    cancelPreparedMessage(leaseId: string): Promise<void>;
+};
+export type GatewayAdmissionResult = {
+    readonly kind: 'accepted';
+    readonly record: AdmissionRecord;
+    readonly replayed: false;
+} | {
+    readonly kind: 'replayed';
+    readonly record: AdmissionRecord;
+    readonly replayed: true;
+} | {
+    readonly kind: 'rejected';
+    readonly reason: 'busy' | 'queue_full' | 'closed';
+};
+export declare class GatewayAdmissionPersistence {
+    #private;
+    constructor(index: GatewaySessionIndex, options?: {
+        leaseTtlMs?: number;
+    });
+    lookup(ownerUserId: string, sessionId: string, clientRequestId: string, body: unknown): AdmissionLookup;
+    prepare(input: {
+        ownerUserId: string;
+        sessionId: string;
+        clientRequestId: string;
+        body: unknown;
+        turnId: string;
+    }): AdmissionRecord;
+    admit(input: {
+        ownerUserId: string;
+        sessionId: string;
+        clientRequestId: string;
+        body: unknown;
+        turnId: string;
+        runtime: GatewayMessageAdmissionRuntime;
+        persistence: GatewayCriticalPersistence;
+        term2Fact: LogEvent;
+        acceptedEvent: DurableEventCandidate;
+        /** Runs after accepted facts are durable and before runtime execution starts. */
+        beforeCommit?: () => Promise<void>;
+    }): Promise<GatewayAdmissionResult>;
+    accept(input: {
+        record: AdmissionRecord;
+        persistence: GatewayCriticalPersistence;
+        term2Fact: LogEvent;
+        acceptedEvent: DurableEventCandidate;
+    }): Promise<AdmissionRecord>;
+    markTerminal(ownerUserId: string, sessionId: string, clientRequestId: string, result: AdmissionResult): AdmissionRecord;
+    reconcile(ownerUserId: string, sessionId: string, clientRequestId: string, callbacks: {
+        cancelPrepared: (turnId: string) => Promise<void>;
+        verifyTranscript?: (record: AdmissionRecord) => Promise<boolean>;
+        verifyJournal?: (record: AdmissionRecord) => Promise<boolean>;
+        repairAcceptedEvent?: (record: AdmissionRecord) => Promise<void>;
+    }): Promise<AdmissionRecord | null>;
+}
+//# sourceMappingURL=admission-persistence.d.ts.map

package/dist/gateway/persistence/admission-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-persistence.d.ts","sourceRoot":"","sources":["../../../source/gateway/persistence/admission-persistence.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAClF,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAczD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAKxD;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAA;CAAE,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAEpE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,cAAc,CACZ,KAAK,EAAE,OAAO,EACd,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CACN;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GACrD;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;KAAE,CACjE,CAAC;IACF,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,CAAA;CAAE,CAAC;AAErF,qBAAa,2BAA2B;;IAItC,YAAY,KAAK,EAAE,mBAAmB,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,EAG5E;IAED,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,eAAe,CActG;IAED,OAAO,CAAC,KAAK,EAAE;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,eAAe,CAyBlB;IAEK,KAAK,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,8BAA8B,CAAC;QACxC,WAAW,EAAE,0BAA0B,CAAC;QACxC,SAAS,EAAE,QAAQ,CAAC;QACpB,aAAa,EAAE,qBAAqB,CAAC;QACrC,iFAAiF;QACjF,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyClC;IAEK,MAAM,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,eAAe,CAAC;QACxB,WAAW,EAAE,0BAA0B,CAAC;QACxC,SAAS,EAAE,QAAQ,CAAC;QACpB,aAAa,EAAE,qBAAqB,CAAC;KACtC,GAAG,OAAO,CAAC,eAAe,CAAC,CAgC3B;IAED,YAAY,CACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,eAAe,GACtB,eAAe,CAcjB;IAED,SAAS,CACP,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,SAAS,EAAE;QACT,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9D,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KAClE,GACA,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAsDjC;CACF"}

package/dist/gateway/persistence/admission-persistence.js

@@ -0,0 +1,215 @@
+import crypto from 'node:crypto';
+import { GatewayPersistenceError, } from './contracts.js';
