@sentropic/h2a-runtime 0.98.5 → 0.98.7-rc.1

package/dist/gateway-host/live-registration.js

@@ -0,0 +1,455 @@
+/**
+ * L6a (H) — explicit live workspace registration (composition seam).
+ *
+ * DESIGN (LIVE §2–3, §10, §12; owner decision Q4 = A):
+ *  - Activation is EXPLICIT and once per worktree: bind, transcript upload,
+ *    code-workspace creation and agent sessions are never inputs here, and
+ *    nothing in this module observes sessions at all. Session end never
+ *    unregisters; host restart replays durable declarations.
+ *  - The durable declaration store is LOCAL h2a state (see
+ *    ./live-declarations.ts); it is never the product workspace router and
+ *    never projection-owned.
+ *  - Identities are minted ONLY through the three canonical public
+ *    derivations from the vendored neutral integration entry
+ *    (../vendor/engram-live, see the core live/contracts.ts header), so
+ *    H ids are byte-identical to the engram (E) side for identical inputs:
+ *    equal fingerprints under different realpaths derive distinct clones,
+ *    while linked worktrees sharing one common-dir derive the same clone.
+ *    Missing/shallow history is explicit uncertainty, never a
+ *    URL/fingerprint-only merge.
+ *  - The public `ws:` worktree/project fingerprint is H's own preserved
+ *    fingerprint (spec §12: keep the existing derivation byte-identical);
+ *    the two helpers below are its only copy, forced by the core/runtime
+ *    boundary (no static runtime→core import), and pinned byte-identical
+ *    to core by live-registration.test.ts. They compute fingerprints, never
+ *    opaque ids: every cloneId/worktreeId/declarationId comes from the
+ *    package.
+ *  - Local authority is a seam with NO fallback: a positive authorization
+ *    without a verified principal is refused explicitly
+ *    (`verified_principal_required`) before any neutral DTO is built — for
+ *    reads as well as activation (spec §12). The default authority DENIES
+ *    every operation explicitly (`local_authority_unavailable`) until L7a
+ *    supplies verified local principals and the stable owner scope.
+ *    Refusal is an error, never a successful empty result.
+ *  - Removal and clone withdrawal stop work first (cancellation seam),
+ *    then return the contract revocation (exact declarationId, tenant,
+ *    clone/worktree attachment, declarationRevision, reason, full private
+ *    purge request); committed history is never touched.
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, realpathSync } from "node:fs";
+import { userInfo } from "node:os";
+import { basename, isAbsolute, resolve } from "node:path";
+import { EXPLICIT_LIVE_CAPABILITY, INITIAL_DECLARATION_REVISION, NON_ACTIVATING_LIFECYCLE_KINDS, POLICY_VERSION, isIdentityUncertaintyState, isNonActivatingLifecycleKind, validateDeclarationRevocation, validateWorkspaceDeclaration, } from "../vendor/engram-live/contracts.js";
+import { deriveCloneIdentity, deriveDeclarationIdentity, deriveWorktreeIdentity, } from "../vendor/engram-live/integration.js";
+import { LIVE_DECLARATION_KIND, LIVE_DECLARATION_SCHEMA_VERSION, createLiveDeclarationStore, } from "./live-declarations.js";
+// ---------------------------------------------------------------------------
+// H-public `ws:` fingerprint (LIVE §12: preserved byte-identical).
+// ---------------------------------------------------------------------------
+//
+// The ONLY runtime copy of the core derivation (core/runtime boundary
+// forbids a static runtime→core import). Fingerprints only: opaque ids are
+// minted exclusively through the canonical package derivations above.
+export function normalizeRootCommits(shas) {
+    return [...new Set(shas.map((s) => s.trim()).filter((s) => s.length > 0))]
+        .sort()
+        .join(",");
+}
+export function computeDurableWorkspaceId(rootCommitSHA, worktreeRelPath) {
+    const hex = createHash("sha256")
+        .update(`${rootCommitSHA}\n${worktreeRelPath}`, "utf8")
+        .digest("hex");
+    return `ws:${hex}`;
+}
+const resolveWithin = (base, path) => {
+    if (isAbsolute(path))
+        return path;
+    return resolve(base, path);
+};
+const realpathOr = (path, fallback) => {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return fallback;
+    }
+};
+/**
+ * Probe a worktree's live identity with read-only Git plumbing. Every
+ * invocation disables optional locks (`--no-optional-locks`, LIVE §7) and
+ * never writes to the observed worktree, its index or its refs. Returns
+ * undefined when the path is not a Git worktree; missing (unborn HEAD) or
+ * shallow history is a successful probe with explicit uncertainty.
