@synoikia/core 0.5.2 → 0.7.0

package/dist/gate/match.d.ts

@@ -3,8 +3,8 @@ import { z } from 'zod';
 export declare const ParamConditionSchema: z.ZodObject<{
     field: z.ZodString;
     op: z.ZodEnum<{
-        any: "any";
         in: "in";
+        any: "any";
         eq: "eq";
         prefix: "prefix";
         range: "range";
@@ -12,11 +12,7 @@ export declare const ParamConditionSchema: z.ZodObject<{
     }>;
     value: z.ZodOptional<z.ZodUnknown>;
 }, z.core.$strip>;
-/**
- * Selects resolved targets by id and by the scope values the plugin declares (design §3.4). Every
- * target must match: its id is in `ids` (when given) and, for each key in `scopes`, its value for that
- * scope is one of the listed values.
- */
+/** Selects resolved targets by id and declared scope values; every target must match (design §3.2). */
 export declare const TargetConditionSchema: z.ZodObject<{
     field: z.ZodLiteral<"$targets">;
     ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -29,8 +25,8 @@ export declare const MatchSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
 }, z.core.$strict>, z.ZodObject<{
     field: z.ZodString;
     op: z.ZodEnum<{
-        any: "any";
         in: "in";
+        any: "any";
         eq: "eq";
         prefix: "prefix";
         range: "range";
@@ -41,12 +37,8 @@ export declare const MatchSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
 export type MatchCondition = z.infer<typeof MatchSchema>[number];
 /** RFC 6901 JSON pointer lookup; returns MISSING instead of undefined so `null` values still count. */
 export declare function getPointer(doc: unknown, pointer: string): unknown;
-/**
- * Whether every parameter is covered by some condition: a condition on a path covers everything under
- * it; an object or array only partly covered has each of its keys (or indexes: `/0/name`) checked in
- * turn. Nothing (or `{}` / `[]`) is covered. Arrays matter for positional APIs, whose
- * params are `[{ name, … }]`.
- */
+/** Whether every parameter is covered by a condition: a path covers everything under it; partly covered
+ * objects and arrays are checked key by key. */
 export declare function coversAllParams(match: readonly MatchCondition[], params: unknown, 
 /** Extra covered pointers, e.g. the raw target a `$targets` condition stands for (design §3.4). */
 alsoCovered?: readonly string[]): boolean;

package/dist/gate/match.js

@@ -1,16 +1,8 @@
 import { MATCH_OPS } from '@synoikia/plugin-sdk';
 import { z } from 'zod';
 import { canonicalJson } from './canonical.js';
-/**
- * Pre-approval `match` evaluator (design §5.2). A rule's match is a list of conditions that must all
- * hold. It fails closed: a missing field, a type mismatch or zero resolved targets means "no match",
- * which only ever sends the call to a human.
- *
- * Matching is **strict**: every parameter of the call must be covered by a condition. A parameter the
- * rule doesn't mention must be absent, unless the rule accepts it with `{ field, op: 'any' }` (`field: ''`
- * accepts all parameters). Otherwise a rule for one field would also approve whatever else the model
- * chose to send (a quota, an ACL, encryption options).
- */
+/** Pre-approval `match` evaluator (design §5.2): all conditions must hold, failing closed. Matching is
+ * strict: every parameter must be covered, or accepted with `op: 'any'`. */
 const PARAM_OPS = [...MATCH_OPS, 'any'];
 export const ParamConditionSchema = z
     .object({
@@ -19,11 +11,7 @@ export const ParamConditionSchema = z
     value: z.unknown().optional(),
 })
     .refine((c) => c.op === 'any' || c.field !== '', 'only "any" can apply to all parameters');
-/**
- * Selects resolved targets by id and by the scope values the plugin declares (design §3.4). Every
- * target must match: its id is in `ids` (when given) and, for each key in `scopes`, its value for that
- * scope is one of the listed values.
- */
+/** Selects resolved targets by id and declared scope values; every target must match (design §3.2). */
 export const TargetConditionSchema = z
     .object({
     field: z.literal('$targets'),
@@ -98,12 +86,8 @@ function targetMatches(target, c) {
     return true;
 }
 const escapePointer = (key) => key.replace(/~/g, '~0').replace(/\//g, '~1');
-/**
- * Whether every parameter is covered by some condition: a condition on a path covers everything under
- * it; an object or array only partly covered has each of its keys (or indexes: `/0/name`) checked in
- * turn. Nothing (or `{}` / `[]`) is covered. Arrays matter for positional APIs, whose
- * params are `[{ name, … }]`.
- */
+/** Whether every parameter is covered by a condition: a path covers everything under it; partly covered
+ * objects and arrays are checked key by key. */
 export function coversAllParams(match, params, 
 /** Extra covered pointers, e.g. the raw target a `$targets` condition stands for (design §3.4). */
 alsoCovered = []) {

package/dist/gate/match.js.map

@@ -1 +1 @@
-{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/gate/match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;;GASG;AAEH,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,CAAU,CAAC;AAEjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC9D,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,EAAE,wCAAwC,CAAC,CAAC;AAE7F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClF,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;AAElH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAG3F,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAElC,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,OAAe;IACtD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAC/B,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;QAC/G,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAe,EAAE,EAAU,EAAE,QAAiB;IAClE,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IAC3D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3D,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,QAAQ;YACX,sGAAsG;YACtG,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;gBAC1B,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,QAAQ,KAAK,EAAE;gBACf,CAAC,MAAM,KAAK,QAAQ;oBAClB,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAChG,CAAC;QACJ,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAqC,CAAC;YAC1E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM;YACT,OAAO,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC;QAC5D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB,EAAE,CAAwC;IACrF,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAgC,EAChC,MAAe;AACf,mGAAmG;AACnG,cAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,IAAY,EAAW,EAAE;QACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,EAAE,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAC5B,KAAgC,EAChC,IAA6D;IAE7D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,CAA0C,CAAC;YACtD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,CAAyC,CAAC;QACrD,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAgC,EAChC,IAA6D;IAE7D,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/gate/match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;4EAC4E;AAE5E,MAAM,SAAS,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,CAAU,CAAC;AAEjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC9D,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACrB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,EAAE,wCAAwC,CAAC,CAAC;AAE7F,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClF,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,8CAA8C,CAAC,CAAC;AAElH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;AAG3F,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;AAElC,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,OAAe;IACtD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAC/B,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;QAC/G,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,MAAe,EAAE,EAAU,EAAE,QAAiB;IAClE,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IAC3D,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACrC,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,IAAI;YACP,OAAO,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3D,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,QAAQ;YACX,sGAAsG;YACtG,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;gBAC1B,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,QAAQ,KAAK,EAAE;gBACf,CAAC,MAAM,KAAK,QAAQ;oBAClB,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAChG,CAAC;QACJ,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAqC,CAAC;YAC1E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,GAAG,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,MAAM;YACT,OAAO,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC;QAC5D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB,EAAE,CAAwC;IACrF,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAEpF;gDACgD;AAChD,MAAM,UAAU,eAAe,CAC7B,KAAgC,EAChC,MAAe;AACf,mGAAmG;AACnG,cAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,KAAc,EAAE,IAAY,EAAW,EAAE;QACxD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,EAAE,CAAC;QAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAC5B,KAAgC,EAChC,IAA6D;IAE7D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,CAA0C,CAAC;YACtD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,CAAyC,CAAC;QACrD,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,KAAgC,EAChC,IAA6D;IAE7D,OAAO,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC"}

