@clossys/butler 0.1.1

package/dist/contract.d.ts

@@ -0,0 +1,256 @@
+/**
+ * The runtime contract: evaluate one stored want, decide one change to it,
+ * and the three gates that read a whole set of them.
+ *
+ * THE LOOP THIS CLOSES
+ * ---------------------
+ * A stated want is the setpoint. Acting on it is the act. Reading the
+ * interpretation back to the person, and asking whether the standing
+ * answer is still current, is the observation. Unconfirmed intents and
+ * expired instructions are the comparison. Re-asking is the correction. A
+ * preference written to a row and never re-checked has no observation and
+ * no comparison — it is an open loop, and closing it is the entire reason
+ * this package exists.
+ *
+ * Everything here is pure. No I/O, no clock read, no ambient state:
+ * `evaluateStandingInstruction` and `decideStandingChange` take `now` as a
+ * parameter rather than calling `Date.now()` themselves, so the same
+ * inputs always produce the same output and a test can put the clock
+ * anywhere it needs it. Storage and audit are host-supplied ports
+ * (`StandingInstructionStore`, `StandingAuditLedger` in `schema.ts`); this
+ * file never touches either.
+ *
+ * THE THREE GATES
+ * ----------------
+ * Each returns the same shape of three-state result: `ok: true` when it
+ * genuinely checked something and found nothing; `ok: false` with a
+ * violation reason and findings when it checked and found something; and
+ * `ok: false` with an INDETERMINATE reason when there was nothing to check
+ * at all. `cli.ts` maps those onto `0` / `1` / `2` and never collapses the
+ * third into either of the first two. A gate that reports "clean" after
+ * checking nothing is worse than no gate.
+ */
+import type { ConfidenceFloor, ConfirmationRecord, InstructionUsage, IntentRecord, PolicyVersion, PreferencePath, StandingAction, StandingAuditEvent, StandingEvaluation, StandingEvaluationPolicy, StandingInstruction, StandingTopic } from "./schema.js";
+/**
+ * Compares one stored instruction against the policy in force AND the
+ * clock. This is the check a weaker tool skips: asking whether a row
+ * exists, or reading a boolean off it, cannot see age, so a row three
+ * policy versions old and a year past its own declared window both read as
+ * a pass. Presence is not currency.
+ *
+ * - `undefined` input, and a record whose own `state.kind` is `"absent"`,
+ *   both return `{ status: "absent", reason: "no-record" }`. There is no
+ *   third "never asked" representation, and this function deliberately does
+ *   not runtime-validate its typed input or fall back to `"absent"` for a
+ *   malformed one — a silent fallback would make a broken record
+ *   indistinguishable from a subject who was genuinely never asked. Untyped
+ *   input is validated at the boundary, by `schema.ts`'s validators.
+ * - An INFERRED instruction with no `confirmedAt` returns
+ *   `{ status: "absent", reason: "unconfirmed-inference" }`. An inferred
+ *   want is not a want we have until the person says it is; treating one as
+ *   binding is the same defect as reading absence as permission, one step
+ *   further upstream.
+ * - A `"granted"` record whose `policyVersion` differs from
+ *   `currentPolicyVersion` is ALWAYS stale, unconditionally. A policy
+ *   change invalidates prior permission by definition.
+ * - A `"denied"` record whose `policyVersion` differs is stale only when
+ *   `policy.invalidateDenialOnPolicyBump` is `true`. Whether a policy bump
+ *   also invalidates a prior refusal is a jurisdiction judgment; `policy`
+ *   has no default, so nobody gets either answer by accident.
+ * - Independently of the policy version, a record whose `decidedAt` is more
+ *   than `currency.days` before `at` is stale with reason
+ *   `"window-elapsed"` — for grants AND denials alike. The window is the
+ *   consumer's own declared statement of how long their own answer keeps
+ *   speaking, and a refusal that has expired is as much a reason to ask
+ *   again as a permission that has.
+ *
+ * When both a policy bump and an elapsed window apply, `"policy-superseded"`
+ * is reported: it is the more specific fact, it names something that
+ * happened on this side of the boundary rather than merely time passing,
+ * and either way the answer is the same — ask again.
+ */
+export declare function evaluateStandingInstruction(instruction: StandingInstruction | undefined, currentPolicyVersion: PolicyVersion, policy: StandingEvaluationPolicy, at: string): StandingEvaluation;
+/**
+ * The pure decision core for one change to one standing instruction:
+ * produces the new record and its audit event. The caller's
+ * `StandingInstructionStore` and `StandingAuditLedger` perform the writes.
+ *
+ * `actorId` and `subjectId` are separate parameters, in that order, and
+ * are never derived from one another — an actor recording a subject's own
+ * decision and an actor deciding on a subject's behalf must be
+ * distinguishable in the audit trail, and a single conflated id makes them
+ * identical forever.
