@medicine-wheel/infra 0.5.7 → 0.5.9

package/README.md

@@ -14,7 +14,7 @@ does not have to change to make that true.
 ## Install
 
 ```bash
-npm install @medicine-wheel/infra
+npm install @medicine-wheel/infra@^0.5.8
 ```
 
 Depends only on `@medicine-wheel/ontology-core` and `zod`.
@@ -110,26 +110,103 @@ if (!parsed.success) { /* the emitter misread systemd — do not reconcile on th
 Port numbers are integers in 1–65535. A misparsed `0` is rejected here rather
 than silently never colliding with anything downstream.
 
-## Scope of `0.1.0`
+## `Precondition` — where the machine fact and the human do not merge
 
-Ships S1, S3, S5 only — facets, `detectPortConflicts`, `MetisHold`, schemas.
-Deliberately **not** here:
+```ts
+import { preconditionGuard, readyService, lingerFact } from '@medicine-wheel/infra';
+
+const p = {
+  id: 'pre:gmusic-linger',
+  gates: 'node:knowledge:assembly-mux',
+  fact: lingerFact('node:human:gmusic', 'enabled', '2026-08-05T12:00:00Z'),
+  consent: { consentId: 'consent:root-step:gmusic', state: 'withdrawn', readAt: '2026-08-05T12:00:00Z' },
+};
+
+preconditionGuard(p).verdict; // 'unauthorized' — NOT 'satisfied', NOT 'unsatisfied'
+```
+
+`linger` is a machine fact: a checkbox with no authority and no ability to
+withdraw. The human authorization to run the root step that set it is a
+`ConsentRecord` in `@medicine-wheel/consent-lifecycle`. A `Precondition`
+references both **by id**, and `infra` never imports that package — a package
+that can construct a consent record can fabricate one.
+
+Four verdicts, and the distinctions are the whole point:
 
-- **`0.2.0`** (S4) — `Precondition`, `preconditionGuard`, `readyService`. Where
-  the machine fact `linger` and the human, withdrawable `ConsentRecord` that
-  authorized the root step reference each other by id without either collapsing
-  into the other.
-- **`0.3.0`** (S6) — level-triggered `reconcile()` + `ObservedState` and the four
-  drift states, which keep `satisfied` from becoming a stale snapshot.
-- **`ontology-core@0.6.0`** (S2) — `part-of` / `ordered-after` / `binds-port` in
-  the governed `KINSHIP_EDGE_TYPES` registry. Until then a dependency edge is an
-  ordinary `Relation`; `infra` does not fork the vocabulary.
+| verdict | means |
+|---|---|
+| `satisfied` | every declared half was read and holds |
+| `unsatisfied` | a machine fact was read and does not match |
+| `unauthorized` | the machine half holds and consent does not authorize |
+| `unknown` | a declared half has **not been read**, which is not the same as false |
+
+`unauthorized` is separate from `unsatisfied` on purpose. Collapse them and a
+withdrawn consent looks like a technical failure an operator can fix by
+restarting something. `unknown` is separate from both because a guard that
+reports "blocked" when nobody has looked yet is a guard operators learn to
+ignore.
+
+`readyService` reports `declared: 0` out loud rather than letting an
+unconfigured service look checked, and carries every `MetisHold` from the
+blocking preconditions forward — the reason a gate is stuck is exactly where
+"you have to restart it twice" lives.
+
+## `reconcile` — level-triggered, so `satisfied` cannot age
+
+```ts
+const result = reconcile(declaredServices, {
+  observedBy: 'node:land:gaia',
+  observedAt: '2026-08-05T12:00:00Z',
+  services: readLiveFromSystemd(),
+}, { now: '2026-08-05T12:05:00Z' });
+
+result.summary;            // { converged: 4, drifted: 1, unrealized: 0, undeclared: 2 }
+result.observationAgeMs;   // 300000 — refuse to act on a reading that is too old
+```
 
