@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/temporal/workflowexecution/__tests__/engine-client.test.ts

@@ -6,9 +6,18 @@
  * raw-signal convention, the WorkflowNotFoundError → seam-sentinel
  * mapping, and the provider's memoization/disconnected semantics.
  *
+ * And the run credential on the input (2026-09-16): minted through the
+ * composed provider's capability on BOTH dispatch lanes (start and
+ * signalWithStart), bound to the execution with no clock; the key is
+ * ABSENT when the provider lacks the capability (an edition credentialed
+ * another way), when it is keyless, and when the mint throws — a dispatch
+ * never fails on a mint.
+ *
  * The Temporal Client is a recording double — the real dial path is
  * proven by local-execution.
  */
+import { randomBytes } from "node:crypto";
+
 import { describe, expect, it } from "vitest";
 
 import type { Client } from "@temporalio/client";
@@ -27,11 +36,18 @@ import {
   WORKFLOW_ROUTING_GLOBAL,
   WorkflowExecutionTemporalConfig,
 } from "../../../domain/workflowexecution/temporal/config.js";
+import type { RunCredentialMint } from "../../../runnerauth/dispatch-credential.js";
+import { newExecutionScopedRunnerCredentialProvider } from "../../../runnerauth/runner-credential-provider.js";
+import {
+  isClockedToken,
+  RunnerAuthService,
+} from "../../../runnerauth/runnerauth.js";
 import type { TemporalManager } from "../../manager.js";
 import {
   newWorkflowExecutionEngineStateProvider,
   TemporalWorkflowExecutionEngine,
 } from "../engine-client.js";
+import type { TemporalWorkflowExecutionEngineDeps } from "../engine-client.js";
 
 const silentLogger = createLogger({
   level: "error",
@@ -46,6 +62,27 @@ const config = new WorkflowExecutionTemporalConfig(
   WORKFLOW_DEFAULT_EXECUTION_TARGET_LOCAL,
 );
 
+/** The keyed OSS default — what a real open-source boot composes. */
+const runnerAuth = RunnerAuthService.create(randomBytes(32));
+const keyedCredentials = newExecutionScopedRunnerCredentialProvider(runnerAuth);
+
+/**
+ * One construction site for every arm: the realistic deps by default,
+ * any of them overridable, so the next dependency costs one line here.
+ */
+function newEngine(
+  client: Client,
+  overrides: Partial<Omit<TemporalWorkflowExecutionEngineDeps, "client">> = {},
+): TemporalWorkflowExecutionEngine {
+  return new TemporalWorkflowExecutionEngine({
+    client,
+    config,
+    runnerCredentials: keyedCredentials,
+    logger: silentLogger,
+    ...overrides,
+  });
+}
+
 interface RecordedStart {
   readonly workflowType: string;
   readonly options: Record<string, unknown>;
@@ -93,6 +130,15 @@ function newClientDouble(handleError?: Error) {
   return { client, starts, signalWithStarts, handleCalls };
 }
 
+/** The one workflow input a recorded start (or signalWithStart) carried. */
+function inputOf(recorded: RecordedStart[]): Record<string, unknown> {
+  expect(recorded).toHaveLength(1);
+  return (recorded[0]!.options["args"] as unknown[])[0] as Record<
+    string,
+    unknown
+  >;
+}
+
 function startInput(
   overrides: Partial<StartWorkflowExecutionInput> = {},
 ): StartWorkflowExecutionInput {
@@ -110,11 +156,7 @@ function startInput(
 describe("TemporalWorkflowExecutionEngine", () => {
   it("starts the orchestrator with the pinned ID, queue, memo, and omitempty input", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await engine.startInvokeWorkflow(startInput());
 
@@ -125,7 +167,9 @@ describe("TemporalWorkflowExecutionEngine", () => {
       "stigmer/workflow-execution/invoke/wfe-1",
     );
     expect(start.options["taskQueue"]).toBe("workflow_execution_stigmer");
-    expect(start.options["memo"]).toEqual({ runnerTaskQueue: "stigmer_runner" });
+    expect(start.options["memo"]).toEqual({
+      runnerTaskQueue: "stigmer_runner",
+    });
     // Go's omitempty shape: recovery_mode false is OMITTED, not false.
     expect(start.options["args"]).toEqual([
       {
@@ -133,6 +177,8 @@ describe("TemporalWorkflowExecutionEngine", () => {
         workflow_instance_id: "wfi-1",
         workflow_id: "wf-1",
         org_id: "org-1",
+        // The run credential, minted per dispatch (its own arms below).
+        execution_context_token: expect.any(String),
       },
     ]);
     // No workflowRunTimeout — durable execution (module header).
@@ -141,11 +187,7 @@ describe("TemporalWorkflowExecutionEngine", () => {
 
