@substrat-run/contract-tests 0.114.0 → 0.117.0

package/dist/capability-suite.js

@@ -0,0 +1,498 @@
+/**
+ * Contract suite for capabilities (#1672) — authority carried by a secret rather than held
+ * by a principal: a link share, a claim link.
+ *
+ * What it pins, in one sentence: **whoever exchanges a capability's secret acts as the
+ * capability, and the capability reaches exactly its entity subtree and keys, never more
+ * than its minter holds right now, for as long as it is live — and the kernel stores only the
+ * secret's hash.**
+ *
+ * Every refusal here is paired with the allow beside it, so a checker that refused
+ * everything cannot pass: the sibling folder is refused NEXT TO the shared folder being
+ * read, the other key NEXT TO the carried one, the revoked capability NEXT TO its live
+ * twin. The properties, and why each is behavioural rather than a note:
+ *
+ * 1. **The subtree and the keys.** A capability over folder F reads F, a document in F and
+ *    a document two levels down; it is refused the sibling folder G, G's document, a
+ *    node-level read, and a key it does not carry — each refusal landing in the denial log
+ *    against `{ capability }`.
+ * 2. **Never more than the minter holds, on every use.** A reader cannot mint a write key;
+ *    and when the minter's own role is taken away AFTER the mint, the capability stops
+ *    granting on the very next call.
+ * 3. **Revocation, expiry and the use limit.** A revoke refuses the next invoke on a stub
+ *    minted before it; a use limit refuses the exchange past it while the sessions already
+ *    handed out keep working — a use is an exchange, not an invocation; two exchanges racing
+ *    for a single-use capability admit one. (The expiry TRANSITION needs a clock a test can
+ *    move, so it is asserted on the pure host — see `capabilityExpiryContractSuite`.)
+ * 4. **The spine.** An event the capability causes carries `{ capability }` as its actor
+ *    and K-34 authorization naming the root; the mint and the exchange are events too.
+ * 5. **Only the hash is stored.** Every table of the scope is scanned after a mint, an
+ *    exchange and a use; the hash is there and the secret is not. The TRIPWIRE for a module
+ *    persisting its own secret by accident — as a payload value, an object key, an entity id,
+ *    an intent's kind, a text or a byte SQL parameter — refuses the write and rolls the mint
+ *    back, and each channel's clean twin goes through. An idempotent replay of a mint returns
+ *    a placeholder. (A tripwire, not a boundary: a module that means to leak its secret can
+ *    encode it first, and no scan of storage can recognise every encoding.)
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { CAPABILITY_SECRET_PREFIX, CAPABILITY_SESSION_PREFIX, capabilityRecord, errorCodeOf, permissionKey, platformActorId, principalId, scopeId, tenantId, } from '@substrat-run/contracts';
+import { capabilityTokenHash, ulid, WITHHELD_SECRET } from '@substrat-run/kernel';
+import { CAP_LEAK_CHANNELS, capMod } from './modules.js';
+const CAP_READ = permissionKey.parse('cap:read');
+const CAP_WRITE = permissionKey.parse('cap:write');
+const CAP_ADMIN = permissionKey.parse('cap:admin');
+const folder = (id) => ({ entityType: 'folder', entityId: id });
+const doc = (id) => ({ entityType: 'doc', entityId: id });
+/** The refusal a promise settles with, or `undefined` when it resolved. */
+const refusal = (p) => p.then(() => undefined, (e) => e);
+export function capabilityContractSuite(adapterName, makeFixture) {
+    describe(`capability contract (#1672): ${adapterName}`, () => {
+        let fixture;
+        let host;
+        const t1 = tenantId.parse(ulid());
+        const s1 = scopeId.parse(ulid());
+        const s2 = scopeId.parse(ulid()); // same tenant, a second scope
+        const alice = principalId.parse(ulid()); // owner: read + write + admin, tenant-wide
+        const bob = principalId.parse(ulid()); // reader at s1 only
+        const carol = principalId.parse(ulid()); // holds nothing
+        const seat = principalId.parse(ulid()); // the principal a `become` yields
+        const staff = platformActorId.parse(ulid());
+        const inFuture = (ms) => new Date(Date.now() + ms).toISOString();
+        const as = (who, scope = s1) => host.getScope(who, t1, scope);
+        const share = async (who, spec) => (await as(who)).invoke('cap/share', spec);
+        const exchange = (secret, scope = s1) => host.exchangeCapability(t1, scope, secret);
+        const sessionOf = async (secret) => {
+            const ex = await exchange(secret);
+            if (ex?.kind !== 'session')
+                throw new Error(`expected a session, got ${JSON.stringify(ex)}`);
+            return ex.sessionToken;
+        };
+        const holder = async (secret) => host.getCapabilityScope(await sessionOf(secret), t1, s1);
+        const outbox = async () => (await as(alice)).invoke('cap/outbox');
+        const denials = async () => (await as(alice)).invoke('cap/denials');
+        const dump = async () => (await as(alice)).invoke('cap/dump');
+        beforeAll(async () => {
+            fixture = await makeFixture();
+            host = fixture.host;
+            host.registerModule(capMod);
+            await host.admin.createTenant(staff, { id: t1, slug: 'cap-tenant', name: 'Cap Tenant' });
+            await host.admin.grantEntitlement(staff, t1, 'cap');
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s1, vertical: 'cap-vertical' });
