@open-everywhere/core 0.1.0

package/dist/agent/access/grants-codemod.js

@@ -0,0 +1,306 @@
+// The deterministic codemod, and the only writer of the grants overlay: a frozen AccessDelta plus a parsed grants file in, byte-identical output out, idempotent on re-apply. It writes only an overlay bundle bound to EXACTLY the delta's domain/surface/personal scope — a multi-bound bundle is never edited, a fresh single-bound clone is made instead — and code bundles are out of reach.
+import { connectorGrantName } from "./bundle.js";
+import { HTTP_METHODS, requestingScopeProblem, sameScope } from "./delta.js";
+import { overlayModuleHeader, unwrapOverlayModule, wrapOverlayModule } from "./overlay-module.js";
+/** A codemod refusal — invalid file, invalid delta, or an invariant breach. Distinct
+ *  type so callers can tell "refused by design" from an unexpected failure. */
+export class GrantsCodemodError extends Error {
+}
+export function emptyGrantsFile() {
+    return { bundles: [], bindings: [] };
+}
+/** The canonical overlay-bundle name for a scope. The "grants:" prefix keeps the overlay out of the code-bundle namespace, and the level tag keeps the four address spaces disjoint. */
+export function overlayBundleName(scope) {
+    switch (scope.level) {
+        case "domain":
+            return `grants:domain:${scope.domain}`;
+        case "surface":
+            return `grants:${scope.surface}`;
+        case "principal":
+            return `grants:principal:${scope.principal}`;
+        case "group":
+            return `grants:group:${scope.group}`;
+    }
+}
+/** The BINDING this module writes for a scope — exactly the one address field
+ *  `assertBindingsValid` requires at that level (bundle.ts LEVEL_FIELD), and nothing else. */
+function bindingScope(scope) {
+    switch (scope.level) {
+        case "domain":
+            return { level: "domain", domain: scope.domain };
+        case "surface":
+            return { level: "surface", surface: scope.surface };
+        case "principal":
+            return { level: "principal", principal: scope.principal };
+        case "group":
+            return { level: "group", group: scope.group };
+    }
+}
+function requestingScopeOf(s) {
+    if (s.level === "domain" && typeof s.domain === "string")
+        return { level: "domain", domain: s.domain };
+    if (s.level === "surface" && typeof s.surface === "string")
+        return { level: "surface", surface: s.surface };
+    if (s.level === "principal" && typeof s.principal === "string")
+        return { level: "principal", principal: s.principal };
+    if (s.level === "group" && typeof s.group === "string")
+        return { level: "group", group: s.group };
+    return undefined;
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStringArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string");
+}
+/** Strict and fail-loud: an unknown key, a non-Bundle entry or a binding outside domain/surface/principal/group all throw, because a silently mis-parsed grants file IS the security bug. Deep semantic validation stays on the merged result. */
+export function parseGrantsFile(value) {
+    if (!isRecord(value))
+        throw new GrantsCodemodError("grants file must be a JSON object with `bundles` and `bindings` arrays");
+    const keys = Object.keys(value).filter((k) => k !== "$comment");
+    const unknown = keys.filter((k) => k !== "bundles" && k !== "bindings");
+    if (unknown.length > 0)
+        throw new GrantsCodemodError(`grants file has unknown top-level key(s): ${unknown.join(", ")}`);
+    if (!Array.isArray(value.bundles) || !Array.isArray(value.bindings)) {
+        throw new GrantsCodemodError("grants file needs `bundles` and `bindings` arrays (use [] when empty)");
+    }
+    const bundles = [];
+    for (const b of value.bundles) {
+        if (!isRecord(b) || typeof b.name !== "string" || !b.name.startsWith("grants:")) {
+            throw new GrantsCodemodError(`every grants bundle needs a "grants:"-prefixed name (got: ${JSON.stringify(isRecord(b) ? b.name : b)})`);
+        }
+        for (const k of Object.keys(b)) {
+            if (!["name", "connections", "connectors"].includes(k)) {
+                // The overlay carries only connections and connectors; any other Bundle field was not machine-written.
+                throw new GrantsCodemodError(`grants bundle "${b.name}" has field "${k}" — the overlay carries only connections/connectors (v1 vocabulary); put anything else in a code bundle`);
+            }
+        }
+        if (b.connectors !== undefined) {
+            // `{ name, credential }` objects only — narrower than Bundle.connectors, because `contentOrigin` is an operator ASSERTION and nothing here may be model-authored past propose time. Such grants stay on the fail-closed source tier.
+            if (!Array.isArray(b.connectors))
+                throw new GrantsCodemodError(`grants bundle "${b.name}" connectors must be an array`);
+            for (const g of b.connectors) {
+                if (!isRecord(g) || typeof g.name !== "string" || !g.name || typeof g.credential !== "string" || !g.credential) {
+                    throw new GrantsCodemodError(`grants bundle "${b.name}" has a malformed connector grant — the overlay writes { name, credential } objects (got: ${JSON.stringify(g)})`);
+                }
+                const extra = Object.keys(g).filter((k) => k !== "name" && k !== "credential");
+                if (extra.length > 0) {
+                    throw new GrantsCodemodError(`grants bundle "${b.name}" connector grant "${g.name}" carries field(s) ${extra.join(", ")} — the overlay writes only { name, credential } (a \`contentOrigin\` declaration is an operator assertion; put it in a code bundle)`);
+                }
+            }
+        }
+        if (b.connections !== undefined) {
+            if (!Array.isArray(b.connections))
+                throw new GrantsCodemodError(`grants bundle "${b.name}" connections must be an array`);
+            for (const c of b.connections) {
+                if (!isRecord(c) || typeof c.id !== "string" || typeof c.credentialType !== "string" || typeof c.secretRef !== "string" || !isStringArray(c.allowedWebsites)) {
+                    throw new GrantsCodemodError(`grants bundle "${b.name}" has a malformed connection (needs id/credentialType/secretRef/allowedWebsites)`);
+                }
+            }
+        }
+        bundles.push(b);
+    }
+    const bindings = [];
+    for (const bd of value.bindings) {
+        if (!isRecord(bd) || typeof bd.bundle !== "string" || !isRecord(bd.scope)) {
