@open-everywhere/core 0.1.0

package/dist/agent/access/live-delegated-tasks.js

@@ -0,0 +1,96 @@
+// A dispatch and any NON-TERMINAL task view arm an id; a terminal view clears it. Arming on a non-terminal sighting is the fail-closed direction, and only a SKIPPED persist spends a hold — the sandbox stop reader reads the set and must never mutate it.
+import { defineState } from "eve/context";
+import { TERMINAL_TASK_STATUSES } from "./background-tasks.js";
+/** How many flush ATTEMPTS one dispatched task may hold this session's memory tree closed; past this the id is retired. Four, read against the measured attempt rate in CI run 32086758859 — about two to four parent turns. */
+export const MAX_FLUSH_HOLDS = 4;
+/** The `defineState` key is FROZEN: it, not this module's path, is what makes a resumed session find the set it already had. The record is in-memory on purpose — a store read on a re-executable inline step body is how a session gets lost — and any unrecognised value reads as ZERO holds used, which re-arms the guard. */
+export const LIVE_DELEGATED_TASKS_STATE_KEY = "open-everywhere.memory.liveTasks";
+const liveTasks = defineState(LIVE_DELEGATED_TASKS_STATE_KEY, () => ({}));
+/** How many holds one recorded value has consumed. Anything unrecognised reads as `0` — see the
+ *  shape note on {@link liveTasks}. */
+function holdsUsed(v) {
+    return typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
+}
+/** Record that a delegation PARKED as a background task, so both readers count it live.
+ *  Fail-soft: a state-container blip degrades to "not counted", which is the same position this
+ *  session was in before the task existed. */
+export function armLiveTask(taskId) {
+    try {
+        if (taskId.length === 0)
+            return;
+        // ZERO holds used: a dispatch is fresh evidence, so it RE-ARMS the full bound even for an id a
+        // previous hold count had already retired.
+        liveTasks.update((t) => ({ ...t, [taskId]: 0 }));
+    }
+    catch {
+        /* an uncountable task degrades the guard to today's behaviour, never breaks the edge */
+    }
+}
+/** Terminal views clear and non-terminal views arm. It takes ALL views, not only the terminal ones, because a `working` sibling in the same peek is the sharpest evidence that another child still holds the tree. */
+export function noteTaskViews(views) {
+    try {
+        if (views.length === 0)
+            return;
+        liveTasks.update((t) => {
+            const next = { ...t };
+            for (const v of views) {
+                if (TERMINAL_TASK_STATUSES.includes(v.status))
+                    delete next[v.taskId];
+                else
+                    next[v.taskId] = 0;
+            }
+            return next;
+        });
+    }
+    catch {
+        /* same fail-soft as above */
+    }
+}
+/** Which delegated tasks this session believes are still live, in insertion order; an unreadable container answers an EMPTY list. A skip records the IDS rather than a count, because a count cannot tell the two ways the guard wedges apart. */
+export function liveTaskIds() {
+    try {
+        // EVERY key, with no bound applied here. {@link consumeFlushHold} DELETES an id at the bound,
+        // so a recorded id is by construction one that still holds. A second filter on this side would
+        // be dead code that reads like a second guard.
+        return Object.keys(liveTasks.get());
+    }
+    catch {
+        return [];
+    }
+}
+/** How many delegated tasks this session believes are still live. `0` ⇒ the flush may run, and the
+ *  sandbox stop may run. Fails to `0` on an unreadable container: the guard exists to prevent a torn
+ *  read, and an unreadable container carries no evidence that any task is running. */
+export function liveTaskCount() {
+    return liveTaskIds().length;
+}
+/** Spends one hold from every id a skip just named and returns the ids that used their last. Called from the SKIP branch of the flush and nowhere else, because a hold is what a skipped flush costs; an unreadable container retires nothing. */
+export function consumeFlushHold(ids) {
+    if (ids.length === 0)
+        return [];
+    let retired = [];
+    try {
+        liveTasks.update((t) => {
+            const next = { ...t };
+            const spent = [];
+            for (const id of ids) {
+                const used = holdsUsed(next[id]) + 1;
+                if (used >= MAX_FLUSH_HOLDS) {
+                    delete next[id];
+                    spent.push(id);
+                }
+                else {
+                    next[id] = used;
+                }
+            }
+            retired = spent;
+            return next;
+        });
+    }
+    catch {
+        /* the guard keeps holding — the same position as before this call */
+        retired = [];
+    }
+    return retired;
+}
+//# sourceMappingURL=live-delegated-tasks.js.map

package/dist/agent/access/live-delegated-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-delegated-tasks.js","sourceRoot":"","sources":["../../../agent/access/live-delegated-tasks.ts"],"names":[],"mappings":"AAAA,6PAA6P;AAE7P,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAoB,MAAM,uBAAuB,CAAC;AAEjF,gOAAgO;AAChO,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,iUAAiU;AACjU,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAC;AAEjF,MAAM,SAAS,GAAG,WAAW,CAAyB,8BAA8B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAElG;uCACuC;AACvC,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;8CAE8C;AAC9C,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,+FAA+F;QAC/F,2CAA2C;QAC3C,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC;AAED,sNAAsN;AACtN,MAAM,UAAU,aAAa,CAAC,KAA6B;IACzD,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;;oBAChE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;AACH,CAAC;AAED,kPAAkP;AAClP,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,8FAA8F;QAC9F,+FAA+F;QAC/F,+CAA+C;QAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;sFAEsF;AACtF,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED,kPAAkP;AAClP,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,OAAO,GAAsB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,IAAI,IAAI,eAAe,EAAE,CAAC;oBAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;oBAChB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/agent/access/loop-breaker.d.ts