-Each step makes the next honest. None is a backlog item for this one.
+The outage this answers (jgwill/gaia#74) was not caused by a missing fact. It was
+caused by a fact that *had been* true. So `reconcile` remembers no transitions:
+it compares the current declared level against the current observed level, every
+time. There is no "converged a minute ago" to go stale.
+
+| drift state | means |
+|---|---|
+| `converged` | both sides agree on every compared field |
+| `drifted` | both exist, they disagree — the differences are named |
+| `unrealized` | declared, not observed — written down, not running |
+| `undeclared` | **observed, not declared** — running and nobody wrote it down |
+
+`undeclared` carries the most information: it finds the service somebody started
+by hand at 2am, which is the service holding the port the next tenant is about to
+be given. The §S3 port traversal is folded in here, because this is the one place
+declared and observed are both in hand.
+
+**Métis is never a difference.** Two sides holding different tacit notes is not
+drift — it is two people knowing different things. A reconciler that reported it
+would be asking an operator to delete what they know to make a table go green.
+
+## Scope
+
+Every specification ships: S1 facets, S3 `detectPortConflicts`, S4
+`Precondition`, S5 `MetisHold`, S6 `reconcile`. S2 — the governed `part-of`,
+`ordered-after` and `binds-port` edges — landed in
+`ontology-core`'s `KINSHIP_EDGE_TYPES`, which is where edge vocabulary belongs.
+`infra` never forked it.
+
+S4 and S6 first ship in **0.5.8**. `0.5.7` and earlier contain S1, S3 and S5
+only — a package that installs `^0.5.7` may resolve a dist with no
+`preconditionGuard` and no `reconcile`.
+
+The package stays types plus pure functions: zero I/O, zero persistence, zero
+clock. `reconcile` takes `now` as an argument for exactly that reason.
+Persistence belongs to `@medicine-wheel/mcp`, which is where these are reachable
+from — `register_host`, `register_tenant`, `register_service`,
+`detect_port_conflicts`, `hold_metis`, `list_infra_topology`,
+`reconcile_infra_state`, and `mw_enforce_gate` for the precondition gate.
 
 ## Grounding
 
-- Specification: `/opt/eury/rispecs/foundations/02-specifications.md` §S1, §S3, §S5
+- Specification: `/opt/eury/rispecs/foundations/02-specifications.md` §S1–§S6
 - Argument: `/opt/eury/foundations/relational-infrastructure/synthesis.md`
 - The collision this exists to catch: `jgwill/gaia#75`
 - The outage that motivated observed state: `jgwill/gaia#74`