+            throw new GrantsCodemodError("every grants binding needs { bundle, scope }");
+        }
+        for (const k of Object.keys(bd)) {
+            // `allowBroad` is the only field beyond the pair; anything else on an overlay binding was not machine-written.
+            if (!["bundle", "scope", "allowBroad"].includes(k)) {
+                throw new GrantsCodemodError(`grants binding for "${bd.bundle}" has field "${k}" — an overlay binding carries { bundle, scope } and at most allowBroad`);
+            }
+        }
+        if (bd.allowBroad !== undefined && (typeof bd.allowBroad !== "string" || bd.allowBroad.trim() === "")) {
+            throw new GrantsCodemodError(`grants binding for "${bd.bundle}" has an empty/malformed allowBroad — the escape must NAME the reason a broad grant is deliberate (access/lint.ts)`);
+        }
+        const raw = bd.scope;
+        const scope = requestingScopeOf(raw);
+        if (!scope) {
+            throw new GrantsCodemodError(`grants binding for "${bd.bundle}" must be domain-, surface-, principal- or group-scoped with that level's own address field (got level="${String(raw.level)}") — the overlay never binds outside the canonical domain, one standalone room, one person or one declared group`);
+        }
+        // Exactly one address field, the level's own. A stray second one would make the scope equality this module's invariant rests on ambiguous.
+        const stray = ["tenant", "domain", "surface", "group", "principal"].filter((f) => raw[f] !== undefined && f !== scope.level);
+        if (stray.length > 0) {
+            throw new GrantsCodemodError(`grants binding for "${bd.bundle}" is ${scope.level}-scoped but also sets scope.${stray.join("/scope.")} — a scope carries exactly its own address field`);
+        }
+        const problem = requestingScopeProblem(scope);
+        if (problem)
+            throw new GrantsCodemodError(`grants binding for "${bd.bundle}": ${problem}`);
+        bindings.push(bd);
+    }
+    return { bundles, bindings };
+}
+// Canonical key order per object shape; unknown keys (future fields) go last,
+// alphabetically, so a vocabulary extension can't reshuffle existing lines.
+const BUNDLE_KEYS = ["name", "connections", "connectors"];
+const CONNECTION_KEYS = ["id", "credentialType", "secretRef", "allowedWebsites", "pathPrefixes", "customHeaders", "methods", "authorizationDetails"];
+const CONNECTOR_GRANT_KEYS = ["name", "credential", "contentOrigin"];
+const BINDING_KEYS = ["bundle", "scope", "allowBroad"];
+const SCOPE_KEYS = ["level", "tenant", "domain", "surface", "group", "principal"];
+function orderKeys(obj, order) {
+    const out = {};
+    for (const k of order)
+        if (k in obj)
+            out[k] = obj[k];
+    for (const k of Object.keys(obj).sort())
+        if (!(k in out))
+            out[k] = obj[k];
+    return out;
+}
+function methodSort(methods) {
+    return [...methods].sort((a, b) => HTTP_METHODS.indexOf(a) - HTTP_METHODS.indexOf(b));
+}
+function canonicalConnection(c) {
+    const obj = { ...c };
+    if (c.methods)
+        obj.methods = methodSort(c.methods);
+    if (c.pathPrefixes)
+        obj.pathPrefixes = [...c.pathPrefixes].sort();
+    return orderKeys(obj, CONNECTION_KEYS);
+}
+function canonicalBundle(b) {
+    const obj = { ...b };
+    if (b.connections)
+        obj.connections = [...b.connections].sort((x, y) => x.id.localeCompare(y.id)).map(canonicalConnection);
+    // Sorted by name, with each grant's own keys ordered: byte-determinism is what the 422-update PR path leans on, and a default sort over objects would not give it.
+    if (b.connectors) {
+        obj.connectors = [...b.connectors]
+            .sort((x, y) => connectorGrantName(x).localeCompare(connectorGrantName(y)))
+            .map((g) => (typeof g === "string" ? g : orderKeys({ ...g }, CONNECTOR_GRANT_KEYS)));
+    }
+    return orderKeys(obj, BUNDLE_KEYS);
+}
+function canonicalBinding(bd) {
+    return orderKeys({ ...bd, scope: orderKeys({ ...bd.scope }, SCOPE_KEYS) }, BINDING_KEYS);
+}
+function scopeSortKey(s) {
+    return `${s.surface ?? ""}/${s.tenant ?? ""}/${s.domain ?? ""}/${s.group ?? ""}/${s.principal ?? ""}/${s.level}`;
+}
+/** Canonical, byte-deterministic serialisation: sorted bundles and bindings, canonical array and key order, 2-space indent, trailing newline. The round trip is stable, which the 422-update path leans on. */
+export function stringifyGrants(grants) {
+    const canonical = {
+        bundles: [...grants.bundles].sort((a, b) => a.name.localeCompare(b.name)).map(canonicalBundle),
+        bindings: [...grants.bindings]
+            .sort((a, b) => a.bundle.localeCompare(b.bundle) || scopeSortKey(a.scope).localeCompare(scopeSortKey(b.scope))),
+    };
+    return JSON.stringify({ bundles: canonical.bundles, bindings: canonical.bindings.map(canonicalBinding) }, null, 2) + "\n";
+}
+// The overlay ships as a machine-owned TS module, not JSON; access/overlay-module.ts carries the grammar.
+const GRANTS_MODULE = {
+    what: "grants overlay",
+    header: overlayModuleHeader("grants overlay", "packages/core/agent/access/grants-codemod.ts"),
+    typeImport: 'import type { GrantsFile } from "@open-everywhere/core/agent/access/grants-codemod.js";',
+    typeName: "GrantsFile",
+};
+export function emitGrantsModule(grants) {
+    return wrapOverlayModule(GRANTS_MODULE, stringifyGrants(grants));
+}
+/** Parse an overlay module and VERIFY THE ROUND TRIP: a hand-edit refuses here rather than being silently rewritten into a diff nobody authored. `npm run overlays:normalize` produces the canonical form. */
+export function parseGrantsModule(text) {
+    const grants = parseGrantsFile(unwrapOverlayModule(GRANTS_MODULE, text, (m) => new GrantsCodemodError(m)));
+    if (emitGrantsModule(grants) !== text) {
+        throw new GrantsCodemodError("grants overlay is not in canonical form — re-emitting its own data does not reproduce the file, so it has been hand-edited. Run `npm run overlays:normalize` and commit the result (the codemod refuses to rewrite a file it did not write).");
+    }
+    return grants;
+}
+/** Lenient re-emit for `npm run overlays:normalize` — the only path allowed to accept a non-canonical file. */
+export function renormalizeGrantsModule(text) {
+    return emitGrantsModule(parseGrantsFile(unwrapOverlayModule(GRANTS_MODULE, text, (m) => new GrantsCodemodError(m))));
+}
+function scopeEquals(s, scope) {
+    const other = requestingScopeOf(s);
+    // Level AND address, never address alone: this comparison is what the single-scope invariant is made of.