+ */
+export function probeLiveWorkspace(cwd) {
+    const worktreeRealpath = realpathOr(cwd, resolve(cwd));
+    const spawnOpts = {
+        cwd: worktreeRealpath,
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 5000,
+        windowsHide: true,
+    };
+    const run = (args) => {
+        try {
+            const out = execFileSync("git", ["--no-optional-locks", "-C", worktreeRealpath, ...args], spawnOpts)
+                .toString("utf8")
+                .trim();
+            return out.length > 0 ? out : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    // --- git-dir / common-dir (resolve relative outputs against the root) ---
+    const gitDirRaw = run(["rev-parse", "--git-dir"]);
+    const commonDirRaw = run(["rev-parse", "--git-common-dir"]);
+    if (gitDirRaw === undefined || commonDirRaw === undefined)
+        return undefined;
+    const gitDir = realpathOr(resolveWithin(worktreeRealpath, gitDirRaw), gitDirRaw);
+    const commonDirRealpath = realpathOr(resolveWithin(worktreeRealpath, commonDirRaw), commonDirRaw);
+    const worktreeName = gitDir === commonDirRealpath ? "" : basename(gitDir);
+    // --- object format (required to mint a contract-valid clone identity) ---
+    const objectFormat = run(["rev-parse", "--show-object-format"]);
+    const oidAlgorithm = objectFormat === "sha1" || objectFormat === "sha256" ? objectFormat : undefined;
+    // --- root commits of this worktree's HEAD (absent on unborn HEAD) ---
+    // HEAD-bound by design: this feeds the public per-worktree `ws:`
+    // fingerprint only, never the clone key.
+    const rootCommitLines = run(["rev-list", "--max-parents=0", "HEAD"]);
+    const rootCommits = rootCommitLines === undefined ? undefined : normalizeRootCommits(rootCommitLines.split(/\r?\n/));
+    // --- common-dir history roots (HEAD-independent clone key, spec §12) ---
+    // The union of root commits over every ref in the shared common-dir,
+    // identical from every worktree of the clone whatever its HEAD (an
+    // orphan branch checked out in one worktree must not fork the clone).
+    // HEAD itself is deliberately excluded: it is per-worktree state.
+    const refTipLines = run(["for-each-ref", "--format=%(objectname)"]);
+    const refTips = refTipLines === undefined
+        ? []
+        : refTipLines
+            .split(/\r?\n/)
+            .map((tip) => tip.trim())
+            .filter((tip) => tip.length > 0);
+    let cloneRootCommits;
+    if (refTips.length > 0) {
+        const cloneRootLines = run(["rev-list", "--max-parents=0", ...refTips]);
+        cloneRootCommits =
+            cloneRootLines === undefined
+                ? undefined
+                : normalizeRootCommits(cloneRootLines.split(/\r?\n/));
+    }
+    const shallow = existsSync(resolve(commonDirRealpath.startsWith("/") ? commonDirRealpath : resolveWithin(worktreeRealpath, commonDirRealpath), "shallow"));
+    const identityUncertainty = [];
+    if (rootCommits === undefined) {
+        identityUncertainty.push("missing_history");
+    }
+    // The clone fingerprint may be absent only under explicit
+    // missing_history uncertainty (engram contract): when the common-dir
+    // holds no ref history at all, say so even if this worktree's HEAD
+    // somehow resolves.
+    if (cloneRootCommits === undefined && !identityUncertainty.includes("missing_history")) {
+        identityUncertainty.push("missing_history");
+    }
+    if (shallow) {
+        identityUncertainty.push("shallow_history");
+    }
+    return {
+        worktreeRealpath,
+        gitDir,
+        commonDirRealpath,
+        worktreeName,
+        ...(oidAlgorithm !== undefined ? { oidAlgorithm } : {}),
+        ...(rootCommits !== undefined ? { rootCommits } : {}),
+        ...(rootCommits !== undefined
+            ? { workspaceFingerprint: computeDurableWorkspaceId(rootCommits, worktreeName) }
+            : {}),
+        ...(cloneRootCommits !== undefined
+            ? { projectFingerprint: computeDurableWorkspaceId(cloneRootCommits, "") }
+            : {}),
+        shallow,
+        identityUncertainty,
+    };
+}
+// ---------------------------------------------------------------------------
+// Lifecycle classification (spec §12: these kinds never activate/remove)
+// ---------------------------------------------------------------------------
+/**
+ * Classify a host lifecycle event against live declarations. Bind, upload,
+ * code-workspace creation and session open/end never activate or remove a
+ * declaration: the only outcome is "no-activation-change". Unknown kinds
+ * are refused. Pinned to NON_ACTIVATING_LIFECYCLE_KINDS, never a copy.
