@smthrs/kernel 0.0.0-stage → 1.0.0-rc.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (267) hide show
  1. package/CHANGELOG.md +206 -0
  2. package/LICENSE +21 -0
  3. package/README.md +154 -2
  4. package/dist/cjs/CapabilitySet.d.ts +6 -0
  5. package/dist/cjs/CapabilitySet.d.ts.map +1 -0
  6. package/dist/cjs/CapabilitySet.js +19 -0
  7. package/dist/cjs/CapabilitySet.js.map +7 -0
  8. package/dist/cjs/ChildProcessEnvironment.d.ts +60 -0
  9. package/dist/cjs/ChildProcessEnvironment.d.ts.map +1 -0
  10. package/dist/cjs/ChildProcessEnvironment.js +61 -0
  11. package/dist/cjs/ChildProcessEnvironment.js.map +7 -0
  12. package/dist/cjs/ChildProcessSpawner.d.ts +100 -0
  13. package/dist/cjs/ChildProcessSpawner.d.ts.map +1 -0
  14. package/dist/cjs/ChildProcessSpawner.js +291 -0
  15. package/dist/cjs/ChildProcessSpawner.js.map +7 -0
  16. package/dist/cjs/CommandLine.d.ts +173 -0
  17. package/dist/cjs/CommandLine.d.ts.map +1 -0
  18. package/dist/cjs/CommandLine.js +54 -0
  19. package/dist/cjs/CommandLine.js.map +7 -0
  20. package/dist/cjs/ContainedSpawner.d.ts +135 -0
  21. package/dist/cjs/ContainedSpawner.d.ts.map +1 -0
  22. package/dist/cjs/ContainedSpawner.js +141 -0
  23. package/dist/cjs/ContainedSpawner.js.map +7 -0
  24. package/dist/cjs/FileSystem.d.ts +452 -0
  25. package/dist/cjs/FileSystem.d.ts.map +1 -0
  26. package/dist/cjs/FileSystem.js +890 -0
  27. package/dist/cjs/FileSystem.js.map +7 -0
  28. package/dist/cjs/FileSystemBatch.d.ts +94 -0
  29. package/dist/cjs/FileSystemBatch.d.ts.map +1 -0
  30. package/dist/cjs/FileSystemBatch.js +31 -0
  31. package/dist/cjs/FileSystemBatch.js.map +7 -0
  32. package/dist/cjs/GrantEvent.d.ts +240 -0
  33. package/dist/cjs/GrantEvent.d.ts.map +1 -0
  34. package/dist/cjs/GrantEvent.js +115 -0
  35. package/dist/cjs/GrantEvent.js.map +7 -0
  36. package/dist/cjs/GrantStore.d.ts +270 -0
  37. package/dist/cjs/GrantStore.d.ts.map +1 -0
  38. package/dist/cjs/GrantStore.js +857 -0
  39. package/dist/cjs/GrantStore.js.map +7 -0
  40. package/dist/cjs/HostError.d.ts +36 -0
  41. package/dist/cjs/HostError.d.ts.map +1 -0
  42. package/dist/cjs/HostError.js +17 -0
  43. package/dist/cjs/HostError.js.map +7 -0
  44. package/dist/cjs/HostServices.d.ts +101 -0
  45. package/dist/cjs/HostServices.d.ts.map +1 -0
  46. package/dist/cjs/HostServices.js +66 -0
  47. package/dist/cjs/HostServices.js.map +7 -0
  48. package/dist/cjs/HttpClient.d.ts +177 -0
  49. package/dist/cjs/HttpClient.d.ts.map +1 -0
  50. package/dist/cjs/HttpClient.js +217 -0
  51. package/dist/cjs/HttpClient.js.map +7 -0
  52. package/dist/cjs/Jj.d.ts +67 -0
  53. package/dist/cjs/Jj.d.ts.map +1 -0
  54. package/dist/cjs/Jj.js +118 -0
  55. package/dist/cjs/Jj.js.map +7 -0
  56. package/dist/cjs/JournalGrantStore.d.ts +65 -0
  57. package/dist/cjs/JournalGrantStore.d.ts.map +1 -0
  58. package/dist/cjs/JournalGrantStore.js +354 -0
  59. package/dist/cjs/JournalGrantStore.js.map +7 -0
  60. package/dist/cjs/Path.d.ts +37 -0
  61. package/dist/cjs/Path.d.ts.map +1 -0
  62. package/dist/cjs/Path.js +46 -0
  63. package/dist/cjs/Path.js.map +7 -0
  64. package/dist/cjs/ProcessConfinement.d.ts +55 -0
  65. package/dist/cjs/ProcessConfinement.d.ts.map +1 -0
  66. package/dist/cjs/ProcessConfinement.js +94 -0
  67. package/dist/cjs/ProcessConfinement.js.map +7 -0
  68. package/dist/cjs/ProcessLedger.d.ts +260 -0
  69. package/dist/cjs/ProcessLedger.d.ts.map +1 -0
  70. package/dist/cjs/ProcessLedger.js +190 -0
  71. package/dist/cjs/ProcessLedger.js.map +7 -0
  72. package/dist/cjs/Rooted.d.ts +53 -0
  73. package/dist/cjs/Rooted.d.ts.map +1 -0
  74. package/dist/cjs/Rooted.js +101 -0
  75. package/dist/cjs/Rooted.js.map +7 -0
  76. package/dist/cjs/Unreachable.d.ts +27 -0
  77. package/dist/cjs/Unreachable.d.ts.map +1 -0
  78. package/dist/cjs/Unreachable.js +43 -0
  79. package/dist/cjs/Unreachable.js.map +7 -0
  80. package/dist/cjs/Workspace.d.ts +62 -0
  81. package/dist/cjs/Workspace.d.ts.map +1 -0
  82. package/dist/cjs/Workspace.js +35 -0
  83. package/dist/cjs/Workspace.js.map +7 -0
  84. package/dist/cjs/index.d.ts +161 -0
  85. package/dist/cjs/index.d.ts.map +1 -0
  86. package/dist/cjs/index.js +73 -0
  87. package/dist/cjs/index.js.map +7 -0
  88. package/dist/cjs/internal/Containment.d.ts +24 -0
  89. package/dist/cjs/internal/Containment.d.ts.map +1 -0
  90. package/dist/cjs/internal/Containment.js +30 -0
  91. package/dist/cjs/internal/Containment.js.map +7 -0
  92. package/dist/cjs/internal/Pipeline.d.ts +18 -0
  93. package/dist/cjs/internal/Pipeline.d.ts.map +1 -0
  94. package/dist/cjs/internal/Pipeline.js +90 -0
  95. package/dist/cjs/internal/Pipeline.js.map +7 -0
  96. package/dist/cjs/internal/makeCapability.d.ts +16 -0
  97. package/dist/cjs/internal/makeCapability.d.ts.map +1 -0
  98. package/dist/cjs/internal/makeCapability.js +44 -0
  99. package/dist/cjs/internal/makeCapability.js.map +7 -0
  100. package/dist/cjs/package.json +1 -0
  101. package/dist/cjs/test/FileSystemBatchContract.d.ts +15 -0
  102. package/dist/cjs/test/FileSystemBatchContract.d.ts.map +1 -0
  103. package/dist/cjs/test/FileSystemBatchContract.js +76 -0
  104. package/dist/cjs/test/FileSystemBatchContract.js.map +7 -0
  105. package/dist/cjs/test/HostContract.d.ts +225 -0
  106. package/dist/cjs/test/HostContract.d.ts.map +1 -0
  107. package/dist/cjs/test/HostContract.js +489 -0
  108. package/dist/cjs/test/HostContract.js.map +7 -0
  109. package/dist/cjs/test/TestGrantStore.d.ts +31 -0
  110. package/dist/cjs/test/TestGrantStore.d.ts.map +1 -0
  111. package/dist/cjs/test/TestGrantStore.js +65 -0
  112. package/dist/cjs/test/TestGrantStore.js.map +7 -0
  113. package/dist/esm/CapabilitySet.d.ts +6 -0
  114. package/dist/esm/CapabilitySet.d.ts.map +1 -0
  115. package/dist/esm/CapabilitySet.js +6 -0
  116. package/dist/esm/CapabilitySet.js.map +1 -0
  117. package/dist/esm/ChildProcessEnvironment.d.ts +60 -0
  118. package/dist/esm/ChildProcessEnvironment.d.ts.map +1 -0
  119. package/dist/esm/ChildProcessEnvironment.js +91 -0
  120. package/dist/esm/ChildProcessEnvironment.js.map +1 -0
  121. package/dist/esm/ChildProcessSpawner.d.ts +100 -0
  122. package/dist/esm/ChildProcessSpawner.d.ts.map +1 -0
  123. package/dist/esm/ChildProcessSpawner.js +342 -0
  124. package/dist/esm/ChildProcessSpawner.js.map +1 -0
  125. package/dist/esm/CommandLine.d.ts +173 -0
  126. package/dist/esm/CommandLine.d.ts.map +1 -0
  127. package/dist/esm/CommandLine.js +195 -0
  128. package/dist/esm/CommandLine.js.map +1 -0
  129. package/dist/esm/ContainedSpawner.d.ts +135 -0
  130. package/dist/esm/ContainedSpawner.d.ts.map +1 -0
  131. package/dist/esm/ContainedSpawner.js +180 -0
  132. package/dist/esm/ContainedSpawner.js.map +1 -0
  133. package/dist/esm/FileSystem.d.ts +452 -0
  134. package/dist/esm/FileSystem.d.ts.map +1 -0
  135. package/dist/esm/FileSystem.js +989 -0
  136. package/dist/esm/FileSystem.js.map +1 -0
  137. package/dist/esm/FileSystemBatch.d.ts +94 -0
  138. package/dist/esm/FileSystemBatch.d.ts.map +1 -0
  139. package/dist/esm/FileSystemBatch.js +26 -0
  140. package/dist/esm/FileSystemBatch.js.map +1 -0
  141. package/dist/esm/GrantEvent.d.ts +240 -0
  142. package/dist/esm/GrantEvent.d.ts.map +1 -0
  143. package/dist/esm/GrantEvent.js +155 -0
  144. package/dist/esm/GrantEvent.js.map +1 -0
  145. package/dist/esm/GrantStore.d.ts +270 -0
  146. package/dist/esm/GrantStore.d.ts.map +1 -0
  147. package/dist/esm/GrantStore.js +951 -0
  148. package/dist/esm/GrantStore.js.map +1 -0
  149. package/dist/esm/HostError.d.ts +36 -0
  150. package/dist/esm/HostError.d.ts.map +1 -0
  151. package/dist/esm/HostError.js +20 -0
  152. package/dist/esm/HostError.js.map +1 -0
  153. package/dist/esm/HostServices.d.ts +101 -0
  154. package/dist/esm/HostServices.d.ts.map +1 -0
  155. package/dist/esm/HostServices.js +76 -0
  156. package/dist/esm/HostServices.js.map +1 -0
  157. package/dist/esm/HttpClient.d.ts +177 -0
  158. package/dist/esm/HttpClient.d.ts.map +1 -0
  159. package/dist/esm/HttpClient.js +299 -0
  160. package/dist/esm/HttpClient.js.map +1 -0
  161. package/dist/esm/Jj.d.ts +67 -0
  162. package/dist/esm/Jj.d.ts.map +1 -0
  163. package/dist/esm/Jj.js +111 -0
  164. package/dist/esm/Jj.js.map +1 -0
  165. package/dist/esm/JournalGrantStore.d.ts +65 -0
  166. package/dist/esm/JournalGrantStore.d.ts.map +1 -0
  167. package/dist/esm/JournalGrantStore.js +350 -0
  168. package/dist/esm/JournalGrantStore.js.map +1 -0
  169. package/dist/esm/Path.d.ts +37 -0
  170. package/dist/esm/Path.d.ts.map +1 -0
  171. package/dist/esm/Path.js +34 -0
  172. package/dist/esm/Path.js.map +1 -0
  173. package/dist/esm/ProcessConfinement.d.ts +55 -0
  174. package/dist/esm/ProcessConfinement.d.ts.map +1 -0
  175. package/dist/esm/ProcessConfinement.js +106 -0
  176. package/dist/esm/ProcessConfinement.js.map +1 -0
  177. package/dist/esm/ProcessLedger.d.ts +260 -0
  178. package/dist/esm/ProcessLedger.d.ts.map +1 -0
  179. package/dist/esm/ProcessLedger.js +283 -0
  180. package/dist/esm/ProcessLedger.js.map +1 -0
  181. package/dist/esm/Rooted.d.ts +53 -0
  182. package/dist/esm/Rooted.d.ts.map +1 -0
  183. package/dist/esm/Rooted.js +104 -0
  184. package/dist/esm/Rooted.js.map +1 -0
  185. package/dist/esm/Unreachable.d.ts +27 -0
  186. package/dist/esm/Unreachable.d.ts.map +1 -0
  187. package/dist/esm/Unreachable.js +26 -0
  188. package/dist/esm/Unreachable.js.map +1 -0
  189. package/dist/esm/Workspace.d.ts +62 -0
  190. package/dist/esm/Workspace.d.ts.map +1 -0
  191. package/dist/esm/Workspace.js +51 -0
  192. package/dist/esm/Workspace.js.map +1 -0
  193. package/dist/esm/index.d.ts +161 -0
  194. package/dist/esm/index.d.ts.map +1 -0
  195. package/dist/esm/index.js +151 -0
  196. package/dist/esm/index.js.map +1 -0
  197. package/dist/esm/internal/Containment.d.ts +24 -0
  198. package/dist/esm/internal/Containment.d.ts.map +1 -0
  199. package/dist/esm/internal/Containment.js +27 -0
  200. package/dist/esm/internal/Containment.js.map +1 -0
  201. package/dist/esm/internal/Pipeline.d.ts +18 -0
  202. package/dist/esm/internal/Pipeline.d.ts.map +1 -0
  203. package/dist/esm/internal/Pipeline.js +68 -0
  204. package/dist/esm/internal/Pipeline.js.map +1 -0
  205. package/dist/esm/internal/makeCapability.d.ts +16 -0
  206. package/dist/esm/internal/makeCapability.d.ts.map +1 -0
  207. package/dist/esm/internal/makeCapability.js +22 -0
  208. package/dist/esm/internal/makeCapability.js.map +1 -0
  209. package/dist/esm/test/FileSystemBatchContract.d.ts +15 -0
  210. package/dist/esm/test/FileSystemBatchContract.d.ts.map +1 -0
  211. package/dist/esm/test/FileSystemBatchContract.js +57 -0
  212. package/dist/esm/test/FileSystemBatchContract.js.map +1 -0
  213. package/dist/esm/test/HostContract.d.ts +225 -0
  214. package/dist/esm/test/HostContract.d.ts.map +1 -0
  215. package/dist/esm/test/HostContract.js +460 -0
  216. package/dist/esm/test/HostContract.js.map +1 -0
  217. package/dist/esm/test/TestGrantStore.d.ts +31 -0
  218. package/dist/esm/test/TestGrantStore.d.ts.map +1 -0
  219. package/dist/esm/test/TestGrantStore.js +57 -0
  220. package/dist/esm/test/TestGrantStore.js.map +1 -0
  221. package/docs/README.md +162 -0
  222. package/docs/api.md +1532 -0
  223. package/docs/concepts/decoration-in-place.md +117 -0
  224. package/docs/concepts/filesystem-batches.md +58 -0
  225. package/docs/concepts/filesystem-confinement.md +168 -0
  226. package/docs/concepts/grant-decisions.md +181 -0
  227. package/docs/concepts/process-containment.md +155 -0
  228. package/docs/contract.md +14 -0
  229. package/docs/guides/adapt-a-new-host-platform.md +148 -0
  230. package/docs/guides/answer-permission-requests.md +151 -0
  231. package/docs/guides/authorize-network-and-model-calls.md +118 -0
  232. package/docs/guides/contain-spawned-processes.md +118 -0
  233. package/docs/guides/guard-a-host-bundle.md +109 -0
  234. package/docs/guides/persist-grants-across-restarts.md +135 -0
  235. package/docs/guides/write-a-capability-policy.md +159 -0
  236. package/docs/installation.md +115 -0
  237. package/docs/quickstart.md +182 -0
  238. package/docs/testing.md +108 -0
  239. package/docs/troubleshooting.md +281 -0
  240. package/package.json +344 -3
  241. package/src/CapabilitySet.ts +6 -0
  242. package/src/ChildProcessEnvironment.ts +98 -0
  243. package/src/ChildProcessSpawner.ts +414 -0
  244. package/src/CommandLine.ts +250 -0
  245. package/src/ContainedSpawner.ts +284 -0
  246. package/src/FileSystem.ts +1655 -0
  247. package/src/FileSystemBatch.ts +90 -0
  248. package/src/GrantEvent.ts +174 -0
  249. package/src/GrantStore.ts +1345 -0
  250. package/src/HostError.ts +37 -0
  251. package/src/HostServices.ts +133 -0
  252. package/src/HttpClient.ts +406 -0
  253. package/src/Jj.ts +159 -0
  254. package/src/JournalGrantStore.ts +461 -0
  255. package/src/Path.ts +47 -0
  256. package/src/ProcessConfinement.ts +156 -0
  257. package/src/ProcessLedger.ts +423 -0
  258. package/src/Rooted.ts +128 -0
  259. package/src/Unreachable.ts +30 -0
  260. package/src/Workspace.ts +65 -0
