@qduc/term2 0.15.0 → 0.16.0

package/dist/gateway/dynamic-workspace-registry.js

@@ -0,0 +1,403 @@
+import { constants, accessSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { ExecutionContext } from '../services/execution-context.js';
+import { WorkspaceAdmissionError } from './workspace-admission.js';
+export class DynamicWorkspaceRegistryError extends Error {
+    code;
+    constructor(code) {
+        super('dynamic workspace registry rejected the request');
+        this.name = 'DynamicWorkspaceRegistryError';
+        this.code = code;
+    }
+}
+const OPAQUE_ID = /^[A-Za-z0-9_-]{1,256}$/;
+const DEFAULT_TTL_MS = 5 * 60_000;
+const DEFAULT_MAX_CANDIDATES = 128;
+const DEFAULT_MAX_CANDIDATES_PER_OWNER = 16;
+const DEFAULT_MAX_BROWSE_ENTRIES = 256;
+export class DynamicWorkspaceRegistry {
+    #admission;
+    #allowedRoots;
+    #candidateTtlMs;
+    #maxCandidates;
+    #maxCandidatesPerOwner;
+    #maxRegistryEntries;
+    #browseTokenTtlMs;
+    #maxBrowseEntries;
+    #now;
+    #fs;
+    #candidates = new Map();
+    #browseTokens = new Map();
+    constructor(options) {
+        this.#admission = options.admission;
+        this.#allowedRoots = Object.freeze(options.allowedRoots.map((root) => canonicalRoot(root)));
+        this.#candidateTtlMs = positiveBound(options.candidateTtlMs ?? DEFAULT_TTL_MS, 'candidateTtlMs');
+        this.#maxCandidates = positiveBound(options.maxCandidates ?? DEFAULT_MAX_CANDIDATES, 'maxCandidates');
+        this.#maxCandidatesPerOwner = positiveBound(options.maxCandidatesPerOwner ?? Math.min(DEFAULT_MAX_CANDIDATES_PER_OWNER, this.#maxCandidates), 'maxCandidatesPerOwner');
+        this.#maxRegistryEntries = positiveBound(options.maxRegistryEntries ?? Math.max(this.#maxCandidates, this.#maxCandidates * 8), 'maxRegistryEntries');
+        this.#browseTokenTtlMs = positiveBound(options.browseTokenTtlMs ?? this.#candidateTtlMs, 'browseTokenTtlMs');
+        this.#maxBrowseEntries = positiveBound(options.maxBrowseEntries ?? DEFAULT_MAX_BROWSE_ENTRIES, 'maxBrowseEntries');
+        this.#now = options.now ?? Date.now;
+        this.#fs = options.fs ?? { realpathSync, statSync, accessSync, readdirSync };
+    }
+    get admission() {
+        return this.#admission;
+    }
+    get candidateCount() {
+        this.#pruneExpired();
+        return this.#candidates.size;
+    }
+    get browseTokenCount() {
+        this.#pruneExpired();
+        return this.#browseTokens.size;
+    }
+    validateCandidate(candidatePath, ownerUserId = 'local-owner') {
+        const checks = [];
+        if (!ownerUserId || typeof candidatePath !== 'string' || !candidatePath || candidatePath.includes('\u0000')) {
+            return invalid(checks, 'workspace_root_unavailable', 'The workspace path is invalid.');
+        }
+        if (!path.isAbsolute(candidatePath)) {
+            checks.push({ name: 'absolute', status: 'error' });
+            return invalid(checks, 'workspace_root_unavailable', 'The workspace path must be absolute.');
+        }
+        checks.push({ name: 'absolute', status: 'ok' });
+        let canonical;
+        try {
+            const initialStat = this.#fs.statSync(candidatePath);
+            checks.push({ name: 'exists', status: 'ok' });
+            if (!initialStat.isDirectory()) {
+                checks.push({ name: 'directory', status: 'error' });
+                return invalid(checks, 'workspace_root_unavailable', 'The selected path is not a directory.');
+            }
+            checks.push({ name: 'directory', status: 'ok' });
+        }
+        catch {
+            checks.push({ name: 'exists', status: 'error' });
+            return invalid(checks, 'workspace_root_unavailable', 'The workspace folder is unavailable.');
+        }
+        try {
+            canonical = this.#fs.realpathSync(candidatePath);
+            checks.push({ name: 'canonical', status: 'ok' });
+        }
+        catch {
+            checks.push({ name: 'canonical', status: 'error' });
+            return invalid(checks, 'workspace_root_not_canonical', 'The workspace path could not be canonicalized.');
+        }