package/dist/gate/pipeline.d.ts

@@ -1,5 +1,7 @@
 import type { Manifest } from '@synoikia/plugin-sdk';
-import type { ApprovalService, ClientPrompts } from '../approvals/service.js';
+import type { SessionGrantService } from '../approvals/grants.js';
+import type { ExecutionRegistry } from '../runtime/executions.js';
+import type { ApprovalService, ClientPrompts, ParkHook } from '../approvals/service.js';
 import type { Db } from '../db/index.js';
 import type { AccessPrincipal } from './access.js';
 import type { InstanceSettings } from '../instances/settings.js';
@@ -7,23 +9,25 @@ import type { PluginProcess } from '../plugins/process.js';
 import type { Binding } from '../sandbox/index.js';
 import type { SlidingWindowLimiter } from './rate-limit.js';
 import type { Redactor } from './redact.js';
-/**
- * The permission gate (design §5.2): the only path from sandboxed code to a plugin's `invoke`.
- *
- *   resolveOperation → attestation → access level → resolveTargets → prepareWrite
- *   → [level ask: pre-approval rule (never for locked) → human approval] → invoke → redact → audit
- *
- * Reads run straight away; acknowledged writes at level `write` are auto-approved.
- *
- * Every branch, including every rejection, writes one `call` audit event. Calls within one
- * `execute` run strictly one at a time, so a pending approval blocks the whole script.
- */
+/** The permission gate (design §5.2), the only path from sandboxed code to `invoke`: resolve → attest →
+ * access → targets → prepareWrite → [grant | rule | human] → invoke → redact → audit (every branch audited). */
 export interface GateDeps {
     db: Db;
     approvals: ApprovalService;
     limiter: SlidingWindowLimiter;
     attestationKey: Buffer;
     now?: () => Date;
+    /** Session grants (design §5.8); without it, no grant applies. */
+    grants?: SessionGrantService;
+    /** Parked executions (design §5.6); without it, nothing parks. */
+    executions?: ExecutionRegistry;
+}
+/** How an execution parks (design §5.6): the gate audits the hand-over and reports each decision. */
+export interface GatePark extends ParkHook {
+    settled(approvalId: string, decision: {
+        outcome: string;
+        decidedBy?: string;
+    }): void;
 }
 export interface InstanceRuntime {
     instanceId: string;
@@ -33,13 +37,12 @@ export interface InstanceRuntime {
     redact: Redactor;
     /** The live plugin process; throws PluginUnavailableError while it is down. */
     plugin: () => PluginProcess;
+    /** The catalog's plugin version while it matches the running child's, else undefined; checked when a
+     * call is gated and again before `invoke`, since descriptors belong to one bundle. */
+    catalogVersion: () => string | undefined;
 }
 export interface CallerContext {
-    /**
-     * `id` is the readable label recorded in the audit log (`token:Claude`); `key` is the stable
-     * principal (token id, grant id, external identity) that per-principal limits are keyed on, since
-     * two tokens may share a name.
-     */
+    /** `id` is the audit label (`token:Claude`); `key` the stable principal per-principal limits use. */
     client: {
         kind: 'mcp_client';
         id?: string;
@@ -50,12 +53,16 @@ export interface CallerContext {
     principal: AccessPrincipal;
     /** Present only for a live session whose client advertised elicitation. */
     prompts?: ClientPrompts;
+    /** Without a usable prompt, the execution may park and hand out the approval link (design §5.6). */
+    parkable?: boolean;
+    /** False once the caller's credential was revoked; a parked run outlives the request that authenticated it. */
+    stillAuthorized?: () => boolean;
 }
 /** What per-principal limits are keyed on: the stable principal, never the display name. */
 export declare const principalKey: (caller: CallerContext) => string;
-/**
- * The gate bindings for one `execute` run. `signal` ends the run: once it is aborted (the sandbox
- * settled, the MCP request was cancelled, or the session closed), calls the script left behind are
- * refused and an approval still open is cancelled, so nothing runs after the tool call has returned.
- */
-export declare function createGateBindings(deps: GateDeps, rt: InstanceRuntime, caller: CallerContext, signal?: AbortSignal): Record<string, Record<string, Binding>>;
+/** The gate bindings for one `execute` run; once `signal` aborts (the tool call ended, or its parked run
+ * was stopped), leftover calls are refused and open approvals cancelled. */
+export declare function createGateBindings(deps: GateDeps, rt: InstanceRuntime, caller: CallerContext, signal?: AbortSignal, opts?: {
+    executionId?: string;
+    park?: GatePark;
+}): Record<string, Record<string, Binding>>;