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([key, child]) => [key, canonicalize(child)]));
+    }
+    return value;
+}
+export function normalizedBodyHash(body) {
+    return crypto
+        .createHash('sha256')
+        .update(JSON.stringify(canonicalize(body)), 'utf8')
+        .digest('hex');
+}
+export class GatewayAdmissionPersistence {
+    #index;
+    #leaseTtlMs;
+    constructor(index, options = {}) {
+        this.#index = index;
+        this.#leaseTtlMs = options.leaseTtlMs ?? 60_000;
+    }
+    lookup(ownerUserId, sessionId, clientRequestId, body) {
+        const record = this.#index.admission(ownerUserId, sessionId, clientRequestId);
+        if (!record)
+            return { kind: 'new' };
+        if (Date.parse(record.expiresAt) <= Date.now()) {
+            this.#index.deleteAdmission(ownerUserId, sessionId, clientRequestId);
+            return { kind: 'new' };
+        }
+        if (!['accepted', 'committed', 'terminal'].includes(record.state)) {
+            this.#index.deleteAdmission(ownerUserId, sessionId, clientRequestId);
+            return { kind: 'new' };
+        }
+        return record.normalizedBodyHash === normalizedBodyHash(body)
+            ? { kind: 'replayed', record }
+            : { kind: 'conflict', record };
+    }
+    prepare(input) {
+        const existing = this.lookup(input.ownerUserId, input.sessionId, input.clientRequestId, input.body);
+        if (existing.kind === 'replayed')
+            return existing.record;
+        if (existing.kind === 'conflict')
+            throw new GatewayPersistenceError('conflict', 'idempotency key has a different body');
+        const now = new Date();
+        const record = {
+            ownerUserId: input.ownerUserId,
+            sessionId: input.sessionId,
+            clientRequestId: input.clientRequestId,
+            normalizedBodyHash: normalizedBodyHash(input.body),
+            turnId: input.turnId,
+            state: 'prepared',
+            phase: 'prepared',
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + this.#leaseTtlMs).toISOString(),
+        };
+        try {
+            this.#index.insertAdmission(record);
+            return record;
+        }
+        catch (error) {
+            const retry = this.lookup(input.ownerUserId, input.sessionId, input.clientRequestId, input.body);
+            if (retry.kind === 'replayed')
+                return retry.record;
+            throw error;
+        }
+    }
+    async admit(input) {
+        const lookup = this.lookup(input.ownerUserId, input.sessionId, input.clientRequestId, input.body);
+        if (lookup.kind === 'conflict')
+            throw new GatewayPersistenceError('conflict', 'idempotency key has a different body');
+        if (lookup.kind === 'replayed')
+            return { kind: 'replayed', record: lookup.record, replayed: true };
+        const prepared = await input.runtime.prepareMessage(input.body, {
+            turnId: input.turnId,
+            clientRequestId: input.clientRequestId,
+        });
+        if (prepared.kind !== 'prepared')
+            return prepared;
+        let record;
+        try {
+            record = this.prepare(input);
+        }
+        catch (error) {
+            await input.runtime.cancelPreparedMessage(prepared.leaseId);
+            throw error;
+        }
+        try {
+            record = await this.accept({
+                record,
+                persistence: input.persistence,
+                term2Fact: input.term2Fact,
+                acceptedEvent: input.acceptedEvent,
+            });
+            await input.beforeCommit?.();
+            await input.runtime.commitMessage(prepared.leaseId);
+            return { kind: 'accepted', record, replayed: false };
+        }
+        catch (error) {
+            const durable = this.#index.admission(input.ownerUserId, input.sessionId, input.clientRequestId);
+            if (!durable || durable.phase === 'prepared') {
+                try {
+                    await input.runtime.cancelPreparedMessage(prepared.leaseId);
+                }
+                catch {
+                    // The runtime's own interruption/read-only state is the recovery signal.