  261. package/src/index.ts +181 -0
  262. package/src/internal/Containment.ts +37 -0
  263. package/src/internal/Pipeline.ts +85 -0
  264. package/src/internal/makeCapability.ts +26 -0
  265. package/src/test/FileSystemBatchContract.ts +59 -0
  266. package/src/test/HostContract.ts +785 -0
  267. package/src/test/TestGrantStore.ts +73 -0
package/dist/esm/GrantStore.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"GrantStore.js","sourceRoot":"","sources":["../../src/GrantStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,UAAU,IAAI,eAAe,EAC7B,iBAAiB,EAEjB,MAAM,EACN,OAAO,EACP,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,QAAQ,EACR,MAAM,EACP,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,QAAQ,EACR,eAAe,EAEf,gBAAgB,EAEhB,kBAAkB,EAClB,IAAI,EACL,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAc,SAAS,EAAE,MAAM,QAAQ,CAAA;AACvG,OAAO,EAAE,MAAM,EAAsB,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACjG,OAAO,EAAE,WAAW,EAAE,aAAa,EAAmB,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AACnH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAqD1C;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAA0B,OAAO,CAAC,IAAI,CAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAA;AAqBD;;;;;GAKG;AACH,MAAM,OAAO,UAAW,SAAQ,OAAO,CAAC,OAAO,EAAuB,CAAC,2BAA2B,CAAC;CAAG;AAkDtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAA;AACjC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAC1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAA;AAC3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAA;AAC3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,IAAI,CAAA;AAC7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,GAAG,IAAI,CAAA;AAC3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAC1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAA;AAC1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAA;AAEhE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAW,EAAE;IAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACxC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;YACrD,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,OAAe,EAAmB,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAA;AAElH,MAAM,eAAe,GAAG,CACtB,KAAQ,EACR,MAAwB,EACrB,EAAE;IACL,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,UAAsB,EAAc,EAAE,CAChE,eAAe,CACb,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,EACjF,CAAC,QAAQ,EAAE,UAAU,CAAC,CACvB,CAAA;AAEH,MAAM,eAAe,GAAG,CAAC,OAA0B,EAAqB,EAAE,CACxE,eAAe,CACb,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,EAC7E,CAAC,QAAQ,EAAE,UAAU,CAAC,CACvB,CAAA;AAEH,MAAM,YAAY,GAAG,CAAC,IAAU,EAAQ,EAAE,CACxC,eAAe,CACb,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EACzE,CAAC,QAAQ,EAAE,SAAS,CAAC,CACtB,CAAA;AAEH,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,KAAc,EAAmB,EAAE,CACxE,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,aAAa,CAAC,CAAA;AAE1E,MAAM,eAAe,GAAG,CAAI,IAAY,EAAE,QAAiB,EAAqC,EAAE,CAChG,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;CAC/C,CAAC,CAAA;AAIJ,MAAM,gBAAgB,GAAG,CAAC,KAAwC,EAAkC,EAAE;IACpG,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAA;IAEpC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAa,EAAQ,EAAE;QACpD,IAAI,KAAK,GAAG,oBAAoB;YAAE,MAAM,OAAO,CAAC,0BAA0B,oBAAoB,EAAE,CAAC,CAAA;QACjG,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,OAAO,CAAC,uCAAuC,CAAC,CAAA;YACnF,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;gBAAE,MAAM,OAAO,CAAC,mCAAmC,CAAC,CAAA;YAC5E,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB;gBAAE,MAAM,OAAO,CAAC,oBAAoB,oBAAoB,QAAQ,CAAC,CAAA;YACxG,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAC5F,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAA;QACxE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACjB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,WAAW,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAA;gBAC3D,MAAM,QAAQ,GAAgB,EAAE,CAAA;gBAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;oBACrD,OAAO,IAAI,CAAC,CAAA;oBACZ,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;wBACrC,MAAM,OAAO,CAAC,oBAAoB,sBAAsB,UAAU,CAAC,CAAA;oBACrE,CAAC;oBACD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;oBAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;wBACzD,MAAM,OAAO,CAAC,oCAAoC,CAAC,CAAA;oBACrD,CAAC;oBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;gBACnD,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAChC,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;YAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACzD,MAAM,OAAO,CAAC,wCAAwC,CAAC,CAAA;YACzD,CAAC;YACD,MAAM,QAAQ,GAAyB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,UAAU,CAAC,UAAU;oBAAE,SAAQ;gBACpC,OAAO,IAAI,CAAC,CAAA;gBACZ,IAAI,OAAO,GAAG,sBAAsB,EAAE,CAAC;oBACrC,MAAM,OAAO,CAAC,oBAAoB,sBAAsB,UAAU,CAAC,CAAA;gBACrE,CAAC;gBACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC;oBACnD,MAAM,OAAO,CAAC,sDAAsD,CAAC,CAAA;gBACvE,CAAC;gBACD,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;oBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YACxF,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;IACH,CAAC,CAAA;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjF,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAC9D,MAAM,OAAO,CAAC,oBAAoB,oBAAoB,QAAQ,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,QAA0C,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CAAC,KAAc,EAA+B,EAAE,CACpE,KAAK,KAAK,SAAS;IACnB,CAAC,OAAO,KAAK,KAAK,QAAQ;QACxB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,qBAAqB;QACrC,YAAY,CAAC,KAAK,CAAC;QACnB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;AAE1B,MAAM,eAAe,GAAG,CACtB,KAA2B,EAC3B,kBAAsC,EACtC,aAAqB,EAKH,EAAE,CACpB,eAAe,CAAC,gBAAgB,EAAE,GAAG,EAAE;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC9E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACpD,MAAM,OAAO,CAAC,mBAAmB,uBAAuB,UAAU,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC1D,0EAA0E;IAC1E,2EAA2E;IAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,UAAU,EAAE,kBAAkB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAc,EAAE,QAAQ,EAAE,CAAA;IAClF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAA;IAClC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,iCAAiC,CAAC,CAAA;IAC7E,IAAI,kBAAkB,KAAK,SAAS;QAAE,MAAM,OAAO,CAAC,iDAAiD,CAAC,CAAA;IACtG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,OAAO,CAAC,6CAA6C,CAAC,CAAA;IAClG,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB;QAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACjF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,KAAK,CAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YAC7D,MAAM,OAAO,CAAC,YAAY,KAAK,qCAAqC,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;AAC1D,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,YAAY,GAAG,CAAC,UAAsB,EAAqB,EAAE,CACjE,IAAI,iBAAiB,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;CAC9B,CAAC,CAAA;AAEJ,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAE3G,MAAM,YAAY,GAAG,CAAC,KAAa,EAAuB,EAAE,CAC1D,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,MAAM,CAAA;AAEnF,MAAM,eAAe,GAAG,CAAC,KAAa,EAAiC,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,YAAY,CAAA;AAEnH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAA0C,EACR,EAAE;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAA;IACvD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAA;AAClG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CACvB,UAAkB,EAClB,KAA2B,EAC3B,QAA0C,EAClC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAE7G;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,UAAkB,EAClB,KAA2B,EAC3B,QAA0C,EAClC,EAAE,CAAC,UAAU,UAAU,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAA;AAElF,MAAM,qBAAqB,GAAG,MAAM,CAAC,mBAAmB,CACtD,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM;IACzB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;CACzF,CAAC,CAAC,EACH,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAC9B,CAAA;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAU,EAAE;IAC3D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAC1G,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1F,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IACrD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IACtG,OAAO,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3D,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,OAA0B,EAC1B,UAAsB,EACtB,IAAgB,EAChB,aAAqB,EACZ,EAAE;IACX,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;QACtF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,iBAAiB,CAAC;QAC7C,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK;KACvD,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;AAClF,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,OAA0B,EAC1B,aAAqB,EACZ,EAAE;IACX,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,iBAAiB,CAAC;QAC7C,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK;KACvD,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,KAA2B,EAI3B,EAAE;IACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY;QAAE,MAAM,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAA;IACtF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAA2C,CAAA;QAC5D,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,IAAI,OAAO,CAAC,MAAM,CAAA;YACvB,IAAI,KAAK,GAAG,YAAY;gBAAE,MAAM,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAA;QACjF,CAAC;QACD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;SAC7F,CAAA;IACH,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,CAAE,KAA6B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3E,UAAU,EAAE,EAAE;KACf,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAClB,UAAuB,EAAE,EACyC,EAAE,CACpE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAA;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAClC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,OAAO,CAAA;IACrC,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;IACpF,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;QACrC,IAAI,MAAM,CAAC,MAAM,GAAG,YAAY;YAAE,MAAM,OAAO,CAAC,mBAAmB,YAAY,UAAU,CAAC,CAAA;QAC1F,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,MAAM,IAAI,KAAK;YACb,CAAC,CAAC;gBACA,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAC3B,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAC3D,cAAc,CACf;aACF;YACD,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAC3D,CAAA;IACH,CAAC,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAClG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAA;IAC1C,MAAM,aAAa,GAAgB,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,eAAe,CAAA;IAChC,MAAM,eAAe,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,oBAAoB,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAA;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YAC3D,MAAM,OAAO,CAAC,6BAA6B,YAAY,UAAU,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACvF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/D,MAAM,OAAO,CAAC,sBAAsB,KAAK,4BAA4B,CAAC,CAAA;YACxE,CAAC;YACD,OAAO,SAAS,CAAA;QAClB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS,UAAU,CAAC,CAAA;IACpD,IAAI,aAAa,GAAG,CAAC,CAAA;IACrB,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEzC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAwC,EAAE;QAC/E,wEAAwE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAA;QAC9D,OAAO,KAAK,GAAG,iBAAiB;YAC9B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,iBAAiB,QAAQ,CAAC,CAAC;YACxE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBACrC,QAAQ,EAAE,oBAAoB;gBAC9B,MAAM,EAAE,GAAG,EAAE,CACX,MAAM,CAAC,IAAI,CACT,IAAI,eAAe,CAAC;oBAClB,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,gCAAgC,oBAAoB,IAAI;iBAClE,CAAC,CACH;aACJ,CAAC,CAAA;IACN,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3D,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAChF,CAAA;IACD,IAAI,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,iBAAiB,qCAAqC,CAAC,CAAC,CAAA;IAC/G,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACjD,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAChF,CAAA;IACD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,UAAU,qCAAqC,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,wEAAwE;IACxE,MAAM,aAAa,GAAG,CACpB,QAA4D,EACnB,EAAE,CAC3C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;QACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACzE,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAA;QAC5E,MAAM,QAAQ,GAAG,KAAK,KAAK,YAAY;YACrC,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;QACxF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAClC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,kEAAkE;YAClE,mEAAmE;YACnE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;;gBAC1D,QAAQ,CAAC,KAAK,EAAE,CAAA;QACvB,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAClG,IACE,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;YACpF,QAAQ,CAAC,MAAM,GAAG,YAAY,EAClC,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,YAAY,UAAU,CAAC,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK,CAAC,CAAC,YAAY,CACjB,IAAI,aAAa,CAAC;gBAChB,SAAS,EAAE,gCAAgC;gBAC3C,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,QAAQ;gBACR,KAAK;aACN,CAAC,CACH,CAAA;YACD,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACxE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IAEJ,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;QACpF,KAAK,