@archmax-ai/harness 0.0.0

package/dist/machine/machine.js

@@ -0,0 +1,551 @@
+import { createWorkflowEventEmitter } from "../core/events.js";
+import { computeSpecHash } from "../workflow/snapshot.js";
+import { normalizeHooks } from "../lifecycle/hook-shape.js";
+import { argsSatisfy, normalizeAllowEntry, } from "./allow.js";
+import { normalizeMountGrants } from "./mount-grants.js";
+import { describeGlob } from "./variables.js";
+import { loadMachineSpec } from "./load-spec.js";
+import { MANUAL_TRIGGER, triggerBindings, } from "./triggers.js";
+import { ADVANCE_TOOL, ALWAYS_ALLOWED_TOOLS, UNGRANTABLE_TOOLS, ESSENTIAL_TOOLS, GET_VARIABLES_TOOL, RESET_TOOL, SET_VARIABLES_TOOL, WAIT_TOOL, workflowSlugFromToolName, } from "./tool-names.js";
+import { specDisabled, } from "./types.js";
+export { ALWAYS_ALLOWED_TOOLS, ESSENTIAL_TOOLS, UNGRANTABLE_TOOLS };
+/**
+ * A declared list, or nothing. `validate` builds a machine from a spec whose
+ * schema may have failed — so a governance key can hold a scalar or an object
+ * here — and reading one as empty keeps every resolver total instead of throwing
+ * mid-diagnostic.
+ */
+function list(value) {
+    return Array.isArray(value) ? value : [];
+}
+/** Default per-eval timeout (ms) for interpreter and lifecycle scripts. */
+const DEFAULT_TIMEOUT_MS = 15_000;
+/**
+ * The compiled workflow: what the runtime consults for transitions, tool
+ * surfaces, enabled skills and trigger wiring. A pure view over the parsed
+ * `spec` — no workspace, no file access. Declarations are read off `spec`
+ * directly (`machine.spec.states[slug].instructions`); the methods here are the
+ * derived answers.
+ */
+export class WorkflowMachine {
+    spec;
+    extraEssential;
+    /**
+     * The entry state: the `manual` start state, else the first declared start
+     * state, else the first declared state — so a machine always has one.
+     */
+    entry;
+    bindingsCache;
+    constructor(spec, 
+    /**
+     * Host-declared tool names treated as essential — always disclosed and
+     * permitted in every state, exactly like the built-in {@link ESSENTIAL_TOOLS}.
+     */
+    extraEssential = new Set()) {
+        this.spec = spec;
+        this.extraEssential = extraEssential;
+        if (!spec.states || Object.keys(spec.states).length === 0) {
+            throw new Error("Invalid machine spec: missing states");
+        }
+        this.entry =
+            this.startStateForTrigger(MANUAL_TRIGGER) ??
+                this.startStates()[0]?.state ??
+                Object.keys(spec.states)[0];
+    }
+    /**
+     * Load the machine from its two files, or `null` when nothing loads to a
+     * usable machine. Load problems other than a missing file are emitted as
+     * `warning` events.
+     */
+    static async load(workspace, paths, onEvent) {
+        const emit = createWorkflowEventEmitter(onEvent);
+        const { spec, issues, lint, usable } = await loadMachineSpec(workspace, paths);
+        for (const issue of [...issues, ...lint]) {
+            if (issue.kind !== "missing") {
+                emit({ type: "warning", scope: "workflow", message: issue.message });
+            }
+        }
+        return usable && spec ? new WorkflowMachine(spec) : null;
+    }
+    /** Construct a machine from an already-parsed spec. */
+    static fromSpec(spec, extraEssentialTools) {
+        return new WorkflowMachine(spec, new Set(extraEssentialTools));
+    }
+    /**
+     * Stable content hash of the spec, written into a session's first checkpoint
+     * and compared on resume.
