@substrat-run/contracts 0.140.0 → 0.142.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/capability.d.ts +152 -5
- package/dist/capability.d.ts.map +1 -1
- package/dist/capability.js +93 -5
- package/dist/capability.js.map +1 -1
- package/dist/control-plane.d.ts +139 -19
- package/dist/control-plane.d.ts.map +1 -1
- package/dist/control-plane.js +76 -13
- package/dist/control-plane.js.map +1 -1
- package/dist/invocation-record.d.ts +1 -1
- package/dist/invocation-record.js +1 -1
- package/dist/kernel-events.d.ts.map +1 -1
- package/dist/kernel-events.js +2 -1
- package/dist/kernel-events.js.map +1 -1
- package/dist/operations.d.ts +2 -0
- package/dist/operations.d.ts.map +1 -1
- package/dist/operations.js +205 -0
- package/dist/operations.js.map +1 -1
- package/dist/tenancy.d.ts +8 -0
- package/dist/tenancy.d.ts.map +1 -1
- package/dist/tenancy.js +8 -0
- package/dist/tenancy.js.map +1 -1
- package/dist/wire-auth.d.ts +33 -0
- package/dist/wire-auth.d.ts.map +1 -0
- package/dist/wire-auth.js +67 -0
- package/dist/wire-auth.js.map +1 -0
- package/package.json +7 -2
package/dist/capability.d.ts
CHANGED
|
@@ -60,6 +60,7 @@ export declare const capabilityAuthority: z.ZodObject<{
|
|
|
60
60
|
}, z.core.$strip>;
|
|
61
61
|
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
62
62
|
operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
63
|
+
attachments: z.ZodOptional<z.ZodLiteral<"read">>;
|
|
63
64
|
}, z.core.$strip>;
|
|
64
65
|
export type CapabilityAuthority = z.infer<typeof capabilityAuthority>;
|
|
65
66
|
/**
|
|
@@ -77,6 +78,7 @@ export declare const capabilityMintInput: z.ZodObject<{
|
|
|
77
78
|
}, z.core.$strip>;
|
|
78
79
|
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
79
80
|
operations: z.ZodOptional<z.ZodArray<z.ZodString>>;
|
|
81
|
+
attachments: z.ZodOptional<z.ZodLiteral<"read">>;
|
|
80
82
|
expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
81
83
|
maxUses: z.ZodOptional<z.ZodNumber>;
|
|
82
84
|
label: z.ZodOptional<z.ZodString>;
|
|
@@ -87,11 +89,11 @@ export type CapabilityMintInput = z.infer<typeof capabilityMintInput>;
|
|
|
87
89
|
* exchanging it yields a principal instead of a session, the shape an owner claim link and
|
|
88
90
|
* a member invite are ("whoever opens this becomes that seat").
|
|
89
91
|
*
|
|
90
|
-
*
|
|
91
|
-
* —
|
|
92
|
-
*
|
|
93
|
-
* Expiry and a use limit are REQUIRED
|
|
94
|
-
* standing credential for a person.
|
|
92
|
+
* `become` is impersonation by another name — the holder acquires everything the principal
|
|
93
|
+
* holds — so module code never mints one. The platform mints this shape (an owner claim link);
|
|
94
|
+
* a PRINCIPAL mints one only through a host's bounded verb (a member invite,
|
|
95
|
+
* `principalBecomeCapabilityInput`, #1686). Expiry and a use limit are REQUIRED here: an
|
|
96
|
+
* unbounded platform `become` is a standing credential for a person.
|
|
95
97
|
*/
|
|
96
98
|
export declare const becomeCapabilityInput: z.ZodObject<{
|
|
97
99
|
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
@@ -100,6 +102,27 @@ export declare const becomeCapabilityInput: z.ZodObject<{
|
|
|
100
102
|
label: z.ZodOptional<z.ZodString>;
|
|
101
103
|
}, z.core.$strip>;
|
|
102
104
|
export type BecomeCapabilityInput = z.infer<typeof becomeCapabilityInput>;
|
|
105
|
+
/**
|
|
106
|
+
* What a PRINCIPAL may mint through a host's bounded verb (#1686) — a `become` capability
|
|
107
|
+
* whose minter is a person rather than the platform: the shape a member invite is.