@@ -0,0 +1,26 @@
+/** The Nth identical result in a turn that first earns an advisory nudge. Two sightings can be a
+ *  benign coincidence (two related reads); a THIRD identical result in one turn is a clear spin. */
+export declare const REPEAT_NUDGE_THRESHOLD = 3;
+/** The Nth identical result that escalates to a hard stop-now directive — a pathological loop the
+ *  model must break out of immediately. Comfortably below the per-turn step boundary so the legible
+ *  nudge lands first. */
+export declare const REPEAT_HARD_THRESHOLD = 5;
+/** A cheap, dependency-free 32-bit FNV-1a hash over a bounded prefix + the full length. Pure. */
+export declare function hashResultBody(body: string): string;
+/** The per-turn counter key: tool identity (source) + a hash of the result body. A different source
+ *  (a different page/channel/tool) or a different body lands on its own counter. Pure. */
+export declare function loopKey(source: string | undefined, body: string): string;
+/** Increment (in the given map) the counter for this (source, body) and return the new count. Pure
+ *  — the session-backed {@link noteToolResultLoop} delegates here so the counting logic is testable
+ *  without an eve context. */
+export declare function recordAndCount(counts: Map<string, number>, source: string | undefined, body: string): number;
+/** The nudge (if any) to append to the result given its running count this turn. Pure. Returns null
+ *  below the nudge threshold (byte-identical to no guard), a soft advisory at
+ *  {@link REPEAT_NUDGE_THRESHOLD}, and a hard stop-now directive at {@link REPEAT_HARD_THRESHOLD}. */
+export declare function nudgeForCount(source: string | undefined, count: number): string | null;
+/** Record one tool result and return the nudge to APPEND after it, or null. Session-scoped and reset per turn by hooks/loop-breaker.ts; with no eve context it is treated as a first sighting, so it never nudges and never throws. */
+export declare function noteToolResultLoop(source: string | undefined, body: string): string | null;
+/** Clear the per-turn counters — called by the turn.started hook so each turn starts fresh (the
+ *  per-turn scope guarantee). Fail-soft outside a session context. */
+export declare function resetLoopBreakerTurn(): void;
+//# sourceMappingURL=loop-breaker.d.ts.map

package/dist/agent/access/loop-breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loop-breaker.d.ts","sourceRoot":"","sources":["../../../agent/access/loop-breaker.ts"],"names":[],"mappings":"AAIA;oGACoG;AACpG,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;yBAEyB;AACzB,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAOvC,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED;0FAC0F;AAC1F,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;8BAE8B;AAC9B,wBAAgB,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5G;AAED;;sGAEsG;AACtG,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBtF;AAID,uOAAuO;AACvO,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1F;AAED;sEACsE;AACtE,wBAAgB,oBAAoB,IAAI,IAAI,CAK3C"}

package/dist/agent/access/loop-breaker.js

@@ -0,0 +1,77 @@
+// Counts identical (tool source, result body) pairs inside ONE turn and appends an advisory nudge past the thresholds. The scope is PER TURN — the turn.started hook resets the counters, so a legitimate poll on later turns never trips it — and the guard only ever APPENDS text, never blocking or dropping a result. Fail-soft: with no eve session context every call is a first sighting, so the guard is byte-identical to not existing.
+import { defineState } from "eve/context";
+/** The Nth identical result in a turn that first earns an advisory nudge. Two sightings can be a
+ *  benign coincidence (two related reads); a THIRD identical result in one turn is a clear spin. */
+export const REPEAT_NUDGE_THRESHOLD = 3;
+/** The Nth identical result that escalates to a hard stop-now directive — a pathological loop the
+ *  model must break out of immediately. Comfortably below the per-turn step boundary so the legible
+ *  nudge lands first. */
+export const REPEAT_HARD_THRESHOLD = 5;
+/** Only the first this-many chars of a body feed the hash (with the full length) — bounds the cost
+ *  of hashing a large result to O(1) while still uniquely fingerprinting a deterministic-failing
+ *  body (a repeated failure returns byte-identical content, so a prefix + length collide exactly). */
+const HASH_PREFIX_CHARS = 4096;
+/** A cheap, dependency-free 32-bit FNV-1a hash over a bounded prefix + the full length. Pure. */
+export function hashResultBody(body) {
+    const sample = body.length > HASH_PREFIX_CHARS ? body.slice(0, HASH_PREFIX_CHARS) : body;
+    let h = 0x811c9dc5;
+    for (let i = 0; i < sample.length; i++) {
+        h ^= sample.charCodeAt(i);
+        h = (h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24))) >>> 0;
+    }
+    return `${body.length.toString(16)}:${h.toString(16)}`;
+}
+/** The per-turn counter key: tool identity (source) + a hash of the result body. A different source
+ *  (a different page/channel/tool) or a different body lands on its own counter. Pure. */
+export function loopKey(source, body) {
+    return `${source ?? ""} ${hashResultBody(body)}`;
+}
+/** Increment (in the given map) the counter for this (source, body) and return the new count. Pure
+ *  — the session-backed {@link noteToolResultLoop} delegates here so the counting logic is testable
+ *  without an eve context. */
+export function recordAndCount(counts, source, body) {
+    const key = loopKey(source, body);
+    const next = (counts.get(key) ?? 0) + 1;
+    counts.set(key, next);
+    return next;
+}
+/** The nudge (if any) to append to the result given its running count this turn. Pure. Returns null
+ *  below the nudge threshold (byte-identical to no guard), a soft advisory at
+ *  {@link REPEAT_NUDGE_THRESHOLD}, and a hard stop-now directive at {@link REPEAT_HARD_THRESHOLD}. */
+export function nudgeForCount(source, count) {
+    if (count < REPEAT_NUDGE_THRESHOLD)
+        return null;
+    const what = source ? `\`${source}\`` : "this tool";
+    if (count >= REPEAT_HARD_THRESHOLD) {
+        return (`⛔ LOOP BREAKER: ${what} has now returned the IDENTICAL result ${count} times this turn — ` +
+            `it is deterministically failing and CANNOT change by retrying. STOP calling it. End your turn ` +
+            `now: report the failure (what you tried, why it can't succeed here) to the person, or answer ` +
+            `from what you already have. Do not call ${what} again this turn.`);
+    }
+    return (`⚠️ LOOP BREAKER: ${what} has returned the same result ${count} times this turn — it looks ` +
+        `deterministic-failing, so retrying it will not help. Stop retrying; report the blocker or ` +
+        `proceed with what you have instead.`);
+}
+const slot = defineState("open-everywhere.loop-breaker-turn", () => null);
+/** Record one tool result and return the nudge to APPEND after it, or null. Session-scoped and reset per turn by hooks/loop-breaker.ts; with no eve context it is treated as a first sighting, so it never nudges and never throws. */
+export function noteToolResultLoop(source, body) {
+    try {
+        const counts = slot.get() ?? new Map();
+        const count = recordAndCount(counts, source, body);
+        slot.update(() => counts);
+        return nudgeForCount(source, count);
+    }
+    catch {
+        return null; // no session context (render path / test / sessionless eval) — no tracking, no nudge
+    }
+}
+/** Clear the per-turn counters — called by the turn.started hook so each turn starts fresh (the
+ *  per-turn scope guarantee). Fail-soft outside a session context. */
+export function resetLoopBreakerTurn() {
+    try {
+        slot.update(() => new Map());
+    }
+    catch {
+    }
+}
+//# sourceMappingURL=loop-breaker.js.map