   it("omits every zero-valued optional field and carries recovery_mode when set", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await engine.startInvokeWorkflow(
       startInput({
@@ -157,18 +199,89 @@ describe("TemporalWorkflowExecutionEngine", () => {
     );
 
     expect(double.starts[0]!.options["args"]).toEqual([
-      { execution_id: "wfe-1", recovery_mode: true },
+      {
+        execution_id: "wfe-1",
+        recovery_mode: true,
+        execution_context_token: expect.any(String),
+      },
     ]);
   });
 
-  it("signalWithStart carries the signal, its payload, and the same start options", async () => {
+  it("carries the run credential minted through the provider: bound to the execution, no clock", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
+    const engine = newEngine(double.client);
+
+    await engine.startInvokeWorkflow(startInput({ executionId: "wex_cred" }));
+
+    const token = inputOf(double.starts)["execution_context_token"];
+    expect(typeof token).toBe("string");
+    expect(runnerAuth.verify(token as string)).toBe("wex_cred");
+    expect(isClockedToken(token as string)).toBe(false);
+  });
+
+  it("signalWithStart mints the same credential — the lane that may be the start", async () => {
+    const double = newClientDouble();
+    const engine = newEngine(double.client);
+
+    await engine.signalWithStart(
+      startInput({ executionId: "wex_sws" }),
+      "relaySignal",
+      {
+        signalName: "human_input_step1",
+        payload: { answer: 42 },
+      },
+    );
+
+    const token = inputOf(double.signalWithStarts)["execution_context_token"];
+    expect(runnerAuth.verify(token as string)).toBe("wex_sws");
+  });
+
+  it("omits the credential when the provider lacks the capability — an edition credentialed another way", async () => {
+    const double = newClientDouble();
+    const withoutCapability: RunCredentialMint = {};
+    const engine = newEngine(double.client, {
+      runnerCredentials: withoutCapability,
     });
 
+    await engine.startInvokeWorkflow(startInput());
+    await engine.signalWithStart(startInput(), "relaySignal", null);
+
+    expect("execution_context_token" in inputOf(double.starts)).toBe(false);
+    expect("execution_context_token" in inputOf(double.signalWithStarts)).toBe(
+      false,
+    );
+  });
+
+  it("omits the credential when the provider is keyless", async () => {
+    const double = newClientDouble();
+    const keyless = newExecutionScopedRunnerCredentialProvider(
+      RunnerAuthService.create(undefined),
+    );
+    const engine = newEngine(double.client, { runnerCredentials: keyless });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect("execution_context_token" in inputOf(double.starts)).toBe(false);
+  });
+
+  it("a mint that throws degrades to a dispatch without the credential — the start still happens", async () => {
+    const double = newClientDouble();
+    const throwing: RunCredentialMint = {
+      mintRunCredential(): string {
+        throw new Error("signing failed");
+      },
+    };
+    const engine = newEngine(double.client, { runnerCredentials: throwing });
+
+    await engine.startInvokeWorkflow(startInput());
+
+    expect("execution_context_token" in inputOf(double.starts)).toBe(false);
+  });
+
+  it("signalWithStart carries the signal, its payload, and the same start options", async () => {
+    const double = newClientDouble();
+    const engine = newEngine(double.client);
+
     await engine.signalWithStart(startInput(), "relaySignal", {
       signalName: "human_input_step1",
       payload: { answer: 42 },
@@ -189,17 +302,17 @@ describe("TemporalWorkflowExecutionEngine", () => {
 
   it("raw signal sends exactly one argument, null when the payload is absent", async () => {
     const double = newClientDouble();
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await engine.signalWorkflow("wf-id-1", "pause", "user requested");
     await engine.signalWorkflow("wf-id-1", "resume", undefined);
 