|
|
108
|
+
*
|
|
109
|
+
* The bound is the host's, checked in the same scope task as the write: the minter must hold,
|
|
110
|
+
* at this node, every permission the target principal holds there, and every entity-narrowed
|
|
111
|
+
* grant the target holds must be one the minter can exercise on that entity too. Otherwise
|
|
112
|
+
* minting a `become` would hand someone more than the minter has — impersonation upward.
|
|
113
|
+
*
|
|
114
|
+
* `expiresAt` absent means no expiry, because a member invite has never had one; the use
|
|
115
|
+
* limit is still required, as on every `become`. The minter is not re-checked when the secret
|
|
116
|
+
* is exchanged: the target's authority was bounded when it was conferred and when this was
|
|
117
|
+
* minted, and withdrawing the invite (revoking this) is the lever.
|
|
118
|
+
*/
|
|
119
|
+
export declare const principalBecomeCapabilityInput: z.ZodObject<{
|
|
120
|
+
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
121
|
+
expiresAt: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
122
|
+
maxUses: z.ZodNumber;
|
|
123
|
+
label: z.ZodOptional<z.ZodString>;
|
|
124
|
+
}, z.core.$strip>;
|
|
125
|
+
export type PrincipalBecomeCapabilityInput = z.infer<typeof principalBecomeCapabilityInput>;
|
|
103
126
|
/**
|
|
104
127
|
* Who minted or revoked a capability: the principal whose operation did it, or a platform
|
|
105
128
|
* actor through `HostAdmin`. Two members rather than a principal with a flag, because an
|
|
@@ -130,6 +153,9 @@ export declare const capabilityRecord: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
|
130
153
|
revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
|
|
131
154
|
platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
|
|
132
155
|
}, z.core.$strip>]>>;
|
|
156
|
+
revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
|
|
157
|
+
"holdings-changed": "holdings-changed";
|
|
158
|
+
}>>>;
|
|
133
159
|
mode: z.ZodLiteral<"act">;
|
|
134
160
|
entity: z.ZodObject<{
|
|
135
161
|
entityType: z.ZodString;
|
|
@@ -137,6 +163,7 @@ export declare const capabilityRecord: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
|
137
163
|
}, z.core.$strip>;
|
|
138
164
|
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
139
165
|
operations: z.ZodNullable<z.ZodArray<z.ZodString>>;
|
|
166
|
+
attachments: z.ZodOptional<z.ZodNullable<z.ZodLiteral<"read">>>;
|
|
140
167
|
}, z.core.$strip>, z.ZodObject<{
|
|
141
168
|
id: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
|
|
142
169
|
label: z.ZodNullable<z.ZodString>;
|
|
@@ -152,6 +179,9 @@ export declare const capabilityRecord: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
|
152
179
|
revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
|
|
153
180
|
platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
|
|
154
181
|
}, z.core.$strip>]>>;
|
|
182
|
+
revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
|
|
183
|
+
"holdings-changed": "holdings-changed";
|
|
184
|
+
}>>>;
|
|
155
185
|
mode: z.ZodLiteral<"become">;
|
|
156
186
|
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
157
187
|
}, z.core.$strip>], "mode">;
|
|
@@ -166,6 +196,100 @@ export declare const mintedCapability: z.ZodObject<{
|
|
|
166
196
|
expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
167
197
|
}, z.core.$strip>;
|
|
168
198
|
export type MintedCapability = z.infer<typeof mintedCapability>;
|
|
199
|
+
/**
|
|
200
|
+
* Why a host's bounded `become` mint refused (#1686), with nothing written:
|
|
201
|
+
* - `coverage` — what the minter lacks of what the target holds;
|
|
202
|
+
* - `target-holds-nothing` — the target holds nothing at the node. Its own answer because a
|
|
203
|
+
* `Coverage` refusal must name a missing key and there is none: an empty set would cover
|
|
204
|
+
* trivially, and the link would yield whatever that principal is granted later;
|
|
205
|
+
* - `target-already-claimed` — some `become` capability for the target has already been
|
|
206
|
+
* exchanged in this scope: somebody already is that principal, and a second link would let a
|
|
207
|
+
* second person become them too. A principal-minted `become` is for a seat nobody has taken.
