taskflow-mcp-core 0.3.0-beta.1.2 → 1.0.0

package/dist/control/approval-service.js

@@ -0,0 +1,342 @@
+/** P15 durable approvals. The project journal, not this service, owns all state. */
+import { randomUUID } from "node:crypto";
+import { Value } from "typebox/value";
+import { ControlError } from "./errors.js";
+import { commandRequestHash } from "./schema/commands.js";
+import { ApprovalRequestSchema } from "./schema/approval.js";
+import { ArtifactRefSchema } from "./schema/evidence.js";
+import { BoundFragmentSchema } from "./schema/plan.js";
+import { UuidSchema } from "./schema/common.js";
+function stale(message) { throw new ControlError("TF_STALE_VERSION", message); }
+function invalid(message) { throw new ControlError("TF_COMMAND_FAILED", message); }
+function revoked(message) { throw new ControlError("TF_AUTHORITY_REVOKED", message); }
+function event(payload) { return { eventId: randomUUID(), recordedAt: Date.now(), payload }; }
+function advance(state, changes, events, command) {
+    const run = { ...state.run, ...changes.run, runVersion: state.run.runVersion + 1 };
+    const approvals = (changes.approvals ?? state.approvals).map((request) => request.status === "pending" ? { ...request, expectedRunVersion: run.runVersion } : request);
+    const outbox = changes.outbox ?? state.outbox;
+    const lifecycle = [];
+    for (const intent of outbox) {
+        const previous = state.outbox.find((item) => item.intentId === intent.intentId);
+        if (!previous || !previous.complete && intent.complete)
+            lifecycle.push(event({
+                kind: intent.kind === "approval.release" ? intent.complete ? "approval.release.completed" : "approval.release.queued" : intent.complete ? "approval.readmission.completed" : "approval.readmission.queued",
+                approvalRequestId: intent.approvalRequestId, intentId: intent.intentId,
+                reservationId: intent.kind === "approval.release" ? intent.reservationId : intent.reservation.reservationId,
+            }));
+    }
+    return { run, approvals, outbox, events: [...events, ...lifecycle, event({ kind: "run.snapshot", run })], ...(command ? { command } : {}) };
+}
+export class ApprovalService {
+    storage;
+    authority;
+    constructor(storage, authority) {
+        this.storage = storage;
+        this.authority = authority;
+        for (const name of ["authorize", "validateRequest", "negotiateDurability", "quiescence", "validateEdit", "prepareReadmission", "validateReadmission", "reserve", "commitReservation", "normalRelease"]) {
+            if (typeof authority[name] !== "function")
+                revoked(`approval authority requires ${name}`);
+        }
+    }
+    #binding(run, input, kind, auth) {
+        return { commandId: input.commandId, kind, requestHash: commandRequestHash(input), callerPrincipal: auth.callerPrincipal, projectId: run.projectId, controlDomainId: run.controlDomainId };
+    }
+    async #replay(context, binding, operation, runId, requestId) {
+        const authorize = () => this.authority.authorize(context, { operation, run: this.#run(runId), ...(requestId ? { request: this.#request(requestId) } : {}) });
+        const auth = await authorize();
+        if (auth.callerPrincipal !== binding.callerPrincipal)
+            revoked("verified principal changed during replay");
+        const saved = this.storage.readCommittedCommand?.(binding);
+        if (!saved)
+            return;
+        const final = await authorize();
+        if (final.callerPrincipal !== binding.callerPrincipal)
+            revoked("verified principal changed before disclosure");
+        return this.storage.readCommittedCommand(binding).responseJson;
+    }
+    #run(id) { return this.storage.readRun(id) ?? invalid("approval requires an existing durable run"); }
+    #request(id) { return this.storage.readApproval(id) ?? invalid("approval request does not exist"); }
+    #checkQuiescence(run, proof) {
+        return Boolean(proof.proofId && proof.runId === run.runId && proof.projectId === run.projectId
+            && proof.projectControlDomainId === run.controlDomainId && proof.projectAdmitCommitSeq === run.projectAdmitCommitSeq
+            && proof.providerNoLiveProcessTree === true && proof.noAmbiguousJobs === true
+            && proof.noPendingResourceIntents === true && proof.reconcileTimeoutOnly === false);
+    }
+    #proof(p) { return { proofId: p.proofId, projectId: p.projectId, projectControlDomainId: p.projectControlDomainId, runId: p.runId, projectAdmitCommitSeq: p.projectAdmitCommitSeq, providerNoLiveProcessTree: p.providerNoLiveProcessTree, noAmbiguousJobs: p.noAmbiguousJobs, noPendingResourceIntents: p.noPendingResourceIntents, reconcileTimeoutOnly: p.reconcileTimeoutOnly }; }
+    #release(state, requestId, proof) {
+        if (!proof || !state.run.reservationId || !this.#checkQuiescence(state.run, proof)
+            || state.outbox.some((item) => item.kind === "approval.release" && item.reservationId === state.run.reservationId && !item.complete))
+            return state.outbox;
+        return [...state.outbox, { kind: "approval.release", intentId: randomUUID(), approvalRequestId: requestId, runId: state.run.runId, reservationId: state.run.reservationId, evidence: this.#proof(proof), complete: false }];
+    }
+    async read(context, approvalRequestId) {
+        const request = this.#request(approvalRequestId);
+        await this.authority.authorize(context, { operation: "read", run: this.#run(request.runId), request });
+        return structuredClone(request);
+    }
+    async request(context, input) {
+        const run = this.#run(input.runId);
+        if (!["compat-auto-reject", "durable-optional", "durable-required"].includes(input.mode))
+            invalid("unknown approval mode");
+        await this.authority.authorize(context, { operation: "request", run });
+        await this.authority.validateRequest(context, run, input.nodeInstanceId);
+        const durable = input.mode !== "compat-auto-reject" && await this.authority.negotiateDurability(context, run, input.mode);
+        if (input.mode === "durable-required" && !durable)
+            throw new ControlError("TF_FEATURE_REQUIRED", "durable approval must be negotiated at Link/Admit");
+        const request = {
