lorenz 0.1.5 → 0.1.6

package/node_modules/@lorenz/dispatch-coordinator/dist/coordinator.js

@@ -1,8 +1,7 @@
-// The DispatchCoordinator: STEP 1 is a 1:1 passthrough over the proven
-// @lorenz/worker-pool WorkerPool.
+// The DispatchCoordinator wraps the @lorenz/worker-pool WorkerPool.
 //
 // With the default settings (slotsPerMachine=1) and the NULL McpEndpointManager
-// (perRunEndpoint=false, mcpEndpoint=null), every operation here is byte-identical
+// (perRunClaimEnforcement=false, mcpEndpoint=null), every operation here is byte-identical
 // at the runtime boundary to calling the underlying WorkerPool directly:
 //   - acquireRunSlot calls pool.acquire and, on `leased`, mints a RunSlot whose
 //     release/fail/heartbeat delegate straight to the wrapped WorkerLease (so the
@@ -77,11 +76,11 @@ function isLocalWorkerHost(workerHost) {
  * SAME machine. `(issueId, slotIndex)` is the key that feeds both the per-run
  * `runKey` (`${slotIndex}`) AND the workspace slot suffix, so two co-resident slots
  * sharing it would collide on BOTH the per-run endpoint/tunnel key and the
- * workspace dir. Rather than silently disambiguate (openQuestion #1), the
- * coordinator ASSERTS-AND-REJECTS: the just-bound lease is settled HEALTHY (the worker
- * itself is fine) and NO slot is registered, so this invariant violation surfaces
- * loudly. The runtime maps the throw to `worker_pool_acquire_error` exactly like any
- * other acquire fault, leaving the first slot untouched.
+ * workspace dir. Rather than silently disambiguate, the coordinator
+ * ASSERTS-AND-REJECTS: the just-bound lease is settled HEALTHY (the worker itself is
+ * fine) and NO slot is registered, so this invariant violation surfaces loudly. The
+ * runtime maps the throw to `worker_pool_acquire_error` exactly like any other
+ * acquire fault, leaving the first slot untouched.
  */
 export class RunSlotCollisionError extends Error {
     issueId;
@@ -96,8 +95,34 @@ export class RunSlotCollisionError extends Error {
     }
 }
 /**
- * Mints a {@link RunSlot} wrapping a settled-once {@link WorkerLease}. STEP 1 always
- * passes `mcpEndpoint = null` (the null manager mints nothing) so release/fail are
+ * Thrown by {@link DispatchCoordinator.acquireRunSlot} when a co-residence run
+ * (`slotsPerMachine > 1`, per-run-claim enforcement on) binds to a LOCAL (empty)
+ * worker host. The per-run claim model only covers REAL remote hosts: an empty
+ * host routes through the manager's null/local path, which mints NO Token B claim
+ * and keeps acp's settings-wide endpoint, so a co-resident local run would share an
+ * unscoped endpoint with its neighbours - a cross-run authority leak. The startup
+ * gate refuses co-residence without claim enforcement; this is the runtime backstop
+ * for a slot that lands on an empty host at acquire time. The just-bound lease is
+ * settled HEALTHY (the worker is fine) and NO slot is registered; the runtime maps
+ * the throw to worker_pool_acquire_error.
+ */
+export class LocalCoResidenceError extends Error {
+    issueId;
+    slotIndex;
+    machineLeaseId;
+    constructor(args) {
+        super(`local_co_residence_unscoped: (issueId=${args.issueId}, slotIndex=${args.slotIndex}) bound to ` +
+            `an empty worker host under slotsPerMachine>1; a local run cannot mint a per-run scoped ` +
+            `Token B claim, so co-residence on a local host is refused`);
+        this.name = "LocalCoResidenceError";
+        this.issueId = args.issueId;
+        this.slotIndex = args.slotIndex;
+        this.machineLeaseId = args.machineLeaseId;
+    }
+}
+/**
+ * Mints a {@link RunSlot} wrapping a settled-once {@link WorkerLease}. With the
+ * null manager `mcpEndpoint = null` (nothing is minted) so release/fail are
  * byte-identical to the underlying lease settle. The slot holds a single
  * `settled` flag so release/fail are exactly-once on THIS handle (a second call is
  * a no-op and never reaches the lease); the lease itself stays the authoritative
@@ -173,12 +198,11 @@ function createRunSlot(args) {
     };
 }
 /**
- * Constructs the STEP 1 passthrough {@link DispatchCoordinator}. `settings` is
- * retained for the later reconcile/co-residence paths; in STEP 1 it is not read
- * past construction (the pool owns the live settings). The injected
- * `mcpEndpointManager` is the null passthrough in STEP 1, so every minted slot
- * carries `mcpEndpoint = null` and the coordinator advertises
- * `perRunEndpoint = false`.
+ * Constructs a {@link DispatchCoordinator}. With the null `mcpEndpointManager`
+ * every minted slot carries `mcpEndpoint = null` and the coordinator advertises
+ * `perRunClaimEnforcement = false` (the passthrough path); a concrete manager
+ * mints a per-run endpoint per slot and advertises `true`. `settings` is read for
+ * the coordinator-owned tunnel budget (the pool owns its own live settings).
  */
 export function createDispatchCoordinator(deps) {
     const { pool, mcpEndpointManager } = deps;
@@ -197,38 +221,67 @@ export function createDispatchCoordinator(deps) {
     // BEFORE drain returns and the daemon stops the local server - otherwise shutdown
     // races live slot teardown and strands those resources.
     const pendingRecycleFails = new Set();
-    // SYNCHRONOUS tunnel reservations held while an acquire is between the ceiling
-    // check and a successful registration. The ceiling check passes and increments
-    // this in the SAME JS tick (before any `await mcpEndpointManager.open`), so two
-    // concurrent acquires can never both slip past a maxConcurrentTunnels ceiling:
-    // the second sees the first's pending reservation. Each reservation is released
-    // exactly once - on open FAILURE, on a post-open guard rejection, or on slot
-    // settlement (via the slot's onSettled) - mirroring the worker pool's single-flight
-    // reservedProvisions counter. A negative count is impossible because every
-    // increment is paired with exactly one release.
-    let reservedTunnels = 0;
+    // SYNCHRONOUS per-HOST tunnel reservations held while an acquire is between the
+    // ceiling check and a successful registration, keyed by worker host. The ceiling
+    // check passes and increments the host's reservation count in the SAME JS tick
+    // (before any `await mcpEndpointManager.open`), so two concurrent acquires can
+    // never both slip past a maxConcurrentTunnels ceiling: the second sees the first's
+    // pending reservation. Co-resident runs on ONE host share ONE `ssh -R` tunnel, so
+    // the budget counts DISTINCT hosts: a host that already has a live tunnel (or
+    // reservation) consumes no additional budget for a second co-resident run. Each
+    // reservation is released exactly once - on open FAILURE, on a post-open guard
+    // rejection, or on slot settlement (via the slot's onSettled).
+    const reservedTunnelHosts = new Map();
+    const reserveTunnelHost = (workerHost) => {
+        reservedTunnelHosts.set(workerHost, (reservedTunnelHosts.get(workerHost) ?? 0) + 1);
+    };
+    const unreserveTunnelHost = (workerHost) => {
+        const count = reservedTunnelHosts.get(workerHost);
+        if (count === undefined)
+            return;
+        if (count <= 1)
+            reservedTunnelHosts.delete(workerHost);
+        else
+            reservedTunnelHosts.set(workerHost, count - 1);
+    };
     // The live settings the coordinator reads for the tunnel-exhaustion ceiling.
     // `reconcile` updates this in place so a config reload that raises/lowers the
     // ceiling takes effect WITHOUT reconstructing the singleton (the live-slot
     // registry is preserved across the reload). The pool owns its own live settings;
     // this reference is only read for the coordinator-owned tunnel budget.
     let currentSettings = deps.settings;
-    // Counts LIVE per-run tunnels: registered slots whose `mcpEndpoint` is non-null
-    // (a local / null-endpoint slot consumes no tunnel budget) PLUS the pending
