agent-passport-system 7.1.0 → 7.2.1

package/dist/src/v2/activation/verify.js

@@ -0,0 +1,406 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Deciding whether an activation condition is established at an instant.
+// See ./types.ts for the specification position and for the three parameters this module
+// refuses to default.
+import { parseRfc3339 } from '../../core/rfc3339.js';
+import { verify as verifyEd25519 } from '../../crypto/keys.js';
+import { mapAuthorityValidationToLifecycle } from '../lifecycle-state/map.js';
+import { lifecycleState } from '../lifecycle-state/state.js';
+import { activationAttestationSignatureInput } from './canonical.js';
+import { ACTIVATION_ATTESTATION_TYPE, ACTIVATION_CONDITION_TYPE, ACTIVATION_GAPS_BY_REASON, ACTIVATION_INSTANT_BASES, ActivationError, } from './types.js';
+/** How far through the checks a rejected attestation got. When no record was accepted, the
+ *  reported code is the reason of the record that got FURTHEST, so the verdict names the
+ *  closest thing to usable evidence that was presented. Ties break on `attestation_id`
+ *  ascending, which makes the answer independent of presentation order. */
+const REJECTION_RANK = Object.freeze({
+    ATTESTATION_RECORD_TYPE_NOT_ACCEPTED: 1,
+    ATTESTATION_SIGNATURE_UNVERIFIED: 2,
+    ATTESTATION_ATTESTOR_BINDING_MISMATCH: 3,
+    ATTESTATION_ATTESTOR_ROLE_UNKNOWN: 4,
+    ATTESTATION_ROLE_CLAIM_CONFLICT: 5,
+    ATTESTATION_ATTESTOR_ROLE_MISMATCH: 6,
+    ATTESTATION_CONDITION_MISMATCH: 7,
+    ATTESTATION_UNKNOWN_ASSERTION: 8,
+    ATTESTATION_INSTANT_MALFORMED: 9,
+    ATTESTATION_DOES_NOT_REACH_ACTION: 10,
+    // Verdict-level codes never rank: they are not rejections of a record.
+    ACTIVATION_ESTABLISHED: 0,
+    CONDITION_DATE_NOT_REACHED: 0,
+    CONDITION_ESTABLISHED_NOT_YET_OCCURRED: 0,
+    CONDITION_FIRST_OCCURRED_AFTER_ACTION: 0,
+    CONDITION_EVIDENCE_CONFLICT: 0,
+    ACTIVATION_THRESHOLD_NOT_MET: 0,
+    NO_ATTESTATION_PRESENTED: 0,
+    CONDITION_DELEGATION_MISMATCH: 0,
+});
+function assertInstant(value, label) {
+    const parsed = parseRfc3339(value);
+    if (!parsed.ok) {
+        throw new ActivationError('INSTANT_MALFORMED', `${label} is not an RFC 3339 instant with an offset (${parsed.reason})`);
+    }
+    return parsed.ms;
+}
+/** Shape rules, each with the reason it exists. A condition that breaks one is a programming
+ *  error at the caller, not a verdict about evidence, so this throws.
+ *
+ *  Exported so a caller can validate a condition it received before reaching a boundary. */
+export function validateActivationCondition(condition) {
+    if (condition === null || typeof condition !== 'object') {
+        throw new ActivationError('CONDITION_MALFORMED', 'condition is not an object');
+    }
+    if (condition.record_type !== ACTIVATION_CONDITION_TYPE) {
+        throw new ActivationError('CONDITION_RECORD_TYPE_UNKNOWN', `condition record_type must be ${ACTIVATION_CONDITION_TYPE}`);
+    }
+    for (const field of ['condition_id', 'delegation_id']) {
+        if (typeof condition[field] !== 'string' || condition[field].length === 0) {
+            throw new ActivationError('CONDITION_MALFORMED', `condition ${field} must be a non-empty string`);
+        }
+    }
+    if (condition.condition_type === 'date') {
+        assertInstant(condition.activation_date, 'condition activation_date');
+        return condition;
+    }
+    if (condition.condition_type === 'recorded_event') {
+        for (const field of ['event_type', 'event_id']) {
+            if (typeof condition[field] !== 'string' || condition[field].length === 0) {
+                throw new ActivationError('CONDITION_MALFORMED', `condition ${field} must be a non-empty string`);
+            }
+        }
+        const roles = condition.required_attestor_roles;
+        if (!Array.isArray(roles) || roles.length === 0) {
+            // A condition naming no accepted source has not stated what it accepts. Accepting
+            // anything would make the role check decorative, and refusing everything would be a
+            // fail-closed ruling the text does not state. Refuse the CONDITION instead.