package/dist/index.d.ts

@@ -10,15 +10,25 @@
  * package: the closed `NodeType` union is reused, never widened, and facets are
  * keyed by node id rather than re-declaring nodes.
  *
- * Scope of `0.1.0` — S1, S3, S5 only. `Precondition` / `preconditionGuard` /
- * `readyService` are `0.2.0` (S4); `reconcile()` / `ObservedState` are `0.3.0`
- * (S6). Neither is shipped here.
+ * Every specification is now shipped: S1 (facets), S3 (`detectPortConflicts`),
+ * S4 (`Precondition` / `preconditionGuard` / `readyService`), S5 (`MetisHold`),
+ * S6 (`ObservedState` / `reconcile`). S2 — the governed `part-of`,
+ * `ordered-after` and `binds-port` edges — landed in `ontology-core`, which is
+ * where edge vocabulary belongs; `infra` never forked it.
+ *
+ * The package remains types plus pure functions. Zero I/O, zero persistence,
+ * zero clock: `reconcile` takes `now` as an argument for exactly that reason.
  *
  * @packageDocumentation
  */
 export type { NodeId, MetisHold, LingerState, Reachability, PortProto, ServiceScope, HostFacet, TenantFacet, ServiceFacet, PortBinding, PortConflict, FacetKind, } from './types';
 export { DEFAULT_PORT_PROTO, FACET_NODE_TYPES } from './types';
 export { MetisHoldSchema, LingerStateSchema, ReachabilitySchema, PortProtoSchema, ServiceScopeSchema, PortNumberSchema, PortBindingSchema, PortConflictSchema, HostFacetSchema, TenantFacetSchema, ServiceFacetSchema, } from './schemas';
-export type { ValidatedMetisHold, ValidatedPortBinding, ValidatedPortConflict, ValidatedHostFacet, ValidatedTenantFacet, ValidatedServiceFacet, } from './schemas';
+export { PreconditionKindSchema, MachineFactSchema, ConsentReferenceSchema, PreconditionSchema, PreconditionVerdictSchema, DriftStateSchema, ObservedStateSchema, } from './schemas';
+export type { ValidatedMetisHold, ValidatedPortBinding, ValidatedPortConflict, ValidatedHostFacet, ValidatedTenantFacet, ValidatedServiceFacet, ValidatedMachineFact, ValidatedConsentReference, ValidatedPrecondition, ValidatedObservedState, } from './schemas';
 export { detectPortConflicts } from './ports';
+export { preconditionGuard, readyService, lingerFact, AUTHORIZING_CONSENT_STATES, CONSENT_REQUIRING_KINDS, } from './preconditions';
+export type { PreconditionKind, MachineFact, ConsentReference, Precondition, PreconditionVerdict, PreconditionResult, ServiceReadiness, } from './preconditions';
+export { reconcile, DRIFT_STATES } from './reconcile';
+export type { DriftState, ObservedState, FieldDifference, DriftRow, ReconcileResult, } from './reconcile';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,YAAY,EACV,MAAM,EACN,SAAS,EACT,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,YAAY,EACV,MAAM,EACN,SAAS,EACT,WAAW,EACX,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,SAAS,GACV,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG/D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAG9C,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEtD,YAAY,EACV,UAAU,EACV,aAAa,EACb,eAAe,EACf,QAAQ,EACR,eAAe,GAChB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -11,14 +11,19 @@
  * package: the closed `NodeType` union is reused, never widened, and facets are
  * keyed by node id rather than re-declaring nodes.
  *
- * Scope of `0.1.0` — S1, S3, S5 only. `Precondition` / `preconditionGuard` /
- * `readyService` are `0.2.0` (S4); `reconcile()` / `ObservedState` are `0.3.0`
- * (S6). Neither is shipped here.
+ * Every specification is now shipped: S1 (facets), S3 (`detectPortConflicts`),
+ * S4 (`Precondition` / `preconditionGuard` / `readyService`), S5 (`MetisHold`),
+ * S6 (`ObservedState` / `reconcile`). S2 — the governed `part-of`,
+ * `ordered-after` and `binds-port` edges — landed in `ontology-core`, which is
+ * where edge vocabulary belongs; `infra` never forked it.
+ *
+ * The package remains types plus pure functions. Zero I/O, zero persistence,
+ * zero clock: `reconcile` takes `now` as an argument for exactly that reason.
  *
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.detectPortConflicts = exports.ServiceFacetSchema = exports.TenantFacetSchema = exports.HostFacetSchema = exports.PortConflictSchema = exports.PortBindingSchema = exports.PortNumberSchema = exports.ServiceScopeSchema = exports.PortProtoSchema = exports.ReachabilitySchema = exports.LingerStateSchema = exports.MetisHoldSchema = exports.FACET_NODE_TYPES = exports.DEFAULT_PORT_PROTO = void 0;
+exports.DRIFT_STATES = exports.reconcile = exports.CONSENT_REQUIRING_KINDS = exports.AUTHORIZING_CONSENT_STATES = exports.lingerFact = exports.readyService = exports.preconditionGuard = exports.detectPortConflicts = exports.ObservedStateSchema = exports.DriftStateSchema = exports.PreconditionVerdictSchema = exports.PreconditionSchema = exports.ConsentReferenceSchema = exports.MachineFactSchema = exports.PreconditionKindSchema = exports.ServiceFacetSchema = exports.TenantFacetSchema = exports.HostFacetSchema = exports.PortConflictSchema = exports.PortBindingSchema = exports.PortNumberSchema = exports.ServiceScopeSchema = exports.PortProtoSchema = exports.ReachabilitySchema = exports.LingerStateSchema = exports.MetisHoldSchema = exports.FACET_NODE_TYPES = exports.DEFAULT_PORT_PROTO = void 0;