+    return other !== undefined && sameScope(other, scope);
+}
+/** Every grants bundle bound to this scope (regardless of what else it's bound to) —
+ *  the "already effective?" check reads these; the WRITE target is stricter (single-bound). */
+function bundlesBoundToScope(grants, scope) {
+    const names = new Set(grants.bindings.filter((b) => scopeEquals(b.scope, scope)).map((b) => b.bundle));
+    return grants.bundles.filter((b) => names.has(b.name));
+}
+/** The write target: the first `grants:…#n` bundle bound to EXACTLY this scope and nothing else. A multi-bound candidate is skipped, never edited, and the probe order is fixed, so the target is deterministic. */
+function writeTarget(grants, scope) {
+    const base = overlayBundleName(scope);
+    for (let n = 1;; n++) {
+        const name = n === 1 ? base : `${base}#${n}`;
+        const existing = grants.bundles.find((b) => b.name === name);
+        if (!existing)
+            return { name, existing: undefined };
+        const bindings = grants.bindings.filter((b) => b.bundle === name);
+        const singleBound = bindings.length === 1 && scopeEquals(bindings[0].scope, scope);
+        if (singleBound)
+            return { name, existing };
+        // Multi-bound (or bound elsewhere): REFUSE to edit it; probe the next name.
+    }
+}
+/** Writes `next` at `name`, bound to exactly the delta's scope. `allowBroad` is additive only — written on creation, added when missing, never removed or rewritten — which keeps this idempotent and leaves withdrawal to a human. */
+function withBundle(grants, name, next, hadBundle, delta) {
+    const scope = delta.scope;
+    const isTarget = (b) => b.bundle === name && scopeEquals(b.scope, scope);
+    const hadBinding = grants.bindings.some(isTarget);
+    return {
+        bundles: hadBundle ? grants.bundles.map((b) => (b.name === name ? next : b)) : [...grants.bundles, next],
+        bindings: hadBinding
+            ? grants.bindings.map((b) => (isTarget(b) && delta.allowBroad && b.allowBroad === undefined ? { ...b, allowBroad: delta.allowBroad } : b))
+            : [...grants.bindings, { bundle: name, scope: bindingScope(scope), ...(delta.allowBroad ? { allowBroad: delta.allowBroad } : {}) }],
+    };
+}
+/** Apply one FROZEN AccessDelta: pure, deterministic and idempotent, refusing rather than guessing on anything outside the vocabulary. The caller re-validates the merged config before any PR opens. */
+export function applyDelta(grants, delta) {
+    // Re-checked here because a codemod validates its own inputs: a frozen row from an older build must never become a PR carrying a scope that cannot bind.
+    const problem = requestingScopeProblem(delta.scope);
+    if (problem)
+        throw new GrantsCodemodError(`delta scope is invalid — ${problem}`);
+    if (delta.allowBroad !== undefined && delta.allowBroad.trim() === "") {
+        throw new GrantsCodemodError("delta carries an EMPTY allowBroad — the escape must name the reason a broad grant is deliberate (access/lint.ts)");
+    }
+    if (delta.kind === "grant-connector") {
+        if (!delta.connector || delta.connector.includes(" ")) {
+            throw new GrantsCodemodError(`invalid connector name "${delta.connector}"`);
+        }
+        if (!delta.credential || delta.credential.includes(" ")) {
+            throw new GrantsCodemodError(`invalid credential id "${delta.credential}" for connector "${delta.connector}"`);
+        }
+        // Keyed on the CONNECTOR alone, not the (connector, credential) pair: the resolver keys one credential per connector, so a second grant would only make the winner depend on file order.
+        if (bundlesBoundToScope(grants, delta.scope).some((b) => (b.connectors ?? []).some((g) => connectorGrantName(g) === delta.connector))) {
+            return { grants, changed: false, bundleName: overlayBundleName(delta.scope) };
+        }
+        const { name, existing } = writeTarget(grants, delta.scope);
+        const next = {
+            ...(existing ?? { name }),
+            connectors: [...(existing?.connectors ?? []), { name: delta.connector, credential: delta.credential }].sort((x, y) => connectorGrantName(x).localeCompare(connectorGrantName(y))),
+        };
+        return { grants: withBundle(grants, name, next, existing !== undefined, delta), changed: true, bundleName: name };
+    }
+    const { connectionId, addMethods, addPathPrefixes, baseConnection } = delta;
+    if (baseConnection.id !== connectionId) {
+        throw new GrantsCodemodError(`delta baseConnection.id "${baseConnection.id}" doesn't match connectionId "${connectionId}"`);
+    }
+    if (addMethods.length === 0 && addPathPrefixes.length === 0) {
+        throw new GrantsCodemodError("widen-connection delta adds nothing");
+    }
+    // Widening only ever adds to a restricted list. A base with no list is already unrestricted on that axis, so such a delta was mis-planned; refuse again here, because codemods do not guess.
+    if (addMethods.length > 0 && baseConnection.methods === undefined) {
+        throw new GrantsCodemodError(`connection "${connectionId}" has no methods restriction — nothing to widen`);
+    }
+    if (addPathPrefixes.length > 0 && baseConnection.pathPrefixes === undefined) {
+        throw new GrantsCodemodError(`connection "${connectionId}" has no pathPrefixes restriction — adding prefixes would narrow, not widen`);
+    }
+    const { name, existing } = writeTarget(grants, delta.scope);
+    const current = existing?.connections?.find((c) => c.id === connectionId) ?? baseConnection;
+    const widened = {
+        ...current,
+        ...(current.methods !== undefined ? { methods: methodSort([...new Set([...current.methods, ...addMethods])]) } : {}),
+        ...(current.pathPrefixes !== undefined ? { pathPrefixes: [...new Set([...current.pathPrefixes, ...addPathPrefixes])].sort() } : {}),
+    };
+    const alreadyEffective = existing?.connections?.some((c) => c.id === connectionId &&
+        addMethods.every((m) => c.methods?.includes(m)) &&
+        addPathPrefixes.every((p) => c.pathPrefixes?.includes(p))) === true;
+    if (alreadyEffective)
+        return { grants, changed: false, bundleName: name };
+    const others = (existing?.connections ?? []).filter((c) => c.id !== connectionId);
+    const next = { ...(existing ?? { name }), connections: [...others, widened] };
+    return { grants: withBundle(grants, name, next, existing !== undefined, delta), changed: true, bundleName: name };
+}
+//# sourceMappingURL=grants-codemod.js.map