+ *
+ * Withdrawing produces `state: { kind: "absent" }`: the same value a
+ * subject who was never asked has. That is deliberate and it is the point
+ * of the three-state model — a withdrawal returns the person to "we do not
+ * have a want here", which is not permission, rather than to a `false`
+ * that some later boolean read could round back up.
+ */
+export declare function decideStandingChange(actorId: string, subjectId: string, instructionId: string, action: StandingAction, now: string): {
+    instruction: StandingInstruction;
+    auditEvent: StandingAuditEvent;
+};
+/**
+ * A pure audit-event builder for a subject reopening their preference
+ * surface, independent of whether they change anything once it is open.
+ * Reopening at all is audit-worthy on its own: it is the observation half
+ * of the loop, and a surface nobody ever reopens is a surface whose
+ * instructions are never re-checked.
+ */
+export declare function recordReopened(actorId: string, subjectId: string, topic: StandingTopic, policyVersion: PolicyVersion, now: string): StandingAuditEvent;
+/**
+ * A pure audit-event builder for the moment `evaluateStandingInstruction`
+ * reports a stored answer stale. `reason` picks the event type, so an
+ * auditor can tell a policy bump from an expired window without re-deriving
+ * it. `previousPolicyVersion` is the version the invalidated record
+ * actually answered; `currentPolicyVersion` is the one in force now.
+ * Calling this is optional — the evaluation itself performs no I/O and
+ * emits nothing — but a host that wants staleness to appear in its trail
+ * rather than only ever being silently recomputed on read calls it once it
+ * observes a `"stale"` evaluation.
+ */
+export declare function recordStaleness(actorId: string, subjectId: string, topic: StandingTopic, reason: "policy-superseded" | "window-elapsed", previousPolicyVersion: PolicyVersion, currentPolicyVersion: PolicyVersion, now: string): StandingAuditEvent;
+export type ConfirmationFindingKind = 
+/** Something was done on this reading and the subject never answered a read-back at all. */
+"acted-without-confirmation"
+/** Something was done on this reading after the subject said it was misread. */
+ | "acted-against-misread"
+/** Something was done on this reading after the subject said they could not tell. `"unclear"` is not a quiet yes. */
+ | "acted-against-unclear"
+/** A reading below the declared floor was acted on with no hand-off and no confirmation. */
+ | "below-floor-acted-silently"
+/** A read-back answers an intent that is not in the set being checked. */
+ | "confirmation-without-intent";
+export interface ConfirmationFinding {
+    kind: ConfirmationFindingKind;
+    intentId: string;
+    /** The actor that dispositioned the intent, or the subject that answered a dangling read-back. Never both, never merged. */
+    actorId?: string;
+    message: string;
+}
+export type ConfirmationFailureReason = "unconfirmed-intents" | "no-intents-provided";
+export interface ConfirmationCompletenessResult {
+    ok: boolean;
+    reason?: ConfirmationFailureReason;
+    intentsChecked: number;
+    confirmationsChecked: number;
+    /** The floor actually applied, echoed back so a report names the number it judged against rather than implying a universal one. */
+    floorApplied: number;
+    findings: ConfirmationFinding[];
+}
+/**
+ * GATE 1 — every acted-on intent has the subject's own confirmation, or an
+ * explicit below-floor hand-off.
+ *
+ * Pure, no I/O. `floor` is supplied by the caller and has no default
+ * anywhere in this package: the number below which a reading is too weak
+ * to act on is one of the consumer's own values, and a floor this package
+ * invented would be this package authoring it.
+ *
+ * The below-floor rule is the AI-native half. A reading whose confidence
+ * is strictly below the floor may still be acted on — but only after the
+ * subject confirms it. What it may never be is acted on SILENTLY: a
+ * below-floor reading has to become a confirmation request or an explicit
+ * hand-off, and `"handed-off"` is a first-class disposition precisely so
+ * declining to act is representable as a decision rather than as an
+ * absence of one.
+ *
+ * `ok: false` with `"no-intents-provided"` is not a violation — it is this
+ * gate saying it never formed an opinion, and `cli.ts` maps it to `2`.