-    // reservations held by in-flight acquires that have passed the ceiling check but
-    // not yet registered. Including the reservations is what closes the
+    // Counts LIVE per-HOST tunnels: the number of DISTINCT worker hosts that hold a
+    // live `ssh -R` reverse tunnel. A host is counted when it has a registered slot
+    // whose `mcpEndpoint` is non-null (a local / null-endpoint slot consumes no
+    // tunnel budget) OR a pending reservation held by an in-flight acquire. Two
+    // co-resident runs on ONE host SHARE one tunnel, so that host counts ONCE - the
+    // budget tracks actual tunnels, not slots. Including the reservations closes the
     // concurrent-acquire race: registration happens only AFTER `await
-    // mcpEndpointManager.open`, so without the reservation a second acquire would
-    // count zero live tunnels while the first is still mid-open and over-open the
-    // ceiling. The registered refcount stays exact via the open-on-bind /
+    // mcpEndpointManager.open`, so without the reservation a second acquire (on a NEW
+    // host) would count one fewer tunnel while the first is still mid-open and
+    // over-open the ceiling. The registered set stays exact via the open-on-bind /
     // close-on-settle lifecycle; the reservation covers the open-in-flight gap.
     const liveTunnelCount = () => {
-        let count = reservedTunnels;
+        const hosts = new Set(reservedTunnelHosts.keys());
         for (const slot of slots.values()) {
             if (slot.mcpEndpoint !== null)
-                count += 1;
+                hosts.add(slot.workerHost);
         }
-        return count;
+        return hosts.size;
+    };
+    // Whether `workerHost` ALREADY holds a live per-host tunnel (a registered
+    // non-null-endpoint slot on it, or a pending in-flight reservation for it). A
+    // co-resident acquire on such a host opens NO new tunnel, so it neither trips the
+    // ceiling nor takes an additional budget unit; the shared host tunnel is already
+    // counted.
+    const hostHasLiveTunnel = (workerHost) => {
+        if ((reservedTunnelHosts.get(workerHost) ?? 0) > 0)
+            return true;
+        for (const slot of slots.values()) {
+            if (slot.mcpEndpoint !== null && slot.workerHost === workerHost)
+                return true;
+        }
+        return false;
     };
     // Recycle-vs-endpoint ordering invariant: the pool fires this INSIDE the per-worker
     // mutex immediately BEFORE it destroys a machine. We fail every still-open
@@ -267,7 +320,9 @@ export function createDispatchCoordinator(deps) {
             }
         });
     }
-    const capabilities = { perRunEndpoint: mcpEndpointManager.perRunEndpoint };
+    const capabilities = {
+        perRunClaimEnforcement: mcpEndpointManager.perRunClaimEnforcement,
+    };
     return {
         capabilities,
         async acquireRunSlot(req) {
@@ -282,16 +337,15 @@ export function createDispatchCoordinator(deps) {
                 // runtime maps every reason onto the single worker_host_capacity event.
                 return { status: "no_capacity", reason: acquired.reason };
             }
-            // (issueId, slotIndex) uniqueness invariant (STEP 3 / T3b): `(issueId,
-            // slotIndex)` feeds BOTH the per-run `runKey` (`${slotIndex}`) and the
-            // workspace slot suffix, so the coordinator must NEVER place two live slots
-            // sharing it on ONE machine - they would collide on the endpoint/tunnel key
-            // AND the workspace dir. We check the registry RIGHT AFTER bind and BEFORE
-            // opening the endpoint (so a colliding endpoint is never minted): if a live
-            // slot already holds this (issueId, slotIndex) on this worker, settle the
-            // just-bound lease HEALTHY (the worker is fine) and assert-and-reject rather than
-            // silently disambiguate (openQuestion #1). The runtime maps the throw to
-            // worker_pool_acquire_error, leaving the first slot untouched.
+            // (issueId, slotIndex) uniqueness invariant: `(issueId, slotIndex)` feeds
+            // BOTH the per-run `runKey` (`${slotIndex}`) and the workspace slot suffix, so
+            // the coordinator must NEVER place two live slots sharing it on ONE machine -
+            // they would collide on the endpoint/tunnel key AND the workspace dir. Check
+            // the registry RIGHT AFTER bind and BEFORE opening the endpoint (so a colliding
+            // endpoint is never minted): if a live slot already holds this (issueId,
+            // slotIndex) on this worker, settle the just-bound lease HEALTHY (the worker is
+            // fine) and assert-and-reject rather than silently disambiguate. The runtime
+            // maps the throw to worker_pool_acquire_error, leaving the first slot untouched.
             const machineLeaseId = acquired.lease.workerId;
             for (const existing of slots.values()) {
                 if (existing.issueId === req.issueId &&
@@ -310,42 +364,75 @@ export function createDispatchCoordinator(deps) {
                     });
                 }
             }
-            // STEP 3 (T3c #1): tunnel-exhaustion ceiling. When `maxConcurrentTunnels` is
-            // set, opening another per-run endpoint that would exceed it surfaces as a
-            // TYPED `no_capacity` ('tunnel_exhausted'), NEVER an unhandled throw inside
-            // acquireRunSlot. We check this AFTER lease-bind + the collision guard but
-            // BEFORE the open so a budget-exhausted slot never mints (then has to tear
-            // down) a tunnel. The ceiling counts ONLY live remote tunnels and applies
-            // ONLY when this open would actually mint one - a local (empty) host
-            // (and the null passthrough, which mints nothing) consumes no `ssh -N` child,
-            // so it is neither gated by nor counted against the budget. The just-bound
-            // WorkerLease is settled HEALTHY (the worker is fine; only the tunnel budget is
-            // exhausted) and NO slot is registered, so a sibling run recovers via the
-            // single `worker_host_capacity` dispatch signal instead of seeing a fault.
+            // Empty-host fail-loud bypass closure: a CO-RESIDENCE run (`slotsPerMachine >
+            // 1`, per-run-claim enforcement on) that needs an MCP endpoint must NEVER land
+            // on a LOCAL (empty) worker host. An empty host routes through the manager's
+            // null/local path, which mints NO Token B claim and keeps acp's settings-wide
+            // endpoint, so a co-resident local run would share one unscoped endpoint with
+            // its neighbours - a cross-run authority leak. The startup gate refuses
+            // co-residence without claim enforcement; this is the runtime backstop for a
+            // slot that lands on an empty host at acquire time. Checked AFTER lease-bind +
+            // collision but BEFORE the endpoint open / tunnel reservation so no unscoped
+            // endpoint is ever minted. The lease is settled HEALTHY and NO slot is
+            // registered; the runtime maps the throw to worker_pool_acquire_error.
+            // Single-tenant (slotsPerMachine<=1) and runs that consume no endpoint are
+            // unaffected.
+            const needsMcpEndpoint = req.needsMcpEndpoint ?? true;
+            if (needsMcpEndpoint &&
+                mcpEndpointManager.perRunClaimEnforcement &&
+                currentSettings.slotsPerMachine > 1 &&
+                isLocalWorkerHost(acquired.lease.workerHost)) {
+                try {
+                    await acquired.lease.release("healthy");
+                }
+                catch {
+                    // Swallow: the bypass refusal is the surfaced fault; the worker is healthy.
+                }
+                throw new LocalCoResidenceError({
+                    issueId: req.issueId,