 var types_1 = require("./types");
 Object.defineProperty(exports, "DEFAULT_PORT_PROTO", { enumerable: true, get: function () { return types_1.DEFAULT_PORT_PROTO; } });
 Object.defineProperty(exports, "FACET_NODE_TYPES", { enumerable: true, get: function () { return types_1.FACET_NODE_TYPES; } });
@@ -35,7 +40,26 @@ Object.defineProperty(exports, "PortConflictSchema", { enumerable: true, get: fu
 Object.defineProperty(exports, "HostFacetSchema", { enumerable: true, get: function () { return schemas_1.HostFacetSchema; } });
 Object.defineProperty(exports, "TenantFacetSchema", { enumerable: true, get: function () { return schemas_1.TenantFacetSchema; } });
 Object.defineProperty(exports, "ServiceFacetSchema", { enumerable: true, get: function () { return schemas_1.ServiceFacetSchema; } });
-// ── Port-conflict detection ─────────────────────────────────────────────────
+var schemas_2 = require("./schemas");
+Object.defineProperty(exports, "PreconditionKindSchema", { enumerable: true, get: function () { return schemas_2.PreconditionKindSchema; } });
+Object.defineProperty(exports, "MachineFactSchema", { enumerable: true, get: function () { return schemas_2.MachineFactSchema; } });
+Object.defineProperty(exports, "ConsentReferenceSchema", { enumerable: true, get: function () { return schemas_2.ConsentReferenceSchema; } });
+Object.defineProperty(exports, "PreconditionSchema", { enumerable: true, get: function () { return schemas_2.PreconditionSchema; } });
+Object.defineProperty(exports, "PreconditionVerdictSchema", { enumerable: true, get: function () { return schemas_2.PreconditionVerdictSchema; } });
+Object.defineProperty(exports, "DriftStateSchema", { enumerable: true, get: function () { return schemas_2.DriftStateSchema; } });
+Object.defineProperty(exports, "ObservedStateSchema", { enumerable: true, get: function () { return schemas_2.ObservedStateSchema; } });
+// ── Port-conflict detection (S3) ────────────────────────────────────────────
 var ports_1 = require("./ports");
 Object.defineProperty(exports, "detectPortConflicts", { enumerable: true, get: function () { return ports_1.detectPortConflicts; } });
+// ── Preconditions (S4) ──────────────────────────────────────────────────────
+var preconditions_1 = require("./preconditions");
+Object.defineProperty(exports, "preconditionGuard", { enumerable: true, get: function () { return preconditions_1.preconditionGuard; } });
+Object.defineProperty(exports, "readyService", { enumerable: true, get: function () { return preconditions_1.readyService; } });
+Object.defineProperty(exports, "lingerFact", { enumerable: true, get: function () { return preconditions_1.lingerFact; } });
+Object.defineProperty(exports, "AUTHORIZING_CONSENT_STATES", { enumerable: true, get: function () { return preconditions_1.AUTHORIZING_CONSENT_STATES; } });
+Object.defineProperty(exports, "CONSENT_REQUIRING_KINDS", { enumerable: true, get: function () { return preconditions_1.CONSENT_REQUIRING_KINDS; } });
+// ── Reconciliation (S6) ─────────────────────────────────────────────────────
+var reconcile_1 = require("./reconcile");
+Object.defineProperty(exports, "reconcile", { enumerable: true, get: function () { return reconcile_1.reconcile; } });
+Object.defineProperty(exports, "DRIFT_STATES", { enumerable: true, get: function () { return reconcile_1.DRIFT_STATES; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AAkBH,iCAA+D;AAAtD,2GAAA,kBAAkB,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAE7C,+EAA+E;AAC/E,qCAYmB;AAXjB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,0GAAA,eAAe,OAAA;AACf,6GAAA,kBAAkB,OAAA;AAClB,2GAAA,gBAAgB,OAAA;AAChB,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAYpB,+EAA+E;AAC/E,iCAA8C;AAArC,4GAAA,mBAAmB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;;AAkBH,iCAA+D;AAAtD,2GAAA,kBAAkB,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAE7C,+EAA+E;AAC/E,qCAYmB;AAXjB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,0GAAA,eAAe,OAAA;AACf,6GAAA,kBAAkB,OAAA;AAClB,2GAAA,gBAAgB,OAAA;AAChB,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAClB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AACjB,6GAAA,kBAAkB,OAAA;AAGpB,qCAQmB;AAPjB,iHAAA,sBAAsB,OAAA;AACtB,4GAAA,iBAAiB,OAAA;AACjB,iHAAA,sBAAsB,OAAA;AACtB,6GAAA,kBAAkB,OAAA;AAClB,oHAAA,yBAAyB,OAAA;AACzB,2GAAA,gBAAgB,OAAA;AAChB,8GAAA,mBAAmB,OAAA;AAgBrB,+EAA+E;AAC/E,iCAA8C;AAArC,4GAAA,mBAAmB,OAAA;AAE5B,+EAA+E;AAC/E,iDAMyB;AALvB,kHAAA,iBAAiB,OAAA;AACjB,6GAAA,YAAY,OAAA;AACZ,2GAAA,UAAU,OAAA;AACV,2HAAA,0BAA0B,OAAA;AAC1B,wHAAA,uBAAuB,OAAA;AAazB,+EAA+E;AAC/E,yCAAsD;AAA7C,sGAAA,SAAS,OAAA;AAAE,yGAAA,YAAY,OAAA"}