+ */
+export function classifyLifecycleEvent(kind) {
+    if (!isNonActivatingLifecycleKind(kind)) {
+        throw new Error(`unknown lifecycle kind: ${String(kind)}`);
+    }
+    return "no-activation-change";
+}
+/**
+ * Default authority until L7a: deny everything explicitly. Local identity
+ * verification is L7a work; until it exists, no declaration API is usable,
+ * and denial is an error — never a successful empty result (A01).
+ */
+export const unverifiedLocalLiveAuthority = {
+    authorize: () => ({ ok: false, reason: "local_authority_unavailable" }),
+};
+export const inertLiveWorkController = {
+    cancelScheduledWork: () => false,
+    requestPrivatePurge: () => false,
+    hasInFlightWork: () => false,
+};
+export class LiveAccessRefused extends Error {
+    operation;
+    reason;
+    constructor(operation, reason) {
+        super(`live ${operation} refused: ${reason}`);
+        this.operation = operation;
+        this.reason = reason;
+        this.name = "LiveAccessRefused";
+    }
+}
+const defaultTenant = () => {
+    const username = userInfo().username;
+    return `local:${username && username.length > 0 ? username : "unknown"}`;
+};
+export function createLiveRegistration(options) {
+    const root = options.root;
+    const tenant = options.tenant ?? defaultTenant();
+    const authority = options.authority ?? unverifiedLocalLiveAuthority;
+    const workController = options.workController ?? inertLiveWorkController;
+    const now = options.now ?? (() => new Date().toISOString());
+    const store = createLiveDeclarationStore(root);
+    const authorize = (operation, detail = {}) => {
+        const decision = authority.authorize({
+            operation,
+            tenant,
+            ...(detail.path !== undefined ? { path: detail.path } : {}),
+            ...(detail.declarationId !== undefined ? { declarationId: detail.declarationId } : {}),
+            ...(detail.hostFingerprint !== undefined
+                ? { hostFingerprint: detail.hostFingerprint }
+                : {}),
+        });
+        if (!decision.ok) {
+            throw new LiveAccessRefused(operation, decision.reason ?? "denied");
+        }
+        // No fabricated fallback: a positive authorization without a verified
+        // principal is refused before any neutral DTO is built. The stable
+        // owner scope and principal proof are L7a work — say so, don't invent.
+        if (decision.principal === undefined || decision.principal.trim().length === 0) {
+            throw new LiveAccessRefused(operation, "verified_principal_required");
+        }
+        return { ...decision, principal: decision.principal };
+    };
+    const resolveInputPath = (path) => realpathOr(resolve(path), resolve(path));
+    const findByAuthorizedRoot = (path) => {
+        const resolved = resolveInputPath(path);
+        return store
+            .list()
+            .find((record) => record.declaration.authorizedRoots.includes(resolved) ||
+            record.declaration.authorizedRoots.includes(realpathOr(resolved, resolved)));
+    };
+    const buildRevocation = (record, reason) => {
+        const revocation = {
+            declarationId: record.declaration.declarationId,
+            tenant: record.declaration.tenant,
+            cloneId: record.declaration.cloneId,
+            worktreeId: record.declaration.worktreeId,
+            declarationRevision: record.declaration.declarationRevision,
+            reason,
+            requestPrivatePurge: {
+                purgePrivateSnapshots: true,
+                purgeDerivedIndexes: true,
+                revokeDecryptability: true,
+                preserveCommittedHistory: true,
+            },
+        };
+        const checked = validateDeclarationRevocation(revocation);
+        if (!checked.ok) {
+            throw new Error(`invalid live declaration revocation: ${checked.errors.join("; ")}`);
+        }
+        return revocation;
+    };
+    return {
+        authority,
+        probe: probeLiveWorkspace,
+        activate(request) {
+            const decision = authorize("activate", { path: request.path });
+            const probe = probeLiveWorkspace(request.path);
+            if (probe === undefined) {
+                throw new Error(`not a git worktree: ${request.path}`);
+            }
+            for (const state of probe.identityUncertainty) {
+                if (!isIdentityUncertaintyState(state)) {
+                    throw new Error(`unknown identity uncertainty state: ${String(state)}`);
+                }
+            }
+            if (probe.oidAlgorithm !== "sha1" && probe.oidAlgorithm !== "sha256") {
+                throw new Error(`cannot mint a live clone identity for ${request.path}: repository object format is undetectable`);
+            }
+            // Canonical identities: byte-identical to the engram side for
+            // identical inputs (hostScope carries the local tenant scope, which
+            // bounds the clone to one host).