+ */
+export declare function checkConfirmationCompleteness(intents: readonly IntentRecord[], confirmations: readonly ConfirmationRecord[], floor: ConfidenceFloor): ConfirmationCompletenessResult;
+export type CurrencyFindingKind = 
+/** An instruction was relied on after its own declared window ran out. */
+"used-past-window"
+/** An instruction was relied on after the policy version it answered was superseded. */
+ | "used-after-policy-superseded"
+/** An instruction was relied on while there was no answer on record — including an inference the subject never confirmed. Absence is not permission. */
+ | "used-while-absent"
+/** A usage names an instruction that is not in the set being checked. */
+ | "usage-without-instruction";
+export interface CurrencyFinding {
+    kind: CurrencyFindingKind;
+    instructionId: string;
+    /** Whoever relied on the instruction. Separate from the instruction's own `subjectId`, always. */
+    actorId: string;
+    usedAt: string;
+    message: string;
+}
+export type CurrencyFailureReason = "stale-instructions-used" | "no-instructions-provided" | "no-usages-provided";
+export interface CurrencyResult {
+    ok: boolean;
+    reason?: CurrencyFailureReason;
+    instructionsChecked: number;
+    usagesChecked: number;
+    findings: CurrencyFinding[];
+}
+/**
+ * GATE 2 — no standing instruction is used past its declared window.
+ *
+ * Pure, no I/O. Reads USAGES, not instructions alone, and that is the
+ * whole design: a set of instructions with nobody relying on them proves
+ * nothing, while a set of usages is a record of the loop actually being
+ * closed or not. Each usage carries the policy version in force at the
+ * moment it happened, so this gate replays a real decision rather than
+ * re-deriving one against today's policy.
+ *
+ * `policy.invalidateDenialOnPolicyBump` has no default — see
+ * `evaluateStandingInstruction`. A caller that cannot supply it does not
+ * get a guess.
+ *
+ * `used-while-absent` is here because it is the same defect the three-state
+ * model exists to prevent, observed one layer up: relying on nothing at all
+ * — a subject never asked, or an inference they never confirmed — is not a
+ * currency problem in the narrow sense, but it is exactly what a boolean
+ * read of a missing row silently permits, and a gate that only measured
+ * age would pass it.
+ *
+ * `ok: false` with either "nothing provided" reason is indeterminate, and
+ * `cli.ts` maps it to `2`.
+ */
+export declare function checkCurrency(instructions: readonly StandingInstruction[], usages: readonly InstructionUsage[], policy: StandingEvaluationPolicy): CurrencyResult;
+export type WithdrawalParityFindingKind = 
+/** The surface declares a way in and no way out. */
+"withdrawal-unavailable"
+/** Withdrawing takes more discrete actions than granting did. */
+ | "withdrawal-costs-more-steps"
+/** Withdrawing requires contacting a human where granting did not. */
+ | "withdrawal-requires-contact"
+/** Withdrawing requires an account where granting did not. */
+ | "withdrawal-requires-account";
+export interface WithdrawalParityFinding {
+    kind: WithdrawalParityFindingKind;
+    surfaceId: string;
+    topic: StandingTopic;
+    message: string;
+}
+export type WithdrawalParityFailureReason = "withdrawal-harder-than-granting" | "no-paths-provided";
+export interface WithdrawalParityResult {
+    ok: boolean;
+    reason?: WithdrawalParityFailureReason;
+    pathsChecked: number;
+    findings: WithdrawalParityFinding[];
+}
+/**
+ * GATE 3 — withdrawing is no harder than granting.
+ *
+ * Pure, no I/O. Compares the two routes a consumer measured itself, using
+ * three coarse countable facts rather than a score: a parity claim that
+ * produces a number nobody can trace back to a step is not evidence.
+ *
+ * A missing `withdraw` path is the loudest finding here, not a skipped
+ * comparison. A surface that offers a way in and no way out is the extreme
+ * of the same defect, and a gate that quietly had nothing to compare would
+ * report it as a pass.
+ *
+ * Reopening is not a degraded path, and this gate is only the measurement
+ * half of that. The API half is structural and lives in `./web`, where
+ * `withdraw` shares `grant`'s and `deny`'s exact call shape, so there is no
+ * separate, harder-to-reach function for revoking than for giving.
+ *
+ * `ok: false` with `"no-paths-provided"` is indeterminate, and `cli.ts`
+ * maps it to `2`.