+            await host.admin.activateScope(staff, t1, s1);
+            await host.provisionScope(staff, { tenantId: t1, scopeId: s2, vertical: 'cap-vertical' });
+            await host.admin.activateScope(staff, t1, s2);
+            await host.admin.defineRole(staff, t1, {
+                key: 'owner',
+                permissions: [CAP_READ, CAP_WRITE, CAP_ADMIN],
+                source: 'vertical',
+            });
+            await host.admin.defineRole(staff, t1, { key: 'reader', permissions: [CAP_READ], source: 'vertical' });
+            await host.admin.assignRole(staff, {
+                principalId: alice,
+                roleKey: 'owner',
+                node: { tenantId: t1, scopeId: null },
+            });
+            await host.admin.assignRole(staff, {
+                principalId: bob,
+                roleKey: 'reader',
+                node: { tenantId: t1, scopeId: s1 },
+            });
+            // The tree in s1:   F ─┬─ d1          G ── d3
+            //                      ├─ d2
+            //                      └─ F2 ── d4
+            const stub = await as(alice);
+            const link = (child, parent) => stub.invoke('cap/link', { child, parent });
+            await link(doc('d1'), folder('F'));
+            await link(doc('d2'), folder('F'));
+            await link(folder('F2'), folder('F'));
+            await link(doc('d4'), folder('F2'));
+            await link(doc('d3'), folder('G'));
+        });
+        afterAll(async () => {
+            await fixture.cleanup();
+        });
+        describe('mint → exchange → act: exactly the subtree and the keys', () => {
+            let minted;
+            let stub;
+            beforeAll(async () => {
+                minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                stub = await holder(minted.secret);
+            });
+            it('hands back a prefixed secret and an id, once', () => {
+                expect(minted.secret.startsWith(CAPABILITY_SECRET_PREFIX)).toBe(true);
+                expect(minted.secret.length).toBeGreaterThanOrEqual(CAPABILITY_SECRET_PREFIX.length + 43);
+            });
+            it('an exchange yields a session, never the secret back', async () => {
+                const ex = await exchange(minted.secret);
+                expect(ex?.kind).toBe('session');
+                if (ex?.kind !== 'session')
+                    return;
+                expect(ex.sessionToken.startsWith(CAPABILITY_SESSION_PREFIX)).toBe(true);
+                expect(ex.sessionToken).not.toContain(minted.secret);
+                expect(ex.capabilityId).toBe(minted.id);
+                expect(ex.entity).toEqual(folder('F'));
+            });
+            it('reads the shared folder, a document in it, and one two levels down', async () => {
+                for (const entity of [folder('F'), doc('d1'), doc('d4')]) {
+                    await expect(stub.invoke('cap/read', { entity })).resolves.toMatchObject({ read: entity });
+                }
+            });
+            it('the proof ends at the capability’s grant on its root, after the minter’s own chain', async () => {
+                const out = await stub.invoke('cap/read', { entity: doc('d4') });
+                const last = out.proof[out.proof.length - 1];
+                expect(last).toEqual({
+                    subject: `capability:${minted.id}`,
+                    relation: 'granted:cap:read',
+                    object: 'folder:F',
+                });
+                expect(out.proof).toContainEqual({
+                    subject: `capability:${minted.id}`,
+                    relation: 'minted-by',
+                    object: `principal:${alice}`,
+                });
+                // The walk it took: d4 → F2 → F.
+                expect(out.proof).toContainEqual({ subject: 'doc:d4', relation: 'parent', object: 'folder:F2' });
+                expect(out.proof).toContainEqual({ subject: 'folder:F2', relation: 'parent', object: 'folder:F' });
+            });
+            it('is refused the sibling folder and the sibling’s document — and the refusal is recorded', async () => {
+                for (const entity of [folder('G'), doc('d3')]) {
+                    const err = await refusal(stub.invoke('cap/read', { entity }));
+                    expect(errorCodeOf(err)).toBe('permission_denied');
+                }
+                const rows = (await denials()).filter((d) => d.actor === JSON.stringify({ capability: minted.id }));
+                expect(rows.filter((d) => d.permission === 'cap:read' && d.operation === 'cap/read')).toHaveLength(2);
+            });
+            it('is refused a key it does not carry, even on its own root', async () => {
+                const err = await refusal(stub.invoke('cap/comment', { doc: doc('d1'), body: 'hi' }));
+                expect(errorCodeOf(err)).toBe('permission_denied');
+                const rows = await denials();
+                expect(rows).toContainEqual(expect.objectContaining({
+                    actor: JSON.stringify({ capability: minted.id }),
+                    permission: 'cap:write',
+                    operation: 'cap/comment',
+                }));
+            });
+            it('holds no node-level authority: a check without an entity refuses it', async () => {
+                const err = await refusal(stub.invoke('cap/read-all'));
+                expect(errorCodeOf(err)).toBe('permission_denied');
+                // The positive twin: the owner, holding the key at the node, passes the same check.