+            throw new ActivationError('CONDITION_ROLES_REQUIRED', 'required_attestor_roles must name at least one role');
+        }
+        for (const role of roles) {
+            if (typeof role !== 'string' || role.length === 0) {
+                throw new ActivationError('CONDITION_ROLES_REQUIRED', 'required_attestor_roles must contain only non-empty strings');
+            }
+        }
+        if (!Number.isInteger(condition.threshold) || condition.threshold < 1) {
+            throw new ActivationError('CONDITION_THRESHOLD_INVALID', 'threshold must be an integer of at least 1, and this module declares no default');
+        }
+        if (!ACTIVATION_INSTANT_BASES.includes(condition.instant_basis)) {
+            throw new ActivationError('CONDITION_INSTANT_BASIS_REQUIRED', `instant_basis must be one of ${ACTIVATION_INSTANT_BASES.join(', ')}, and this module declares no default`);
+        }
+        return condition;
+    }
+    throw new ActivationError('CONDITION_TYPE_UNKNOWN', 'condition_type must be date or recorded_event');
+}
+function classify(attestation, condition, actionMs, input) {
+    const usesOwnPreimage = input.attestationPreimage === undefined;
+    const accepted = input.acceptedAttestationRecordTypes;
+    // 1. Record type. A record whose type the model has not declared it accepts for this
+    //    condition is not evidence, however well it verifies.
+    if (usesOwnPreimage) {
+        if (attestation.record_type !== ACTIVATION_ATTESTATION_TYPE) {
+            return { ok: false, reason: 'ATTESTATION_RECORD_TYPE_NOT_ACCEPTED' };
+        }
+    }
+    else if (!accepted.includes(attestation.record_type)) {
+        return { ok: false, reason: 'ATTESTATION_RECORD_TYPE_NOT_ACCEPTED' };
+    }
+    // 2. Signature, over the record's own bytes, under the key authorized at `attested_at`.
+    if (typeof attestation.attested_at !== 'string') {
+        return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+    }
+    if (!parseRfc3339(attestation.attested_at).ok) {
+        return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+    }
+    if (typeof attestation.verification_method !== 'string' ||
+        typeof attestation.signature !== 'string' ||
+        typeof attestation.attestor !== 'string') {
+        return { ok: false, reason: 'ATTESTATION_SIGNATURE_UNVERIFIED' };
+    }
+    const resolved = input.resolveVerificationKey(attestation.attestor, attestation.verification_method, attestation.attested_at);
+    // A resolver failure and a missing key are the same finding here: no accepted source
+    // produced a key, so the record is not usable evidence. The granular key-resolution
+    // outcomes belong to chain verification, which reports them on its own result.
+    if (typeof resolved !== 'string' || resolved.length === 0) {
+        return { ok: false, reason: 'ATTESTATION_SIGNATURE_UNVERIFIED' };
+    }
+    const preimage = usesOwnPreimage
+        ? activationAttestationSignatureInput(attestation)
+        : input.attestationPreimage(attestation);
+    let signatureOk = false;
+    try {
+        signatureOk = verifyEd25519(preimage, attestation.signature, resolved);
+    }
+    catch {
+        signatureOk = false;
+    }
+    if (!signatureOk)
+        return { ok: false, reason: 'ATTESTATION_SIGNATURE_UNVERIFIED' };
+    // 3. The verification method has to belong to the attestor the body names, or a valid
+    //    signature says nothing about who attested.
+    if (!attestation.verification_method.startsWith(`${attestation.attestor}#`)) {
+        return { ok: false, reason: 'ATTESTATION_ATTESTOR_BINDING_MISMATCH' };
+    }
+    // 4. The attestor's own role claim, checked AGAINST the resolver. Never believed.
+    if (typeof attestation.attestor_role === 'string' && attestation.attestor_role.length > 0) {
+        const claimed = input.resolveAttestorRole(attestation.attestor, attestation.attestor_role, attestation.attested_at);
+        if (claimed === 'unknown')
+            return { ok: false, reason: 'ATTESTATION_ATTESTOR_ROLE_UNKNOWN' };
+        if (claimed !== 'holds')
+            return { ok: false, reason: 'ATTESTATION_ROLE_CLAIM_CONFLICT' };
+    }
+    // 5. Does the attestor hold a role the condition requires? A source the model does not
+    //    accept for THIS condition is not evidence in either direction: it cannot establish the
+    //    condition and it cannot establish that the condition was unmet.
+    let holdsRequired = false;
+    let anyUnknown = false;
+    for (const role of condition.required_attestor_roles) {
+        const standing = input.resolveAttestorRole(attestation.attestor, role, attestation.attested_at);
+        if (standing === 'holds') {
+            holdsRequired = true;
+            break;
+        }
+        if (standing === 'unknown')
+            anyUnknown = true;
+    }
+    if (!holdsRequired) {
+        return {
+            ok: false,
+            reason: anyUnknown
+                ? 'ATTESTATION_ATTESTOR_ROLE_UNKNOWN'
+                : 'ATTESTATION_ATTESTOR_ROLE_MISMATCH',
+        };
+    }
+    // 6. Condition binding.
+    if (attestation.condition_id !== condition.condition_id ||
+        attestation.event_type !== condition.event_type ||
+        attestation.event_id !== condition.event_id) {
+        return { ok: false, reason: 'ATTESTATION_CONDITION_MISMATCH' };
+    }
+    // 7. What it establishes, measured on the instant the CONDITION declares governs.