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,UAAsB,EAAsC,EAAE,CAAC;QAC/E,eAAe;QACf,aAAa;QACb,QAAQ;aACL,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC;QAC1B,eAAe;KAChB,CAAA;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAC9B,QAAQ,CAAC,UAAU,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,GAAG,IAAI,CAAA;QACb,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACrC,OAAO,CAAC,KAAK,EAAE,CAAA;QACf,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CACnB,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CACR,QAAQ,CAAC,IAAI,CACX,KAAK,CAAC,QAAQ,EACd,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,oBAAoB,CAAC,CACzD,EACH,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAA;IACH,CAAC,CAAC,CACH,CACF,CAAA;IAED,MAAM,eAAe,GAAG,CACtB,UAAsB,EACtB,IAAgB,EAChB,IAA6B,EAC7B,OAAsB,EACwB,EAAE,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,OAAO,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,2BAA2B,sBAAsB,UAAU,CAAC,CAAC,CAAA;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,aAAa,EAAE,EAAE,CAAA;QACjD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAA0B,CAAA;QAC/D,MAAM,KAAK,GAAiB;YAC1B,SAAS;YACT,UAAU;YACV,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,QAAQ;SACT,CAAA;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAC7B,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;IAEJ,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,cAAc,aAAa,EAAE,EAAE,CAAC,CAAA;IAElF,MAAM,KAAK,GAAqB,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CACtF,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;YAC1C,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;SAC7B,CAAC,CAAC,CAAA;QACH,6DAA6D;QAC7D,oEAAoE;QACpE,sEAAsE;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;YAC1E,CAAC;YACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAA;YAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC,CAAA;YAC/F,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YAC3E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC,CAAA;YAChG,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,CAAA;YAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAAA;gBAChD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,kBAAkB,CAAC;oBACjB,SAAS;oBACT,KAAK;oBACL,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC,CACH,CAAA;YACH,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,eAAe,CAC3B,OAAO,CAAC,UAAU,EAClB,IAAI,EACJ,OAAO,CAAC,IAAI,EACZ,OAAO,CACR,CAAA;QACH,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAC9C,CACF,CAAA;QACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAM;QACR,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,QAAQ,CACb,QAAQ,CAAC,UAAU,CACjB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACjC,CAAC,CAAC,CACH,CACF,CACF,CAAA;IACH,CAAC,CAAC,CACH,CACF,CAAA;IAED,MAAM,cAAc,GAAwB,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC9D,MAAM,CAAC,OAAO,CACZ,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,EACtB,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE;QACrB,IACE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC;YACxC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,OAAO,EAClE,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,IAAI,CACrD,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC3B,CAAC,CAAC,CACH,CACF,CAAA;IACH,CAAC,EACD,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CACtB,CAAA;IAED,sEAAsE;IACtE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoD,CAAA;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,aAAa,GAAG,CAAC,CAAA;IAerB,MAAM,SAAS,GAAG,CAChB,SAAiB,EACjB,UAAsB,EACtB,eAA8C,EACA,EAAE,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,6DAA6D;YAC7D,6DAA6D;YAC7D,4DAA4D;YAC5D,mDAAmD;YACnD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CAAC;gBAClB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,0BAA0B;aACpC,CAAC,CACH,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpC,kEAAkE;QAClE,sEAAsE;QACtE,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,eAAe,EAAE,GAAG,EAAE;YAC3D,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACxD,IAAI,eAAe,KAAK,SAAS;oBAAE,OAAO,eAAe,CAAC,eAAe,CAAC,CAAA;gBAC1E,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;gBACvD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,MAAM,OAAO,CACX,uGAAuG,CACxG,CAAA;gBACH,CAAC;gBACD,OAAO,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACvC,CAAC;YACD,OAAO,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACxB,OAAO;oBACL,UAAU;oBACV,KAAK;oBACL,KAAK,EAAE,IAAI,SAAS,CAAC;wBACnB,SAAS,EAAE,4BAA4B;wBACvC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;wBACnD,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO;wBACP,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;qBACjB,CAAC;iBACH,CAAA;YACH,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CAAC;wBAClB,IAAI,EAAE,oBAAoB;wBAC1B,OAAO,EAAE,kCAAkC;qBAC5C,CAAC,CACH,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC/E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,CAAA;gBACrF,CAAC;gBACD,IACE,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;oBACpF,aAAa;oBACf,YAAY,EACd,CAAC;oBACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACxB,aAAa,IAAI,CAAC,CAAA;gBAClB,OAAO;oBACL,UAAU;oBACV,KAAK;oBACL,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC1D,KAAK,EAAE,IAAI,QAAQ,CAAC;wBAClB,SAAS,EAAE,2BAA2B;wBACtC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,UAAU;wBACV,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO;wBACP,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;wBAC7B,KAAK,EAAE,KAAK;wBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;qBACjB,CAAC;iBACH,CAAA;YACH,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;oBAC/E,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,CAAA;gBACrF,CAAC;gBACD,IACE,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;oBACpF,aAAa;oBACf,YAAY,EACd,CAAC;oBACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAC,CAAA;gBAC5E,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACxB,aAAa,IAAI,CAAC,CAAA;gBAClB,OAAO;oBACL,UAAU;oBACV,KAAK;oBACL,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;oBAC1D,KAAK,EAAE,IAAI,eAAe,CAAC;wBACzB,SAAS,EAAE,kCAAkC;wBAC7C,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;wBACnD,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO;wBACP,KAAK,EAAE,YAAY;wBACnB,IAAI,EAAE,KAAK,CAAC,IAAI;qBACjB,CAAC;iBACH,CAAA;YACH,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;gBACxB,OAAO;oBACL,UAAU;oBACV,KAAK;oBACL,KAAK,EAAE,IAAI,WAAW,CAAC;wBACrB,SAAS,EAAE,8BAA8B;wBACzC,SAAS;wBACT,KAAK,EAAE,KAAK,IAAI,EAAE;wBAClB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;wBACnD,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,OAAO;wBACP,KAAK,EAAE,MAAM;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;qBACjB,CAAC;iBACH,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,OAAqB,EAAwC,EAAE,CACvG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC3B,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,YAAY;YAAE,aAAa,IAAI,CAAC,CAAA;QAC3F,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpC,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAA;gBAC/E,CAAC;gBACD,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;gBAClD,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzB,OAAM;YACR,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAA;gBAC/E,CAAC;gBACD,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAClB,KAAK,CAAC,QAAQ,EACd,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAChE,CAAA;gBACD,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;gBACzB,OAAM;YACR,CAAC;YACD,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,8DAA8D;gBAC9D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,8DAA8D;gBAC9D,eAAe;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBACrE,KAAK,CAAC,CAAC,cAAc,CAAA;gBACrB,OAAM;YACR,CAAC;YACD,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBAClC,KAAK,CAAC,CAAC,cAAc,CAAA;gBACrB,OAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM,KAAK,GAAqB,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAC5D,SAAS,EACT,UAAU,EACV,eAAe,EACf,EAAE,CACF,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE,CACrC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAA;QAC7F,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,+BAA+B;QAC/B,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAClB,QAAQ,CAAC,UAAU,CACjB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC3B,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,YAAY;gBAAE,aAAa,IAAI,CAAC,CAAA;QAC7F,CAAC,CAAC,CACH,CACF,CACF,CAAA;QACD,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAC,CACH,CACF,CAAA;IAED,MAAM,IAAI,GAAoB,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,CAC9D,QAAQ,CAAC,UAAU,CACjB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;IACf,mEAAmE;IACnE,4DAA4D;IAC5D,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CACtB,OAAO,CAAC,MAAM,EAAE,EAChB,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,EAAkB,EAAE,CACxD,MAAM,CAAC,MAAM,CAAC;QACZ,SAAS;QACT,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,IAAI;QACJ,IAAI;KACL,CAAC,CACL,CAAC,CACH,CACF,CACF,EAAE,CAAA;IAcH,MAAM,YAAY,GAAG,CACnB,QAA4D,EACT,EAAE,CACrD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;QACpC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACzE,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAA;QACxE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACxC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;QAClF,IACE,eAAe,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM;YACpF,aAAa,GAAG,QAAQ,CAAC,MAAM,GAAG,YAAY,EAClD,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,YAAY,UAAU,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,YAAY,UAAU,CAAC,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAyB,CAAA;QAChE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;QACnC,aAAa,IAAI,QAAQ,CAAC,MAAM,CAAA;QAChC,OAAO;YACL,IAAI,EAAE,OAAgB;YACtB,SAAS;YACT,KAAK;YACL,QAAQ;YACR,UAAU;YACV,KAAK,EAAE,IAAI,aAAa,CAAC;gBACvB,SAAS,EAAE,gCAAgC;gBAC3C,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,QAAQ;gBACR,KAAK;aACN,CAAC;SACH,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,MAAM,gBAAgB,GAAG,CACvB,OAA+D,EACzB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAClC,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAA;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAC1E,CAAC;QACD,iEAAiE;QACjE,sEAAsE;QACtE,gDAAgD;QAChD,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACvC,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAA;QACpF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;QACxE,CAAC;QACD,KAAK,CAAC,CAAC,cAAc,CAAA;IACvB,CAAC,CAAC,CAAA;IAEJ,MAAM,aAAa,GAA6B,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAC9F,MAAM,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,CACZ,QAA4D,EACtB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAA;YAClE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,KAAK,SAAS;oBACZ,OAAM;gBACR,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,4DAA4D;oBAC5D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,0DAA0D;oBAC1D,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC;wBAC5B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAC5D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAC5B,CACF,CAAA;gBACH,CAAC;gBACD,KAAK,OAAO,CAAC,CAAC,CAAC;oBACb,yDAAyD;oBACzD,8DAA8D;oBAC9D,4DAA4D;oBAC5D,KAAK,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvB,QAAQ,CAAC,UAAU,CACjB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAClB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;wBAClC,aAAa,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAA;wBACxC,KAAK,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;oBACtD,CAAC,CAAC,CACH,CACF,CACF,CAAA;oBACD,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACxD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,EACjE,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CACzE,CAAA;oBACD,OAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QACJ,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;YACzE,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAM;YAC1C,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACxB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA;IAED,MAAM,MAAM,GAAsB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACxE,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,OAAO,CAAA;QAC9B,MAAM,SAAS,GAAG,CAAC,KAA0B,EAAE,EAAE,CAC/C,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CACnG,CAAA;QACH,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACpB,SAAS,CAAC,eAAe,CAAC;gBAC1B,SAAS,CAAC,aAAa,CAAC;gBACxB,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzF,SAAS,CAAC,eAAe,CAAC;aAC3B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;SACxC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAC,CAAA;IACH,OAAO,UAAU,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;AACrE,CAAC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CACnB,UAAuB,EAAE,EAC4B,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAEjG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAY,UAAU,CAAC,EAAE,CAAC;IAC7C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,MAAM,CAAC,MAAM,CAAC;QACZ,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAE,CAAC,GAAG,EAAE,aAAa,CAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClF,MAAM,CAAC,MAAM,CAAC;gBACZ,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC7G,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;aACtD,CAAC,CACH,CAAC,CAAC,CAAC;KACL,CAAC,CACH,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;IACvD,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;IACvD,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE;IAC9D,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;CACxE,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAA4B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAA","sourcesContent":["/**\n * In-memory capability grants with an attended Deferred request lifecycle.