+                await expect((await as(alice)).invoke('cap/read-all')).resolves.toEqual({ all: true });
+            });
+            it('ctx.principal carries the capability id — it is not a person', async () => {
+                expect(await stub.invoke('cap/whoami')).toBe(minted.id);
+            });
+            it('a session is scope-bound: presented to another scope of the tenant, it acts as nobody', async () => {
+                const token = await sessionOf(minted.secret);
+                const elsewhere = await host.getCapabilityScope(token, t1, s2);
+                expect(errorCodeOf(await refusal(elsewhere.invoke('cap/read', { entity: folder('F') })))).toBe('unauthenticated');
+            });
+            it('a secret is scope-bound: exchanged at another scope of the tenant, it finds nothing', async () => {
+                expect(await exchange(minted.secret, s2)).toBeNull();
+            });
+        });
+        describe('never more than the minter holds — at the mint, and on every use', () => {
+            it('a reader cannot mint a write key; the same reader can mint the read key', async () => {
+                const err = await refusal(share(bob, { entity: folder('F'), permissions: [CAP_WRITE] }));
+                expect(errorCodeOf(err)).toBe('permission_denied');
+                const ok = await share(bob, { entity: folder('F'), permissions: [CAP_READ] });
+                expect(ok.id).toMatch(/^[0-9A-HJKMNP-TV-Z]{26}$/);
+            });
+            it('one key too many refuses the whole mint, and leaves no row behind', async () => {
+                const before = (await (await as(alice)).invoke('cap/list', { includeRevoked: true })).length;
+                await refusal(share(bob, { entity: folder('F'), permissions: [CAP_READ, CAP_WRITE] }));
+                const after = (await (await as(alice)).invoke('cap/list', { includeRevoked: true })).length;
+                expect(after).toBe(before);
+            });
+            it('someone holding nothing mints nothing', async () => {
+                const err = await refusal(share(carol, { entity: folder('F'), permissions: [CAP_READ] }));
+                expect(errorCodeOf(err)).toBe('permission_denied');
+            });
+            it('taking the minter’s role away AFTER the mint ends what the capability can do, at the next call', async () => {
+                const dan = principalId.parse(ulid());
+                const role = { principalId: dan, roleKey: 'reader', node: { tenantId: t1, scopeId: s1 } };
+                await host.admin.assignRole(staff, role);
+                const minted = await share(dan, { entity: folder('F'), permissions: [CAP_READ] });
+                const stub = await holder(minted.secret);
+                await expect(stub.invoke('cap/read', { entity: doc('d1') })).resolves.toBeTruthy();
+                await host.admin.unassignRole(staff, role);
+                expect(errorCodeOf(await refusal(stub.invoke('cap/read', { entity: doc('d1') })))).toBe('permission_denied');
+                // Given back, it grants again — the re-check is live, not a latch.
+                await host.admin.assignRole(staff, role);
+                await expect(stub.invoke('cap/read', { entity: doc('d1') })).resolves.toBeTruthy();
+            });
+            it('a consumer cannot mint: its checks allow unconditionally, so it is refused outright', async () => {
+                await (await as(alice)).invoke('cap/request-mint', { entity: folder('F') });
+                const notes = await (await as(alice)).invoke('cap/notes');
+                expect(notes.map((n) => n.body)).toContain('refused forbidden');
+                expect(notes.some((n) => n.body.startsWith('minted'))).toBe(false);
+            });
+            it('a capability cannot mint a capability — no re-delegation', async () => {
+                const minted = await share(alice, {
+                    entity: folder('F'),
+                    permissions: [CAP_READ],
+                });
+                const stub = await holder(minted.secret);
+                const err = await refusal(stub.invoke('cap/share', { entity: folder('F'), permissions: [CAP_READ] }));
+                expect(errorCodeOf(err)).toBe('forbidden');
+            });
+        });
+        describe('revocation, the use limit, and the operation list', () => {
+            it('a revoke refuses the NEXT invoke on a stub minted before it; its live twin keeps working', async () => {
+                const doomed = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                const twin = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                const doomedStub = await holder(doomed.secret);
+                const twinStub = await holder(twin.secret);
+                await expect(doomedStub.invoke('cap/read', { entity: folder('F') })).resolves.toBeTruthy();
+                await (await as(alice)).invoke('cap/unshare', { id: doomed.id });
+                expect(errorCodeOf(await refusal(doomedStub.invoke('cap/read', { entity: folder('F') })))).toBe('unauthenticated');
+                expect(await exchange(doomed.secret)).toBeNull();
+                await expect(twinStub.invoke('cap/read', { entity: folder('F') })).resolves.toBeTruthy();
+            });
+            it('revoking twice is a no-op, not an error', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                await (await as(alice)).invoke('cap/unshare', { id: minted.id });
+                await expect((await as(alice)).invoke('cap/unshare', { id: minted.id })).resolves.toEqual({
+                    revoked: true,
+                });
+            });
+            it('only someone who could have minted it may revoke it', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_WRITE] });
+                // bob reads F but does not hold cap:write there.