+    if (attestation.assertion === 'condition_occurred') {
+        const raw = condition.instant_basis === 'attestation_written'
+            ? attestation.attested_at
+            : attestation.occurred_at;
+        if (typeof raw !== 'string')
+            return { ok: false, reason: 'ATTESTATION_UNKNOWN_ASSERTION' };
+        const parsed = parseRfc3339(raw);
+        if (!parsed.ok)
+            return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+        return {
+            ok: true,
+            finding: parsed.ms <= actionMs ? 'occurred_by_action' : 'occurred_after_action',
+        };
+    }
+    if (attestation.assertion === 'condition_not_occurred_through') {
+        const raw = attestation.not_occurred_through;
+        if (typeof raw !== 'string')
+            return { ok: false, reason: 'ATTESTATION_UNKNOWN_ASSERTION' };
+        const parsed = parseRfc3339(raw);
+        if (!parsed.ok)
+            return { ok: false, reason: 'ATTESTATION_INSTANT_MALFORMED' };
+        // A negative that stops short of the action instant says nothing about the interval
+        // between where it stops and the action. That is the coverage limb, not a source problem.
+        if (parsed.ms < actionMs)
+            return { ok: false, reason: 'ATTESTATION_DOES_NOT_REACH_ACTION' };
+        return { ok: true, finding: 'not_occurred_through_action' };
+    }
+    return { ok: false, reason: 'ATTESTATION_UNKNOWN_ASSERTION' };
+}
+function notEstablishedFor(code) {
+    return lifecycleState({
+        verdict: 'not_established',
+        reason_code: code,
+        missing: ACTIVATION_GAPS_BY_REASON[code] ?? ['source'],
+    });
+}
+/**
+ * Decide whether an activation condition is established for one action at one instant.
+ *
+ * Three verdicts are reachable and `invalid` is not one of them:
+ *
+ * | situation                                                    | verdict             |
+ * |--------------------------------------------------------------|---------------------|
+ * | condition established at or before the action instant         | `valid`             |
+ * | established as not met at that instant, or first met after it | `not_yet_effective` |
+ * | the verifier cannot tell                                      | `not_established`   |
+ *
+ * NOT ESTABLISHED IS NOT THE NEGATION OF THE CLAIM. It says the verifier could not reach a
+ * conclusion and names which establishment limb was missing. `not_yet_effective` says the
+ * verifier DID reach a conclusion and it was negative; its remedy is to wait, where
+ * `not_established`'s remedy is a better source. Collapsing the two throws away a decidable
+ * answer the verifier already had.
+ *
+ * NO RETROACTIVE ACTIVATION, KEYED ON THE CONDITION'S OWN INSTANT. A record putting the
+ * condition's first occurrence after the action instant leaves that action
+ * `not_yet_effective`, and the SAME record establishes the condition for any later action.
+ * What the rule keys on is the condition's instant, not the instant someone wrote the record:
+ * learning on Thursday that a condition was met on Monday is the normal case for any model
+ * built around an after-the-fact determination, and under
+ * `instant_basis: 'condition_occurrence'` such a record establishes the condition. A model
+ * that reads it the other way says so with `instant_basis: 'attestation_written'`.
+ *
+ * ORDER OF RESOLUTION, and why contradiction sits above acceptance:
+ *
+ *   1. two accepted records that disagree      `not_established`, `CONDITION_EVIDENCE_CONFLICT`
+ *   2. `threshold` records say occurred by it  `valid`
+ *   3. `threshold` records say not occurred    `not_yet_effective`
+ *   4. `threshold` records say occurred after  `not_yet_effective`
+ *   5. some accepted, fewer than `threshold`   `not_established`, `ACTIVATION_THRESHOLD_NOT_MET`
+ *   6. none accepted                           `not_established`, furthest rejection reason
+ *
+ * Contradiction is evaluated on PRESENCE, not on counts. Two acceptable records that disagree
+ * leave the verifier unable to tell which holds, and neither is discarded in favour of the
+ * other: preferring the later record, or the negative one, or a majority, would each be a
+ * precedence rule the concept text does not state.
+ *
+ * This function reads no clock and makes no network call. `actionInstant` is a parameter.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, invariant candidates CAND-04
+ * and CAND-13 (activation half) and BROAD-L7. Not required by draft-pidlisnyi-aps-03.
