@open-everywhere/core 0.1.0

package/dist/agent/access/overlay-module.d.ts

@@ -0,0 +1,20 @@
+/** One overlay's fixed module grammar. Every field is a CONSTANT — nothing here is derived from the
+ *  overlay's data, so the emitted bytes depend only on the parsed structure. */
+export interface OverlayModuleGrammar {
+    /** Human name of the overlay, for refusal messages ("grants overlay"). */
+    readonly what: string;
+    /** The fixed header comment. Every line already `//`-prefixed; ends with a newline. */
+    readonly header: string;
+    /** The single type-only import line (no trailing newline). Always the PACKAGE specifier, never a
+     *  relative one: the overlay's location in the deployer repo is configurable
+     *  (`OE_ACCESS_GRANTS_PATH` and friends), so a relative path could not be part of a fixed grammar. */
+    readonly typeImport: string;
+    readonly typeName: string;
+}
+/** Wrap a codemod's canonical JSON body into the module text. The body's own trailing newline is consumed by the suffix, so the emitted statement is one line-terminated `export default … satisfies T;`. */
+export declare function wrapOverlayModule(g: OverlayModuleGrammar, canonicalJson: string): string;
+/** Strip the grammar off an overlay module and `JSON.parse` the body, REFUSING through the caller's own error type when the prefix or suffix is absent — that is, when anything outside the data was touched. Whether the data is canonical, and whether it is well-shaped, are the caller's own checks. */
+export declare function unwrapOverlayModule(g: OverlayModuleGrammar, text: string, refuse: (message: string) => Error): unknown;
+/** The fixed header, parameterised only by what the file is and which codemod owns it. One function, so all three overlay headers state the machine-owned contract in the SAME words rather than drifting apart. */
+export declare function overlayModuleHeader(what: string, codemodPath: string): string;
+//# sourceMappingURL=overlay-module.d.ts.map

package/dist/agent/access/overlay-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-module.d.ts","sourceRoot":"","sources":["../../../agent/access/overlay-module.ts"],"names":[],"mappings":"AAEA;gFACgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;0GAEsG;IACtG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAUD,6MAA6M;AAC7M,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAGxF;AAED,4SAA4S;AAC5S,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAAK,GAAG,OAAO,CAsBtH;AAED,oNAAoN;AACpN,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAa7E"}

package/dist/agent/access/overlay-module.js

@@ -0,0 +1,47 @@
+// One pinned module grammar for the machine-owned config overlays: a fixed header, one type-only import, and a single `export default <canonical JSON> satisfies T;`. The bytes are a pure function of the parsed structure, which determinism, idempotency and the PR dedupe all lean on. A `.ts` file EXECUTES at load, so the guarantee is not the format but the drift lint: it reads the file as TEXT, re-emits it and fails on any byte difference, header and import included.
+function overlayModulePrefix(g) {
+    return `${g.header}\n${g.typeImport}\n\nexport default `;
+}
+function overlayModuleSuffix(g) {
+    return ` satisfies ${g.typeName};\n`;
+}
+/** Wrap a codemod's canonical JSON body into the module text. The body's own trailing newline is consumed by the suffix, so the emitted statement is one line-terminated `export default … satisfies T;`. */
+export function wrapOverlayModule(g, canonicalJson) {
+    const body = canonicalJson.endsWith("\n") ? canonicalJson.slice(0, -1) : canonicalJson;
+    return `${overlayModulePrefix(g)}${body}${overlayModuleSuffix(g)}`;
+}
+/** Strip the grammar off an overlay module and `JSON.parse` the body, REFUSING through the caller's own error type when the prefix or suffix is absent — that is, when anything outside the data was touched. Whether the data is canonical, and whether it is well-shaped, are the caller's own checks. */
+export function unwrapOverlayModule(g, text, refuse) {
+    const prefix = overlayModulePrefix(g);
+    const suffix = overlayModuleSuffix(g);
+    if (!text.startsWith(prefix)) {
+        throw refuse(`${g.what} module does not start with the generated header + \`export default \` (this file is machine-owned; run \`npm run overlays:normalize\` after editing its data, and never edit anything outside it)`);
+    }
+    if (!text.endsWith(suffix)) {
+        throw refuse(`${g.what} module does not end with \`${suffix.trimEnd()}\` — it must contain exactly one \`export default <data> satisfies ${g.typeName};\` statement and nothing else`);
+    }
+    if (text.length < prefix.length + suffix.length) {
+        throw refuse(`${g.what} module has no data between its header and its \`satisfies\` clause`);
+    }
+    const body = text.slice(prefix.length, text.length - suffix.length);
+    try {
+        return JSON.parse(body);
+    }
+    catch (err) {
+        throw refuse(`${g.what} module's data is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** The fixed header, parameterised only by what the file is and which codemod owns it. One function, so all three overlay headers state the machine-owned contract in the SAME words rather than drifting apart. */
+export function overlayModuleHeader(what, codemodPath) {
+    return (`// GENERATED + MACHINE-OWNED — DO NOT HAND-EDIT.\n` +
+        `//\n` +
+        `// The ${what}: DATA ONLY. Written exclusively by the deterministic codemod\n` +
+        `// (${codemodPath}) on a bot-PR branch; the PR merge is the approval gate.\n` +
+        `//\n` +
+        `// \`npm run lint:overlays\` (in the \`npm test\` chain) re-emits this file from its own parsed\n` +
+        `// content and FAILS on any byte difference, so a hand-edit — including one that adds executable\n` +
+        `// code — cannot merge green. That check is what makes it safe for this data to live in a module.\n` +
+        `//\n` +
+        `// To change it by hand: edit the data below, then run \`npm run overlays:normalize\`.\n`);
+}
+//# sourceMappingURL=overlay-module.js.map

