@iflow-mcp/jkheadley-instar 0.26.2

package/dist/core/DispatchScopeEnforcer.js

@@ -0,0 +1,173 @@
+/**
+ * DispatchScopeEnforcer — scope limits for dispatch execution.
+ *
+ * Part of Phase 4 of the Adaptive Autonomy System (Improvement 3).
+ *
+ * Dispatch types have different scope tiers controlling what they can modify:
+ *   - lesson/strategy: Context only (always eligible for auto-execute)
+ *   - configuration: Config files only (when profile >= collaborative)
+ *   - action: Project files + shell (when profile >= autonomous)
+ *   - behavioral: Agent behavior (CLAUDE.md, hooks) — always requires human
+ *   - security: Security settings — always requires human
+ *
+ * At collaborative profile, action dispatches queue for approval with summary.
+ * At autonomous profile, they auto-execute with Telegram notification.
+ */
+// ── Scope Tier Mapping ───────────────────────────────────────────────
+/** Map dispatch type to its scope tier */
+const TYPE_TO_SCOPE = {
+    lesson: 'context',
+    strategy: 'context',
+    configuration: 'config',
+    action: 'project',
+    behavioral: 'behavior',
+    security: 'security',
+};
+/** Minimum autonomy profile required for each scope tier */
+const SCOPE_MIN_PROFILE = {
+    context: 'cautious', // Always eligible
+    config: 'collaborative', // Needs collaborative+
+    project: 'autonomous', // Needs autonomous for auto-execute
+    behavior: 'never', // Always human
+    security: 'never', // Always human
+};
+/** Profile order for comparison */
+const PROFILE_ORDER = {
+    cautious: 0,
+    supervised: 1,
+    collaborative: 2,
+    autonomous: 3,
+};
+/** Config file patterns — paths allowed for 'config' scope */
+const CONFIG_PATH_PATTERNS = [
+    /^\.instar\/config\.json$/,
+    /^\.instar\/.*\.json$/,
+    /^\.env(\..+)?$/,
+    /^config\//,
+];
+/** Behavioral file patterns — paths that always require human approval */
+const BEHAVIORAL_PATH_PATTERNS = [
+    /CLAUDE\.md$/i,
+    /\.instar\/hooks\//,
+    /\.claude\//,
+];
+// ── Enforcer ──────────────────────────────────────────────────────────
+export class DispatchScopeEnforcer {
+    /**
+     * Check whether a dispatch is allowed to execute at the given autonomy profile.
+     */
+    checkScope(dispatch, profile) {
+        const tier = TYPE_TO_SCOPE[dispatch.type] ?? 'security';
+        const minProfile = SCOPE_MIN_PROFILE[tier];
+        // Hard floors: behavior and security always need human
+        if (minProfile === 'never') {
+            return {
+                allowed: false,
+                tier,
+                reason: `${dispatch.type} dispatches always require human approval`,
+                requiresApproval: true,
+            };
+        }
+        const profileLevel = PROFILE_ORDER[profile];
+        const requiredLevel = PROFILE_ORDER[minProfile];
+        // Action dispatches at collaborative queue for approval (special case)
+        if (tier === 'project' && profile === 'collaborative') {
+            return {
+                allowed: false,
+                tier,
+                reason: 'action dispatches at collaborative profile queue for human approval',
+                requiresApproval: true,
+            };
+        }
+        if (profileLevel < requiredLevel) {
+            return {
+                allowed: false,
+                tier,
+                reason: `${dispatch.type} dispatches require ${minProfile} profile or higher (current: ${profile})`,
+                requiresApproval: true,
+            };
+        }
+        return {
+            allowed: true,
+            tier,
+            reason: `${dispatch.type} dispatch allowed at ${profile} profile`,
+            requiresApproval: false,
+        };
+    }
+    /**
+     * Validate that action steps stay within their scope tier.
+     * Returns invalid steps if any escape the allowed scope.