|
|
208
|
+
*/
|
|
209
|
+
export declare const becomeMintRefusal: z.ZodUnion<readonly [z.ZodObject<{
|
|
210
|
+
ok: z.ZodLiteral<false>;
|
|
211
|
+
coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
212
|
+
covered: z.ZodLiteral<true>;
|
|
213
|
+
missing: z.ZodTuple<[], null>;
|
|
214
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
215
|
+
covered: z.ZodLiteral<false>;
|
|
216
|
+
missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
217
|
+
}, z.core.$strip>], "covered">;
|
|
218
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
219
|
+
ok: z.ZodLiteral<false>;
|
|
220
|
+
refused: z.ZodEnum<{
|
|
221
|
+
"target-already-claimed": "target-already-claimed";
|
|
222
|
+
"target-holds-nothing": "target-holds-nothing";
|
|
223
|
+
}>;
|
|
224
|
+
}, z.core.$strip>]>;
|
|
225
|
+
export type BecomeMintRefusal = z.infer<typeof becomeMintRefusal>;
|
|
226
|
+
/** What a host's bounded `become` mint answers (#1686): the minted capability, or the refusal. */
|
|
227
|
+
export declare const boundedBecomeMint: z.ZodUnion<readonly [z.ZodObject<{
|
|
228
|
+
ok: z.ZodLiteral<true>;
|
|
229
|
+
minted: z.ZodObject<{
|
|
230
|
+
id: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
|
|
231
|
+
secret: z.ZodString;
|
|
232
|
+
expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
233
|
+
}, z.core.$strip>;
|
|
234
|
+
}, z.core.$strip>, z.ZodUnion<readonly [z.ZodObject<{
|
|
235
|
+
ok: z.ZodLiteral<false>;
|
|
236
|
+
coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
237
|
+
covered: z.ZodLiteral<true>;
|
|
238
|
+
missing: z.ZodTuple<[], null>;
|
|
239
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
240
|
+
covered: z.ZodLiteral<false>;
|
|
241
|
+
missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
242
|
+
}, z.core.$strip>], "covered">;
|
|
243
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
244
|
+
ok: z.ZodLiteral<false>;
|
|
245
|
+
refused: z.ZodEnum<{
|
|
246
|
+
"target-already-claimed": "target-already-claimed";
|
|
247
|
+
"target-holds-nothing": "target-holds-nothing";
|
|
248
|
+
}>;
|
|
249
|
+
}, z.core.$strip>]>]>;
|
|
250
|
+
export type BoundedBecomeMint = z.infer<typeof boundedBecomeMint>;
|
|
251
|
+
/**
|
|
252
|
+
* What a host's bounded `become` revoke answers (#1686): whether this call revoked it, or the
|
|
253
|
+
* coverage that refused the revoker — who must be the link's minter, or hold everything its
|
|
254
|
+
* principal holds now (whoever could have minted it). A refusal writes nothing.
|
|
255
|
+
*/
|
|
256
|
+
export declare const boundedBecomeRevoke: z.ZodUnion<readonly [z.ZodObject<{
|
|
257
|
+
ok: z.ZodLiteral<true>;
|
|
258
|
+
revoked: z.ZodBoolean;
|
|
259
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
260
|
+
ok: z.ZodLiteral<false>;
|
|
261
|
+
coverage: z.ZodDiscriminatedUnion<[z.ZodObject<{
|
|
262
|
+
covered: z.ZodLiteral<true>;
|
|
263
|
+
missing: z.ZodTuple<[], null>;
|
|
264
|
+
}, z.core.$strip>, z.ZodObject<{
|
|
265
|
+
covered: z.ZodLiteral<false>;
|
|
266
|
+
missing: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
267
|
+
}, z.core.$strip>], "covered">;
|
|
268
|
+
}, z.core.$strip>]>;
|
|
269
|
+
export type BoundedBecomeRevoke = z.infer<typeof boundedBecomeRevoke>;
|
|
270
|
+
/**
|
|
271
|
+
* Where a `become` link stands (#1686) — what a pending-invite list shows beside each invite, so
|
|
272
|
+
* a link the kernel revoked is never shown as open. `used`: exchanged up to its limit. A
|
|
273
|
+
* capability the scope does not hold reads as `revoked`.