package/dist/agent/access/loop-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loop-breaker.js","sourceRoot":"","sources":["../../../agent/access/loop-breaker.ts"],"names":[],"mappings":"AAAA,ibAAib;AAEjb,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;oGACoG;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAExC;;yBAEyB;AACzB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;sGAEsG;AACtG,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,OAAO,CAAC,MAA0B,EAAE,IAAY;IAC9D,OAAO,GAAG,MAAM,IAAI,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;8BAE8B;AAC9B,MAAM,UAAU,cAAc,CAAC,MAA2B,EAAE,MAA0B,EAAE,IAAY;IAClG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;sGAEsG;AACtG,MAAM,UAAU,aAAa,CAAC,MAA0B,EAAE,KAAa;IACrE,IAAI,KAAK,GAAG,sBAAsB;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IACpD,IAAI,KAAK,IAAI,qBAAqB,EAAE,CAAC;QACnC,OAAO,CACL,mBAAmB,IAAI,0CAA0C,KAAK,qBAAqB;YAC3F,gGAAgG;YAChG,+FAA+F;YAC/F,2CAA2C,IAAI,mBAAmB,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,CACL,oBAAoB,IAAI,iCAAiC,KAAK,8BAA8B;QAC5F,4FAA4F;QAC5F,qCAAqC,CACtC,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,WAAW,CAA6B,mCAAmC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAEtG,uOAAuO;AACvO,MAAM,UAAU,kBAAkB,CAAC,MAA0B,EAAE,IAAY;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,EAAkB,CAAC;QACvD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,qFAAqF;IACpG,CAAC;AACH,CAAC;AAED;sEACsE;AACtE,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;IACT,CAAC;AACH,CAAC"}

package/dist/agent/access/mcp-call-fence.d.ts

@@ -0,0 +1,19 @@
+import type { FetchLike } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { GrantUndispatchedError } from "../operational/credential-grant-rows.js";
+/** What ONE grant row lends. Every field is pinned when the grant is minted, never per call. */
+export interface McpBorrowPin {
+    /** The URL host (with port, when the URL carries one) of the connection's `directUrl`. */
+    readonly host: string;
+    /** The vendor tool name, exact bytes — the row's tool column (PR 2), never the mounted name. */
+    readonly tool: string;
+    /** The arguments the grant freezes. May be empty; every key here is enforced on every call. */
+    readonly frozenArgs: Readonly<Record<string, unknown>>;
+}
+/** A fence refusal, raised BEFORE `base` is called, so the refused request was never sent — which lets the broker refund a once-mode grant. It does not mean the vendor was untouched: the SDK handshake already ran. */
+export declare class McpCallFenceError extends GrantUndispatchedError {
+}
+/** Structural equality over JSON values: key order does not matter, array order does, and `Object.is` at the leaves, so a mismatched type never compares equal. */
+export declare function deepEqualJson(a: unknown, b: unknown): boolean;
+/** Wrap `base` so every request it carries must be the borrow this pin describes. Throws McpCallFenceError at BUILD time on a pin that cannot be enforced, and at CALL time on any request that fails the ladder. */
+export declare function fenceMcpBorrowFetch(pin: McpBorrowPin, base: FetchLike): FetchLike;
+//# sourceMappingURL=mcp-call-fence.d.ts.map

package/dist/agent/access/mcp-call-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-call-fence.d.ts","sourceRoot":"","sources":["../../../agent/access/mcp-call-fence.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAiB,MAAM,yCAAyC,CAAC;AAEhG,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+FAA+F;IAC/F,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACxD;AAED,yNAAyN;AACzN,qBAAa,iBAAkB,SAAQ,sBAAsB;CAAG;AAmBhE,mKAAmK;AACnK,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAY7D;AAgCD,qNAAqN;AACrN,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,CAiGjF"}