+     */
+    validateSteps(steps, tier) {
+        const violations = [];
+        for (let i = 0; i < steps.length; i++) {
+            const step = steps[i];
+            const violation = this.checkStepScope(step, tier, i);
+            if (violation) {
+                violations.push(violation);
+            }
+        }
+        return {
+            valid: violations.length === 0,
+            violations,
+        };
+    }
+    /**
+     * Get the scope tier for a dispatch type.
+     */
+    getScopeTier(type) {
+        return TYPE_TO_SCOPE[type] ?? 'security';
+    }
+    /**
+     * Check if a file path is within config scope.
+     */
+    isConfigPath(filePath) {
+        return CONFIG_PATH_PATTERNS.some(pattern => pattern.test(filePath));
+    }
+    /**
+     * Check if a file path is a behavioral file (always requires human).
+     */
+    isBehavioralPath(filePath) {
+        return BEHAVIORAL_PATH_PATTERNS.some(pattern => pattern.test(filePath));
+    }
+    // ── Private ─────────────────────────────────────────────────────────
+    checkStepScope(step, tier, index) {
+        // Context-only scope: no file or shell operations allowed
+        if (tier === 'context') {
+            if (step.type === 'shell' || step.type === 'file_write' || step.type === 'file_patch') {
+                return `Step ${index}: ${step.type} not allowed in context-only scope`;
+            }
+            if (step.type === 'config_merge') {
+                return `Step ${index}: config_merge not allowed in context-only scope`;
+            }
+            if (step.type === 'agentic') {
+                return `Step ${index}: agentic execution not allowed in context-only scope`;
+            }
+        }
+        // Config scope: only config file operations
+        if (tier === 'config') {
+            if (step.type === 'shell') {
+                return `Step ${index}: shell commands not allowed in config scope`;
+            }
+            if (step.type === 'agentic') {
+                return `Step ${index}: agentic execution not allowed in config scope`;
+            }
+            if (step.path) {
+                if (this.isBehavioralPath(step.path)) {
+                    return `Step ${index}: cannot modify behavioral file ${step.path} in config scope`;
+                }
+                if (!this.isConfigPath(step.path)) {
+                    return `Step ${index}: path ${step.path} is outside config scope`;
+                }
+            }
+        }
+        // Project scope: all operations allowed except behavioral files
+        if (tier === 'project') {
+            if (step.path && this.isBehavioralPath(step.path)) {
+                return `Step ${index}: cannot modify behavioral file ${step.path} — requires human approval`;
+            }
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=DispatchScopeEnforcer.js.map

package/dist/core/DispatchScopeEnforcer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DispatchScopeEnforcer.js","sourceRoot":"","sources":["../../src/core/DispatchScopeEnforcer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAqBH,wEAAwE;AAExE,0CAA0C;AAC1C,MAAM,aAAa,GAAgD;IACjE,MAAM,EAAE,SAAS;IACjB,QAAQ,EAAE,SAAS;IACnB,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,UAAU;IACtB,QAAQ,EAAE,UAAU;CACrB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,iBAAiB,GAA8D;IACnF,OAAO,EAAE,UAAU,EAAS,kBAAkB;IAC9C,MAAM,EAAE,eAAe,EAAK,uBAAuB;IACnD,OAAO,EAAE,YAAY,EAAO,oCAAoC;IAChE,QAAQ,EAAE,OAAO,EAAW,eAAe;IAC3C,QAAQ,EAAE,OAAO,EAAW,eAAe;CAC5C,CAAC;AAEF,mCAAmC;AACnC,MAAM,aAAa,GAAyC;IAC1D,QAAQ,EAAE,CAAC;IACX,UAAU,EAAE,CAAC;IACb,aAAa,EAAE,CAAC;IAChB,UAAU,EAAE,CAAC;CACd,CAAC;AAEF,8DAA8D;AAC9D,MAAM,oBAAoB,GAAG;IAC3B,0BAA0B;IAC1B,sBAAsB;IACtB,gBAAgB;IAChB,WAAW;CACZ,CAAC;AAEF,0EAA0E;AAC1E,MAAM,wBAAwB,GAAG;IAC/B,cAAc;IACd,mBAAmB;IACnB,YAAY;CACb,CAAC;AAEF,yEAAyE;AAEzE,MAAM,OAAO,qBAAqB;IAChC;;OAEG;IACH,UAAU,CACR,QAAkB,EAClB,OAA6B;QAE7B,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QACxD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE3C,uDAAuD;QACvD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI;gBACJ,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,2CAA2C;gBACnE,gBAAgB,EAAE,IAAI;aACvB,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAEhD,uEAAuE;QACvE,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI;gBACJ,MAAM,EAAE,qEAAqE;gBAC7E,gBAAgB,EAAE,IAAI;aACvB,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,GAAG,aAAa,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI;gBACJ,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,uBAAuB,UAAU,gCAAgC,OAAO,GAAG;gBACnG,gBAAgB,EAAE,IAAI;aACvB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,wBAAwB,OAAO,UAAU;YACjE,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CACX,KAAmB,EACnB,IAAuB;QAEvB,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACrD,IAAI,SAAS,EAAE,CAAC;gBACd,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;YAC9B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAsB;QACjC,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,QAAgB;QAC3B,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,uEAAuE;IAE/D,cAAc,CACpB,IAAgB,EAChB,IAAuB,EACvB,KAAa;QAEb,0DAA0D;QAC1D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACtF,OAAO,QAAQ,KAAK,KAAK,IAAI,CAAC,IAAI,oCAAoC,CAAC;YACzE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACjC,OAAO,QAAQ,KAAK,kDAAkD,CAAC;YACzE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,QAAQ,KAAK,uDAAuD,CAAC;YAC9E,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,OAAO,QAAQ,KAAK,8CAA8C,CAAC;YACrE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,QAAQ,KAAK,iDAAiD,CAAC;YACxE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrC,OAAO,QAAQ,KAAK,mCAAmC,IAAI,CAAC,IAAI,kBAAkB,CAAC;gBACrF,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,IAAI,0BAA0B,CAAC;gBACpE,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,OAAO,QAAQ,KAAK,mCAAmC,IAAI,CAAC,IAAI,4BAA4B,CAAC;YAC/F,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/core/DispatchVerifier.d.ts

@@ -0,0 +1,76 @@
+/**
+ * DispatchVerifier — Ed25519 dispatch origin verification.
+ *
+ * Verifies that dispatches came from a trusted Portal instance using
+ * asymmetric cryptographic signatures. Portal signs with its private key;
+ * agents verify with the public key.
+ *
+ * Why asymmetric, not HMAC: HMAC uses a shared secret — if any agent
+ * is compromised, the attacker can forge dispatches for the entire network.
+ * With Ed25519, agents can verify but never forge.
+ *
+ * Features:
+ * - Ed25519 signature verification
+ * - Replay prevention via seen-dispatch-ID cache (TTL: 24 hours)
+ * - Expiry checking
+ * - Key rotation support via keyId
+ * - Canonical payload serialization
+ */
+import type { Dispatch } from './DispatchManager.js';
+export interface SignedDispatch extends Dispatch {
+    /** Ed25519 signature of canonical dispatch payload */
+    signature: string;
+    /** Timestamp of signing */
+    signedAt: string;
+    /** Expiry — dispatches older than this are rejected */
+    expiresAt: string;
+    /** Signing key ID — supports key rotation */
+    keyId: string;
+}
+export interface VerificationResult {
+    verified: boolean;
+    reason: string;
+}
+export interface DispatchVerifierConfig {
+    /** Map of keyId → PEM-encoded Ed25519 public key */
+    trustedKeys: Record<string, string>;
+    /** Replay cache TTL in ms (default: 24 hours) */
+    replayCacheTtlMs?: number;
+    /** Whether verification is required (default: false for gradual rollout) */
+    required?: boolean;
+}
+export declare class DispatchVerifier {
+    private trustedKeys;
+    private replayCacheTtlMs;
+    private required;
+    private seenIds;
+    constructor(config: DispatchVerifierConfig);
+    /**
+     * Verify a dispatch's origin and integrity.