+     */
+    get specHash() {
+        return computeSpecHash(this.spec);
+    }
+    /** Whether this machine is out of service (see {@link specDisabled}). */
+    get disabled() {
+        return specDisabled(this.spec);
+    }
+    /** Runtime knobs from `settings`, defaults applied. */
+    get harnessSettings() {
+        const s = this.spec.settings ?? {};
+        return {
+            timeoutMs: s.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+            memoryLimitBytes: s.memoryLimitBytes,
+            maxPtcCalls: s.maxPtcCalls,
+            maxResultChars: s.maxResultChars,
+            ...(s.prompt_cache
+                ? {
+                    promptCache: {
+                        ...(s.prompt_cache.enabled !== undefined ? { enabled: s.prompt_cache.enabled } : {}),
+                        ...(s.prompt_cache.ttl !== undefined ? { ttl: s.prompt_cache.ttl } : {}),
+                    },
+                }
+                : {}),
+        };
+    }
+    /**
+     * The model id `state`'s turns run on, or `undefined` when the workflow leaves
+     * the choice to the assembly. The one place the chain is derived — the state's
+     * `model`, else the root's `settings.model` — so nothing re-implements the
+     * precedence. An unknown slug reads as the workflow's own declaration, which is
+     * what the runtime wants for a position it cannot resolve.
+     */
+    modelFor(state) {
+        return this.spec.states[state]?.model ?? this.spec.settings?.model;
+    }
+    /**
+     * Every distinct model id this spec declares, in a stable order (the root's
+     * first, then each state's in declaration order). What assembly builds a model
+     * for, and what it names when an explicit `model` instance makes them inert.
+     */
+    declaredModels() {
+        const ids = new Set();
+        if (this.spec.settings?.model)
+            ids.add(this.spec.settings.model);
+        for (const state of Object.values(this.spec.states)) {
+            if (state?.model)
+                ids.add(state.model);
+        }
+        return [...ids];
+    }
+    // --- Skills ---------------------------------------------------------------------
+    /**
+     * The skills the workflow grants in **every** state: the root's
+     * `allow_always`, resolved against the registry. A state's `skills.allow`
+     * adds to this list, exactly as `tools.allow` adds to `tools.allow_always`.
+     * An absent key grants nothing, the same as `allow_always: []`. A declared
+     * slug the registry does not provide is dropped (and reported by `validate`).
+     */
+    workflowAlwaysSkills(available) {
+        const provided = new Set(available);
+        return list(this.spec.skills?.allow_always).filter((slug) => provided.has(slug));
+    }
+    /** The slugs `skills.forbid_always` denies in every state of this workflow. */
+    workflowForbiddenSkills() {
+        return list(this.spec.skills?.forbid_always);
+    }
+    /**
+     * The slugs denied while `state` is active, from either level. Declaration
+     * order, workflow-wide first, so a caller rendering them is byte-stable.
+     */
+    forbiddenSkills(state) {
+        const workflow = this.workflowForbiddenSkills();
+        const own = list(this.spec.states[state]?.skills?.forbid).filter((slug) => !workflow.includes(slug));
+        return [...workflow, ...own];
+    }
+    /**
+     * Which level denies `slug` in `state`, or `undefined` if neither does — so a
+     * refusal can say whether a list forbade the bundle or nothing granted it.
+     */
+    skillDenial(state, slug) {
+        if (this.workflowForbiddenSkills().includes(slug))
+            return "workflow";
+        if (list(this.spec.states[state]?.skills?.forbid).includes(slug))
+            return "state";
+        return undefined;
+    }
+    /**
+     * The skills enabled while `state` is active — the one answer the kernel's
+     * skill rule, prompt disclosure, the PTC listing redaction and `validate` all
+     * consult.
+     *
+     * The grant is additive: the state's own `skills.allow` followed by the root's
+     * `allow_always`, each in declaration order, deduplicated by slug. The denial
+     * beats it: anything `skills.forbid_always` or the state's `skills.forbid`
+     * names is removed, so **deny beats allow and no narrower level widens a
+     * denial**. Order is declaration order from the frozen spec, so everything
+     * rendered from this — the prompt's skills section above all — is byte-stable
+     * across the model calls of a turn.