+ */
+export function verifyActivation(input) {
+    if (input === null || typeof input !== 'object') {
+        throw new ActivationError('INPUT_MALFORMED', 'input is not an object');
+    }
+    if (typeof input.resolveAttestorRole !== 'function') {
+        throw new ActivationError('ROLE_RESOLVER_REQUIRED', 'resolveAttestorRole is required: role standing is resolved outside the record, always');
+    }
+    if (typeof input.resolveVerificationKey !== 'function') {
+        throw new ActivationError('KEY_RESOLVER_REQUIRED', 'resolveVerificationKey is required');
+    }
+    if (input.attestationPreimage !== undefined) {
+        const accepted = input.acceptedAttestationRecordTypes;
+        if (!Array.isArray(accepted) || accepted.length === 0) {
+            throw new ActivationError('ACCEPTED_RECORD_TYPES_REQUIRED', 'acceptedAttestationRecordTypes must name at least one type when attestationPreimage is supplied');
+        }
+    }
+    if (typeof input.delegationId !== 'string' || input.delegationId.length === 0) {
+        throw new ActivationError('DELEGATION_ID_REQUIRED', 'delegationId must be a non-empty string');
+    }
+    const condition = validateActivationCondition(input.condition);
+    const actionMs = assertInstant(input.actionInstant, 'actionInstant');
+    const presented = input.attestations ?? [];
+    if (condition.delegation_id !== input.delegationId) {
+        return Object.freeze({
+            state: notEstablishedFor('CONDITION_DELEGATION_MISMATCH'),
+            condition_id: condition.condition_id,
+            condition_type: condition.condition_type,
+            findings: Object.freeze([]),
+            rejections: Object.freeze([]),
+        });
+    }
+    // A date condition needs no evidence at all. The verifier reads the date off the condition
+    // and compares it with the action instant, so an unreached date is a KNOWN negative and
+    // never an unknown one. Presented attestations are not consulted.
+    if (condition.condition_type === 'date') {
+        const reached = assertInstant(condition.activation_date, 'condition activation_date') <= actionMs;
+        return Object.freeze({
+            state: reached
+                ? lifecycleState({ verdict: 'valid', reason_code: 'ACTIVATION_ESTABLISHED' })
+                : lifecycleState({
+                    verdict: 'not_yet_effective',
+                    reason_code: 'CONDITION_DATE_NOT_REACHED',
+                }),
+            condition_id: condition.condition_id,
+            condition_type: condition.condition_type,
+            findings: Object.freeze([]),
+            rejections: Object.freeze([]),
+        });
+    }
+    const findings = [];
+    const rejections = [];
+    const counts = {
+        occurred_by_action: 0,
+        occurred_after_action: 0,
+        not_occurred_through_action: 0,
+    };
+    for (const attestation of presented) {
+        if (attestation === null || typeof attestation !== 'object') {
+            throw new ActivationError('ATTESTATION_MALFORMED', 'an attestation is not an object');
+        }
+        const id = typeof attestation.attestation_id === 'string' ? attestation.attestation_id : '';
+        const attestor = typeof attestation.attestor === 'string' ? attestation.attestor : '';
+        const outcome = classify(attestation, condition, actionMs, input);
+        if (outcome.ok) {
+            counts[outcome.finding] += 1;
+            findings.push(Object.freeze({ attestation_id: id, attestor, finding: outcome.finding }));
+        }
+        else {
+            rejections.push(Object.freeze({ attestation_id: id, attestor, reason_code: outcome.reason }));
+        }
+    }
+    const frozen = {
+        condition_id: condition.condition_id,
+        condition_type: condition.condition_type,
+        findings: Object.freeze([...findings]),
+        rejections: Object.freeze([...rejections]),
+    };
+    if (counts.occurred_by_action > 0 && counts.not_occurred_through_action > 0) {
+        return Object.freeze({ ...frozen, state: notEstablishedFor('CONDITION_EVIDENCE_CONFLICT') });
+    }
+    if (counts.occurred_by_action >= condition.threshold) {
+        return Object.freeze({
+            ...frozen,
+            state: lifecycleState({ verdict: 'valid', reason_code: 'ACTIVATION_ESTABLISHED' }),
+        });
+    }
+    if (counts.not_occurred_through_action >= condition.threshold) {
+        return Object.freeze({
+            ...frozen,
+            state: lifecycleState({
+                verdict: 'not_yet_effective',
+                reason_code: 'CONDITION_ESTABLISHED_NOT_YET_OCCURRED',
+            }),
+        });
+    }
+    if (counts.occurred_after_action >= condition.threshold) {
+        return Object.freeze({
+            ...frozen,
+            state: lifecycleState({
+                verdict: 'not_yet_effective',
+                reason_code: 'CONDITION_FIRST_OCCURRED_AFTER_ACTION',
+            }),
+        });
+    }
+    if (findings.length > 0) {
+        return Object.freeze({ ...frozen, state: notEstablishedFor('ACTIVATION_THRESHOLD_NOT_MET') });
+    }
+    if (rejections.length === 0) {
+        return Object.freeze({ ...frozen, state: notEstablishedFor('NO_ATTESTATION_PRESENTED') });
+    }
+    const furthest = [...rejections].sort((a, b) => {
+        const rank = REJECTION_RANK[b.reason_code] - REJECTION_RANK[a.reason_code];
+        return rank !== 0 ? rank : a.attestation_id.localeCompare(b.attestation_id);
+    })[0];
+    return Object.freeze({ ...frozen, state: notEstablishedFor(furthest.reason_code) });
+}
+/**
+ * Report an activation result ALONGSIDE a chain result, never merged into it.
+ *
+ * Two stages, in order, and the order is the point:
+ *
+ *   1. Chain verification decides whether the grant is valid at the action instant. Its
+ *      four-value result is returned untouched in `chain`.
+ *   2. Activation is asked ONLY when the chain is valid. A grant that does not verify is not a
+ *      grant that is waiting on a condition, and reporting `not_yet_effective` for a revoked
+ *      or unparented grant would say the remedy is to wait when it is not.