+     */
+    verify(dispatch: Dispatch): VerificationResult;
+    /**
+     * Build the canonical signing payload for a dispatch.
+     * Keys sorted alphabetically for deterministic serialization.
+     */
+    buildCanonicalPayload(dispatch: Dispatch, signedAt: string, expiresAt: string): string;
+    /**
+     * Check if a dispatch ID has been seen before (replay prevention).
+     */
+    isReplay(dispatchId: string): boolean;
+    /**
+     * Add a trusted key. Supports runtime key rotation.
+     */
+    addTrustedKey(keyId: string, publicKeyPem: string): void;
+    /**
+     * Remove a trusted key.
+     */
+    removeTrustedKey(keyId: string): void;
+    /**
+     * Get the number of trusted keys.
+     */
+    get trustedKeyCount(): number;
+    private markSeen;
+    private cleanReplayCache;
+}
+//# sourceMappingURL=DispatchVerifier.d.ts.map

package/dist/core/DispatchVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DispatchVerifier.d.ts","sourceRoot":"","sources":["../../src/core/DispatchVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,WAAW,cAAe,SAAQ,QAAQ;IAC9C,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,WAAW,CAAyB;IAC5C,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAU;IAC1B,OAAO,CAAC,OAAO,CAAkC;gBAErC,MAAM,EAAE,sBAAsB;IAM1C;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,QAAQ,GAAG,kBAAkB;IAuD9C;;;OAGG;IACH,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAatF;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAKrC;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAIxD;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIrC;;OAEG;IACH,IAAI,eAAe,IAAI,MAAM,CAE5B;IAID,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gBAAgB;CAQzB"}

package/dist/core/DispatchVerifier.js

@@ -0,0 +1,128 @@
+/**
+ * DispatchVerifier — Ed25519 dispatch origin verification.
+ *
+ * Verifies that dispatches came from a trusted Portal instance using
+ * asymmetric cryptographic signatures. Portal signs with its private key;
+ * agents verify with the public key.
+ *
+ * Why asymmetric, not HMAC: HMAC uses a shared secret — if any agent
+ * is compromised, the attacker can forge dispatches for the entire network.
+ * With Ed25519, agents can verify but never forge.
+ *
+ * Features:
+ * - Ed25519 signature verification
+ * - Replay prevention via seen-dispatch-ID cache (TTL: 24 hours)
+ * - Expiry checking
+ * - Key rotation support via keyId
+ * - Canonical payload serialization
+ */
+import crypto from 'node:crypto';
+export class DispatchVerifier {
+    trustedKeys;
+    replayCacheTtlMs;
+    required;
+    seenIds = new Map(); // dispatchId → timestamp seen
+    constructor(config) {
+        this.trustedKeys = config.trustedKeys;
+        this.replayCacheTtlMs = config.replayCacheTtlMs ?? 24 * 60 * 60 * 1000;
+        this.required = config.required ?? false;
+    }
+    /**
+     * Verify a dispatch's origin and integrity.