+            const clone = deriveCloneIdentity({
+                hostScope: tenant,
+                commonDirRealpath: probe.commonDirRealpath,
+                ...(probe.projectFingerprint !== undefined
+                    ? { commonDirProjectFingerprint: probe.projectFingerprint }
+                    : {}),
+                identityUncertainty: [...probe.identityUncertainty],
+                oidAlgorithm: probe.oidAlgorithm,
+            });
+            const worktree = deriveWorktreeIdentity({
+                hostScope: tenant,
+                clone: { cloneId: clone.cloneId },
+                worktreePath: probe.worktreeRealpath,
+                gitDir: probe.gitDir,
+                ...(probe.workspaceFingerprint !== undefined
+                    ? { worktreeFingerprint: probe.workspaceFingerprint }
+                    : {}),
+                identityUncertainty: [...probe.identityUncertainty],
+            });
+            const identity = deriveDeclarationIdentity({
+                hostScope: tenant,
+                clone: { cloneId: clone.cloneId },
+                worktree: { worktreeId: worktree.worktreeId },
+            });
+            const declaration = {
+                tenant,
+                principal: decision.principal,
+                ...(probe.workspaceFingerprint !== undefined
+                    ? { hostFingerprint: probe.workspaceFingerprint }
+                    : {}),
+                identityUncertainty: [...probe.identityUncertainty],
+                declarationId: identity.declarationId,
+                cloneId: identity.cloneId,
+                worktreeId: identity.worktreeId,
+                authorizedRoots: [probe.worktreeRealpath],
+                liveCapability: EXPLICIT_LIVE_CAPABILITY,
+                policyVersion: POLICY_VERSION,
+                declarationRevision: INITIAL_DECLARATION_REVISION,
+            };
+            const checked = validateWorkspaceDeclaration(declaration);
+            if (!checked.ok) {
+                throw new Error(`invalid live workspace declaration: ${checked.errors.join("; ")}`);
+            }
+            const existing = store.get(declaration.declarationId);
+            if (existing !== undefined) {
+                // Once per worktree: replay the existing declaration, no revision bump.
+                return { declaration: existing, created: false };
+            }
+            const timestamp = now();
+            const record = {
+                kind: LIVE_DECLARATION_KIND,
+                schemaVersion: LIVE_DECLARATION_SCHEMA_VERSION,
+                declaration,
+                clone,
+                worktree,
+                createdAt: timestamp,
+                activatedAt: timestamp,
+                updatedAt: timestamp,
+            };
+            store.insert(record);
+            return { declaration: record, created: true };
+        },
+        list() {
+            authorize("list");
+            return store.list();
+        },
+        status(path) {
+            authorize("status", { path });
+            return findByAuthorizedRoot(path);
+        },
+        resolvePath(path) {
+            authorize("resolve", { path });
+            const resolved = resolveInputPath(path);
+            let best;
+            let bestMatchedLength = -1;
+            for (const record of store.list()) {
+                for (const rootPath of record.declaration.authorizedRoots) {
+                    if (resolved !== rootPath && !resolved.startsWith(rootPath + "/"))
+                        continue;
+                    const relativePath = resolved === rootPath ? "" : resolved.slice(rootPath.length + 1);
+                    if (best === undefined || rootPath.length > bestMatchedLength) {
+                        best = { declaration: record, relativePath };
+                        bestMatchedLength = rootPath.length;
+                    }
+                }
+            }
+            return best;
+        },
+        remove(request) {
+            authorize("remove", { path: request.path });
+            const record = findByAuthorizedRoot(request.path);
+            if (record === undefined) {
+                return { removed: false, canceledWork: false, purgeRequested: false };
+            }
+            const scope = {
+                declarationId: record.declaration.declarationId,
+                cloneId: record.declaration.cloneId,
+            };
+            // Stop work and reject delayed jobs BEFORE unregistering; then purge
+            // private local snapshots. Committed history is never touched here.
+            const canceledWork = workController.cancelScheduledWork(scope);
+            const purgeRequested = workController.requestPrivatePurge(scope);
+            const revocation = buildRevocation(record, request.reason);
+            store.remove(record.declaration.declarationId);
+            return { removed: true, canceledWork, purgeRequested, revocation };
+        },
+        removeClone(request) {
+            authorize("remove-clone");
+            // Withdrawing a whole clone revokes EACH of its declarations, one
+            // unambiguous revocation per declaration (contract §L6a).