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md` and\n * `docs/specs/Concepts/Trust Granularity.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport {\n type Capability,\n Capability as CapabilityValue,\n CapabilityPattern,\n type EffectTier,\n format,\n matches,\n maxResourceLength,\n parsePattern,\n patternFromCapability,\n subsumes,\n tierOf\n} from \"@smthrs/capability/Capability\"\nimport {\n evaluate,\n GrantStoreError,\n type PermissionDenied,\n permissionDenied,\n type PermissionRequired,\n permissionRequired,\n Rule\n} from \"@smthrs/capability/Permission\"\nimport { digestSync } from \"@smthrs/crypto/Sha256\"\nimport { Cause, Context, Deferred, Effect, Layer, Option, Schema, type Scope, Semaphore } from \"effect\"\nimport { allows, type CapabilitySet, current, fromPatterns, intersect } from \"./CapabilitySet.ts\"\nimport { DeniedGrant, EnvelopeGrant, type GrantEvent, OnceGrant, RememberedGrant, RunGrant } from \"./GrantEvent.ts\"\nimport { Workspace } from \"./Workspace.ts\"\n\n/**\n * A capability request waiting for an attended reply.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface PendingRequest {\n readonly requestId: string\n readonly capability: Capability\n readonly tier: EffectTier\n readonly meta: Record<string, unknown>\n}\n\n/**\n * A resolution supplied by an attended permission surface.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Resolution = \"once\" | \"run\" | \"remembered\" | \"deny\"\n\n/**\n * Scope and plan identity for a bulk envelope approval.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface EnvelopeGrantOptions {\n readonly planDigest: string\n readonly patterns: ReadonlyArray<CapabilityPattern>\n readonly scope?: \"run\" | \"remembered\" | undefined\n}\n\n/** A policy rule and the authority captured when it was granted.\n * @category models\n * @since 1.0.0-rc.1\n */\nexport interface PolicyRule {\n readonly rule: Rule\n readonly ceiling: Pick<CapabilitySet, \"groups\">\n}\n\n/** Atomic ordered policy snapshot, bounded by the calling fiber.\n * @category models\n * @since 1.0.0-rc.1\n */\nexport interface Policy {\n readonly groups: ReadonlyArray<ReadonlyArray<PolicyRule>>\n readonly ceiling: CapabilitySet\n}\n\n/** A conservative snapshot for services that expose no durable authority.\n * @category constructors\n * @since 1.0.0-rc.1\n */\nexport const emptyPolicy: Effect.Effect<Policy> = current.pipe(\n Effect.map((ceiling) => Object.freeze({ groups: Object.freeze([]), ceiling }))\n)\n\n/** Operations exposed by the grant store.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface Service {\n readonly policy: Effect.Effect<Policy, GrantStoreError>\n readonly check: (\n capability: Capability,\n meta?: Record<string, unknown>\n ) => Effect.Effect<void, PermissionRequired | PermissionDenied | GrantStoreError>\n readonly reply: (\n requestId: string,\n resolution: Resolution,\n pattern?: CapabilityPattern\n ) => Effect.Effect<void, GrantStoreError>\n readonly list: Effect.Effect<ReadonlyArray<PendingRequest>>\n readonly grantEnvelope: (options: EnvelopeGrantOptions) => Effect.Effect<void, GrantStoreError>\n}\n\n/**\n * Service key for permission decisions and attended grant requests.\n *\n * @category services\n * @since 1.0.0-rc.0\n */\nexport class GrantStore extends Context.Service<GrantStore, Service>()(\"@smthrs/kernel/GrantStore\") {}\n\n/**\n * A hook that durably records a grant decision before it becomes active.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Persist = (event: GrantEvent) => Effect.Effect<void, GrantStoreError>\n\n/**\n * Configuration for an in-memory grant store.\n *\n * A nested `rules` value is also accepted by the journal adapter: its first\n * ruleset is configured policy and subsequent rulesets are replayed remembered\n * grants.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface MakeOptions {\n readonly attended?: boolean | undefined\n readonly rules?: ReadonlyArray<Rule> | ReadonlyArray<ReadonlyArray<Rule>> | undefined\n /** Bare rules use the constructor ceiling; captured groups intersect it. */\n readonly runRules?:\n | ReadonlyArray<\n Rule | {\n readonly rule: Rule\n readonly ceiling: ReadonlyArray<ReadonlyArray<CapabilityPattern>>\n }\n >\n | undefined\n readonly envelope?: EnvelopeGrantOptions | undefined\n /**\n * {@link envelopeSignature} values of envelopes that are already durable —\n * typically replayed from a journal. A construction or runtime envelope\n * matching a seeded signature still activates its rules but is not\n * persisted again.\n */\n readonly envelopeSignatures?: ReadonlyArray<string> | undefined\n readonly runId?: string | undefined\n readonly planDigest?: string | undefined\n readonly persist?: Persist | undefined\n}\n\ninterface PendingEntry extends PendingRequest {\n readonly ceiling: CapabilitySet\n readonly deferred: Deferred.Deferred<void, PermissionDenied>\n}\n\n/**\n * Maximum policy rules retained by one store.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumRules = 1_024\n/**\n * Maximum predicates in one approval envelope.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumEnvelopePatterns = 256\n/**\n * Maximum permission requests parked at once.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumPendingRequests = 1_024\n/**\n * Maximum nesting depth of permission metadata.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumMetadataDepth = 16\n/**\n * Maximum members across one permission metadata graph.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumMetadataMembers = 1_024\n/**\n * Maximum encoded bytes retained for one metadata value.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumMetadataBytes = 64 * 1024\n/**\n * Maximum encoded bytes persisted for one grant event.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumEventBytes = 256 * 1024\n/**\n * Maximum milliseconds one grant journal write may take before its reply or\n * envelope admission fails with `journal_failed`. Journal writes never hold\n * the store's mutation permit, so a slow write stalls only the admission that\n * issued it.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumPersistMillis = 30_000\n/**\n * Maximum length of a run, plan, request, or signature identity.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumIdentityLength = 4_096\n/**\n * Maximum capability resource length enforced by the capability vocabulary.\n * @category limits\n * @since 1.0.0-rc.0\n */\nexport const maximumCapabilityResourceLength = maxResourceLength\n\nconst encoder = new TextEncoder()\n\nconst isWellFormed = (value: string): boolean => {\n for (let index = 0; index < value.length; index += 1) {\n const unit = value.charCodeAt(index)\n if (unit >= 0xd800 && unit <= 0xdbff) {\n const next = value.charCodeAt(index + 1)\n if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n index += 1\n } else if (unit >= 0xdc00 && unit <= 0xdfff) {\n return false\n }\n }\n return true\n}\n\nconst invalid = (message: string): GrantStoreError => new GrantStoreError({ code: \"invalid_resolution\", message })\n\nconst immutableFields = <A extends object, K extends keyof A>(\n value: A,\n fields: ReadonlyArray<K>\n): A => {\n for (const field of fields) {\n Object.defineProperty(value, field, {\n value: value[field],\n enumerable: true,\n writable: false,\n configurable: false\n })\n }\n return value\n}\n\nconst snapshotCapability = (capability: Capability): Capability =>\n immutableFields(\n new CapabilityValue({ action: capability.action, resource: capability.resource }),\n [\"action\", \"resource\"]\n )\n\nconst snapshotPattern = (pattern: CapabilityPattern): CapabilityPattern =>\n immutableFields(\n new CapabilityPattern({ action: pattern.action, resource: pattern.resource }),\n [\"action\", \"resource\"]\n )\n\nconst snapshotRule = (rule: Rule): Rule =>\n immutableFields(\n new Rule({ effect: rule.effect, pattern: snapshotPattern(rule.pattern) }),\n [\"effect\", \"pattern\"]\n )\n\nconst snapshotFailure = (what: string, cause: unknown): GrantStoreError =>\n cause instanceof GrantStoreError ? cause : invalid(`${what} is invalid`)\n\nconst attemptSnapshot = <A>(what: string, evaluate: () => A): Effect.Effect<A, GrantStoreError> =>\n Effect.try({\n try: evaluate,\n catch: (cause) => snapshotFailure(what, cause)\n })\n\ntype Json = null | boolean | number | string | ReadonlyArray<Json> | { readonly [key: string]: Json }\n\nconst metadataSnapshot = (input: Readonly<Record<string, unknown>>): Readonly<Record<string, Json>> => {\n let members = 0\n const active = new WeakSet<object>()\n\n const visit = (value: unknown, depth: number): Json => {\n if (depth > maximumMetadataDepth) throw invalid(`metadata exceeds depth ${maximumMetadataDepth}`)\n if (value === null || typeof value === \"boolean\") return value\n if (typeof value === \"number\") {\n if (!Number.isFinite(value)) throw invalid(\"metadata contains a non-finite number\")\n return value\n }\n if (typeof value === \"string\") {\n if (!isWellFormed(value)) throw invalid(\"metadata contains ill-formed text\")\n if (value.length > maximumMetadataBytes) throw invalid(`metadata exceeds ${maximumMetadataBytes} bytes`)\n return value\n }\n if (typeof value !== \"object\" || value === null) throw invalid(\"metadata must be JSON data\")\n if (active.has(value)) throw invalid(\"metadata must not contain cycles\")\n active.add(value)\n try {\n if (Array.isArray(value)) {\n const descriptors = Object.getOwnPropertyDescriptors(value)\n const snapshot: Array<Json> = []\n for (let index = 0; index < value.length; index += 1) {\n members += 1\n if (members > maximumMetadataMembers) {\n throw invalid(`metadata exceeds ${maximumMetadataMembers} members`)\n }\n const descriptor = descriptors[String(index)]\n if (descriptor === undefined || !(\"value\" in descriptor)) {\n throw invalid(\"metadata arrays must be dense data\")\n }\n snapshot.push(visit(descriptor.value, depth + 1))\n }\n return Object.freeze(snapshot)\n }\n\n const prototype = Object.getPrototypeOf(value)\n if (prototype !== Object.prototype && prototype !== null) {\n throw invalid(\"metadata objects must be plain records\")\n }\n const snapshot: Record<string, Json> = Object.create(null)\n for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {\n if (!descriptor.enumerable) continue\n members += 1\n if (members > maximumMetadataMembers) {\n throw invalid(`metadata exceeds ${maximumMetadataMembers} members`)\n }\n if (!isWellFormed(key) || !(\"value\" in descriptor)) {\n throw invalid(\"metadata members must be well-formed data properties\")\n }\n if (descriptor.value !== undefined) snapshot[key] = visit(descriptor.value, depth + 1)\n }\n return Object.freeze(snapshot)\n } finally {\n active.delete(value)\n }\n }\n\n const snapshot = visit(input, 0)\n if (Array.isArray(snapshot) || snapshot === null || typeof snapshot !== \"object\") {\n throw invalid(\"metadata must be a record\")\n }\n const encoded = JSON.stringify(snapshot)\n if (encoder.encode(encoded).byteLength > maximumMetadataBytes) {\n throw invalid(`metadata exceeds ${maximumMetadataBytes} bytes`)\n }\n return snapshot as Readonly<Record<string, Json>>\n}\n\nconst validIdentity = (value: unknown): value is string | undefined =>\n value === undefined ||\n (typeof value === \"string\" &&\n value.length > 0 &&\n value.length <= maximumIdentityLength &&\n isWellFormed(value) &&\n !value.includes(\"\\0\"))\n\nconst prepareEnvelope = (\n input: EnvelopeGrantOptions,\n expectedPlanDigest: string | undefined,\n workspaceRoot: string\n): Effect.Effect<{\n readonly planDigest: string\n readonly scope: \"run\" | \"remembered\"\n readonly patterns: ReadonlyArray<CapabilityPattern>\n}, GrantStoreError> =>\n attemptSnapshot(\"grant envelope\", () => {\n if (!Array.isArray(input.patterns)) throw invalid(\"patterns must be an array\")\n if (input.patterns.length > maximumEnvelopePatterns) {\n throw invalid(`patterns exceed ${maximumEnvelopePatterns} entries`)\n }\n const patterns = canonicalEnvelopePatterns(input.patterns)\n // An empty envelope carries no authority. It is deliberately a no-op even\n // when replayed without the plan identity that authorized a non-empty one.\n if (patterns.length === 0) {\n return { planDigest: expectedPlanDigest ?? \"\", scope: \"run\" as const, patterns }\n }\n const scope = input.scope ?? \"run\"\n if (!isEnvelopeScope(scope)) throw invalid(\"scope must be run or remembered\")\n if (expectedPlanDigest === undefined) throw invalid(\"grant envelope requires a configured planDigest\")\n if (!validIdentity(input.planDigest)) throw invalid(\"planDigest is empty, malformed, or too long\")\n if (input.planDigest !