package/dist/agent/access/mcp-call-fence.js

@@ -0,0 +1,180 @@
+// The MCP borrow fence — OE's own `fetch` under the SDK transport, and the only control on a borrow's arguments. It admits https to the pinned host with `redirect: "error"`, POST or DELETE only (GET would open the server-initiated SSE channel), one JSON object on a five-method allowlist, and a `tools/call` naming the pinned tool with every frozen argument deep-equal; anything else fails CLOSED.
+import { GrantUndispatchedError, quotedPurpose } from "../operational/credential-grant-rows.js";
+/** A fence refusal, raised BEFORE `base` is called, so the refused request was never sent — which lets the broker refund a once-mode grant. It does not mean the vendor was untouched: the SDK handshake already ran. */
+export class McpCallFenceError extends GrantUndispatchedError {
+}
+/** The JSON-RPC methods a borrow may send: the handshake pair, the SDK's `ping`, the approve-time `tools/list`, and `tools/call`. Nothing else is a borrow. */
+const ALLOWED_JSONRPC_METHODS = new Set([
+    "initialize",
+    "notifications/initialized",
+    "ping",
+    "tools/list",
+    "tools/call",
+]);
+/** The only keys `tools/call` params may carry. An unknown key is refused rather than passed through, because a key this fence does not read is a key it cannot bound. */
+const TOOLS_CALL_PARAM_KEYS = new Set(["name", "arguments", "_meta"]);
+/** A JSON object — not an array, not `null`. The shape every check below is written against. */
+function isJsonRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Structural equality over JSON values: key order does not matter, array order does, and `Object.is` at the leaves, so a mismatched type never compares equal. */
+export function deepEqualJson(a, b) {
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        return a.every((element, i) => deepEqualJson(element, b[i]));
+    }
+    if (isJsonRecord(a) || isJsonRecord(b)) {
+        if (!isJsonRecord(a) || !isJsonRecord(b))
+            return false;
+        const keysA = Object.keys(a);
+        if (keysA.length !== Object.keys(b).length)
+            return false;
+        return keysA.every((key) => Object.hasOwn(b, key) && deepEqualJson(a[key], b[key]));
+    }
+    return Object.is(a, b);
+}
+/** Render an untrusted label for a refusal message under the same quoted-data discipline the approval card gives a model-authored purpose. Values are NEVER rendered — only keys and names. */
+function label(value) {
+    if (typeof value === "string")
+        return quotedPurpose(value);
+    let rendered;
+    try {
+        // `JSON.stringify` throws on a circular value or a BigInt. Nothing that reaches here can be
+        // either, but a refusal message must never be the thing that raises a non-fence error.
+        rendered = JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return "unrenderable";
+    }
+    return quotedPurpose(rendered);
+}
+/** Deep-copy one JSON value, refusing anything that is not one. Two jobs: it VALIDATES the pin, since a value the fence cannot compare is a pin it cannot enforce, and it SNAPSHOTS it against a later mutation. */
+function cloneJsonPinValue(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string")
+        return value;
+    if (Array.isArray(value))
+        return value.map((element) => cloneJsonPinValue(element));
+    // Plain objects only: copying a `Date` or a class instance by its own enumerable keys would silently turn it into `{}`, a pin that enforces nothing.
+    const proto = typeof value === "object" ? Object.getPrototypeOf(value) : undefined;
+    if (isJsonRecord(value) && (proto === Object.prototype || proto === null)) {
+        const copy = {};
+        for (const key of Object.keys(value))
+            copy[key] = cloneJsonPinValue(value[key]);
+        return copy;
+    }
+    throw new McpCallFenceError("mcp-call-fence: a frozen argument is not a JSON value — refusing to build a fence on a pin it cannot compare.");
+}
+/** Wrap `base` so every request it carries must be the borrow this pin describes. Throws McpCallFenceError at BUILD time on a pin that cannot be enforced, and at CALL time on any request that fails the ladder. */
+export function fenceMcpBorrowFetch(pin, base) {
+    // A pin this fence cannot read is a pin it cannot enforce. Refusing to BUILD is the fail-closed direction; the alternative allows everything on a misconfigured row.
+    if (typeof pin.host !== "string" || pin.host.trim() === "") {
+        throw new McpCallFenceError("mcp-call-fence: the pin names no host — refusing to build a fence that cannot check one.");
+    }
+    if (typeof pin.tool !== "string" || pin.tool === "") {
+        throw new McpCallFenceError("mcp-call-fence: the pin names no tool — refusing to build a fence that cannot check one.");
+    }
+    if (!isJsonRecord(pin.frozenArgs)) {
+        throw new McpCallFenceError("mcp-call-fence: the pin's frozen arguments are not a JSON object — refusing to build.");
+    }
+    // Snapshot, not a reference: compose owns the row object, and a fence reading the live object could be moved by the same bug it exists to catch. `URL.host` is lower-cased by the parser, so the pin is lower-cased once here.
+    const pinnedHost = pin.host.trim().toLowerCase();
+    const pinnedTool = pin.tool;
+    const frozenArgs = cloneJsonPinValue(pin.frozenArgs);
+    const frozenKeys = Object.keys(frozenArgs);
+    const boundary = `the grant lends only \`${label(pinnedTool)}\` on \`${pinnedHost}\``;
+    // The explicit `never` return annotation is load-bearing: TypeScript narrows control flow after a call only for an annotated const, which is what lets every check below read as `if (bad) refuse(...)`.
+    const refuse = (reason) => {
+        // Say "this request was not sent", never "the vendor was not dialled": a `tools/call` refusal arrives after the SDK has already handshaken with the vendor under the owner's token.
+        throw new McpCallFenceError(`mcp-call-fence: ${reason} — ${boundary}; this request was not sent.`);
+    };
+    return async (url, init) => {
+        const href = typeof url === "string" ? url : url instanceof URL ? url.href : undefined;
+        if (href === undefined)
+            refuse("the request URL is neither a string nor a URL");
+        let parsed;
+        try {
+            parsed = new URL(href);
+        }
+        catch {
+            parsed = undefined;
+        }
+        if (parsed === undefined)
+            refuse("the request URL does not parse");
+        if (parsed.protocol !== "https:")
+            refuse(`the request scheme is \`${label(parsed.protocol)}\`, not https`);
+        if (parsed.host !== pinnedHost)
+            refuse(`the request host is \`${label(parsed.host)}\``);
+        const rawMethod = init?.method;
+        if (rawMethod !== undefined && typeof rawMethod !== "string")
+            refuse("the request method is not a string");
+        const method = (typeof rawMethod === "string" ? rawMethod : "GET").toUpperCase();
+        if (method === "GET") {
+            refuse("GET opens the server-initiated SSE stream, which a borrow never needs");
+        }
+        if (method !== "POST" && method !== "DELETE")
+            refuse(`the request method \`${label(method)}\` is not POST or DELETE`);
+        // A 3xx is followed inside `base` and never re-enters this wrapper, so a redirect would replay the borrow at a host the pin never admitted.
+        const fenced = { ...init, redirect: "error" };
+        const body = init?.body;
+        if (method === "DELETE") {
+            // Session teardown carries no body. A DELETE that grew one is a shape this fence cannot read.
+            if (body !== undefined && body !== null)
+                refuse("the session-teardown DELETE carries a body");
+            return base(url, fenced);
+        }
+        if (typeof body !== "string")
+            refuse("the POST body is not a JSON string");
+        let message;
+        let parseFailed = false;
+        try {
+            message = JSON.parse(body);
+        }
+        catch {
+            parseFailed = true;
+        }
+        if (parseFailed)
+            refuse("the POST body does not parse as JSON");
+        if (Array.isArray(message))
+            refuse("the POST body is a JSON-RPC batch, which a borrow never sends");
+        if (!isJsonRecord(message))
+            refuse("the POST body is not a single JSON object");
+        const jsonRpcMethod = message["method"];
+        // A RESPONSE to a server-initiated request (sampling, elicitation) carries `result`/`error` and
+        // no `method`. It is refused here, by the same rule that refuses an unknown method name.
+        if (typeof jsonRpcMethod !== "string")
+            refuse("the POST body names no JSON-RPC method");
+        if (!ALLOWED_JSONRPC_METHODS.has(jsonRpcMethod)) {
+            refuse(`the JSON-RPC method \`${label(jsonRpcMethod)}\` is not one a borrow may send`);
+        }
+        if (jsonRpcMethod === "tools/call") {
+            const params = message["params"];
+            if (!isJsonRecord(params))
+                refuse("the tools/call carries no params object");
+            for (const key of Object.keys(params)) {
+                if (!TOOLS_CALL_PARAM_KEYS.has(key))
+                    refuse(`the tools/call params carry the unread key \`${label(key)}\``);
+            }
+            if (params["name"] !== pinnedTool)
+                refuse(`the tools/call names the tool \`${label(params["name"])}\``);
+            const args = params["arguments"];
+            if (args !== undefined && !isJsonRecord(args))
+                refuse("the tools/call arguments are not a JSON object");
+            if (frozenKeys.length > 0) {
+                if (!isJsonRecord(args)) {
+                    refuse(`the grant freezes ${frozenKeys.length} argument(s) and the tools/call carries no arguments object`);
+                }
+                for (const key of frozenKeys) {
+                    if (!Object.hasOwn(args, key))
+                        refuse(`the frozen argument \`${label(key)}\` is absent from the tools/call`);
+                    if (!deepEqualJson(args[key], frozenArgs[key])) {
+                        refuse(`the frozen argument \`${label(key)}\` does not match the value the grant froze`);
+                    }
+                }
+            }
+        }
+        // The vendor receives the body the fence READ, re-serialised: a parser differential such as duplicate keys could otherwise let it act on a call this ladder never approved.
+        return base(url, { ...fenced, body: JSON.stringify(message) });
+    };
+}
+//# sourceMappingURL=mcp-call-fence.js.map