package/dist/agent/access/overlay-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"overlay-module.js","sourceRoot":"","sources":["../../../agent/access/overlay-module.ts"],"names":[],"mappings":"AAAA,sdAAsd;AAgBtd,SAAS,mBAAmB,CAAC,CAAuB;IAClD,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,qBAAqB,CAAC;AAC3D,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAuB;IAClD,OAAO,cAAc,CAAC,CAAC,QAAQ,KAAK,CAAC;AACvC,CAAC;AAED,6MAA6M;AAC7M,MAAM,UAAU,iBAAiB,CAAC,CAAuB,EAAE,aAAqB;IAC9E,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;IACvF,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,4SAA4S;AAC5S,MAAM,UAAU,mBAAmB,CAAC,CAAuB,EAAE,IAAY,EAAE,MAAkC;IAC3G,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,CACV,GAAG,CAAC,CAAC,IAAI,oMAAoM,CAC9M,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,CACV,GAAG,CAAC,CAAC,IAAI,+BAA+B,MAAM,CAAC,OAAO,EAAE,sEAAsE,CAAC,CAAC,QAAQ,gCAAgC,CACzK,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAChD,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,qEAAqE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;AACH,CAAC;AAED,oNAAoN;AACpN,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IACnE,OAAO,CACL,oDAAoD;QACpD,MAAM;QACN,UAAU,IAAI,iEAAiE;QAC/E,OAAO,WAAW,4DAA4D;QAC9E,MAAM;QACN,mGAAmG;QACnG,oGAAoG;QACpG,qGAAqG;QACrG,MAAM;QACN,0FAA0F,CAC3F,CAAC;AACJ,CAAC"}

package/dist/agent/access/own-account-gate-manifest.d.ts

@@ -0,0 +1,23 @@
+/** One source file offered to the checker. `file` is a repo-relative path, used only in messages. */
+export interface OwnAccountGateFile {
+    readonly file: string;
+    readonly source: string;
+}
+/** One call of the acting-identity gate, with the connector its marker declared (when it had one). */
+export interface OwnAccountGateSite {
+    readonly file: string;
+    /** 1-based line of the call. */
+    readonly line: number;
+    /** The connector the marker above the call declared. `undefined` when there was no marker. */
+    readonly connector?: string;
+}
+/** The live binding every gated read calls. Named here so the checker and its message agree. */
+export declare const OWN_ACCOUNT_GATE_CALL = "connectorActingIdentityForTurn";
+/** The marker a gated call site carries, in the comment block immediately above the call:
+ *  `own-account-gate: <connector>`. One connector per marker; a site covering two carries two. */
+export declare const OWN_ACCOUNT_GATE_MARKER = "own-account-gate:";
+/** Every acting-identity gate call in `files`, with the connectors its marker declared. */
+export declare function findOwnAccountGateSites(files: readonly OwnAccountGateFile[]): OwnAccountGateSite[];
+/** Three rules: every admitted connector is gated, every gate names its connector, and a gate naming a connector NEITHER list recognises is a stale join. A `human-acting` connector with no borrow route is the one legitimate refusing gate; `humanActingConnectors` defaults to empty, the strict reading in both directions. */
+export declare function checkOwnAccountGateSites(files: readonly OwnAccountGateFile[], connectors: readonly string[], humanActingConnectors?: readonly string[]): string[];
+//# sourceMappingURL=own-account-gate-manifest.d.ts.map