== expectedPlanDigest) throw invalid(\"planDigest mismatch\")\n for (let index = 0; index < patterns.length; index += 1) {\n if (!isValidEnvelopePattern(patterns[index]!, workspaceRoot)) {\n throw invalid(`patterns[${index}] is outside the workspace envelope`)\n }\n }\n return { planDigest: input.planDigest, scope, patterns }\n })\n\n/**\n * Records the displayed capability for once/deny audit events, which are never\n * installed or replayed as authority.\n */\nconst exactPattern = (capability: Capability): CapabilityPattern =>\n new CapabilityPattern({\n action: capability.action,\n resource: capability.resource\n })\n\nconst hasResourceWildcard = (resource: string): boolean => resource.includes(\"*\") || resource.includes(\"?\")\n\nconst isResolution = (value: string): value is Resolution =>\n value === \"once\" || value === \"run\" || value === \"remembered\" || value === \"deny\"\n\nconst isEnvelopeScope = (value: string): value is \"run\" | \"remembered\" => value === \"run\" || value === \"remembered\"\n\n/**\n * Canonicalizes an envelope pattern list: duplicate predicates collapse to\n * their first occurrence and the survivors sort by their formatted identity.\n *\n * An envelope is a *set* of predicates, so two envelopes listing the same\n * predicates in a different order or multiplicity are the same approval. Every\n * envelope is canonicalized before it is persisted or compared, which makes\n * envelope idempotency structural rather than dependent on caller discipline.\n *\n * The ordering is the code-unit sort of `format(pattern)` — the one renderer\n * for capability identity. RFC 8785 canonical JSON (`@smthrs/canonical`)\n * was considered and does not fit: it canonicalizes object keys but preserves\n * array order as semantic, and the ordering that matters here is exactly the\n * pattern-array order.\n *\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const canonicalEnvelopePatterns = (\n patterns: ReadonlyArray<CapabilityPattern>\n): ReadonlyArray<CapabilityPattern> => {\n const byIdentity = new Map<string, CapabilityPattern>()\n for (const input of patterns) {\n const pattern = snapshotPattern(input)\n const identity = format(pattern)\n if (!byIdentity.has(identity)) {\n byIdentity.set(identity, pattern)\n }\n }\n return Object.freeze([...byIdentity.keys()].sort().map((identity) => byIdentity.get(identity)!))\n}\n\nconst envelopeEncoding = (\n planDigest: string,\n scope: \"run\" | \"remembered\",\n patterns: ReadonlyArray<CapabilityPattern>\n): string => JSON.stringify({ planDigest, scope, patterns: canonicalEnvelopePatterns(patterns).map(format) })\n\n/**\n * Computes the canonical identity of an envelope approval.\n *\n * Two envelopes with the same plan digest, scope, and predicate set produce\n * the same signature regardless of pattern order or repetition. The signature\n * is how the store, and journal replay above it, recognise an envelope that\n * is already durable. It is `sha256:` followed by 64 lowercase hex digits.\n *\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const envelopeSignature = (\n planDigest: string,\n scope: \"run\" | \"remembered\",\n patterns: ReadonlyArray<CapabilityPattern>\n): string => `sha256:${digestSync(envelopeEncoding(planDigest, scope, patterns))}`\n\nconst decodeLegacySignature = Schema.decodeUnknownResult(\n Schema.fromJsonString(Schema.Struct({\n planDigest: Schema.String,\n scope: Schema.Literals([\"run\", \"remembered\"]),\n patterns: Schema.Array(Schema.String).check(Schema.isMaxLength(maximumEnvelopePatterns))\n })),\n { onExcessProperty: \"error\" }\n)\n\n// v1 events contain predicates, not signatures, and replay hashes them afresh.\n// Also accept canonical full-JSON identities supplied by older seed callers.\nconst normalizeEnvelopeSignature = (value: string): string => {\n if (!value.startsWith(\"{\")) return value\n if (value.length > maximumEventBytes || encoder.encode(value).byteLength > maximumEventBytes) return value\n const decoded = decodeLegacySignature(value)\n if (decoded._tag === \"Failure\" || !validIdentity(decoded.success.planDigest)) return value\n const { planDigest, scope, patterns } = decoded.success\n const parsed = Option.all(patterns.map(parsePattern))\n if (Option.isNone(parsed) || envelopeEncoding(planDigest, scope, parsed.value) !== value) return value\n return envelopeSignature(planDigest, scope, parsed.value)\n}\n\n/**\n * Checks that a request-scoped grant cannot authorize a different action or a\n * more dangerous effect tier than the request displayed to the user. A\n * wildcard-bearing pattern identical to the resource is ambiguous because the\n * grammar has no escape, so its wildcard reading would silently widen access.\n *\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const isValidGrantPattern = (\n pattern: CapabilityPattern,\n capability: Capability,\n tier: EffectTier,\n workspaceRoot: string\n): boolean => {\n if (pattern.action !== capability.action || !matches(pattern, capability)) {\n return false\n }\n if (hasResourceWildcard(pattern.resource) && pattern.resource === capability.resource) {\n return false\n }\n if (tierOf(capability, { workspaceRoot }) !== tier) {\n return false\n }\n if (capability.action !== \"fs:write\") {\n return true\n }\n if (tier === \"irreversible\") {\n return !hasResourceWildcard(pattern.resource)\n }\n const workspacePattern = new CapabilityPattern({\n action: \"fs:write\",\n resource: `${workspaceRoot.replace(/[\\\\/]+$/, \"\")}/**`\n })\n return pattern.resource === workspaceRoot || subsumes(workspacePattern, pattern)\n}\n\n/**\n * Checks that a bulk envelope pattern preserves exact action and filesystem\n * effect-tier boundaries.\n *\n * @category validation\n * @since 1.0.0-rc.0\n */\nexport const isValidEnvelopePattern = (\n pattern: CapabilityPattern,\n workspaceRoot: string\n): boolean => {\n if (pattern.action.includes(\"*\")) {\n return false\n }\n if (pattern.action !== \"fs:write\" || !hasResourceWildcard(pattern.resource)) {\n return true\n }\n const workspacePattern = new CapabilityPattern({\n action: \"fs:write\",\n resource: `${workspaceRoot.replace(/[\\\\/]+$/, \"\")}/**`\n })\n return subsumes(workspacePattern, pattern)\n}\n\nconst normalizeRules = (\n rules: MakeOptions[\"rules\"]\n): {\n readonly configured: ReadonlyArray<Rule>\n readonly remembered: ReadonlyArray<Rule>\n} => {\n if (rules === undefined || rules.length === 0 || rules[0] === undefined) {\n return { configured: [], remembered: [] }\n }\n if (rules.length > maximumRules) throw invalid(`rules exceed ${maximumRules} entries`)\n if (Array.isArray(rules[0])) {\n const rulesets = rules as ReadonlyArray<ReadonlyArray<Rule>>\n let count = 0\n for (const ruleset of rulesets) {\n count += ruleset.length\n if (count > maximumRules) throw invalid(`rules exceed ${maximumRules} entries`)\n }\n return {\n configured: Object.freeze(rulesets[0]!.map(snapshotRule)),\n remembered: Object.freeze(rulesets.slice(1).flatMap((ruleset) => ruleset.map(snapshotRule)))\n }\n }\n return {\n configured: Object.freeze((rules as ReadonlyArray<Rule>).map(snapshotRule)),\n remembered: []\n }\n}\n\n/**\n * Builds an in-memory grant store.\n *\n * Attended stores suspend an asking fiber on a request-local `Deferred`.\n * Unattended stores fail immediately with `PermissionRequired`. The returned\n * service is scoped: closing its scope rejects every waiter and clears the\n * pending map.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const make = (\n options: MakeOptions = {}\n): Effect.Effect<Service, GrantStoreError, Scope.Scope | Workspace> =>\n Effect.gen(function*() {\n const attended = options.attended ?? true\n const runId = options.runId\n const planDigest = options.planDigest\n if (!validIdentity(runId)) {\n return yield* Effect.fail(invalid(\"runId is empty, malformed, or too long\"))\n }\n if (!validIdentity(planDigest)) {\n return yield* Effect.fail(invalid(\"planDigest is empty, malformed, or too long\"))\n }\n const workspace = yield* Workspace\n const initialCeiling = yield* current\n const workspaceRoot = workspace.root\n const initial = yield* attemptSnapshot(\"rules\", () => normalizeRules(options.rules))\n const initialRunRules = yield* attemptSnapshot(\"runRules\", () => {\n const values = options.runRules ?? []\n if (values.length > maximumRules) throw invalid(`runRules exceed ${maximumRules} entries`)\n return values.map((value) =>\n \"rule\" in value\n ? {\n rule: snapshotRule(value.rule),\n ceiling: value.ceiling.reduce(\n (ceiling, group) => intersect(ceiling, fromPatterns(group)),\n initialCeiling\n )\n }\n : { rule: snapshotRule(value), ceiling: initialCeiling }\n )\n })\n if (initial.configured.length + initial.remembered.length + initialRunRules.length > maximumRules) {\n return yield* Effect.fail(invalid(`rules exceed ${maximumRules} entries`))\n }\n const configuredRules = initial.configured\n const envelopeRules: Array<Rule> = []\n const runRules = initialRunRules\n const rememberedRules = [...initial.remembered]\n const pending = new Map<string, PendingEntry>()\n const persist = options.persist ?? (() => Effect.void)\n const signatures = yield* attemptSnapshot(\"envelopeSignatures\", () => {\n const values = options.envelopeSignatures ?? []\n if (!Array.isArray(values) || values.length > maximumRules) {\n throw invalid(`envelopeSignatures exceed ${maximumRules} entries`)\n }\n return values.map((value, index) => {\n const signature = typeof value === \"string\" ? normalizeEnvelopeSignature(value) : value\n if (typeof signature !== \"string\" || !validIdentity(signature)) {\n throw invalid(`envelopeSignatures[${index}] is malformed or too long`)\n }\n return signature\n })\n })\n const grantedEnvelopes = new Set<string>(signatures)\n let nextRequestId = 1\n let closed = false\n const mutation = yield* Semaphore.make(1)\n\n const persistEvent = (event: GrantEvent): Effect.Effect<void, GrantStoreError> => {\n // Every event is constructed below exclusively from validated primitive\n // identities and immutable capability snapshots, so encoding cannot\n // observe caller objects or invoke a caller-defined `toJSON` hook.\n const bytes = encoder.encode(JSON.stringify(event)).byteLength\n return bytes > maximumEventBytes\n ? Effect.fail(invalid(`grant event exceeds ${maximumEventBytes} bytes`))\n : Effect.timeoutOrElse(persist(event), {\n duration: maximumPersistMillis,\n orElse: () =>\n Effect.fail(\n new GrantStoreError({\n code: \"journal_failed\",\n message: `grant journal write exceeded ${maximumPersistMillis}ms`\n })\n )\n })\n }\n\n const invalidRemembered = rememberedRules.findIndex((rule) =>\n rule.effect === \"allow\" && !isValidEnvelopePattern(rule.pattern, workspaceRoot)\n )\n if (invalidRemembered !== -1) {\n return yield* Effect.fail(invalid(`rememberedRules[${invalidRemembered}] is outside the workspace envelope`))\n }\n const invalidRun = runRules.findIndex(({ rule }) =>\n rule.effect === \"allow\" && !isValidEnvelopePattern(rule.pattern, workspaceRoot)\n )\n if (invalidRun !== -1) {\n return yield* Effect.fail(invalid(`runRules[${invalidRun}] is outside the workspace envelope`))\n }\n\n // Construction envelopes validate capacity before persistence or\n // activation. A seeded construction envelope may already have rules\n // installed by replay. Runtime admission is two-phase in grantEnvelope.\n const admitEnvelope = (\n envelope: Effect.Success<ReturnType<typeof prepareEnvelope>>\n ): Effect.Effect<boolean, GrantStoreError> =>\n Effect.gen(function*() {\n const { patterns, scope } = envelope\n if (patterns.length === 0) return false\n const signature = envelopeSignature(envelope.planDigest, scope, patterns)\n const durable = grantedEnvelopes.has(signature)\n const destination = scope === \"remembered\" ? rememberedRules : envelopeRules\n const replayed = scope === \"remembered\"\n ? rememberedRules\n : runRules.filter(({ ceiling }) => ceiling === initialCeiling).map(({ rule }) => rule)\n const existing = new Set<string>()\n for (const rule of replayed) {\n // Supplied rules can mask earlier grants. Only the trailing allow\n // rules (including journal replay) can replace a fresh activation.\n if (rule.effect === \"allow\") existing.add(format(rule.pattern))\n else existing.clear()\n }\n const incoming = durable ? patterns.filter((pattern) => !existing.has(format(pattern))) : patterns\n if (\n configuredRules.length + envelopeRules.length + runRules.length + rememberedRules.length +\n incoming.length > maximumRules\n ) {\n return yield* Effect.fail(invalid(`rules exceed ${maximumRules} entries`))\n }\n if (!durable && grantedEnvelopes.size >= maximumRules) {\n return yield* Effect.fail(invalid(`grant envelopes exceed ${maximumRules} entries`))\n }\n if (!durable) {\n yield* persistEvent(\n new EnvelopeGrant({\n eventType: \"flows.kernel.grant.envelope.v1\",\n runId: runId ?? \"\",\n planDigest: envelope.planDigest,\n patterns,\n scope\n })\n )\n grantedEnvelopes.add(signature)\n }\n for (const pattern of incoming) {\n destination.push(snapshotRule(new Rule({ effect: \"allow\", pattern })))\n }\n return true\n })\n\n if (options.envelope !