+                    slotIndex: req.slotIndex,
+                    machineLeaseId,
+                });
+            }
+            // Tunnel-exhaustion ceiling. When `maxConcurrentTunnels` is set, opening
+            // another per-run endpoint that would exceed it surfaces as a TYPED
+            // `no_capacity` ('tunnel_exhausted'), NEVER an unhandled throw inside
+            // acquireRunSlot. Checked AFTER lease-bind + the collision guard but BEFORE the
+            // open so a budget-exhausted slot never mints (then has to tear down) a tunnel.
+            // The ceiling counts ONLY live remote tunnels and applies ONLY when this open
+            // would actually mint one - a local (empty) host (and the null passthrough,
+            // which mints nothing) consumes no `ssh -N` child, so it is neither gated by
+            // nor counted against the budget. The just-bound WorkerLease is settled HEALTHY
+            // (only the tunnel budget is exhausted) and NO slot is registered, so a sibling
+            // run recovers via the single `worker_host_capacity` dispatch signal.
             //
             // The ceiling check + the reservation are a SINGLE synchronous step (no
-            // `await` between `liveTunnelCount()` and `reservedTunnels += 1`): two
-            // concurrent acquires therefore cannot both pass it, because the second's
-            // count includes the first's pending reservation. The reservation is held
-            // across the (awaited) open so the gap between check and registration cannot
-            // be over-subscribed; it is released on open FAILURE and otherwise handed off
-            // to the slot's settlement (so the budget is freed exactly once when the run
-            // finishes). Mirrors the worker pool's reservedProvisions single-flight.
+            // `await` between `liveTunnelCount()` and `reserveTunnelHost(...)`): two
+            // concurrent acquires therefore cannot both pass it, because the second's count
+            // includes the first's pending reservation. The reservation is held across the
+            // (awaited) open so the gap between check and registration cannot be
+            // over-subscribed; it is released on open FAILURE and otherwise handed off to
+            // the slot's settlement (freed exactly once when the run finishes). Mirrors the
+            // worker pool's reservedProvisions single-flight.
             const runKey = runKeyFor(req.issueId, req.slotIndex);
             const tunnelCeiling = currentSettings.maxConcurrentTunnels;
-            // Whether THIS run actually consumes a per-run MCP endpoint. The Codex/appserver
-            // executor runs its dynamic tools IN-PROCESS and ignores the endpoint, so a
-            // run that needs none must SKIP the open AND the tunnel reservation/ceiling
-            // entirely (it would otherwise be SKIPPED by an open failure / port-forward
-            // restriction / maxConcurrentTunnels for an endpoint it never uses). Only
-            // ACP/Claude reads `/mcp` over the reverse tunnel. Defaults to `true`
-            // (the existing ACP behaviour) when a legacy caller omits the field.
-            const needsMcpEndpoint = req.needsMcpEndpoint ?? true;
+            // `needsMcpEndpoint` (resolved above the local-co-residence guard) is whether
+            // THIS run actually consumes a per-run MCP endpoint. The Codex/appserver
+            // executor runs its dynamic tools IN-PROCESS and ignores the endpoint, so a run
+            // that needs none SKIPS the open AND the tunnel reservation/ceiling entirely
+            // (it would otherwise be SKIPPED by an open failure / port-forward restriction /
+            // maxConcurrentTunnels for an endpoint it never uses). Only ACP/Claude reads
+            // `/mcp` over the reverse tunnel.
             const wouldOpenTunnel = needsMcpEndpoint &&
-                mcpEndpointManager.perRunEndpoint &&
+                mcpEndpointManager.perRunClaimEnforcement &&
                 !isLocalWorkerHost(acquired.lease.workerHost);
+            // A co-resident acquire on a host that ALREADY holds a live tunnel opens no NEW
+            // tunnel, so it is exempt from the ceiling AND takes no extra budget unit (the
+            // shared host tunnel is already counted). Only an acquire that would open a
+            // tunnel on a NEW host is gated/reserved.
+            const opensNewHostTunnel = wouldOpenTunnel && !hostHasLiveTunnel(acquired.lease.workerHost);
             let tunnelReserved = false;
-            if (wouldOpenTunnel && tunnelCeiling !== undefined) {
+            if (opensNewHostTunnel && tunnelCeiling !== undefined) {
                 if (liveTunnelCount() >= tunnelCeiling) {
                     // Settle the just-bound lease HEALTHY (best-effort; a settle hiccup must
                     // not mask the capacity signal) and return the typed no_capacity reason.
@@ -357,8 +444,8 @@ export function createDispatchCoordinator(deps) {
                     }
                     return { status: "no_capacity", reason: "tunnel_exhausted" };
                 }
-                // Take the reservation in the SAME JS tick the ceiling check passed.
-                reservedTunnels += 1;
+                // Take the per-host reservation in the SAME JS tick the ceiling check passed.
+                reserveTunnelHost(acquired.lease.workerHost);
                 tunnelReserved = true;
             }
             // Releases this acquire's pending tunnel reservation exactly once (a no-op if
@@ -366,12 +453,12 @@ export function createDispatchCoordinator(deps) {
             const releaseReservation = () => {
                 if (tunnelReserved) {
                     tunnelReserved = false;
-                    reservedTunnels -= 1;
+                    unreserveTunnelHost(acquired.lease.workerHost);
                 }
             };
-            // STEP 2: open the WHOLE per-run endpoint AFTER the lease-bind (the null
-            // manager still mints nothing, keeping the single-slot/local path
-            // byte-identical). The runKey is the issue-scoped `${issueId}#${slotIndex}`.
+            // Open the WHOLE per-run endpoint AFTER the lease-bind (the null manager mints
+            // nothing, keeping the single-slot/local path byte-identical). The runKey is
+            // the issue-scoped `${issueId}#${slotIndex}`.
             // SKIP the open entirely for a run that consumes no endpoint (Codex/appserver):
             // the slot binds with a null endpoint (no reservation was taken, since
             // wouldOpenTunnel is false when needsMcpEndpoint is false) so it can never be
@@ -492,6 +579,24 @@ export function createDispatchCoordinator(deps) {
         async hydrate() {
             await pool.hydrate();
         },
+        isRunLive(runKey, workerHost, generation) {
+            // SYNCHRONOUS read of the live-slot registry the coordinator itself mutates
+            // (never a cached copy), so a settled/recycled run is observed not-live
+            // immediately. runKey and workerHost both come from the resolved Token B claim
+            // (no self-reported identity the caller could spoof). The generation must match
+            // the endpoint the live slot holds: a recycle bumps the slot's generation, so a
+            // token stamped against the prior generation is denied even inside the
+            // registry's own async teardown window.
+            for (const slot of slots.values()) {
+                if (slot.runKey === runKey &&
+                    slot.workerHost === workerHost &&
+                    slot.mcpEndpoint !== null &&
+                    slot.mcpEndpoint.generation === generation) {
+                    return true;
+                }
+            }
+            return false;
+        },
         snapshot() {
             const base = pool.snapshot();
             const slotEntries = [];