+ *
+ * This is also where CAND-13's activation half lands. A pre-committed replacement grant is an
+ * ordinary grant with an ordinary condition, so it needs no separate machinery here, and the
+ * ordering is what keeps L1 intact: if the pre-committing instrument is revoked, the
+ * replacement's chain is invalid and no activation evidence can make it exercisable. Nothing
+ * in this module can turn an invalid chain into a `valid` lifecycle verdict.
+ *
+ * `activation` may be `null`, which is how a caller says no activation module ran. The
+ * composite then carries only the chain's own reading.
+ *
+ * Proposed. Concept source: aeoess/agent-authority-lifecycle, invariant L1 and invariant
+ * candidates CAND-04 and CAND-13.
+ */
+export function composeActivation(chain, activation, options = {}) {
+    const mapped = mapAuthorityValidationToLifecycle(chain, options.mapping ?? {});
+    if (chain.state !== 'valid' || activation === null) {
+        return Object.freeze({ chain, lifecycle: mapped });
+    }
+    return Object.freeze({ chain, lifecycle: activation.state });
+}
+//# sourceMappingURL=verify.js.map

package/dist/src/v2/activation/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../src/v2/activation/verify.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,2FAA2F;AAC3F,yFAAyF;AACzF,sBAAsB;AAEtB,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAM9D,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAK5D,OAAO,EAAE,mCAAmC,EAAE,MAAM,gBAAgB,CAAA;AACpE,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,eAAe,GAUhB,MAAM,YAAY,CAAA;AAEnB;;;2EAG2E;AAC3E,MAAM,cAAc,GAAmD,MAAM,CAAC,MAAM,CAAC;IACnF,oCAAoC,EAAE,CAAC;IACvC,gCAAgC,EAAE,CAAC;IACnC,qCAAqC,EAAE,CAAC;IACxC,iCAAiC,EAAE,CAAC;IACpC,+BAA+B,EAAE,CAAC;IAClC,kCAAkC,EAAE,CAAC;IACrC,8BAA8B,EAAE,CAAC;IACjC,6BAA6B,EAAE,CAAC;IAChC,6BAA6B,EAAE,CAAC;IAChC,iCAAiC,EAAE,EAAE;IACrC,uEAAuE;IACvE,sBAAsB,EAAE,CAAC;IACzB,0BAA0B,EAAE,CAAC;IAC7B,sCAAsC,EAAE,CAAC;IACzC,qCAAqC,EAAE,CAAC;IACxC,2BAA2B,EAAE,CAAC;IAC9B,4BAA4B,EAAE,CAAC;IAC/B,wBAAwB,EAAE,CAAC;IAC3B,6BAA6B,EAAE,CAAC;CACjC,CAAC,CAAA;AAyCF,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,GAAG,KAAK,+CAA+C,MAAM,CAAC,MAAM,GAAG,CACxE,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,2BAA2B,CACzC,SAAgC;IAEhC,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,yBAAyB,EAAE,CAAC;QACxD,MAAM,IAAI,eAAe,CACvB,+BAA+B,EAC/B,iCAAiC,yBAAyB,EAAE,CAC7D,CAAA;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,eAAe,CAAU,EAAE,CAAC;QAC/D,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,aAAa,KAAK,6BAA6B,CAChD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACxC,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAA;QACrE,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,SAAS,CAAC,cAAc,KAAK,gBAAgB,EAAE,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,UAAU,CAAU,EAAE,CAAC;YACxD,IAAI,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,eAAe,CACvB,qBAAqB,EACrB,aAAa,KAAK,6BAA6B,CAChD,CAAA;YACH,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,uBAAuB,CAAA;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,kFAAkF;YAClF,oFAAoF;YACpF,4EAA4E;YAC5E,MAAM,IAAI,eAAe,CACvB,0BAA0B,EAC1B,qDAAqD,CACtD,CAAA;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,eAAe,CACvB,0BAA0B,EAC1B,6DAA6D,CAC9D,CAAA;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,eAAe,CACvB,6BAA6B,EAC7B,iFAAiF,CAClF,CAAA;QACH,CAAC;QACD,IAAI,CAAE,wBAA8C,CAAC,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,eAAe,CACvB,kCAAkC,EAClC,gCAAgC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC3G,CAAA;QACH,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,+CAA+C,CAChD,CAAA;AACH,CAAC;AAMD,SAAS,QAAQ,CACf,WAAoC,EACpC,SAA6C,EAC7C,QAAgB,EAChB,KAAkC;IAElC,MAAM,eAAe,GAAG,KAAK,CAAC,mBAAmB,KAAK,SAAS,CAAA;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,8BAA8B,CAAA;IAErD,qFAAqF;IACrF,0DAA0D;IAC1D,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,WAAW,CAAC,WAAW,KAAK,2BAA2B,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;QACtE,CAAC;IACH,CAAC;SAAM,IAAI,CAAC,QAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAA;IACtE,CAAC;IAED,wFAAwF;IACxF,IAAI,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;IAC/D,CAAC;IACD,IACE,OAAO,WAAW,CAAC,mBAAmB,KAAK,QAAQ;QACnD,OAAO,WAAW,CAAC,SAAS,KAAK,QAAQ;QACzC,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,EACxC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,sBAAsB,CAC3C,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,mBAAmB,EAC/B,WAAW,CAAC,WAAW,CACxB,CAAA;IACD,qFAAqF;IACrF,oFAAoF;IACpF,+EAA+E;IAC/E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IAClE,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe;QAC9B,CAAC,CAAC,mCAAmC,CAAC,WAAW,CAAC;QAClD,CAAC,CAAC,KAAK,CAAC,mBAAoB,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,WAAW,GAAG,KAAK,CAAA;IACvB,IAAI,CAAC;QACH,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,KAAK,CAAA;IACrB,CAAC;IACD,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;IAElF,sFAAsF;IACtF,gDAAgD;IAChD,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAA;IACvE,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAO,WAAW,CAAC,