== undefined) {\n const envelope = yield* prepareEnvelope(options.envelope, planDigest, workspaceRoot)\n yield* admitEnvelope(envelope)\n }\n\n const rulesets = (capability: Capability): ReadonlyArray<ReadonlyArray<Rule>> => [\n configuredRules,\n envelopeRules,\n runRules\n .filter(({ ceiling }) => allows(ceiling, capability))\n .map(({ rule }) => rule),\n rememberedRules\n ]\n\n yield* Effect.addFinalizer(() =>\n mutation.withPermit(\n Effect.gen(function*() {\n closed = true\n const entries = [...pending.values()]\n pending.clear()\n yield* Effect.forEach(\n entries,\n (entry) =>\n Deferred.fail(\n entry.deferred,\n permissionDenied(entry.capability, \"grant store closed\")\n ),\n { discard: true }\n )\n })\n )\n )\n\n const allocateRequest = (\n capability: Capability,\n tier: EffectTier,\n meta: Record<string, unknown>,\n ceiling: CapabilitySet\n ): Effect.Effect<PendingEntry, GrantStoreError> =>\n Effect.gen(function*() {\n if (pending.size >= maximumPendingRequests) {\n return yield* Effect.fail(invalid(`pending requests exceed ${maximumPendingRequests} entries`))\n }\n const requestId = `permission-${nextRequestId++}`\n const deferred = yield* Deferred.make<void, PermissionDenied>()\n const entry: PendingEntry = {\n requestId,\n capability,\n tier,\n meta,\n ceiling,\n deferred\n }\n pending.set(requestId, entry)\n return entry\n })\n\n const nextUnattendedRequestId = Effect.sync(() => `permission-${nextRequestId++}`)\n\n const check: Service[\"check\"] = Effect.fn(\"GrantStore.check\")((capability, meta = {}) =>\n Effect.uninterruptibleMask((restore) =>\n Effect.gen(function*() {\n const request = yield* attemptSnapshot(\"permission request\", () => ({\n capability: snapshotCapability(capability),\n meta: metadataSnapshot(meta)\n }))\n // The permit guards only in-memory state, so acquiring it is\n // interruptible: a cancelled caller is released instead of queueing\n // uninterruptibly. The critical section itself stays uninterruptible.\n const entry = yield* restore(mutation.take(1)).pipe(\n Effect.andThen(\n Effect.gen(function*() {\n if (closed) {\n return yield* Effect.fail(new GrantStoreError({ code: \"store_closed\" }))\n }\n const ceiling = yield* current\n if (!allows(ceiling, request.capability)) {\n return yield* Effect.fail(permissionDenied(request.capability, \"outside capability ceiling\"))\n }\n\n const decision = evaluate(rulesets(request.capability), request.capability)\n if (decision === \"allow\") {\n return undefined\n }\n if (decision === \"deny\") {\n return yield* Effect.fail(permissionDenied(request.capability, \"denied by permission policy\"))\n }\n\n const tier = tierOf(request.capability, { workspaceRoot })\n if (!attended) {\n const requestId = yield* nextUnattendedRequestId\n return yield* Effect.fail(\n permissionRequired({\n requestId,\n runId,\n capability: request.capability,\n tier,\n meta: request.meta\n })\n )\n }\n\n return yield* allocateRequest(\n request.capability,\n tier,\n request.meta,\n ceiling\n )\n }).pipe(Effect.ensuring(mutation.release(1)))\n )\n )\n if (entry === undefined) {\n return\n }\n return yield* restore(Deferred.await(entry.deferred)).pipe(\n Effect.ensuring(\n mutation.withPermit(\n Effect.sync(() => {\n pending.delete(entry.requestId)\n })\n )\n )\n )\n })\n )\n )\n\n const resolveCovered: Effect.Effect<void> = Effect.suspend(() =>\n Effect.forEach(\n [...pending.entries()],\n ([requestId, entry]) => {\n if (\n !allows(entry.ceiling, entry.capability) ||\n evaluate(rulesets(entry.capability), entry.capability) !== \"allow\"\n ) {\n return Effect.void\n }\n return Deferred.succeed(entry.deferred, undefined).pipe(\n Effect.andThen(\n Effect.sync(() => {\n pending.delete(requestId)\n })\n )\n )\n },\n { discard: true }\n ).pipe(Effect.asVoid)\n )\n\n // Requests and envelopes with a journal write in flight. The mutation\n // permit guards only in-memory state: a decision is planned under the\n // permit, persisted without it, then activated under it again.\n const resolving = new Set<string>()\n const granting = new Map<string, Deferred.Deferred<void, GrantStoreError>>()\n // Planned rules occupy capacity until their write fails or they activate.\n // Replies and envelopes share this count, guarded by the mutation permit.\n let reservedRules = 0\n\n type PlannedReply =\n | {\n readonly resolution: \"once\" | \"deny\"\n readonly entry: PendingEntry\n readonly event: GrantEvent\n }\n | {\n readonly resolution: \"run\" | \"remembered\"\n readonly entry: PendingEntry\n readonly rule: Rule\n readonly event: GrantEvent\n }\n\n const planReply = (\n requestId: string,\n resolution: Resolution,\n suppliedPattern: CapabilityPattern | undefined\n ): Effect.Effect<PlannedReply, GrantStoreError> =>\n Effect.gen(function*() {\n if (closed) {\n return yield* Effect.fail(new GrantStoreError({ code: \"store_closed\" }))\n }\n if (!isResolution(resolution)) {\n // A runtime-invalid resolution must fail the reply, not fall\n // through the switch below: silently succeeding would strand\n // the request's waiter on its Deferred forever. The request\n // stays pending so the caller can still answer it.\n return yield* Effect.fail(\n new GrantStoreError({\n code: \"invalid_resolution\",\n message: \"unknown grant resolution\"\n })\n )\n }\n const entry = pending.get(requestId)\n // A request whose decision is already being persisted is decided:\n // the losing reply fails fast instead of queueing behind the journal.\n if (entry === undefined || resolving.has(requestId)) {\n return yield* Effect.fail(new GrantStoreError({ code: \"request_not_found\" }))\n }\n const pattern = yield* attemptSnapshot(\"grant pattern\", () => {\n if (resolution === \"run\" || resolution === \"remembered\") {\n if (suppliedPattern !== undefined) return snapshotPattern(suppliedPattern)\n const derived = patternFromCapability(entry.capability)\n if (Option.isNone(derived)) {\n throw invalid(\n \"the requested resource contains glob metacharacters; supply an explicit grant pattern or resolve once\"\n )\n }\n return snapshotPattern(derived.value)\n }\n return snapshotPattern(exactPattern(entry.capability))\n })\n\n switch (resolution) {\n case \"once\": {\n resolving.add(requestId)\n return {\n resolution,\n entry,\n event: new OnceGrant({\n eventType: \"flows.kernel.grant.once.v1\",\n requestId,\n runId: runId ?? \"\",\n ...(planDigest === undefined ? {} : { planDigest }),\n capability: entry.capability,\n pattern,\n scope: \"once\",\n tier: entry.tier\n })\n }\n }\n case \"run\": {\n if (planDigest === undefined) {\n return yield* Effect.fail(\n new GrantStoreError({\n code: \"invalid_resolution\",\n message: \"run grants require a plan digest\"\n })\n )\n }\n if (!isValidGrantPattern(pattern, entry.capability, entry.tier, workspaceRoot)) {\n return yield* Effect.fail(invalid(\"grant pattern exceeds the requested authority\"))\n }\n if (\n configuredRules.length + envelopeRules.length + runRules.length + rememberedRules.length +\n reservedRules >=\n maximumRules\n ) {\n return yield* Effect.fail(invalid(`rules exceed ${maximumRules} entries`))\n }\n resolving.add(requestId)\n reservedRules += 1\n return {\n resolution,\n entry,\n rule: snapshotRule(new Rule({ effect: \"allow\", pattern })),\n event: new RunGrant({\n eventType: \"flows.kernel.grant.run.v2\",\n requestId,\n runId: runId ?? \"\",\n planDigest,\n capability: entry.capability,\n pattern,\n ceiling: entry.ceiling.groups,\n scope: \"run\",\n tier: entry.tier\n })\n }\n }\n case \"remembered\": {\n if (!isValidGrantPattern(pattern, entry.capability, entry.tier, workspaceRoot)) {\n return yield* Effect.fail(invalid(\"grant pattern exceeds the requested authority\"))\n }\n if (\n configuredRules.length + envelopeRules.length + runRules.length + rememberedRules.length +\n reservedRules >=\n maximumRules\n ) {\n return yield* Effect.fail(invalid(`rules exceed ${maximumRules} entries`))\n }\n resolving.add(requestId)\n reservedRules += 1\n return {\n resolution,\n entry,\n rule: snapshotRule(new Rule({ effect: \"allow\", pattern })),\n event: new RememberedGrant({\n eventType: \"flows.kernel.grant.remembered.v1\",\n requestId,\n runId: runId ?? \"\",\n ...(planDigest === undefined ? {} : { planDigest }),\n capability: entry.capability,\n pattern,\n scope: \"remembered\",\n tier: entry.tier\n })\n }\n }\n case \"deny\": {\n resolving.add(requestId)\n return {\n resolution,\n entry,\n event: new DeniedGrant({\n eventType: \"flows.kernel.grant.denied.v1\",\n requestId,\n runId: runId ?? \"\",\n ...(planDigest === undefined ? {} : { planDigest }),\n capability: entry.capability,\n pattern,\n scope: \"once\",\n tier: entry.tier\n })\n }\n }\n }\n })\n\n const activateReply = (requestId: string, planned: PlannedReply): Effect.Effect<void, GrantStoreError> =>\n Effect.gen(function*() {\n resolving.delete(requestId)\n if (planned.resolution === \"run\" || planned.resolution === \"remembered\") reservedRules -= 1\n if (closed) {\n return yield* Effect.fail(new GrantStoreError({ code: \"store_closed\" }))\n }\n const entry = pending.get(requestId)\n switch (planned.resolution) {\n case \"once\": {\n if (entry === undefined) {\n return yield* Effect.fail(new GrantStoreError({ code: \"request_not_found\" }))\n }\n yield* Deferred.succeed(entry.deferred, undefined)\n pending.delete(requestId)\n return\n }\n case \"deny\": {\n if (entry === undefined) {\n return yield* Effect.fail(new GrantStoreError({ code: \"request_not_found\" }))\n }\n yield* Deferred.fail(\n entry.deferred,\n permissionDenied(entry.capability, \"permission request denied\")\n )\n pending.delete(requestId)\n return\n }\n case \"run\": {\n // The decision is already durable, so the rule activates even\n // when the request's own waiter left while the journal wrote:\n // replay installs it on the next open and the live store must\n // not diverge from the journal. Capacity was validated before\n // persistence.\n runRules.push({ rule: planned.rule, ceiling: planned.entry.ceiling })\n yield* resolveCovered\n return\n }\n case \"remembered\": {\n rememberedRules.push(planned.rule)\n yield* resolveCovered\n return\n }\n }\n })\n\n const reply: Service[\"reply\"] = Effect.fn(\"GrantStore.reply\")((\n requestId,\n resolution,\n suppliedPattern\n ) =>\n Effect.uninterruptibleMask((restore) =>\n Effect.gen(function*() {\n const planned = yield* mutation.withPermit(planReply(requestId, resolution, suppliedPattern))\n // Journal IO never holds the permit: only this reply waits on it,\n // interruptibly, so the write deadline can fire and a cancelled\n // reply is released. A failed write clears the in-flight mark so\n // the request stays retryable.\n yield* restore(persistEvent(planned.event)).pipe(\n Effect.onError(() =>\n mutation.withPermit(\n Effect.sync(() => {\n resolving.delete(requestId)\n if (planned.resolution === \"run\" || planned.resolution === \"remembered\") reservedRules -= 1\n })\n )\n )\n )\n yield* mutation.withPermit(activateReply(requestId, planned))\n })\n )\n )\n\n const list: Service[\"list\"] = Effect.fn(\"GrantStore.list\")(() =>\n mutation.withPermit(\n Effect.sync(() =>\n // Every entry's meta is already the frozen snapshot taken at check\n // time; list copies the array and re-wraps identity without\n // re-walking or re-serializing the metadata graph.\n Object.freeze(Array.from(\n pending.values(),\n ({ requestId, capability, tier, meta }): PendingRequest =>\n Object.freeze({\n requestId,\n capability: snapshotCapability(capability),\n tier,\n meta\n })\n ))\n )\n )\n )()\n\n type EnvelopeAdmission =\n | { readonly _tag: \"Durable\" }\n | { readonly _tag: \"Wait\"; readonly completion: Deferred.Deferred<void, GrantStoreError> }\n | {\n readonly _tag: \"Fresh\"\n readonly signature: string\n readonly scope: \"run\" | \"remembered\"\n readonly patterns: ReadonlyArray<CapabilityPattern>\n readonly completion: Deferred.Deferred<void, GrantStoreError>\n readonly event: GrantEvent\n }\n\n const planEnvelope = (\n envelope: Effect.Success<ReturnType<typeof prepareEnvelope>>\n ): Effect.Effect<EnvelopeAdmission, GrantStoreError> =>\n Effect.gen(function*() {\n if (closed) {\n return yield* Effect.fail(new GrantStoreError({ code: \"store_closed\" }))\n }\n const { patterns, scope } = envelope\n const signature = envelopeSignature(envelope.planDigest, scope, patterns)\n if (grantedEnvelopes.has(signature)) return { _tag: \"Durable\" as const }\n // A concurrent admission of the same envelope is already persisting;\n // wait for its outcome rather than writing a duplicate record.\n const inFlight = granting.get(signature)\n if (inFlight !