package/dist/agent/access/own-account-gate-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-account-gate-manifest.d.ts","sourceRoot":"","sources":["../../../agent/access/own-account-gate-manifest.ts"],"names":[],"mappings":"AAEA,qGAAqG;AACrG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,mCAAmC,CAAC;AAEtE;kGACkG;AAClG,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAsC3D,2FAA2F;AAC3F,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,GAAG,kBAAkB,EAAE,CAelG;AAED,oUAAoU;AACpU,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,SAAS,kBAAkB,EAAE,EACpC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,qBAAqB,GAAE,SAAS,MAAM,EAAO,GAC5C,MAAM,EAAE,CAkDV"}

package/dist/agent/access/own-account-gate-manifest.js

@@ -0,0 +1,109 @@
+// The rule `lint:own-account-gate` enforces: every connector the own-account stamp producer recognises has at least one call site consulting the acting-identity gate. Each gated site names its connector in a marker, because the connector is passed as a value no scan of the source can resolve.
+/** The live binding every gated read calls. Named here so the checker and its message agree. */
+export const OWN_ACCOUNT_GATE_CALL = "connectorActingIdentityForTurn";
+/** The marker a gated call site carries, in the comment block immediately above the call:
+ *  `own-account-gate: <connector>`. One connector per marker; a site covering two carries two. */
+export const OWN_ACCOUNT_GATE_MARKER = "own-account-gate:";
+const MARKER_RE = /own-account-gate:\s*([A-Za-z0-9][A-Za-z0-9._-]*)/u;
+/** Comments and string literals blanked to spaces, line structure preserved, so a commented-out or quoted gate call can NEVER satisfy a gate. A template literal is blanked whole, so a call inside a substitution is invisible — fail-closed, since the connector then reads as ungated. */
+function codeOnlyLines(source) {
+    const blank = (m) => m.replace(/[^\n]/gu, " ");
+    return source
+        .replace(/\/\*[\s\S]*?\*\//gu, blank)
+        .replace(/\/\*[\s\S]*$/u, blank)
+        .replace(/\/\/[^\n]*/gu, blank)
+        .replace(/`[\s\S]*?`/gu, blank)
+        .replace(/"(?:[^"\\\n]|\\.)*"/gu, blank)
+        .replace(/'(?:[^'\\\n]|\\.)*'/gu, blank);
+}
+/** A CALL of the gate, and not its declaration, its import or its re-export. The call is the only
+ *  shape that carries an open parenthesis and is not a `function` declaration. Read from a
+ *  comment- and string-blanked line, never from raw text — see {@link codeOnlyLines}. */
+function isGateCall(line) {
+    if (!line.includes(`${OWN_ACCOUNT_GATE_CALL}(`))
+        return false;
+    return !/\bfunction\s+connectorActingIdentityForTurn\s*\(/u.test(line);
+}
+/** The connectors declared by the contiguous comment block immediately above `line`. Contiguous means comment and blank lines only: a statement between the marker and the call detaches it, so a marker can never be inherited by a call below the one it was written for. */
+function markersAbove(lines, line) {
+    const found = [];
+    for (let i = line - 2; i >= 0; i--) {
+        const text = (lines[i] ?? "").trim();
+        if (text === "")
+            continue;
+        const isComment = text.startsWith("//") || text.startsWith("*") || text.startsWith("/*");
+        if (!isComment)
+            break;
+        const m = MARKER_RE.exec(text);
+        if (m?.[1] !== undefined)
+            found.push(m[1]);
+    }
+    return found;
+}
+/** Every acting-identity gate call in `files`, with the connectors its marker declared. */
+export function findOwnAccountGateSites(files) {
+    const sites = [];
+    for (const { file, source } of files) {
+        // TWO VIEWS OF ONE FILE, and both are needed. The CALL is read from code only, so a comment can
+        // never satisfy a gate; the MARKER is read from the raw lines, because a marker IS a comment.
+        const lines = source.split("\n");
+        const code = codeOnlyLines(source).split("\n");
+        for (let i = 0; i < code.length; i++) {
+            if (!isGateCall(code[i] ?? ""))
+                continue;