+            approvalRequestId: randomUUID(), runId: run.runId, nodeInstanceId: input.nodeInstanceId,
+            boundPlanHash: run.boundPlanHash, ...(run.boundFragmentHash ? { boundFragmentHash: run.boundFragmentHash } : {}),
+            expectedRunVersion: input.expectedRunVersion + 1, allowedDecisions: input.allowedDecisions,
+            owner: input.owner, ...(input.audience ? { audience: input.audience } : {}),
+            ...(input.requiredPrincipals ? { requiredPrincipals: input.requiredPrincipals } : {}),
+            deadline: input.deadline, timeoutPolicy: input.timeoutPolicy, status: durable ? "pending" : "rejected", createdAt: Date.now(),
+        };
+        if (!Value.Check(ApprovalRequestSchema, request) || new Set(request.allowedDecisions).size !== request.allowedDecisions.length)
+            invalid("invalid approval request");
+        const proof = await this.authority.quiescence(context, run);
+        await this.authority.authorize(context, { operation: "request", run, request });
+        this.storage.mutateRun(run.runId, input.expectedRunVersion, (state) => {
+            if (["completed", "failed", "blocked", "cancelled", "unknown"].includes(state.run.status)
+                || !["admitted", "executing", "parked", "reconciling"].includes(state.run.stage)
+                || !Number.isSafeInteger(state.run.projectAdmitCommitSeq) || state.run.projectAdmitCommitSeq < 1)
+                stale("run cannot request approval before durable admission or after terminal state");
+            if (state.approvals.some((item) => item.nodeInstanceId === request.nodeInstanceId && item.status === "pending"))
+                stale("node already has pending approval");
+            const expired = durable && request.deadline <= Date.now();
+            const settled = !durable || expired;
+            const parked = !settled && proof && this.#checkQuiescence(state.run, proof);
+            const stored = { ...request, ...(expired ? { status: "expired", decidedAt: Date.now() } : !durable ? { decidedAt: Date.now() } : {}) };
+            const nextRun = { ...state.run, requiresReadmission: !settled, status: settled ? "blocked" : "paused", stage: settled ? "terminal" : parked ? "parked" : "reconciling" };
+            return advance(state, { run: nextRun, approvals: [...state.approvals, stored], outbox: this.#release(state, request.approvalRequestId, proof) }, [event(settled
+                    ? { kind: "approval.settled", approvalRequestId: stored.approvalRequestId, decision: expired ? "expired" : "rejected" }
+                    : { kind: "approval.pending", approvalRequestId: stored.approvalRequestId, request: stored })]);
+        });
+        await this.drainReleases(context, run.runId);
+        return this.read(context, request.approvalRequestId);
+    }
+    async decide(context, input) {
+        input = structuredClone(input);
+        if (!Value.Check(UuidSchema, input.commandId) || !Number.isSafeInteger(input.expectedRunVersion) || input.expectedRunVersion < 0)
+            invalid("invalid decision command identity/version");
+        const request = this.#request(input.approvalRequestId), run = this.#run(input.runId);
+        if (request.runId !== run.runId)
+            invalid("approval does not belong to this run");
+        if (!["approve", "reject", "edit"].includes(input.decision) || !request.allowedDecisions.includes(input.decision))
+            invalid("decision not allowed");
+        const initialAuth = await this.authority.authorize(context, { operation: "decide", run, request });
+        const binding = this.#binding(run, input, "approval.decide", initialAuth);
+        const replay = await this.#replay(context, binding, "decide", run.runId, request.approvalRequestId);
+        if (replay !== undefined)
+            return JSON.parse(replay);
+        if (input.decision === "edit") {
+            if (!input.editArtifactRef || !Value.Check(ArtifactRefSchema, input.editArtifactRef) || !["output", "plan"].includes(input.editKind ?? ""))
+                invalid("edit requires typed guidance artifact");
+            await this.authority.validateEdit(context, run, request, { kind: input.editKind, artifact: input.editArtifactRef });
+        }
+        else if (input.editKind !== undefined || input.editArtifactRef !== undefined)
+            invalid("edit payload requires edit decision");
+        const proof = await this.authority.quiescence(context, run);
+        const auth = await this.authority.authorize(context, { operation: "decide", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+        let expired = false;
+        const committed = this.storage.mutateRun(run.runId, input.expectedRunVersion, (state, meta) => {
+            const current = state.approvals.find((item) => item.approvalRequestId === request.approvalRequestId) ?? invalid("missing approval");
+            if (current.status !== "pending" || state.run.status !== "paused" || current.expectedRunVersion !== input.expectedRunVersion)
+                stale("approval is already settled or run changed");
+            if (current.deadline <= Date.now()) {
+                expired = true;
+                return this.#expireMutation(state, current, proof);
+            }
+            const decisionEvent = event({ kind: "approval.settled", approvalRequestId: current.approvalRequestId, decision: input.decision === "approve" ? "approved" : input.decision === "reject" ? "rejected" : "edited" });
+            const decided = { ...current, status: input.decision === "approve" ? "approved" : input.decision === "reject" ? "rejected" : "edited", decidedAt: Date.now(), decisionCommandId: input.commandId, decisionEventId: decisionEvent.eventId, decisionCommitSeq: meta.commitSeq,
+                ...(input.decision === "edit" ? { editKind: input.editKind, editArtifactRef: input.editArtifactRef } : {}) };
+            const approvals = state.approvals.map((item) => item.approvalRequestId === current.approvalRequestId ? decided : input.decision === "reject" && item.status === "pending" ? { ...item, status: "cancelled", decidedAt: Date.now() } : item);
+            const stillPending = approvals.some((item) => item.status === "pending");
