@event4u/agent-config 9.25.0 → 9.27.0

package/dist/shared/settingsAsks.js

@@ -0,0 +1,128 @@
+/**
+ * The one-question budget, as a function rather than as a promise.
+ *
+ * Phase 5 of `road-to-zero-ceremony-settings`. The rule
+ * `src/rules/settings-ask-protocol.md` states the budget — at most ONE settings
+ * question per command execution, every further undecided key taking its
+ * conservative default silently and being named in the end-summary. Prose is
+ * where that obligation has to live, because no gate can count the questions in
+ * a chat turn.
+ *
+ * But the *split* is not a judgement call: given the keys an execution needs
+ * decided, which one is asked and what the others resolve to is fully
+ * determined. Leaving that determined part in prose too would mean the roadmap's
+ * own exit criterion — "a planted fixture needing three B decisions asks once,
+ * assumes two conservatively, and lists both in the summary" — had nothing to
+ * run against. So the split is computed here and the rule points at it.
+ *
+ * What this module does NOT do, stated so nobody mistakes it for the fence:
+ * it does not ask, it does not write, and it cannot stop an agent that ignores
+ * it. The write fence is one layer down and is real —
+ * `src/scripts/_cli/cmd_settings_set.ts` and the Fastify settings route both
+ * refuse every C-class key and fail closed on an unreadable class contract.
+ *
+ * Pure — no I/O, no clock, no environment.
+ *
+ * @see src/rules/settings-ask-protocol.md
+ * @see docs/contracts/settings-classes.md
+ */
+import { classOfPath, isConservativeDefault } from './settingsClasses.js';
+/**
+ * The end-summary line for a silently defaulted key.
+ *
+ * `--source manual` and not `jit-answer`: the user did not answer a question, so
+ * stamping the write as a just-in-time answer would record a consent nobody
+ * gave. The provenance vocabulary exists to keep exactly that distinction.
+ */
+export function changeCommand(key) {
+    return `agent-config settings:set ${key} <value> --source manual`;
+}
+/**
+ * Plan one execution's settings asks.
+ *
+ * `needed` is the keys this execution genuinely cannot proceed without, in the
+ * order they became needed — the caller's own ordering is respected because the
+ * first key to actually block the run is the one that earned the question.
+ *
+ * `decided` is every key already settled on any resolution layer. A decided key
+ * is not a candidate: re-asking a settled question is the cheap question the
+ * ask-discipline rules forbid, and it is the single most likely way this budget
+ * gets spent on nothing.
+ *
+ * `defaultOf` supplies the template default. It returns `undefined` for a key
+ * the template does not carry, which is treated as unclassified rather than as
+ * a default of `undefined` — a missing template entry is a defect, not a value.
+ */
+export function planSettingsAsks(needed, classes, defaultOf, decided = new Set(), options = {}) {
+    const plan = { ask: null, silent: [], skipped: [] };
+    const seen = new Set();
+    // Non-TTY / CI / headless: nobody can answer, so the budget is ZERO rather
+    // than one. Every candidate takes its conservative default and the plan
+    // carries no ask — "no questions, ever", as a computed fact rather than as a
+    // promise the caller has to remember. Nothing is written either: this
+    // function never persists, and with no ask there is no `jit-answer` write.
+    const interactive = options.interactive ?? true;
+    for (const key of needed) {
+        // A duplicate in the caller's list must not consume the budget twice.
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        if (decided.has(key)) {
+            plan.skipped.push({ key, reason: 'already-decided' });
+            continue;
+        }
+        const cls = classOfPath(classes, key);
+        if (cls === undefined) {
+            // Unclassified is guarded everywhere else in this system; it is
+            // guarded here too. Never fall back to "probably fine".
+            plan.skipped.push({ key, reason: 'unclassified' });
+            continue;
+        }
+        if (cls === 'A') {
+            plan.skipped.push({ key, reason: 'class-a-never-asked' });
+            continue;
+        }
+        if (cls === 'C') {
+            // A C key set to `ask` still produces a RUNTIME question, but that
+            // answer lasts one run and is never persisted, so it is not this
+            // budget's business. Persisting it stays on the human path.
+            plan.skipped.push({ key, reason: 'class-c-guarded' });
+            continue;
+        }
+        const fallback = defaultOf(key);
+        if (fallback === undefined) {
+            plan.skipped.push({ key, reason: 'unclassified' });
+            continue;
+        }
+        if (interactive && plan.ask === null) {
+            plan.ask = key;
+            continue;
+        }
+        if (!isConservativeDefault(fallback)) {
+            // Taking a permissive value silently would be a decision made in
+            // the user's name — the one outcome the Iron Law names outright.
+            // Surfacing it as skipped forces the caller to deal with it instead
+            // of inheriting a permission nobody granted.
+            plan.skipped.push({ key, reason: 'non-conservative-default' });
+            continue;
+        }
+        plan.silent.push({ key, value: fallback, command: changeCommand(key) });
+    }
+    return plan;
+}
+/**
+ * The end-summary block for a plan, or `null` when nothing was defaulted.
+ *
+ * `null` rather than an empty string so a caller cannot append a heading with no
+ * rows under it. This text rides INSIDE the single end-summary that
+ * `direct-answers` already requires — it is never a second summary.
+ */
+export function silentDefaultsSummary(plan) {
+    if (plan.silent.length === 0) {
+        return null;
+    }
+    const lines = plan.silent.map((s) => `- \`${s.key}\` → ${JSON.stringify(s.value)} (default) · change: \`${s.command}\``);
+    return `Settings resolved without asking this run:\n${lines.join('\n')}`;
+}
+//# sourceMappingURL=settingsAsks.js.map