+            const declared = markersAbove(lines, i + 1);
+            if (declared.length === 0)
+                sites.push({ file, line: i + 1 });
+            else
+                for (const connector of declared)
+                    sites.push({ connector, file, line: i + 1 });
+        }
+    }
+    return sites;
+}
+/** Three rules: every admitted connector is gated, every gate names its connector, and a gate naming a connector NEITHER list recognises is a stale join. A `human-acting` connector with no borrow route is the one legitimate refusing gate; `humanActingConnectors` defaults to empty, the strict reading in both directions. */
+export function checkOwnAccountGateSites(files, connectors, humanActingConnectors = []) {
+    const sites = findOwnAccountGateSites(files);
+    const problems = [];
+    for (const site of sites) {
+        if (site.connector !== undefined)
+            continue;
+        problems.push(`${site.file}:${site.line} — a \`${OWN_ACCOUNT_GATE_CALL}\` call with no \`${OWN_ACCOUNT_GATE_MARKER} <connector>\` ` +
+            `marker in the comment block above it. Say which connector this gate covers: the connector is passed as a value ` +
+            `and cannot be read from the source, so an unmarked gate covers nothing this lint can see.`);
+    }
+    const gated = new Set(sites.map((s) => s.connector).filter((c) => c !== undefined));
+    const admitted = new Set(connectors);
+    const userPrincipal = new Set(humanActingConnectors);
+    // Rule 1 walks the producer's own UNION, not the borrow list alone: a rule keyed on one half would cover the human-acting half in one direction only. Sorted, so a config with several ungated vendors reports in a stable order.
+    for (const connector of [...new Set([...connectors, ...humanActingConnectors])].sort()) {
+        if (gated.has(connector))
+            continue;
+        const via = admitted.has(connector)
+            ? "is in CREDENTIAL_GRANT_ROLES (access/credential-grant.ts)"
+            : "declares a `human-acting` credential family (access/connector-credentials.ts)";
+        problems.push(`\`${connector}\` ${via} but no call site consults the ` +
+            `acting-identity gate for it. The own-account grammar recognises the vendor the moment it reaches EITHER half of ` +
+            `\`ownAccountAskVendors()\` (connections/own-account-vendors.ts), so a ` +
+            `requester asking to act with their own ${connector} account is stamped — and every read then runs on the ` +
+            `deployment's own integration, which is the OPE-1525 defect. Add a \`${OWN_ACCOUNT_GATE_CALL}\` call at the line ` +
+            `that resolves the ${connector} credential, and mark it \`${OWN_ACCOUNT_GATE_MARKER} ${connector}\`.`);
+    }
+    for (const connector of [...gated].sort()) {
+        if (admitted.has(connector))
+            continue;
+        // A user-principal family with no borrow route refuses BY DESIGN — the legitimate second case
+        // rule 3's doc comment states. Only a connector neither list recognises is a stale join.
+        if (userPrincipal.has(connector))
+            continue;
+        problems.push(`a gate marked \`${OWN_ACCOUNT_GATE_MARKER} ${connector}\` covers a connector NEITHER list recognises — ` +
+            `a stale join. ${connector} is not in CREDENTIAL_GRANT_ROLES (access/credential-grant.ts), so no grant can be ` +
+            `minted for it, and its catalogue declares no \`human-acting\` credential family (access/connector-credentials.ts), ` +
+            `so nothing says this deployment ever means to act as the person there. The gate still recognises an ask for ${connector} and ` +
+            `can then only ever REFUSE: a member naming their own ${connector} account is turned away with a route this ` +
+            `deployment cannot open, and no review decided that. Add ${connector} to the reviewed list, declare a ` +
+            `\`human-acting\` credential family for it, or delete the gate call together with its marker.`);
+    }
+    return problems;
+}
+//# sourceMappingURL=own-account-gate-manifest.js.map