aAAa,KAAK,QAAQ,IAAI,WAAW,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1F,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,CACvC,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,WAAW,CACxB,CAAA;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;QAC5F,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAA;IAC1F,CAAC;IAED,uFAAuF;IACvF,4FAA4F;IAC5F,qEAAqE;IACrE,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,UAAU,GAAG,KAAK,CAAA;IACtB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,uBAAuB,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,CAAA;QAC/F,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,aAAa,GAAG,IAAI,CAAA;YACpB,MAAK;QACP,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,UAAU,GAAG,IAAI,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;gBAChB,CAAC,CAAC,mCAAmC;gBACrC,CAAC,CAAC,oCAAoC;SACzC,CAAA;IACH,CAAC;IAED,wBAAwB;IACxB,IACE,WAAW,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QACnD,WAAW,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU;QAC/C,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,QAAQ,EAC3C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAA;IAChE,CAAC;IAED,kFAAkF;IAClF,IAAI,WAAW,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACnD,MAAM,GAAG,GACP,SAAS,CAAC,aAAa,KAAK,qBAAqB;YAC/C,CAAC,CAAC,WAAW,CAAC,WAAW;YACzB,CAAC,CAAC,WAAW,CAAC,WAAW,CAAA;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC7E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB;SAChF,CAAA;IACH,CAAC;IAED,IAAI,WAAW,CAAC,SAAS,KAAK,gCAAgC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,WAAW,CAAC,oBAAoB,CAAA;QAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC1F,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;QAC7E,oFAAoF;QACpF,0FAA0F;QAC1F,IAAI,MAAM,CAAC,EAAE,GAAG,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAA;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAA;IAC7D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAA;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA0B;IACnD,OAAO,cAAc,CAAC;QACpB,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;KACvD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkC;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,wBAAwB,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CACvB,wBAAwB,EACxB,uFAAuF,CACxF,CAAA;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,oCAAoC,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,8BAA8B,CAAA;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,eAAe,CACvB,gCAAgC,EAChC,iGAAiG,CAClG,CAAA;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,yCAAyC,CAAC,CAAA;IAChG,CAAC;IAED,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAA;IAE1C,IAAI,SAAS,CAAC,aAAa,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,iBAAiB,CAAC,+BAA+B,CAAC;YACzD,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,2FAA2F;IAC3F,wFAAwF;IACxF,kEAAkE;IAClE,IAAI,SAAS,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,2BAA2B,CAAC,IAAI,QAAQ,CAAA;QACjG,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,OAAO;gBACZ,CAAC,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;gBAC7E,CAAC,CAAC,cAAc,CAAC;oBACb,OAAO,EAAE,mBAAmB;oBAC5B,WAAW,EAAE,4BAA4B;iBAC1C,CAAC;YACN,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,MAAM,UAAU,GAA0B,EAAE,CAAA;IAC5C,MAAM,MAAM,GAA0C;QACpD,kBAAkB,EAAE,CAAC;QACrB,qBAAqB,EAAE,CAAC;QACxB,2BAA2B,EAAE,CAAC;KAC/B,CAAA;IAED,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;QACpC,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,uBAAuB,EAAE,iCAAiC,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3F,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QACrF,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;QACjE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;YAC5B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC1F,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG;QACb,YAAY,EAAE,SAAS,CAAC,YAAY;QACpC,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;KAC3C,CAAA;IAED,IAAI,MAAM,CAAC,kBAAkB,GAAG,CAAC,IAAI,MAAM,CAAC,2BAA2B,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACrD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;SACnF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,2BAA2B,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,cAAc,CAAC;gBACpB,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,wCAAwC;aACtD,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,MAAM;YACT,KAAK,EAAE,cAAc,CAAC;gBACpB,OAAO,EAAE,mBAAmB;gBAC5B,WAAW,EAAE,uCAAuC;aACrD,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC1E,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACL,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;AACrF,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAgC,EAChC,UAAmC,EACnC,OAAO,GAAiC,EAAE;IAE1C,MAAM,MAAM,GAAG,iCAAiC,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC9E,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAA;AAC9D,CAAC"}

package/dist/src/v2/authority-state/fencing.d.ts

@@ -0,0 +1,49 @@
+import type { FencedWrite, FencedWriteOutcome, StateMarker } from './types.js';
+/**
+ * An authority-state publication log with a fencing gate on every write.