+        try {
+            this.#fs.accessSync(canonical, constants.R_OK | constants.X_OK);
+            checks.push({ name: 'readable', status: 'ok' });
+        }
+        catch {
+            checks.push({ name: 'readable', status: 'error' });
+            return invalid(checks, 'workspace_not_readable', 'The local user cannot read this folder.');
+        }
+        if (!this.#isContainedByAllowedRoot(canonical)) {
+            checks.push({ name: 'contained', status: 'error' });
+            return invalid(checks, 'workspace_path_escape', 'The selected folder is outside the allowed workspace roots.');
+        }
+        checks.push({ name: 'contained', status: 'ok' });
+        this.#pruneExpired();
+        const ownerCandidates = [...this.#candidates.values()].filter((candidate) => candidate.ownerUserId === ownerUserId);
+        if (this.#candidates.size >= this.#maxCandidates ||
+            ownerCandidates.length >= this.#maxCandidatesPerOwner ||
+            this.#registryEntryCount() >= this.#maxRegistryEntries) {
+            return invalid(checks, 'candidate_registry_full', 'Too many workspace selections are pending.');
+        }
+        const candidateId = opaqueId();
+        const record = {
+            candidateId,
+            ownerUserId,
+            canonicalRoot: canonical,
+            displayName: path.basename(canonical) || canonical,
+            expiresAt: this.#now() + this.#candidateTtlMs,
+        };
+        this.#candidates.set(candidateId, record);
+        return {
+            valid: true,
+            candidateId,
+            displayName: record.displayName,
+            expiresAt: record.expiresAt,
+            checks,
+        };
+    }
+    browse(candidateId, childToken, ownerUserId = 'local-owner') {
+        const candidate = this.#candidateFor(candidateId, ownerUserId);
+        const parent = childToken ? this.#browsePath(childToken, candidate) : this.#revalidate(candidate);
+        this.#assertReadableDirectory(parent);
+        let entries;
+        try {
+            entries = this.#fs
+                .readdirSync(parent, { withFileTypes: true })
+                .sort((a, b) => a.name.localeCompare(b.name))
+                .map((entry) => this.#browseEntry(candidate, parent, entry));
+        }
+        catch {
+            throw new DynamicWorkspaceRegistryError('workspace_not_readable');
+        }
+        return {
+            candidateId,
+            entries: entries.slice(0, this.#maxBrowseEntries),
+            truncated: entries.length > this.#maxBrowseEntries,
+        };
+    }
+    select(candidateId, access, ownerUserId = 'local-owner') {
+        if (access !== 'read' && access !== 'read_write')
+            throw new DynamicWorkspaceRegistryError('workspace_root_unavailable');
+        const candidate = this.#candidateFor(candidateId, ownerUserId);
+        let canonical;
+        try {
+            canonical = this.#revalidate(candidate);
+        }
+        catch (error) {
+            this.expire(candidateId);
+            throw error;
+        }
+        const workspaceId = `ws_${opaqueId()}`;
+        const grant = {
+            workspaceId,
+            ownerUserId,
+            label: candidate.displayName,
+            kind: 'local',
+            localRoot: canonical,
+            access,
+            enabled: true,
+        };
+        this.#admission.registerDynamicLocalGrant(grant);
+        try {
+            const binding = this.#admission.prepare({
+                iss: 'term2-local-owner',
+                aud: 'term2-local-owner',
+                sub: ownerUserId,
+                purpose: 'session_create',
+                iat: 0,
+                nbf: 0,
+                exp: Number.MAX_SAFE_INTEGER,
+                jti: opaqueId(),
+                ver: 1,
+                workspaceId,
+            });
+            this.#candidates.delete(candidateId);
+            for (const [token, value] of this.#browseTokens) {
+                if (value.candidateId === candidateId)
+                    this.#browseTokens.delete(token);
+            }