+     */
+    enabledSkills(state, available) {
+        const provided = new Set(available);
+        const own = list(this.spec.states[state]?.skills?.allow).filter((slug) => provided.has(slug));
+        const always = this.workflowAlwaysSkills(available).filter((slug) => !own.includes(slug));
+        const denied = new Set(this.forbiddenSkills(state));
+        return [...own, ...always].filter((slug) => !denied.has(slug));
+    }
+    // --- Mounts ---------------------------------------------------------------------
+    /**
+     * The governed mounts the workflow enables in **every** state: the root's
+     * `mounts.allow_always`, filtered to the names the host declared governed. A
+     * state's `mounts.allow` adds to this list, exactly as `skills.allow` adds to
+     * `skills.allow_always`. An absent key grants nothing, the same as
+     * `allow_always: []`. A name the table does not govern is dropped (and
+     * reported by `validate`) — an ungoverned mount needs no grant.
+     */
+    workflowAlwaysMounts(governed) {
+        const table = new Set(governed);
+        return normalizeMountGrants(this.spec.mounts?.allow_always)
+            .map((grant) => grant.mount)
+            .filter((name) => table.has(name));
+    }
+    /**
+     * The names `mounts.forbid_always` denies in every state of this workflow —
+     * governed or not, since a denial subtracts an ungoverned mount's standing
+     * visibility too.
+     */
+    workflowForbiddenMounts() {
+        return list(this.spec.mounts?.forbid_always);
+    }
+    /**
+     * The mount names denied while `state` is active, from either level.
+     * Declaration order, workflow-wide first, so a caller rendering them is
+     * byte-stable.
+     */
+    forbiddenMounts(state) {
+        const workflow = this.workflowForbiddenMounts();
+        const own = list(this.spec.states[state]?.mounts?.forbid).filter((name) => !workflow.includes(name));
+        return [...workflow, ...own];
+    }
+    /**
+     * Which level denies `name` in `state`, or `undefined` if neither does — so a
+     * refusal can say whether a list forbade the mount or nothing enabled it.
+     */
+    mountDenial(state, name) {
+        if (this.workflowForbiddenMounts().includes(name))
+            return "workflow";
+        if (list(this.spec.states[state]?.mounts?.forbid).includes(name))
+            return "state";
+        return undefined;
+    }
+    /**
+     * The **governed** mounts enabled while `state` is active — the one answer the
+     * kernel's mount rule, prompt disclosure, the listing redaction and `validate`
+     * all consult. Ungoverned mounts are not in it: they are visible in every
+     * state without a grant, and `forbiddenMounts` is what takes one away.
+     *
+     * The grant is additive: the state's own `mounts.allow` followed by the root's
+     * `allow_always`, each in declaration order, deduplicated by name. The denial
+     * beats it: anything `mounts.forbid_always` or the state's `mounts.forbid`
+     * names is removed, so **deny beats allow and no narrower level widens a
+     * denial**. Order is declaration order from the frozen spec, so everything
+     * rendered from this is byte-stable across the model calls of a turn.
+     */
+    enabledMounts(state, governed) {
+        const table = new Set(governed);
+        const own = normalizeMountGrants(this.spec.states[state]?.mounts?.allow)
+            .map((grant) => grant.mount)
+            .filter((name) => table.has(name));
+        const always = this.workflowAlwaysMounts(governed).filter((name) => !own.includes(name));
+        const denied = new Set(this.forbiddenMounts(state));
+        return [...own, ...always].filter((name) => !denied.has(name));
+    }
+    /**
+     * Whether writes to `name` are permitted while `state` is active — the second
+     * half of a mount grant, beside which states may see it at all.
+     *
+     * A mount is writable here only when the host declared it writable **and** no
+     * applicable grant narrowed it to `read`. Read-only is a restriction, so it
+     * behaves like every other restriction in this schema: whichever level asks
+     * for it gets it, and no narrower level widens it back. `read_write` on a
+     * mount the host serves read-only is therefore inert (reported by `validate`)
+     * — the host's posture is the ceiling, not a default to argue with.
+     *
+     * An ungoverned mount takes the host's posture in every state: it carries no
+     * grant to qualify.