package/dist/preconditions.d.ts

@@ -0,0 +1,198 @@
+/**
+ * Preconditions — what must hold before West runs.
+ *
+ * A service is West: the thing that executes. A port claim, a linger flag, a
+ * unit file on disk are South: claims that must hold *first*. This module makes
+ * that ordering checkable without letting either half stand in for the other.
+ *
+ * The load-bearing separation, and the reason this file exists at all:
+ *
+ * > `linger` is a machine fact — a checkbox with no authority and no ability to
+ * > withdraw. The human authorization to run the root step that sets it is a
+ * > `ConsentRecord` in `@medicine-wheel/consent-lifecycle`. A `Precondition`
+ * > references both **by id**. Neither collapses into the other.
+ *
+ * Collapsing them is the failure this guards against: once a granted consent is
+ * inferred from a machine fact, withdrawing consent stops meaning anything,
+ * because the flag is still set. So `unauthorized` is a verdict of its own — the
+ * machine is ready and the human has not said yes — and it never reads as
+ * `unsatisfied`.
+ *
+ * A pure function over plain data. No I/O, no ontology traversal, no clock.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S4.
+ */
+import type { LingerState, MetisHold, NodeId, ServiceFacet } from './types';
+/**
+ * The kinds of machine fact a precondition can read.
+ *
+ * Every one of these is something a host can be asked and will answer without a
+ * person present. That is precisely what disqualifies them from carrying
+ * consent.
+ */
+export type PreconditionKind = 
+/** the tenant's user units survive logout — `loginctl show-user <account>` */
+'linger'
+/** the slot this service claims is not held by another service */
+ | 'port-free'
+/** the unit file exists in the scope the facet declares */
+ | 'unit-present'
+/** the directory the unit reads its environment from exists (jgwill/gaia#74) */
+ | 'working-directory';
+/**
+ * A fact read off a machine, with its provenance attached.
+ *
+ * `observed` being absent means **never read**, which is not the same as read
+ * and false. A guard that treats the two alike will report a service blocked
+ * when nobody has looked yet, and the operator learns to ignore it.
+ */
+export interface MachineFact {
+    kind: PreconditionKind;
+    /** the facet whose field carries this fact — host, tenant or service */
+    facetNodeId: NodeId;
+    /** what the fact must read for the precondition to hold */
+    expected: string;
+    /** what it actually read. Absent means unread. */
+    observed?: string;
+    /** ISO 8601 — when `observed` was read. Staleness is a fact, not an inference. */
+    observedAt?: string;
+}
+/**
+ * The consent states that authorize an action.
+ *
+ * Mirrors `ConsentState` in `@medicine-wheel/consent-lifecycle` and is exported
+ * as data so a caller can pass its own set rather than fork this file. `infra`
+ * deliberately does **not** import that package: a package that can construct a
+ * consent record can fabricate one, and this one must not be able to.
+ */
+export declare const AUTHORIZING_CONSENT_STATES: readonly string[];
+/**
+ * Fact kinds that cannot stand alone.
+ *
+ * `linger` is here because enabling it required running a root step, and that
+ * root step required a human to say yes. A precondition that reads the flag and
+ * references no `ConsentRecord` therefore opens the gate on the machine fact
+ * alone — which is the exact collapse this module's docstring forbids, arriving
+ * not through a wrong verdict but through an incomplete declaration.
+ *
+ * Such a precondition returns `unknown`, never `satisfied`: nothing authorized
+ * it, and nothing was checked. `unauthorized` would be wrong too — that verdict
+ * means consent was read and did not authorize, and here it was never named.
+ */
+export declare const CONSENT_REQUIRING_KINDS: readonly PreconditionKind[];
+/**
+ * A pointer at a `ConsentRecord`, never a copy of one.
+ *
+ * `state` is an opaque string on purpose. `infra` does not own consent semantics;
+ * it records what the lifecycle said and when it was asked.
+ */
+export interface ConsentReference {
+    /** → `ConsentRecord.id` in `@medicine-wheel/consent-lifecycle` */
+    consentId: string;
+    /** the state as read at `readAt`. Absent means unread. */
+    state?: string;
+    /** ISO 8601 */
+    readAt?: string;
+}
+/**
+ * One condition that must hold before a service may be considered ready.
+ *
+ * A precondition may carry a machine fact, a consent reference, or both. Both is
+ * the interesting case and the one the whole module is shaped around: running
+ * the root step that enables linger needed a human to say yes, and that yes can
+ * be withdrawn later while the flag stays enabled.
+ */
+export interface Precondition {
+    /** stable id for the precondition itself */
+    id: string;
+    /** the service whose readiness this gates → `ServiceFacet.nodeId` */
+    gates: NodeId;
+    /** one line an operator can read — 'gmusic linger must survive logout' */
+    description?: string;
+    /** the machine half */
+    fact?: MachineFact;
+    /** the human half, referenced by id and never embedded */
+    consent?: ConsentReference;
+    /** what a person knows about this precondition that the fields cannot hold */
+    metis?: MetisHold;
+}
+/**
+ * How a precondition reads right now.
+ *
+ * Four values, and the distinctions between them are the point:
+ *
+ * - `satisfied`    — every half that was declared was read, and holds.
+ * - `unsatisfied`  — a machine fact was read and does not match what is expected.
+ * - `unauthorized` — the machine half holds (or was not required) and consent
+ *                    does not authorize. Kept separate from `unsatisfied` so a
+ *                    withdrawn consent can never be mistaken for a technical
+ *                    failure, and so an operator cannot "fix" it by restarting
+ *                    something.
+ * - `unknown`      — a declared half has not been read. Never read as either
+ *                    success or failure.
+ */
+export type PreconditionVerdict = 'satisfied' | 'unsatisfied' | 'unauthorized' | 'unknown';
+export interface PreconditionResult {
+    preconditionId: string;
+    gates: NodeId;
+    verdict: PreconditionVerdict;
+    /** one sentence naming what decided it */
+    reason: string;
+    /** echoed so a caller rendering a table does not have to re-join */
+    fact?: MachineFact;
+    consent?: ConsentReference;
+    metis?: MetisHold;
+}
+/**
+ * Read one precondition.
+ *
+ * Order of decision, and it matters:
+ *
+ * 1. A declared-but-unread half yields `unknown`. Nothing else is decided from
+ *    an unread fact.
+ * 2. A read machine fact that does not match yields `unsatisfied`. The human
+ *    half is not consulted — there is nothing yet to authorize.
+ * 3. A consent that does not authorize yields `unauthorized`, whatever the
+ *    machine says.
+ * 4. A fact whose kind is in {@link CONSENT_REQUIRING_KINDS} and that names no
+ *    consent yields `unknown`. The machine half holding is not the question.
+ * 5. A precondition declaring neither half yields `unknown`, not `satisfied`.
+ *    An empty gate that reports success is how a gate stops being one.
+ */
+export declare function preconditionGuard(precondition: Precondition, authorizingStates?: readonly string[]): PreconditionResult;
+export interface ServiceReadiness {
+    /** → `ServiceFacet.nodeId` */
+    service: NodeId;
+    /** true only when every declared precondition is `satisfied` */
+    ready: boolean;
+    /** how many preconditions were declared for this service. Zero is a finding. */
+    declared: number;
+    /** every result, in the order the preconditions were given */
+    results: PreconditionResult[];
+    /** the subset that is not `satisfied` — what an operator has to act on */
+    blocking: PreconditionResult[];
+    /**
+     * Every `MetisHold` carried by a blocking precondition or by the service.
+     *
+     * Surfaced rather than summarised: the reason a gate is stuck is exactly where
+     * "you have to restart it twice" tends to live, and a readiness report that
+     * drops it has flattened the one thing the operator needed.
+     */
+    metis: MetisHold[];
+    /** one sentence for a caller that renders a single line */
+    reason: string;
+}
+/**
+ * Whether a service may be considered ready, given the preconditions that gate it.
+ *
+ * Preconditions gating other services are ignored rather than silently counted —
+ * the filter is on `gates`, so passing the whole set for a host is fine.
+ *
+ * A service with **no** declared preconditions is reported `ready: true` with
+ * `declared: 0`, and the reason says so. That is a vacuous truth and the caller
+ * is told it is one; hiding it would let an unconfigured service look checked.
+ */
+export declare function readyService(service: ServiceFacet, preconditions: Precondition[], authorizingStates?: readonly string[]): ServiceReadiness;
+/** Convenience: the linger fact for a tenant, shaped so the expected value is not retyped at every call site. */
+export declare function lingerFact(tenantNodeId: NodeId, observed?: LingerState, observedAt?: string): MachineFact;
+//# sourceMappingURL=preconditions.d.ts.map