package/dist/agent/access/grants-codemod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-codemod.js","sourceRoot":"","sources":["../../../agent/access/grants-codemod.ts"],"names":[],"mappings":"AAAA,kYAAkY;AAElY,OAAO,EAAE,kBAAkB,EAA2E,MAAM,aAAa,CAAC;AAC1H,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAA0C,MAAM,YAAY,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,iBAAiB,EAA6B,MAAM,qBAAqB,CAAC;AAQ7H;+EAC+E;AAC/E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;CAAG;AAEhD,MAAM,UAAU,eAAe;IAC7B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,wLAAwL;AACxL,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,iBAAiB,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,KAAK,SAAS;YACZ,OAAO,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,KAAK,WAAW;YACd,OAAO,oBAAoB,KAAK,CAAC,SAAS,EAAE,CAAC;QAC/C,KAAK,OAAO;YACV,OAAO,gBAAgB,KAAK,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED;8FAC8F;AAC9F,SAAS,YAAY,CAAC,KAAsB;IAC1C,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACtD,KAAK,WAAW;YACd,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAQ;IACjC,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACvG,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5G,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IACtH,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAClG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,kPAAkP;AAClP,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,wEAAwE,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,UAAU,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,kBAAkB,CAAC,uEAAuE,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,kBAAkB,CAAC,6DAA6D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzI,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,uGAAuG;gBACvG,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,gBAAgB,CAAC,yGAAyG,CAAC,CAAC;YACnL,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/B,qOAAqO;YACrO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,+BAA+B,CAAC,CAAC;YACxH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;oBAC/G,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,CAAC,IAAI,6FAA6F,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAC1I,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC;gBAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,IAAI,sBAAsB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,qIAAqI,CAChO,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,gCAAgC,CAAC,CAAC;YAC1H,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC9B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;oBAC7J,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC,IAAI,kFAAkF,CAAC,CAAC;gBAC3I,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAsB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,kBAAkB,CAAC,8CAA8C,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,+GAA+G;YAC/G,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,CAAC,MAAM,gBAAgB,CAAC,yEAAyE,CAAC,CAAC;YAC3J,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,CAAC,MAAM,oHAAoH,CAAC,CAAC;QACrL,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,KAAgC,CAAC;QAChD,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAuB,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EAAE,CAAC,MAAM,2GAA2G,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,kHAAkH,CAC/Q,CAAC;QACJ,CAAC;QACD,2IAA2I;QAC3I,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,MAAM,CACxE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,CACjD,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,+BAA+B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;QAC1L,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,EAAE,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QAC3F,QAAQ,CAAC,IAAI,CAAC,EAAwB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AAC1D,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;AACrJ,MAAM,oBAAoB,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AACvD,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;AAElF,SAAS,SAAS,CAAC,GAA4B,EAAE,KAAwB;IACvE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,GAAG;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAA8B;IAChD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAa;IACxC,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9C,IAAI,CAAC,CAAC,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,OAAO,SAAS,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAA4B,EAAE,GAAG,CAAC,EAAE,CAAC;IAC9C,IAAI,CAAC,CAAC,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC1H,mKAAmK;IACnK,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;aAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;aAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAW;IACnC,OAAO,SAAS,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,EAA6B,EAAE,UAAU,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,YAAY,CAAC,CAAQ;IAC5B,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AACnH,CAAC;AAED,+MAA+M;AAC/M,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;QAC9F,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;aAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;KAClH,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC5H,CAAC;AAED,0GAA0G;AAE1G,MAAM,aAAa,GAAyB;IAC1C,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,8CAA8C,CAAC;IAC7F,UAAU,EAAE,yFAAyF;IACrG,QAAQ,EAAE,YAAY;CACvB,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,OAAO,iBAAiB,CAAC,aAAa,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,8MAA8M;AAC9M,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,eAAe,CAAC,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAC1B,8OAA8O,CAC/O,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,gBAAgB,CAAC,eAAe,CAAC,mBAAmB,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,CAAC;AASD,SAAS,WAAW,CAAC,CAAQ,EAAE,KAAsB;IACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACnC,yGAAyG;IACzG,OAAO,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;+FAC+F;AAC/F,SAAS,mBAAmB,CAAC,MAAkB,EAAE,KAAsB;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,oNAAoN;AACpN,SAAS,WAAW,CAAC,MAAkB,EAAE,KAAsB;IAC7D,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnF,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAED,uOAAuO;AACvO,SAAS,UAAU,CAAC,MAAkB,EAAE,IAAY,EAAE,IAAY,EAAE,SAAkB,EAAE,KAAkB;IACxG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;QACxG,QAAQ,EAAE,UAAU;YAClB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;KACtI,CAAC;AACJ,CAAC;AAED,yMAAyM;AACzM,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,KAAkB;IAC/D,yJAAyJ;IACzJ,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO;QAAE,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;IACjF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,IAAI,kBAAkB,CAAC,kHAAkH,CAAC,CAAC;IACnJ,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,KAAK,CAAC,UAAU,oBAAoB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QACjH,CAAC;QACD,yLAAyL;QACzL,IACE,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClD,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,CAC5E,EACD,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAW;YACnB,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC;YACzB,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnH,kBAAkB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAC3D;SACF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,KAAK,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpH,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IAC5E,IAAI,cAAc,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;QACvC,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,cAAc,CAAC,EAAE,iCAAiC,YAAY,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;IACD,6LAA6L;IAC7L,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClE,MAAM,IAAI,kBAAkB,CAAC,eAAe,YAAY,iDAAiD,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5E,MAAM,IAAI,kBAAkB,CAAC,eAAe,YAAY,6EAA6E,CAAC,CAAC;IACzI,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,IAAI,cAAc,CAAC;IAC5F,MAAM,OAAO,GAAe;QAC1B,GAAG,OAAO;QACV,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpH,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpI,CAAC;IAEF,MAAM,gBAAgB,GACpB,QAAQ,EAAE,WAAW,EAAE,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,EAAE,KAAK,YAAY;QACrB,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/C,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAC5D,KAAK,IAAI,CAAC;IACb,IAAI,gBAAgB;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAE1E,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IAClF,MAAM,IAAI,GAAW,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,KAAK,SAAS,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACpH,CAAC"}