+     */
+    mountWritable(state, name, mounts) {
+        if (!mounts.writable.includes(name))
+            return false;
+        const applicable = [
+            ...normalizeMountGrants(this.spec.states[state]?.mounts?.allow),
+            ...normalizeMountGrants(this.spec.mounts?.allow_always),
+        ].filter((grant) => grant.mount === name);
+        return !applicable.some((grant) => grant.access === "read");
+    }
+    // --- Graph ----------------------------------------------------------------------
+    transitionTargets(from) {
+        return (this.spec.states[from]?.transitions ?? []).map((t) => t.to);
+    }
+    getTransition(from, to) {
+        return this.spec.states[from]?.transitions?.find((t) => t.to === to);
+    }
+    /** The state a failed turn routes to (`on_error`), if declared and present. */
+    onError(state) {
+        const target = this.spec.states[state]?.on_error;
+        return target && this.spec.states[target] ? target : undefined;
+    }
+    /** A state with no declared outgoing transitions is terminal (ends the run). */
+    isTerminal(state) {
+        return this.transitionTargets(state).length === 0;
+    }
+    /** Whether a state is a human decision state (a person picks the edge). */
+    isHumanState(state) {
+        return this.spec.states[state]?.type === "human";
+    }
+    /**
+     * States a run can reach: the start states plus everything transitively
+     * reachable through transitions and `on_error` routes. A state no start state
+     * reaches is dead in the definition, so nothing it declares widens the surface.
+     */
+    reachableStates() {
+        const seen = new Set();
+        const queue = this.startStates().map((s) => s.state);
+        while (queue.length > 0) {
+            const slug = queue.shift();
+            if (seen.has(slug) || !this.spec.states[slug])
+                continue;
+            seen.add(slug);
+            queue.push(...this.transitionTargets(slug));
+            const errorTarget = this.onError(slug);
+            if (errorTarget)
+                queue.push(errorTarget);
+        }
+        return seen;
+    }
+    /** Each state's normalized `before`/`after` hook lists, for states declaring any. */
+    lifecycleHooks() {
+        const map = {};
+        for (const [slug, state] of Object.entries(this.spec.states)) {
+            const before = normalizeHooks(state.before);
+            const after = normalizeHooks(state.after);
+            if (before.length || after.length) {
+                map[slug] = {
+                    ...(before.length ? { before } : {}),
+                    ...(after.length ? { after } : {}),
+                };
+            }
+        }
+        return map;
+    }
+    /**
+     * The sibling workflows this machine may delegate to: every
+     * `archmax_workflow_<slug>` named in `tools.allow_always` and in the given
+     * state's `tools.allow` — or, with no state, in any **reachable** state's.
+     * Naming a target in governance *is* declaring the delegation.
+     */
+    delegationTargets(state) {
+        const targets = new Set();
+        const collect = (entries) => {
+            for (const entry of entries) {
+                const { tool } = normalizeAllowEntry(entry);
+                const slug = tool ? workflowSlugFromToolName(tool) : undefined;
+                if (slug)
+                    targets.add(slug);
+            }
+        };
+        collect(this.allowAlwaysEntries());
+        for (const slug of state !== undefined ? [state] : this.reachableStates()) {
+            collect(this.allowEntries(slug));
+        }
+        return [...targets].sort();
+    }
+    /** Run variables this state must have set before it may be left. */
+    requiredVariables(state) {
+        return this.spec.states[state]?.requires ?? [];
+    }
+    // --- Tool surface ---------------------------------------------------------------
+    allowEntries(state) {
+        return this.spec.states[state]?.tools?.allow ?? [];
+    }
+    allowAlwaysEntries() {
+        return this.spec.tools?.allow_always ?? [];
+    }
+    /**
+     * The effective essential set: the built-ins plus the host's `essentialTools`.
+     * Unconditional — no property of a workspace or a spec adds to it, and `task`
+     * is in it under no circumstances (see {@link UNGRANTABLE_TOOLS}).
+     */
+    essentialTools() {
+        const tools = new Set(ESSENTIAL_TOOLS);
+        for (const tool of this.extraEssential)
+            tools.add(tool);
+        return tools;
+    }
+    /**
+     * Every denial entry that applies in `state`: the workflow's `forbid_always`
+     * followed by the state's own `forbid`. Order is presentational only — both
+     * block, and a denial is evaluated ahead of every grant.
+     */
+    forbidEntries(state) {
+        // `validate` builds a machine from a spec whose schema may have failed, so a
+        // key can hold anything here; a non-list is nothing rather than a crash.