package/node_modules/@lorenz/dispatch-coordinator/dist/coordinator.js.map

@@ -1 +1 @@
-{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../src/coordinator.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kCAAkC;AAClC,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AACnF,yEAAyE;AACzE,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,6CAA6C;AAC7C,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,wCAAwC;AACxC,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,wCAAwC;AAkCxC;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACxB,KAAK,CAAU;IACxB,UAAU,CAAS;IACnB,MAAM,CAAS;IAExB,YAAY,IAA4D;QACtE,KAAK,CACH,6BAA6B,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,SAAiB;IACnD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,cAAc,CAAS;IAEhC,YAAY,IAAoE;QAC9E,KAAK,CACH,gCAAgC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,SAAS,6BAA6B,IAAI,CAAC,cAAc,EAAE,CAC5H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF;AAwFD;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAQtB;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC9F,mFAAmF;IACnF,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE;IACF,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,GAAwB,EAAiB,EAAE;QAC/D,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,QAAQ,CAAC;gBACP,KAAK,EAAE,qCAAqC;gBAC5C,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,YAAY,CAAC,YAAY,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,cAAc,EAAE,KAAK,CAAC,QAAQ;QAC9B,OAAO;QACP,SAAS;QACT,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS;YACP,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAsB;YAClC,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAmC;IAEnC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAC1C,4EAA4E;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IACnD,6EAA6E;IAC7E,kFAAkF;IAClF,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzC,mFAAmF;IACnF,oFAAoF;IACpF,2EAA2E;IAC3E,6EAA6E;IAC7E,kFAAkF;IAClF,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAiB,CAAC;IAErD,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,oFAAoF;IACpF,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,iFAAiF;IACjF,uEAAuE;IACvE,IAAI,eAAe,GAAuB,IAAI,CAAC,QAAQ,CAAC;IAExD,gFAAgF;IAChF,4EAA4E;IAC5E,iFAAiF;IACjF,oEAAoE;IACpE,kEAAkE;IAClE,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,GAAW,EAAE;QACnC,IAAI,KAAK,GAAG,eAAe,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,oFAAoF;IACpF,2EAA2E;IAC3E,kFAAkF;IAClF,4EAA4E;IAC5E,2EAA2E;IAC3E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,iFAAiF;IACjF,kEAAkE;IAClE,EAAE;IACF,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,kFAAkF;IAClF,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAgB,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,8EAA8E;gBAC9E,wEAAwE;gBACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACtD,yEAAyE;oBACzE,wDAAwD;gBAC1D,CAAC,CAAC,CAAC;gBACH,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC,cAAc,EAAW,CAAC;IAEpF,OAAO;QACL,YAAY;QAEZ,KAAK,CAAC,cAAc,CAAC,GAA0B;YAC7C,2EAA2E;YAC3E,+EAA+E;YAC/E,8EAA8E;YAC9E,4EAA4E;YAC5E,qCAAqC;YACrC,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAExD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,oEAAoE;gBACpE,wEAAwE;gBACxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YAED,uEAAuE;YACvE,uEAAuE;YACvE,4EAA4E;YAC5E,4EAA4E;YAC5E,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,kFAAkF;YAClF,yEAAyE;YACzE,+DAA+D;YAC/D,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC/C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IACE,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;oBAChC,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;oBACpC,QAAQ,CAAC,cAAc,KAAK,cAAc,EAC1C,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,uEAAuE;oBACzE,CAAC;oBACD,MAAM,IAAI,qBAAqB,CAAC;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,6EAA6E;YAC7E,2EAA2E;YAC3E,4EAA4E;YAC5E,2EAA2E;YAC3E,2EAA2E;YAC3E,0EAA0E;YAC1E,qEAAqE;YACrE,8EAA8E;YAC9E,2EAA2E;YAC3E,gFAAgF;YAChF,0EAA0E;YAC1E,2EAA2E;YAC3E,EAAE;YACF,wEAAwE;YACxE,uEAAuE;YACvE,0EAA0E;YAC1E,0EAA0E;YAC1E,6EAA6E;YAC7E,8EAA8E;YAC9E,6EAA6E;YAC7E,yEAAyE;YACzE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,aAAa,GAAG,eAAe,CAAC,oBAAoB,CAAC;YAC3D,iFAAiF;YACjF,4EAA4E;YAC5E,4EAA4E;YAC5E,4EAA4E;YAC5E,0EAA0E;YAC1E,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC;YACtD,MAAM,eAAe,GACnB,gBAAgB;gBAChB,kBAAkB,CAAC,cAAc;gBACjC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,eAAe,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBACnD,IAAI,eAAe,EAAE,IAAI,aAAa,EAAE,CAAC;oBACvC,yEAAyE;oBACzE,yEAAyE;oBACzE,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,0EAA0E;oBAC5E,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAC/D,CAAC;gBACD,qEAAqE;gBACrE,eAAe,IAAI,CAAC,CAAC;gBACrB,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,8EAA8E;YAC9E,yDAAyD;YACzD,MAAM,kBAAkB,GAAG,GAAS,EAAE;gBACpC,IAAI,cAAc,EAAE,CAAC;oBACnB,cAAc,GAAG,KAAK,CAAC;oBACvB,eAAe,IAAI,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC;YAEF,yEAAyE;YACzE,kEAAkE;YAClE,6EAA6E;YAC7E,gFAAgF;YAChF,uEAAuE;YACvE,8EAA8E;YAC9E,2EAA2E;YAC3E,6EAA6E;YAC7E,IAAI,QAAQ,GAAoD,IAAI,CAAC;YACrE,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC;wBACvC,iEAAiE;wBACjE,wEAAwE;wBACxE,wEAAwE;wBACxE,6EAA6E;wBAC7E,4EAA4E;wBAC5E,qEAAqE;wBACrE,2EAA2E;wBAC3E,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gCAAgC;wBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAK,eAAuC;wBAClE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;wBACrC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,4EAA4E;oBAC5E,4EAA4E;oBAC5E,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,uEAAuE;oBACvE,yDAAyD;oBACzD,6BAA6B;oBAC7B,kBAAkB,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,qEAAqE;oBACvE,CAAC;oBACD,MAAM,IAAI,iBAAiB,CAAC;wBAC1B,KAAK,EAAE,SAAS;wBAChB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;wBACrC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ;gBACR,kBAAkB;gBAClB,QAAQ;gBACR,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;oBACpB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;aACF,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,6EAA6E;YAC7E,qEAAqE;YACrE,mEAAmE;YACnE,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,OAAO;YACL,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QAED,UAAU;YACR,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3B,CAAC;QAED,mBAAmB,CAAC,EAAc;YAChC,oEAAoE;YACpE,0EAA0E;YAC1E,8EAA8E;YAC9E,kDAAkD;YAClD,IAAI,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAwB;YACtC,4EAA4E;YAC5E,oEAAoE;YACpE,2EAA2E;YAC3E,yEAAyE;YACzE,oEAAoE;YACpE,mEAAmE;YACnE,0EAA0E;YAC1E,4BAA4B;YAC5B,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzD,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,8EAA8E;YAC9E,oEAAoE;YACpE,2EAA2E;YAC3E,8EAA8E;YAC9E,sCAAsC;YACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAkD;YAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,iFAAiF;YACjF,2EAA2E;YAC3E,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,QAAQ;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;iBACrD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,QAAsC;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"coordinator.js","sourceRoot":"","sources":["../src/coordinator.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,gFAAgF;AAChF,2FAA2F;AAC3F,yEAAyE;AACzE,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,kFAAkF;AAClF,6CAA6C;AAC7C,kFAAkF;AAClF,+EAA+E;AAC/E,kFAAkF;AAClF,wCAAwC;AACxC,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,wCAAwC;AAgCxC;;;;;;;;;GASG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACxB,KAAK,CAAU;IACxB,UAAU,CAAS;IACnB,MAAM,CAAS;IAExB,YAAY,IAA4D;QACtE,KAAK,CACH,6BAA6B,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;CACF;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,OAAe,EAAE,SAAiB;IACnD,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,cAAc,CAAS;IAEhC,YAAY,IAAoE;QAC9E,KAAK,CACH,gCAAgC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,SAAS,6BAA6B,IAAI,CAAC,cAAc,EAAE,CAC5H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,cAAc,CAAS;IAEhC,YAAY,IAAoE;QAC9E,KAAK,CACH,yCAAyC,IAAI,CAAC,OAAO,eAAe,IAAI,CAAC,SAAS,aAAa;YAC7F,yFAAyF;YACzF,2DAA2D,CAC9D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;IAC5C,CAAC;CACF;AAuGD;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAQtB;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC9F,mFAAmF;IACnF,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,EAAE;IACF,gFAAgF;IAChF,iFAAiF;IACjF,gFAAgF;IAChF,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,2DAA2D;IAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