+     */
+    verify(dispatch) {
+        const signed = dispatch;
+        // Check if dispatch has signature fields
+        if (!signed.signature || !signed.signedAt || !signed.expiresAt || !signed.keyId) {
+            if (this.required) {
+                return { verified: false, reason: 'Dispatch is unsigned and verification is required' };
+            }
+            // Unsigned dispatches pass when verification is not required (gradual rollout)
+            return { verified: true, reason: 'Unsigned dispatch accepted (verification not required)' };
+        }
+        // Check replay
+        if (this.isReplay(dispatch.dispatchId)) {
+            return { verified: false, reason: `Replay detected: dispatch ${dispatch.dispatchId} already seen` };
+        }
+        // Check expiry
+        const now = new Date();
+        const expiresAt = new Date(signed.expiresAt);
+        if (isNaN(expiresAt.getTime()) || now > expiresAt) {
+            return { verified: false, reason: `Dispatch expired at ${signed.expiresAt}` };
+        }
+        // Look up the signing key
+        const publicKeyPem = this.trustedKeys[signed.keyId];
+        if (!publicKeyPem) {
+            return { verified: false, reason: `Unknown signing key ID: ${signed.keyId}` };
+        }
+        // Build canonical payload
+        const canonicalPayload = this.buildCanonicalPayload(dispatch, signed.signedAt, signed.expiresAt);
+        // Verify Ed25519 signature
+        try {
+            const isValid = crypto.verify(null, Buffer.from(canonicalPayload), publicKeyPem, Buffer.from(signed.signature, 'base64'));
+            if (!isValid) {
+                return { verified: false, reason: 'Invalid signature' };
+            }
+        }
+        catch (err) {
+            return { verified: false, reason: `Signature verification error: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        // Mark as seen (replay prevention)
+        this.markSeen(dispatch.dispatchId);
+        return { verified: true, reason: 'Signature verified' };
+    }
+    /**
+     * Build the canonical signing payload for a dispatch.
+     * Keys sorted alphabetically for deterministic serialization.
+     */
+    buildCanonicalPayload(dispatch, signedAt, expiresAt) {
+        const payload = {
+            content: dispatch.content,
+            dispatchId: dispatch.dispatchId,
+            expiresAt,
+            priority: dispatch.priority,
+            signedAt,
+            title: dispatch.title,
+            type: dispatch.type,
+        };
+        return JSON.stringify(payload);
+    }
+    /**
+     * Check if a dispatch ID has been seen before (replay prevention).
+     */
+    isReplay(dispatchId) {
+        this.cleanReplayCache();
+        return this.seenIds.has(dispatchId);
+    }
+    /**
+     * Add a trusted key. Supports runtime key rotation.
+     */
+    addTrustedKey(keyId, publicKeyPem) {
+        this.trustedKeys[keyId] = publicKeyPem;
+    }
+    /**
+     * Remove a trusted key.
+     */
+    removeTrustedKey(keyId) {
+        delete this.trustedKeys[keyId];
+    }
+    /**
+     * Get the number of trusted keys.
+     */
+    get trustedKeyCount() {
+        return Object.keys(this.trustedKeys).length;
+    }
+    // ── Private ───────────────────────────────────────────────────────
+    markSeen(dispatchId) {
+        this.seenIds.set(dispatchId, Date.now());
+    }
+    cleanReplayCache() {
+        const cutoff = Date.now() - this.replayCacheTtlMs;
+        for (const [id, timestamp] of this.seenIds) {
+            if (timestamp < cutoff) {
+                this.seenIds.delete(id);
+            }
+        }
+    }
+}
+//# sourceMappingURL=DispatchVerifier.js.map

package/dist/core/DispatchVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DispatchVerifier.js","sourceRoot":"","sources":["../../src/core/DispatchVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AA4BjC,MAAM,OAAO,gBAAgB;IACnB,WAAW,CAAyB;IACpC,gBAAgB,CAAS;IACzB,QAAQ,CAAU;IAClB,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,8BAA8B;IAEhF,YAAY,MAA8B;QACxC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAkB;QACvB,MAAM,MAAM,GAAG,QAAmC,CAAC;QAEnD,yCAAyC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAChF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAC9F,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,QAAQ,CAAC,UAAU,eAAe,EAAE,CAAC;QACtG,CAAC;QAED,eAAe;QACf,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAU,CAAC,CAAC;QAC9C,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,GAAG,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;QAChF,CAAC;QAED,0BAA0B;QAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC;QACrD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAChF,CAAC;QAED,0BAA0B;QAC1B,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAS,EAAE,MAAM,CAAC,SAAU,CAAC,CAAC;QAEnG,2BAA2B;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAC3B,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAC7B,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAU,EAAE,QAAQ,CAAC,CACzC,CAAC;YAEF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC1H,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEnC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,qBAAqB,CAAC,QAAkB,EAAE,QAAgB,EAAE,SAAiB;QAC3E,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS;YACT,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,UAAkB;QACzB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa,EAAE,YAAoB;QAC/C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAa;QAC5B,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,IAAI,eAAe;QACjB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,qEAAqE;IAE7D,QAAQ,CAAC,UAAkB;QACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAEO,gBAAgB;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAClD,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,SAAS,GAAG,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/core/EvolutionManager.d.ts

@@ -0,0 +1,223 @@
+/**
+ * Evolution Manager — the feedback loop that turns running into evolving.