+ */
+export declare function checkWithdrawalParity(paths: readonly PreferencePath[]): WithdrawalParityResult;
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAElB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,EACd,MAAM,aAAa,CAAC;AAerB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAC5C,oBAAoB,EAAE,aAAa,EACnC,MAAM,EAAE,wBAAwB,EAChC,EAAE,EAAE,MAAM,GACT,kBAAkB,CAwBpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,MAAM,GACV;IAAE,WAAW,EAAE,mBAAmB,CAAC;IAAC,UAAU,EAAE,kBAAkB,CAAA;CAAE,CAkBtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,aAAa,EACpB,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,MAAM,GACV,kBAAkB,CAEpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,mBAAmB,GAAG,gBAAgB,EAC9C,qBAAqB,EAAE,aAAa,EACpC,oBAAoB,EAAE,aAAa,EACnC,GAAG,EAAE,MAAM,GACV,kBAAkB,CAUpB;AAID,MAAM,MAAM,uBAAuB;AACjC,4FAA4F;AAC1F,4BAA4B;AAC9B,gFAAgF;GAC9E,uBAAuB;AACzB,qHAAqH;GACnH,uBAAuB;AACzB,4FAA4F;GAC1F,4BAA4B;AAC9B,0EAA0E;GACxE,6BAA6B,CAAC;AAElC,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,4HAA4H;IAC5H,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAEtF,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,yBAAyB,CAAC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mIAAmI;IACnI,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,aAAa,EAAE,SAAS,kBAAkB,EAAE,EAC5C,KAAK,EAAE,eAAe,GACrB,8BAA8B,CA+DhC;AAID,MAAM,MAAM,mBAAmB;AAC7B,0EAA0E;AACxE,kBAAkB;AACpB,wFAAwF;GACtF,8BAA8B;AAChC,wJAAwJ;GACtJ,mBAAmB;AACrB,yEAAyE;GACvE,2BAA2B,CAAC;AAEhC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,yBAAyB,GAAG,0BAA0B,GAAG,oBAAoB,CAAC;AAElH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,SAAS,mBAAmB,EAAE,EAC5C,MAAM,EAAE,SAAS,gBAAgB,EAAE,EACnC,MAAM,EAAE,wBAAwB,GAC/B,cAAc,CAoDhB;AAID,MAAM,MAAM,2BAA2B;AACrC,oDAAoD;AAClD,wBAAwB;AAC1B,iEAAiE;GAC/D,6BAA6B;AAC/B,sEAAsE;GACpE,6BAA6B;AAC/B,8DAA8D;GAC5D,6BAA6B,CAAC;AAElC,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,2BAA2B,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,6BAA6B,GAAG,iCAAiC,GAAG,mBAAmB,CAAC;AAEpG,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,6BAA6B,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CA2B9F"}

package/dist/contract.js

@@ -0,0 +1,377 @@
+/**
+ * The runtime contract: evaluate one stored want, decide one change to it,
+ * and the three gates that read a whole set of them.
+ *
+ * THE LOOP THIS CLOSES
+ * ---------------------
+ * A stated want is the setpoint. Acting on it is the act. Reading the
+ * interpretation back to the person, and asking whether the standing
+ * answer is still current, is the observation. Unconfirmed intents and
+ * expired instructions are the comparison. Re-asking is the correction. A
+ * preference written to a row and never re-checked has no observation and
+ * no comparison — it is an open loop, and closing it is the entire reason
+ * this package exists.
+ *
+ * Everything here is pure. No I/O, no clock read, no ambient state:
+ * `evaluateStandingInstruction` and `decideStandingChange` take `now` as a
+ * parameter rather than calling `Date.now()` themselves, so the same
+ * inputs always produce the same output and a test can put the clock
+ * anywhere it needs it. Storage and audit are host-supplied ports
+ * (`StandingInstructionStore`, `StandingAuditLedger` in `schema.ts`); this
+ * file never touches either.
+ *
+ * THE THREE GATES
+ * ----------------
+ * Each returns the same shape of three-state result: `ok: true` when it
+ * genuinely checked something and found nothing; `ok: false` with a
+ * violation reason and findings when it checked and found something; and
+ * `ok: false` with an INDETERMINATE reason when there was nothing to check
+ * at all. `cli.ts` maps those onto `0` / `1` / `2` and never collapses the
+ * third into either of the first two. A gate that reports "clean" after
+ * checking nothing is worse than no gate.
+ */
+const MILLISECONDS_PER_DAY = 86_400_000;
+function samePolicyVersion(a, b) {
+    return a.policyId === b.policyId && a.version === b.version;
+}
+function windowElapsed(decidedAt, currency, at) {
+    const decided = Date.parse(decidedAt);
+    const asked = Date.parse(at);
+    if (Number.isNaN(decided) || Number.isNaN(asked))
+        return false;
+    return asked - decided > currency.days * MILLISECONDS_PER_DAY;
+}
+/**
+ * Compares one stored instruction against the policy in force AND the
+ * clock. This is the check a weaker tool skips: asking whether a row
+ * exists, or reading a boolean off it, cannot see age, so a row three
+ * policy versions old and a year past its own declared window both read as
+ * a pass. Presence is not currency.
+ *
+ * - `undefined` input, and a record whose own `state.kind` is `"absent"`,
+ *   both return `{ status: "absent", reason: "no-record" }`. There is no
+ *   third "never asked" representation, and this function deliberately does
+ *   not runtime-validate its typed input or fall back to `"absent"` for a
+ *   malformed one — a silent fallback would make a broken record
+ *   indistinguishable from a subject who was genuinely never asked. Untyped
+ *   input is validated at the boundary, by `schema.ts`'s validators.