package/dist/shared/settingsAsks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settingsAsks.js","sourceRoot":"","sources":["../../src/shared/settingsAsks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAsB,MAAM,sBAAsB,CAAC;AA+B9F;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACrC,OAAO,6BAA6B,GAAG,0BAA0B,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAC5B,MAAyB,EACzB,OAA2C,EAC3C,SAAmC,EACnC,UAA+B,IAAI,GAAG,EAAE,EACxC,UAAqC,EAAE;IAEvC,MAAM,IAAI,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IAEhD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACvB,sEAAsE;QACtE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChB,SAAS;QACb,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACtD,SAAS;QACb,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,gEAAgE;YAChE,wDAAwD;YACxD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,SAAS;QACb,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC1D,SAAS;QACb,CAAC;QACD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACd,mEAAmE;YACnE,iEAAiE;YACjE,4DAA4D;YAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACtD,SAAS;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACnD,SAAS;QACb,CAAC;QAED,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;YACf,SAAS;QACb,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,iEAAiE;YACjE,iEAAiE;YACjE,oEAAoE;YACpE,6CAA6C;YAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC/D,SAAS;QACb,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAa;IAC/C,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,OAAO,IAAI,CAC5F,CAAC;IACF,OAAO,+CAA+C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7E,CAAC"}