+            const nextRun = { ...state.run, requiresReadmission: input.decision !== "reject", status: input.decision === "reject" ? "blocked" : stillPending ? "paused" : "running", stage: input.decision === "reject" ? "terminal" : stillPending ? state.run.stage : "queued" };
+            const command = { commandId: input.commandId, kind: "approval.decide", requestHash: commandRequestHash(input), callerPrincipal: auth.callerPrincipal, authorizationContextHash: auth.authorizationContextHash,
+                projectId: run.projectId, controlDomainId: run.controlDomainId, status: "completed", firstCommitSeq: meta.commitSeq, lastCommitSeq: meta.commitSeq, recordedAt: Date.now() };
+            return { ...advance(state, { run: nextRun, approvals, ...(input.decision === "reject" ? { outbox: this.#release(state, current.approvalRequestId, proof) } : {}) }, [decisionEvent], command), responseJson: JSON.stringify(decided) };
+        }, binding);
+        if (expired)
+            stale("approval expired; late decisions cannot be committed");
+        const response = await this.#replay(context, binding, "decide", run.runId, request.approvalRequestId);
+        if (response !== undefined)
+            return JSON.parse(response);
+        // Compatibility adapters still return their own committed response, never latest state.
+        await this.authority.authorize(context, { operation: "decide", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+        return JSON.parse(committed.responseJson);
+    }
+    #expireMutation(state, request, proof) {
+        return advance(state, { run: { ...state.run, status: "blocked", stage: "terminal", requiresReadmission: false }, outbox: this.#release(state, request.approvalRequestId, proof), approvals: state.approvals.map((item) => item.status !== "pending" ? item : { ...item, status: item.approvalRequestId === request.approvalRequestId ? "expired" : "cancelled", decidedAt: Date.now() }) }, state.approvals.filter((item) => item.status === "pending").map((item) => event({ kind: "approval.settled", approvalRequestId: item.approvalRequestId, decision: item.approvalRequestId === request.approvalRequestId ? "expired" : "cancelled" })));
+    }
+    async expireDue(context) {
+        let count = 0;
+        for (const request of this.storage.listApprovals()) {
+            if (request.status !== "pending" || request.deadline > Date.now())
+                continue;
+            const run = this.#run(request.runId);
+            await this.authority.authorize(context, { operation: "expire", run, request });
+            const proof = await this.authority.quiescence(context, run);
+            await this.authority.authorize(context, { operation: "expire", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+            try {
+                this.storage.mutateRun(run.runId, run.runVersion, (state) => {
+                    const current = state.approvals.find((item) => item.approvalRequestId === request.approvalRequestId);
+                    if (!current || current.status !== "pending" || current.deadline > Date.now())
+                        stale("expiry lost CAS");
+                    return this.#expireMutation(state, current, proof);
+                });
+                count++;
+            }
+            catch (error) {
+                if (!(error instanceof ControlError) || error.code !== "TF_STALE_VERSION")
+                    throw error;
+            }
+        }
+        return count;
+    }
+    async cancel(context, input) {
+        input = structuredClone(input);
+        if (!Value.Check(UuidSchema, input.commandId) || !Number.isSafeInteger(input.expectedRunVersion) || input.expectedRunVersion < 0)
+            invalid("cancel requires a command ID and version");
+        const run = this.#run(input.runId);
+        const initialAuth = await this.authority.authorize(context, { operation: "cancel", run });
+        const binding = this.#binding(run, input, "run.cancel", initialAuth);
+        const replay = await this.#replay(context, binding, "cancel", run.runId);
+        if (replay !== undefined)
+            return JSON.parse(replay);
+        const proof = await this.authority.quiescence(context, run);
+        const authorization = await this.authority.authorize(context, { operation: "cancel", run: this.#run(run.runId) });
+        const committed = this.storage.mutateRun(run.runId, input.expectedRunVersion, (state, meta) => {
+            if (["completed", "failed", "blocked", "cancelled"].includes(state.run.status))
+                stale("terminal run history cannot be cancelled again");
+            const command = { commandId: input.commandId, kind: "run.cancel", requestHash: commandRequestHash(input), callerPrincipal: authorization.callerPrincipal,
+                authorizationContextHash: authorization.authorizationContextHash, projectId: run.projectId, controlDomainId: run.controlDomainId, status: "completed", firstCommitSeq: meta.commitSeq, lastCommitSeq: meta.commitSeq, recordedAt: Date.now() };
+            const mutation = advance(state, {
+                run: { ...state.run, requiresReadmission: false, status: this.#checkQuiescence(state.run, proof) ? "cancelled" : "unknown", stage: this.#checkQuiescence(state.run, proof) ? "terminal" : "reconciling", needsOperator: !this.#checkQuiescence(state.run, proof) },
+                approvals: state.approvals.map((item) => item.status === "pending" ? { ...item, status: "cancelled", decidedAt: Date.now() } : item),
+                outbox: this.#release(state, state.approvals.at(-1)?.approvalRequestId ?? invalid("run has no approval"), proof),
+            }, state.approvals.filter((item) => item.status === "pending").map((item) => event({ kind: "approval.settled", approvalRequestId: item.approvalRequestId, decision: "cancelled" })), command);
+            return { ...mutation, responseJson: JSON.stringify(mutation.run) };
+        }, binding);
+        const response = await this.#replay(context, binding, "cancel", run.runId);
+        if (response !== undefined)
+            return JSON.parse(response);
+        await this.authority.authorize(context, { operation: "cancel", run: this.#run(run.runId) });
+        return JSON.parse(committed.responseJson);
+    }
+    /** Re-prove quiescence after a non-quiescent pause; never infer it from status. */
+    async park(context, input) {
+        const run = this.#run(input.runId);