|
|
274
|
+
*/
|
|
275
|
+
export declare const becomeLinkState: z.ZodObject<{
|
|
276
|
+
state: z.ZodEnum<{
|
|
277
|
+
expired: "expired";
|
|
278
|
+
open: "open";
|
|
279
|
+
revoked: "revoked";
|
|
280
|
+
used: "used";
|
|
281
|
+
}>;
|
|
282
|
+
reason: z.ZodNullable<z.ZodEnum<{
|
|
283
|
+
"holdings-changed": "holdings-changed";
|
|
284
|
+
}>>;
|
|
285
|
+
}, z.core.$strip>;
|
|
286
|
+
export type BecomeLinkState = z.infer<typeof becomeLinkState>;
|
|
287
|
+
/**
|
|
288
|
+
* The most links one `becomeLinkStates` call may name — the cap other id-list reads take
|
|
289
|
+
* (`CONNECT_LINK_LIST_MAX_IDS`, a grant-scoped read's maximum). Over it the read refuses rather
|
|
290
|
+
* than truncate; a list longer than this asks in pages of it.
|
|
291
|
+
*/
|
|
292
|
+
export declare const BECOME_LINK_STATES_MAX_IDS = 100;
|
|
169
293
|
/**
|
|
170
294
|
* What an exchange yields: a session to act as the capability (`act`), or the principal
|
|
171
295
|
* the holder becomes (`become`). A refused exchange — an unknown, expired, revoked or
|
|
@@ -227,6 +351,9 @@ export declare const capabilityPage: z.ZodObject<{
|
|
|
227
351
|
revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
|
|
228
352
|
platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
|
|
229
353
|
}, z.core.$strip>]>>;
|
|
354
|
+
revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
|
|
355
|
+
"holdings-changed": "holdings-changed";
|
|
356
|
+
}>>>;
|
|
230
357
|
mode: z.ZodLiteral<"act">;
|
|
231
358
|
entity: z.ZodObject<{
|
|
232
359
|
entityType: z.ZodString;
|
|
@@ -234,6 +361,7 @@ export declare const capabilityPage: z.ZodObject<{
|
|
|
234
361
|
}, z.core.$strip>;
|
|
235
362
|
permissions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PermissionKey", "out">>;
|
|
236
363
|
operations: z.ZodNullable<z.ZodArray<z.ZodString>>;
|
|
364
|
+
attachments: z.ZodOptional<z.ZodNullable<z.ZodLiteral<"read">>>;
|
|
237
365
|
}, z.core.$strip>, z.ZodObject<{
|
|
238
366
|
id: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
|
|
239
367
|
label: z.ZodNullable<z.ZodString>;
|
|
@@ -249,6 +377,9 @@ export declare const capabilityPage: z.ZodObject<{
|
|
|
249
377
|
revokedBy: z.ZodNullable<z.ZodUnion<readonly [z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">, z.ZodObject<{
|
|
250
378
|
platform: z.core.$ZodBranded<z.ZodString, "PlatformActorId", "out">;
|
|
251
379
|
}, z.core.$strip>]>>;
|
|
380
|
+
revokedReason: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
|
|
381
|
+
"holdings-changed": "holdings-changed";
|
|
382
|
+
}>>>;
|
|
252
383
|
mode: z.ZodLiteral<"become">;
|
|
253
384
|
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
254
385
|
}, z.core.$strip>], "mode">>;
|
|
@@ -315,6 +446,13 @@ export declare const CAPABILITY_REVOKED = "capability.revoked";
|
|
|
315
446
|
* capability itself (`capability:<id>`) for `become`; actor: `{ capability }`.