package/dist/preconditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preconditions.d.ts","sourceRoot":"","sources":["../src/preconditions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5E;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB;AAC1B,8EAA8E;AAC5E,QAAQ;AACV,kEAAkE;GAChE,WAAW;AACb,2DAA2D;GACzD,cAAc;AAChB,gFAAgF;GAC9E,mBAAmB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,gBAAgB,CAAC;IACvB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAA0B,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,gBAAgB,EAAe,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,GAAG,SAAS,CAAC;AAE3F,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,mBAAmB,CAAC;IAC7B,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,YAAY,EAC1B,iBAAiB,GAAE,SAAS,MAAM,EAA+B,GAChE,kBAAkB,CAoEpB;AAID,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,KAAK,EAAE,OAAO,CAAC;IACf,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,YAAY,EACrB,aAAa,EAAE,YAAY,EAAE,EAC7B,iBAAiB,GAAE,SAAS,MAAM,EAA+B,GAChE,gBAAgB,CA6BlB;AAED,iHAAiH;AACjH,wBAAgB,UAAU,CACxB,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,WAAW,EACtB,UAAU,CAAC,EAAE,MAAM,GAClB,WAAW,CAQb"}

package/dist/preconditions.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * Preconditions — what must hold before West runs.
+ *
+ * A service is West: the thing that executes. A port claim, a linger flag, a
+ * unit file on disk are South: claims that must hold *first*. This module makes
+ * that ordering checkable without letting either half stand in for the other.
+ *
+ * The load-bearing separation, and the reason this file exists at all:
+ *
+ * > `linger` is a machine fact — a checkbox with no authority and no ability to
+ * > withdraw. The human authorization to run the root step that sets it is a
+ * > `ConsentRecord` in `@medicine-wheel/consent-lifecycle`. A `Precondition`
+ * > references both **by id**. Neither collapses into the other.
+ *
+ * Collapsing them is the failure this guards against: once a granted consent is
+ * inferred from a machine fact, withdrawing consent stops meaning anything,
+ * because the flag is still set. So `unauthorized` is a verdict of its own — the
+ * machine is ready and the human has not said yes — and it never reads as
+ * `unsatisfied`.
+ *
+ * A pure function over plain data. No I/O, no ontology traversal, no clock.
+ *
+ * Spec: /opt/eury/rispecs/foundations/02-specifications.md §S4.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONSENT_REQUIRING_KINDS = exports.AUTHORIZING_CONSENT_STATES = void 0;
+exports.preconditionGuard = preconditionGuard;
+exports.readyService = readyService;
+exports.lingerFact = lingerFact;
+/**
+ * The consent states that authorize an action.
+ *
+ * Mirrors `ConsentState` in `@medicine-wheel/consent-lifecycle` and is exported
+ * as data so a caller can pass its own set rather than fork this file. `infra`
+ * deliberately does **not** import that package: a package that can construct a
+ * consent record can fabricate one, and this one must not be able to.
+ */
+exports.AUTHORIZING_CONSENT_STATES = ['granted', 'active'];
+/**
+ * Fact kinds that cannot stand alone.
+ *
+ * `linger` is here because enabling it required running a root step, and that
+ * root step required a human to say yes. A precondition that reads the flag and
+ * references no `ConsentRecord` therefore opens the gate on the machine fact
+ * alone — which is the exact collapse this module's docstring forbids, arriving
+ * not through a wrong verdict but through an incomplete declaration.
+ *
+ * Such a precondition returns `unknown`, never `satisfied`: nothing authorized
+ * it, and nothing was checked. `unauthorized` would be wrong too — that verdict
+ * means consent was read and did not authorize, and here it was never named.
+ */
+exports.CONSENT_REQUIRING_KINDS = ['linger'];
+/**
+ * Read one precondition.
+ *
+ * Order of decision, and it matters:
+ *
+ * 1. A declared-but-unread half yields `unknown`. Nothing else is decided from
+ *    an unread fact.
+ * 2. A read machine fact that does not match yields `unsatisfied`. The human
+ *    half is not consulted — there is nothing yet to authorize.
+ * 3. A consent that does not authorize yields `unauthorized`, whatever the
+ *    machine says.
+ * 4. A fact whose kind is in {@link CONSENT_REQUIRING_KINDS} and that names no
+ *    consent yields `unknown`. The machine half holding is not the question.
+ * 5. A precondition declaring neither half yields `unknown`, not `satisfied`.
+ *    An empty gate that reports success is how a gate stops being one.