package/dist/gate/pipeline.js

@@ -8,7 +8,7 @@ import { BindingError } from '../sandbox/index.js';
 import { verifyAttestationKey } from './attestation.js';
 import { canonicalJson, sha256Hex } from './canonical.js';
 import { evaluatePreApproval } from './preapproval.js';
-import { redactDiff, redactPaths } from './redact.js';
+import { redactDiff, redactPaths, redactResult } from './redact.js';
 /** What per-principal limits are keyed on: the stable principal, never the display name. */
 export const principalKey = (caller) => caller.client.key ?? caller.client.id ?? 'anonymous';
 const MAX_ERROR_MESSAGE = 500;
@@ -51,15 +51,14 @@ const DENIAL_MESSAGES = {
     prompt_failed: 'needs approval, but the client could not show the approval prompt',
     confirmation_mismatch: 'was denied (confirmation mismatch)',
     endpoint_stopped: 'was cancelled: the endpoint was stopped or reconfigured while it waited for approval',
+    park_refused: 'needs approval, and an earlier approval of this execution was not given or it reached its approval limit; call execute again',
+    too_many_parked: 'needs approval, and too many earlier calls of this client still wait for one; resume or finish those first',
 };
-/**
- * The gate bindings for one `execute` run. `signal` ends the run: once it is aborted (the sandbox
- * settled, the MCP request was cancelled, or the session closed), calls the script left behind are
- * refused and an approval still open is cancelled, so nothing runs after the tool call has returned.
- */
-export function createGateBindings(deps, rt, caller, signal = new AbortController().signal) {
+/** The gate bindings for one `execute` run; once `signal` aborts (the tool call ended, or its parked run
+ * was stopped), leftover calls are refused and open approvals cancelled. */
+export function createGateBindings(deps, rt, caller, signal = new AbortController().signal, opts = {}) {
     const now = deps.now ?? (() => new Date());
-    const executionId = randomUUID();
+    const executionId = opts.executionId ?? randomUUID();
     let queue = Promise.resolve();
     const openApprovals = new Set();
     signal.addEventListener('abort', () => {
@@ -99,11 +98,17 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
             if (signal.aborted)
                 reject('rejected:execution_ended', new BindingError('EXECUTION_ENDED', 'The execute call this belongs to has already ended'));
         };
+        const ensureAuthorized = () => {
+            if (caller.stillAuthorized && !caller.stillAuthorized())
+                reject('rejected:credential_revoked', new BindingError('OPERATION_DISABLED', 'The credential of this call was revoked or no longer covers this endpoint'));
+        };
         try {
             ensureRunning();
+            ensureAuthorized();
             // 0. Map the raw binding call onto a catalog key (path templates, split keys…).
             const resolved = await rt.plugin().call('resolveOperation', { fn, args });
             audit.operationKey = resolved.key;
+            const catalogAt = rt.catalogVersion();
             const op = deps.db
                 .select()
                 .from(operations)
@@ -166,13 +171,23 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                 if (isWrite && !deps.limiter.allows(writeBucket, rt.settings.writesPerMinute, 60_000))
                     overWriteBudget();
                 // 6. Level `write`: acknowledged writes are auto-approved. Level `ask` (a write, or a read given
-                //    its own Ask): pre-approval rules, which never cover locked ops nor unacknowledged writes.
+                //    its own Ask): a session grant, then pre-approval rules; neither covers locked ops.
                 let preapproved = false;
                 if (mode === 'auto') {
                     preapproved = true;
                     decision = 'auto-approved:level';
                 }
                 else if (!operation.locked && access.reachable && access.level === 'ask') {
+                    // A session grant (§5.8) covers Ask, but never typed-confirmation ops nor locked ones.
+                    const grant = operation.typedConfirmation
+                        ? undefined
+                        : deps.grants?.active(rt.instanceId, principalKey(caller));
+                    if (grant) {
+                        preapproved = true;
+                        decision = `auto-approved:grant:${grant.id}`;
+                    }
+                }
+                if (!preapproved && !operation.locked && access.reachable && access.level === 'ask') {
                     const targetCovers = operation.matchProfile
                         ? rt.manifest.matchProfiles[operation.matchProfile]?.find((f) => f.field === '$targets')?.covers
                         : undefined;
@@ -196,6 +211,20 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                         reject('rejected:missing_confirmation_literal', new BindingError('PLUGIN_ERROR', `The plugin did not provide a confirmation value for ${operation.key}`));
                     }
                     ensureRunning();
+                    let parked = false;
+                    const park = opts.park && {
+                        reserve: () => opts.park.reserve(),
+                        offer: (a) => {
+                            parked = true;
+                            writeAudit(deps.db, {
+                                ...audit,
+                                decision: 'awaiting_approval',
+                                durationMs: Date.now() - started,
+                                detail: { ...audit.detail, approvalId: a.approvalId, channel: 'link' },
+                            }, now());
+                            opts.park.offer(a);
+                        },
+                    };
                     const paramsHash = sha256Hex(canonicalJson({ key: operation.key, params, targets, expectedHash: expectedHash ?? null }));
                     const request = deps.approvals.request({
                         instanceId: rt.instanceId,
@@ -219,6 +248,7 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                             isWrite &&
                             !operation.locked &&
                             !operation.typedConfirmation,
+                        park,
                     });
                     audit.detail.approvalId = request.id;
                     openApprovals.add(request.id);
@@ -230,6 +260,8 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                         openApprovals.delete(request.id);
                         budget.resume();
                     }
+                    if (parked)
+                        opts.park.settled(request.id, { outcome: approval.outcome, decidedBy: approval.decidedBy });
                     audit.decidedBy = approval.decidedBy;
                     audit.decidedVia = approval.via;
                     if (approval.outcome === 'cancelled' && signal.aborted)
@@ -240,12 +272,30 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                             ? `Approval for ${operation.key} timed out and was denied`
                             : `${operation.key} ${(approval.reason && DENIAL_MESSAGES[approval.reason]) ?? `was denied${approval.reason ? ` (${approval.reason})` : ''}`}`));
                     }
+                    ensureAuthorized();
                     // The admin may have lowered the level while the approval was open: the call must still be allowed.
                     const after = resolveAccess(deps.db, rt.instanceId, operation.key, caller.principal);
                     if (!after.reachable || after.mode === 'run') {
                         reject('rejected:access_changed', new BindingError('OPERATION_DISABLED', `${operation.key} was disabled while waiting for approval`));
                     }
                     decision = 'human-approved';
+                    const maxHours = rt.settings.sessionGrantMaxHours;
+                    if (approval.sessionGrantUntil &&
+                        deps.grants &&
+                        maxHours > 0 &&
+                        !operation.locked &&
+                        !operation.typedConfirmation) {
+                        // The page offers only allowed lengths; the cap is enforced here too.
+                        const cap = now().getTime() + maxHours * 3_600_000;
+                        deps.grants.create({
+                            instanceId: rt.instanceId,
+                            principal: principalKey(caller),
+                            client: caller.client.id,
+                            createdBy: approval.decidedBy ?? 'unknown',
+                            approvalId: request.id,
+                            expiresAt: new Date(Math.min(approval.sessionGrantUntil.getTime(), cap)),
+                        });
+                    }
                 }
             }
             // 8. The approver saw these targets; after a wait they may have moved (an entity joined the area).
@@ -258,6 +308,12 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                     reject('rejected:targets_changed', new BindingError('TARGETS_CHANGED', `What ${operation.key} would act on changed while it waited for approval; call it again to get a fresh approval`));
                 }
             }
+            // The catalog that gated and masks this call must still describe the running code (an update or
+            // restart during an approval wait would otherwise run it under another bundle's rules).
+            const catalogNow = rt.catalogVersion();
+            if (catalogAt === undefined || catalogNow !== catalogAt) {
+                throw new BindingError('PLUGIN_UNAVAILABLE', 'The plugin changed while this call was pending (an update or restart); call it again');
+            }
             // 9. The real upstream call, within what's left of the sandbox budget.
             if (isWrite && !deps.limiter.take(writeBucket, rt.settings.writesPerMinute, 60_000))
                 overWriteBudget();
@@ -272,9 +328,10 @@ export function createGateBindings(deps, rt, caller, signal = new AbortControlle
                     ...(rt.manifest.capabilities.targets ? { targets } : {}),
                 },
             }, remaining);
-            // 10–11. Redact, audit, hand back.
+            // 10–11. Redact (the operation's declared result secrets first, then by key name and secret
+            // value), audit, hand back. Nothing past this point sees the plugin's raw result.
             finish(decision, { resultStatus: 'ok' });
-            return rt.redact(result);
+            return rt.redact(redactResult(result, operation.sensitiveResult));
         }
         catch (err) {
             const raw = toBindingError(err);