|
|
316
447
|
*/
|
|
317
448
|
export declare const CAPABILITY_EXERCISED = "capability.exercised";
|
|
449
|
+
/**
|
|
450
|
+
* A principal minted a `become` capability through a host's bounded verb (#1686) — a member
|
|
451
|
+
* invite. Entity: the capability itself (`capability:<id>`), as on a `become`'s
|
|
452
|
+
* `capability.exercised`; actor: the minter. Its own type rather than `capability.minted`,
|
|
453
|
+
* whose payload is an `act` capability's (an entity and its keys) and is frozen.
|
|
454
|
+
*/
|
|
455
|
+
export declare const CAPABILITY_BECOME_MINTED = "capability.become-minted";
|
|
318
456
|
export declare const capabilityMintedPayload: z.ZodObject<{
|
|
319
457
|
capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
|
|
320
458
|
entity: z.ZodObject<{
|
|
@@ -329,6 +467,15 @@ export declare const capabilityMintedPayload: z.ZodObject<{
|
|
|
329
467
|
mintedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
330
468
|
}, z.core.$strip>;
|
|
331
469
|
export type CapabilityMintedPayload = z.infer<typeof capabilityMintedPayload>;
|
|
470
|
+
export declare const capabilityBecomeMintedPayload: z.ZodObject<{
|
|
471
|
+
capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
|
|
472
|
+
principal: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
473
|
+
expiresAt: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "Instant", "out">>;
|
|
474
|
+
maxUses: z.ZodNumber;
|
|
475
|
+
label: z.ZodNullable<z.ZodString>;
|
|
476
|
+
mintedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
|
|
477
|
+
}, z.core.$strip>;
|
|
478
|
+
export type CapabilityBecomeMintedPayload = z.infer<typeof capabilityBecomeMintedPayload>;
|
|
332
479
|
export declare const capabilityRevokedPayload: z.ZodObject<{
|
|
333
480
|
capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
|
|
334
481
|
entity: z.ZodObject<{
|
package/dist/capability.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;
|
|
1
|
+
{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,eAAO,MAAM,wBAAwB,WAAW,CAAC;AACjD,kEAAkE;AAClE,eAAO,MAAM,yBAAyB,WAAW,CAAC;AAClD,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,QAAmB,CAAC;AAC1D,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAE5C,gGAAgG;AAChG,eAAO,MAAM,eAAe,aAAoC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B;;;;;iBAKzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;mBAAkE,CAAC;AAChG,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAwBhE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAgB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;mBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,kGAAkG;AAClG,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;qBAA4F,CAAC;AAC3H,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;mBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;2BAa7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;iBAK3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC,EAC9E,GAAG,EAAE,MAAM,GACV,gBAAgB,CAKlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAUjF;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAGjE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;GAyB9B,CAAC;AASL,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAC3D;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,6BAA6B;;;;;;;iBAQxC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,eAAO,MAAM,wBAAwB;;;;;;;iBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,0BAA0B;;;;;;;;;;iBAUrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}
|
package/dist/capability.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
2
|
import { entityRef } from './events.js';
|
|
3
3
|
import { capabilityId, instant, permissionKey, platformActorId, principalId } from './ids.js';
|
|
4
|
+
import { coverage } from './permission.js';
|
|
4
5
|
/**
|
|
5
6
|
* Capabilities (#1672) — authority carried by a SECRET rather than held by a principal.
|
|
6
7
|
*
|
|
@@ -59,6 +60,8 @@ export const capabilityAuthority = z.object({
|
|
|
59
60
|
entity: entityRef,
|
|
60
61
|
permissions: z.array(permissionKey).min(1).max(CAPABILITY_PERMISSIONS_MAX),
|
|
61
62
|
operations: z.array(z.string().min(1)).min(1).max(CAPABILITY_OPERATIONS_MAX).optional(),
|
|
63
|
+
/** Explicitly allow attachment reads; this never widens permissions or operations. */
|
|
64
|
+
attachments: z.literal('read').optional(),
|
|
62
65
|
});
|
|
63
66
|
/**
|
|
64
67
|
* What a MODULE may mint (`ctx.capabilities.mint`) — always an `act` capability.
|
|
@@ -78,11 +81,11 @@ export const capabilityMintInput = capabilityAuthority.extend({
|
|
|
78
81
|
* exchanging it yields a principal instead of a session, the shape an owner claim link and
|
|
79
82
|
* a member invite are ("whoever opens this becomes that seat").