,GAAwB,EAAiB,EAAE;QAC/D,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACtB,QAAQ,CAAC;gBACP,KAAK,EAAE,qCAAqC;gBAC5C,MAAM;gBACN,OAAO;gBACP,SAAS;gBACT,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,YAAY,CAAC,YAAY,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,EAAE,CAAC;YACZ,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,cAAc,EAAE,KAAK,CAAC,QAAQ;QAC9B,OAAO;QACP,SAAS;QACT,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM;QACN,WAAW,EAAE,QAAQ;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS;YACP,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAsB;YAClC,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAc;YACvB,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAmC;IAEnC,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAC1C,4EAA4E;IAC5E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IACnD,6EAA6E;IAC7E,kFAAkF;IAClF,+DAA+D;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzC,mFAAmF;IACnF,oFAAoF;IACpF,2EAA2E;IAC3E,6EAA6E;IAC7E,kFAAkF;IAClF,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAiB,CAAC;IAErD,gFAAgF;IAChF,iFAAiF;IACjF,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,kFAAkF;IAClF,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAQ,EAAE;QACrD,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;IACF,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAQ,EAAE;QACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,KAAK,IAAI,CAAC;YAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;;YAClD,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,iFAAiF;IACjF,uEAAuE;IACvE,IAAI,eAAe,GAAuB,IAAI,CAAC,QAAQ,CAAC;IAExD,gFAAgF;IAChF,gFAAgF;IAChF,4EAA4E;IAC5E,4EAA4E;IAC5E,gFAAgF;IAChF,iFAAiF;IACjF,kEAAkE;IAClE,kFAAkF;IAClF,2EAA2E;IAC3E,+EAA+E;IAC/E,4EAA4E;IAC5E,MAAM,eAAe,GAAG,GAAW,EAAE;QACnC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC,CAAC;IAEF,0EAA0E;IAC1E,8EAA8E;IAC9E,kFAAkF;IAClF,iFAAiF;IACjF,WAAW;IACX,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAAW,EAAE;QACxD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,oFAAoF;IACpF,2EAA2E;IAC3E,kFAAkF;IAClF,4EAA4E;IAC5E,2EAA2E;IAC3E,kFAAkF;IAClF,iFAAiF;IACjF,gFAAgF;IAChF,+EAA+E;IAC/E,iFAAiF;IACjF,kEAAkE;IAClE,EAAE;IACF,6EAA6E;IAC7E,gFAAgF;IAChF,2EAA2E;IAC3E,kFAAkF;IAClF,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,OAAO,IAAI,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC,kBAAkB,CAAC,CAAC,QAAgB,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,8EAA8E;gBAC9E,wEAAwE;gBACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACtD,yEAAyE;oBACzE,wDAAwD;gBAC1D,CAAC,CAAC,CAAC;gBACH,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChC,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG;QACnB,sBAAsB,EAAE,kBAAkB,CAAC,sBAAsB;KACzD,CAAC;IAEX,OAAO;QACL,YAAY;QAEZ,KAAK,CAAC,cAAc,CAAC,GAA0B;YAC7C,2EAA2E;YAC3E,+EAA+E;YAC/E,8EAA8E;YAC9E,4EAA4E;YAC5E,qCAAqC;YACrC,MAAM,QAAQ,GAAkB,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAExD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACjC,oEAAoE;gBACpE,wEAAwE;gBACxE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;YAED,0EAA0E;YAC1E,+EAA+E;YAC/E,8EAA8E;YAC9E,6EAA6E;YAC7E,gFAAgF;YAChF,yEAAyE;YACzE,gFAAgF;YAChF,6EAA6E;YAC7E,iFAAiF;YACjF,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC/C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtC,IACE,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;oBAChC,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;oBACpC,QAAQ,CAAC,cAAc,KAAK,cAAc,EAC1C,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,uEAAuE;oBACzE,CAAC;oBACD,MAAM,IAAI,qBAAqB,CAAC;wBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,8EAA8E;YAC9E,+EAA+E;YAC/E,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,wEAAwE;YACxE,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;YAC7E,uEAAuE;YACvE,uEAAuE;YACvE,2EAA2E;YAC3E,cAAc;YACd,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC;YACtD,IACE,gBAAgB;gBAChB,kBAAkB,CAAC,sBAAsB;gBACzC,eAAe,CAAC,eAAe,GAAG,CAAC;gBACnC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAC5C,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,4EAA4E;gBAC9E,CAAC;gBACD,MAAM,IAAI,qBAAqB,CAAC;oBAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YAED,yEAAyE;YACzE,oEAAoE;YACpE,sEAAsE;YACtE,gFAAgF;YAChF,gFAAgF;YAChF,8EAA8E;YAC9E,4EAA4E;YAC5E,6EAA6E;YAC7E,gFAAgF;YAChF,gFAAgF;YAChF,sEAAsE;YACtE,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,gFAAgF;YAChF,+EAA+E;YAC/E,qEAAqE;YACrE,8EAA8E;YAC9E,gFAAgF;YAChF,kDAAkD;YAClD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,aAAa,GAAG,eAAe,CAAC,oBAAoB,CAAC;YAC3D,8EAA8E;YAC9E,yEAAyE;YACzE,gFAAgF;YAChF,6EAA6E;YAC7E,iFAAiF;YACjF,6EAA6E;YAC7E,kCAAkC;YAClC,MAAM,eAAe,GACnB,gBAAgB;gBAChB,kBAAkB,CAAC,sBAAsB;gBACzC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,gFAAgF;YAChF,+EAA+E;YAC/E,4EAA4E;YAC5E,0CAA0C;YAC1C,MAAM,kBAAkB,GAAG,eAAe,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5F,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,kBAAkB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtD,IAAI,eAAe,EAAE,IAAI,aAAa,EAAE,CAAC;oBACvC,yEAAyE;oBACzE,yEAAyE;oBACzE,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,0EAA0E;oBAC5E,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;gBAC/D,CAAC;gBACD,8EAA8E;gBAC9E,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC7C,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,8EAA8E;YAC9E,yDAAyD;YACzD,MAAM,kBAAkB,GAAG,GAAS,EAAE;gBACpC,IAAI,cAAc,EAAE,CAAC;oBACnB,cAAc,GAAG,KAAK,CAAC;oBACvB,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC,CAAC;YAEF,+EAA+E;YAC/E,6EAA6E;YAC7E,8CAA8C;YAC9C,gFAAgF;YAChF,uEAAuE;YACvE,8EAA8E;YAC9E,2EAA2E;YAC3E,6EAA6E;YAC7E,IAAI,QAAQ,GAAoD,IAAI,CAAC;YACrE,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC;wBACvC,iEAAiE;wBACjE,wEAAwE;wBACxE,wEAAwE;wBACxE,6EAA6E;wBAC7E,4EAA4E;wBAC5E,qEAAqE;wBACrE,2EAA2E;wBAC3E,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gCAAgC;wBAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAK,eAAuC;wBAClE,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;wBACrC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,4EAA4E;oBAC5E,4EAA4E;oBAC5E,0EAA0E;oBAC1E,uEAAuE;oBACvE,0EAA0E;oBAC1E,uEAAuE;oBACvE,yDAAyD;oBACzD,6BAA6B;oBAC7B,kBAAkB,EAAE,CAAC;oBACrB,IAAI,CAAC;wBACH,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC1C,CAAC;oBAAC,MAAM,CAAC;wBACP,qEAAqE;oBACvE,CAAC;oBACD,MAAM,IAAI,iBAAiB,CAAC;wBAC1B,KAAK,EAAE,SAAS;wBAChB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;wBACrC,MAAM;qBACP,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,IAAI,GAAG,aAAa,CAAC;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ;gBACR,kBAAkB;gBAClB,QAAQ;gBACR,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;oBACpB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvB,CAAC;aACF,CAAC,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,6EAA6E;YAC7E,qEAAqE;YACrE,mEAAmE;YACnE,kBAAkB,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACnC,CAAC;QAED,yEAAyE;QACzE,wEAAwE;QACxE,4DAA4D;QAC5D,OAAO;YACL,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,CAAC;QAED,UAAU;YACR,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3B,CAAC;QAED,mBAAmB,CAAC,EAAc;YAChC,oEAAoE;YACpE,0EAA0E;YAC1E,8EAA8E;YAC9E,kDAAkD;YAClD,IAAI,CAAC,mBAAmB,EAAE,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAwB;YACtC,4EAA4E;YAC5E,oEAAoE;YACpE,2EAA2E;YAC3E,yEAAyE;YACzE,oEAAoE;YACpE,mEAAmE;YACnE,0EAA0E;YAC1E,4BAA4B;YAC5B,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzD,4EAA4E;YAC5E,4EAA4E;YAC5E,6EAA6E;YAC7E,2EAA2E;YAC3E,8EAA8E;YAC9E,oEAAoE;YACpE,2EAA2E;YAC3E,8EAA8E;YAC9E,sCAAsC;YACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAkD;YAC5D,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,iFAAiF;YACjF,2EAA2E;YAC3E,yEAAyE;YACzE,+DAA+D;YAC/D,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;QAED,SAAS,CAAC,MAAc,EAAE,UAAkB,EAAE,UAAkB;YAC9D,4EAA4E;YAC5E,wEAAwE;YACxE,+EAA+E;YAC/E,gFAAgF;YAChF,gFAAgF;YAChF,uEAAuE;YACvE,wCAAwC;YACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,IACE,IAAI,CAAC,MAAM,KAAK,MAAM;oBACtB,IAAI,CAAC,UAAU,KAAK,UAAU;oBAC9B,IAAI,CAAC,WAAW,KAAK,IAAI;oBACzB,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EAC1C,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,QAAQ;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,WAAW,GAA2B,EAAE,CAAC;YAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClC,WAAW,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,UAAU,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;iBACrD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,QAAsC;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/node_modules/@lorenz/dispatch-coordinator/dist/gate.d.ts