package/dist/shared/settingsCarveOut.js

@@ -0,0 +1,118 @@
+/**
+ * The always-written carve-out set for the sparse settings file.
+ *
+ * `road-to-zero-ceremony-settings` Phase 3. The user's global settings file
+ * becomes a sparse record of decisions actually made, which is safe only while
+ * *key absent* resolves exactly like *key set to the template default*.
+ *
+ * An audit of every reader found that is NOT universally true. For the keys
+ * below a reader deliberately resolves an absent key to something other than
+ * the template's default, so omitting them from a fresh install's file would
+ * silently change behaviour. They are written explicitly instead, with their
+ * template value, and stamped `package-default` in the provenance sidecar so
+ * the file never claims the user decided them.
+ *
+ * This is the blocker's "carved out" branch. The alternative branch — "fixed at
+ * its reader" — was rejected for the `projection.*` family because the
+ * divergence there is the documented upgrade-safety contract
+ * (`agent-settings.template.yml`: *"a missing key also still means legacy-all,
+ * so only fresh installs get the scoped default"*). Changing those readers
+ * would flip existing 5.x installs from `legacy-all` to `scoped`, which is the
+ * silent narrowing the contract exists to prevent.
+ *
+ * Pure module — no I/O. The VALUES are not duplicated here; only the key paths
+ * and the reason. The emitter reads each value out of the template, so this
+ * list cannot drift from the defaults it is protecting.
+ *
+ * @see docs/contracts/settings-classes.md
+ */
+export const SETTINGS_CARVE_OUT = [
+    {
+        key: 'projection.mode',
+        reader: 'src/scripts/install.ts:3409 _resolve_scoped_projection',
+        absentResolvesTo: 'legacy-all',
+        reason: 'The template fallback applies only when NO global settings file exists. '
+            + 'Once a file exists, an absent key means legacy-all by documented contract, '
+            + 'so an existing install is never silently narrowed on upgrade.',
+    },
+    {
+        key: 'projection.rule_workspaces',
+        reader: 'src/install/rule_scope.ts:96 ruleScopeFromSettings',
+        absentResolvesTo: 'null — LEGACY_ALL, i.e. every rule ships including maintainer-only ones',
+        reason: 'Same upgrade contract as projection.mode, and the failure is louder: '
+            + 'an absent list widens the projection instead of narrowing it.',
+    },
+    {
+        key: 'subagents.auto',
+        reader: 'src/scripts/routing_doctor.ts:206',
+        absentResolvesTo: 'ask',
+        reason: 'The reader falls back to `ask` while the template ships `on`. Carved out '
+            + 'rather than fixed at the reader because the doctor reports what the '
+            + 'RESOLVED configuration is; changing its fallback would make the report '
+            + 'disagree with what the other readers actually do.',
+    },
+    {
+        key: 'discipline_profile',
+        reader: 'work_engine/_lib/agent_settings.ts:1263',
+        absentResolvesTo: 'essential, unconditionally',
+        reason: 'The template ships `auto`, which resolves to `off` on any measured-null model, '
+            + 'any non-Claude host, and any host exposing no model id. Absent skips that '
+            + 'resolution entirely and loads the essential tier everywhere.',
+    },
+    {
+        key: 'chat_history.frequency',
+        reader: 'src/scripts/chat_history.ts:1140',
+        absentResolvesTo: 'per_phase',
+        reason: 'Canonical substitution is `per_turn`. Absent gives coarser capture than the '
+            + 'shipped default — an audit-thinning change, which the class contract\'s own '
+            + 'test 8 (what can the attacker HIDE) names as the severe direction.',
+    },
+    {
+        key: 'profile.id',
+        reader: 'src/scripts/config/profiles.ts:221 resolve_profile',
+        absentResolvesTo: 'the id `developer`, but a DEGRADED profile — packs: [], personas: [], hints: []',
+        reason: 'Exactly the projection.mode shape: the template default is honoured only when '
+            + 'no settings file exists. With a file present the id resolves but its profile '
+            + 'body does not load, so the install silently loses every pack and persona.',
+    },
+    {
+        key: 'quality.local_auto_run',
+        reader: 'src/scripts/lint_roadmap_ci_steps.ts:106',
+        absentResolvesTo: 'true — which DISABLES the CI-step gate',
+        reason: 'Inverted polarity, and the most dangerous row in the set: the template ships '
+            + '`false`, which ARMS the gate. Omitting the key would disarm a quality gate '
+            + 'for every fresh install while the reference page says it is on.',
+    },
+    {
+        key: 'onboarding.onboarded',
+        reader: 'src/scripts/onboarding_gate_hook.ts:99',
+        absentResolvesTo: 'gate skipped, as if onboarding had already completed',
+        reason: 'Absent behaves like `onboarded: true`, not like the template default `false`. '
+            + 'Omitting it would skip the onboarding gate on precisely the fresh installs '
+            + 'the gate exists for.',
+    },
+    {
+        key: 'chat_history.enabled',
+        reader: 'src/scripts/chat_history.ts:1025 _read_chat_history_enabled',
+        absentResolvesTo: 'false',
+        reason: 'The reader falls back to false while the template ships true. This one is '
+            + 'privacy-shaped: fixing the reader would start recording history for every '
+            + 'install whose file lacks the key. Writing it explicitly keeps the decision '
+            + 'visible in the file the user can read.',
+    },
+];
+/** Just the paths — the emitter iterates these against the template. */
+export function carveOutKeys() {
+    return SETTINGS_CARVE_OUT.map((c) => c.key);
+}
+/**
+ * `projection.*` is additionally stripped from the user-global layer by
+ * `load_agent_settings`'s `MERGEABLE_KEYS` whitelist, so `_globalRuleScope`
+ * (`src/server/routes/install.ts:234`) resolves LEGACY_ALL whether or not the
+ * key is written. That is a pre-existing defect, independent of sparseness —
+ * widening the whitelist requires an ADR, per its own comment — and the
+ * carve-out neither causes nor fixes it. Recorded so the next reader of this
+ * module does not mistake the carve-out for a fix.
+ */
+export const KNOWN_UNFIXED_BY_CARVE_OUT = 'src/server/routes/install.ts:234 _globalRuleScope — MERGEABLE_KEYS strips projection.*; needs an ADR.';
+//# sourceMappingURL=settingsCarveOut.js.map