|
|
80
83
|
*
|
|
81
|
-
*
|
|
82
|
-
* —
|
|
83
|
-
*
|
|
84
|
-
* Expiry and a use limit are REQUIRED
|
|
85
|
-
* standing credential for a person.
|
|
84
|
+
* `become` is impersonation by another name — the holder acquires everything the principal
|
|
85
|
+
* holds — so module code never mints one. The platform mints this shape (an owner claim link);
|
|
86
|
+
* a PRINCIPAL mints one only through a host's bounded verb (a member invite,
|
|
87
|
+
* `principalBecomeCapabilityInput`, #1686). Expiry and a use limit are REQUIRED here: an
|
|
88
|
+
* unbounded platform `become` is a standing credential for a person.
|
|
86
89
|
*/
|
|
87
90
|
export const becomeCapabilityInput = z.object({
|
|
88
91
|
principal: principalId,
|
|
@@ -90,6 +93,26 @@ export const becomeCapabilityInput = z.object({
|
|
|
90
93
|
maxUses: z.number().int().positive(),
|
|
91
94
|
label: capabilityLabel.optional(),
|
|
92
95
|
});
|
|
96
|
+
/**
|
|
97
|
+
* What a PRINCIPAL may mint through a host's bounded verb (#1686) — a `become` capability
|
|
98
|
+
* whose minter is a person rather than the platform: the shape a member invite is.
|
|
99
|
+
*
|
|
100
|
+
* The bound is the host's, checked in the same scope task as the write: the minter must hold,
|
|
101
|
+
* at this node, every permission the target principal holds there, and every entity-narrowed
|
|
102
|
+
* grant the target holds must be one the minter can exercise on that entity too. Otherwise
|
|
103
|
+
* minting a `become` would hand someone more than the minter has — impersonation upward.
|
|
104
|
+
*
|
|
105
|
+
* `expiresAt` absent means no expiry, because a member invite has never had one; the use
|
|
106
|
+
* limit is still required, as on every `become`. The minter is not re-checked when the secret
|
|
107
|
+
* is exchanged: the target's authority was bounded when it was conferred and when this was
|
|
108
|
+
* minted, and withdrawing the invite (revoking this) is the lever.
|
|
109
|
+
*/
|
|
110
|
+
export const principalBecomeCapabilityInput = z.object({
|
|
111
|
+
principal: principalId,
|
|
112
|
+
expiresAt: instant.optional(),
|
|
113
|
+
maxUses: z.number().int().positive(),
|
|
114
|
+
label: capabilityLabel.optional(),
|
|
115
|
+
});
|
|
93
116
|
/**
|
|
94
117
|
* Who minted or revoked a capability: the principal whose operation did it, or a platform
|
|
95
118
|
* actor through `HostAdmin`. Two members rather than a principal with a flag, because an
|
|
@@ -111,6 +134,12 @@ const capabilityRecordCommon = {
|
|
|
111
134
|
lastUsedAt: instant.nullable(),
|
|
112
135
|
revokedAt: instant.nullable(),
|
|
113
136
|
revokedBy: capabilityAuthor.nullable(),
|
|
137
|
+
/**
|
|
138
|
+
* Why the kernel itself revoked it, when it did (#1686): `holdings-changed` — a principal-minted
|
|
139
|
+
* `become` whose principal's holdings changed between mint and exchange. Null for a revoke a
|
|
140
|
+
* person or the platform made, and for a live capability. Absent from a host that predates it.