+                }
+            }
+            if (durable && (durable.state === 'accepted' || durable.state === 'committed')) {
+                this.markTerminal(durable.ownerUserId, durable.sessionId, durable.clientRequestId, 'failed');
+            }
+            throw error;
+        }
+    }
+    async accept(input) {
+        const current = this.#index.admission(input.record.ownerUserId, input.record.sessionId, input.record.clientRequestId);
+        if (!current)
+            throw new GatewayPersistenceError('not_found', 'prepared admission not found');
+        if (current.state === 'accepted' || current.state === 'committed')
+            return current;
+        if (current.state !== 'prepared')
+            throw new GatewayPersistenceError('conflict', 'admission is no longer prepared');
+        const transcript = await input.persistence.appendTranscriptCritical(input.term2Fact);
+        this.#index.updateAdmission(current.ownerUserId, current.sessionId, current.clientRequestId, {
+            phase: 'transcript_written',
+            transcriptChecksum: transcript.checksum,
+        });
+        const journal = await input.persistence.appendJournalCritical(input.acceptedEvent);
+        this.#index.updateAdmission(current.ownerUserId, current.sessionId, current.clientRequestId, {
+            phase: 'journal_written',
+            journalChecksum: journal.checksum,
+        });
+        if (!input.persistence.verifyTranscriptFact(input.term2Fact, transcript.checksum) ||
+            !input.persistence.verifyJournalEvent(input.acceptedEvent, journal.checksum)) {
+            throw new GatewayPersistenceError('readonly', 'admission durable facts failed checksum validation');
+        }
+        return this.#index.updateAdmission(current.ownerUserId, current.sessionId, current.clientRequestId, {
+            state: 'accepted',
+            result: 'accepted',
+            phase: 'committed',
+            transcriptChecksum: transcript.checksum,
+            journalChecksum: journal.checksum,
+        });
+    }
+    markTerminal(ownerUserId, sessionId, clientRequestId, result) {
+        const current = this.#index.admission(ownerUserId, sessionId, clientRequestId);
+        if (!current)
+            throw new GatewayPersistenceError('not_found', 'admission not found');
+        if (current.state !== 'accepted' && current.state !== 'committed') {
+            return this.#index.updateAdmission(ownerUserId, sessionId, clientRequestId, {
+                state: 'rejected',
+                result: result === 'accepted' ? 'failed' : result,
+            });
+        }
+        return this.#index.updateAdmission(ownerUserId, sessionId, clientRequestId, {
+            state: 'terminal',
+            result,
+            phase: 'committed',
+        });
+    }
+    reconcile(ownerUserId, sessionId, clientRequestId, callbacks) {
+        const record = this.#index.admission(ownerUserId, sessionId, clientRequestId);
+        if (!record)
+            return Promise.resolve(null);
+        const commit = () => this.#index.updateAdmission(ownerUserId, sessionId, clientRequestId, {
+            state: 'accepted',
+            result: 'accepted',
+            phase: 'committed',
+        });
+        if (record.state === 'prepared') {
+            if (callbacks.verifyTranscript && record.transcriptChecksum) {
+                return callbacks.verifyTranscript(record).then((present) => {
+                    if (!present) {
+                        return callbacks.cancelPrepared(record.turnId).then(() => this.#index.updateAdmission(ownerUserId, sessionId, clientRequestId, {
+                            state: 'rejected',
+                            result: 'failed',
+                        }));
+                    }
+                    if (!callbacks.repairAcceptedEvent)
+                        throw new GatewayPersistenceError('readonly', 'accepted event repair is unavailable');
+                    return callbacks.repairAcceptedEvent(record).then(commit);
+                });
+            }
+            return callbacks.cancelPrepared(record.turnId).then(() => this.#index.updateAdmission(ownerUserId, sessionId, clientRequestId, {
+                state: 'rejected',
+                result: 'failed',
+            }));
+        }
+        if (record.phase === 'transcript_written') {
+            if (!callbacks.verifyTranscript || !callbacks.repairAcceptedEvent)
+                throw new GatewayPersistenceError('readonly', 'transcript admission fact cannot be verified');
+            return callbacks.verifyTranscript(record).then((valid) => {
+                if (!valid)
+                    throw new GatewayPersistenceError('readonly', 'transcript admission fact is corrupt');
+                return callbacks.repairAcceptedEvent(record).then(commit);
+            });
+        }
+        if (record.phase === 'journal_written') {
+            if (!callbacks.verifyTranscript || !callbacks.verifyJournal)
+                throw new GatewayPersistenceError('readonly', 'accepted admission facts cannot be verified');
+            return Promise.all([callbacks.verifyTranscript(record), callbacks.verifyJournal(record)]).then(([transcript, journal]) => {
+                if (!transcript || !journal)
+                    throw new GatewayPersistenceError('readonly', 'accepted admission fact checksum mismatch');
+                return commit();
+            });
+        }
+        if (record.state === 'accepted' || record.state === 'committed' || record.state === 'terminal')