+                expect(errorCodeOf(await refusal((await as(bob)).invoke('cap/unshare', { id: minted.id })))).toBe('permission_denied');
+                expect(errorCodeOf(await refusal((await as(carol)).invoke('cap/unshare', { id: minted.id })))).toBe('permission_denied');
+            });
+            it('a use limit refuses the exchange past it — and the sessions already out keep acting', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ], maxUses: 2 });
+                const first = await host.getCapabilityScope(await sessionOf(minted.secret), t1, s1);
+                await sessionOf(minted.secret);
+                expect(await exchange(minted.secret)).toBeNull();
+                // A use is an EXCHANGE: the first session reads as often as it likes.
+                for (let i = 0; i < 3; i++) {
+                    await expect(first.invoke('cap/read', { entity: doc('d1') })).resolves.toBeTruthy();
+                }
+                const [record] = (await (await as(alice)).invoke('cap/list', { entity: folder('F') }))
+                    .map((r) => capabilityRecord.parse(r))
+                    .filter((r) => r.id === minted.id);
+                expect(record?.uses).toBe(2);
+                expect(record?.maxUses).toBe(2);
+            });
+            it('two exchanges racing for a single-use capability admit exactly one', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ], maxUses: 1 });
+                const results = await Promise.all(Array.from({ length: 5 }, () => exchange(minted.secret)));
+                expect(results.filter((r) => r !== null)).toHaveLength(1);
+            });
+            it('an operation off the capability’s list is refused before its handler, whatever the keys allow', async () => {
+                const minted = await share(alice, {
+                    entity: folder('F'),
+                    permissions: [CAP_READ, CAP_WRITE],
+                    operations: ['cap/read'],
+                });
+                const stub = await holder(minted.secret);
+                await expect(stub.invoke('cap/read', { entity: doc('d1') })).resolves.toBeTruthy();
+                expect(errorCodeOf(await refusal(stub.invoke('cap/comment', { doc: doc('d1'), body: 'x' })))).toBe('forbidden');
+                // Refused at the door: no key was checked, so nothing lands in the denial log.
+                const rows = (await denials()).filter((d) => d.actor === JSON.stringify({ capability: minted.id }));
+                expect(rows).toHaveLength(0);
+            });
+            it('an allowlist naming an operation that does not exist is refused at the mint', async () => {
+                const err = await refusal(share(alice, { entity: folder('F'), permissions: [CAP_READ], operations: ['cap/no-such-op'] }));
+                expect(errorCodeOf(err)).toBe('validation_failed');
+            });
+            it('an expiry that is not in the future is refused at the mint', async () => {
+                const err = await refusal(share(alice, { entity: folder('F'), permissions: [CAP_READ], expiresAt: '2000-01-01T00:00:00.000Z' }));
+                expect(errorCodeOf(err)).toBe('validation_failed');
+            });
+            it('a secret that is not one of ours, or one never minted, exchanges for nothing', async () => {
+                expect(await exchange('not-a-secret')).toBeNull();
+                expect(await exchange(`${CAPABILITY_SECRET_PREFIX}${'A'.repeat(43)}`)).toBeNull();
+            });
+        });
+        describe('the spine: the actor, K-34, and the capability’s own events', () => {
+            it('an event the capability causes is stamped `{ capability }`, with the key and root that authorized it', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ, CAP_WRITE] });
+                const stub = await holder(minted.secret);
+                await stub.invoke('cap/comment', { doc: doc('d2'), body: 'looks good' });
+                const row = (await outbox())
+                    .filter((r) => r.type === 'cap.commented' && r.entity_id === 'd2')
+                    .pop();
+                expect(JSON.parse(row.actor)).toEqual({ capability: minted.id });
+                expect(JSON.parse(row.authorization)).toEqual([{ permission: 'cap:write', grant: 'folder:F' }]);
+                expect(row.operation).toBe('cap/comment');
+            });
+            it('the mint is on the spine as the minter; the exchange as the capability — neither carries the secret', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                await sessionOf(minted.secret);
+                const rows = await outbox();
+                const mint = rows.find((r) => r.type === 'capability.minted' && JSON.parse(r.payload).capabilityId === minted.id);
+                expect(JSON.parse(mint.actor)).toBe(alice);
+                expect(mint.entity_type).toBe('folder');
+                expect(mint.entity_id).toBe('F');
+                const exercised = rows.find((r) => r.type === 'capability.exercised' && JSON.parse(r.payload).capabilityId === minted.id);
+                expect(JSON.parse(exercised.actor)).toEqual({ capability: minted.id });
+                expect(exercised.operation).toBe('capabilities.exchange');
+                // ONE instant per exchange: the event says the use happened exactly when the row does.
+                const [record] = (await (await as(alice)).invoke('cap/list', { entity: folder('F'), limit: 200 }))
+                    .map((r) => capabilityRecord.parse(r))
+                    .filter((r) => r.id === minted.id);
+                expect(record?.lastUsedAt).toBe(exercised.occurred_at);
+                expect(JSON.parse(exercised.payload)).toMatchObject({ mode: 'act', uses: 1 });
+                for (const r of [mint, exercised])
+                    expect(r.payload).not.toContain(minted.secret);
+            });
+            it('a revoke is on the spine as the revoker', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                await (await as(alice)).invoke('cap/unshare', { id: minted.id });
+                const row = (await outbox()).find((r) => r.type === 'capability.revoked' && JSON.parse(r.payload).capabilityId === minted.id);
+                expect(JSON.parse(row.actor)).toBe(alice);
+            });
+        });
+        describe('only the hash is stored; an accidental write of the secret is refused', () => {
+            it('after a mint, an exchange and a use, every table holds the hash and none holds the secret', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ, CAP_WRITE] });
+                const token = await sessionOf(minted.secret);
+                const stub = await host.getCapabilityScope(token, t1, s1);
+                await stub.invoke('cap/comment', { doc: doc('d1'), body: 'stored' });
+                const tables = await dump();
+                const everything = Object.values(tables).join('\n');
+                expect(everything).not.toContain(minted.secret);
+                expect(everything).not.toContain(token);
+                // The positive twin: what IS stored is the hash — of both.