|
|
141
|
+
*/
|
|
142
|
+
revokedReason: z.enum(['holdings-changed']).nullable().optional(),
|
|
114
143
|
};
|
|
115
144
|
/**
|
|
116
145
|
* A capability as the directory holds it — what `ctx.capabilities.list` returns. Carries
|
|
@@ -125,6 +154,8 @@ export const capabilityRecord = z.discriminatedUnion('mode', [
|
|
|
125
154
|
permissions: z.array(permissionKey).min(1),
|
|
126
155
|
/** Null = any operation the keys allow. */
|
|
127
156
|
operations: z.array(z.string().min(1)).nullable(),
|
|
157
|
+
/** Absent/null = attachment readers remain refused when `operations` is narrowed. */
|
|
158
|
+
attachments: z.literal('read').nullable().optional(),
|
|
128
159
|
}),
|
|
129
160
|
z.object({
|
|
130
161
|
mode: z.literal('become'),
|
|
@@ -141,6 +172,47 @@ export const mintedCapability = z.object({
|
|
|
141
172
|
secret: z.string().startsWith(CAPABILITY_SECRET_PREFIX),
|
|
142
173
|
expiresAt: instant.nullable(),
|
|
143
174
|
});
|
|
175
|
+
/**
|
|
176
|
+
* Why a host's bounded `become` mint refused (#1686), with nothing written:
|
|
177
|
+
* - `coverage` — what the minter lacks of what the target holds;
|
|
178
|
+
* - `target-holds-nothing` — the target holds nothing at the node. Its own answer because a
|
|
179
|
+
* `Coverage` refusal must name a missing key and there is none: an empty set would cover
|
|
180
|
+
* trivially, and the link would yield whatever that principal is granted later;
|
|
181
|
+
* - `target-already-claimed` — some `become` capability for the target has already been
|
|
182
|
+
* exchanged in this scope: somebody already is that principal, and a second link would let a
|
|
183
|
+
* second person become them too. A principal-minted `become` is for a seat nobody has taken.
|
|
184
|
+
*/
|
|
185
|
+
export const becomeMintRefusal = z.union([
|
|
186
|
+
z.object({ ok: z.literal(false), coverage }),
|
|
187
|
+
z.object({ ok: z.literal(false), refused: z.enum(['target-holds-nothing', 'target-already-claimed']) }),
|
|
188
|
+
]);
|
|
189
|
+
/** What a host's bounded `become` mint answers (#1686): the minted capability, or the refusal. */
|
|
190
|
+
export const boundedBecomeMint = z.union([z.object({ ok: z.literal(true), minted: mintedCapability }), becomeMintRefusal]);
|
|
191
|
+
/**
|
|
192
|
+
* What a host's bounded `become` revoke answers (#1686): whether this call revoked it, or the
|
|
193
|
+
* coverage that refused the revoker — who must be the link's minter, or hold everything its
|
|
194
|
+
* principal holds now (whoever could have minted it). A refusal writes nothing.
|
|
195
|
+
*/
|
|
196
|
+
export const boundedBecomeRevoke = z.union([
|
|
197
|
+
z.object({ ok: z.literal(true), revoked: z.boolean() }),
|
|
198
|
+
z.object({ ok: z.literal(false), coverage }),
|
|
199
|
+
]);
|
|
200
|
+
/**
|
|
201
|
+
* Where a `become` link stands (#1686) — what a pending-invite list shows beside each invite, so
|
|
202
|
+
* a link the kernel revoked is never shown as open. `used`: exchanged up to its limit. A
|
|
203
|
+
* capability the scope does not hold reads as `revoked`.
|
|
204
|
+
*/
|
|
205
|
+
export const becomeLinkState = z.object({
|
|
206
|
+
state: z.enum(['open', 'used', 'revoked', 'expired']),
|
|
207
|
+
/** Why the kernel revoked it, when it did; null otherwise. */
|
|
208
|
+
reason: z.enum(['holdings-changed']).nullable(),
|
|
209
|
+
});
|
|
210
|
+
/**
|
|
211
|
+
* The most links one `becomeLinkStates` call may name — the cap other id-list reads take
|
|
212
|
+
* (`CONNECT_LINK_LIST_MAX_IDS`, a grant-scoped read's maximum). Over it the read refuses rather
|
|
213
|
+
* than truncate; a list longer than this asks in pages of it.
|
|
214
|
+
*/
|
|
215
|
+
export const BECOME_LINK_STATES_MAX_IDS = 100;
|
|
144
216
|
/**
|
|
145
217
|
* What an exchange yields: a session to act as the capability (`act`), or the principal
|
|
146
218
|
* the holder becomes (`become`). A refused exchange — an unknown, expired, revoked or
|
|
@@ -270,6 +342,13 @@ export const CAPABILITY_REVOKED = 'capability.revoked';
|
|
|
270
342
|
* capability itself (`capability:<id>`) for `become`; actor: `{ capability }`.