@@ -1,16 +1,18 @@
 import type { WorkerPoolSettings } from "@lorenz/domain";
 /** The subset of a coordinator's capabilities the gate consumes. */
 export interface SlotsPerMachineGateCapabilities {
-    readonly perRunEndpoint: boolean;
+    readonly perRunClaimEnforcement: boolean;
 }
 /**
  * Returns an operator-facing error message when `workerPool` would be unsafe to run,
  * or `null` when it passes. Co-residence packs multiple run slots onto one machine,
  * so `slotsPerMachine > 1` requires BOTH:
  *
- *  1. a coordinator that advertises `capabilities.perRunEndpoint === true` (each
- *     RunSlot owns its own MCP endpoint - token + local-server + tunnel - so two
- *     co-resident runs never share or tear out each other's endpoint), and
+ *  1. a coordinator whose gateway advertises `capabilities.perRunClaimEnforcement
+ *     === true`: the shared MCP gateway resolves each request's per-run scoped Token
+ *     B claim server-side, re-checks the owning run is still live, fences it by
+ *     generation, and fails closed otherwise - so two co-resident runs sharing one
+ *     host + one reverse tunnel can never authorize against each other's claim, and
  *  2. an explicit `worker.worker_pool.co_residence` operator opt-in, because a single
  *     poisoned worker fails every co-resident run on recycle: widening that blast
  *     radius is a deliberate tradeoff, not just a capability.