     expect(double.handleCalls).toEqual([
-      { workflowId: "wf-id-1", method: "signal", args: ["pause", "user requested"] },
+      {
+        workflowId: "wf-id-1",
+        method: "signal",
+        args: ["pause", "user requested"],
+      },
       // Go SignalWorkflow(nil) — one nil argument, not zero arguments.
       { workflowId: "wf-id-1", method: "signal", args: ["resume", null] },
     ]);
@@ -208,11 +321,7 @@ describe("TemporalWorkflowExecutionEngine", () => {
   it("maps WorkflowNotFoundError onto the seam's sentinel for signal/cancel/terminate", async () => {
     const notFound = new WorkflowNotFoundError("gone", "wf-id-x", undefined);
     const double = newClientDouble(notFound);
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await expect(
       engine.signalWorkflow("wf-id-x", "pause", "r"),
@@ -228,11 +337,7 @@ describe("TemporalWorkflowExecutionEngine", () => {
   it("passes non-not-found errors through unchanged", async () => {
     const boom = new Error("connection refused");
     const double = newClientDouble(boom);
-    const engine = new TemporalWorkflowExecutionEngine({
-      client: double.client,
-      config,
-      logger: silentLogger,
-    });
+    const engine = newEngine(double.client);
 
     await expect(engine.cancelWorkflow("wf-id-x")).rejects.toBe(boom);
   });
@@ -248,6 +353,7 @@ describe("newWorkflowExecutionEngineStateProvider", () => {
     const provider = newWorkflowExecutionEngineStateProvider({
       manager,
       config,
+      runnerCredentials: keyedCredentials,
       logger: silentLogger,
     });
 

package/src/temporal/workflowexecution/engine-client.ts

@@ -26,6 +26,18 @@
  * signal/cancel/terminate operations take a workflowId verbatim. That
  * asymmetry is the seam's documented contract.
  *
+ * The run credential rides the input (2026-09-16): every dispatch — a
+ * fresh start, a recovery, and both signalWithStart lanes (sendSignal,
+ * submitWorkflowTaskApproval), which may be the start when they race the
+ * create — asks the composed credential provider for the run's credential
+ * (runnerauth/dispatch-credential.ts) and carries it as
+ * `execution_context_token`, the connect lane's shape. signalWithStart
+ * mints even when the workflow already exists and Temporal discards the
+ * input: the mint is a local HMAC with no read, and one input builder
+ * serving every lane is worth more than the spared signature. A provider
+ * without the capability (an edition credentialed another way) leaves the
+ * key off.
+ *
  * Proven by the workflowexecution suites on local-execution.
  */
 import type { JsonValue } from "@bufbuild/protobuf";
@@ -42,6 +54,8 @@ import {
   type WorkflowExecutionEngineStateProvider,
 } from "../../domain/workflowexecution/engine.js";
 import type { WorkflowExecutionTemporalConfig } from "../../domain/workflowexecution/temporal/config.js";
+import { runCredentialForDispatch } from "../../runnerauth/dispatch-credential.js";
+import type { RunCredentialMint } from "../../runnerauth/dispatch-credential.js";
 import type { TemporalManager } from "../manager.js";
 import { resolveWorkflowTaskQueue } from "./dispatch.js";
 import {
@@ -54,6 +68,8 @@ import type { InvokeWorkflowExecutionWorkflowInput } from "./workflow-input.js";
 export interface TemporalWorkflowExecutionEngineDeps {
   readonly client: Client;
   readonly config: WorkflowExecutionTemporalConfig;
+  /** The composed credential provider — the dispatch reads its run-credential capability (module header). */
+  readonly runnerCredentials: RunCredentialMint;
   readonly logger: Logger;
 }
 
@@ -82,7 +98,7 @@ export class TemporalWorkflowExecutionEngine
       workflowId,
       taskQueue: config.stigmerQueue,
       memo: { [MEMO_RUNNER_TASK_QUEUE]: dispatch.taskQueue },
-      args: [buildWorkflowInput(input)],
+      args: [this.buildWorkflowInput(input)],
     });
 
     logger.info("Started InvokeWorkflowExecutionWorkflow", {
@@ -117,7 +133,7 @@ export class TemporalWorkflowExecutionEngine
         workflowId,
         taskQueue: config.stigmerQueue,
         memo: { [MEMO_RUNNER_TASK_QUEUE]: dispatch.taskQueue },
-        args: [buildWorkflowInput(input)],
+        args: [this.buildWorkflowInput(input)],
         signal: signalName,
         signalArgs: [payload],
       },
@@ -164,26 +180,35 @@ export class TemporalWorkflowExecutionEngine
       throw mapNotFound(error, workflowId);
     }
   }
-}
 