+        return [...list(this.spec.tools?.forbid_always), ...list(this.spec.states[state]?.tools?.forbid)];
+    }
+    /**
+     * The entries that govern `state`, in precedence order — the one derivation
+     * enforcement and disclosure both read. A tool is decided by exactly one tier:
+     * the state's own entries when they name it (the narrower constraint, even for
+     * an essential tool); else the essential grant; else `allow_always`. An
+     * `allow_always` entry for a tool the state mentions or that is essential is
+     * therefore inert.
+     */
+    effectiveEntries(state) {
+        const own = this.allowEntries(state).map(normalizeAllowEntry);
+        const mentioned = new Set(own.map((e) => e.tool));
+        const essential = [...this.essentialTools()]
+            .filter((tool) => !mentioned.has(tool))
+            .map((tool) => ({ tool, argMatchers: null }));
+        const always = this.allowAlwaysEntries()
+            .map(normalizeAllowEntry)
+            .filter((e) => e.tool && !mentioned.has(e.tool) && !this.essentialTools().has(e.tool));
+        return [...own, ...essential, ...always];
+    }
+    /**
+     * Whether a tool call is statically permitted in `state`. Closed by default:
+     * the always-allowed controls pass; otherwise some effective entry must name
+     * the tool and match its arguments.
+     */
+    checkAllowed(state, tool, args, ctx) {
+        if (ALWAYS_ALLOWED_TOOLS.has(tool))
+            return true;
+        return this.effectiveEntries(state).some((entry) => entry.tool === tool &&
+            argsSatisfy(entry.argMatchers, args, ctx?.variables, (failure) => ctx?.onUnresolved?.(failure)));
+    }
+    /**
+     * The tool names disclosed to the model while `state` is active: every tool
+     * an effective entry names plus the controls (`archmax_advance` omitted for a
+     * terminal state, where every call to it would be rejected), minus the tools
+     * denied here by name. Name-level only — argument enforcement stays with the
+     * kernel at call time.
+     */
+    disclosedTools(state) {
+        const disclosed = new Set();
+        for (const { tool } of this.effectiveEntries(state))
+            if (tool)
+                disclosed.add(tool);
+        if (!this.isTerminal(state))
+            disclosed.add(ADVANCE_TOOL);
+        // Reset, wait and the variable tools are disclosed everywhere, terminal
+        // states included: restarting, parking for a reply, and the run's working
+        // memory all still apply once a run has answered.
+        disclosed.add(RESET_TOOL);
+        disclosed.add(WAIT_TOOL);
+        disclosed.add(GET_VARIABLES_TOOL);
+        disclosed.add(SET_VARIABLES_TOOL);
+        // A bare denial removes the tool from the model's picture entirely; a
+        // guarded one (`{ tool: write_file, paths: [...] }`) denies only some calls,
+        // so the tool stays disclosed and the kernel refuses the call — the same
+        // rule the grant side follows for a guarded allow entry.
+        for (const entry of this.forbidEntries(state)) {
+            const { tool, argMatchers } = normalizeAllowEntry(entry);
+            if (tool && !argMatchers)
+                disclosed.delete(tool);
+        }
+        return disclosed;
+    }
+    renderEntry({ tool, argMatchers }) {
+        if (!argMatchers)
+            return tool ?? "";
+        const parts = Object.entries(argMatchers)
+            .map(([name, globs]) => `${name}=${globs.join("|")}`)
+            .join(", ");
+        return `${tool}(${parts})`;
+    }
+    /**
+     * Model-facing description of what `checkAllowed` enforces in a state: the
+     * effective entries in precedence order, minus any tool denied here by name,
+     * then the always-allowed controls the state discloses. A denial that leaves
+     * the tool usable for other arguments (a guarded entry) leaves it listed —
+     * the same line disclosure draws — so the model's picture matches enforcement
+     * either way.