package/dist/shared/settingsCarveOut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settingsCarveOut.js","sourceRoot":"","sources":["../../src/shared/settingsCarveOut.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAcH,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACtD;QACI,GAAG,EAAE,iBAAiB;QACtB,MAAM,EAAE,wDAAwD;QAChE,gBAAgB,EAAE,YAAY;QAC9B,MAAM,EACF,0EAA0E;cACxE,6EAA6E;cAC7E,+DAA+D;KACxE;IACD;QACI,GAAG,EAAE,4BAA4B;QACjC,MAAM,EAAE,oDAAoD;QAC5D,gBAAgB,EAAE,yEAAyE;QAC3F,MAAM,EACF,uEAAuE;cACrE,+DAA+D;KACxE;IACD;QACI,GAAG,EAAE,gBAAgB;QACrB,MAAM,EAAE,mCAAmC;QAC3C,gBAAgB,EAAE,KAAK;QACvB,MAAM,EACF,2EAA2E;cACzE,sEAAsE;cACtE,yEAAyE;cACzE,mDAAmD;KAC5D;IACD;QACI,GAAG,EAAE,oBAAoB;QACzB,MAAM,EAAE,yCAAyC;QACjD,gBAAgB,EAAE,4BAA4B;QAC9C,MAAM,EACF,iFAAiF;cAC/E,4EAA4E;cAC5E,8DAA8D;KACvE;IACD;QACI,GAAG,EAAE,wBAAwB;QAC7B,MAAM,EAAE,kCAAkC;QAC1C,gBAAgB,EAAE,WAAW;QAC7B,MAAM,EACF,8EAA8E;cAC5E,8EAA8E;cAC9E,oEAAoE;KAC7E;IACD;QACI,GAAG,EAAE,YAAY;QACjB,MAAM,EAAE,oDAAoD;QAC5D,gBAAgB,EACZ,iFAAiF;QACrF,MAAM,EACF,gFAAgF;cAC9E,+EAA+E;cAC/E,2EAA2E;KACpF;IACD;QACI,GAAG,EAAE,wBAAwB;QAC7B,MAAM,EAAE,0CAA0C;QAClD,gBAAgB,EAAE,wCAAwC;QAC1D,MAAM,EACF,+EAA+E;cAC7E,6EAA6E;cAC7E,iEAAiE;KAC1E;IACD;QACI,GAAG,EAAE,sBAAsB;QAC3B,MAAM,EAAE,wCAAwC;QAChD,gBAAgB,EAAE,sDAAsD;QACxE,MAAM,EACF,gFAAgF;cAC9E,6EAA6E;cAC7E,sBAAsB;KAC/B;IACD;QACI,GAAG,EAAE,sBAAsB;QAC3B,MAAM,EAAE,6DAA6D;QACrE,gBAAgB,EAAE,OAAO;QACzB,MAAM,EACF,4EAA4E;cAC1E,4EAA4E;cAC5E,6EAA6E;cAC7E,wCAAwC;KACjD;CACJ,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,YAAY;IACxB,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACnC,uGAAuG,CAAC"}