+            const targets = store
+                .list()
+                .filter((record) => record.declaration.cloneId === request.cloneId);
+            const revocations = [];
+            let canceledWork = false;
+            let purgeRequested = false;
+            for (const record of targets) {
+                const scope = {
+                    declarationId: record.declaration.declarationId,
+                    cloneId: record.declaration.cloneId,
+                };
+                canceledWork = workController.cancelScheduledWork(scope) || canceledWork;
+                purgeRequested = workController.requestPrivatePurge(scope) || purgeRequested;
+                revocations.push(buildRevocation(record, request.reason));
+                store.remove(record.declaration.declarationId);
+            }
+            return { removed: revocations.length, revocations, canceledWork, purgeRequested };
+        },
+        rebind(request) {
+            authorize("rebind", { path: request.path });
+            const record = findByAuthorizedRoot(request.path);
+            if (record === undefined) {
+                throw new Error(`no live declaration for path: ${request.path}`);
+            }
+            const scope = {
+                declarationId: record.declaration.declarationId,
+                cloneId: record.declaration.cloneId,
+            };
+            // In-flight collection/publication cannot be redirected by a rebind.
+            if (workController.hasInFlightWork(scope)) {
+                throw new LiveAccessRefused("rebind", "in_flight_work_cannot_be_redirected");
+            }
+            const nextBindingRevision = (record.declaration.bindingRevision ?? 0) + 1;
+            return store.update(record.declaration.declarationId, record.declaration.declarationRevision, (current) => ({
+                ...current,
+                declaration: {
+                    ...current.declaration,
+                    serverWorkspaceId: request.sentropicWorkspaceId,
+                    serverIssuer: request.issuer,
+                    bindingRevision: nextBindingRevision,
+                    declarationRevision: current.declaration.declarationRevision + 1,
+                },
+                updatedAt: now(),
+            }));
+        },
+        replay() {
+            authorize("replay");
+            return store.list();
+        },
+    };
+}
+// Re-export the consumed lifecycle vocabulary for host compositors that
+// classify events without importing the neutral package directly.
+export { NON_ACTIVATING_LIFECYCLE_KINDS };
+//# sourceMappingURL=live-registration.js.map

package/dist/gateway-host/live-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-registration.js","sourceRoot":"","sources":["../../src/gateway-host/live-registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,8BAA8B,EAC9B,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,qBAAqB,EACrB,+BAA+B,EAC/B,0BAA0B,GAG3B,MAAM,wBAAwB,CAAC;AAEhC,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,sEAAsE;AAEtE,MAAM,UAAU,oBAAoB,CAAC,IAA2B;IAC9D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;SACvE,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,aAAqB,EACrB,eAAuB;IAEvB,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC7B,MAAM,CAAC,GAAG,aAAa,KAAK,eAAe,EAAE,EAAE,MAAM,CAAC;SACtD,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,MAAM,GAAG,EAAE,CAAC;AACrB,CAAC;AA6BD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAU,EAAE;IAC5D,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG;QAChB,GAAG,EAAE,gBAAgB;QACrB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAA+B;QAC/D,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,IAAuB,EAAsB,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC,EAAE,SAAS,CAAC;iBACjG,QAAQ,CAAC,MAAM,CAAC;iBAChB,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,2EAA2E;IAC3E,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,iBAAiB,GAAG,UAAU,CAClC,aAAa,CAAC,gBAAgB,EAAE,YAAY,CAAC,EAC7C,YAAY,CACb,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE1E,2EAA2E;IAC3E,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAChB,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAElF,uEAAuE;IACvE,iEAAiE;IACjE,yCAAyC;IACzC,MAAM,eAAe,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAErH,0EAA0E;IAC1E,qEAAqE;IACrE,mEAAmE;IACnE,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GACX,WAAW,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,WAAW;aACR,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,IAAI,gBAAoC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QACxE,gBAAgB;YACd,cAAc,KAAK,SAAS;gBAC1B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAC/H,CAAC;IAEF,MAAM,mBAAmB,GAA+B,EAAE,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IACD,0DAA0D;IAC1D,qEAAqE;IACrE,mEAAmE;IACnE,oBAAoB;IACpB,IAAI,gBAAgB,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvF,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,MAAM;QACN,iBAAiB;QACjB,YAAY;QACZ,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,WAAW,KAAK,SAAS;YAC3B,CAAC,CAAC,