package/dist/gate/pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/gate/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAExH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAiDtD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC;AAE5G,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,YAAY;QAAE,OAAO,GAAG,CAAC;IAC5C,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,GAAG,YAAY,sBAAsB;QACvC,OAAO,IAAI,YAAY,CAAC,oBAAoB,EAAE,8CAA8C,CAAC,CAAC;IAChG,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChG,IAAI,GAAG,YAAY,mBAAmB;QACpC,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;IACrF,OAAO,IAAI,YAAY,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,iBAAiB,GAA2B;IAChD,aAAa,EAAE,mCAAmC;IAClD,UAAU,EAAE,kDAAkD;IAC9D,eAAe,EAAE,8DAA8D;IAC/E,mBAAmB,EAAE,iEAAiE;IACtF,iBAAiB,EAAE,+BAA+B;CACnD,CAAC;AAEF,2DAA2D;AAC3D,MAAM,SAAS,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAEhH,MAAM,eAAe,GAA2B;IAC9C,gBAAgB,EAAE,kEAAkE;IACpF,qBAAqB,EACnB,0HAA0H;IAC5H,QAAQ,EAAE,4BAA4B;IACtC,aAAa,EAAE,mEAAmE;IAClF,qBAAqB,EAAE,oCAAoC;IAC3D,gBAAgB,EAAE,sFAAsF;CACzG,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,EAAmB,EACnB,MAAqB,EACrB,SAAsB,IAAI,eAAe,EAAE,CAAC,MAAM;IAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QACpC,KAAK,MAAM,EAAE,IAAI,aAAa;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GACd,CAAC,EAAU,EAAW,EAAE,CACxB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEJ,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,IAAe,EAAE,MAAqB;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAqD;YAC9D,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;YACzB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;SAC5B,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,QAAqE,EAAE,EAAE,EAAE;YAC3G,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,CACR,IAAI,CAAC,EAAE,EACP;gBACE,GAAG,KAAK;gBACR,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBACxC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;aAC7C,EACD,GAAG,EAAE,CACN,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,GAAiB,EAAS,EAAE;YAC5D,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,IAAI,MAAM,CAAC,OAAO;gBAChB,MAAM,CACJ,0BAA0B,EAC1B,IAAI,YAAY,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAC1F,CAAC;QACN,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,aAAa,EAAE,CAAC;YAEhB,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC;YAClC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE;iBACf,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;iBACtF,GAAG,EAA8B,CAAC;YACrC,oGAAoG;YACpG,MAAM,YAAY,GAAG,CAAI,CAAI,EAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;YACpF,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE7C,iEAAiE;YACjE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,mBAAmB,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAI,QAAQ,CAAC,MAAiD,EAAE,iBAAiB,CAAC;gBACjG,IACE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE;oBAClD,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,WAAW,EAAE,EAAE,CAAC,EAAE;oBAClB,KAAK,EAAE,EAAE,CAAC,GAAG;oBACb,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,SAAS;iBACV,CAAC,EACF,CAAC;oBACD,MAAM,CACJ,+BAA+B,EAC/B,IAAI,YAAY,CACd,sBAAsB,EACtB,yBAAyB,EAAE,CAAC,GAAG,6CAA6C,CAC7E,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,gGAAgG;YAChG,8BAA8B;YAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtE,MAAM,CACJ,YAAY,MAAM,EAAE,EACpB,MAAM,CAAC,MAAM,CACX,IAAI,YAAY,CACd,oBAAoB,EACpB,GAAG,QAAQ,CAAC,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,kBAAkB,EAAE,CACrE,EACD,EAAE,MAAM,EAAE,CACX,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,EAAG,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YACpD,oGAAoG;YACpG,MAAM,aAAa,GAAG,IAAI,KAAK,KAAK,CAAC;YACrC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC;YACzE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;YAE9E,8FAA8F;YAC9F,IAAI,OAAO,GAAqB,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpG,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,uEAAuE;YACvE,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7B,IAAI,IAAa,CAAC;YAClB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxF,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACrB,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;YACvC,CAAC;YAED,+DAA+D;YAC/D,IAAI,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,QAA8B,CAAC;YACnC,+FAA+F;YAC/F,oEAAoE;YACpE,MAAM,WAAW,GAAG,SAAS,EAAE,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,EAAE,CAC3B,MAAM,CAAC,uBAAuB,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACvG,IAAI,aAAa,EAAE,CAAC;gBAClB,wFAAwF;gBACxF,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;oBAAE,eAAe,EAAE,CAAC;gBAEzG,iGAAiG;gBACjG,+FAA+F;gBAC/F,IAAI,WAAW,GAAG,KAAK,CAAC;gBACxB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,WAAW,GAAG,IAAI,CAAC;oBACnB,QAAQ,GAAG,qBAAqB,CAAC;gBACnC,CAAC;qBAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY;wBACzC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,MAAM;wBAChG,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,OAAO,GAAG,mBAAmB,CACjC,IAAI,CAAC,EAAE,EACP,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,EACvF,GAAG,EAAE,CACN,CAAC;oBACF,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;wBACrC,WAAW,GAAG,IAAI,CAAC;wBACnB,QAAQ,GAAG,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpD,CAAC;yBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBAC3C,KAAK,CAAC,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;oBAClD,CAAC;gBACH,CAAC;gBAED,iEAAiE;gBACjE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,2FAA2F;oBAC3F,8DAA8D;oBAC9D,MAAM,OAAO,GAAG,MAAM,EAAE;yBACrB,MAAM,EAAE;yBACR,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;oBACpF,IAAI,SAAS,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;wBAC3D,MAAM,CACJ,uCAAuC,EACvC,IAAI,YAAY,CAAC,cAAc,EAAE,uDAAuD,SAAS,CAAC,GAAG,EAAE,CAAC,CACzG,CAAC;oBACJ,CAAC;oBACD,aAAa,EAAE,CAAC;oBAChB,MAAM,UAAU,GAAG,SAAS,CAC1B,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,CAC3F,CAAC;oBACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;wBACrC,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,YAAY,EAAE,SAAS,CAAC,GAAG;wBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC;wBACnC,UAAU;wBACV,eAAe,EAAE,OAAO;wBACxB,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;wBAChF,mFAAmF;wBACnF,IAAI,EAAE,UAAU,CAAC,IAAwC,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC;wBAChG,YAAY;wBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB;wBACxC,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,mGAAmG;wBACnG,aAAa,EACX,EAAE,CAAC,QAAQ,CAAC,wBAAwB,KAAK,QAAQ;4BACjD,OAAO;4BACP,CAAC,SAAS,CAAC,MAAM;4BACjB,CAAC,SAAS,CAAC,iBAAiB;qBAC/B,CAAC,CAAC;oBACH,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC;oBACrC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACpC,CAAC;4BAAS,CAAC;wBACT,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBACjC,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,CAAC;oBACD,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;oBACrC,