+                expect(tables._substrat_capabilities).toContain(await capabilityTokenHash(minted.secret));
+                expect(tables._substrat_capability_sessions).toContain(await capabilityTokenHash(token));
+            });
+            // The tripwire, channel by channel: each accidental write of the secret is refused
+            // and takes its mint down with it; the SAME channel carrying a harmless value goes
+            // through and the capability persists — so a guard that refused a channel wholesale,
+            // or scanned only the payload, would fail one side or the other.
+            const labelled = async (label) => (await (await as(alice)).invoke('cap/list', { includeRevoked: true, limit: 200 }))
+                .map((r) => capabilityRecord.parse(r))
+                .some((r) => r.label === label);
+            for (const via of CAP_LEAK_CHANNELS) {
+                it(`the secret written via ${via} is refused, and its mint rolled back with it`, async () => {
+                    const label = `leak-${via}-${ulid()}`;
+                    const err = await refusal((await as(alice)).invoke('cap/share-and-leak', {
+                        entity: folder('F'),
+                        permissions: [CAP_READ],
+                        label,
+                        via,
+                    }));
+                    expect(errorCodeOf(err)).toBe('forbidden');
+                    expect(await labelled(label)).toBe(false);
+                });
+                it(`a harmless value written via ${via} goes through (the clean twin)`, async () => {
+                    const label = `clean-${via}-${ulid()}`;
+                    await (await as(alice)).invoke('cap/share-and-leak', {
+                        entity: folder('F'),
+                        permissions: [CAP_READ],
+                        label,
+                        via,
+                        leak: false,
+                    });
+                    expect(await labelled(label)).toBe(true);
+                });
+            }
+            it('an idempotent replay of a mint withholds the secret; the first response carried it', async () => {
+                const key = `mint-${ulid()}`;
+                const input = { entity: folder('F'), permissions: [CAP_READ], label: key };
+                const stub = await as(alice);
+                const first = await stub.invoke('cap/share-link', input, {
+                    idempotencyKey: key,
+                });
+                expect(first.link).toMatch(new RegExp(`#share=${CAPABILITY_SECRET_PREFIX}`));
+                const replay = await stub.invoke('cap/share-link', input, {
+                    idempotencyKey: key,
+                });
+                expect(replay.id).toBe(first.id);
+                expect(replay.link).toBe(`https://docs.example/#share=${WITHHELD_SECRET}`);
+                const secret = first.link.split('#share=')[1];
+                expect(Object.values(await dump()).join('\n')).not.toContain(secret);
+                // The first response's secret is the real one: it exchanges.
+                expect((await exchange(secret))?.kind).toBe('session');
+            });
+        });
+        describe('listing', () => {
+            it('lists records with neither the secret nor its hash; revoked ones only when asked', async () => {
+                const live = await share(alice, { entity: folder('F2'), permissions: [CAP_READ], label: 'live' });
+                const gone = await share(alice, { entity: folder('F2'), permissions: [CAP_READ], label: 'gone' });
+                await (await as(alice)).invoke('cap/unshare', { id: gone.id });
+                const listed = await (await as(alice)).invoke('cap/list', { entity: folder('F2') });
+                const ids = listed.map((r) => capabilityRecord.parse(r).id);
+                expect(ids).toContain(live.id);
+                expect(ids).not.toContain(gone.id);
+                const all = (await (await as(alice)).invoke('cap/list', {
+                    entity: folder('F2'),
+                    includeRevoked: true,
+                })).map((r) => capabilityRecord.parse(r));
+                expect(all.find((r) => r.id === gone.id)?.revokedBy).toBe(alice);
+                const text = JSON.stringify(all);
+                expect(text).not.toContain(live.secret);
+                expect(text).not.toContain(await capabilityTokenHash(live.secret));
+            });
+        });
+        describe('become — platform-minted, exchanged for a principal', () => {
+            it('yields the principal once, is spent, and is audited without its secret', async () => {
+                const minted = await host.admin.mintCapability(staff, t1, s1, {
+                    principal: seat,
+                    expiresAt: inFuture(60_000),
+                    maxUses: 1,
+                    label: 'claim',
+                });
+                const ex = await exchange(minted.secret);
+                expect(ex).toEqual({ kind: 'principal', capabilityId: minted.id, principal: seat });
+                expect(await exchange(minted.secret)).toBeNull();
+                const log = await host.admin.auditLog(staff);
+                const entry = log.find((e) => e.action === 'mintCapability' && JSON.stringify(e.after).includes(minted.id));
+                expect(entry).toBeDefined();
+                expect(JSON.stringify(log)).not.toContain(minted.secret);
+                expect(JSON.stringify(log)).not.toContain(await capabilityTokenHash(minted.secret));
+                const exercised = (await outbox()).find((r) => r.type === 'capability.exercised' && JSON.parse(r.payload).capabilityId === minted.id);
+                expect(JSON.parse(exercised.actor)).toEqual({ capability: minted.id });
+                expect(JSON.parse(exercised.payload)).toMatchObject({ mode: 'become', principal: seat });
+            });
+            it('a route that can only take a session refuses a `become` secret WITHOUT spending it', async () => {
+                const minted = await host.admin.mintCapability(staff, t1, s1, {
+                    principal: seat,
+                    expiresAt: inFuture(60_000),
+                    maxUses: 1,
+                });
+                expect(await host.exchangeCapability(t1, s1, minted.secret, { mode: 'act' })).toBeNull();
+                // Still unspent: the route that CAN take a principal gets it.