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;YAChF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,gBAAgB,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,kBAAkB,EAAE,yBAAyB,CAAC,gBAAgB,EAAE,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;QACP,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAgC;IACrE,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAmCD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAkB;IACzD,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;CACxE,CAAC;AAkBF,MAAM,CAAC,MAAM,uBAAuB,GAAuB;IACzD,mBAAmB,EAAE,GAAG,EAAE,CAAC,KAAK;IAChC,mBAAmB,EAAE,GAAG,EAAE,CAAC,KAAK;IAChC,eAAe,EAAE,GAAG,EAAE,CAAC,KAAK;CAC7B,CAAC;AAEF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B;IACA;IAFX,YACW,SAAwB,EACxB,MAAc;QAEvB,KAAK,CAAC,QAAQ,SAAS,aAAa,MAAM,EAAE,CAAC,CAAC;QAHrC,cAAS,GAAT,SAAS,CAAe;QACxB,WAAM,GAAN,MAAM,CAAQ;QAGvB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAkFD,MAAM,aAAa,GAAG,GAAW,EAAE;IACjC,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACrC,OAAO,SAAS,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,4BAA4B,CAAC;IACpE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAyB,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAErE,MAAM,SAAS,GAAG,CAChB,SAAwB,EACxB,SAA8E,EAAE,EAC7B,EAAE;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC;YACnC,SAAS;YACT,MAAM;YACN,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IACxD,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5F,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAqC,EAAE;QAC/E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,KAAK;aACT,IAAI,EAAE;aACN,IAAI,CACH,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrD,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAC9E,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CACtB,MAA6B,EAC7B,MAAwB,EACE,EAAE;QAC5B,MAAM,UAAU,GAA6B;YAC3C,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa;YAC/C,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACjC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO;YACnC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU;YACzC,mBAAmB,EAAE,MAAM,CAAC,WAAW,CAAC,mBAAmB;YAC3D,MAAM;YACN,mBAAmB,EAAE;gBACnB,qBAAqB,EAAE,IAAI;gBAC3B,mBAAmB,EAAE,IAAI;gBACzB,oBAAoB,EAAE,IAAI;gBAC1B,wBAAwB,EAAE,IAAI;aAC/B;SACF,CAAC;QACF,MAAM,OAAO,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;IAEF,OAAO;QACL,SAAS;QACT,KAAK,EAAE,kBAAkB;QACzB,QAAQ,CAAC,OAAO;YACd,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;gBAC9C,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CACb,yCAAyC,OAAO,CAAC,IAAI,4CAA4C,CAClG,CAAC;YACJ,CAAC;YACD,8DAA8D;YAC9D,oEAAoE;YACpE,iCAAiC;YACjC,MAAM,KAAK,GAAqB,mBAAmB,CAAC;gBAClD,SAAS,EAAE,MAAM;gBACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,kBAAkB,EAAE;oBAC3D,CAAC,CAAC,EAAE,CAAC;gBACP,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;gBACnD,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAwB,sBAAsB,CAAC;gBAC3D,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBACjC,YAAY,EAAE,KAAK,CAAC,gBAAgB;gBACpC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,oBAAoB,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;gBACP,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;aACpD,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,yBAAyB,CAAC;gBACzC,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;gBACjC,QAAQ,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE;aAC9C,CAAC,CAAC;YACH,MAAM,WAAW,GAA4B;gBAC3C,MAAM;gBACN,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;oBAC1C,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,oBAAoB,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACP,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;gBACnD,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBACzC,cAAc,EAAE,wBAAwB;gBACxC,aAAa,EAAE,cAAc;gBAC7B,mBAAmB,EAAE,4BAA4B;aAClD,CAAC;YACF,MAAM,OAAO,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YACnD,CAAC;YACD,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,MAAM,GAA0B;gBACpC,IAAI,EAAE,qBAAqB;gBAC3B,aAAa,EAAE,+BAA+B;gBAC9C,WAAW;gBACX,KAAK;gBACL,QAAQ;gBACR,SAAS,EAAE,SAAS;gBACpB,WAAW,EAAE,SAAS;gBACtB,SAAS,EAAE,SAAS;aACrB,CAAC;YACF,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,IAAI;YACF,SAAS,CAAC,MAAM,CAAC,CAAC;YAClB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,IAAI;YACT,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QACD,WAAW,CAAC,IAAI;YACd,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,IAAkC,CAAC;YACvC,IAAI,iBAAiB,GAAG,CAAC,CAAC,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;oBAC1D,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;wBAAE,SAAS;oBAC5E,MAAM,YAAY,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBACtF,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;wBAC9D,IAAI,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;wBAC7C,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,OAAO;YACZ,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,GAAkB;gBAC3B,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa;gBAC/C,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO;aACpC,CAAC;YACF,qEAAqE;YACrE,oEAAoE;YACpE,MAAM,YAAY,GAAG,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