+            return { workspaceId, displayName: candidate.displayName, binding };
+        }
+        catch (error) {
+            this.#admission.removeDynamicLocalGrant(workspaceId);
+            if (error instanceof WorkspaceAdmissionError)
+                throw error;
+            throw new DynamicWorkspaceRegistryError('workspace_root_unavailable');
+        }
+    }
+    expire(candidateId) {
+        this.#candidates.delete(candidateId);
+        for (const [token, value] of this.#browseTokens) {
+            if (value.candidateId === candidateId)
+                this.#browseTokens.delete(token);
+        }
+    }
+    pin(binding) {
+        return ExecutionContext.pin(binding.canonicalRoot);
+    }
+    #candidateFor(candidateId, ownerUserId) {
+        if (!OPAQUE_ID.test(candidateId))
+            throw new DynamicWorkspaceRegistryError('candidate_not_found');
+        const candidate = this.#candidates.get(candidateId);
+        if (!candidate)
+            throw new DynamicWorkspaceRegistryError('candidate_not_found');
+        if (candidate.ownerUserId !== ownerUserId)
+            throw new DynamicWorkspaceRegistryError('workspace_owner_mismatch');
+        if (candidate.expiresAt <= this.#now()) {
+            this.expire(candidateId);
+            throw new DynamicWorkspaceRegistryError('candidate_expired');
+        }
+        this.#pruneExpired();
+        return candidate;
+    }
+    #browsePath(token, candidate) {
+        if (!OPAQUE_ID.test(token))
+            throw new DynamicWorkspaceRegistryError('candidate_not_found');
+        const value = this.#browseTokens.get(token);
+        if (!value || value.candidateId !== candidate.candidateId || value.ownerUserId !== candidate.ownerUserId)
+            throw new DynamicWorkspaceRegistryError('candidate_not_found');
+        if (value.expiresAt <= this.#now()) {
+            this.#browseTokens.delete(token);
+            throw new DynamicWorkspaceRegistryError('candidate_expired');
+        }
+        let canonical;
+        try {
+            canonical = this.#revalidate(candidate);
+        }
+        catch (error) {
+            this.#browseTokens.delete(token);
+            throw error;
+        }
+        let currentPath;
+        try {
+            currentPath = this.#fs.realpathSync(value.canonicalPath);
+        }
+        catch {
+            this.#browseTokens.delete(token);
+            throw new DynamicWorkspaceRegistryError('workspace_path_escape');
+        }
+        if (currentPath !== value.canonicalPath || !isContained(canonical, currentPath)) {
+            this.#browseTokens.delete(token);
+            throw new DynamicWorkspaceRegistryError('workspace_path_escape');
+        }
+        this.#assertReadableDirectory(currentPath);
+        return currentPath;
+    }
+    #browseEntry(candidate, parent, entry) {
+        const fullPath = path.join(parent, entry.name);
+        if (entry.isSymbolicLink()) {
+            try {
+                const target = this.#fs.realpathSync(fullPath);
+                const inside = isContained(candidate.canonicalRoot, target);
+                if (!inside) {
+                    return {
+                        name: entry.name,
+                        type: 'symlink',
+                        selectable: false,
+                        rejectionReason: 'workspace_path_escape',
+                        targetDisplay: 'outside-candidate-root',
+                    };
+                }
+                if (!this.#fs.statSync(target).isDirectory()) {
+                    return { name: entry.name, type: 'symlink', selectable: false, rejectionReason: 'workspace_not_directory' };
+                }
+                return {
+                    name: entry.name,
+                    type: 'symlink',
+                    selectable: true,
+                    targetDisplay: path.relative(candidate.canonicalRoot, target) || '.',
+                    childToken: this.#tokenFor(candidate, target),
+                };
+            }
+            catch {
+                return { name: entry.name, type: 'symlink', selectable: false, rejectionReason: 'workspace_root_unavailable' };