package/dist/agent/access/mcp-call-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-call-fence.js","sourceRoot":"","sources":["../../../agent/access/mcp-call-fence.ts"],"names":[],"mappings":"AAAA,8YAA8Y;AAG9Y,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAYhG,yNAAyN;AACzN,MAAM,OAAO,iBAAkB,SAAQ,sBAAsB;CAAG;AAEhE,+JAA+J;AAC/J,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,YAAY;IACZ,2BAA2B;IAC3B,MAAM;IACN,YAAY;IACZ,YAAY;CACb,CAAC,CAAC;AAEH,0KAA0K;AAC1K,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,gGAAgG;AAChG,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,mKAAmK;AACnK,MAAM,UAAU,aAAa,CAAC,CAAU,EAAE,CAAU;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAClF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,+LAA+L;AAC/L,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,4FAA4F;QAC5F,uFAAuF;QACvF,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,oNAAoN;AACpN,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACpF,qJAAqJ;IACrJ,MAAM,KAAK,GAAY,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,iBAAiB,CACzB,+GAA+G,CAChH,CAAC;AACJ,CAAC;AAED,qNAAqN;AACrN,MAAM,UAAU,mBAAmB,CAAC,GAAiB,EAAE,IAAe;IACpE,qKAAqK;IACrK,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,iBAAiB,CAAC,0FAA0F,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,iBAAiB,CAAC,0FAA0F,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CAAC,uFAAuF,CAAC,CAAC;IACvH,CAAC;IACD,+NAA+N;IAC/N,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;IAC5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAA4B,CAAC;IAChF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,0BAA0B,KAAK,CAAC,UAAU,CAAC,WAAW,UAAU,IAAI,CAAC;IACtF,yMAAyM;IACzM,MAAM,MAAM,GAA8B,CAAC,MAAM,EAAE,EAAE;QACnD,oLAAoL;QACpL,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,MAAM,MAAM,QAAQ,8BAA8B,CAAC,CAAC;IACrG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,+CAA+C,CAAC,CAAC;QAChF,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,CAAC,2BAA2B,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC3G,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,MAAM,CAAC,yBAAyB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExF,MAAM,SAAS,GAAG,IAAI,EAAE,MAAM,CAAC;QAC/B,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACjF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,MAAM,CAAC,uEAAuE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,wBAAwB,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAEtH,4IAA4I;QAC5I,MAAM,MAAM,GAAgB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAE3D,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACxB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,8FAA8F;YAC9F,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,CAAC,4CAA4C,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,oCAAoC,CAAC,CAAC;QAC3E,IAAI,OAAgB,CAAC;QACrB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,WAAW;YAAE,MAAM,CAAC,sCAAsC,CAAC,CAAC;QAChE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,+DAA+D,CAAC,CAAC;QACpG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,gGAAgG;QAChG,yFAAyF;QACzF,IAAI,OAAO,aAAa,KAAK,QAAQ;YAAE,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACxF,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,yBAAyB,KAAK,CAAC,aAAa,CAAC,iCAAiC,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,yCAAyC,CAAC,CAAC;YAC7E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,gDAAgD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9G,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU;gBAAE,MAAM,CAAC,mCAAmC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;YAExG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,gDAAgD,CAAC,CAAC;YACxG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,qBAAqB,UAAU,CAAC,MAAM,6DAA6D,CAAC,CAAC;gBAC9G,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;wBAAE,MAAM,CAAC,yBAAyB,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;oBAC7G,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBAC/C,MAAM,CAAC,yBAAyB,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;oBAC3F,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,4KAA4K;QAC5K,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC;AACJ,CAAC"}