+ *
+ * Four subsystems, one principle: every interaction is an opportunity
+ * to improve. Not during batch reflection hours later, but at the
+ * moment the insight is freshest.
+ *
+ * Subsystems:
+ * 1. Evolution Queue — staged self-improvement proposals
+ * 2. Learning Registry — structured, searchable insights
+ * 3. Capability Gap Tracker — "what am I missing?"
+ * 4. Action Queue — commitment tracking with stale detection
+ *
+ * Born from Portal's engagement pipeline (Steps 8-11) and proven
+ * across 100+ evolution proposals and 10 platform engagement skills.
+ */
+import type { EvolutionProposal, EvolutionType, EvolutionStatus, LearningEntry, LearningSource, CapabilityGap, GapCategory, ActionItem, EvolutionManagerConfig } from './types.js';
+import type { TrustElevationTracker } from './TrustElevationTracker.js';
+import type { AutonomousEvolution, ReviewResult } from './AutonomousEvolution.js';
+import type { AutonomyProfileManager } from './AutonomyProfileManager.js';
+interface EvolutionState {
+    proposals: EvolutionProposal[];
+    stats: {
+        totalProposals: number;
+        byStatus: Record<string, number>;
+        byType: Record<string, number>;
+        lastUpdated: string;
+    };
+}
+interface LearningState {
+    learnings: LearningEntry[];
+    stats: {
+        totalLearnings: number;
+        applied: number;
+        pending: number;
+        byCategory: Record<string, number>;
+        lastUpdated: string;
+    };
+}
+interface GapState {
+    gaps: CapabilityGap[];
+    stats: {
+        totalGaps: number;
+        bySeverity: Record<string, number>;
+        byCategory: Record<string, number>;
+        addressed: number;
+        lastUpdated: string;
+    };
+}
+interface ActionState {
+    actions: ActionItem[];
+    stats: {
+        totalActions: number;
+        pending: number;
+        completed: number;
+        overdue: number;
+        lastUpdated: string;
+    };
+}
+export declare class EvolutionManager {
+    private stateDir;
+    private config;
+    private trustElevationTracker;
+    private autonomousEvolution;
+    private autonomyManager;
+    constructor(config: EvolutionManagerConfig);
+    /**
+     * Wire adaptive autonomy modules for runtime integration.
+     * - TrustElevationTracker: receives proposal approval/rejection events
+     * - AutonomousEvolution: handles auto-implementation when in autonomous mode
+     * - AutonomyProfileManager: provides current autonomy profile state
+     */
+    setAdaptiveAutonomyModules(modules: {
+        trustElevationTracker?: TrustElevationTracker | null;
+        autonomousEvolution?: AutonomousEvolution | null;
+        autonomyManager?: AutonomyProfileManager | null;
+    }): void;
+    /**
+     * Get the wired TrustElevationTracker (for external access, e.g. routes).