+            }
+        }
+        if (entry.isDirectory()) {
+            try {
+                const target = this.#fs.realpathSync(fullPath);
+                if (!isContained(candidate.canonicalRoot, target))
+                    return { name: entry.name, type: 'directory', selectable: false, rejectionReason: 'workspace_path_escape' };
+                if (!this.#fs.statSync(target).isDirectory())
+                    return { name: entry.name, type: 'directory', selectable: false, rejectionReason: 'workspace_not_directory' };
+                return { name: entry.name, type: 'directory', selectable: true, childToken: this.#tokenFor(candidate, target) };
+            }
+            catch {
+                return {
+                    name: entry.name,
+                    type: 'directory',
+                    selectable: false,
+                    rejectionReason: 'workspace_root_unavailable',
+                };
+            }
+        }
+        if (entry.isFile())
+            return { name: entry.name, type: 'file', selectable: false, rejectionReason: 'workspace_not_directory' };
+        return { name: entry.name, type: 'other', selectable: false, rejectionReason: 'workspace_not_directory' };
+    }
+    #tokenFor(candidate, directory) {
+        this.#pruneExpired();
+        if (this.#registryEntryCount() >= this.#maxRegistryEntries) {
+            this.#evictBrowseToken();
+            if (this.#registryEntryCount() >= this.#maxRegistryEntries)
+                return undefined;
+        }
+        const token = opaqueId();
+        const now = this.#now();
+        this.#browseTokens.set(token, {
+            candidateId: candidate.candidateId,
+            ownerUserId: candidate.ownerUserId,
+            canonicalPath: directory,
+            expiresAt: Math.min(candidate.expiresAt, now + this.#browseTokenTtlMs),
+            createdAt: now,
+        });
+        return token;
+    }
+    #revalidate(candidate) {
+        let canonical;
+        try {
+            canonical = this.#fs.realpathSync(candidate.canonicalRoot);
+            if (!this.#fs.statSync(canonical).isDirectory())
+                throw new Error();
+            this.#fs.accessSync(canonical, constants.R_OK | constants.X_OK);
+        }
+        catch {
+            throw new DynamicWorkspaceRegistryError('workspace_root_unavailable');
+        }
+        if (canonical !== candidate.canonicalRoot || !this.#isContainedByAllowedRoot(canonical)) {
+            throw new DynamicWorkspaceRegistryError('workspace_path_escape');
+        }
+        return canonical;
+    }
+    #assertReadableDirectory(directory) {
+        try {
+            if (!this.#fs.statSync(directory).isDirectory())
+                throw new Error();
+            this.#fs.accessSync(directory, constants.R_OK | constants.X_OK);
+        }
+        catch {
+            throw new DynamicWorkspaceRegistryError('workspace_not_readable');
+        }
+    }
+    #isContainedByAllowedRoot(candidate) {
+        return this.#allowedRoots.some((root) => isContained(root, candidate));
+    }
+    #pruneExpired() {
+        const now = this.#now();
+        for (const [id, candidate] of this.#candidates) {
+            if (candidate.expiresAt <= now)
+                this.expire(id);
+        }
+        for (const [token, browse] of this.#browseTokens) {
+            if (browse.expiresAt <= now || !this.#candidates.has(browse.candidateId))
+                this.#browseTokens.delete(token);
+        }
+    }
+    #registryEntryCount() {
+        return this.#candidates.size + this.#browseTokens.size;
+    }
+    #evictBrowseToken() {
+        let oldest;
+        for (const item of this.#browseTokens.entries()) {
+            if (!oldest || item[1].createdAt < oldest[1].createdAt)
+                oldest = item;
+        }
+        if (oldest)
+            this.#browseTokens.delete(oldest[0]);
+    }
+}
+function canonicalRoot(root) {
+    if (!path.isAbsolute(root))
+        throw new Error('dynamic workspace allowed roots must be absolute');
+    try {
+        const resolved = realpathSync(root);