+        await this.authority.authorize(context, { operation: "park", run });
+        const proof = await this.authority.quiescence(context, run);
+        await this.authority.authorize(context, { operation: "park", run: this.#run(run.runId) });
+        this.storage.mutateRun(run.runId, input.expectedRunVersion, (state) => {
+            if (!(state.run.status === "paused" || state.run.status === "running" && state.run.stage === "queued") || state.run.requiresReadmission !== true)
+                stale("terminal or executing runs cannot be revived by park");
+            if (!this.#checkQuiescence(state.run, proof))
+                throw new ControlError("TF_RECONCILE_REQUIRED", "park requires fresh TE quiescence", { recoveryAction: "operator", sideEffects: "unknown" });
+            const approval = state.approvals.find((item) => item.status === "pending" || item.status === "approved" || item.status === "edited") ?? invalid("run has no durable approval");
+            const intent = state.run.reservationId ? [{ kind: "approval.release", intentId: randomUUID(), approvalRequestId: approval.approvalRequestId, runId: run.runId, reservationId: state.run.reservationId, evidence: this.#proof(proof), complete: false }] : [];
+            return advance(state, { run: { ...state.run, status: "paused", stage: "parked", requiresReadmission: true }, outbox: [...state.outbox.filter((item) => item.kind !== "approval.release" || item.complete), ...intent] }, []);
+        });
+        await this.drainReleases(context, run.runId);
+        return this.#run(run.runId);
+    }
+    /** Terminal status may precede process/TE settlement. Once settlement is
+     * proven, discharge capacity without reopening or changing terminal history. */
+    async releaseTerminal(context, input) {
+        const run = this.#run(input.runId);
+        await this.authority.authorize(context, { operation: "park", run });
+        const proof = await this.authority.quiescence(context, run);
+        await this.authority.authorize(context, { operation: "park", run: this.#run(run.runId) });
+        this.storage.mutateRun(run.runId, input.expectedRunVersion, (state) => {
+            if (!["completed", "failed", "blocked", "cancelled"].includes(state.run.status))
+                stale("terminal release requires terminal run");
+            if (!this.#checkQuiescence(state.run, proof))
+                throw new ControlError("TF_RECONCILE_REQUIRED", "terminal release requires fresh TE quiescence", { recoveryAction: "operator", sideEffects: "unknown" });
+            const approval = state.approvals.at(-1) ?? invalid("run has no approval history");
+            return advance(state, { run: { ...state.run, requiresReadmission: false }, outbox: this.#release(state, approval.approvalRequestId, proof) }, []);
+        });
+        await this.drainReleases(context, run.runId);
+        return this.#run(run.runId);
+    }
+    async drainReleases(context, runId) {
+        const ids = runId ? [runId] : [...new Set(this.storage.listApprovals().map((request) => request.runId))];
+        for (const id of ids)
+            for (const item of this.storage.readOutbox(id)) {
+                if (item.kind !== "approval.release" || item.complete)
+                    continue;
+                const run = this.#run(id);
+                await this.authority.authorize(context, { operation: "park", run });
+                await this.authority.normalRelease(context, item);
+                const current = this.#run(id);
+                await this.authority.authorize(context, { operation: "park", run: current });
+                this.storage.mutateRun(id, current.runVersion, (state) => {
+                    const found = state.outbox.find((intent) => intent.intentId === item.intentId);
+                    if (!found || found.complete || state.run.reservationId !== item.reservationId)
+                        stale("release intent changed");
+                    const queued = !state.approvals.some((request) => request.status === "pending") && state.approvals.some((request) => request.status === "approved" || request.status === "edited");
+                    return advance(state, { run: { ...state.run, slot: "released", ...(queued && state.run.status === "paused" ? { status: "running", stage: "queued" } : {}) }, outbox: state.outbox.map((intent) => intent.intentId === item.intentId ? { ...intent, complete: true } : intent) }, []);
+                });
+            }
+    }
+    async readmit(context, input) {
+        const request = this.#request(input.approvalRequestId), run = this.#run(request.runId);
+        if (run.runVersion !== input.expectedRunVersion)
+            stale("readmission run version changed");
+        await this.authority.authorize(context, { operation: "readmit", run, request });
+        const pending = this.storage.readOutbox(run.runId).find((item) => item.kind === "approval.readmission" && !item.complete);
+        if (pending)
+            return this.#finishReadmission(context, pending);
+        if (!["approved", "edited"].includes(request.status) || run.stage !== "queued" || !["released", "none"].includes(run.slot))
+            stale("approved run must queue and release its old reservation before readmission");
+        const prepared = await this.authority.prepareReadmission(context, run, request);
+        const auth = await this.authority.authorize(context, { operation: "readmit", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+        const { fragment, owner } = prepared;
+        if (!Value.Check(BoundFragmentSchema, fragment) || fragment.projectId !== run.projectId || fragment.controlDomainId !== run.controlDomainId
+            || fragment.parentBoundPlanHash !== run.boundPlanHash || fragment.parentBoundFragmentHash !== run.boundFragmentHash
+            || fragment.sourceEventId !== request.decisionEventId || fragment.sourceCommitSeq !== request.decisionCommitSeq
+            || fragment.boundFragmentHash === run.boundFragmentHash || fragment.authorityEpoch < run.authorityEpoch
+            || !fragment.fragmentPolicyHash.endsWith(`:${prepared.policyHash}`) || prepared.authorizationContextHash !== auth.authorizationContextHash
+            || owner.runId !== run.runId || !owner.attemptId || !owner.unitId || owner.attemptId === run.owner?.attemptId || owner.unitId === run.owner?.unitId)