-/**
- * The slim input with Go's omitempty shape (workflow-input.ts): zero
- * values are omitted so TS-authored histories carry the same keys a
- * Go-authored one would. The cloud-only fields are unmodeled (the seam's
- * ratified boundary).
- */
-function buildWorkflowInput(
-  input: StartWorkflowExecutionInput,
-): InvokeWorkflowExecutionWorkflowInput {
-  return {
-    execution_id: input.executionId,
-    ...(input.workflowInstanceId !== ""
-      ? { workflow_instance_id: input.workflowInstanceId }
-      : {}),
-    ...(input.workflowId !== "" ? { workflow_id: input.workflowId } : {}),
-    ...(input.orgId !== "" ? { org_id: input.orgId } : {}),
-    ...(input.recoveryMode ? { recovery_mode: true } : {}),
-  };
+  /**
+   * The slim input with Go's omitempty shape (workflow-input.ts): zero
+   * values are omitted so TS-authored histories carry the same keys a
+   * Go-authored one would. The cloud-only fields are unmodeled (the
+   * seam's ratified boundary). The run credential is the one key minted
+   * here rather than copied from the caller (module header).
+   */
+  private buildWorkflowInput(
+    input: StartWorkflowExecutionInput,
+  ): InvokeWorkflowExecutionWorkflowInput {
+    const runCredential = runCredentialForDispatch(
+      this.deps.runnerCredentials,
+      input.executionId,
+      this.deps.logger,
+    );
+    return {
+      execution_id: input.executionId,
+      ...(input.workflowInstanceId !== ""
+        ? { workflow_instance_id: input.workflowInstanceId }
+        : {}),
+      ...(input.workflowId !== "" ? { workflow_id: input.workflowId } : {}),
+      ...(input.orgId !== "" ? { org_id: input.orgId } : {}),
+      ...(input.recoveryMode ? { recovery_mode: true } : {}),
+      ...(runCredential !== ""
+        ? { execution_context_token: runCredential }
+        : {}),
+    };
+  }
 }
 
 /**
@@ -200,6 +225,7 @@ function mapNotFound(error: unknown, workflowId: string): unknown {
 export interface WorkflowExecutionEngineStateProviderDeps {
   readonly manager: TemporalManager;
   readonly config: WorkflowExecutionTemporalConfig;
+  readonly runnerCredentials: RunCredentialMint;
   readonly logger: Logger;
 }
 
@@ -232,6 +258,7 @@ export function newWorkflowExecutionEngineStateProvider(
           engine: new TemporalWorkflowExecutionEngine({
             client,
             config: deps.config,
+            runnerCredentials: deps.runnerCredentials,
             logger: deps.logger,
           }),
         },

package/src/temporal/workflowexecution/workflow-input.ts

@@ -28,6 +28,20 @@ export interface InvokeWorkflowExecutionWorkflowInput {
    * recover pipeline; normal executions omit it (Go omitempty).
    */
   readonly recovery_mode?: boolean;
+  /**
+   * The run credential (runnerauth: a clockless execution-scoped token
+   * bound to this execution), minted by the engine client at dispatch
+   * when the composed credential provider defines `mintRunCredential`
+   * and omitted otherwise. The connect lane's key for the same token
+   * type (domain/mcpserver/engine.ts). The orchestrator passes this
+   * object whole to the runner's child workflow, so the runner reads it
+   * from here and presents it on the run's own RPCs: under the built-in
+   * authorization posture it admits the runner as the human whose run
+   * this is, for as long as the run lives. In Temporal history in the
+   * clear, like the connect lane's — history is operator-only, and the
+   * operator holds the signing key already.
+   */
+  readonly execution_context_token?: string;
 }
 
 /**

package/dist/domain/skill/storage/prefilter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"prefilter.d.ts","sourceRoot":"","sources":["../../../../src/domain/skill/storage/prefilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAIjE;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUlD;AA2BD,0EAA0E;AAC1E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAK/D;AAgBD,UAAU,aAAa;IACrB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CAetE;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,kBAAkB,EAAE,GACrC,gBAAgB,EAAE,CAwCpB"}

package/dist/domain/skill/storage/prefilter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prefilter.js","sourceRoot":"","sources":["../../../../src/domain/skill/storage/prefilter.ts"],"names":[],"mappings":"AAkCA,4EAA4E;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,IACE,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,SAAS,CAAC,MAAM,GAAG,CAAC,EACpB,CAAC;QACD,OAAO,GAAG,SAAS,GAAG,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,oBAAoB,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,sEAAsE;IACtE,mEAAmE;IACnE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,4EAA4E;AAE5E,6EAA6E;AAC7E,MAAM,8BAA8B,GAAG,SAAS,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,KAAK;SACT,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAE5E,iEAAiE;AACjE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,+CAA+C;AAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC;AACxB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC;AAQ1B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,QAAQ,KAAK,OAAO;QAC/B,SAAS,EACP,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,OAAO;YACpB,QAAQ,KAAK,QAAQ;KACxB,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEtC,IAAI,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC9C,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC"}