borgmcp-shared 0.3.0 → 0.4.2

package/README.md

@@ -41,7 +41,7 @@ import { ADAPTER_CONFORMANCE_FIXTURES } from 'borgmcp-shared/conformance';
 The supported subpaths are:
 
 - `borgmcp-shared/protocol`: wire entities, requests, responses, errors, and
-  protocol compatibility metadata.
+  the exact protocol version tag.
 - `borgmcp-shared/domain`: pure role-section, address, and high-water-mark
   helpers plus shared domain types.
 - `borgmcp-shared/conformance`: test-runner-independent behavior vectors and
@@ -67,24 +67,34 @@ The first-slice HTTP contract has four shared paths:
   credential-proven retry is non-mutating, and a mismatched replay fails
   uniformly. Secrets never belong in a response, URL, query string, command-line
   argument, diagnostic, or serializable domain entity.
-- `GET /api/protocol` requires authentication and returns the protocol version,
-  package version, capabilities, and bounded limits in the shared envelope.
+- `GET /api/protocol` is credential-free and mutation-free. It returns ONLY the
+  exact protocol tag — no package version, limits, server identity, or other
+  fingerprint surface — so a client verifies pinned TLS and the exact tag before
+  it creates or sends any credential.
 - `POST /api/cubes` requires an active parent client with `create_cube`. Its
   strict, idempotent request selects a server-owned template; one atomic success
   creates a cube, two initial roles, and the creator's cube-scoped `manage`
   grant. Exact retries return the same non-secret identities without mutation.
 
-`negotiateProtocol` requires bearer authentication, revocation, cube isolation,
-verified TLS, and no-cloud-fallback capabilities. Missing security capabilities
-fail closed before an operation begins.
+`decodeProtocolTagPreflight` fails closed on any tag other than the exact
+expected version, on any extra field, or on a non-object body — before any
+credential is created or sent. The exact protocol tag is the sole acceptance
+authority: there is no capability negotiation, and client and server ship and
+update together as one clean-slate product. The attach request envelope still
+decodes its version before any payload as defense in depth.
 
 Every JSON coordination request and successful JSON response is carried inside
 `ProtocolEnvelope<T>`. Failures use `ProtocolErrorEnvelope`. The only bodyless
 exceptions are the `204` liveness and acknowledgement responses. Payload codecs
 are exported separately so adapters can validate the envelope first and then
 validate the operation-specific payload without accepting ambiguous fields.
+Cube managers reassign a seat with `PATCH /api/cubes/:cubeId/drones/:droneId`
+and evict one with `DELETE` on the same path. Both operations use strict
+versioned request and success envelopes. An evicted seat's former bearer receives
+the terminal `410 DRONE_EVICTED` signal; revoked or expired sessions remain the
+generic `401 SESSION_REVOKED` case.
 See [docs/enrollment.md](docs/enrollment.md) for purpose-bound owner enrollment,
-ordinary ungranted enrollment, cube creation, pending-keychain, and retry contracts.
+ordinary ungranted enrollment, cube creation, pending enrollment, and retry contracts.
 
 ## Conformance
 
@@ -94,15 +104,19 @@ readonly data rather than Vitest-specific helpers, so they work with any test
 runner and in any JavaScript runtime. Cases cover HTTP and canonical errors,
 credential misuse, isolation and revocation, SSE framing/replay/cursor ordering,
 executable enrollment authority/retry/mismatch/redaction and cube-create
-idempotency, acks, claims, decisions, and
-unsupported-capability failures.
+idempotency, acks, claims, decisions, cube-scoped drone reassignment, role-class
+and single-seat invariants, eviction exclusion, and terminal bearer signaling.
+Manage-scoped cube, role, taxonomy, decision, and drone operations also share an
+authority matrix: managing parents may mutate; known same-cube read/write
+parents receive `403 ACCESS_DENIED`; drone sessions remain non-managing; and
+no-grant, foreign, or unknown cubes remain hidden behind `404 NOT_FOUND`.
 
 Implement `AdapterConformanceDriver` with raw responses from the target adapter,
 then call `runAdapterConformance`. The runner creates and decodes envelopes,
 drives state transitions, and decides pass/fail; adapters do not submit expected
-results. `runEquivalentAdapterConformance(cloud, local)` executes the identical
-sequence against both implementations and fails when either implementation or
-their normalized observable transcripts diverge.
+results. Each server or client adapter runs this single portable suite against
+its local/self-hosted implementation. The package does not define a second
+authority, migration target, or fallback implementation.
 