package/dist/agent/access/member-grant.d.ts

@@ -0,0 +1,16 @@
+import { type CredentialBoundDomain } from "./domain-credentials.js";
+/** The credential id this domain's MEMBER surface runs under for `connector`, or `undefined` when it holds no member grant. NO FALLBACK — `undefined` never means "use the org default". `memberRole` is the provider's personal-credential id in its catalogue, the ROLE the declaration names. */
+export declare function memberGrantCredential(domain: CredentialBoundDomain | undefined, connector: string, memberRole: string): string | undefined;
+export interface MemberRole {
+    readonly connector: string;
+    readonly role: string;
+}
+/** The (connector, member-role) pairs read as a member grant — the only place core enumerates vendors on this plane. Naming a role here grants nothing, but a domain that overrides that exact (connector, credential) pair for ANY purpose gains the member grant as a side effect, so extend this list in the SAME diff that adds the catalogue credential. */
+export declare const MEMBER_ROLES: readonly MemberRole[];
+/** The key a member-plane grant is carried by, through the pure resolver: `<connector>/<credentialId>`.
+ *  ONE spelling, produced here and consumed by access/connector-credentials.ts `expandConnectorGrant`
+ *  — a second spelling is how a gate and a router come to disagree about the same grant. */
+export declare function memberGrantKey(connector: string, credentialId: string): string;
+/** Every member-plane grant these domains hold, as {@link memberGrantKey} strings — the precomputed input the pure resolver reads. A LIST, because a surface can resolve into several domains. It is a grant SET and never an admission: `expandConnectorGrant` and the per-turn controls still run after it. */
+export declare function memberPlaneGrants(domains: readonly (CredentialBoundDomain | undefined)[]): readonly string[];
+//# sourceMappingURL=member-grant.d.ts.map

package/dist/agent/access/member-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-grant.d.ts","sourceRoot":"","sources":["../../../agent/access/member-grant.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAE5F,oSAAoS;AACpS,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAKpB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iWAAiW;AACjW,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAG7C,CAAC;AAEF;;4FAE4F;AAC5F,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,iTAAiT;AACjT,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,qBAAqB,GAAG,SAAS,CAAC,EAAE,GAAG,SAAS,MAAM,EAAE,CAS5G"}

package/dist/agent/access/member-grant.js

@@ -0,0 +1,34 @@
+// A domain declares the MEMBER role in its own `Domain.credentials`, and that declaration IS the grant. NO FALLBACK, unlike `domainCredentialId`: a domain that declares nothing holds no member grant, so absence is a refusal rather than the org default. Holding the grant admits NOTHING on its own — access/member-plane.ts still requires the arming flag, a single verified requester, an internal room and a read-tier op.
+import { credentialOverrideFor } from "./domain-credentials.js";
+/** The credential id this domain's MEMBER surface runs under for `connector`, or `undefined` when it holds no member grant. NO FALLBACK — `undefined` never means "use the org default". `memberRole` is the provider's personal-credential id in its catalogue, the ROLE the declaration names. */
+export function memberGrantCredential(domain, connector, memberRole) {
+    const declared = credentialOverrideFor(domain, connector, memberRole);
+    if (!declared)
+        return undefined;
+    // `use` is validated non-empty at boot (domainCredentialProblems), so this is the declared id.
+    return declared.use;
+}
+/** The (connector, member-role) pairs read as a member grant — the only place core enumerates vendors on this plane. Naming a role here grants nothing, but a domain that overrides that exact (connector, credential) pair for ANY purpose gains the member grant as a side effect, so extend this list in the SAME diff that adds the catalogue credential. */
+export const MEMBER_ROLES = [
+    // Notion's personal credential. GitHub declares one too and is deliberately ABSENT: Tommy ruled on 2026-09-08 that a member's own GitHub credential may surface org-invisible reads only in that member's DM, never into a shared room. The entry test is "the operator may admit this credential into a SHARED ROOM", not "it is a user principal".
+    { connector: "notion", role: "user-oauth" },
+];
+/** The key a member-plane grant is carried by, through the pure resolver: `<connector>/<credentialId>`.
+ *  ONE spelling, produced here and consumed by access/connector-credentials.ts `expandConnectorGrant`
+ *  — a second spelling is how a gate and a router come to disagree about the same grant. */
+export function memberGrantKey(connector, credentialId) {
+    return `${connector}/${credentialId}`;
+}
+/** Every member-plane grant these domains hold, as {@link memberGrantKey} strings — the precomputed input the pure resolver reads. A LIST, because a surface can resolve into several domains. It is a grant SET and never an admission: `expandConnectorGrant` and the per-turn controls still run after it. */
+export function memberPlaneGrants(domains) {
+    const out = new Set();
+    for (const domain of domains) {
+        for (const m of MEMBER_ROLES) {
+            const credential = memberGrantCredential(domain, m.connector, m.role);
+            if (credential !== undefined)
+                out.add(memberGrantKey(m.connector, credential));
+        }
+    }
+    return [...out].sort();
+}
+//# sourceMappingURL=member-grant.js.map