+     */
+    getTrustElevationTracker(): TrustElevationTracker | null;
+    /**
+     * Get the wired AutonomousEvolution module (for external access, e.g. routes).
+     */
+    getAutonomousEvolution(): AutonomousEvolution | null;
+    private filePath;
+    private readFile;
+    private writeFile;
+    private now;
+    private loadEvolution;
+    private saveEvolution;
+    private nextProposalId;
+    addProposal(opts: {
+        title: string;
+        source: string;
+        description: string;
+        type: EvolutionType;
+        impact?: 'high' | 'medium' | 'low';
+        effort?: 'high' | 'medium' | 'low';
+        proposedBy?: string;
+        tags?: string[];
+    }): EvolutionProposal;
+    updateProposalStatus(id: string, status: EvolutionStatus, resolution?: string): boolean;
+    /**
+     * Process a proposal through the autonomous evolution pipeline.
+     * If in autonomous mode and the review approves with safe scope,
+     * the proposal is auto-implemented via sidecar pattern.
+     *
+     * Returns the action taken, or null if autonomous modules aren't wired.
+     */
+    processProposalAutonomously(proposalId: string, review: ReviewResult): {
+        action: string;
+        reason: string;
+    } | null;
+    listProposals(filter?: {
+        status?: EvolutionStatus;
+        type?: EvolutionType;
+    }): EvolutionProposal[];
+    getEvolutionStats(): EvolutionState['stats'];
+    private loadLearnings;
+    private saveLearnings;
+    private nextLearningId;
+    addLearning(opts: {
+        title: string;
+        category: string;
+        description: string;
+        source: LearningSource;
+        tags?: string[];
+        evolutionRelevance?: string;
+    }): LearningEntry;
+    markLearningApplied(id: string, appliedTo: string): boolean;
+    listLearnings(filter?: {
+        category?: string;
+        applied?: boolean;
+    }): LearningEntry[];
+    getLearningStats(): LearningState['stats'];
+    private loadGaps;
+    private saveGaps;
+    private nextGapId;
+    addGap(opts: {
+        title: string;
+        category: GapCategory;
+        severity: 'critical' | 'high' | 'medium' | 'low';
+        description: string;
+        context: string;
+        platform?: string;
+        session?: string;
+        currentState?: string;
+        proposedSolution?: string;
+    }): CapabilityGap;
+    addressGap(id: string, resolution: string): boolean;
+    listGaps(filter?: {
+        severity?: string;
+        category?: GapCategory;
+        status?: string;
+    }): CapabilityGap[];
+    getGapStats(): GapState['stats'];
+    private loadActions;
+    private saveActions;
+    private nextActionId;
+    addAction(opts: {
+        title: string;
+        description: string;
+        priority?: 'critical' | 'high' | 'medium' | 'low';
+        commitTo?: string;
+        dueBy?: string;
+        source?: ActionItem['source'];
+        tags?: string[];
+    }): ActionItem;
+    updateAction(id: string, updates: {
+        status?: ActionItem['status'];
+        resolution?: string;
+    }): boolean;
+    listActions(filter?: {
+        status?: ActionItem['status'];
+        priority?: string;
+    }): ActionItem[];
+    getOverdueActions(): ActionItem[];
+    getActionStats(): ActionState['stats'];
+    /**
+     * Get a full dashboard of evolution health.
+     * Useful for session-start orientation and status reporting.
+     */
+    getDashboard(): {
+        evolution: EvolutionState['stats'];
+        learnings: LearningState['stats'];
+        gaps: GapState['stats'];
+        actions: ActionState['stats'];
+        highlights: string[];
+    };
+    /**
+     * Detect gaps or proposals that may already be resolved by existing infrastructure.
+     *
+     * Scans open gaps and proposed items against:
+     *   - Implemented proposals (already built)
+     *   - Applied learnings (already absorbed)
+     *   - Addressed gaps (already resolved)
+     *
+     * Returns items that appear to have implicit resolutions, with evidence.