 The package's own suite covers built-in templates, role-section patching,
 broadcast high-water-mark ordering, drone-address formatting, and current public
@@ -110,24 +124,30 @@ response shapes.
 
 ## Compatibility
 
-`PROTOCOL_VERSION`, `SUPPORTED_PROTOCOL_VERSIONS`, and `COMPATIBILITY_MATRIX`
-describe the compatibility contract. During the pre-1.0 package series, new
-contracts may be added, but an existing wire shape will not change without a
-documented migration path and corresponding conformance coverage. Consumers pin
-`^0.3.0` (`>=0.3.0 <0.4.0`): before 1.0, breaking wire changes increment the
-minor version while compatible additions and corrections increment the patch.
+`PROTOCOL_VERSION` is the sole acceptance authority: every envelope carries the
+protocol tag, and each decoder fails closed on any value other than the exact
+expected tag. There is no capability negotiation, supported-version list,
+compatibility matrix, or version-range fallback. The client and server are one
+clean-slate product — a wire change increments the tag and both adopt it
+together in a coordinated release, with no mixed-version window.
 
-See [docs/compatibility.md](docs/compatibility.md) for the current matrix and
-the policy for introducing protocol changes.
+See [docs/compatibility.md](docs/compatibility.md) for the exact-tag policy and
+the coordinated rollout order for introducing protocol changes.
 
 ## Distribution
 
-`borgmcp-shared@0.2.2` is the published legacy baseline. This source prepares
-`0.3.0` for the breaking retry-safe enrollment and multi-cube creation contract;
-the version change does not authorize a tag or publication. After a separately
-authorized registry release, consumers adopting this contract pin
-`borgmcp-shared@^0.3.0` and commit registry lockfiles. No registry token belongs
-in this repository, package metadata, lockfiles, or a committed `.npmrc`;
+`borgmcp-shared@0.4.0` is the published clean-slate v2 baseline and is
+immutable, but its artifact predates the local/self-hosted package cleanup. The
+immutable `v0.4.1` verification artifact exposed a platform-dependent SBOM audit
+and must never be published, moved, reused, rerun, or substituted.
+This source now identifies the still-unpublished `0.4.2` recovery release: its
+package manifest, lockfile, exported identity, and SBOM and packed-artifact
+verifiers all read `0.4.2`. The protocol tag and runtime behavior are unchanged.
+This reviewed version bump grants no tag or publish authority; creating the
+annotated `v0.4.2` tag and publishing its exact reviewed artifact remain separate,
+independently gated steps. After that release, consumers pin exact
+`borgmcp-shared@0.4.2` and commit registry lockfiles. No registry token belongs in
+this repository, package metadata, lockfiles, or a committed `.npmrc`;
 publishing uses protected external credentials and provenance.
 
 The first client and server releases must consume the reviewed registry release,

package/SECURITY.md

@@ -6,10 +6,10 @@ Please report suspected vulnerabilities privately through GitHub Security
 Advisories for this repository. Open the repository's **Security** tab, select
 **Advisories**, and choose **Report a vulnerability**.
 
-If GitHub's private reporting interface is unavailable, email
-`queen@borgmcp.ai`. Do not include credentials, access tokens, customer data,
-or other secrets unless the maintainers explicitly request them through an
-encrypted channel.
+If GitHub's private reporting interface is unavailable, do not open a public
+issue containing vulnerability details. Wait until private repository reporting
+is available. Do not include credentials, access tokens, user data, or other
+secrets unless the maintainers explicitly request them through a secure channel.
 
 Do not disclose the issue publicly until the maintainers confirm that a fix is
 available and coordinated disclosure is appropriate.
@@ -18,7 +18,8 @@ available and coordinated disclosure is appropriate.
 
 Security reports may concern this package's published artifacts, protocol
 contracts, conformance data, dependency chain, or documentation. Vulnerabilities
-in hosted Borg MCP services can be reported through the same channels.
+in the client or self-hosted server belong in those repositories' private
+security-reporting channels.
 