package/dist/agent/access/own-account-gate-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"own-account-gate-manifest.js","sourceRoot":"","sources":["../../../agent/access/own-account-gate-manifest.ts"],"names":[],"mappings":"AAAA,sSAAsS;AAiBtS,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAEtE;kGACkG;AAClG,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,MAAM,SAAS,GAAG,mDAAmD,CAAC;AAEtE,6RAA6R;AAC7R,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,MAAM;SACV,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC;SACpC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC;SAC/B,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;SAC9B,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;SAC9B,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC;SACvC,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED;;yFAEyF;AACzF,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,qBAAqB,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,CAAC,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAED,+QAA+Q;AAC/Q,SAAS,YAAY,CAAC,KAAwB,EAAE,IAAY;IAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC,SAAS;YAAE,MAAM;QACtB,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,uBAAuB,CAAC,KAAoC;IAC1E,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,SAAS;YACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;;gBACxD,KAAK,MAAM,SAAS,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oUAAoU;AACpU,MAAM,UAAU,wBAAwB,CACtC,KAAoC,EACpC,UAA6B,EAC7B,qBAAqB,GAAsB,EAAE;IAE7C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,SAAS;QAC3C,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,UAAU,qBAAqB,qBAAqB,uBAAuB,iBAAiB;YACnH,iHAAiH;YACjH,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAErD,kOAAkO;IAClO,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACvF,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YACjC,CAAC,CAAC,2DAA2D;YAC7D,CAAC,CAAC,+EAA+E,CAAC;QACpF,QAAQ,CAAC,IAAI,CACX,KAAK,SAAS,MAAM,GAAG,iCAAiC;YACtD,kHAAkH;YAClH,wEAAwE;YACxE,0CAA0C,SAAS,wDAAwD;YAC3G,uEAAuE,qBAAqB,sBAAsB;YAClH,qBAAqB,SAAS,8BAA8B,uBAAuB,IAAI,SAAS,KAAK,CACxG,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACtC,8FAA8F;QAC9F,yFAAyF;QACzF,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAC3C,QAAQ,CAAC,IAAI,CACX,mBAAmB,uBAAuB,IAAI,SAAS,kDAAkD;YACvG,iBAAiB,SAAS,qFAAqF;YAC/G,qHAAqH;YACrH,+GAA+G,SAAS,OAAO;YAC/H,wDAAwD,SAAS,4CAA4C;YAC7G,2DAA2D,SAAS,mCAAmC;YACvG,8FAA8F,CACjG,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/agent/access/pane-venue.d.ts

@@ -0,0 +1,58 @@
+import { type BindableContext } from "../identity/binding.js";
+import { type Domain } from "../memory/domain.js";
+import { type FloorAttestation } from "./audience-floor.js";
+/** Where a pane read may render, given role (already checked) AND venue. */
+export type PaneVenue = 
+/** An armed governance channel — render inline. */
+{
+    readonly placement: "inline";
+    readonly via: "governance-channel";
+}
+/** The role-holding requester's own DM — render inline, view-only (audited by the read itself). */
+ | {
+    readonly placement: "inline";
+    readonly via: "requester-dm";
+}
+/** Wrong venue — redirect-and-fulfil. `target` is where the substance should be delivered. */
+ | {
+    readonly placement: "redirect";
+    readonly target: "governance-channel" | "requester-dm";
+    /** The governance channel to deliver to (present iff target === "governance-channel"). */
+    readonly channel?: string;
+};
+export interface PaneVenueInput {
+    readonly isRequesterDm: boolean;
+    readonly isGovernanceChannel: boolean;
+    /** The governance floor attestation for the asking channel (present iff isGovernanceChannel). */
+    readonly attestation?: FloorAttestation;
+    /** The configured governance-channel target (governanceChannelFor); undefined ⇒ none configured. */
+    readonly governanceChannel?: string;
+}
+/** Pure venue decision, in order: an armed governance channel, then the requester's own DM, then redirect, to the governance channel when one is configured and otherwise to the DM. A governance channel whose floor is BREACHED does not render inline; the demote is fail-closed. */
+export declare function classifyPaneVenue(input: PaneVenueInput): PaneVenue;
+export declare class PaneRedirectError extends Error {
+    readonly target: "governance-channel" | "requester-dm";
+    readonly channel?: string;
+    constructor(message: string, target: "governance-channel" | "requester-dm", channel?: string);
+}
+/** The VENUE half of the dual gate; call it right after the role gate. It returns when the feature is inert or the venue may render inline, and otherwise stamps `governance.redirected` and throws, so the read never renders in place. */
+export declare function requirePaneVenue(ctx: BindableContext, opts: {
+    kind: string;
+}): Promise<PaneVenue>;
+/** Thrown by {@link fulfilPaneRead} once the substance HAS been delivered to the requester's DM.
+ *  Distinct from {@link PaneRedirectError} — the work happened; only the room copy is left. */
+export declare class PaneDmDeliveredError extends Error {
+    /** The DM conversation id the substance landed in (public id — never the content). */
+    readonly dmSurfaceId: string;
+    constructor(message: string, dmSurfaceId: string);
+}
+/**
+ * Redirect-and-fulfil for an org-grain pane read: on a governance-channel redirect `compute` never runs, and on the DM arm the role and the platform's DM arm are verified BEFORE computing.
+ * Fail-closed everywhere. An unverifiable role, a missing DM arm or a failed post all end in a PaneRedirectError, and no path lets org-scope substance reach the asking room.
+ */
+export declare function fulfilPaneRead<T>(ctx: BindableContext, opts: {
+    kind: string;
+    render: (value: T) => string;
+}, compute: () => Promise<T>): Promise<T>;
+export declare function governanceRedirectTarget(domains: readonly Domain[]): string | undefined;
+//# sourceMappingURL=pane-venue.d.ts.map