|
|
271
343
|
*/
|
|
272
344
|
export const CAPABILITY_EXERCISED = 'capability.exercised';
|
|
345
|
+
/**
|
|
346
|
+
* A principal minted a `become` capability through a host's bounded verb (#1686) — a member
|
|
347
|
+
* invite. Entity: the capability itself (`capability:<id>`), as on a `become`'s
|
|
348
|
+
* `capability.exercised`; actor: the minter. Its own type rather than `capability.minted`,
|
|
349
|
+
* whose payload is an `act` capability's (an entity and its keys) and is frozen.
|
|
350
|
+
*/
|
|
351
|
+
export const CAPABILITY_BECOME_MINTED = 'capability.become-minted';
|
|
273
352
|
export const capabilityMintedPayload = z.object({
|
|
274
353
|
capabilityId,
|
|
275
354
|
entity: entityRef,
|
|
@@ -280,6 +359,15 @@ export const capabilityMintedPayload = z.object({
|
|
|
280
359
|
label: capabilityLabel.nullable(),
|
|
281
360
|
mintedBy: principalId,
|
|
282
361
|
});
|
|
362
|
+
export const capabilityBecomeMintedPayload = z.object({
|
|
363
|
+
capabilityId,
|
|
364
|
+
/** The principal whoever exchanges the secret becomes. */
|
|
365
|
+
principal: principalId,
|
|
366
|
+
expiresAt: instant.nullable(),
|
|
367
|
+
maxUses: z.number().int().positive(),
|
|
368
|
+
label: capabilityLabel.nullable(),
|
|
369
|
+
mintedBy: principalId,
|
|
370
|
+
});
|
|
283
371
|
export const capabilityRevokedPayload = z.object({
|
|
284
372
|
capabilityId,
|
|
285
373
|
entity: entityRef,
|
package/dist/capability.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;
|
|
1
|
+
{"version":3,"file":"capability.js","sourceRoot":"","sources":["../src/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,QAAQ,CAAC;AACjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC;AAClD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAC1D,gFAAgF;AAChF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAE5C,gGAAgG;AAChG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IACvF,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO;IAClB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC;AAGhG,MAAM,sBAAsB,GAAG;IAC7B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,gBAAgB;IAC1B,QAAQ,EAAE,OAAO;IACjB,4BAA4B;IAC5B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,kCAAkC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,+CAA+C;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACpC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,SAAS,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACtC;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClE,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,GAAG,sBAAsB;QACzB,MAAM,EAAE,SAAS;QACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,2CAA2C;QAC3C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,qFAAqF;QACrF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrD,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,GAAG,sBAAsB;QACzB,SAAS,EAAE,WAAW;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,YAAY;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC;IACvD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC;IACvC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5C,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC;CACxG,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAG3H;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IACvD,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC7C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACrD,8DAA8D;IAC9D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC7D,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,YAAY;QACZ,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC;QAC9D,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,SAAS;KAClB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,YAAY;QACZ,SAAS,EAAE,WAAW;KACvB,CAAC;CACH,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAClC,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAaH,MAAM,UAAU,gBAAgB,CAC9B,MAA8E,EAC9E,GAAW;IAEX,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,MAAM,EAAE,CAAC;QACnB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,EAAE,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,MAAM;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,MAAyB;IACvD,MAAM,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IACxG,CAAC;AACH,CAAC,CAAC;KACD,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC;QACxC,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;YACxD,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpH,OAAO,CAAC,CAAC,KAAK,CAAC;AACjB,CAAC,CAAC,CAAC;AAEL,8EAA8E;AAC9E,+EAA+E;AAC/E,mFAAmF;AACnF,oFAAoF;AACpF,oCAAoC;AACpC,8EAA8E;AAE9E,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAC3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,YAAY;IACZ,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,YAAY;IACZ,0DAA0D;IAC1D,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,WAAW;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY;IACZ,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,WAAW;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,YAAY;IACZ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/B,qCAAqC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,yFAAyF;IACzF,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE;IACpC,iEAAiE;IACjE,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC"}
|