+ */
+function preconditionGuard(precondition, authorizingStates = exports.AUTHORIZING_CONSENT_STATES) {
+    const base = {
+        preconditionId: precondition.id,
+        gates: precondition.gates,
+        fact: precondition.fact,
+        consent: precondition.consent,
+        metis: precondition.metis,
+    };
+    const { fact, consent } = precondition;
+    if (!fact && !consent) {
+        return {
+            ...base,
+            verdict: 'unknown',
+            reason: 'precondition declares neither a machine fact nor a consent reference — nothing was checked',
+        };
+    }
+    if (fact && fact.observed === undefined) {
+        return {
+            ...base,
+            verdict: 'unknown',
+            reason: `machine fact '${fact.kind}' on ${fact.facetNodeId} has not been read`,
+        };
+    }
+    if (fact && fact.observed !== fact.expected) {
+        return {
+            ...base,
+            verdict: 'unsatisfied',
+            reason: `machine fact '${fact.kind}' on ${fact.facetNodeId} read '${fact.observed}', expected '${fact.expected}'`,
+        };
+    }
+    if (fact && !consent && exports.CONSENT_REQUIRING_KINDS.includes(fact.kind)) {
+        return {
+            ...base,
+            verdict: 'unknown',
+            reason: `machine fact '${fact.kind}' holds, but this precondition names no ConsentRecord — ` +
+                `the root step that set it required a human to say yes, and no yes was referenced`,
+        };
+    }
+    if (consent && consent.state === undefined) {
+        return {
+            ...base,
+            verdict: 'unknown',
+            reason: `consent ${consent.consentId} has not been read from the lifecycle`,
+        };
+    }
+    if (consent && !authorizingStates.includes(consent.state)) {
+        return {
+            ...base,
+            verdict: 'unauthorized',
+            reason: `consent ${consent.consentId} is '${consent.state}' — the machine half may hold, but this is not authorization`,
+        };
+    }
+    return {
+        ...base,
+        verdict: 'satisfied',
+        reason: fact
+            ? `machine fact '${fact.kind}' reads '${fact.observed}'${consent ? ` and consent ${consent.consentId} is '${consent.state}'` : ''}`
+            : `consent ${consent?.consentId} is '${consent?.state}'`,
+    };
+}
+/**
+ * Whether a service may be considered ready, given the preconditions that gate it.
+ *
+ * Preconditions gating other services are ignored rather than silently counted —
+ * the filter is on `gates`, so passing the whole set for a host is fine.
+ *
+ * A service with **no** declared preconditions is reported `ready: true` with
+ * `declared: 0`, and the reason says so. That is a vacuous truth and the caller
+ * is told it is one; hiding it would let an unconfigured service look checked.
+ */
+function readyService(service, preconditions, authorizingStates = exports.AUTHORIZING_CONSENT_STATES) {
+    const mine = preconditions.filter((p) => p.gates === service.nodeId);
+    const results = mine.map((p) => preconditionGuard(p, authorizingStates));
+    const blocking = results.filter((r) => r.verdict !== 'satisfied');
+    const metis = [];
+    if (service.metis)
+        metis.push(service.metis);
+    for (const r of blocking)
+        if (r.metis)
+            metis.push(r.metis);
+    const ready = blocking.length === 0;
+    let reason;
+    if (mine.length === 0) {
+        reason = `no preconditions are declared for ${service.unit} — ready is vacuously true, not verified`;
+    }
+    else if (ready) {
+        reason = `all ${mine.length} precondition(s) satisfied for ${service.unit}`;
+    }
+    else {
+        const counts = blocking.reduce((acc, r) => {
+            acc[r.verdict] = (acc[r.verdict] ?? 0) + 1;
+            return acc;
+        }, {});
+        const shape = Object.entries(counts)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([verdict, n]) => `${n} ${verdict}`)
+            .join(', ');
+        reason = `${service.unit} is blocked: ${shape}`;
+    }
+    return { service: service.nodeId, ready, declared: mine.length, results, blocking, metis, reason };
+}
+/** Convenience: the linger fact for a tenant, shaped so the expected value is not retyped at every call site. */
+function lingerFact(tenantNodeId, observed, observedAt) {
+    return {
+        kind: 'linger',
+        facetNodeId: tenantNodeId,
+        expected: 'enabled',
+        observed,
+        observedAt,
+    };
+}
+//# sourceMappingURL=preconditions.js.map