+        if (!statSync(resolved).isDirectory())
+            throw new Error();
+        return resolved;
+    }
+    catch {
+        throw new Error('dynamic workspace allowed root is unavailable');
+    }
+}
+function positiveBound(value, name) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error(`${name} must be a positive integer`);
+    return value;
+}
+function opaqueId() {
+    return randomUUID().replaceAll('-', '');
+}
+function isContained(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+function invalid(checks, reasonCode, reason) {
+    return { valid: false, checks, reasonCode, reason };
+}
+//# sourceMappingURL=dynamic-workspace-registry.js.map

package/dist/gateway/dynamic-workspace-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic-workspace-registry.js","sourceRoot":"","sources":["../../source/gateway/dynamic-workspace-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACrF,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAsB,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AA8DvF,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC7C,IAAI,CAQiB;IAE9B,YAAY,IAA2C;QACrD,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAkBD,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAC3C,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAC5C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAEvC,MAAM,OAAO,wBAAwB;IAC1B,UAAU,CAAqB;IAC/B,aAAa,CAAoB;IACjC,eAAe,CAAS;IACxB,cAAc,CAAS;IACvB,sBAAsB,CAAS;IAC/B,mBAAmB,CAAS;IAC5B,iBAAiB,CAAS;IAC1B,iBAAiB,CAAS;IAC1B,IAAI,CAAe;IACnB,GAAG,CAA6B;IAChC,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IAExD,YAAY,OAYX;QACC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QACpC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC,cAAc,IAAI,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACjG,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,sBAAsB,EAAE,eAAe,CAAC,CAAC;QACtG,IAAI,CAAC,sBAAsB,GAAG,aAAa,CACzC,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC,GAAG,CAAC,gCAAgC,EAAE,IAAI,CAAC,cAAc,CAAC,EAChG,uBAAuB,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,aAAa,CACtC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC,EACpF,oBAAoB,CACrB,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;QAC7G,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,EAAE,kBAAkB,CAAC,CAAC;QACnH,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;IAC/E,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,cAAc;QAChB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED,IAAI,gBAAgB;QAClB,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,iBAAiB,CAAC,aAAqB,EAAE,WAAW,GAAG,aAAa;QAClE,MAAM,MAAM,GAA+B,EAAE,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5G,OAAO,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,gCAAgC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAEhD,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBACpD,OAAO,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,uCAAuC,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,MAAM,EAAE,8BAA8B,EAAE,gDAAgD,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,OAAO,CAAC,MAAM,EAAE,wBAAwB,EAAE,yCAAyC,CAAC,CAAC;QAC9F,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,OAAO,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,6DAA6D,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;QACpH,IACE,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc;YAC5C,eAAe,CAAC,MAAM,IAAI,IAAI,CAAC,sBAAsB;YACrD,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,mBAAmB,EACtD,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,EAAE,yBAAyB,EAAE,4CAA4C,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAoB;YAC9B,WAAW;YACX,WAAW;YACX,aAAa,EAAE,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS;YAClD,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,eAAe;SAC9C,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC1C,OAAO;YACL,KAAK,EAAE,IAAI;YACX,WAAW;YACX,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM;SACP,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,WAAmB,EAAE,UAAmB,EAAE,WAAW,GAAG,aAAa;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,GAAG;iBACf,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;iBAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,6BAA6B,CAAC,wBAAwB,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;YACL,WAAW;YACX,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC;YACjD,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB;SACnD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,WAAmB,EAAE,MAA6B,EAAE,WAAW,GAAG,aAAa;QACpF,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,YAAY;YAC9C,MAAM,IAAI,6BAA6B,CAAC,4BAA4B,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/D,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,QAAQ,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAmB;YAC5B,WAAW;YACX,WAAW;YACX,KAAK,EAAE,SAAS,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,SAAS;YACpB,MAAM;YACN,OAAO,EAAE,IAAI;SACd,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACtC,GAAG,EAAE,mBAAmB;gBACxB,GAAG,EAAE,mBAAmB;gBACxB,GAAG,EAAE,WAAW;gBAChB,OAAO,EAAE,gBAAgB;gBACzB,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,MAAM,CAAC,gBAAgB;gBAC5B,GAAG,EAAE,QAAQ,EAAE;gBACf,GAAG,EAAE,CAAC;gBACN,WAAW;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACrC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBAChD,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;oBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACrD,IAAI,KAAK,YAAY,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC1D,MAAM,IAAI,6BAA6B,CAAC,4BAA4B,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,WAAmB;QACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,GAAG,CAAC,OAAuB;QACzB,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,WAAmB,EAAE,WAAmB;QACpD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QAC/E,IAAI,SAAS,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,6BAA6B,CAAC,0BAA0B,CAAC,CAAC;QAC/G,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,IAAI,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW,CAAC,KAAa,EAAE,SAA0B;QACnD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW;YACtG,MAAM,IAAI,6BAA6B,CAAC,qBAAqB,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,6BAA6B,CAAC,mBAAmB,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,WAAW,KAAK,KAAK,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;YAChF,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAC3C,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,YAAY,CAAC,SAA0B,EAAE,MAAc,EAAE,KAA+B;QACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,SAAS;wBACf,UAAU,EAAE,KAAK;wBACjB,eAAe,EAAE,uBAAuB;wBACxC,aAAa,EAAE,wBAAwB;qBACxC,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC7C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC;gBAC9G,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,IAAI;oBAChB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,GAAG;oBACpE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;iBAC9C,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,4BAA4B,EAAE,CAAC;YACjH,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;gBAC/C,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC;oBAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,CAAC;gBAC9G,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;oBAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC;gBAChH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YAClH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,KAAK;oBACjB,eAAe,EAAE,4BAA4B;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE;YAChB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC;QAC3G,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE,yBAAyB,EAAE,CAAC;IAC5G,CAAC;IAED,SAAS,CAAC,SAA0B,EAAE,SAAiB;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;QAC/E,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE;YAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACtE,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,WAAW,CAAC,SAA0B;QACpC,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,6BAA6B,CAAC,4BAA4B,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,KAAK,SAAS,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,6BAA6B,CAAC,uBAAuB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wBAAwB,CAAC,SAAiB;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,6BAA6B,CAAC,wBAAwB,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,yBAAyB,CAAC,SAAiB;QACzC,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,aAAa;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;IACzD,CAAC;IAED,iBAAiB;QACf,IAAI,MAAyC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAAE,MAAM,GAAG,IAAI,CAAC;QACxE,CAAC;QACD,IAAI,MAAM;YAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACzD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,OAAO,CACd,MAA2C,EAC3C,UAAgC,EAChC,MAAc;IAEd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AACtD,CAAC"}