+ * - An INFERRED instruction with no `confirmedAt` returns
+ *   `{ status: "absent", reason: "unconfirmed-inference" }`. An inferred
+ *   want is not a want we have until the person says it is; treating one as
+ *   binding is the same defect as reading absence as permission, one step
+ *   further upstream.
+ * - A `"granted"` record whose `policyVersion` differs from
+ *   `currentPolicyVersion` is ALWAYS stale, unconditionally. A policy
+ *   change invalidates prior permission by definition.
+ * - A `"denied"` record whose `policyVersion` differs is stale only when
+ *   `policy.invalidateDenialOnPolicyBump` is `true`. Whether a policy bump
+ *   also invalidates a prior refusal is a jurisdiction judgment; `policy`
+ *   has no default, so nobody gets either answer by accident.
+ * - Independently of the policy version, a record whose `decidedAt` is more
+ *   than `currency.days` before `at` is stale with reason
+ *   `"window-elapsed"` — for grants AND denials alike. The window is the
+ *   consumer's own declared statement of how long their own answer keeps
+ *   speaking, and a refusal that has expired is as much a reason to ask
+ *   again as a permission that has.
+ *
+ * When both a policy bump and an elapsed window apply, `"policy-superseded"`
+ * is reported: it is the more specific fact, it names something that
+ * happened on this side of the boundary rather than merely time passing,
+ * and either way the answer is the same — ask again.
+ */
+export function evaluateStandingInstruction(instruction, currentPolicyVersion, policy, at) {
+    if (instruction === undefined || instruction.state.kind === "absent") {
+        return { status: "absent", reason: "no-record" };
+    }
+    if (instruction.provenance === "inferred" && instruction.confirmedAt === undefined) {
+        return { status: "absent", reason: "unconfirmed-inference" };
+    }
+    const { state } = instruction;
+    const current = samePolicyVersion(state.policyVersion, currentPolicyVersion);
+    const expired = windowElapsed(state.decidedAt, instruction.currency, at);
+    if (state.kind === "granted") {
+        if (!current)
+            return { status: "stale", reason: "policy-superseded", previousPolicyVersion: state.policyVersion, decidedAt: state.decidedAt };
+        if (expired)
+            return { status: "stale", reason: "window-elapsed", previousPolicyVersion: state.policyVersion, decidedAt: state.decidedAt };
+        return { status: "granted", policyVersion: state.policyVersion };
+    }
+    // state.kind === "denied"
+    if (!current && policy.invalidateDenialOnPolicyBump) {
+        return { status: "stale", reason: "policy-superseded", previousPolicyVersion: state.policyVersion, decidedAt: state.decidedAt };
+    }
+    if (expired)
+        return { status: "stale", reason: "window-elapsed", previousPolicyVersion: state.policyVersion, decidedAt: state.decidedAt };
+    return { status: "denied", policyVersion: state.policyVersion };
+}
+/**
+ * The pure decision core for one change to one standing instruction:
+ * produces the new record and its audit event. The caller's
+ * `StandingInstructionStore` and `StandingAuditLedger` perform the writes.
+ *
+ * `actorId` and `subjectId` are separate parameters, in that order, and
+ * are never derived from one another — an actor recording a subject's own
+ * decision and an actor deciding on a subject's behalf must be
+ * distinguishable in the audit trail, and a single conflated id makes them
+ * identical forever.
+ *
+ * Withdrawing produces `state: { kind: "absent" }`: the same value a
+ * subject who was never asked has. That is deliberate and it is the point
+ * of the three-state model — a withdrawal returns the person to "we do not
+ * have a want here", which is not permission, rather than to a `false`
+ * that some later boolean read could round back up.
+ */
+export function decideStandingChange(actorId, subjectId, instructionId, action, now) {
+    const base = { instructionId, subjectId, topic: action.topic, provenance: "stated", currency: action.currency };
+    const instruction = action.kind === "grant"
+        ? { ...base, state: { kind: "granted", policyVersion: action.policyVersion, decidedAt: now } }
+        : action.kind === "deny"
+            ? { ...base, state: { kind: "denied", policyVersion: action.policyVersion, decidedAt: now } }
+            : { ...base, state: { kind: "absent" } };
+    const auditEvent = {
+        subjectId,
+        actorId,
+        topic: action.topic,
+        type: action.kind === "grant" ? "granted" : action.kind === "deny" ? "denied" : "withdrawn",
+        policyVersion: action.policyVersion,
+        occurredAt: now,
+    };
+    return { instruction, auditEvent };
+}
+/**
+ * A pure audit-event builder for a subject reopening their preference
+ * surface, independent of whether they change anything once it is open.
+ * Reopening at all is audit-worthy on its own: it is the observation half
+ * of the loop, and a surface nobody ever reopens is a surface whose
+ * instructions are never re-checked.