+ *
+ * Generic in the payload on purpose: this class orders writes and stores nothing about
+ * authority itself. The payload is whatever the deployment publishes as a state view, a
+ * store handle, a snapshot identifier or a record set. The SDK has no opinion about it.
+ *
+ * The gate, in one line each:
+ *
+ *  - a token BELOW the highest already accepted is refused, `stale_fencing_token`
+ *  - a token EQUAL to it is accepted, because equal has not gone backwards: the same holder
+ *    is retrying, and the retry is idempotent
+ *  - a token ABOVE it is accepted, and so is a token the log has never seen before, as long
+ *    as it does not go backwards. The gate fences state that is behind, not state that
+ *    merely differs
+ *  - a token counted in a DIFFERENT SCOPE from the log's is refused,
+ *    `fencing_scope_mismatch`, and an absent or malformed token is refused
+ *    `fencing_token_unreadable`. Two markers from different scopes order nothing, and a
+ *    write path that cannot order a token is not fenced. Neither refusal is in any source;
+ *    both are this module's choice, and they are kept apart because an unreadable token is
+ *    a different finding from a backwards one
+ *
+ * A refused write changes nothing: not the published payload, not the highest token. That
+ * is the property the whole class exists for, and a caller reads `accepted` to learn which
+ * of the two happened rather than comparing payloads.
+ *
+ * NOT DURABLE, NOT CONCURRENT, NOT A LOCK SERVICE. This holds one token and one payload in
+ * this process's heap. It acquires no lock, contacts no lock service, and its check-then-set
+ * is one synchronous statement sequence, which is safe on this runtime and is a property of
+ * the runtime rather than a pattern a durable store may copy. The same warning
+ * `InMemoryAuthorityRevocationStore` carries applies here for the same reason.
+ */
+export declare class FencedAuthorityStateLog<T> {
+    private highest;
+    private payload;
+    private written;
+    /** The highest token accepted so far, or `null` when nothing has been published. */
+    highestToken(): StateMarker | null;
+    /** What is published now. `undefined` when no write has landed, which a caller must tell
+     *  apart from a write that landed carrying `undefined`; `hasPublished()` is how. */
+    published(): T | undefined;
+    hasPublished(): boolean;
+    /** Submit a write. See the class doc for the four outcomes. Never throws for a malformed
+     *  token: an unreadable token is one that cannot be shown to have moved forward, so it is
+     *  refused. */
+    write(write: FencedWrite<T>): FencedWriteOutcome<T>;
+}
+//# sourceMappingURL=fencing.d.ts.map

package/dist/src/v2/authority-state/fencing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fencing.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/fencing.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,uBAAuB,CAAC,CAAC;IACpC,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,OAAO,CAA2B;IAC1C,OAAO,CAAC,OAAO,CAAQ;IAEvB,oFAAoF;IACpF,YAAY,IAAI,WAAW,GAAG,IAAI,CAEjC;IAED;wFACoF;IACpF,SAAS,IAAI,CAAC,GAAG,SAAS,CAEzB;IAED,YAAY,IAAI,OAAO,CAEtB;IAED;;mBAEe;IACf,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAmBlD;CACF"}

package/dist/src/v2/authority-state/fencing.js

@@ -0,0 +1,92 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN. Fencing on the authority-state WRITE path.
+// See ./types.ts for the specification position. Proposed.
+//
+// WHY THIS IS A SEPARATE AXIS FROM THE READ PATH. A read-side high-water mark protects one
+// verifier that has already seen the newer state. It does nothing for a verifier that has
+// seen nothing, reading a published view that a stale writer republished underneath it. A
+// partition that resolves the wrong way rolls authority back with no restore involved, and
+// the read path never sees a regression because the published state simply IS the old
+// state. So the check has to exist where the write lands.
+//
+// The rule implemented here is the one Kleppmann's "How to do distributed locking" states:
+// the storage server takes an active role in checking tokens and rejects any write on which
+// the token has gone backwards. `OPEN-QUESTIONS.md` names authority rollback as open and
+// names an append-only revocation log a restore must replay as the other candidate
+// mechanism in the same sentence. That one is NOT modelled here. Neither is specified.
+import { compareStateMarker, sameScope } from './marker.js';
+/**
+ * An authority-state publication log with a fencing gate on every write.
+ *
+ * Generic in the payload on purpose: this class orders writes and stores nothing about
+ * authority itself. The payload is whatever the deployment publishes as a state view, a
+ * store handle, a snapshot identifier or a record set. The SDK has no opinion about it.