package/dist/agent/access/pane-venue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-venue.d.ts","sourceRoot":"","sources":["../../../agent/access/pane-venue.ts"],"names":[],"mappings":"AAKA,OAAO,EAA+B,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG3F,OAAO,EAAwF,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACxI,OAAO,EAA8C,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAIxG,4EAA4E;AAC5E,MAAM,MAAM,SAAS;AACnB,mDAAmD;AACjD;IAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,oBAAoB,CAAA;CAAE;AACtE,mGAAmG;GACjG;IAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAA;CAAE;AAChE,8FAA8F;GAC5F;IACE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAAC;IACvD,0FAA0F;IAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEN,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,iGAAiG;IACjG,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC,oGAAoG;IACpG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,wRAAwR;AACxR,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CAWlE;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,cAAc,CAAC;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM,EAK3F;CACF;AAeD,4OAA4O;AAC5O,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAKvG;AAoED;+FAC+F;AAC/F,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,sFAAsF;IACtF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,YAAY,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAI/C;CACF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAA;CAAE,EACpD,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACxB,OAAO,CAAC,CAAC,CAAC,CAoDZ;AAeD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAEvF"}

package/dist/agent/access/pane-venue.js

@@ -0,0 +1,177 @@
+// The dual gate for an org-grain pane read: the ROLE check, then the VENUE check. A wrong venue is never rendered in place and never partially rendered; `requirePaneVenue` throws before the tool computes any substance, and the redirect is stamped `governance.redirected`.
+// The second venue target is the role-holding requester's own DM, which core delivers mechanically. The gate ALSO engages with zero governance domains when the org sets `governanceDelivery: "dm-fallback"` on the `org` pseudo-domain; absent means "channel".
+import { appendAudit } from "../audit/audit.js";
+import { actingPrincipalId, bindFrom } from "../identity/binding.js";
+import { resolvePartition } from "../memory/partition.js";
+import { getConfig } from "./config.js";
+import { governanceChannelFor, governanceDeliveryMode, governanceDomains, isGovernanceChannel } from "../memory/domain.js";
+import { attestGovernanceChannel, floorBreachNotice } from "./audience-floor.js";
+import { adminControlRoles } from "./roles.js";
+import { canDeliverDirectMessage, directMessageCapablePlatforms, dispatchDirectMessage } from "../channels/post-arms.js";
+/** Pure venue decision, in order: an armed governance channel, then the requester's own DM, then redirect, to the governance channel when one is configured and otherwise to the DM. A governance channel whose floor is BREACHED does not render inline; the demote is fail-closed. */
+export function classifyPaneVenue(input) {
+    if (input.isGovernanceChannel && input.attestation?.armed) {
+        return { placement: "inline", via: "governance-channel" };
+    }
+    if (input.isRequesterDm) {
+        return { placement: "inline", via: "requester-dm" };
+    }
+    if (input.governanceChannel) {
+        return { placement: "redirect", target: "governance-channel", channel: input.governanceChannel };
+    }
+    return { placement: "redirect", target: "requester-dm" };
+}
+export class PaneRedirectError extends Error {
+    target;
+    channel;
+    constructor(message, target, channel) {
+        super(message);
+        this.name = "PaneRedirectError";
+        this.target = target;
+        this.channel = channel;
+    }
+}
+function redirectDirective(target, channel, kind) {
+    if (target === "governance-channel") {
+        return (`that's admin-pane output (${kind}) — it can't be shown in this room. Deliver the full answer in the governance channel ${channel} (mention the person who asked), ` +
+            `and reply here only with a pointer: "that's admin-pane output — I've posted it in ${channel}." Do NOT render any of the substance in this channel (partial disclosure is still disclosure).`);