package/dist/agent/access/group-request.d.ts

@@ -0,0 +1,13 @@
+import { type BindableContext } from "../identity/binding.js";
+import { type Group } from "../identity/groups.js";
+import { type EffectiveAccess, type ResolveRequest } from "./resolver.js";
+/** The link-set ids this account belongs to — at most ONE, by the store's `(org, platform, native_id)` primary key. Returns [] on any failure: a store outage degrades to "in no link-set-backed group" rather than aborting or widening the turn. */
+export declare function callerLinkSets(org: string, platform: string, nativeId: string, tenant?: string): Promise<readonly string[]>;
+/** Returns the org-scoped shared vault subject when the caller is a CONFIRMED member of an ACTIVE link-set, and `undefined` otherwise — unlinked, suggested, suspended, revoked, or any error — which keys the vault by the caller's own raw principal. DM-ONLY BY CALLER CONTRACT: the `mode === "dm"` check belongs to the caller, not to this function. */
+export declare function sharedVaultSubjectFor(org: string, connector: string, platform: string, nativeId: string, tenant?: string): Promise<string | undefined>;
+/** Fills the caller's `principalLinkSets` and their link-set-backed `groups` from ONE read. DM-only deliberately, because a principal or group binding resolves nothing outside a DM; a request with no principalId, or a caller in no link-set, is returned unchanged. */
+export declare function withLinkSetGroups(req: ResolveRequest, org: string, groups?: readonly Group[]): Promise<ResolveRequest>;
+export declare function buildResolveRequestWithGroups(ctx: BindableContext): Promise<ResolveRequest>;
+/** The ONLY form under which a link-set-backed `group` binding is effective. Identical to the synchronous form in every other respect, so switching a call site to it can only widen that site to the groups its caller is really in. */
+export declare function resolveAccessForWithGroups(ctx: BindableContext): Promise<EffectiveAccess>;
+//# sourceMappingURL=group-request.d.ts.map