package/dist/preconditions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preconditions.js","sourceRoot":"","sources":["../src/preconditions.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AAwJH,8CAuEC;AAqCD,oCAiCC;AAGD,gCAYC;AA1QD;;;;;;;GAOG;AACU,QAAA,0BAA0B,GAAsB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACU,QAAA,uBAAuB,GAAgC,CAAC,QAAQ,CAAC,CAAC;AAuE/E;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAC/B,YAA0B,EAC1B,oBAAuC,kCAA0B;IAEjE,MAAM,IAAI,GAAG;QACX,cAAc,EAAE,YAAY,CAAC,EAAE;QAC/B,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,IAAI,EAAE,YAAY,CAAC,IAAI;QACvB,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;KAC1B,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;IAEvC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,4FAA4F;SACrG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,iBAAiB,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,WAAW,oBAAoB;SAC/E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,iBAAiB,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,WAAW,UAAU,IAAI,CAAC,QAAQ,gBAAgB,IAAI,CAAC,QAAQ,GAAG;SAClH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,+BAAuB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,SAAS;YAClB,MAAM,EACJ,iBAAiB,IAAI,CAAC,IAAI,0DAA0D;gBACpF,kFAAkF;SACrF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,uCAAuC;SAC5E,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAe,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,WAAW,OAAO,CAAC,SAAS,QAAQ,OAAO,CAAC,KAAK,8DAA8D;SACxH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE,IAAI;YACV,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,SAAS,QAAQ,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACnI,CAAC,CAAC,WAAW,OAAO,EAAE,SAAS,QAAQ,OAAO,EAAE,KAAK,GAAG;KAC3D,CAAC;AACJ,CAAC;AA2BD;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAC1B,OAAqB,EACrB,aAA6B,EAC7B,oBAAuC,kCAA0B;IAEjE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;IAElE,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IAEpC,IAAI,MAAc,CAAC;IACnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,qCAAqC,OAAO,CAAC,IAAI,0CAA0C,CAAC;IACvG,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,kCAAkC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAChE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACjC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;aACxC,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,gBAAgB,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrG,CAAC;AAED,iHAAiH;AACjH,SAAgB,UAAU,CACxB,YAAoB,EACpB,QAAsB,EACtB,UAAmB;IAEnB,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,SAAS;QACnB,QAAQ;QACR,UAAU;KACX,CAAC;AACJ,CAAC"}