package/dist/gateway/gateway.d.ts

@@ -6,13 +6,20 @@ import type { GatewayAssertionClaims, GatewayManifest, GatewaySafeLogMetadata, P
 import { GatewayServer } from './server.js';
 import type { RuntimeFactory } from './runtime-factory.js';
 import { type PendingInteractionDto, type SessionProjectionSource } from './persistence/projection.js';
+import { type GatewayTlsOptions } from './server.js';
 import { ServerSession } from './server-session.js';
 import type { GatewayPersistenceCoordinator } from './persistence/coordinator.js';
+import { DynamicWorkspaceRegistry } from './dynamic-workspace-registry.js';
+import { type OAuthAccountProviderId } from '../providers/oauth-accounts.js';
 declare const INTERACTION_METRICS: readonly ['interaction_presented', 'interaction_updated', 'interaction_resolved', 'interaction_stale', 'interaction_duplicate', 'interaction_sanitization_rejected', 'interaction_continuation_failed'];
 type InteractionMetric = (typeof INTERACTION_METRICS)[number];
 export type GatewayLaunchConfig = {
     enabled: boolean;
-    socketPath: string;
+    socketPath?: string;
+    /** Defaults to loopback; public-interface binds are outside deployment policy. */
+    host?: string;
+    port?: number;
+    tls?: GatewayTlsOptions;
     manifestPath: string;
     manifestSha256?: string;
     replayDbPath: string;
@@ -33,6 +40,21 @@ export type GatewayLaunchConfig = {
     runtimeFactory?: RuntimeFactory;
     /** Optional plan-03 durable index/log/journal owner. */
     persistence?: GatewayPersistenceCoordinator;
+    /** Optional pre-wired registry; otherwise one is derived from local grants. */
+    workspaceRegistry?: DynamicWorkspaceRegistry;
+    /** Explicit local roots allowed to the browser-owned candidate registry. */
+    workspaceAllowedRoots?: readonly string[];
+    /** Test/launcher seam for the server-owned OAuth loopback flow. */
+    oauthLogin?: (provider: OAuthAccountProviderId) => Promise<void>;
+    /** Principal permitted to operate the process-wide settings/account stores. */
+    localOwnerUserId?: string;
+    pairing?: {
+        enabled: boolean;
+        otpTtlMs?: number;
+        maxAttempts?: number;
+        /** Remove this file and restart to revoke all peers and re-bootstrap pairing. */
+        trustFilePath: string;
+    };
 };
 export declare class GatewayStartupError extends Error {
     constructor();
@@ -53,6 +75,7 @@ export declare class Term2Gateway {
     shutdown(graceMs?: number): Promise<void>;
 }
 export declare function classifyInteractionResolution(interaction: SessionProjectionSource['interaction'], hasLiveSnapshot: boolean): 'interaction_not_resolvable' | 'interaction_already_resolved' | null;
+export declare function sessionConfigProjection(session: ServerSession): Record<string, unknown>;
 export type InteractionResolveRequest = {
     revision: number;
     answer: string;

package/dist/gateway/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../source/gateway/gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAEL,kBAAkB,EAElB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAS3D,OAAO,EAEL,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AAerC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,6BAA6B,EAA2B,MAAM,8BAA8B,CAAC;AAQ3G,QAAA,MAAM,mBAAmB,YACvB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,CACzB,CAAC;AACX,KAAK,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAwD9D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACnF,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,wDAAwD;IACxD,WAAW,CAAC,EAAE,6BAA6B,CAAC;CAC7C,