+     */
+    describeAllowed(state) {
+        const denied = new Set();
+        for (const entry of this.forbidEntries(state)) {
+            const { tool, argMatchers } = normalizeAllowEntry(entry);
+            if (tool && !argMatchers)
+                denied.add(tool);
+        }
+        const parts = this.effectiveEntries(state)
+            .filter(({ tool }) => !tool || !denied.has(tool))
+            .map((entry) => this.renderEntry(entry));
+        const disclosed = this.disclosedTools(state);
+        for (const tool of ALWAYS_ALLOWED_TOOLS)
+            if (disclosed.has(tool))
+                parts.push(tool);
+        return parts.join(", ");
+    }
+    /**
+     * Model-facing lines describing the argument constraints that bind in a
+     * state, rendered through the same resolver the kernel enforces with so an
+     * unresolved reference is shown as unresolved-and-named rather than as a
+     * placeholder the model might pass literally. Empty when none bind.
+     */
+    describeArgConstraints(state, variables = {}) {
+        const lines = [];
+        for (const { tool, argMatchers } of this.effectiveEntries(state)) {
+            if (!tool || !argMatchers)
+                continue;
+            const constraints = Object.entries(argMatchers)
+                .map(([name, globs]) => {
+                const rendered = globs.map((g) => describeGlob(g, variables));
+                return rendered.length > 1
+                    ? `${name} must match one of: ${rendered.map((g) => `'${g}'`).join(", ")}`
+                    : `${name} must match '${rendered[0]}'`;
+            })
+                .join(" and ");
+            lines.push(`- ${tool}: ${constraints}`);
+        }
+        return lines;
+    }
+    // --- Triggers -------------------------------------------------------------------
+    /**
+     * Every trigger the spec declares, read from the states that declare them —
+     * computed once per machine.
+     */
+    triggerBindings() {
+        this.bindingsCache ??= triggerBindings(this.spec);
+        return this.bindingsCache;
+    }
+    /** The declared start states as `{ trigger, state }` pairs, in declaration order. */
+    startStates() {
+        return [...this.triggerBindings().values()].map((binding) => ({
+            trigger: binding.id,
+            state: binding.entry,
+        }));
+    }
+    /**
+     * The state a trigger enters, or `undefined` for an id no state declares.
+     * `manual` is the one entry for every ingress — the CLI, an SDK invocation
+     * naming no trigger, a host firing that names it, and a delegation.
+     */
+    startStateForTrigger(id) {
+        return this.triggerBindings().get(id)?.entry;
+    }
+    /** The session path declared for a trigger, if it declares one. */
+    sessionPathForTrigger(id) {
+        return this.triggerBindings().get(id)?.session;
+    }
+    /**
+     * The host-resolved `message:` declaration for a trigger: the parsed path,
+     * `false` for "firings carry no message", or `undefined` when undeclared.
+     */
+    messagePathForTrigger(id) {
+        return this.triggerBindings().get(id)?.message;
+    }
+    /** The host-resolved `connection:` slug declared for a trigger, if any. */
+    connectionForTrigger(id) {
+        return this.triggerBindings().get(id)?.connection;
+    }
+    /** The run variables a firing of this trigger must supply, if declared. */
+    requiresForTrigger(id) {
+        return this.triggerBindings().get(id)?.requires;
+    }
+    /**
+     * The run variables a run started through this trigger guarantees are set when
+     * it completes, if declared — the only variables that cross a sub-run boundary
+     * upward.