,cAAc,GAAG,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC3D,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;QACrE,CAAC;QACD,WAAW,CAAC,OAAO;YACjB,SAAS,CAAC,cAAc,CAAC,CAAC;YAC1B,kEAAkE;YAClE,0DAA0D;YAC1D,MAAM,OAAO,GAAG,KAAK;iBAClB,IAAI,EAAE;iBACN,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;YACtE,MAAM,WAAW,GAA+B,EAAE,CAAC;YACnD,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAkB;oBAC3B,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa;oBAC/C,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO;iBACpC,CAAC;gBACF,YAAY,GAAG,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC;gBACzE,cAAc,GAAG,cAAc,CAAC,mBAAmB,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC;gBAC7E,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1D,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,OAAO;YACZ,SAAS,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,KAAK,GAAkB;gBAC3B,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa;gBAC/C,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO;aACpC,CAAC;YACF,qEAAqE;YACrE,IAAI,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,iBAAiB,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,mBAAmB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC,MAAM,CACjB,MAAM,CAAC,WAAW,CAAC,aAAa,EAChC,MAAM,CAAC,WAAW,CAAC,mBAAmB,EACtC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACZ,GAAG,OAAO;gBACV,WAAW,EAAE;oBACX,GAAG,OAAO,CAAC,WAAW;oBACtB,iBAAiB,EAAE,OAAO,CAAC,oBAAoB;oBAC/C,YAAY,EAAE,OAAO,CAAC,MAAM;oBAC5B,eAAe,EAAE,mBAAmB;oBACpC,mBAAmB,EAAE,OAAO,CAAC,WAAW,CAAC,mBAAmB,GAAG,CAAC;iBACjE;gBACD,SAAS,EAAE,GAAG,EAAE;aACjB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM;YACJ,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpB,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,kEAAkE;AAClE,OAAO,EAAE,8BAA8B,EAAE,CAAC"}

package/dist/identity-cull/cull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cull.d.ts","sourceRoot":"","sources":["../../src/identity-cull/cull.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoBH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAiCD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;QACvC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9C,CAAC;IACF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACnE,uFAAuF;IACvF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CAAC;CAClD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;CAC/E;AAqkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,GAAG,aAAa,CAmL7E;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,sBAA2B,GAAG,gBAAgB,CAYxF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IACjD,oFAAoF;IACpF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,6BAA6B,GAAG,8BAA8B,GAAG,+BAA+B,CAAC;CACpH;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,sBAAsB,GAChC,wBAAwB,CAc1B;AAED,KAAK,yBAAyB,GAC1B,+BAA+B,GAC/B,+BAA+B,GAC/B,mCAAmC,GACnC,qCAAqC,GACrC,8BAA8B,CAAC;AAEnC,KAAK,mBAAmB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAiFnG;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAiC9F;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,oBAAoB,CAAA;CAAE,GAC7F;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ5F,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,wBAAwB,GAAG,uBAAuB,CAShG"}
+{"version":3,"file":"cull.d.ts","sourceRoot":"","sources":["../../src/identity-cull/cull.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqBH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAiCD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;QACvC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC7C,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC9C,CAAC;IACF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACnE,uFAAuF;IACvF,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CAAC;CAClD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;CAC/E;AAqkBD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,GAAG,aAAa,CAmL7E;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IAC9C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iCAAiC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,sBAA2B,GAAG,gBAAgB,CAYxF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,EAAE,sBAAsB,CAAC;IACjD,oFAAoF;IACpF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,6BAA6B,GAAG,8BAA8B,GAAG,+BAA+B,CAAC;CACpH;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,sBAAsB,GAChC,wBAAwB,CAc1B;AAED,KAAK,yBAAyB,GAC1B,+BAA+B,GAC/B,+BAA+B,GAC/B,mCAAmC,GACnC,qCAAqC,GACrC,8BAA8B,CAAC;AAEnC,KAAK,mBAAmB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAErG,MAAM,MAAM,uBAAuB,GAAG,mBAAmB,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAuBnG;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,CAkC9F;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,GAAG,oBAAoB,CAAA;CAAE,GAC7F;IAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ5F,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,wBAAwB,GAAG,uBAAuB,CAShG"}

package/dist/identity-cull/cull.js

@@ -5,6 +5,7 @@
  * however, implement and verify the canonical binding-fence + held-descriptor
  * CAS needed by a future, separately owner-authorized executor.