== undefined) return { _tag: \"Wait\" as const, completion: inFlight }\n if (\n configuredRules.length + envelopeRules.length + runRules.length + rememberedRules.length +\n reservedRules + patterns.length > maximumRules\n ) {\n return yield* Effect.fail(invalid(`rules exceed ${maximumRules} entries`))\n }\n if (grantedEnvelopes.size + granting.size >= maximumRules) {\n return yield* Effect.fail(invalid(`grant envelopes exceed ${maximumRules} entries`))\n }\n const completion = yield* Deferred.make<void, GrantStoreError>()\n granting.set(signature, completion)\n reservedRules += patterns.length\n return {\n _tag: \"Fresh\" as const,\n signature,\n scope,\n patterns,\n completion,\n event: new EnvelopeGrant({\n eventType: \"flows.kernel.grant.envelope.v1\",\n runId: runId ?? \"\",\n planDigest: envelope.planDigest,\n patterns,\n scope\n })\n }\n })\n\n const activateEnvelope = (\n planned: Extract<EnvelopeAdmission, { readonly _tag: \"Fresh\" }>\n ): Effect.Effect<void, GrantStoreError> =>\n Effect.gen(function*() {\n granting.delete(planned.signature)\n reservedRules -= planned.patterns.length\n if (closed) {\n return yield* Effect.fail(new GrantStoreError({ code: \"store_closed\" }))\n }\n // The decision is already durable, so its rules activate without\n // re-checking capacity: replay installs them on the next open and the\n // live store must not diverge from the journal.\n grantedEnvelopes.add(planned.signature)\n const destination = planned.scope === \"remembered\" ? rememberedRules : envelopeRules\n for (const pattern of planned.patterns) {\n destination.push(snapshotRule(new Rule({ effect: \"allow\", pattern })))\n }\n yield* resolveCovered\n })\n\n const grantEnvelope: Service[\"grantEnvelope\"] = Effect.fn(\"GrantStore.grantEnvelope\")((input) =>\n Effect.uninterruptibleMask((restore) => {\n const admit = (\n prepared: Effect.Success<ReturnType<typeof prepareEnvelope>>\n ): Effect.Effect<void, GrantStoreError> =>\n Effect.gen(function*() {\n const planned = yield* mutation.withPermit(planEnvelope(prepared))\n switch (planned._tag) {\n case \"Durable\":\n return\n case \"Wait\": {\n // The identical envelope is mid-flight elsewhere; adopt its\n // outcome. A failed write fails here too: re-planning would\n // turn one journal outage into an unbounded loop of writes.\n // An interrupted first admission decided nothing and can be\n // retried. Check this caller's cancellation before re-planning\n // so an interrupted duplicate cannot loop under the mask.\n return yield* restore(Deferred.await(planned.completion)).pipe(\n Effect.catchCause((cause) =>\n Cause.hasInterruptsOnly(cause)\n ? restore(Effect.void).pipe(Effect.andThen(admit(prepared)))\n : Effect.failCause(cause)\n )\n )\n }\n case \"Fresh\": {\n // Journal IO never holds the permit: only this admission\n // waits on it, interruptibly, so the write deadline can fire.\n // Concurrent duplicates are released with the same outcome.\n yield* restore(persistEvent(planned.event)).pipe(\n Effect.onError((cause) =>\n mutation.withPermit(\n Effect.gen(function*() {\n granting.delete(planned.signature)\n reservedRules -= planned.patterns.length\n yield* Deferred.failCause(planned.completion, cause)\n })\n )\n )\n )\n yield* mutation.withPermit(activateEnvelope(planned)).pipe(\n Effect.tap(() => Deferred.succeed(planned.completion, undefined)),\n Effect.onError((cause) => Deferred.failCause(planned.completion, cause))\n )\n return\n }\n }\n })\n return Effect.gen(function*() {\n const prepared = yield* prepareEnvelope(input, planDigest, workspaceRoot)\n if (prepared.patterns.length === 0) return\n yield* admit(prepared)\n })\n })\n )\n\n const policy: Service[\"policy\"] = mutation.withPermit(Effect.gen(function*() {\n if (closed) return yield* Effect.fail(new GrantStoreError({ code: \"store_closed\" }))\n const ceiling = yield* current\n const unbounded = (rules: ReadonlyArray<Rule>) =>\n rules.map((rule) =>\n Object.freeze({ rule: snapshotRule(rule), ceiling: Object.freeze({ groups: Object.freeze([]) }) })\n )\n return Object.freeze({\n ceiling,\n groups: Object.freeze([\n unbounded(configuredRules),\n unbounded(envelopeRules),\n runRules.map(({ rule, ceiling }) => Object.freeze({ rule: snapshotRule(rule), ceiling })),\n unbounded(rememberedRules)\n ].map((group) => Object.freeze(group)))\n })\n }))\n return GrantStore.of({ check, reply, list, grantEnvelope, policy })\n })\n\n/**\n * Provides a scoped in-memory grant store.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer = (\n options: MakeOptions = {}\n): Layer.Layer<GrantStore, GrantStoreError, Workspace> => Layer.effect(GrantStore, make(options))\n\n/**\n * An allow-all grant store.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const makeNoop: Service = GrantStore.of({\n policy: current.pipe(Effect.map((ceiling) =>\n Object.freeze({\n ceiling,\n groups: Object.freeze([Object.freeze(([\"*\", \"net:private\"] as const).map((action) =>\n Object.freeze({\n rule: snapshotRule(new Rule({ effect: \"allow\", pattern: new CapabilityPattern({ action, resource: \"**\" }) })),\n ceiling: Object.freeze({ groups: Object.freeze([]) })\n })\n ))])\n })\n )),\n check: Effect.fn(\"GrantStore.check\")(() => Effect.void),\n reply: Effect.fn(\"GrantStore.reply\")(() => Effect.void),\n list: Effect.fn(\"GrantStore.list\")(() => Effect.succeed([]))(),\n grantEnvelope: Effect.fn(\"GrantStore.grantEnvelope\")(() => Effect.void)\n})\n\n/**\n * Provides the allow-all grant store.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layerNoop: Layer.Layer<GrantStore> = Layer.succeed(GrantStore)(makeNoop)\n"]}
package/dist/esm/HostError.d.ts ADDED
@@ -0,0 +1,36 @@
1
+ /**
2
+ * @since 1.0.0-rc.0
3
+ *
4
+ * Host domain errors, shaped after `effect/PlatformError`.
5
+ *
6
+ * Effect's platform errors carry normalized operation data — a stable `_tag`
7
+ * reason, the `module` and `method` that failed, a human `description`, and the
8
+ * original `cause` — and are constructed through small helpers rather than
9
+ * `new`. We mirror that exactly, with two deliberate deviations:
10
+ *
11
+ * - the normalized reason lives in a `code` field rather than a nested
12
+ * `reason._tag`, because ours is a small closed set per service; and
13
+ * - the classes are `Schema.TaggedError`, not `Data.TaggedError`, because
14
+ * Host failures cross the durability boundary and must round-trip.
15
+ *
16
+ * Codes are a STABLE public contract: callers branch on them, step keys digest
17
+ * them, UIs map them to remediation. Never repurpose a code — add one.
18
+ */
19
+ import type { JjError } from "@smthrs/jj";
20
+ /**
21
+ * Every failure the Host surface is allowed to surface.
22
+ *
23
+ * `JjError` is declared by `@smthrs/jj` beside its contract; it is named here
24
+ * because that service is still part of the closed Host surface
25
+ * (`HostServices.ts`). This is a type union, not a re-export — import the
26
+ * error itself from its package.
27
+ *
28
+ * Running a command is absent on purpose: process execution is Effect's
29
+ * `ChildProcessSpawner`, so it fails with `PlatformError` like the rest of
30
+ * `effect`'s platform surface.
31
+ *
32
+ * @category models
33
+ * @since 1.0.0-rc.0
34
+ */
35
+ export type HostError = JjError;
36
+ //# sourceMappingURL=HostError.d.ts.map
package/dist/esm/HostError.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"HostError.d.ts","sourceRoot":"","sources":["../../src/HostError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,CAAA"}
package/dist/esm/HostError.js ADDED
@@ -0,0 +1,20 @@
1
+ /**
2
+ * @since 1.0.0-rc.0
3
+ *
4
+ * Host domain errors, shaped after `effect/PlatformError`.
5
+ *
6
+ * Effect's platform errors carry normalized operation data — a stable `_tag`
7
+ * reason, the `module` and `method` that failed, a human `description`, and the
8
+ * original `cause` — and are constructed through small helpers rather than
9
+ * `new`. We mirror that exactly, with two deliberate deviations:
10
+ *
11
+ * - the normalized reason lives in a `code` field rather than a nested
12
+ * `reason._tag`, because ours is a small closed set per service; and
13
+ * - the classes are `Schema.TaggedError`, not `Data.TaggedError`, because
14
+ * Host failures cross the durability boundary and must round-trip.
15
+ *
16
+ * Codes are a STABLE public contract: callers branch on them, step keys digest
17
+ * them, UIs map them to remediation. Never repurpose a code — add one.
18
+ */
19
+ export {};
20
+ //# sourceMappingURL=HostError.js.map
package/dist/esm/HostError.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"HostError.js","sourceRoot":"","sources":["../../src/HostError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG","sourcesContent":["/**\n * @since 1.0.0-rc.0\n *\n * Host domain errors, shaped after `effect/PlatformError`.\n *\n * Effect's platform errors carry normalized operation data — a stable `_tag`\n * reason, the `module` and `method` that failed, a human `description`, and the\n * original `cause` — and are constructed through small helpers rather than\n * `new`. We mirror that exactly, with two deliberate deviations:\n *\n * - the normalized reason lives in a `code` field rather than a nested\n * `reason._tag`, because ours is a small closed set per service; and\n * - the classes are `Schema.TaggedError`, not `Data.TaggedError`, because\n * Host failures cross the durability boundary and must round-trip.\n *\n * Codes are a STABLE public contract: callers branch on them, step keys digest\n * them, UIs map them to remediation. Never repurpose a code — add one.\n */\n\nimport type { JjError } from \"@smthrs/jj\"\n\n/**\n * Every failure the Host surface is allowed to surface.\n *\n * `JjError` is declared by `@smthrs/jj` beside its contract; it is named here\n * because that service is still part of the closed Host surface\n * (`HostServices.ts`). This is a type union, not a re-export — import the\n * error itself from its package.\n *\n * Running a command is absent on purpose: process execution is Effect's\n * `ChildProcessSpawner`, so it fails with `PlatformError` like the rest of\n * `effect`'s platform surface.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type HostError = JjError\n"]}
package/dist/esm/HostServices.d.ts ADDED
@@ -0,0 +1,101 @@
1
+ /**
2
+ * The closed Host service list.
3
+ *
4
+ * One list, one set of tags. The kernel decorates each slot **in place** — a
5
+ * middleware `Layer` over the very tag the platform adapter provides — so
6
+ * there is no second, "protected" tag to keep in slot-order sync with this
7
+ * one, and no cast to force a guarded implementation onto a narrower error
8
+ * contract.
9
+ *
10
+ * Governing design:
11
+ * `docs/specs/Concepts/Permission Kernel.md`,
12
+ * `docs/specs/Concepts/Trust Granularity.md`, and
13
+ * `docs/specs/Concepts/Host Adapters.md`.
14
+ *
15
+ * @since 1.0.0-rc.0
16
+ */
17
+ import { Jj as JjPort } from "@smthrs/jj";
18
+ import { FileSystem as EffectFileSystem, Layer, Path as EffectPath } from "effect";
19
+ import { HttpClient as HttpClientPort } from "effect/unstable/http/HttpClient";
20
+ import { ChildProcessSpawner as ChildProcessSpawnerPort } from "effect/unstable/process/ChildProcessSpawner";
21
+ /**
22
+ * The CLOSED LIST of platform ports the kernel protects.
23
+ * Optional filesystem batches belong to the existing FileSystem slot. The
24
+ * decorator grants each member separately and exposes no additional tag or
25
+ * unguarded executor to consumers; host slot identities remain unchanged.
26
+ *
27
+ * Everything that touches the outside world enters Smithers through exactly one
28
+ * of these tags — there is no ambient `node:fs`, no bare `spawn`, no global
29
+ * `Date.now()`. Two things depend on that closure:
30
+ *
31
+ * 1. The capability kernel wraps precisely this list. A service that is not
32
+ * here cannot be attenuated, denied, or audited, so it must not exist.
33
+ * 2. Step keys digest this list as their `layers` component. Which platform
34
+ * implementations were in scope is part of a step's identity, so a replay
35
+ * under different layers is a different step rather than a silent lie.
36
+ *
37
+ * Each slot's guarded implementation replaces the raw one under the same tag,
38
+ * so a consumer that never heard of the kernel still cannot bypass it. Where
39
+ * Effect owns the tag (`FileSystem`, `Path`, `ChildProcessSpawner`,
40
+ * `HttpClient`) the error channel stays Effect's own — `PlatformError`, or
41
+ * `HttpClientError` for the network — and permission failures are projected
42
+ * into it by `Permission.toPlatformError` and `HttpClient.toHttpClientError`;
43
+ * where Smithers owns the service (`Jj`) the interface names the kernel's
44
+ * failures directly.
45
+ *
46
+ * `Path` is intentionally retained as an explicit decision: it checks nothing
47
+ * and resolves relative paths against `Workspace.root`.
48
+ * Network access is Effect's own `HttpClient`: there is no Smithers transport
49
+ * port beneath it, because a raw port would be a second way to reach the
50
+ * network whose contract never mentions permission.
51
+ *
52
+ * `Clock` and `Random` are Effect core built-ins: already port-shaped, already
53
+ * swappable via `Effect.provideService`, and never decorated here — a `Clock`
54
+ * or a `Random` carries no host authority to guard, so they are not ours to
55
+ * define. `ChildProcessSpawner` is the same story one layer out: process spawning is
56
+ * `effect/unstable/process`, and the slot holds Effect's tag rather than a
57
+ * Smithers wrapper around it.