+     */
+    returnsForTrigger(id) {
+        return this.triggerBindings().get(id)?.returns;
+    }
+}
+//# sourceMappingURL=machine.js.map

package/dist/machine/machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.js","sourceRoot":"","sources":["../../src/machine/machine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAA6B,MAAM,mBAAmB,CAAC;AAG1F,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,WAAW,EACX,mBAAmB,GAGpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAsB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,eAAe,EAA0B,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,cAAc,EACd,eAAe,GAGhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,kBAAkB,EAClB,SAAS,EACT,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,GAOb,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AAEpE;;;;;GAKG;AACH,SAAS,IAAI,CAAI,KAAsB;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAYD,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,OAAO,eAAe;IAUf;IAKQ;IAdnB;;;OAGG;IACM,KAAK,CAAS;IAEf,aAAa,CAA+B;IAEpD,YACW,IAAiB;IAC1B;;;OAGG;IACc,iBAAsC,IAAI,GAAG,EAAE;QALvD,SAAI,GAAJ,IAAI,CAAa;QAKT,mBAAc,GAAd,cAAc,CAAiC;QAGhE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,KAAK;YACR,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC;gBACzC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK;gBAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,SAAoB,EACpB,KAAwB,EACxB,OAA8B;QAE9B,MAAM,IAAI,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/E,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAED,uDAAuD;IACvD,MAAM,CAAC,QAAQ,CACb,IAAiB,EACjB,mBAAsC;QAEtC,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,IAAI,QAAQ;QACV,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,IAAI,QAAQ;QACV,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,uDAAuD;IACvD,IAAI,eAAe;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACnC,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,kBAAkB;YAC5C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,GAAG,CAAC,CAAC,CAAC,YAAY;gBAChB,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpF,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzE;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,cAAc;QACZ,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,EAAE,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,mFAAmF;IAEnF;;;;;;OAMG;IACH,oBAAoB,CAAC,SAA4B;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,+EAA+E;IAC/E,uBAAuB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,KAAa;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAC9D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;QACF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,KAAa,EAAE,IAAY;QACrC,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,KAAa,EAAE,SAA4B;QACvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,mFAAmF;IAEnF;;;;;;;OAOG;IACH,oBAAoB,CAAC,QAA2B;QAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;aACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAa;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAC9D,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;QACF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,KAAa,EAAE,IAAY;QACrC,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,KAAa,EAAE,QAA2B;QACtD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC;aACrE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,MAAqB;QAC9D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,UAAU,GAAG;YACjB,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC;YAC/D,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;SACxD,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,mFAAmF;IAEnF,iBAAiB,CAAC,IAAY;QAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,aAAa,CAAC,IAAY,EAAE,EAAU;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,+EAA+E;IAC/E,OAAO,CAAC,KAAa;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;QACjD,OAAO,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAED,gFAAgF;IAChF,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,2EAA2E;IAC3E,YAAY,CAAC,KAAa;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,OAAO,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,eAAe;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IACrF,cAAc;QACZ,MAAM,GAAG,GAAkC,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,GAAG;oBACV,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAc;QAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,OAAqB,EAAE,EAAE;YACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/D,IAAI,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,mFAAmF;IAE3E,YAAY,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACrD,CAAC;IAEO,kBAAkB;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACK,cAAc;QACpB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,cAAc;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,KAAa;QACzB,6EAA6E;QAC7E,yEAAyE;QACzE,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACpG,CAAC;IAED;;;;;;;OAOG;IACK,gBAAgB,CAAC,KAAa;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,IAAI,EAAwB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE;aACrC,GAAG,CAAC,mBAAmB,CAAC;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,KAAa,EACb,IAAY,EACZ,IAA6B,EAC7B,GAAkB;QAElB,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CACtC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,IAAI,KAAK,IAAI;YACnB,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAC/D,GAAG,EAAE,YAAY,EAAE,CAAC,OAAO,CAAC,CAC7B,CACJ,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,KAAa;QAC1B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,IAAI,IAAI;gBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,wEAAwE;QACxE,0EAA0E;QAC1E,kDAAkD;QAClD,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAClC,SAAS,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAClC,sEAAsE;QACtE,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,IAAI,IAAI,CAAC,WAAW;gBAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAwB;QAC7D,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;IAC7B,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,KAAa;QAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,IAAI,IAAI,CAAC,WAAW;gBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;aACvC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,oBAAoB;YAAE,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,sBAAsB,CAAC,KAAa,EAAE,YAA2B,EAAE;QACjE,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,SAAS;YACpC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;iBAC5C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;gBACrB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBAC9D,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACxB,CAAC,CAAC,GAAG,IAAI,uBAAuB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC1E,CAAC,CAAC,GAAG,IAAI,gBAAgB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC;iBACD,IAAI,CAAC,OAAO,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,WAAW,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,mFAAmF;IAEnF;;;OAGG;IACH,eAAe;QACb,IAAI,CAAC,aAAa,KAAK,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,qFAAqF;IACrF,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;IAC/C,CAAC;IAED,mEAAmE;IACnE,qBAAqB,CAAC,EAAU;QAC9B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,EAAU;QAC9B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACjD,CAAC;IAED,2EAA2E;IAC3E,oBAAoB,CAAC,EAAU;QAC7B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;IACpD,CAAC;IAED,2EAA2E;IAC3E,kBAAkB,CAAC,EAAU;QAC3B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACjD,CAAC;CACF"}

package/dist/machine/mount-grants.d.ts

@@ -0,0 +1,25 @@
+import type { MountAccess, MountGrantEntry } from "./types.js";
+/**
+ * One mounts grant, in the one shape every reader consults: the mount's name and
+ * the access this level asked for, `undefined` meaning "whatever posture the
+ * host declared".