package/dist/shared/settingsConsent.js

@@ -0,0 +1,93 @@
+/**
+ * Is a permissive B-class value a RECORDED CONSENT, or just a value?
+ *
+ * Phase 5 of `road-to-zero-ceremony-settings`, and the answer to that
+ * roadmap's Risk 3 — *"the provenance stamp becomes decoration; an unread stamp
+ * is cost with no return"*. Before this module the sidecar
+ * `settings/.agent-settings.provenance.json` was written by `settings:set` and
+ * read by exactly one caller, the GUI, to **display** it. Nothing decided
+ * anything on it. This is the reader that makes it load-bearing.
+ *
+ * The distinction it draws, which a bare value cannot: `true` that a human chose
+ * and `true` that the machine inferred are the same byte and are not the same
+ * permission. `auto-detected` is the provenance a machine writes about itself —
+ * a locale, an installed binary, a detected host. Letting it grant a consent
+ * would mean the agent could arrive at its own permission by observing the
+ * world, which is the confused-deputy shape in miniature.
+ *
+ * Modelled on `src/scripts/hooks/block_unauthorized_git.ts`: answer from a
+ * recorded fact rather than from the model's recollection, and treat a missing
+ * record as NOT granted rather than as probably-fine.
+ *
+ * WHAT THIS IS NOT. It is not a hook and it does not intercept anything. No
+ * B-class key currently gates an action through a guard — the two that gate
+ * behaviour at all (`personal.open_edited_files`, `memory.learn_on_session_end`)
+ * are read as values by the installer, the wizard and one session_end concern,
+ * and the *action* they govern is prose. So the enforcement gradient is honest
+ * and steep: this function is deterministic, the obligation to call it is
+ * model-carried, and on a prose-only host ask-once can degrade to ask-never.
+ *
+ * Pure — no I/O. Callers supply the value and the sidecar entry.
+ *
+ * @see src/rules/settings-ask-protocol.md
+ * @see docs/contracts/settings-classes.md
+ */
+import { isConservativeDefault } from './settingsClasses.js';
+/**
+ * The sources that can carry a human decision.
+ *
+ * `jit-answer` is a question the user answered. `gui` is a human at the settings
+ * editor. `manual` is a hand-edit or an explicit CLI write on the user's
+ * instruction. `auto-detected` is excluded on purpose — see the module header.
+ */
+const HUMAN_SOURCES = ['jit-answer', 'gui', 'manual'];
+/**
+ * The verdict for one consent-gated action.
+ *
+ * Order matters: class first (a C key never reaches a consent question at all),
+ * then the value (conservative means no, regardless of provenance), then the
+ * record.
+ */
+export function consentVerdict(query) {
+    if (query.cls !== 'B') {
+        return 'not-a-consent-key';
+    }
+    if (isConservativeDefault(query.value)) {
+        return 'withheld-default';
+    }
+    if (query.handEdited === true) {
+        return 'granted';
+    }
+    if (query.source === undefined) {
+        return 'withheld-unrecorded';
+    }
+    if (!HUMAN_SOURCES.includes(query.source)) {
+        return 'withheld-machine-inferred';
+    }
+    return 'granted';
+}
+/** `true` only for `granted` — every other verdict withholds. */
+export function consentGranted(query) {
+    return consentVerdict(query) === 'granted';
+}
+/**
+ * One line explaining a withheld verdict, for the surface that refused.
+ *
+ * `null` for `granted`, so a caller cannot accidentally print a refusal reason
+ * on the allow path.
+ */
+export function withheldReason(verdict, key) {
+    switch (verdict) {
+        case 'granted':
+            return null;
+        case 'withheld-default':
+            return `${key} is at its conservative default — absent and no are the same answer.`;
+        case 'withheld-unrecorded':
+            return `${key} permits this, but nothing records who decided it. Ask, or set it via the GUI.`;
+        case 'withheld-machine-inferred':
+            return `${key} was auto-detected, not decided. A machine inference is not a consent.`;
+        case 'not-a-consent-key':
+            return `${key} is not a class-B consent key — this gate does not apply to it.`;
+    }
+}
+//# sourceMappingURL=settingsConsent.js.map