+ */
+export function recordReopened(actorId, subjectId, topic, policyVersion, now) {
+    return { subjectId, actorId, topic, type: "reopened", policyVersion, occurredAt: now };
+}
+/**
+ * A pure audit-event builder for the moment `evaluateStandingInstruction`
+ * reports a stored answer stale. `reason` picks the event type, so an
+ * auditor can tell a policy bump from an expired window without re-deriving
+ * it. `previousPolicyVersion` is the version the invalidated record
+ * actually answered; `currentPolicyVersion` is the one in force now.
+ * Calling this is optional — the evaluation itself performs no I/O and
+ * emits nothing — but a host that wants staleness to appear in its trail
+ * rather than only ever being silently recomputed on read calls it once it
+ * observes a `"stale"` evaluation.
+ */
+export function recordStaleness(actorId, subjectId, topic, reason, previousPolicyVersion, currentPolicyVersion, now) {
+    return {
+        subjectId,
+        actorId,
+        topic,
+        type: reason,
+        policyVersion: currentPolicyVersion,
+        previousPolicyVersion,
+        occurredAt: now,
+    };
+}
+/**
+ * GATE 1 — every acted-on intent has the subject's own confirmation, or an
+ * explicit below-floor hand-off.
+ *
+ * Pure, no I/O. `floor` is supplied by the caller and has no default
+ * anywhere in this package: the number below which a reading is too weak
+ * to act on is one of the consumer's own values, and a floor this package
+ * invented would be this package authoring it.
+ *
+ * The below-floor rule is the AI-native half. A reading whose confidence
+ * is strictly below the floor may still be acted on — but only after the
+ * subject confirms it. What it may never be is acted on SILENTLY: a
+ * below-floor reading has to become a confirmation request or an explicit
+ * hand-off, and `"handed-off"` is a first-class disposition precisely so
+ * declining to act is representable as a decision rather than as an
+ * absence of one.
+ *
+ * `ok: false` with `"no-intents-provided"` is not a violation — it is this
+ * gate saying it never formed an opinion, and `cli.ts` maps it to `2`.
+ */
+export function checkConfirmationCompleteness(intents, confirmations, floor) {
+    const base = { intentsChecked: intents.length, confirmationsChecked: confirmations.length, floorApplied: floor.minimumConfidence };
+    if (intents.length === 0) {
+        return { ok: false, reason: "no-intents-provided", ...base, findings: [] };
+    }
+    const byIntentId = new Map();
+    for (const confirmation of confirmations)
+        byIntentId.set(confirmation.intentId, confirmation);
+    const knownIntentIds = new Set(intents.map((intent) => intent.intentId));
+    const findings = [];
+    for (const intent of intents) {
+        const confirmation = byIntentId.get(intent.intentId);
+        const belowFloor = intent.confidence < floor.minimumConfidence;
+        if (intent.disposition !== "acted") {
+            // "handed-off" and "awaiting-confirmation" are both explicit,
+            // recorded decisions not to act yet. Neither needs a confirmation to
+            // be complete, because neither has done anything.
+            continue;
+        }
+        if (confirmation === undefined) {
+            findings.push({
+                kind: belowFloor ? "below-floor-acted-silently" : "acted-without-confirmation",
+                intentId: intent.intentId,
+                actorId: intent.actorId,
+                message: belowFloor
+                    ? `acted on a reading of confidence ${intent.confidence} below the declared floor ${floor.minimumConfidence}, with no confirmation and no hand-off`
+                    : "acted with no confirmation record from the subject",
+            });
+            continue;
+        }
+        if (confirmation.verdict === "misread") {
+            findings.push({
+                kind: "acted-against-misread",
+                intentId: intent.intentId,
+                actorId: intent.actorId,
+                message: "acted after the subject answered the read-back with \"misread\"",
+            });
+            continue;
+        }
+        if (confirmation.verdict === "unclear") {
+            findings.push({
+                kind: "acted-against-unclear",
+                intentId: intent.intentId,
+                actorId: intent.actorId,
+                message: "acted after the subject answered the read-back with \"unclear\"",
+            });
+        }
+    }
+    for (const confirmation of confirmations) {
+        if (knownIntentIds.has(confirmation.intentId))
+            continue;
+        findings.push({
+            kind: "confirmation-without-intent",
+            intentId: confirmation.intentId,
+            message: "a read-back answers an intent that is not in the set being checked",
+        });
+    }
+    if (findings.length > 0)
+        return { ok: false, reason: "unconfirmed-intents", ...base, findings };
+    return { ok: true, ...base, findings: [] };
+}
+/**
+ * GATE 2 — no standing instruction is used past its declared window.
+ *
+ * Pure, no I/O. Reads USAGES, not instructions alone, and that is the
+ * whole design: a set of instructions with nobody relying on them proves
+ * nothing, while a set of usages is a record of the loop actually being
+ * closed or not. Each usage carries the policy version in force at the
+ * moment it happened, so this gate replays a real decision rather than
+ * re-deriving one against today's policy.