+            revoked("readmission must bind fresh policy, fragment and execution owner");
+        const reservation = await this.authority.reserve(context, run, owner);
+        if (reservation.reservationId === run.reservationId || reservation.runId !== run.runId || reservation.projectId !== run.projectId
+            || reservation.projectControlDomainId !== run.controlDomainId || reservation.state !== "reserved")
+            revoked("readmission requires a new bound reservation");
+        await this.authority.authorize(context, { operation: "readmit", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+        const committed = this.storage.mutateRun(run.runId, input.expectedRunVersion, (state, meta) => {
+            if (state.run.stage !== "queued" || state.approvals.some((item) => item.status === "pending"))
+                stale("readmission state changed");
+            const intent = { kind: "approval.readmission", intentId: randomUUID(), approvalRequestId: request.approvalRequestId, runId: run.runId, reservation, owner, fragment,
+                policyHash: prepared.policyHash, authorizationContextHash: auth.authorizationContextHash, projectAdmitCommitSeq: meta.commitSeq, complete: false };
+            return advance(state, { run: { ...state.run, status: "running", stage: "admitted", slot: "reserved", reservationId: reservation.reservationId, owner, policyHash: prepared.policyHash, authorityEpoch: fragment.authorityEpoch, boundFragmentHash: fragment.boundFragmentHash, projectAdmitCommitSeq: meta.commitSeq }, outbox: [...state.outbox, intent] }, []);
+        });
+        const intent = committed.outbox.find((item) => item.kind === "approval.readmission" && !item.complete);
+        return this.#finishReadmission(context, intent);
+    }
+    async #finishReadmission(context, intent) {
+        const run = this.#run(intent.runId), request = this.#request(intent.approvalRequestId);
+        const assertAdmitted = (current) => {
+            if (current.status !== "running" || current.stage !== "admitted" || current.requiresReadmission !== true
+                || current.reservationId !== intent.reservation.reservationId || current.owner?.attemptId !== intent.owner.attemptId
+                || !["approved", "edited"].includes(this.#request(intent.approvalRequestId).status))
+                stale("readmission was cancelled or changed");
+        };
+        assertAdmitted(run);
+        await this.authority.authorize(context, { operation: "readmit", run, request });
+        await this.authority.validateReadmission(context, run, intent);
+        await this.authority.authorize(context, { operation: "readmit", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+        assertAdmitted(this.#run(run.runId));
+        await this.authority.commitReservation(context, intent);
+        const current = this.#run(run.runId);
+        await this.authority.validateReadmission(context, current, intent);
+        await this.authority.authorize(context, { operation: "readmit", run: this.#run(run.runId), request: this.#request(request.approvalRequestId) });
+        return this.storage.mutateRun(run.runId, current.runVersion, (state) => {
+            const pending = state.outbox.find((item) => item.intentId === intent.intentId);
+            if (!pending || pending.complete || state.run.stage !== "admitted" || state.run.reservationId !== intent.reservation.reservationId || state.run.owner?.attemptId !== intent.owner.attemptId)
+                stale("readmission intent changed");
+            return advance(state, { run: { ...state.run, slot: "committed", requiresReadmission: false }, outbox: state.outbox.map((item) => item.intentId === intent.intentId ? { ...item, complete: true } : item) }, []);
+        }).run;
+    }
+}
+//# sourceMappingURL=approval-service.js.map

package/dist/control/approval-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-service.js","sourceRoot":"","sources":["../../../taskflow-control/src/approval-service.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAgD,MAAM,sBAAsB,CAAC;AACxG,OAAO,EAAE,qBAAqB,EAAkE,MAAM,sBAAsB,CAAC;AAC7H,OAAO,EAAE,iBAAiB,EAAoB,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,kBAAkB,CAAC;AAI3E,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAuEhD,SAAS,KAAK,CAAC,OAAe,IAAW,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/F,SAAS,OAAO,CAAC,OAAe,IAAW,MAAM,IAAI,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAClG,SAAS,OAAO,CAAC,OAAe,IAAW,MAAM,IAAI,YAAY,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACrG,SAAS,KAAK,CAAC,OAA4B,IAA0B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACzI,SAAS,OAAO,CAAC,KAA2B,EAAE,OAAsC,EAAE,MAA8B,EAAE,OAAuB;IAC5I,MAAM,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;IACnF,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvK,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IAC9C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC5E,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,6BAA6B;gBAC1M,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACtE,aAAa,EAAE,MAAM,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa;aAC3G,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7I,CAAC;AAED,MAAM,OAAO,eAAe;IAClB,OAAO,CAAkB;IACzB,SAAS,CAAuB;IACzC,YAAY,OAAwB,EAAE,SAA+B;QACpE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,SAAS,EAAE,mBAAmB,EAAE,eAAe,CAAU,EAAE,CAAC;YACjN,IAAI,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,UAAU;gBAAE,OAAO,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;IACF,CAAC;IACD,QAAQ,CAAC,GAAgB,EAAE,KAAyB,EAAE,IAA2B,EAAE,IAA2B;QAC7G,OAAO,EAAC,SAAS,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,eAAe,EAAC,IAAI,CAAC,eAAe,EAAE,SAAS,EAAC,GAAG,CAAC,SAAS,EAAC,eAAe,EAAC,GAAG,CAAC,eAAe,EAAC,CAAC;IACpL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAS,EAAE,OAAsB,EAAE,SAA2B,EAAE,KAAY,EAAE,SAAiB;QAC5G,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAC,EAAC,SAAS,EAAC,GAAG,EAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;QAClJ,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;YAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;QAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QAC/E,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;QAChC,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