package/dist/shared/settingsConsent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settingsConsent.js","sourceRoot":"","sources":["../../src/shared/settingsConsent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,qBAAqB,EAAsB,MAAM,sBAAsB,CAAC;AAKjF;;;;;;GAMG;AACH,MAAM,aAAa,GAA6B,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAsChF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB;IAC9C,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,mBAAmB,CAAC;IAC/B,CAAC;IACD,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,kBAAkB,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,OAAO,2BAA2B,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,KAAmB;IAC9C,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB,EAAE,GAAW;IAC/D,QAAQ,OAAO,EAAE,CAAC;QACd,KAAK,SAAS;YACV,OAAO,IAAI,CAAC;QAChB,KAAK,kBAAkB;YACnB,OAAO,GAAG,GAAG,sEAAsE,CAAC;QACxF,KAAK,qBAAqB;YACtB,OAAO,GAAG,GAAG,gFAAgF,CAAC;QAClG,KAAK,2BAA2B;YAC5B,OAAO,GAAG,GAAG,wEAAwE,CAAC;QAC1F,KAAK,mBAAmB;YACpB,OAAO,GAAG,GAAG,iEAAiE,CAAC;IACvF,CAAC;AACL,CAAC"}

package/dist/shared/settingsSurface.js

@@ -31,7 +31,13 @@ function unwrapRef(root) {
 export function flattenSurface(schema, version) {
     const entries = {};
     const walk = (node, prefix) => {
-        if (node.type === 'object' && node.properties !== undefined) {
+        // `properties: {}` — a free-form map such as `z.object({}).passthrough()` —
+        // is a LEAF, per this function's own contract above. Recursing on the
+        // mere presence of the key walked zero children and emitted nothing, so
+        // the key vanished from the surface: `subagents.host_capabilities` was
+        // classified in the settings contract, present in the template, and
+        // absent from every snapshot and upgrade delta.
+        if (node.type === 'object' && node.properties !== undefined && Object.keys(node.properties).length > 0) {
             for (const key of Object.keys(node.properties).sort()) {
                 const child = node.properties[key];
                 walk(child, prefix === '' ? key : `${prefix}.${key}`);

package/dist/shared/settingsSurface.js.map

@@ -1 +1 @@
-{"version":3,"file":"settingsSurface.js","sourceRoot":"","sources":["../../src/shared/settingsSurface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAsDH,SAAS,SAAS,CAAC,IAAoB;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,OAAe;IAClE,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,MAAc,EAAQ,EAAE;QACxD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAmB,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACX,CAAC;QACD,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAuB,EAAE,CAAuB;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAqB,EAAE,IAAqB;IAC5E,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAiB,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7C,SAAS;QACb,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAiB,CAAC;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAiB,EAAE,CAAC,CAAC;QACnF,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC;AAeD,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,YAAkC;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAA+B,CAAC;YAAE,OAAO,UAAU,CAAC;QAClG,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,YAAY,KAAK,SAAS;eAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"settingsSurface.js","sourceRoot":"","sources":["../../src/shared/settingsSurface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAsDH,SAAS,SAAS,CAAC,IAAoB;IACnC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAsB,EAAE,OAAe;IAClE,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,IAAoB,EAAE,MAAc,EAAQ,EAAE;QACxD,4EAA4E;QAC5E,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAmB,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO;QACX,CAAC;QACD,IAAI,MAAM,KAAK,EAAE;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAiB,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAuB,EAAE,CAAuB;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAqB,EAAE,IAAqB;IAC5E,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEnD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAiB,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7C,SAAS;QACb,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAiB,CAAC;QAC5C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAiB,EAAE,CAAC,CAAC;QACnF,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;AAC3E,CAAC;AAeD,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,YAAkC;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAA+B,CAAC;YAAE,OAAO,UAAU,CAAC;QAClG,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,eAAe,GAAG,YAAY,KAAK,SAAS;eAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,GAAG,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}