package/dist/agent/access/group-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-request.d.ts","sourceRoot":"","sources":["../../../agent/access/group-request.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+B,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAsB,KAAK,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAMvE,OAAO,EAAiB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,sPAAsP;AACtP,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAQjI;AAED,8VAA8V;AAC9V,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,2QAA2Q;AAC3Q,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,EACX,MAAM,GAAE,SAAS,KAAK,EAAqC,GAC1D,OAAO,CAAC,cAAc,CAAC,CAczB;AAED,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAEjG;AAED,yOAAyO;AACzO,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAO/F"}

package/dist/agent/access/group-request.js

@@ -0,0 +1,67 @@
+// The awaitable half of the DM personal universe. It can only ever ADD to `groups`/`principalLinkSets`, so a synchronous caller resolves strictly LESS access than an awaiting one, never more. Only CONFIRMED links in ACTIVE sets count, so a `suggested` row never widens a grant and a suspended or revoked set stops contributing at once.
+import { resolvePartition } from "../memory/partition.js";
+import { actingPrincipalId, bindFrom } from "../identity/binding.js";
+import { groupsForPrincipal } from "../identity/groups.js";
+import { tryPrincipalKey } from "../identity/principal-key.js";
+import { resolveLinkSet } from "../identity/link-store.js";
+import { sharedVaultSubject } from "../identity/oauth-vault-share.js";
+import { getConfig } from "./config.js";
+import { buildResolveRequest } from "./request.js";
+import { resolveAccess } from "./resolver.js";
+/** The link-set ids this account belongs to — at most ONE, by the store's `(org, platform, native_id)` primary key. Returns [] on any failure: a store outage degrades to "in no link-set-backed group" rather than aborting or widening the turn. */
+export async function callerLinkSets(org, platform, nativeId, tenant) {
+    try {
+        // Omitting `tenant` makes identity/link-tenant.ts fall back to the deployment's sole admitted workspace and THROW if it cannot name one. That lands in the catch as [] — the same fail-closed answer a store outage gets.
+        const set = await resolveLinkSet(org, platform, nativeId, tenant);
+        return set ? [set.id] : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Returns the org-scoped shared vault subject when the caller is a CONFIRMED member of an ACTIVE link-set, and `undefined` otherwise — unlinked, suggested, suspended, revoked, or any error — which keys the vault by the caller's own raw principal. DM-ONLY BY CALLER CONTRACT: the `mode === "dm"` check belongs to the caller, not to this function. */
+export async function sharedVaultSubjectFor(org, connector, platform, nativeId, tenant) {
+    void connector; // per-connector by contract (see doc); the derivation is link-level, not per-connector
+    try {
+        const sets = await callerLinkSets(org, platform, nativeId, tenant); // confirmed/active only, [] on error
+        const linkSetId = sets[0]; // at most one, by the store's PK (an account is exactly one person)
+        if (linkSetId === undefined)
+            return undefined; // unlinked / suggested / suspended / revoked → raw
+        return sharedVaultSubject(org, linkSetId);
+    }
+    catch {
+        return undefined; // fail-closed: any error resolves the caller's OWN raw-principal subject
+    }
+}
+/** Fills the caller's `principalLinkSets` and their link-set-backed `groups` from ONE read. DM-only deliberately, because a principal or group binding resolves nothing outside a DM; a request with no principalId, or a caller in no link-set, is returned unchanged. */
+export async function withLinkSetGroups(req, org, groups = getConfig().loadGroups?.() ?? []) {
+    if (req.mode !== "dm" || req.principalId === undefined)
+        return req;
+    // The request's OWN workspace completes the caller's account (OPE-309 phase 2) — a fact already in
+    // hand, so this path never falls back to config.
+    const sets = await callerLinkSets(org, req.platform, req.principalId, req.workspace);
+    if (sets.length === 0)
+        return req;
+    // C2.2: the caller's own confirmed set ids ride on the request so a `linkSet:<id>` principal
+    // binding can match. Always added when the caller is in a set — independent of the group registry.
+    let out = { ...req, principalLinkSets: [...new Set([...(req.principalLinkSets ?? []), ...sets])].sort() };
+    if (groups.length > 0) {
+        const viaSets = groupsForPrincipal(groups, tryPrincipalKey(req.platform, req.workspace, req.principalId), sets);
+        if (viaSets.length > 0)
+            out = { ...out, groups: [...new Set([...(req.groups ?? []), ...viaSets])].sort() };
+    }
+    return out;
+}
+export async function buildResolveRequestWithGroups(ctx) {
+    return withLinkSetGroups(buildResolveRequest(ctx), resolvePartition(ctx).org);
+}
+/** The ONLY form under which a link-set-backed `group` binding is effective. Identical to the synchronous form in every other respect, so switching a call site to it can only widen that site to the groups its caller is really in. */
+export async function resolveAccessForWithGroups(ctx) {
+    const cfg = getConfig();
+    // Fire-safety, mirrored from buildResolveRequest: an unattested turn has no acting principal, so
+    // it has no groups either — read here only to skip the store round-trip, never to change the answer.
+    const acting = actingPrincipalId(bindFrom(ctx));
+    const req = acting === undefined ? buildResolveRequest(ctx) : await buildResolveRequestWithGroups(ctx);
+    return resolveAccess(req, cfg.loadBundles(), cfg.loadBindings(), cfg.pluginRegistry, cfg.loadConnectorCredentials?.() ?? []);
+}
+//# sourceMappingURL=group-request.js.map