package/node_modules/@lorenz/dispatch-coordinator/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,oEAAoE;AACpE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,YAAY,EAAE,+BAA+B,GAAG,SAAS,GACxD,MAAM,GAAG,IAAI,CAkBf"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,oEAAoE;AACpE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,kBAAkB,GAAG,SAAS,EAC1C,YAAY,EAAE,+BAA+B,GAAG,SAAS,GACxD,MAAM,GAAG,IAAI,CAmBf"}

package/node_modules/@lorenz/dispatch-coordinator/dist/gate.js

@@ -17,9 +17,11 @@
  * or `null` when it passes. Co-residence packs multiple run slots onto one machine,
  * so `slotsPerMachine > 1` requires BOTH:
  *
- *  1. a coordinator that advertises `capabilities.perRunEndpoint === true` (each
- *     RunSlot owns its own MCP endpoint - token + local-server + tunnel - so two
- *     co-resident runs never share or tear out each other's endpoint), and
+ *  1. a coordinator whose gateway advertises `capabilities.perRunClaimEnforcement
+ *     === true`: the shared MCP gateway resolves each request's per-run scoped Token
+ *     B claim server-side, re-checks the owning run is still live, fences it by
+ *     generation, and fails closed otherwise - so two co-resident runs sharing one
+ *     host + one reverse tunnel can never authorize against each other's claim, and
  *  2. an explicit `worker.worker_pool.co_residence` operator opt-in, because a single
  *     poisoned worker fails every co-resident run on recycle: widening that blast
  *     radius is a deliberate tradeoff, not just a capability.
@@ -32,9 +34,10 @@
 export function checkSlotsPerMachineGate(workerPool, capabilities) {
     if (!workerPool || workerPool.enabled === false || workerPool.slotsPerMachine <= 1)
         return null;
-    if (capabilities?.perRunEndpoint !== true) {
-        return ("worker.worker_pool.max_in_flight > 1 requires a dispatch coordinator with per-run MCP " +
-            "endpoints (capabilities.perRunEndpoint), which the current build does not provide");
+    if (capabilities?.perRunClaimEnforcement !== true) {
+        return ("worker.worker_pool.max_in_flight > 1 requires a dispatch coordinator whose MCP gateway " +
+            "enforces per-run scoped claims (capabilities.perRunClaimEnforcement): server-side Token B " +
+            "resolution, owner re-check, and a generation fence, which the current build does not provide");
     }
     if (workerPool.coResidence !== true) {
         return ("worker.worker_pool.max_in_flight > 1 requires the explicit worker.worker_pool.co_residence " +