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC;oBAChC,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO;wBAAE,aAAa,EAAE,CAAC;oBACxE,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACxE,MAAM,CACJ,KAAK,EACL,IAAI,YAAY,CACd,mBAAmB,EACnB,QAAQ,CAAC,OAAO,KAAK,WAAW;4BAC9B,CAAC,CAAC,gBAAgB,SAAS,CAAC,GAAG,2BAA2B;4BAC1D,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,aAAa,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CACjJ,CACF,CAAC;oBACJ,CAAC;oBACD,oGAAoG;oBACpG,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBACrF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;wBAC7C,MAAM,CACJ,yBAAyB,EACzB,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,SAAS,CAAC,GAAG,0CAA0C,CAAC,CACnG,CAAC;oBACJ,CAAC;oBACD,QAAQ,GAAG,gBAAgB,CAAC;gBAC9B,CAAC;YACH,CAAC;YAED,mGAAmG;YACnG,kGAAkG;YAClG,aAAa,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,gBAAgB,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrF,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;oBAC9B,MAAM,CACJ,0BAA0B,EAC1B,IAAI,YAAY,CACd,iBAAiB,EACjB,QAAQ,SAAS,CAAC,GAAG,2FAA2F,CACjH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;gBAAE,eAAe,EAAE,CAAC;YACvG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CACnC,QAAQ,EACR;gBACE,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;gBACN,OAAO,EAAE;oBACP,MAAM,EAAE,UAAU,EAAE;oBACpB,YAAY;oBACZ,UAAU,EAAE,SAAS;oBACrB,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF,EACD,SAAS,CACV,CAAC;YAEF,mCAAmC;YACnC,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAChC,8FAA8F;YAC9F,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAG,GAA2B,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,kGAAkG;YAClG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzG,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,WAAW,CACjD,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAChE;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/gate/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAExH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoDpE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC;AAE5G,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,mBAAmB;IACnB,gBAAgB;IAChB,0BAA0B;IAC1B,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAEH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,YAAY;QAAE,OAAO,GAAG,CAAC;IAC5C,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QAChF,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,GAAG,YAAY,sBAAsB;QACvC,OAAO,IAAI,YAAY,CAAC,oBAAoB,EAAE,8CAA8C,CAAC,CAAC;IAChG,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,YAAY,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAChG,IAAI,GAAG,YAAY,mBAAmB;QACpC,OAAO,IAAI,YAAY,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;IACrF,OAAO,IAAI,YAAY,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,iBAAiB,GAA2B;IAChD,aAAa,EAAE,mCAAmC;IAClD,UAAU,EAAE,kDAAkD;IAC9D,eAAe,EAAE,8DAA8D;IAC/E,mBAAmB,EAAE,iEAAiE;IACtF,iBAAiB,EAAE,+BAA+B;CACnD,CAAC;AAEF,2DAA2D;AAC3D,MAAM,SAAS,GAAG,CAAC,OAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAEhH,MAAM,eAAe,GAA2B;IAC9C,gBAAgB,EAAE,kEAAkE;IACpF,qBAAqB,EACnB,0HAA0H;IAC5H,QAAQ,EAAE,4BAA4B;IACtC,aAAa,EAAE,mEAAmE;IAClF,qBAAqB,EAAE,oCAAoC;IAC3D,gBAAgB,EAAE,sFAAsF;IACxG,YAAY,EACV,8HAA8H;IAChI,eAAe,EACb,4GAA4G;CAC/G,CAAC;AAEF;4EAC4E;AAC5E,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,EAAmB,EACnB,MAAqB,EACrB,SAAsB,IAAI,eAAe,EAAE,CAAC,MAAM,EAClD,OAAkD,EAAE;IAEpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;IACrD,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QACpC,KAAK,MAAM,EAAE,IAAI,aAAa;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,iBAAiB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GACd,CAAC,EAAU,EAAW,EAAE,CACxB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1D,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEJ,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,IAAe,EAAE,MAAqB;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAqD;YAC9D,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;YACzB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;SAC5B,CAAC;QACF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,QAAqE,EAAE,EAAE,EAAE;YAC3G,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,CACR,IAAI,CAAC,EAAE,EACP;gBACE,GAAG,KAAK;gBACR,QAAQ;gBACR,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBACxC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gBAChC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE;aAC7C,EACD,GAAG,EAAE,CACN,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,GAAiB,EAAS,EAAE;YAC5D,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5E,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,GAAG,EAAE;YACzB,IAAI,MAAM,CAAC,OAAO;gBAChB,MAAM,CACJ,0BAA0B,EAC1B,IAAI,YAAY,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAC1F,CAAC;QACN,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,GAAG,EAAE;YAC5B,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;gBACrD,MAAM,CACJ,6BAA6B,EAC7B,IAAI,YAAY,CACd,oBAAoB,EACpB,2EAA2E,CAC5E,CACF,CAAC;QACN,CAAC,CAAC;QAEF,IAAI,CAAC;YACH,aAAa,EAAE,CAAC;YAChB,gBAAgB,EAAE,CAAC;YAEnB,gFAAgF;YAChF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC;YAClC,MAAM,SAAS,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC;YACtC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE;iBACf,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;iBACtF,GAAG,EAA8B,CAAC;YACrC,oGAAoG;YACpG,MAAM,YAAY,GAAG,CAAI,CAAI,EAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC;YACpF,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAE7C,iEAAiE;YACjE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,mBAAmB,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAI,QAAQ,CAAC,MAAiD,EAAE,iBAAiB,CAAC;gBACjG,IACE,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,cAAc,EAAE;oBAClD,UAAU,EAAE,EAAE,CAAC,UAAU;oBACzB,WAAW,EAAE,EAAE,CAAC,EAAE;oBAClB,KAAK,EAAE,EAAE,CAAC,GAAG;oBACb,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,SAAS;iBACV,CAAC,EACF,CAAC;oBACD,MAAM,CACJ,+BAA+B,EAC/B,IAAI,YAAY,CACd,sBAAsB,EACtB,yBAAyB,EAAE,CAAC,GAAG,6CAA6C,CAC7E,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,gGAAgG;YAChG,8BAA8B;YAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtE,MAAM,CACJ,YAAY,MAAM,EAAE,EACpB,MAAM,CAAC,MAAM,CACX,IAAI,YAAY,CACd,oBAAoB,EACpB,GAAG,QAAQ,CAAC,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,IAAI,kBAAkB,EAAE,CACrE,EACD,EAAE,MAAM,EAAE,CACX,CACF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,EAAG,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YACpD,oGAAoG;YACpG,MAAM,aAAa,GAAG,IAAI,KAAK,KAAK,CAAC;YACrC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC;YACzE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC;YAE9E,8FAA8F;YAC9F,IAAI,OAAO,GAAqB,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACrC,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpG,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,uEAAuE;YACvE,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC7B,IAAI,IAAa,CAAC;YAClB,IAAI,YAAgC,CAAC;YACrC,IAAI,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACxF,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;gBACzB,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;gBACrB,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;YACvC,CAAC;YAED,+DAA+D;YAC/D,IAAI,QAAQ,GAAG,eAAe,CAAC;YAC/B,IAAI,QAA8B,CAAC;YACnC,+FAA+F;YAC/F,oEAAoE;YACpE,MAAM,WAAW,GAAG,SAAS,EAAE,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,GAAG,EAAE,CAC3B,MAAM,CAAC,uBAAuB,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC,CAAC;YACvG,IAAI,aAAa,EAAE,CAAC;gBAClB,wFAAwF;gBACxF,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;oBAAE,eAAe,EAAE,CAAC;gBAEzG,iGAAiG;gBACjG,wFAAwF;gBACxF,IAAI,WAAW,GAAG,KAAK,CAAC;gBACxB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;oBACpB,WAAW,GAAG,IAAI,CAAC;oBACnB,QAAQ,GAAG,qBAAqB,CAAC;gBACnC,CAAC;qBAAM,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC3E,uFAAuF;oBACvF,MAAM,KAAK,GAAG,SAAS,CAAC,iBAAiB;wBACvC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC7D,IAAI,KAAK,EAAE,CAAC;wBACV,WAAW,GAAG,IAAI,CAAC;wBACnB,QAAQ,GAAG,uBAAuB,KAAK,CAAC,EAAE,EAAE,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBACpF,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY;wBACzC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,MAAM;wBAChG,CAAC,CAAC,SAAS,CAAC;oBACd,MAAM,OAAO,GAAG,mBAAmB,CACjC,IAAI,CAAC,EAAE,EACP,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,EACvF,GAAG,EAAE,CACN,CAAC;oBACF,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;wBACrC,WAAW,GAAG,IAAI,CAAC;wBACnB,QAAQ,GAAG,sBAAsB,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpD,CAAC;yBAAM,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBAC3C,KAAK,CAAC,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;oBAClD,CAAC;gBACH,CAAC;gBAED,iEAAiE;gBACjE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,2FAA2F;oBAC3F,8DAA8D;oBAC9D,MAAM,OAAO,GAAG,MAAM,EAAE;yBACrB,MAAM,EAAE;yBACR,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;oBACpF,IAAI,SAAS,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;wBAC3D,MAAM,CACJ,uCAAuC,EACvC,IAAI,YAAY,CAAC,cAAc,EAAE,uDAAuD,SAAS,CAAC,GAAG,EAAE,CAAC,CACzG,CAAC;oBACJ,CAAC;oBACD,aAAa,EAAE,CAAC;oBAChB,IAAI,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM,IAAI,GAAyB,IAAI,CAAC,IAAI,IAAI;wBAC9C,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAK,CAAC,OAAO,EAAE;wBACnC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;4BACX,MAAM,GAAG,IAAI,CAAC;4BACd,UAAU,CACR,IAAI,CAAC,EAAE,EACP;gCACE,GAAG,KAAK;gCACR,QAAQ,EAAE,mBAAmB;gCAC7B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;gCAChC,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE;6BACvE,EACD,GAAG,EAAE,CACN,CAAC;4BACF,IAAI,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBACtB,CAAC;qBACF,CAAC;oBACF,MAAM,UAAU,GAAG,SAAS,CAC1B,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,CAAC,CAC3F,CAAC;oBACF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;wBACrC,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,WAAW,EAAE,SAAS,CAAC,EAAE;wBACzB,YAAY,EAAE,SAAS,CAAC,GAAG;wBAC3B,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC;wBACnC,UAAU;wBACV,eAAe,EAAE,OAAO;wBACxB,OAAO,EAAE,OAAO,CAAC,IAAI;wBACrB,cAAc,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;wBAChF,mFAAmF;wBACnF,IAAI,EAAE,UAAU,CAAC,IAAwC,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC;wBAChG,YAAY;wBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,iBAAiB;wBACxC,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,mGAAmG;wBACnG,aAAa,EACX,EAAE,CAAC,QAAQ,CAAC,wBAAwB,KAAK,QAAQ;4BACjD,OAAO;4BACP,CAAC,SAAS,CAAC,MAAM;4BACjB,CAAC,SAAS,CAAC,iBAAiB;wBAC9B,IAAI;qBACL,CAAC,CAAC;oBACH,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,EAAE,CAAC;oBACrC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAC9B,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;oBACpC,CAAC;4BAAS,CAAC;wBACT,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBACjC,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,CAAC;oBACD,IAAI,MAAM;wBAAE,IAAI,CAAC,IAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;oBACzG,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;oBACrC,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC;oBAChC,IAAI,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,OAAO;wBAAE,aAAa,EAAE,CAAC;oBACxE,IAAI,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;wBACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACxE,MAAM,CACJ,KAAK,EACL,IAAI,YAAY,CACd,mBAAmB,EACnB,QAAQ,CAAC,OAAO,KAAK,WAAW;4BAC9B,CAAC,CAAC,gBAAgB,SAAS,CAAC,GAAG,2BAA2B;4BAC1D,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,aAAa,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CACjJ,CACF,CAAC;oBACJ,CAAC;oBACD,gBAAgB,EAAE,CAAC;oBACnB,oGAAoG;oBACpG,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBACrF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;wBAC7C,MAAM,CACJ,yBAAyB,EACzB,IAAI,YAAY,CAAC,oBAAoB,EAAE,GAAG,SAAS,CAAC,GAAG,0CAA0C,CAAC,CACnG,CAAC;oBACJ,CAAC;oBACD,QAAQ,GAAG,gBAAgB,CAAC;oBAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;oBAClD,IACE,QAAQ,CAAC,iBAAiB;wBAC1B,IAAI,CAAC,MAAM;wBACX,QAAQ,GAAG,CAAC;wBACZ,CAAC,SAAS,CAAC,MAAM;wBACjB,CAAC,SAAS,CAAC,iBAAiB,EAC5B,CAAC;wBACD,sEAAsE;wBACtE,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,SAAS,CAAC;wBACnD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;4BACjB,UAAU,EAAE,EAAE,CAAC,UAAU;4BACzB,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC;4BAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;4BACxB,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS;4BAC1C,UAAU,EAAE,OAAO,CAAC,EAAE;4BACtB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;yBACzE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mGAAmG;YACnG,kGAAkG;YAClG,aAAa,EAAE,CAAC;YAChB,IAAI,QAAQ,KAAK,gBAAgB,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACtE,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrF,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;oBAC9B,MAAM,CACJ,0BAA0B,EAC1B,IAAI,YAAY,CACd,iBAAiB,EACjB,QAAQ,SAAS,CAAC,GAAG,2FAA2F,CACjH,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,gGAAgG;YAChG,wFAAwF;YACxF,MAAM,UAAU,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBACxD,MAAM,IAAI,YAAY,CACpB,oBAAoB,EACpB,sFAAsF,CACvF,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;gBAAE,eAAe,EAAE,CAAC;YACvG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CACnC,QAAQ,EACR;gBACE,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM;gBACN,OAAO,EAAE;oBACP,MAAM,EAAE,UAAU,EAAE;oBACpB,YAAY;oBACZ,UAAU,EAAE,SAAS;oBACrB,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzD;aACF,EACD,SAAS,CACV,CAAC;YAEF,4FAA4F;YAC5F,kFAAkF;YAClF,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAChC,8FAA8F;YAC9F,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAG,GAA2B,CAAC,MAAM,EAAE,CAAC,CAAC;YACvE,kGAAkG;YAClG,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzG,MAAM,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,WAAW,CACjD,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/gate/preapproval.d.ts