+            return Promise.resolve(record);
+        return Promise.resolve(record);
+    }
+}
+//# sourceMappingURL=admission-persistence.js.map

package/dist/gateway/persistence/admission-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-persistence.js","sourceRoot":"","sources":["../../../source/gateway/persistence/admission-persistence.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,uBAAuB,GAIxB,MAAM,gBAAgB,CAAC;AAIxB,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CACrD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;SAClD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAwBD,MAAM,OAAO,2BAA2B;IAC7B,MAAM,CAAsB;IAC5B,WAAW,CAAS;IAE7B,YAAY,KAA0B,EAAE,OAAO,GAA4B,EAAE;QAC3E,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,WAAmB,EAAE,SAAiB,EAAE,eAAuB,EAAE,IAAa;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;YACrE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,MAAM,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,IAAI,CAAC;YAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;YAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,KAMP;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACpG,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAC9B,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAoB;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;YAClD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,UAAU;YACjB,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE;SACpE,CAAC;QACF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjG,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAYX;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClG,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAC5B,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;QACxF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACnG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE;YAC9D,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBACzB,MAAM;gBACN,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;YACjG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC9D,CAAC;gBAAC,MAAM,CAAC;oBACP,yEAAyE;gBAC3E,CAAC;YACH,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,CAAC,EAAE,CAAC;gBAC/E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;YAC/F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAKZ;QACC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CACnC,KAAK,CAAC,MAAM,CAAC,WAAW,EACxB,KAAK,CAAC,MAAM,CAAC,SAAS,EACtB,KAAK,CAAC,MAAM,CAAC,eAAe,CAC7B,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;QAClF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;YAAE,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,iCAAiC,CAAC,CAAC;QACnH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE;YAC3F,KAAK,EAAE,oBAAoB;YAC3B,kBAAkB,EAAE,UAAU,CAAC,QAAQ;SACxC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE;YAC3F,KAAK,EAAE,iBAAiB;YACxB,eAAe,EAAE,OAAO,CAAC,QAAQ;SAClC,CAAC,CAAC;QACH,IACE,CAAC,KAAK,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC7E,CAAC,KAAK,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,EAC5E,CAAC;YACD,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,oDAAoD,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE;YAClG,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,WAAW;YAClB,kBAAkB,EAAE,UAAU,CAAC,QAAQ;YACvC,eAAe,EAAE,OAAO,CAAC,QAAQ;SAClC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CACV,WAAmB,EACnB,SAAiB,EACjB,eAAuB,EACvB,MAAuB;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE;gBAC1E,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;aAClD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE;YAC1E,KAAK,EAAE,UAAU;YACjB,MAAM;YACN,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CACP,WAAmB,EACnB,SAAiB,EACjB,eAAuB,EACvB,SAKC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,GAAG,EAAE,CAClB,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE;YACnE,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,WAAW;SACnB,CAAC,CAAC;QACL,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,IAAI,SAAS,CAAC,gBAAgB,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC5D,OAAO,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;oBACzD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACvD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE;4BACnE,KAAK,EAAE,UAAU;4BACjB,MAAM,EAAE,QAAQ;yBACjB,CAAC,CACH,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,SAAS,CAAC,mBAAmB;wBAChC,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;oBACxF,OAAO,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC5D,CAAC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACvD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE;gBACnE,KAAK,EAAE,UAAU;gBACjB,MAAM,EAAE,QAAQ;aACjB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,oBAAoB,EAAE,CAAC;YAC1C,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,mBAAmB;gBAC/D,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,8CAA8C,CAAC,CAAC;YAChG,OAAO,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvD,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,sCAAsC,CAAC,CAAC;gBAClG,OAAO,SAAS,CAAC,mBAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,aAAa;gBACzD,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,6CAA6C,CAAC,CAAC;YAC/F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5F,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;gBACxB,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO;oBACzB,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,2CAA2C,CAAC,CAAC;gBAC7F,OAAO,MAAM,EAAE,CAAC;YAClB,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU;YAC5F,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}