;YAAE,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAC/G,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAqB,CAAC,OAAO,CAAE,CAAC,YAAY,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,EAAU,IAAiB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC;IAC1H,QAAQ,CAAC,EAAU,IAA4B,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,iCAAiC,CAAC,CAAC,CAAC,CAAC;IACpI,gBAAgB,CAAC,GAAgB,EAAE,KAAyB;QAC3D,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;eAC1F,KAAK,CAAC,sBAAsB,KAAK,GAAG,CAAC,eAAe,IAAI,KAAK,CAAC,qBAAqB,KAAK,GAAG,CAAC,qBAAqB;eACjH,KAAK,CAAC,yBAAyB,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI;eAC1E,KAAK,CAAC,wBAAwB,KAAK,IAAI,IAAI,KAAK,CAAC,oBAAoB,KAAK,KAAK,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,CAAC,CAAoB,IAAuB,OAAO,EAAC,OAAO,EAAC,CAAC,CAAC,OAAO,EAAC,SAAS,EAAC,CAAC,CAAC,SAAS,EAAC,sBAAsB,EAAC,CAAC,CAAC,sBAAsB,EAAC,KAAK,EAAC,CAAC,CAAC,KAAK,EAAC,qBAAqB,EAAC,CAAC,CAAC,qBAAqB,EAAC,yBAAyB,EAAC,CAAC,CAAC,yBAAyB,EAAC,eAAe,EAAC,CAAC,CAAC,eAAe,EAAC,wBAAwB,EAAC,CAAC,CAAC,wBAAwB,EAAC,oBAAoB,EAAC,CAAC,CAAC,oBAAoB,EAAC,CAAC,CAAC,CAAC;IAEzY,QAAQ,CAAC,KAA2B,EAAE,SAAiB,EAAE,KAA0B;QAClF,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;eAC9E,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC;QAC3J,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7N,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAAU,EAAE,iBAAyB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvG,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAU,EAAE,KAA2B;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC3H,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1H,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;QACtJ,MAAM,OAAO,GAA2B;YACvC,iBAAiB,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc;YACvF,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YAC1F,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SAC7H,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,gBAAgB,CAAC,MAAM;YAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;QACpK,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE;YACrE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;mBACrF,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;mBAC7E,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,qBAAsB,GAAG,CAAC;gBAAE,KAAK,CAAC,8EAA8E,CAAC,CAAC;YAC1L,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;gBAAE,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC5J,MAAM,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAChJ,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,QAAiB,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,aAAsB,EAAE,CAAC;YACtN,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO;oBAC9J,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE;oBACvH,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAU,EAAE,KAA4B;QACpD,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC;YAAE,OAAO,CAAC,2CAA2C,CAAC,CAAC;QACvL,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;YAAE,OAAO,CAAC,sCAAsC,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACnJ,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAC,KAAK,EAAC,iBAAiB,EAAC,WAAW,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,KAAK,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAChG,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAA2B,CAAC;QAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,OAAO,CAAC,uCAAuC,CAAC,CAAC;YAC7L,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,eAAgB,EAAE,CAAC,CAAC;QACvH,CAAC;aAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/H,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC5J,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;YACpI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC,kBAAkB;gBAAE,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAClL,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACpC,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,aAAa,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnN,MAAM,OAAO,GAA2B,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,SAAS;gBAClS,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9G,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAoB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACrP,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAiB,CAAC,CAAC,CAAC,SAAkB,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAiB,EAAE,CAAC;YACpT,MAAM,OAAO,GAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;gBAC3N,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9K,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxO,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,IAAI,OAAO;YAAE,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,KAAK,EAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClG,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA2B,CAAC;QAClF,wFAAwF;QACxF,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAC,EAAC,SAAS,EAAC,QAAQ,EAAC,GAAG,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAC,OAAO,EAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAC,CAAC,CAAC;QACvI,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,YAAa,CAA2B,CAAC;IACtE,CAAC;IACD,eAAe,CAAC,KAA2B,EAAE,OAA+B,EAAE,KAA0B;QACvG,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;IAClnB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,OAAU;QACzB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,SAAS;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAC/I,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;oBACrG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE;wBAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBACxG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpD,CAAC,CAAC,CAAC;gBAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QACzH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAU,EAAE,KAAuE;QAC/F,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC;YAAE,OAAO,CAAC,0CAA0C,CAAC,CAAC;QACtL,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAC,KAAK,EAAC,YAAY,EAAC,WAAW,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgB,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7F,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACxI,MAAM,OAAO,GAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,aAAa,CAAC,eAAe;gBACtK,wBAAwB,EAAE,aAAa,CAAC,wBAAwB,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAChP,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE;gBAChC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE;gBAClQ,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAoB,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7I,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,OAAO,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC;aAChH,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7L,OAAO,EAAC,GAAG,QAAQ,EAAC,YAAY,EAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAC,CAAC;QAChE,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAC,OAAO,EAAC,QAAQ,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAgB,CAAC;QACvE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAC,EAAC,SAAS,EAAC,QAAQ,EAAC,GAAG,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,YAAa,CAAgB,CAAC;IAC3D,CAAC;IACD,mFAAmF;IACnF,KAAK,CAAC,IAAI,CAAC,OAAU,EAAE,KAAoD;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE;YACrE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,mBAAmB,KAAK,IAAI;gBAAE,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAChN,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,mCAAmC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3L,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,CAAC,6BAA6B,CAAC,CAAC;YAC/K,MAAM,MAAM,GAA4B,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtR,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9N,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD;oFACgF;IAChF,KAAK,CAAC,eAAe,CAAC,OAAU,EAAE,KAAoD;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,EAAE;YACrE,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACjI,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,+CAA+C,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;YACvM,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,6BAA6B,CAAC,CAAC;YAClF,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnJ,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,OAAU,EAAE,KAAc;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzG,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtE,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9B,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7E,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;oBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC/E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa;wBAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC;oBAChH,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;oBACnL,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAkB,EAAE,KAAK,EAAE,QAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACxS,CAAC,CAAC,CAAC;YACJ,CAAC;IACF,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAU,EAAE,KAAgE;QACzF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB;YAAE,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1F,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7J,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC7J,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;eACvI,QAAQ,CAAC,mBAAmB,KAAK,GAAG,CAAC,aAAa,IAAI,QAAQ,CAAC,uBAAuB,KAAK,GAAG,CAAC,iBAAiB;eAChH,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO,CAAC,iBAAiB;eAC5G,QAAQ,CAAC,iBAAiB,KAAK,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc;eACpG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,QAAQ,CAAC,wBAAwB,KAAK,IAAI,CAAC,wBAAwB;eACvI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,MAAM;YAAE,OAAO,CAAC,kEAAkE,CAAC,CAAC;QAClO,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,WAAW,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa,IAAI,WAAW,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,IAAI,WAAW,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS;eAC7H,WAAW,CAAC,sBAAsB,KAAK,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,CAAC,8CAA8C,CAAC,CAAC;QAC5J,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAChJ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YAC7F,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;gBAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAClI,MAAM,MAAM,GAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ;gBAC7L,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,wBAAwB,EAAE,IAAI,CAAC,wBAAwB,EAAE,qBAAqB,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACpJ,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClW,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAsB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAE,CAAC;QAC3I,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,CAAC,kBAAkB,CAAC,OAAU,EAAE,MAAiC;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACvF,MAAM,cAAc,GAAG,CAAC,OAAoB,EAAE,EAAE;YAC/C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI;mBACpG,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,OAAO,CAAC,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS;mBACjH,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;gBAAE,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACrI,CAAC,CAAC;QACF,cAAc,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAChJ,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAChJ,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;YACtE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS;gBAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACjO,OAAO,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjN,CAAC,CAAC,CAAC,GAAG,CAAC;IACR,CAAC;CACD"}

package/dist/control/authorization.d.ts

@@ -0,0 +1,94 @@
+import type { CommandKind } from "./schema/commands.ts";
+export declare const AUTHORIZATION_CAPABILITIES: readonly ["project.read", "run.submit", "run.cancel", "approval.decide", "coordinator.setMaxActiveRuns", "coordinator.forceRelease", "artifact.read"];
+export type AuthorizationCapabilityKind = typeof AUTHORIZATION_CAPABILITIES[number];
+export type AuthorizationCapability = {
+    kind: AuthorizationCapabilityKind;
+    scopeRoot: string;
+};
+export type AuthorizationPolicyLayer = {
+    capabilities?: AuthorizationCapability[];
+    deny?: AuthorizationCapabilityKind[];
+    attenuate?: AuthorizationCapability[];
+    substitute?: {
+        capability: AuthorizationCapabilityKind;
+        with: AuthorizationCapability;
+    }[];
+};
+export type LiveAuthorizationPolicy = {
+    host: AuthorizationPolicyLayer;
+    user?: AuthorizationPolicyLayer;
+    project?: AuthorizationPolicyLayer;
+    invocation?: AuthorizationPolicyLayer;
+    revokedPrincipals?: string[];