+ *
+ * `policy.invalidateDenialOnPolicyBump` has no default — see
+ * `evaluateStandingInstruction`. A caller that cannot supply it does not
+ * get a guess.
+ *
+ * `used-while-absent` is here because it is the same defect the three-state
+ * model exists to prevent, observed one layer up: relying on nothing at all
+ * — a subject never asked, or an inference they never confirmed — is not a
+ * currency problem in the narrow sense, but it is exactly what a boolean
+ * read of a missing row silently permits, and a gate that only measured
+ * age would pass it.
+ *
+ * `ok: false` with either "nothing provided" reason is indeterminate, and
+ * `cli.ts` maps it to `2`.
+ */
+export function checkCurrency(instructions, usages, policy) {
+    const base = { instructionsChecked: instructions.length, usagesChecked: usages.length };
+    if (instructions.length === 0)
+        return { ok: false, reason: "no-instructions-provided", ...base, findings: [] };
+    if (usages.length === 0)
+        return { ok: false, reason: "no-usages-provided", ...base, findings: [] };
+    const byId = new Map();
+    for (const instruction of instructions)
+        byId.set(instruction.instructionId, instruction);
+    const findings = [];
+    for (const usage of usages) {
+        const instruction = byId.get(usage.instructionId);
+        if (instruction === undefined) {
+            findings.push({
+                kind: "usage-without-instruction",
+                instructionId: usage.instructionId,
+                actorId: usage.actorId,
+                usedAt: usage.usedAt,
+                message: "relied on an instruction that is not in the set being checked",
+            });
+            continue;
+        }
+        const evaluation = evaluateStandingInstruction(instruction, usage.currentPolicyVersion, policy, usage.usedAt);
+        if (evaluation.status === "absent") {
+            findings.push({
+                kind: "used-while-absent",
+                instructionId: usage.instructionId,
+                actorId: usage.actorId,
+                usedAt: usage.usedAt,
+                message: evaluation.reason === "unconfirmed-inference"
+                    ? "relied on an inferred instruction the subject never confirmed"
+                    : "relied on an instruction with no answer on record",
+            });
+            continue;
+        }
+        if (evaluation.status === "stale") {
+            findings.push({
+                kind: evaluation.reason === "window-elapsed" ? "used-past-window" : "used-after-policy-superseded",
+                instructionId: usage.instructionId,
+                actorId: usage.actorId,
+                usedAt: usage.usedAt,
+                message: evaluation.reason === "window-elapsed"
+                    ? `relied on an answer decided at ${evaluation.decidedAt}, past its declared window of ${instruction.currency.days} day(s)`
+                    : `relied on an answer to policy ${evaluation.previousPolicyVersion.policyId}@${evaluation.previousPolicyVersion.version}, superseded by ${usage.currentPolicyVersion.policyId}@${usage.currentPolicyVersion.version}`,
+            });
+        }
+    }
+    if (findings.length > 0)
+        return { ok: false, reason: "stale-instructions-used", ...base, findings };
+    return { ok: true, ...base, findings: [] };
+}
+/**
+ * GATE 3 — withdrawing is no harder than granting.
+ *
+ * Pure, no I/O. Compares the two routes a consumer measured itself, using
+ * three coarse countable facts rather than a score: a parity claim that
+ * produces a number nobody can trace back to a step is not evidence.
+ *
+ * A missing `withdraw` path is the loudest finding here, not a skipped
+ * comparison. A surface that offers a way in and no way out is the extreme
+ * of the same defect, and a gate that quietly had nothing to compare would
+ * report it as a pass.
+ *
+ * Reopening is not a degraded path, and this gate is only the measurement
+ * half of that. The API half is structural and lives in `./web`, where
+ * `withdraw` shares `grant`'s and `deny`'s exact call shape, so there is no
+ * separate, harder-to-reach function for revoking than for giving.
+ *
+ * `ok: false` with `"no-paths-provided"` is indeterminate, and `cli.ts`
+ * maps it to `2`.