+    }
+    return (`that's admin-pane output (${kind}) — it can't be shown in this room, and no governance channel is configured. Deliver it view-only in the requester's DM instead, ` +
+        `and reply here only with a pointer ("I've sent it to you directly"). Do NOT render the substance in this channel. (Configure a governance domain to give the whole admin team a shared venue.)`);
+}
+/** The VENUE half of the dual gate; call it right after the role gate. It returns when the feature is inert or the venue may render inline, and otherwise stamps `governance.redirected` and throws, so the read never renders in place. */
+export async function requirePaneVenue(ctx, opts) {
+    const r = await resolvePaneVenue(ctx);
+    if (r.decision.placement === "inline")
+        return r.decision;
+    await auditRedirect(r, opts.kind);
+    throw redirectError(r, opts.kind);
+}
+/** Classify this turn's venue for a pane read. Never throws, never audits — the callers decide. */
+async function resolvePaneVenue(ctx) {
+    const domains = getConfig().loadDomains();
+    const b = bindFrom(ctx);
+    const part = resolvePartition(ctx);
+    const coords = { org: part.org, platform: part.platform, workspace: part.workspace, surface: part.surface };
+    // The ACTING principal, because everything this resolution's principal feeds is authority or disclosure. A triggered fire must hold neither its creator's admin standing nor a claim on their DM.
+    const base = { domains, channelKey: part.surfaceKey, principalId: actingPrincipalId(b), coords };
+    // ACTIVATION SEAM: inert unless a governance domain exists (OPE-110) OR the org opted into the
+    // admin-less DM path (OPE-44). Inert ⇒ render inline, exactly as before either slice landed.
+    const dmFallback = governanceDeliveryMode(domains) === "dm-fallback";
+    if (governanceDomains(domains).length === 0 && !dmFallback) {
+        return { ...base, decision: { placement: "inline", via: "requester-dm" }, isGovernanceChannel: false };
+    }
+    const isGov = isGovernanceChannel(part.surfaceKey, domains);
+    const attestation = isGov ? await attestGovernanceChannel(part.surfaceKey, domains, { ...coords, principalId: b.principalId }) : undefined;
+    const decision = classifyPaneVenue({
+        isRequesterDm: b.mode === "dm",
+        isGovernanceChannel: isGov,
+        attestation,
+        governanceChannel: governanceChannelFor(domains, adminChannelFallback()),
+    });
+    return { ...base, decision, isGovernanceChannel: isGov, attestation };
+}
+/** Stamp the `governance.redirected` row (§5: a pattern of pane asks in public rooms is itself
+ *  signal the audit log should carry). `refused` marks a DM arm that could NOT deliver. */
+async function auditRedirect(r, kind, refused) {
+    const decision = r.decision;
+    await appendAudit({
+        ...r.coords,
+        principalId: r.principalId,
+        action: "governance.redirected",
+        detail: {
+            kind,
+            from: r.channelKey,
+            to: decision.placement === "redirect" ? decision.target : "inline",
+            ...(decision.placement === "redirect" && decision.channel ? { channel: decision.channel } : {}),
+            ...(r.isGovernanceChannel && r.attestation?.breach ? { floorBreach: r.attestation.breach.reason } : {}),
+            ...(refused ? { refused } : {}),
+        },
+    });
+}
+/** The model-facing redirect error for a wrong-venue pane read (never carries substance). */
+function redirectError(r, kind, refused) {
+    const decision = r.decision;
+    if (decision.placement !== "redirect")
+        throw new Error("redirectError called on a non-redirect venue"); // unreachable
+    const notice = r.isGovernanceChannel && r.attestation?.breach ? ` (${floorBreachNotice(r.attestation.breach)})` : "";
+    const why = refused ? ` I couldn't deliver it to your DM either: ${refused}` : "";
+    return new PaneRedirectError(redirectDirective(decision.target, decision.channel, kind) + notice + why, decision.target, decision.channel);
+}
+/** Thrown by {@link fulfilPaneRead} once the substance HAS been delivered to the requester's DM.
+ *  Distinct from {@link PaneRedirectError} — the work happened; only the room copy is left. */
+export class PaneDmDeliveredError extends Error {