package/dist/agent/access/member-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-grant.js","sourceRoot":"","sources":["../../../agent/access/member-grant.ts"],"names":[],"mappings":"AAAA,oaAAoa;AAEpa,OAAO,EAAE,qBAAqB,EAA8B,MAAM,yBAAyB,CAAC;AAE5F,oSAAoS;AACpS,MAAM,UAAU,qBAAqB,CACnC,MAAyC,EACzC,SAAiB,EACjB,UAAkB;IAElB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,+FAA+F;IAC/F,OAAO,QAAQ,CAAC,GAAG,CAAC;AACtB,CAAC;AAOD,iWAAiW;AACjW,MAAM,CAAC,MAAM,YAAY,GAA0B;IACjD,qVAAqV;IACrV,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;CAC5C,CAAC;AAEF;;4FAE4F;AAC5F,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,YAAoB;IACpE,OAAO,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;AACxC,CAAC;AAED,iTAAiT;AACjT,MAAM,UAAU,iBAAiB,CAAC,OAAuD;IACvF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACtE,IAAI,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/agent/access/member-plane.d.ts

@@ -0,0 +1,91 @@
+/** The op tiers access/connector-op-gating.ts classifies a connector op into. Repeated structurally
+ *  rather than imported so this module stays a leaf (the same reason CapLevel lives where it does). */
+export type MemberPlaneOpTier = "read" | "write" | "destructive";
+/** What access/requester-identity.ts said about who asked — the shape this module reads, structurally,
+ *  so the join is testable without an eve session. `requester` is the ONLY admitting kind. */
+export type MemberPlaneRequester = {
+    readonly kind: "requester";
+    readonly principalId: string;
+} | {
+    readonly kind: "unverified";
+} | {
+    readonly kind: "none";
+};
+/** Every input the member-plane decision reads. All explicit; the module resolves nothing itself. */
+export interface MemberPlaneInput {
+    /** G1a — `connectors.memberPlane`. Default OFF. */
+    readonly armed: boolean;
+    /** G1b — `connectors.opTiering`. Default OFF, and REQUIRED: G5 is enforced at the per-op approval
+     *  seam, which only runs when tiering is armed. See this file's G1 note. */
+    readonly opTiered: boolean;
+    /** G2 — the caller's domain declared this connector's member role (access/member-grant.ts). */
+    readonly granted: boolean;
+    /** G3 — this turn's requester verdict (access/requester-identity.ts `requesterThisTurn`). */
+    readonly requester: MemberPlaneRequester;
+    /** G4a — the wake carried a non-member author's bytes (OE_CHAT_NONMEMBER_ATTR was stamped). */
+    readonly nonMemberWake: boolean;
+    /** It is `declaredTrust === "internal" && trust === "internal"`, never the trust JOIN alone: the platform mapper wins that join and grades every ordinary Slack channel internal with nobody vouched for. The second conjunct is the DEMOTION — a declaration matches at any rung, so without it a tenant-grain line would re-promote a channel the platform reported as externally shared. REQUIRED, and false on every unresolvable input. */
+    readonly roomVouchedInternal: boolean;
+    /** The tier of the op being attempted, or undefined when the site is not per-op — the credential RESOLVE, which happens before any op is named. undefined ADMITS: the resolve performs no op, and the per-op site runs this same verdict again with the tier in hand. */
+    readonly opTier?: MemberPlaneOpTier;
+}
+/** Why the member plane refused — the `reason` value the `connector.refused` audit row carries. ONE
+ *  vocabulary, so a refusal in the log names the gate that produced it. */
+export type MemberPlaneRefusal = "member_plane_disarmed" | "member_plane_untiered" | "member_plane_ungranted" | "member_plane_unverified_requester" | "member_plane_nonmember_wake" | "member_plane_write";
+/** The decision. `admit: true` carries the principal the personal token must be minted FOR — never a
+ *  bare boolean, so a caller cannot admit the plane and then mint for somebody else. */
+export type MemberPlaneVerdict = {
+    readonly admit: true;
+    readonly requesterPrincipalId: string;
+} | {
+    readonly admit: false;
+    readonly reason: MemberPlaneRefusal;
+};
+/** Admits only when every gate holds; otherwise it names the FIRST gate that refused, in a fixed order. The admitting arm carries `requesterPrincipalId`, the id the mint must key its vault subject on, so the admission and the identity it admitted can never disagree — the mint site's own acting-principal read answers a different question on a shared window. */
+export declare function memberPlaneVerdict(input: MemberPlaneInput): MemberPlaneVerdict;
+/** G4b's derivation, in one place, so the mint site cannot spell it a second way. Both conjuncts are load-bearing: the declaration is the operator's vouch, and the trust join is what keeps a coarse tenant declaration from re-promoting a positively-external room. Every unresolvable input answers false, and the parameters are strings so an unexpected value refuses instead of type-erroring. */
+export declare function roomVouchedInternalFrom(declaredTrust: string | undefined, trust: string | undefined): boolean;
+/** The operator-facing sentence for each refusal — used in the thrown tool error, so the model relays
+ *  a cause rather than a bare denial. Never names another person and never names a credential value. */
+export declare function memberPlaneRefusalMessage(connector: string, reason: MemberPlaneRefusal): string;