+ */
+export function checkWithdrawalParity(paths) {
+    if (paths.length === 0)
+        return { ok: false, reason: "no-paths-provided", pathsChecked: 0, findings: [] };
+    const findings = [];
+    for (const path of paths) {
+        const where = { surfaceId: path.surfaceId, topic: path.topic };
+        if (path.withdraw === undefined) {
+            findings.push({ ...where, kind: "withdrawal-unavailable", message: "declares a grant path and no withdraw path at all" });
+            continue;
+        }
+        if (path.withdraw.steps > path.grant.steps) {
+            findings.push({
+                ...where,
+                kind: "withdrawal-costs-more-steps",
+                message: `withdrawing takes ${path.withdraw.steps} step(s) against granting's ${path.grant.steps}`,
+            });
+        }
+        if (path.withdraw.requiresContact && !path.grant.requiresContact) {
+            findings.push({ ...where, kind: "withdrawal-requires-contact", message: "withdrawing requires contacting a human where granting did not" });
+        }
+        if (path.withdraw.requiresAccount && !path.grant.requiresAccount) {
+            findings.push({ ...where, kind: "withdrawal-requires-account", message: "withdrawing requires an account where granting did not" });
+        }
+    }
+    if (findings.length > 0)
+        return { ok: false, reason: "withdrawal-harder-than-granting", pathsChecked: paths.length, findings };
+    return { ok: true, pathsChecked: paths.length, findings: [] };
+}
+//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAkBH,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAExC,SAAS,iBAAiB,CAAC,CAAgB,EAAE,CAAgB;IAC3D,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,QAAwB,EAAE,EAAU;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,OAAO,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC,IAAI,GAAG,oBAAoB,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAA4C,EAC5C,oBAAmC,EACnC,MAAgC,EAChC,EAAU;IAEV,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,WAAW,CAAC,UAAU,KAAK,UAAU,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC;IAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEzE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9I,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1I,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;IACnE,CAAC;IAED,0BAA0B;IAC1B,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,4BAA4B,EAAE,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IAC1I,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,SAAiB,EACjB,aAAqB,EACrB,MAAsB,EACtB,GAAW;IAEX,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,QAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IACzH,MAAM,WAAW,GACf,MAAM,CAAC,IAAI,KAAK,OAAO;QACrB,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;QAC9F,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;YACtB,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;YAC7F,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;IAE/C,MAAM,UAAU,GAAuB;QACrC,SAAS;QACT,OAAO;QACP,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW;QAC3F,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,GAAG;KAChB,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,SAAiB,EACjB,KAAoB,EACpB,aAA4B,EAC5B,GAAW;IAEX,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,SAAiB,EACjB,KAAoB,EACpB,MAA8C,EAC9C,qBAAoC,EACpC,oBAAmC,EACnC,GAAW;IAEX,OAAO;QACL,SAAS;QACT,OAAO;QACP,KAAK;QACL,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,oBAAoB;QACnC,qBAAqB;QACrB,UAAU,EAAE,GAAG;KAChB,CAAC;AACJ,CAAC;AAoCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAgC,EAChC,aAA4C,EAC5C,KAAsB;IAEtB,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,oBAAoB,EAAE,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACnI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,KAAK,MAAM,YAAY,IAAI,aAAa;QAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,iBAAiB,CAAC;QAE/D,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACnC,8DAA8D;YAC9D,qEAAqE;YACrE,kDAAkD;YAClD,SAAS;QACX,CAAC;QAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,4BAA4B;gBAC9E,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,UAAU;oBACjB,CAAC,CAAC,oCAAoC,MAAM,CAAC,UAAU,6BAA6B,KAAK,CAAC,iBAAiB,wCAAwC;oBACnJ,CAAC,CAAC,oDAAoD;aACzD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,YAAY,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,IAAI,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,SAAS;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,OAAO,EAAE,oEAAoE;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AAiCD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAC3B,YAA4C,EAC5C,MAAmC,EACnC,MAAgC;IAEhC,MAAM,IAAI,GAAG,EAAE,mBAAmB,EAAE,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACxF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC/G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEnG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,KAAK,MAAM,WAAW,IAAI,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,2BAA2B;gBACjC,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,+DAA+D;aACzE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,UAAU,GAAG,2BAA2B,CAAC,WAAW,EAAE,KAAK,CAAC,oBAAoB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9G,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EACL,UAAU,CAAC,MAAM,KAAK,uBAAuB;oBAC3C,CAAC,CAAC,+DAA+D;oBACjE,CAAC,CAAC,mDAAmD;aAC1D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,UAAU,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,8BAA8B;gBAClG,aAAa,EAAE,KAAK,CAAC,aAAa;gBAClC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EACL,UAAU,CAAC,MAAM,KAAK,gBAAgB;oBACpC,CAAC,CAAC,kCAAkC,UAAU,CAAC,SAAS,iCAAiC,WAAW,CAAC,QAAQ,CAAC,IAAI,SAAS;oBAC3H,CAAC,CAAC,iCAAiC,UAAU,CAAC,qBAAqB,CAAC,QAAQ,IAAI,UAAU,CAAC,qBAAqB,CAAC,OAAO,mBAAmB,KAAK,CAAC,oBAAoB,CAAC,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE;aAC3N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC7C,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAgC;IACpE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEzG,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC1H,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,GAAG,KAAK;gBACR,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,qBAAqB,IAAI,CAAC,QAAQ,CAAC,KAAK,+BAA+B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;aACnG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;QAC9I,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC/H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAChE,CAAC"}