58
+ *
59
+ * @category models
60
+ * @since 1.0.0-rc.0
61
+ */
62
+ export type HostService = EffectFileSystem.FileSystem | EffectPath.Path | ChildProcessSpawnerPort | JjPort | HttpClientPort;
63
+ /**
64
+ * The Host tags consumed by the kernel at runtime, decorated in place by
65
+ * {@link layer}, and digested by the step-key planner.
66
+ *
67
+ * @category models
68
+ * @since 1.0.0-rc.0
69
+ */
70
+ export declare const HostServiceTags: readonly [import("effect/Context").Service<EffectFileSystem.FileSystem, EffectFileSystem.FileSystem>, import("effect/Context").Service<EffectPath.Path, EffectPath.Path>, typeof ChildProcessSpawnerPort, import("effect/Context").Service<JjPort, JjPort>, import("effect/Context").Service<HttpClientPort, HttpClientPort>];
71
+ /**
72
+ * Stable slot identifiers shared by host composition, kernel attenuation, and
73
+ * step-layer resolution.
74
+ *
75
+ * Each id is the tag key of its slot's service — Effect's own key for the
76
+ * services Effect ships, the defining module's path for ours. The ids are
77
+ * digested into step keys, so a rename invalidates every cached step naming
78
+ * the slot; rename only when the service itself changes, as when `Shell` was
79
+ * replaced by Effect's `ChildProcessSpawner`.
80
+ *
81
+ * @category models
82
+ * @since 1.0.0-rc.0
83
+ */
84
+ export declare const HostServiceIds: readonly ["effect/FileSystem", "effect/Path", "effect/process/ChildProcessSpawner", "@smthrs/jj/Jj", "effect/HttpClient"];
85
+ /**
86
+ * Builds the full protected Host surface over a host platform bundle and a
87
+ * `GrantStore`. `Workspace` remains a requirement so the exact same root
88
+ * service can be supplied to both the grant store and filesystem decorators.
89
+ *
90
+ * Every member both requires and provides its own slot's tag: provide this
91
+ * layer over a raw platform bundle and the guarded implementation shadows the
92
+ * raw one for everything downstream. There is no exception and no second tag
93
+ * list — `HttpClient` decorates Effect's network tag exactly the way
94
+ * `FileSystem` decorates Effect's filesystem tag. The host supplies
95
+ * `ProcessConfinement` for approved processes; absence refuses spawning.
96
+ *
97
+ * @category layers
98
+ * @since 1.0.0-rc.0
99
+ */
100
+ export declare const layer: Layer.Layer<ChildProcessSpawnerPort | EffectPath.Path | EffectFileSystem.FileSystem | JjPort | HttpClientPort, import("effect/PlatformError").PlatformError, ChildProcessSpawnerPort | import("./Workspace.ts").Workspace | import("./GrantStore.ts").GrantStore | EffectPath.Path | EffectFileSystem.FileSystem | JjPort | HttpClientPort>;
101
+ //# sourceMappingURL=HostServices.d.ts.map
package/dist/esm/HostServices.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"HostServices.d.ts","sourceRoot":"","sources":["../../src/HostServices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAClF,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,IAAI,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AAO5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,MAAM,WAAW,GACnB,gBAAgB,CAAC,UAAU,GAC3B,UAAU,CAAC,IAAI,GACf,uBAAuB,GACvB,MAAM,GACN,cAAc,CAAA;AAElB;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,+TAMlB,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,2HAMjB,CAAA;AAEV;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,KAAK,6UAMjB,CAAA"}
package/dist/esm/HostServices.js ADDED
@@ -0,0 +1,76 @@
1
+ /**
2
+ * The closed Host service list.
3
+ *
4
+ * One list, one set of tags. The kernel decorates each slot **in place** — a
5
+ * middleware `Layer` over the very tag the platform adapter provides — so
6
+ * there is no second, "protected" tag to keep in slot-order sync with this
7
+ * one, and no cast to force a guarded implementation onto a narrower error
8
+ * contract.
9
+ *
10
+ * Governing design:
11
+ * `docs/specs/Concepts/Permission Kernel.md`,
12
+ * `docs/specs/Concepts/Trust Granularity.md`, and
13
+ * `docs/specs/Concepts/Host Adapters.md`.
14
+ *
15
+ * @since 1.0.0-rc.0
16
+ */
17
+ import { Jj as JjPort } from "@smthrs/jj";
18
+ import { FileSystem as EffectFileSystem, Layer, Path as EffectPath } from "effect";
19
+ import { HttpClient as HttpClientPort } from "effect/unstable/http/HttpClient";
20
+ import { ChildProcessSpawner as ChildProcessSpawnerPort } from "effect/unstable/process/ChildProcessSpawner";
21
+ import * as ChildProcessSpawner from "./ChildProcessSpawner.js";
22
+ import * as FileSystem from "./FileSystem.js";
23
+ import * as HttpClient from "./HttpClient.js";
24
+ import * as Jj from "./Jj.js";
25
+ import * as Path from "./Path.js";
26
+ /**
27
+ * The Host tags consumed by the kernel at runtime, decorated in place by
28
+ * {@link layer}, and digested by the step-key planner.
29
+ *
30
+ * @category models
31
+ * @since 1.0.0-rc.0
32
+ */
33
+ export const HostServiceTags = [
34
+ EffectFileSystem.FileSystem,
35
+ EffectPath.Path,
36
+ ChildProcessSpawnerPort,
37
+ JjPort,
38
+ HttpClientPort
39
+ ];
40
+ /**
41
+ * Stable slot identifiers shared by host composition, kernel attenuation, and
42
+ * step-layer resolution.
43
+ *
44
+ * Each id is the tag key of its slot's service — Effect's own key for the
45
+ * services Effect ships, the defining module's path for ours. The ids are
46
+ * digested into step keys, so a rename invalidates every cached step naming
47
+ * the slot; rename only when the service itself changes, as when `Shell` was
48
+ * replaced by Effect's `ChildProcessSpawner`.
49
+ *
50
+ * @category models
51
+ * @since 1.0.0-rc.0
52
+ */
53
+ export const HostServiceIds = [
54
+ "effect/FileSystem",
55
+ "effect/Path",
56
+ "effect/process/ChildProcessSpawner",
57
+ "@smthrs/jj/Jj",
58
+ "effect/HttpClient"
59
+ ];
60
+ /**
61
+ * Builds the full protected Host surface over a host platform bundle and a
62
+ * `GrantStore`. `Workspace` remains a requirement so the exact same root
63
+ * service can be supplied to both the grant store and filesystem decorators.
64
+ *
65
+ * Every member both requires and provides its own slot's tag: provide this
66
+ * layer over a raw platform bundle and the guarded implementation shadows the
67
+ * raw one for everything downstream. There is no exception and no second tag
68
+ * list — `HttpClient` decorates Effect's network tag exactly the way
69
+ * `FileSystem` decorates Effect's filesystem tag. The host supplies
70
+ * `ProcessConfinement` for approved processes; absence refuses spawning.
71
+ *
72
+ * @category layers
73
+ * @since 1.0.0-rc.0
74
+ */
75
+ export const layer = Layer.mergeAll(FileSystem.layer, Path.layer, ChildProcessSpawner.layer, Jj.layer, HttpClient.layer);
76
+ //# sourceMappingURL=HostServices.js.map
package/dist/esm/HostServices.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"HostServices.js","sourceRoot":"","sources":["../../src/HostServices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAClF,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAC9E,OAAO,EAAE,mBAAmB,IAAI,uBAAuB,EAAE,MAAM,6CAA6C,CAAA;AAC5G,OAAO,KAAK,mBAAmB,MAAM,0BAA0B,CAAA;AAC/D,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AAkDjC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,gBAAgB,CAAC,UAAU;IAC3B,UAAU,CAAC,IAAI;IACf,uBAAuB;IACvB,MAAM;IACN,cAAc;CACN,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,mBAAmB;IACnB,aAAa;IACb,oCAAoC;IACpC,eAAe;IACf,mBAAmB;CACX,CAAA;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CACjC,UAAU,CAAC,KAAK,EAChB,IAAI,CAAC,KAAK,EACV,mBAAmB,CAAC,KAAK,EACzB,EAAE,CAAC,KAAK,EACR,UAAU,CAAC,KAAK,CACjB,CAAA","sourcesContent":["/**\n * The closed Host service list.\n *\n * One list, one set of tags. The kernel decorates each slot **in place** — a\n * middleware `Layer` over the very tag the platform adapter provides — so\n * there is no second, \"protected\" tag to keep in slot-order sync with this\n * one, and no cast to force a guarded implementation onto a narrower error\n * contract.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md`,\n * `docs/specs/Concepts/Trust Granularity.md`, and\n * `docs/specs/Concepts/Host Adapters.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport { Jj as JjPort } from \"@smthrs/jj\"\nimport { FileSystem as EffectFileSystem, Layer, Path as EffectPath } from \"effect\"\nimport { HttpClient as HttpClientPort } from \"effect/unstable/http/HttpClient\"\nimport { ChildProcessSpawner as ChildProcessSpawnerPort } from \"effect/unstable/process/ChildProcessSpawner\"\nimport * as ChildProcessSpawner from \"./ChildProcessSpawner.ts\"\nimport * as FileSystem from \"./FileSystem.ts\"\nimport * as HttpClient from \"./HttpClient.ts\"\nimport * as Jj from \"./Jj.ts\"\nimport * as Path from \"./Path.ts\"\n\n/**\n * The CLOSED LIST of platform ports the kernel protects.\n * Optional filesystem batches belong to the existing FileSystem slot. The\n * decorator grants each member separately and exposes no additional tag or\n * unguarded executor to consumers; host slot identities remain unchanged.\n *\n * Everything that touches the outside world enters Smithers through exactly one\n * of these tags — there is no ambient `node:fs`, no bare `spawn`, no global\n * `Date.now()`. Two things depend on that closure:\n *\n * 1. The capability kernel wraps precisely this list. A service that is not\n * here cannot be attenuated, denied, or audited, so it must not exist.\n * 2. Step keys digest this list as their `layers` component. Which platform\n * implementations were in scope is part of a step's identity, so a replay\n * under different layers is a different step rather than a silent lie.\n *\n * Each slot's guarded implementation replaces the raw one under the same tag,\n * so a consumer that never heard of the kernel still cannot bypass it. Where\n * Effect owns the tag (`FileSystem`, `Path`, `ChildProcessSpawner`,\n * `HttpClient`) the error channel stays Effect's own — `PlatformError`, or\n * `HttpClientError` for the network — and permission failures are projected\n * into it by `Permission.toPlatformError` and `HttpClient.toHttpClientError`;\n * where Smithers owns the service (`Jj`) the interface names the kernel's\n * failures directly.\n *\n * `Path` is intentionally retained as an explicit decision: it checks nothing\n * and resolves relative paths against `Workspace.root`.\n * Network access is Effect's own `HttpClient`: there is no Smithers transport\n * port beneath it, because a raw port would be a second way to reach the\n * network whose contract never mentions permission.\n *\n * `Clock` and `Random` are Effect core built-ins: already port-shaped, already\n * swappable via `Effect.provideService`, and never decorated here — a `Clock`\n * or a `Random` carries no host authority to guard, so they are not ours to\n * define. `ChildProcessSpawner` is the same story one layer out: process spawning is\n * `effect/unstable/process`, and the slot holds Effect's tag rather than a\n * Smithers wrapper around it.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type HostService =\n | EffectFileSystem.FileSystem\n | EffectPath.Path\n | ChildProcessSpawnerPort\n | JjPort\n | HttpClientPort\n\n/**\n * The Host tags consumed by the kernel at runtime, decorated in place by\n * {@link layer}, and digested by the step-key planner.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const HostServiceTags = [\n EffectFileSystem.FileSystem,\n EffectPath.Path,\n ChildProcessSpawnerPort,\n JjPort,\n HttpClientPort\n] as const\n\n/**\n * Stable slot identifiers shared by host composition, kernel attenuation, and\n * step-layer resolution.\n *\n * Each id is the tag key of its slot's service — Effect's own key for the\n * services Effect ships, the defining module's path for ours. The ids are\n * digested into step keys, so a rename invalidates every cached step naming\n * the slot; rename only when the service itself changes, as when `Shell` was\n * replaced by Effect's `ChildProcessSpawner`.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const HostServiceIds = [\n \"effect/FileSystem\",\n \"effect/Path\",\n \"effect/process/ChildProcessSpawner\",\n \"@smthrs/jj/Jj\",\n \"effect/HttpClient\"\n] as const\n\n/**\n * Builds the full protected Host surface over a host platform bundle and a\n * `GrantStore`. `Workspace` remains a requirement so the exact same root\n * service can be supplied to both the grant store and filesystem decorators.\n *\n * Every member both requires and provides its own slot's tag: provide this\n * layer over a raw platform bundle and the guarded implementation shadows the\n * raw one for everything downstream. There is no exception and no second tag\n * list — `HttpClient` decorates Effect's network tag exactly the way\n * `FileSystem` decorates Effect's filesystem tag. The host supplies\n * `ProcessConfinement` for approved processes; absence refuses spawning.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer = Layer.mergeAll(\n FileSystem.layer,\n Path.layer,\n ChildProcessSpawner.layer,\n Jj.layer,\n HttpClient.layer\n)\n"]}