  */
+import { withIdentityFenceSync } from "@sentropic/h2a";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, constants, existsSync, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, realpathSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -797,62 +798,6 @@ function compareHeldDescriptor(fd, expectedSize, expectedSha256) {
         ? { state: "READY" }
         : { state: "ABORTED", reason: "HELD_DESCRIPTOR_HASH_MISMATCH" };
 }
-function fencePayload(fence) {
-    return JSON.stringify({
-        protocol: IDENTITY_BINDING_FENCE_PROTOCOL,
-        fenceEpoch: fence.epoch,
-        pid: process.pid,
-        acquiredAt: new Date().toISOString(),
-    });
-}
-function fenceIsHeld(fence) {
-    try {
-        const stat = lstatSync(fence.lockPath);
-        if (stat.isSymbolicLink() || !stat.isFile())
-            return false;
-        const payload = JSON.parse(readFileSync(fence.lockPath, "utf8"));
-        return isRecord(payload)
-            && payload.protocol === IDENTITY_BINDING_FENCE_PROTOCOL
-            && payload.fenceEpoch === fence.epoch
-            && payload.pid === process.pid;
-    }
-    catch {
-        return false;
-    }
-}
-function acquireCanonicalBindingFence(lockPath) {
-    const fence = { lockPath, epoch: randomUUID() };
-    let fd;
-    try {
-        fd = openSync(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-    }
-    catch (error) {
-        if (error.code === "EEXIST")
-            return undefined;
-        throw error;
-    }
-    try {
-        writeFileSync(fd, fencePayload(fence));
-        fsyncSync(fd);
-    }
-    catch (error) {
-        closeSync(fd);
-        try {
-            unlinkSync(lockPath);
-        }
-        catch {
-            // A failure to clean up an owned fence is safer than proceeding.
-        }
-        throw error;
-    }
-    closeSync(fd);
-    return fence;
-}
-function releaseCanonicalBindingFence(fence) {
-    if (!fenceIsHeld(fence))
-        throw new Error("canonical binding fence ownership was lost");
-    unlinkSync(fence.lockPath);
-}
 /**
  * Exercises the authoritative len/hash primitive over one held descriptor.
  * This staging-only verification releases its test fence before it returns and
@@ -865,42 +810,43 @@ export function verifyHeldDescriptorCas(input) {
         return { state: "ABORTED", reason: "SINGLE_WRITER_PRECONDITION_FAILED" };
     }
     const canonicalBindingPath = realpathSync(input.bindingPath);
-    const fence = acquireCanonicalBindingFence(join(dirname(canonicalBindingPath), ".lock"));
-    if (!fence)
-        return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_UNAVAILABLE" };
     try {
-        if (!fenceIsHeld(fence))
-            return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
-        const fd = openSync(canonicalBindingPath, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            if (!fstatSync(fd).isFile())
-                return { state: "ABORTED", reason: "HELD_DESCRIPTOR_HASH_MISMATCH" };
-            const preflight = compareHeldDescriptor(fd, input.expectedSize, input.expectedSha256);
-            if (preflight.state === "ABORTED")
-                return preflight;
-            // This seam runs while the canonical fence is held.  A direct append
-            // here models a bypass; the immediately-pre-rename held-fd CAS below
-            // must refuse it before any executor could rename.
-            input.afterPreflight?.();
-            if (!fenceIsHeld(fence))
+        return withIdentityFenceSync(join(dirname(canonicalBindingPath), ".lock"), (fence) => {
+            if (!fence.stillHeld())
                 return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
-            const final = compareHeldDescriptor(fd, input.expectedSize, input.expectedSha256);
-            if (final.state === "ABORTED")
-                return final;
-            if (!fenceIsHeld(fence))
-                return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
-            // Never call rename: execution remains hard-gated for this release. This
-            // staging verification releases its fence at return; an executor must not
-            // use it as a released-then-reacquired rename precondition.
-            void input.rename;
-            return { state: "STAGING_VERIFIED" };
-        }
-        finally {
-            closeSync(fd);
-        }
+            const fd = openSync(canonicalBindingPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+                if (!fstatSync(fd).isFile())
+                    return { state: "ABORTED", reason: "HELD_DESCRIPTOR_HASH_MISMATCH" };
+                const preflight = compareHeldDescriptor(fd, input.expectedSize, input.expectedSha256);
+                if (preflight.state === "ABORTED")
+                    return preflight;
+                // This seam runs while the canonical fence is held.  A direct append
+                // here models a bypass; the immediately-pre-rename held-fd CAS below
+                // must refuse it before any executor could rename.
+                input.afterPreflight?.();
+                if (!fence.stillHeld())
+                    return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
+                const final = compareHeldDescriptor(fd, input.expectedSize, input.expectedSha256);
+                if (final.state === "ABORTED")
+                    return final;
+                if (!fence.stillHeld())
+                    return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_LOST" };
+                // Never call rename: execution remains hard-gated for this release. This
+                // staging verification releases its fence at return; an executor must not
+                // use it as a released-then-reacquired rename precondition.
+                void input.rename;
+                return { state: "STAGING_VERIFIED" };
+            }
+            finally {
+                closeSync(fd);
+            }
+        }, { timeoutMs: 5000 });
     }
-    finally {
-        releaseCanonicalBindingFence(fence);
+    catch (error) {
+        if (error instanceof Error && error.name === "LockTimeoutError")
+            return { state: "ABORTED", reason: "CANONICAL_BINDING_FENCE_UNAVAILABLE" };
+        throw error;
     }
 }
 function isValidTail(tail) {