+/** Why a personal-credential write refused at the per-op approval seam. ONE vocabulary, so the audit
+ *  row and the thrown message name the gate that produced the refusal. */
+export type PersonalWriteRefusal = "member_plane_write" | "personal_write_unproven_dm" | "personal_write_requester_mismatch";
+/** Every input {@link personalConnectorWriteVerdict} reads. All explicit; it resolves nothing. */
+export interface PersonalConnectorWriteInput {
+    /** The bound credential carries the member-plane stamp — it resolved OUTSIDE a DM. */
+    readonly memberPlaneBinding: boolean;
+    /** The bound credential is user-principal (`principal === "user"`), i.e. somebody's own account. */
+    readonly personalCredential: boolean;
+    /** The surface mode `connections/connector-auth.ts resolveDmPrincipal` read, or `undefined` when it
+     *  could not resolve one. Only the literal `"dm"` admits. */
+    readonly surfaceMode?: string;
+    /** The acting principal id that same read returned, or `undefined` when unresolvable. */
+    readonly actingPrincipalId?: string;
+    /** This turn's requester verdict (access/requester-identity.ts, read through {@link requesterFromAuth}). */
+    readonly requester: MemberPlaneRequester;
+}
+/** The decision. `prompt: true` means "raise the ordinary approval card"; the caller then applies the
+ *  tier's own once-per-op / per-call rule. It never means "run the op". */
+export type PersonalConnectorWriteVerdict = {
+    readonly prompt: true;
+} | {
+    readonly prompt: false;
+    readonly reason: PersonalWriteRefusal;
+};
+/** Reads the shared-room arm FIRST, so the member-plane denial is unchanged whatever the other inputs say, then proves the DM, then cross-checks the requester. Every unresolvable input refuses; an APP-principal credential is not this function's business and prompts unchanged. */
+export declare function personalConnectorWriteVerdict(input: PersonalConnectorWriteInput): PersonalConnectorWriteVerdict;
+/** The operator-facing sentence for each personal-write refusal. The shared-room arm delegates to
+ *  {@link memberPlaneRefusalMessage} so that copy has exactly one home. Never names another person. */
+export declare function personalWriteRefusalMessage(connector: string, reason: PersonalWriteRefusal): string;
+/** The minimal shape these readers touch — a `SessionAuth`-like bag, structurally. */
+export interface MemberPlaneAuthLike {
+    readonly current?: {
+        readonly attributes?: Readonly<Record<string, unknown>>;
+    } | null;
+}
+/** FAIL CLOSED IN EVERY UNREADABLE ARM: no bag, no stamp, an empty stamp or the unverified sentinel all answer a non-admitting kind, and only a non-empty non-sentinel stamp names a requester. The sentinel is passed in so this module stays a leaf and imports no eve context. */
+export declare function requesterFromAuth(auth: MemberPlaneAuthLike | undefined, requesterAttr: string, unverifiedSentinel: string): MemberPlaneRequester;
+/** POSITIVE-ONLY, matching the producer: the attribute is written as the literal "true" and absent otherwise, so anything else reads as "not refuted". This is G4's refutation half ONLY — not refuted is not vouched, and the room declaration carries the vouch. */
+export declare function nonMemberWakeFromAuth(auth: MemberPlaneAuthLike | undefined, nonMemberAttr: string): boolean;
+//# sourceMappingURL=member-plane.d.ts.map

package/dist/agent/access/member-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member-plane.d.ts","sourceRoot":"","sources":["../../../agent/access/member-plane.ts"],"names":[],"mappings":"AAEA;uGACuG;AACvG,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AAEjE;8FAC8F;AAC9F,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9B,qGAAqG;AACrG,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;gFAC4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gbAAgb;IAChb,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,yQAAyQ;IACzQ,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED;2EAC2E;AAC3E,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,uBAAuB,GACvB,wBAAwB,GACxB,mCAAmC,GACnC,6BAA6B,GAC7B,oBAAoB,CAAC;AAEzB;wFACwF;AACxF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnE,0WAA0W;AAC1W,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,kBAAkB,CAe9E;AAED,0YAA0Y;AAC1Y,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE7G;AAED;wGACwG;AACxG,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA0C/F;AAID;0EAC0E;AAC1E,MAAM,MAAM,oBAAoB,GAC5B,oBAAoB,GACpB,4BAA4B,GAC5B,mCAAmC,CAAC;AAExC,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IAC1C,sFAAsF;IACtF,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,oGAAoG;IACpG,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;iEAC6D;IAC7D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,4GAA4G;IAC5G,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC1C;AAED;2EAC2E;AAC3E,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEtE,wRAAwR;AACxR,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,2BAA2B,GAAG,6BAA6B,CAiB/G;AAED;uGACuG;AACvG,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAiBnG;AAID,sFAAsF;AACtF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;CACvF;AAOD,qRAAqR;AACrR,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,oBAAoB,CAKhJ;AAED,sQAAsQ;AACtQ,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAE3G"}