package/dist/agent/access/group-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-request.js","sourceRoot":"","sources":["../../../agent/access/group-request.ts"],"names":[],"mappings":"AAAA,gVAAgV;AAEhV,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAc,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,aAAa,EAA6C,MAAM,eAAe,CAAC;AAEzF,sPAAsP;AACtP,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,QAAgB,EAAE,QAAgB,EAAE,MAAe;IACnG,IAAI,CAAC;QACH,0NAA0N;QAC1N,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8VAA8V;AAC9V,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,SAAiB,EACjB,QAAgB,EAChB,QAAgB,EAChB,MAAe;IAEf,KAAK,SAAS,CAAC,CAAC,uFAAuF;IACvG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,qCAAqC;QACzG,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,oEAAoE;QAC/F,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC,CAAC,mDAAmD;QAClG,OAAO,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,yEAAyE;IAC7F,CAAC;AACH,CAAC;AAED,2QAA2Q;AAC3Q,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAmB,EACnB,GAAW,EACX,MAAM,GAAqB,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE;IAE3D,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACnE,mGAAmG;IACnG,iDAAiD;IACjD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,6FAA6F;IAC7F,mGAAmG;IACnG,IAAI,GAAG,GAAmB,EAAE,GAAG,GAAG,EAAE,iBAAiB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1H,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QAChH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,GAAoB;IACtE,OAAO,iBAAiB,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,yOAAyO;AACzO,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,GAAoB;IACnE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,iGAAiG;IACjG,qGAAqG;IACrG,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,6BAA6B,CAAC,GAAG,CAAC,CAAC;IACvG,OAAO,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/H,CAAC"}

package/dist/agent/access/halt-state.d.ts

@@ -0,0 +1,7 @@
+/** Stamp what this session's halt read answered. Fail-soft: outside a live eve context there is no
+ *  session state to stamp, and the projection's `null` default is the right answer there anyway. */
+export declare function stampHalted(halted: boolean): void;
+/** What the last halt read in THIS session answered, or `null` if none has run. A slot read that
+ *  throws (no eve context) is the same "no read has happened" answer. */
+export declare function currentHaltStamp(): boolean | null;
+//# sourceMappingURL=halt-state.d.ts.map

package/dist/agent/access/halt-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt-state.d.ts","sourceRoot":"","sources":["../../../agent/access/halt-state.ts"],"names":[],"mappings":"AAMA;oGACoG;AACpG,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAKjD;AAED;yEACyE;AACzE,wBAAgB,gBAAgB,IAAI,OAAO,GAAG,IAAI,CAMjD"}

package/dist/agent/access/halt-state.js

@@ -0,0 +1,23 @@
+// Stamps what this session's halt read answered, for the synchronous projection seam that cannot page the store itself. THREE values, not two: `null` means no read has happened in this session and reads as NOT halted, while `true` after a FAILED read is the fail-closed half. The egress arrows never read this slot — it is a cache for the one seam that cannot, and never the wall.
+import { defineState } from "eve/context";
+const slot = defineState("open-everywhere.halted", () => null);
+/** Stamp what this session's halt read answered. Fail-soft: outside a live eve context there is no
+ *  session state to stamp, and the projection's `null` default is the right answer there anyway. */
+export function stampHalted(halted) {
+    try {
+        slot.update(() => halted);
+    }
+    catch {
+    }
+}
+/** What the last halt read in THIS session answered, or `null` if none has run. A slot read that
+ *  throws (no eve context) is the same "no read has happened" answer. */
+export function currentHaltStamp() {
+    try {
+        return slot.get();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=halt-state.js.map

package/dist/agent/access/halt-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt-state.js","sourceRoot":"","sources":["../../../agent/access/halt-state.ts"],"names":[],"mappings":"AAAA,6XAA6X;AAE7X,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,IAAI,GAAG,WAAW,CAAiB,wBAAwB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/E;oGACoG;AACpG,MAAM,UAAU,WAAW,CAAC,MAAe;IACzC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;IACT,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/agent/access/halt.d.ts