+     */
+    detectImplicitEvolution(): Array<{
+        type: 'gap' | 'proposal';
+        id: string;
+        title: string;
+        matchedBy: {
+            type: string;
+            id: string;
+            title: string;
+            similarity: string;
+        };
+    }>;
+    /**
+     * Simple keyword overlap matching. Returns the best match if overlap
+     * exceeds a threshold, or null if no match is strong enough.
+     */
+    private findKeywordMatch;
+    /**
+     * Extract meaningful keywords from text, filtering stop words.
+     */
+    private extractKeywords;
+}
+export {};
+//# sourceMappingURL=EvolutionManager.d.ts.map

package/dist/core/EvolutionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EvolutionManager.d.ts","sourceRoot":"","sources":["../../src/core/EvolutionManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,KAAK,EACV,iBAAiB,EACjB,aAAa,EACb,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,EACX,UAAU,EACV,sBAAsB,EACvB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAE1E,UAAU,cAAc;IACtB,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,KAAK,EAAE;QACL,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,UAAU,aAAa;IACrB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,KAAK,EAAE;QACL,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,aAAa,EAAE,CAAC;IACtB,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,UAAU,WAAW;IACnB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,KAAK,EAAE;QACL,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,mBAAmB,CAAoC;IAC/D,OAAO,CAAC,eAAe,CAAuC;gBAElD,MAAM,EAAE,sBAAsB;IAK1C;;;;;OAKG;IACH,0BAA0B,CAAC,OAAO,EAAE;QAClC,qBAAqB,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAAC;QACrD,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;QACjD,eAAe,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC;KACjD,GAAG,IAAI;IAMR;;OAEG;IACH,wBAAwB,IAAI,qBAAqB,GAAG,IAAI;IAIxD;;OAEG;IACH,sBAAsB,IAAI,mBAAmB,GAAG,IAAI;IAMpD,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,QAAQ;IAWhB,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,GAAG;IAMX,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,aAAa;IA4BrB,OAAO,CAAC,cAAc;IAOtB,WAAW,CAAC,IAAI,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,IAAI,EAAE,aAAa,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;QACnC,MAAM,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;QACnC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,GAAG,iBAAiB;IAqBrB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO;IAkBvF;;;;;;OAMG;IACH,2BAA2B,CACzB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GACnB;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAiC5C,aAAa,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,eAAe,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,iBAAiB,EAAE;IAQ/F,iBAAiB,IAAI,cAAc,CAAC,OAAO,CAAC;IAM5C,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,aAAa;IA0BrB,OAAO,CAAC,cAAc;IAOtB,WAAW,CAAC,IAAI,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,cAAc,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,GAAG,aAAa;IAkBjB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAU3D,aAAa,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,aAAa,EAAE;IAQjF,gBAAgB,IAAI,aAAa,CAAC,OAAO,CAAC;IAM1C,OAAO,CAAC,QAAQ;IAOhB,OAAO,CAAC,QAAQ;IA4BhB,OAAO,CAAC,SAAS;IAOjB,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,WAAW,CAAC;QACtB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,aAAa;IAwBjB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAWnD,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,aAAa,EAAE;IASlG,WAAW,IAAI,QAAQ,CAAC,OAAO,CAAC;IAMhC,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,WAAW;IA6BnB,OAAO,CAAC,YAAY;IAOpB,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;QAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,GAAG,UAAU;IAoBd,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;QAChC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO;IAaX,WAAW,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU,EAAE;IAQxF,iBAAiB,IAAI,UAAU,EAAE;IASjC,cAAc,IAAI,WAAW,CAAC,OAAO,CAAC;IAMtC;;;OAGG;IACH,YAAY,IAAI;QACd,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;QACnC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB;IA0BD;;;;;;;;;OASG;IACH,uBAAuB,IAAI,KAAK,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;QACzB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5E,CAAC;IAsFF;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;IACH,OAAO,CAAC,eAAe;CAuBxB"}