+ *
+ * The two spellings a grant list accepts — a bare name and
+ * `{ mount, access }` — normalize here rather than at each reader, the way
+ * `normalizeAllowEntry` normalizes the two spellings of a tool entry: the
+ * resolution on {@link WorkflowMachine} and `validate` then read one shape and
+ * cannot disagree about what the document said.
+ */
+export interface NormalizedMountGrant {
+    readonly mount: string;
+    readonly access: MountAccess | undefined;
+}
+/**
+ * Normalize a mounts grant list, dropping entries no well-formed spelling
+ * covers.
+ *
+ * Tolerant of a malformed value on purpose: `validate` builds a machine from a
+ * spec whose schema may have failed, so a key can hold anything here, and a
+ * non-list is nothing rather than a crash.
+ */
+export declare function normalizeMountGrants(entries: readonly MountGrantEntry[] | undefined): NormalizedMountGrant[];

package/dist/machine/mount-grants.js

@@ -0,0 +1,24 @@
+/**
+ * Normalize a mounts grant list, dropping entries no well-formed spelling
+ * covers.
+ *
+ * Tolerant of a malformed value on purpose: `validate` builds a machine from a
+ * spec whose schema may have failed, so a key can hold anything here, and a
+ * non-list is nothing rather than a crash.
+ */
+export function normalizeMountGrants(entries) {
+    if (!Array.isArray(entries))
+        return [];
+    const grants = [];
+    for (const entry of entries) {
+        if (typeof entry === "string") {
+            grants.push({ mount: entry, access: undefined });
+            continue;
+        }
+        if (entry !== null && typeof entry === "object" && typeof entry.mount === "string") {
+            grants.push({ mount: entry.mount, access: entry.access });
+        }
+    }
+    return grants;
+}
+//# sourceMappingURL=mount-grants.js.map

package/dist/machine/mount-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-grants.js","sourceRoot":"","sources":["../../src/machine/mount-grants.ts"],"names":[],"mappings":"AAkBA;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA+C;IAE/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/machine/slug.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The one shape a slug takes, at every level that has one: a **state slug** (a
+ * state's key in `states`) and a **workflow slug** (the `workflows/<slug>/`
+ * directory name, the CLI argument, a delegation tool's target). Deliberately
+ * the same shape, so the pattern lives here alone.
+ */
+/**
+ * **Hyphen-separated kebab-case** — lowercase alphanumeric segments joined by
+ * single hyphens. No leading, trailing, or doubled hyphens; no underscores, no
+ * uppercase, no spaces.
+ */
+export declare const SLUG_PATTERN: RegExp;
+/** Whether a value is a well-formed slug. */
+export declare function isSlug(value: unknown): value is string;

package/dist/machine/slug.js

@@ -0,0 +1,17 @@
+/**
+ * The one shape a slug takes, at every level that has one: a **state slug** (a
+ * state's key in `states`) and a **workflow slug** (the `workflows/<slug>/`
+ * directory name, the CLI argument, a delegation tool's target). Deliberately
+ * the same shape, so the pattern lives here alone.
+ */
+/**
+ * **Hyphen-separated kebab-case** — lowercase alphanumeric segments joined by
+ * single hyphens. No leading, trailing, or doubled hyphens; no underscores, no
+ * uppercase, no spaces.
+ */
+export const SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** Whether a value is a well-formed slug. */
+export function isSlug(value) {
+    return typeof value === "string" && SLUG_PATTERN.test(value);
+}
+//# sourceMappingURL=slug.js.map