+};
+export type AuthorizationBinding = {
+    projectId: string;
+    controlDomainId: string;
+    projectRoot: string;
+};
+declare const verifiedContextBrand: unique symbol;
+/** No serializable identity fields. Only the issuing authority recognizes it. */
+export type VerifiedContext = {
+    readonly [verifiedContextBrand]: true;
+};
+export type AuthorizationChallenge = Readonly<{
+    purpose: "taskflow.control.authentication";
+    version: 1;
+    id: string;
+    nonce: string;
+    expiresAt: number;
+    principal: string;
+    binding: Readonly<AuthorizationBinding>;
+}>;
+export type AuthorizeOperation = "read" | "submit" | "replay" | "artifact";
+export type AuthorizationCommandKind = CommandKind | "run.cancel";
+export type AuthorizationRequest = AuthorizationBinding & {
+    operation: AuthorizeOperation;
+    commandKind?: AuthorizationCommandKind;
+    resourcePath?: string;
+    artifactDigest?: string;
+};
+export type AuthorizationDecision = Readonly<{
+    principal: string;
+    callerPrincipal: string;
+    authorizationContextHash: string;
+    capability: Readonly<AuthorizationCapability>;
+    effectivePolicy: Readonly<{
+        hostBaseline: readonly AuthorizationCapabilityKind[];
+        layers: LiveAuthorizationPolicy;
+        capability: Readonly<AuthorizationCapability>;
+    }>;
+}>;
+export interface AuthorizationAuthorityOptions {
+    ownerUid: number;
+    /** Trusted bootstrap issuer configuration, never an RPC body/client label. */
+    credentialIssuerId?: string;
+    bootstrapSecret: Uint8Array;
+    /** Explicit, trusted host baseline; [] grants no capabilities. */
+    hostBaseline: readonly AuthorizationCapabilityKind[];
+    loadLivePolicy: (principal: string, binding: Readonly<AuthorizationBinding>) => unknown | Promise<unknown>;
+    verifyArtifactReachability?: (principal: string, binding: Readonly<AuthorizationBinding>, digest: string, commandKind?: AuthorizationCommandKind) => boolean | Promise<boolean>;
+    now?: () => number;
+    challengeTtlMs?: number;
+}
+export interface AuthorizationAuthority {
+    /** Optional, explicitly provisioned issuer; never granted by a caller role label. */
+    issueOperatorStandalone?(binding: AuthorizationBinding): VerifiedContext;
+    createOperatorChallenge?(binding: AuthorizationBinding): AuthorizationChallenge;
+    issueStandalone(binding: AuthorizationBinding): VerifiedContext;
+    createChallenge(binding: AuthorizationBinding): AuthorizationChallenge;
+    authenticate(challengeId: string, proof: string): VerifiedContext;
+    identity(context: VerifiedContext): Readonly<{
+        principal: string;
+        binding: Readonly<AuthorizationBinding>;
+    }>;
+    revokeContext(context: VerifiedContext): void;
+    authorize(context: VerifiedContext, request: AuthorizationRequest): Promise<AuthorizationDecision>;
+}
+/** Shared core canonical serialization, full SHA256 for wire audit fields. */
+export declare function authorizationAuditHash(value: unknown): string;
+/** Client helper: caller obtains secret from protected bootstrap storage. */
+export declare function answerAuthorizationChallenge(secret: Uint8Array, challenge: AuthorizationChallenge): string;
+export declare function createAuthorizationAuthority(options: AuthorizationAuthorityOptions): AuthorizationAuthority;
+export {};
+//# sourceMappingURL=authorization.d.ts.map

package/dist/control/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../../../taskflow-control/src/authorization.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,eAAO,MAAM,0BAA0B,YACtC,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,8BAA8B,EAC7F,0BAA0B,EAAE,eAAe,CAClC,CAAC;AACX,MAAM,MAAM,2BAA2B,GAAG,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC;AACpF,MAAM,MAAM,uBAAuB,GAAG;IAAE,IAAI,EAAE,2BAA2B,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAC/F,MAAM,MAAM,wBAAwB,GAAG;IACtC,YAAY,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,2BAA2B,EAAE,CAAC;IACrC,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC,UAAU,CAAC,EAAE;QAAE,UAAU,EAAE,2BAA2B,CAAC;QAAC,IAAI,EAAE,uBAAuB,CAAA;KAAE,EAAE,CAAC;CAC1F,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG;IACrC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAChC,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,UAAU,CAAC,EAAE,wBAAwB,CAAC;IACtC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AACvG,OAAO,CAAC,MAAM,oBAAoB,EAAE,OAAO,MAAM,CAAC;AAClD,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CAAC;IAC7C,OAAO,EAAE,iCAAiC,CAAC;IAAC,OAAO,EAAE,CAAC,CAAC;IACvD,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CACzG,CAAC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;AAC3E,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,YAAY,CAAC;AAClE,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG;IACzD,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,MAAM,CAAC;IACjC,UAAU,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC9C,eAAe,EAAE,QAAQ,CAAC;QAAE,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;QAAC,MAAM,EAAE,uBAAuB,CAAC;QAAC,UAAU,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAA;KAAE,CAAC,CAAC;CACpK,CAAC,CAAC;AACH,MAAM,WAAW,6BAA6B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,UAAU,CAAC;IAC5B,kEAAkE;IAClE,YAAY,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACrD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3G,0BAA0B,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,wBAAwB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChL,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AACD,MAAM,WAAW,sBAAsB;IACtC,qFAAqF;IACrF,uBAAuB,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAAC;IACzE,uBAAuB,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IAChF,eAAe,CAAC,OAAO,EAAE,oBAAoB,GAAG,eAAe,CAAC;IAChE,eAAe,CAAC,OAAO,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IACvE,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,eAAe,CAAC;IAClE,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAA;KAAE,CAAC,CAAC;IAC7G,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9C,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACnG;AA+FD,8EAA8E;AAC9E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE7D;AACD,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,sBAAsB,GAAG,MAAM,CAE1G;AAED,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,GAAG,sBAAsB,CAoG3G"}