+ *
+ * The gate, in one line each:
+ *
+ *  - a token BELOW the highest already accepted is refused, `stale_fencing_token`
+ *  - a token EQUAL to it is accepted, because equal has not gone backwards: the same holder
+ *    is retrying, and the retry is idempotent
+ *  - a token ABOVE it is accepted, and so is a token the log has never seen before, as long
+ *    as it does not go backwards. The gate fences state that is behind, not state that
+ *    merely differs
+ *  - a token counted in a DIFFERENT SCOPE from the log's is refused,
+ *    `fencing_scope_mismatch`, and an absent or malformed token is refused
+ *    `fencing_token_unreadable`. Two markers from different scopes order nothing, and a
+ *    write path that cannot order a token is not fenced. Neither refusal is in any source;
+ *    both are this module's choice, and they are kept apart because an unreadable token is
+ *    a different finding from a backwards one
+ *
+ * A refused write changes nothing: not the published payload, not the highest token. That
+ * is the property the whole class exists for, and a caller reads `accepted` to learn which
+ * of the two happened rather than comparing payloads.
+ *
+ * NOT DURABLE, NOT CONCURRENT, NOT A LOCK SERVICE. This holds one token and one payload in
+ * this process's heap. It acquires no lock, contacts no lock service, and its check-then-set
+ * is one synchronous statement sequence, which is safe on this runtime and is a property of
+ * the runtime rather than a pattern a durable store may copy. The same warning
+ * `InMemoryAuthorityRevocationStore` carries applies here for the same reason.
+ */
+export class FencedAuthorityStateLog {
+    highest = null;
+    payload = undefined;
+    written = false;
+    /** The highest token accepted so far, or `null` when nothing has been published. */
+    highestToken() {
+        return this.highest;
+    }
+    /** What is published now. `undefined` when no write has landed, which a caller must tell
+     *  apart from a write that landed carrying `undefined`; `hasPublished()` is how. */
+    published() {
+        return this.payload;
+    }
+    hasPublished() {
+        return this.written;
+    }
+    /** Submit a write. See the class doc for the four outcomes. Never throws for a malformed
+     *  token: an unreadable token is one that cannot be shown to have moved forward, so it is
+     *  refused. */
+    write(write) {
+        const token = write?.token;
+        // Read the token on its own first. An unreadable token is a different finding from a
+        // stale one, and collapsing them would report a backwards move that never happened.
+        if (compareStateMarker(token, token) !== 'forward') {
+            return { accepted: false, code: 'fencing_token_unreadable', published: this.highest };
+        }
+        if (this.highest !== null) {
+            if (!sameScope(this.highest, token)) {
+                return { accepted: false, code: 'fencing_scope_mismatch', published: this.highest };
+            }
+            if (compareStateMarker(this.highest, token) !== 'forward') {
+                return { accepted: false, code: 'stale_fencing_token', published: this.highest };
+            }
+        }
+        this.highest = token;
+        this.payload = write.payload;
+        this.written = true;
+        return { accepted: true, published: token, payload: write.payload };
+    }
+}
+//# sourceMappingURL=fencing.js.map

package/dist/src/v2/authority-state/fencing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fencing.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/fencing.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,+DAA+D;AAC/D,2DAA2D;AAC3D,EAAE;AACF,2FAA2F;AAC3F,0FAA0F;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,sFAAsF;AACtF,0DAA0D;AAC1D,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,yFAAyF;AACzF,mFAAmF;AACnF,uFAAuF;AAEvF,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAG3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,uBAAuB;IAC1B,OAAO,GAAuB,IAAI,CAAA;IAClC,OAAO,GAAkB,SAAS,CAAA;IAClC,OAAO,GAAG,KAAK,CAAA;IAEvB,oFAAoF;IACpF,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;wFACoF;IACpF,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED;;mBAEe;IACf,KAAK,CAAC,KAAqB;QACzB,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,CAAA;QAC1B,qFAAqF;QACrF,oFAAoF;QACpF,IAAI,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;QACvF,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YACrF,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;YAClF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACrE,CAAC;CACF"}

package/dist/src/v2/authority-state/index.d.ts

@@ -0,0 +1,7 @@
+export * from './types.js';
+export * from './marker.js';
+export * from './retained.js';
+export * from './fencing.js';
+export * from './withdrawal.js';
+export * from './report.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/v2/authority-state/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/v2/authority-state/index.ts"],"names":[],"mappings":"AAQA,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA"}

package/dist/src/v2/authority-state/index.js

@@ -0,0 +1,14 @@
+// Copyright (c) 2026 Tymofii Pidlisnyi
+// SPDX-License-Identifier: Apache-2.0
+//
+// PROPOSED, OPT-IN authority state markers, write fencing and revocation withdrawal.
+// Nothing here is required by draft-pidlisnyi-aps-03 and nothing here changes any existing
+// exported behaviour. Concept source: aeoess/agent-authority-lifecycle, invariant candidates
+// CAND-08 and CAND-02.
+export * from './types.js';
+export * from './marker.js';
+export * from './retained.js';
+export * from './fencing.js';
+export * from './withdrawal.js';
+export * from './report.js';
+//# sourceMappingURL=index.js.map

package/dist/src/v2/authority-state/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/v2/authority-state/index.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,sCAAsC;AACtC,EAAE;AACF,qFAAqF;AACrF,2FAA2F;AAC3F,6FAA6F;AAC7F,uBAAuB;AAEvB,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA"}