@@ -11,20 +11,13 @@ export type PreApprovalOutcome = {
 } | {
     kind: 'no_match';
 };
-/**
- * Finds an enabled, unexpired rule for the operation whose match holds and which has rate budget left,
- * and records the hit, all in one transaction so concurrent calls can't overshoot a limit. Callers
- * must never pass a locked operation (design §5.2 step 6); rules on locked ops are also disabled at sync.
- */
+/** Finds a matching, unexpired rule with budget left and records the hit, in one transaction. Never
+ * called for locked operations (design §5.2). */
 export declare function evaluatePreApproval(db: Db, input: {
     instanceId: string;
     operationId: string;
     params: unknown;
     targets: readonly ResolvedTarget[];
-    /**
-     * The params subtrees a `$targets` condition stands for (the profile field's `covers`). A rule with
-     * a `$targets` condition already checks every resolved target, so under strict matching those
-     * subtrees count as covered. Nothing is stored on the rule.
-     */
+    /** The params subtrees a `$targets` condition covers (the profile field's `covers`), for strict matching. */
     targetCovers?: readonly string[];
 }, now?: Date): PreApprovalOutcome;

package/dist/gate/preapproval.js

@@ -1,11 +1,8 @@
 import { and, asc, count, eq, gt } from 'drizzle-orm';
 import { preApprovalHits, preApprovalRules } from '../db/schema.js';
 import { conditionsHold, coversAllParams, MatchSchema } from './match.js';
-/**
- * Finds an enabled, unexpired rule for the operation whose match holds and which has rate budget left,
- * and records the hit, all in one transaction so concurrent calls can't overshoot a limit. Callers
- * must never pass a locked operation (design §5.2 step 6); rules on locked ops are also disabled at sync.
- */
+/** Finds a matching, unexpired rule with budget left and records the hit, in one transaction. Never
+ * called for locked operations (design §5.2). */
 export function evaluatePreApproval(db, input, now = new Date()) {
     return db.transaction((tx) => {
         const rules = tx