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,cAGC;CACF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,eAAe,CAmB7G;AAED,qFAAqF;AACrF,qBAAa,YAAY;;IAiBvB,OAAO,eAsBN;IAgqBD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,YAAY,CASvD;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IACD,IAAI,SAAS,IAAI,kBAAkB,CAElC;IACD,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IACD,IAAI,eAAe,IAAI,MAAM,CAE5B;IACD,IAAI,kBAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAMpE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3B;IAEK,aAAa,CACjB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,CAAC,EAAE,IAAI,CAAC,gCAAgC,EAAE,SAAS,GAAG,gBAAgB,GAAG,eAAe,CAAC,EAChG,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,GAAG,aAAa,CAAC,CAmGnE;IAEK,QAAQ,CAAC,OAAO,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7C;CACF;AAwCD,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,uBAAuB,CAAC,aAAa,CAAC,EACnD,eAAe,EAAE,OAAO,GACvB,4BAA4B,GAAG,8BAA8B,GAAG,IAAI,CAItE;AAiDD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,yBAAyB,CAa5F;AA8BD,iBAAS,qBAAqB,CAAC,KAAK,EAAE,OAAO,4BAA4B,EAAE,kBAAkB,GAAG,OAAO,CAmDtG;AAcD,iBAAS,0BAA0B,CACjC,QAAQ,EAAE;IACR,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,2BAA2B,EAAE,MAAM,CAAC;CACrC,EACD,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAQvB;AAsOD,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AACrF,YAAY,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../source/gateway/gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAEL,kBAAkB,EAElB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,qBAAqB,EACrB,KAAK,gCAAgC,EACrC,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,wBAAwB,EACxB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAS3D,OAAO,EAEL,KAAK,qBAAqB,EAE1B,KAAK,uBAAuB,EAC7B,MAAM,6BAA6B,CAAC;AASrC,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,6BAA6B,EAA2B,MAAM,8BAA8B,CAAC;AAE3G,OAAO,EAAE,wBAAwB,EAAiC,MAAM,iCAAiC,CAAC;AAgB1G,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AASxC,QAAA,MAAM,mBAAmB,YACvB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,uBAAuB,EACvB,mCAAmC,EACnC,iCAAiC,CACzB,CAAC;AACX,KAAK,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAkE9D,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACnF,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,wDAAwD;IACxD,WAAW,CAAC,EAAE,6BAA6B,CAAC;IAC5C,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAC7C,4EAA4E;IAC5E,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,mEAAmE;IACnE,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE;QACR,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,iFAAiF;QACjF,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;CACH,CAAC;AAEF,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,cAGC;CACF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,eAAe,CA8D7G;AAED,qFAAqF;AACrF,qBAAa,YAAY;;IAsBvB,OAAO,eAqFN;IAkiCD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,YAAY,CASvD;IAED,IAAI,MAAM,IAAI,aAAa,CAE1B;IACD,IAAI,SAAS,IAAI,kBAAkB,CAElC;IACD,IAAI,SAAS,IAAI,gBAAgB,CAEhC;IACD,IAAI,eAAe,IAAI,MAAM,CAE5B;IACD,IAAI,kBAAkB,IAAI,QAAQ,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAMpE;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAQ3B;IAEK,aAAa,CACjB,MAAM,EAAE,sBAAsB,EAC9B,OAAO,CAAC,EAAE,IAAI,CAAC,gCAAgC,EAAE,SAAS,GAAG,gBAAgB,GAAG,eAAe,CAAC,EAChG,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,UAAU,CAAC,OAAO,qBAAqB,CAAC,GAAG,aAAa,CAAC,CAmGnE;IAEK,QAAQ,CAAC,OAAO,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD7C;CACF;AA+ED,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,uBAAuB,CAAC,aAAa,CAAC,EACnD,eAAe,EAAE,OAAO,GACvB,4BAA4B,GAAG,8BAA8B,GAAG,IAAI,CAItE;AAoID,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsCvF;AAmCD,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,yBAAyB,CAa5F;AA8BD,iBAAS,qBAAqB,CAAC,KAAK,EAAE,OAAO,4BAA4B,EAAE,kBAAkB,GAAG,OAAO,CAmDtG;AAcD,iBAAS,0BAA0B,CACjC,QAAQ,EAAE;IACR,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,2BAA2B,EAAE,MAAM,CAAC;CACrC,EACD,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,qBAAqB,CAQvB;AAsOD,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,CAAC;AACrF,YAAY,EAAE,cAAc,EAAE,CAAC"}