+                expect(await host.exchangeCapability(t1, s1, minted.secret, { mode: 'become' })).toEqual({
+                    kind: 'principal',
+                    capabilityId: minted.id,
+                    principal: seat,
+                });
+            });
+            it('and a claim route refuses a share link without spending it', async () => {
+                const link = await share(alice, { entity: folder('F'), permissions: [CAP_READ], maxUses: 1 });
+                expect(await host.exchangeCapability(t1, s1, link.secret, { mode: 'become' })).toBeNull();
+                expect((await host.exchangeCapability(t1, s1, link.secret, { mode: 'act' }))?.kind).toBe('session');
+            });
+            it('is revoked by the platform, not by a module', async () => {
+                const minted = await host.admin.mintCapability(staff, t1, s1, {
+                    principal: seat,
+                    expiresAt: inFuture(60_000),
+                    maxUses: 3,
+                });
+                expect(errorCodeOf(await refusal((await as(alice)).invoke('cap/unshare', { id: minted.id })))).toBe('forbidden');
+                await host.admin.revokeCapability(staff, t1, s1, minted.id);
+                expect(await exchange(minted.secret)).toBeNull();
+            });
+            it('the platform can revoke a module-minted link too — the lever for a leaked one', async () => {
+                const minted = await share(alice, { entity: folder('F'), permissions: [CAP_READ] });
+                const stub = await holder(minted.secret);
+                await host.admin.revokeCapability(staff, t1, s1, minted.id);
+                expect(errorCodeOf(await refusal(stub.invoke('cap/read', { entity: folder('F') })))).toBe('unauthenticated');
+            });
+            it('requires a future expiry, and refuses an unknown capability on revoke', async () => {
+                expect(errorCodeOf(await refusal(host.admin.mintCapability(staff, t1, s1, {
+                    principal: seat,
+                    expiresAt: '2000-01-01T00:00:00.000Z',
+                    maxUses: 1,
+                })))).toBe('validation_failed');
+                expect(errorCodeOf(await refusal(host.admin.revokeCapability(staff, t1, s1, ulid())))).toBe('not_found');
+            });
+        });
+    });
+}
+//# sourceMappingURL=capability-suite.js.map

package/dist/capability-suite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-suite.js","sourceRoot":"","sources":["../src/capability-suite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,eAAe,EACf,WAAW,EACX,OAAO,EACP,QAAQ,GAOT,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,EAAkB,MAAM,sBAAsB,CAAC;AAElG,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AACjD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAEnD,MAAM,MAAM,GAAG,CAAC,EAAU,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,GAAG,GAAG,CAAC,EAAU,EAAa,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAmB7E,2EAA2E;AAC3E,MAAM,OAAO,GAAG,CAAC,CAAmB,EAAoB,EAAE,CACxD,CAAC,CAAC,IAAI,CACJ,GAAG,EAAE,CAAC,SAAS,EACf,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAClB,CAAC;AAEJ,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,WAA4C;IAE5C,QAAQ,CAAC,gCAAgC,WAAW,EAAE,EAAE,GAAG,EAAE;QAC3D,IAAI,OAAyB,CAAC;QAC9B,IAAI,IAAe,CAAC;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,8BAA8B;QAChE,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,2CAA2C;QACjG,MAAM,GAAG,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB;QACxE,MAAM,KAAK,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,gBAAgB;QACtE,MAAM,IAAI,GAAgB,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kCAAkC;QACvF,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAa,CAAC;QAE7F,MAAM,EAAE,GAAG,CAAC,GAAgB,EAAE,KAAK,GAAY,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,EACjB,GAAgB,EAChB,IAA6B,EACF,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAmB,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,KAAK,GAAY,EAAE,EAAsC,EAAE,CAC3F,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;YAC1D,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,EAAE,EAAE,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7F,OAAO,EAAE,CAAC,YAAY,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,KAAK,IAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAc,YAAY,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,KAAK,IAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAc,aAAa,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,KAAK,IAAqC,EAAE,CACvD,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAyB,UAAU,CAAC,CAAC;QAE/D,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;YAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACzF,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE;gBACrC,GAAG,EAAE,OAAO;gBACZ,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;gBAC7C,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACvG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;gBACjC,WAAW,EAAE,KAAK;gBAClB,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;gBACjC,WAAW,EAAE,GAAG;gBAChB,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;aACpC,CAAC,CAAC;YAEH,8CAA8C;YAC9C,6BAA6B;YAC7B,mCAAmC;YACnC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,CAAC,KAAgB,EAAE,MAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACvE,IAAI,MAAwB,CAAC;YAC7B,IAAI,IAA0D,CAAC;YAE/D,SAAS,CAAC,KAAK,IAAI,EAAE;gBACnB,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9E,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;gBACtD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;gBACnE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACjC,IAAI,EAAE,EAAE,IAAI,KAAK,SAAS;oBAAE,OAAO;gBACnC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;gBAClF,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACzD,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7F,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;gBAClG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAC3B,UAAU,EACV,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CACtB,CAAC;gBACF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;oBACnB,OAAO,EAAE,cAAc,MAAM,CAAC,EAAE,EAAE;oBAClC,QAAQ,EAAE,kBAAkB;oBAC5B,MAAM,EAAE,UAAU;iBACnB,CAAC,CAAC;gBACH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC;oBAC/B,OAAO,EAAE,cAAc,MAAM,CAAC,EAAE,EAAE;oBAClC,QAAQ,EAAE,WAAW;oBACrB,MAAM,EAAE,aAAa,KAAK,EAAE;iBAC7B,CAAC,CAAC;gBACH,iCAAiC;gBACjC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;gBACjG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YACrG,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;gBACtG,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC/D,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAC7D,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACxG,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;gBACxE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CACzB,MAAM