@@ -0,0 +1,90 @@
+import { type BindableContext } from "../identity/binding.js";
+import type { HaltAddress, HaltRow } from "../operational/store.js";
+/** Every axis a covering halt row could be written against. A caller fills what it can NAME; an axis it leaves out is an axis no halt row can match there. */
+export interface HaltScope {
+    readonly org: string;
+    /** `platform/workspace/surface` — matches a `level: "surface"` row. */
+    readonly surfaceKey?: string;
+    /** `platform/workspace` — matches a `level: "workspace"` row. */
+    readonly workspaceKey?: string;
+    /** The domain NAME (unqualified — a domain spans tenants) — matches a `level: "domain"` row. */
+    readonly domain?: string;
+    /** `user:<principal-key>` (access/scope-key.ts) — matches a `level: "user"` row. */
+    readonly userScopeKey?: string;
+}
+/** `unreadable` is the fail-closed arm: the store could not be paged, so the call is treated as halted and the sentence names no address nobody set. */
+export type HaltState = {
+    readonly halted: false;
+} | {
+    readonly halted: true;
+    readonly row: HaltRow;
+    readonly unreadable?: undefined;
+} | {
+    readonly halted: true;
+    readonly row?: undefined;
+    readonly unreadable: string;
+};
+export declare const NOT_HALTED: HaltState;
+/** A UNION, never a ladder walk: the four levels are INDEPENDENT axes, so a call is halted if ANY covering row is active. The org-wide branch is first and reads no scope key, which keeps the org-wide marker from ever being a string a real domain could be named. */
+export declare function haltRowCovers(row: HaltRow, scope: HaltScope): boolean;
+/** The first covering row, or undefined. Pure, and shared by every arrow so no two planes disagree about what an address covers; the org-wide row wins when several cover, so a refusal names the widest true reason. */
+export declare function haltCovering(rows: readonly HaltRow[], scope: HaltScope): HaltRow | undefined;
+export interface HaltDeps {
+    readonly rows?: (org: string) => Promise<readonly HaltRow[]>;
+}
+/** Resolve the halt state for one call. FAIL-CLOSED: a store the arrow cannot read answers HALTED, and the resume path's fail-OPEN half is what makes that safe. */
+export declare function resolveHalt(scope: HaltScope, deps?: HaltDeps): Promise<HaltState>;
+/**
+ * For a call whose own address is unreadable, ANY active row in the org halts it: a kill switch fails closed on an address it cannot read, exactly as on a store it cannot read.
+ * Deliberately not the default. An arrow that CAN name its room must use resolveHalt, or an addressed halt becomes total.
+ */
+export declare function resolveHaltUnaddressed(org: string, deps?: HaltDeps): Promise<HaltState>;
+/** The ONE domain-axis resolver, shared so an arrow gets the axis by deriving its address at all and cannot forget it. Fail-soft: an unresolvable config leaves the domain axis ABSENT, never a guessed domain. */
+export declare function haltDomainForSurfaceKey(surfaceKey: string): string | undefined;
+/**
+ * The address derivable from a scope key plus an optional domain and acting principal; the scope key is read through the one grammar reader, never by hand.
+ * The person axis is only as wide as the key it can build: a bare-domain scope key carries none, so a `level: "user"` halt does not reach it, and a tenant key resolves no domain either.
+ */
+export declare function haltScopeFor(input: {
+    readonly org: string;
+    readonly scopeKey?: string;
+    readonly domain?: string | null;
+    /** A NATIVE person id, composed into a `user:` key against the scope key's platform/tenant. */
+    readonly principalId?: string;
+    /** An ALREADY-COMPOSED principal key (identity/principal-key.ts) — for the callers that hold one
+     *  (the grant broker does). Wins over `principalId`, and needs no platform to be namable. */
+    readonly principalKey?: string;
+}): HaltScope;
+/** The address context of a live session. Fail-soft on an unbindable context: the org falls back to the deployment's own and the finer axes are simply absent. It never throws, because an arrow's fail-closed decision belongs to the arrow. */
+export declare function haltScopeForCtx(ctx: BindableContext): HaltScope;
+/** The ONE place a loose (level, scopeKey, orgWide) triple becomes an address, so neither door can invent a fourth spelling. Throws on an ambiguous triple: naming both or neither is a caller bug. */
+export declare function haltAddressFromParts(parts: {
+    readonly orgWide?: boolean;
+    readonly level?: string;
+    readonly scopeKey?: string;
+}): HaltAddress;
+/** The address as the audit rows and the operator-facing answers spell it — ids and names only. */
+export declare function haltAddressFields(address: HaltAddress): Record<string, unknown>;
+/**
+ * ONE renderer, so every surface reports a halt the same way. Host-authored throughout, with no
+ * free-text reason on the row to inject one, and it names no scope key and no principal id — only
+ * the halt's WIDTH, which is the one fact a seat needs to describe the pause correctly.
+ *
+ * 🔴 IT DOES NOT TELL THE SEAT THAT READS ARE PAUSED, AND THAT MATTERS MORE THAN IT LOOKS
+ * (OPE-1758). The authorization doctrine defines a consequential act as one whose effect ESCAPES the
+ * conversation (access/consequence.ts), and a read does not — the enforcement agrees, letting a
+ * connector read through under a halt. The older wording ("no connector calls, no fetching from the
+ * internet… do not look for another way round it, and do not retry") said otherwise, and in
+ * soak-2026-09-12-a it was the FALSE INSTRUCTION behind the step-31 refusal: the seat declined a
+ * read-only pull-request question it could have answered by delegating, quoting this paragraph
+ * verbatim in all three of its worker prompts. So the paragraph now says what the code enforces, and
+ * says plainly that reading, replying and delegating a read are not ways round the pause.
+ */
+export declare function haltSeatParagraph(state: HaltState): string | null;
+/** The refusal sentence an arrow throws or returns, naming the plane it refused on. `what` is a
+ *  short host-authored noun phrase ("this action", "outbound network access"). */
+export declare function haltRefusalMessage(state: HaltState, what: string): string;
+/** The audit detail both refusal rows carry — IDS AND NAMES ONLY, never free text from a caller. */
+export declare function haltAuditDetail(state: HaltState): Record<string, unknown>;
+export type { HaltAddress, HaltRow };
+//# sourceMappingURL=halt.d.ts.map

package/dist/agent/access/halt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"halt.d.ts","sourceRoot":"","sources":["../../../agent/access/halt.ts"],"names":[],"mappings":"AAGA,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIvF,OAAO,KAAK,EAAY,WAAW,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAI9E,8JAA8J;AAC9J,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,wJAAwJ;AACxJ,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF,eAAO,MAAM,UAAU,EAAE,SAA6B,CAAC;AAEvD,yQAAyQ;AACzQ,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAarE;AAED,yNAAyN;AACzN,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAG5F;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;CAC9D;AAmBD,oKAAoK;AACpK,wBAAsB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAK3F;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,SAAS,CAAC,CAMjG;AAED,mNAAmN;AACnN,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM9E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;iGAC6F;IAC7F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,SAAS,CA8CZ;AAED,iPAAiP;AACjP,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,SAAS,CAQ/D;AAED,uMAAuM;AACvM,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAW5I;AAED,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE/E;AA8BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAgBjE;AAED;kFACkF;AAClF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAOzE;AAED,oGAAoG;AACpG,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzE;AAED,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC"}