 Only supported package versions receive security fixes. The latest published
 version is always supported; older versions may receive fixes when a safe

package/dist/conformance/adapter.d.ts

@@ -9,6 +9,25 @@ export interface ConformancePrincipal {
 export interface ConformanceCube {
     readonly id: string;
 }
+export interface ConformanceRole {
+    readonly id: string;
+}
+export interface ConformanceDrone {
+    readonly id: string;
+}
+export type ConformanceCubeAccess = 'read' | 'write' | 'manage';
+export interface ConformanceCubeManagementState {
+    readonly directive: string;
+    readonly taxonomy_marker: string | null;
+    readonly role_ids: readonly string[];
+    readonly active_decision_ids: readonly string[];
+    readonly drones: ReadonlyArray<{
+        readonly id: string;
+        readonly role_id: string;
+        readonly evicted: boolean;
+        readonly session_revoked: boolean;
+    }>;
+}
 export interface ConformanceAuthorityState {
     enrolled_clients: number;
     enrollment_claims: number;
@@ -29,6 +48,7 @@ export interface ConformanceCreatedCubeState {
 export interface ConformanceEnrollmentPrincipalState {
     response_client_matches: boolean;
     active_credential_bindings: number;
+    bound_credential_matches_enrollment: boolean;
 }
 export interface ConformanceReplayBarrier {
     readonly reached: Promise<void>;
@@ -41,7 +61,21 @@ export interface ConformanceAdmin {
     reset(): Promise<void>;
     createPrincipal(name: string): Promise<ConformancePrincipal>;
     createCube(name: string): Promise<ConformanceCube>;
-    grantCube(principal: ConformancePrincipal, cube: ConformanceCube): Promise<void>;
+    grantCube(principal: ConformancePrincipal, cube: ConformanceCube, access?: ConformanceCubeAccess): Promise<void>;
+    createRole(cube: ConformanceCube, input: {
+        readonly roleClass: 'queen' | 'worker';
+        readonly isHumanSeat: boolean;
+    }): Promise<ConformanceRole>;
+    createDrone(principal: ConformancePrincipal, cube: ConformanceCube, role: ConformanceRole): Promise<ConformanceDrone>;
+    issueManagedDroneSession(drone: ConformanceDrone): Promise<string>;
+    revokeManagedDroneSession(drone: ConformanceDrone): Promise<void>;
+    expireManagedDroneSession(drone: ConformanceDrone): Promise<void>;
+    inspectManagedDrone(drone: ConformanceDrone): Promise<{
+        readonly role_id: string;
+        readonly evicted: boolean;
+        readonly session_revoked: boolean;
+    }>;
+    inspectCubeManagementState(cube: ConformanceCube): Promise<ConformanceCubeManagementState>;
     grantCreateCubeCapability(principal: ConformancePrincipal): Promise<void>;
     issueDroneSession(principal: ConformancePrincipal): Promise<string>;
     issueSingleUseInvitation(principal: ConformancePrincipal, purpose: 'owner' | 'client'): Promise<string>;
@@ -61,8 +95,14 @@ export interface ConformanceOperations {
     appendRaw(credential: string, cube: ConformanceCube, body: string): Promise<ConformanceHttpResponse>;
     read(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
     ack(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    updateCube(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    createRole(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    patchTaxonomy(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
     recordDecision(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
     listDecisions(credential: string, cube: ConformanceCube, request: unknown): Promise<ConformanceHttpResponse>;
+    listDrones(credential: string, cube: ConformanceCube): Promise<ConformanceHttpResponse>;
+    reassignDrone(credential: string, cube: ConformanceCube, drone: ConformanceDrone, request: unknown): Promise<ConformanceHttpResponse>;
+    evictDrone(credential: string, cube: ConformanceCube, drone: ConformanceDrone, request: unknown): Promise<ConformanceHttpResponse>;
     openStream(credential: string, cube: ConformanceCube, cursor: LogCursor | null): Promise<ConformanceStreamResponse>;
 }
 export interface ConformanceEnvironment {
@@ -73,8 +113,11 @@ export declare const ADAPTER_CONFORMANCE_FIXTURES: readonly [{
     readonly id: "http.unauthenticated-liveness";
     readonly area: "http";
 }, {
-    readonly id: "protocol.enrollment-auth";
+    readonly id: "protocol.credential-free-preflight";
     readonly area: "protocol";
+}, {
+    readonly id: "enrollment.retry-authority";
+    readonly area: "enrollment";
 }, {
     readonly id: "security.adapter-boundary-injection";
     readonly area: "security";
@@ -103,8 +146,23 @@ export declare const ADAPTER_CONFORMANCE_FIXTURES: readonly [{
     readonly id: "decisions.topic-supersession";
     readonly area: "decisions";
 }, {
-    readonly id: "capabilities.unsupported-fails-closed";
-    readonly area: "capabilities";
+    readonly id: "security.drone-management-authorization";
+    readonly area: "security";
+}, {
+    readonly id: "security.manage-access-matrix";
+    readonly area: "security";
+}, {
+    readonly id: "drones.reassign-invariants";
+    readonly area: "drones";
+}, {
+    readonly id: "security.cross-cube-drone-management";
+    readonly area: "security";
+}, {
+    readonly id: "drones.evict-terminal-signal";
+    readonly area: "drones";
+}, {
+    readonly id: "security.drone-session-rejection-causes";
+    readonly area: "security";
 }, {
     readonly id: "security.active-stream-revocation";
     readonly area: "security";
@@ -124,16 +182,9 @@ export interface AdapterConformanceReport {
         observations: Record<string, unknown>;
     }>;
 }
-export interface EquivalentAdapterConformanceReport {
-    ok: boolean;
-    cloud: AdapterConformanceReport;
-    local: AdapterConformanceReport;
-    equivalent: boolean;
-}
 export interface AdapterConformanceOptions {
     streamDeadlineMs?: number;
     pendingProbeMs?: number;
 }
 export declare function runAdapterConformance(environment: ConformanceEnvironment, options?: AdapterConformanceOptions): Promise<AdapterConformanceReport>;
-export declare function runEquivalentAdapterConformance(cloud: ConformanceEnvironment, local: ConformanceEnvironment, options?: AdapterConformanceOptions): Promise<EquivalentAdapterConformanceReport>;
 //# sourceMappingURL=adapter.d.ts.map

package/dist/conformance/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/conformance/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAiBL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAGf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,mCAAmC;IAClD,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IAExE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CACtC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACnD,SAAS,CAAC,SAAS,EAAE,oBAAoB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,wBAAwB,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxG,qBAAqB,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5D,kBAAkB,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,0BAA0B,CACxB,SAAS,EAAE,oBAAoB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChD,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,mBAAmB,IAAI,wBAAwB,CAAC;CACjD;AAGD,MAAM,WAAW,qBAAqB;IACpC,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,IAAI,CACF,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,GAAG,CACD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,IAAI,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAc/B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,2BAA2B,CAAC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAEpC,oBAAoB,EAAE,aAAa,CAAC;QAClC,EAAE,EAAE,2BAA2B,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,kCAAkC;IACjD,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,wBAAwB,CAAC;IAChC,KAAK,EAAE,wBAAwB,CAAC;IAChC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IAExC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAwLD,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,sBAAsB,EACnC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CAypBnC;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,sBAAsB,EAC7B,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,kCAAkC,CAAC,CAY7C"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/conformance/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAoBL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EAEf,MAAM,sBAAsB,CAAC;AAG9B,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEhE,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,OAAO,CAAC;IACjC,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,mCAAmC;IAClD,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,MAAM,CAAC;IAOnC,mCAAmC,EAAE,OAAO,CAAC;CAC9C;AAED,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IAExE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CACtC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEnD,SAAS,CACP,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;QACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;QACvC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7B,WAAW,CACT,SAAS,EAAE,oBAAoB,EAC/B,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7B,wBAAwB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QACpD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;KACnC,CAAC,CAAC;IAEH,0BAA0B,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC3F,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,iBAAiB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE,wBAAwB,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxG,qBAAqB,IAAI,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC5D,kBAAkB,CAChB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxC,0BAA0B,CACxB,SAAS,EAAE,oBAAoB,EAC/B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChD,eAAe,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,mBAAmB,IAAI,wBAAwB,CAAC;CACjD;AAGD,MAAM,WAAW,qBAAqB;IACpC,MAAM,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC3D,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1F,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,IAAI,CACF,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,GAAG,CACD,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,cAAc,CACZ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,aAAa,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,UAAU,CACR,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,GAAG,IAAI,GACvB,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;CAC5C;AAED,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB/B,CAAC;AAEX,MAAM,MAAM,2BAA2B,GACrC,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,2BAA2B,CAAC;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAEpC,oBAAoB,EAAE,aAAa,CAAC;QAClC,EAAE,EAAE,2BAA2B,CAAC;QAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvC,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IAExC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAsMD,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,sBAAsB,EACnC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,wBAAwB,CAAC,CA+lCnC"}