,CAAC,gBAAgB,CAAC;oBACtB,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;oBAChD,UAAU,EAAE,WAAW;oBACvB,SAAS,EAAE,aAAa;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;gBACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;gBACvD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnD,oFAAoF;gBACpF,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;gBAC5E,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;gBACrG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5F,iBAAiB,CAClB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;gBACnG,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAChF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;gBACvF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACnD,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC9E,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;gBACjF,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvF,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;gBACrD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1F,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;gBAC9G,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtC,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAClF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACnF,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC3C,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACrF,mBAAmB,CACpB,CAAC;gBACF,mEAAmE;gBACnE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACrF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;gBACnG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAqB,WAAW,CAAC,CAAC;gBAC9E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;gBAChE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;gBACxE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;oBAChC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;oBACnB,WAAW,EAAE,CAAC,QAAQ,CAAC;iBACxB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;gBACtG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,mDAAmD,EAAE,GAAG,EAAE;YACjE,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;gBACxG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAClF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3C,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAE3F,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAEjE,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7F,iBAAiB,CAClB,CAAC;gBACF,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACjD,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC3F,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;gBACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpF,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjE,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACxF,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;gBACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACrF,iDAAiD;gBACjD,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC/F,mBAAmB,CACpB,CAAC;gBACF,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACjG,mBAAmB,CACpB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;gBACnG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAChG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpF,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACjD,sEAAsE;gBACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3B,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACtF,CAAC;gBACD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;qBAC9F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;qBACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;gBACrC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;gBAClF,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAChG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5F,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;gBAC7G,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE;oBAChC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;oBACnB,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;oBAClC,UAAU,EAAE,CAAC,UAAU,CAAC;iBACzB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACnF,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAChG,WAAW,CACZ,CAAC;gBACF,+EAA+E;gBAC/E,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACpG,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;gBAC3F,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAC/F,CAAC;gBACF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;gBAC1E,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC,CACtG,CAAC;gBACF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;gBAC5F,MAAM,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,CAAC,MAAM,QAAQ,CAAC,GAAG,wBAAwB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACpF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,6DAA6D,EAAE,GAAG,EAAE;YAC3E,EAAE,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;gBACpH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC/F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC;qBACzB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC;qBACjE,GAAG,EAAG,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;gBACjG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;gBACnH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpF,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,EAAE,CAC1F,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,EAAE,CAC7F,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvE,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAC1D,uFAAuF;gBACvF,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;qBAC1G,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;qBACrC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;gBACrC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;gBACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;oBAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;gBACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpF,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjE,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,EAAE,CAC3F,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,uEAAuE,EAAE,GAAG,EAAE;YACrF,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;gBACzG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC/F,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC1D,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACxC,2DAA2D;gBAC3D,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,SAAS,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC1F,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,SAAS,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,CAAC,CAAC,CAAC;YAEH,mFAAmF;YACnF,mFAAmF;YACnF,qFAAqF;YACrF,iEAAiE;YACjE,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE,CACvC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;iBAC1F,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YACpC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBACpC,EAAE,CAAC,0BAA0B,GAAG,+CAA+C,EAAE,KAAK,IAAI,EAAE;oBAC1F,MAAM,KAAK,GAAG,QAAQ,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBACtC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE;wBAC7C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;wBACnB,WAAW,EAAE,CAAC,QAAQ,CAAC;wBACvB,KAAK;wBACL,GAAG;qBACJ,CAAC,CACH,CAAC;oBACF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBAC3C,MAAM,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5C,CAAC,CAAC,CAAC;gBAEH,EAAE,CAAC,gCAAgC,GAAG,gCAAgC,EAAE,KAAK,IAAI,EAAE;oBACjF,MAAM,KAAK,GAAG,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;oBACvC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,EAAE;wBACnD,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;wBACnB,WAAW,EAAE,CAAC,QAAQ,CAAC;wBACvB,KAAK;wBACL,GAAG;wBACH,IAAI,EAAE,KAAK;qBACZ,CAAC,CAAC;oBACH,MAAM,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,CAAC,CAAC,CAAC;YACL,CAAC;YAED,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;gBAClG,MAAM,GAAG,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;gBAC3E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAA+B,gBAAgB,EAAE,KAAK,EAAE;oBACrF,cAAc,EAAE,GAAG;iBACpB,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,UAAU,wBAAwB,EAAE,CAAC,CAAC,CAAC;gBAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAA+B,gBAAgB,EAAE,KAAK,EAAE;oBACtF,cAAc,EAAE,GAAG;iBACpB,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,+BAA+B,eAAe,EAAE,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,CAAC;gBAC/C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACrE,6DAA6D;gBAC7D,MAAM,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;YACvB,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;gBAChG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/F,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAY,UAAU,EAAE;oBACjE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;oBACpB,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;YACnE,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;gBACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC5D,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;oBAC3B,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE,OAAO;iBACf,CAAC,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CACpF,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBACpF,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAQ,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,EAAE,CAC7F,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;gBAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC5D,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;oBAC3B,OAAO,EAAE,CAAC;iBACX,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACzF,8DAA8D;gBAC9D,MAAM,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;oBACvF,IAAI,EAAE,WAAW;oBACjB,YAAY,EAAE,MAAM,CAAC,EAAE;oBACvB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;gBAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9F,MAAM,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC1F,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtG,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;gBAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC5D,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC;oBAC3B,OAAO,EAAE,CAAC;iBACX,CAAC,CAAC;gBACH,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACjG,WAAW,CACZ,CAAC;gBACF,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;gBAC7F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACpF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,iBAAiB,CAClB,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;gBACrF,MAAM,CACJ,WAAW,CACT,MAAM,OAAO,CACX,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE;oBACvC,SAAS,EAAE,IAAI;oBACf,SAAS,EAAE,0BAAqC;oBAChD,OAAO,EAAE,CAAC;iBACX,CAAC,CACH,CACF,CACF,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBAC5B,MAAM,CACJ,WAAW,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAW,CAAC,CAAC,CAAC,CACxF,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,9 @@ export type { ScopeHostFixture, ScopeHostSuiteOptions } from './scope-host-suite
 export { permissionContractSuite } from './permission-suite.js';
 export { atomicContractSuite } from './atomic-suite.js';
 export { impersonationContractSuite } from './impersonation-suite.js';
+export { capabilityContractSuite } from './capability-suite.js';
+export { capabilityExpiryContractSuite } from './capability-expiry-suite.js';
+export type { CapabilityExpiryFixture } from './capability-expiry-suite.js';
 export { searchContractSuite } from './search-suite.js';
 export { entityVersionContractSuite } from './entity-version-suite.js';
 export { timelineContractSuite } from './timeline-suite.js';
@@ -10,6 +13,8 @@ export { concurrencyContractSuite } from './concurrency-suite.js';
 export { idempotencyContractSuite } from './idempotency-suite.js';
 export { listContractSuite } from './list-suite.js';
 export { scheduleContractSuite } from './schedule-suite.js';
+export { jobRunContractSuite } from './job-run-suite.js';
+export { systemSwitchContractSuite } from './system-switch-suite.js';
 export { inputParseContractSuite } from './input-parse-suite.js';
 export { spineGuardContractSuite } from './spine-guard-suite.js';
 export { grantExpiryContractSuite } from './grant-expiry-suite.js';
@@ -21,6 +26,6 @@ export { nodeOnlySuite, declaredNodeOnlySuite } from './node-only-suite.js';
 export type { NodeOnlyOptions } from './node-only-suite.js';
 export { declareEntityChecks, declareNodeOnly, assertNodeOnly } from './conformance.js';
 export type { ConformanceDeclaration, DrivenConformance, DeclaredNodeOnlyConformance, AssertedNodeOnlyConformance, } from './conformance.js';
-export { atomicMod, billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, permMod, scheduleMod, testMod, freshnessMod, searchMod, searchModManifest, listMod, listModManifest, parseMod, parseModManifest, } from './modules.js';
+export { atomicMod, billedMod, brokenMod, connectorMod, contractTestBareOps, contractTestInitialModules, contractTestModules, liveMod, liveModManifest, permMod, capMod, capModManifest, scheduleMod, jobsMod, testMod, freshnessMod, searchMod, searchModManifest, listMod, listModManifest, parseMod, parseModManifest, } from './modules.js';
 export { connectorCalls, connectorTestFetch, resetConnectorCalls, type ConnectorCall, } from './connector-fixture.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,OAAO,EACP,WAAW,EACX,OAAO,EACP,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,eAAe,EACf,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,KAAK,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACzG,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACxF,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,EACnB,OAAO,EACP,eAAe,EACf,OAAO,EACP,MAAM,EACN,cAAc,EACd,WAAW,EACX,OAAO,EACP,OAAO,EACP,YAAY,EACZ,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,eAAe,EACf,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC"}