package/dist/gate/preapproval.js.map

@@ -1 +1 @@
-{"version":3,"file":"preapproval.js","sourceRoot":"","sources":["../../src/gate/preapproval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAM,EACN,KAWC,EACD,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,EAAE;aACb,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EACjD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EACnD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CACnC,CACF;aACA,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACxC,GAAG,EAAE,CAAC;QAET,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAE,SAAS;YAC9G,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5D,0FAA0F;gBAC1F,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACrG,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;gBACrD,MAAM,IAAI,GACR,EAAE;qBACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;qBACtB,IAAI,CAAC,eAAe,CAAC;qBACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EACnC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CACnE,CACF;qBACA,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACtB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACxG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"preapproval.js","sourceRoot":"","sources":["../../src/gate/preapproval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAQ1E;iDACiD;AACjD,MAAM,UAAU,mBAAmB,CACjC,EAAM,EACN,KAOC,EACD,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,EAAE;aACb,MAAM,EAAE;aACR,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EACjD,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EACnD,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CACnC,CACF;aACA,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;aACxC,GAAG,EAAE,CAAC;QAET,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAE,SAAS;YAC9G,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5D,0FAA0F;gBAC1F,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACrG,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;gBACrD,MAAM,IAAI,GACR,EAAE;qBACC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;qBACtB,IAAI,CAAC,eAAe,CAAC;qBACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EACnC,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,CACnE,CACF;qBACA,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACtB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9E,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACxG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/gate/rate-limit.d.ts

@@ -1,8 +1,4 @@
-/**
- * Sliding windows of hit timestamps per key, bounded in memory: keys whose window has passed are
- * dropped, and past `maxKeys` the keys with the fewest hits go first. Callers keyed by anything a client
- * chooses (usernames, IPs, principals) can't grow it without limit.
- */
+/** Sliding windows of hit timestamps per key, bounded so client-chosen keys can't grow it without limit. */
 export declare class HitWindows {
     private readonly now;
     private readonly maxKeys;
@@ -13,17 +9,11 @@ export declare class HitWindows {
     recent(key: string, windowMs: number): number[];
     add(key: string, windowMs: number): number[];
     delete(key: string): void;
-    /**
-     * Drops keys whose window has passed, then the keys with the fewest hits (oldest first among equals),
-     * down to 90% of the cap. A flood of one-off keys therefore can't push out a key that is close to or
-     * at its limit, such as a username that is locked out.
-     */
+    /** Drops expired keys, then those with the fewest hits, to 90% of the cap, so a flood of one-off keys
+     * can't evict a key at its limit. */
     private prune;
 }
-/**
- * In-memory sliding-window limiter for per-instance execute/write caps (design §5.2). Separate from
- * pre-approval rule limits, which are persisted in `pre_approval_hits`.
- */
+/** In-memory limiter for per-instance execute/write caps (design §5.2), separate from rule limits. */
 export declare class SlidingWindowLimiter {
     private readonly hits;
     constructor(now?: () => number, maxKeys?: number);

package/dist/gate/rate-limit.js

@@ -1,8 +1,4 @@
-/**
- * Sliding windows of hit timestamps per key, bounded in memory: keys whose window has passed are
- * dropped, and past `maxKeys` the keys with the fewest hits go first. Callers keyed by anything a client
- * chooses (usernames, IPs, principals) can't grow it without limit.
- */
+/** Sliding windows of hit timestamps per key, bounded so client-chosen keys can't grow it without limit. */
 export class HitWindows {
     now;
     maxKeys;
@@ -36,11 +32,8 @@ export class HitWindows {
     delete(key) {
         this.map.delete(key);
     }
-    /**
-     * Drops keys whose window has passed, then the keys with the fewest hits (oldest first among equals),
-     * down to 90% of the cap. A flood of one-off keys therefore can't push out a key that is close to or
-     * at its limit, such as a username that is locked out.
-     */
+    /** Drops expired keys, then those with the fewest hits, to 90% of the cap, so a flood of one-off keys
+     * can't evict a key at its limit. */
     prune() {
         const t = this.now();
         for (const [k, e] of this.map)
@@ -55,10 +48,7 @@ export class HitWindows {
             this.map.delete(k);
     }
 }
-/**
- * In-memory sliding-window limiter for per-instance execute/write caps (design §5.2). Separate from
- * pre-approval rule limits, which are persisted in `pre_approval_hits`.
- */
+/** In-memory limiter for per-instance execute/write caps (design §5.2), separate from rule limits. */
 export class SlidingWindowLimiter {
     hits;
     constructor(now = Date.now, maxKeys) {

package/dist/gate/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/gate/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIF;IACA;IAJF,GAAG,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE/E,YACmB,MAAoB,IAAI,CAAC,GAAG,EAC5B,UAAU,MAAM;QADhB,QAAG,GAAH,GAAG,CAAyB;QAC5B,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,uDAAuD;IACvD,MAAM,CAAC,GAAW,EAAE,QAAgB;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,qCAAqC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACK,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QACpC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAa;IAElC,YAAY,MAAoB,IAAI,CAAC,GAAG,EAAE,OAAgB;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC;IACxD,CAAC;IAED,0GAA0G;IAC1G,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/gate/rate-limit.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,MAAM,OAAO,UAAU;IAIF;IACA;IAJF,GAAG,GAAG,IAAI,GAAG,EAAgD,CAAC;IAE/E,YACmB,MAAoB,IAAI,CAAC,GAAG,EAC5B,UAAU,MAAM;QADhB,QAAG,GAAH,GAAG,CAAyB;QAC5B,YAAO,GAAP,OAAO,CAAS;IAChC,CAAC;IAEJ,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,uDAAuD;IACvD,MAAM,CAAC,GAAW,EAAE,QAAgB;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,qCAAqC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,QAAgB;QAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED;yCACqC;IAC7B,KAAK;QACX,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO;QACpC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,EAAE,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC;CACF;AAED,sGAAsG;AACtG,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAa;IAElC,YAAY,MAAoB,IAAI,CAAC,GAAG,EAAE,OAAgB;QACxD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC;IACxD,CAAC;IAED,0GAA0G;IAC1G,IAAI,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,MAAM,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}