package/node_modules/@lorenz/dispatch-coordinator/dist/gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kFAAkF;AAClF,+DAA+D;AAC/D,EAAE;AACF,+EAA+E;AAC/E,wCAAwC;AACxC,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,gBAAgB;AAShB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA0C,EAC1C,YAAyD;IAEzD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,CAAC,eAAe,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhG,IAAI,YAAY,EAAE,cAAc,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,CACL,wFAAwF;YACxF,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,CACL,6FAA6F;YAC7F,wFAAwF;YACxF,uFAAuF;YACvF,cAAc,CACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,kFAAkF;AAClF,+DAA+D;AAC/D,EAAE;AACF,+EAA+E;AAC/E,wCAAwC;AACxC,gFAAgF;AAChF,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AACjF,gBAAgB;AAShB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,UAA0C,EAC1C,YAAyD;IAEzD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,UAAU,CAAC,eAAe,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhG,IAAI,YAAY,EAAE,sBAAsB,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,CACL,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACpC,OAAO,CACL,6FAA6F;YAC7F,wFAAwF;YACxF,uFAAuF;YACvF,cAAc,CACf,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@lorenz/dispatch-coordinator/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { createDispatchCoordinator, EndpointOpenError, RunSlotCollisionError, type DispatchCoordinator, type CreateDispatchCoordinatorDeps, type AcquireRunSlotResult, type NoCapacityReason, type CapacityProbe, type DispatchCoordinatorSnapshot, type RunSlotSnapshotEntry, } from "./coordinator.js";
+export { createDispatchCoordinator, EndpointOpenError, LocalCoResidenceError, RunSlotCollisionError, type DispatchCoordinator, type CreateDispatchCoordinatorDeps, type AcquireRunSlotResult, type NoCapacityReason, type CapacityProbe, type DispatchCoordinatorSnapshot, type RunSlotSnapshotEntry, } from "./coordinator.js";
 export { type RunSlot, type AcquireRunSlotRequest, type McpEndpointManager } from "./types.js";
 export { nullEndpointManager, createNullEndpointManager } from "./nullEndpointManager.js";
 export { createPerRunEndpointManager, type CreatePerRunEndpointManagerDeps, type AcquireAgentMcpEndpointForRun, } from "./mcpEndpointManager.js";

package/node_modules/@lorenz/dispatch-coordinator/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EACL,2BAA2B,EAC3B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,GACnC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,KAAK,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE/F,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EACL,2BAA2B,EAC3B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,GACnC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,MAAM,WAAW,CAAC"}

package/node_modules/@lorenz/dispatch-coordinator/dist/index.js

@@ -4,12 +4,11 @@
 // machine pool and an injected McpEndpointManager to mint per-run RunSlots.
 // Distinct from the pure-policy @lorenz/dispatch package.
 //
-// STEP 1 surface: the DispatchCoordinator is a 1:1 passthrough over WorkerPool
-// (default slotsPerMachine=1 + the null McpEndpointManager make every RunSlot
-// carry mcpEndpoint=null), so the runtime boundary is byte-identical to calling
-// the WorkerPool directly. Later steps add per-run MCP endpoints, co-residence, and
-// a provider hot-swap behind this same surface.
-export { createDispatchCoordinator, EndpointOpenError, RunSlotCollisionError, } from "./coordinator.js";
+// With default slotsPerMachine=1 and the null McpEndpointManager every RunSlot
+// carries mcpEndpoint=null, so the runtime boundary is byte-identical to calling
+// the WorkerPool directly. A concrete McpEndpointManager adds per-run MCP
+// endpoints and co-residence behind this same surface.
+export { createDispatchCoordinator, EndpointOpenError, LocalCoResidenceError, RunSlotCollisionError, } from "./coordinator.js";
 export { nullEndpointManager, createNullEndpointManager } from "./nullEndpointManager.js";
 export { createPerRunEndpointManager, } from "./mcpEndpointManager.js";
 export { checkSlotsPerMachineGate } from "./gate.js";

package/node_modules/@lorenz/dispatch-coordinator/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,oFAAoF;AACpF,gDAAgD;AAEhD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,GAQtB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EACL,2BAA2B,GAG5B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAwC,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+BAA+B;AAC/B,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,0EAA0E;AAC1E,uDAAuD;AAEvD,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,GAQtB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EACL,2BAA2B,GAG5B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,wBAAwB,EAAwC,MAAM,WAAW,CAAC"}

package/node_modules/@lorenz/dispatch-coordinator/dist/mcpEndpointManager.d.ts

@@ -16,11 +16,13 @@ export interface CreatePerRunEndpointManagerDeps {
     acquireForRun: AcquireAgentMcpEndpointForRun;
 }
 /**
- * Constructs the CONCRETE per-run {@link McpEndpointManager} (`perRunEndpoint =
- * true`, the capability the STEP 3 startup gate consumes). For an ssh-addressable
- * `workerHost` it opens the WHOLE per-run endpoint lease via the injected
- * `acquireForRun`; for a local (empty) host it returns `null` (acp keeps its
- * own endpoint, the byte-identical local path). `release(lease)` closes the lease
+ * Constructs the CONCRETE per-run {@link McpEndpointManager}
+ * (`perRunClaimEnforcement = true`, the capability the startup gate consumes:
+ * each run gets a scoped Token B claim the shared gateway re-checks server-side).
+ * For an ssh-addressable `workerHost` it opens the WHOLE per-run endpoint lease
+ * via the injected `acquireForRun`; for a local (empty) host it returns `null`
+ * (acp keeps its own endpoint, the byte-identical local path). `release(lease)`
+ * closes the lease
  * (revoking the token, dropping the local-server ref, and closing the per-run
  * tunnel together) and is a safe no-op for the `null` local lease.
  */

package/node_modules/@lorenz/dispatch-coordinator/dist/mcpEndpointManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcpEndpointManager.d.ts","sourceRoot":"","sources":["../src/mcpEndpointManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC1C,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,gEAAgE;AAChE,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,aAAa,EAAE,6BAA6B,CAAC;CAC9C;AAaD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,+BAA+B,GACpC,kBAAkB,CAuBpB"}
+{"version":3,"file":"mcpEndpointManager.d.ts","sourceRoot":"","sources":["../src/mcpEndpointManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC1C,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,gEAAgE;AAChE,MAAM,WAAW,+BAA+B;IAC9C,yFAAyF;IACzF,aAAa,EAAE,6BAA6B,CAAC;CAC9C;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,+BAA+B,GACpC,kBAAkB,CAuBpB"}