+    /** The DM conversation id the substance landed in (public id — never the content). */
+    dmSurfaceId;
+    constructor(message, dmSurfaceId) {
+        super(message);
+        this.name = "PaneDmDeliveredError";
+        this.dmSurfaceId = dmSurfaceId;
+    }
+}
+/**
+ * Redirect-and-fulfil for an org-grain pane read: on a governance-channel redirect `compute` never runs, and on the DM arm the role and the platform's DM arm are verified BEFORE computing.
+ * Fail-closed everywhere. An unverifiable role, a missing DM arm or a failed post all end in a PaneRedirectError, and no path lets org-scope substance reach the asking room.
+ */
+export async function fulfilPaneRead(ctx, opts, compute) {
+    const r = await resolvePaneVenue(ctx);
+    const decision = r.decision;
+    if (decision.placement === "inline")
+        return await compute();
+    if (decision.target === "governance-channel") {
+        await auditRedirect(r, opts.kind);
+        throw redirectError(r, opts.kind); // compute() deliberately never runs
+    }
+    // Both preconditions are checked BEFORE compute(), so nothing that cannot be delivered is ever built. The role check is the DM arm's own, independent of the tool's role gate, and it fails closed on no verified id.
+    const roles = adminControlRoles(r.principalId, r.domains, r.coords.platform, r.coords.workspace);
+    if (roles.length === 0) {
+        const why = r.principalId
+            ? `your id ("${r.principalId}") holds no admin standing in any configured domain`
+            : "this turn carries no verified sender id";
+        await auditRedirect(r, opts.kind, "role-unverified");
+        throw redirectError(r, opts.kind, why);
+    }
+    // (2) VENUE ARM: the platform must actually be able to DM. Absent arm = unsupported, never faked.
+    if (!canDeliverDirectMessage(r.coords.platform)) {
+        const capable = directMessageCapablePlatforms();
+        await auditRedirect(r, opts.kind, "no-dm-arm");
+        throw redirectError(r, opts.kind, `this deployment can't DM on "${r.coords.platform}" (DM delivery is implemented by: ${capable.length ? capable.join(", ") : "no provider"})`);
+    }
+    const value = await compute();
+    let delivery;
+    try {
+        delivery = await dispatchDirectMessage(r.coords.platform, {
+            principalId: r.principalId,
+            text: dmEnvelope(opts.kind, r.channelKey, opts.render(value)),
+        });
+    }
+    catch (err) {
+        // The substance stays in this frame and dies with it — never a partial render into the room.
+        await auditRedirect(r, opts.kind, "dm-delivery-failed");
+        throw redirectError(r, opts.kind, String(err instanceof Error ? err.message : err));
+    }
+    await appendAudit({
+        ...r.coords,
+        principalId: r.principalId,
+        action: "governance.dm_delivered",
+        detail: { kind: opts.kind, from: r.channelKey, to: "requester-dm", dmSurface: delivery.surfaceId, roles },
+    });
+    throw new PaneDmDeliveredError(`that's admin-pane output (${opts.kind}) — it can't be shown in this room, so I've DELIVERED IT to the person who asked, in their DM with me. ` +
+        `Reply here with ONLY a short pointer ("I've sent you a DM") — you do not have the content and must not restate, summarise, estimate or hint at any of it. ` +
+        `(Configure a governance domain to give the whole admin team a shared venue instead.)`, delivery.surfaceId);
+}
+/** The DM's own header — says WHY it arrived and WHERE it was asked, so the reading room has the
+ *  context the room pointer deliberately withholds. Kept in ONE place with the other copy. */
+function dmEnvelope(kind, askedIn, body) {
+    return `Admin-pane output (${kind}) — you asked in ${askedIn}, which isn't a venue that may hear org-scope output, so here it is view-only.\n\n${body}`;
+}
+/** The legacy `OE_ACCESS_ADMIN_CHANNEL` env as the governance-channel fallback (§4.1 migration:
+ *  the env becomes an alias — a bare notification channel where pointers/digests can still land). */
+function adminChannelFallback() {
+    const load = getConfig().loadAccessRequests;
+    return load?.()?.adminChannel ?? undefined;
+}
+export function governanceRedirectTarget(domains) {
+    return governanceChannelFor(domains, adminChannelFallback());
+}
+//# sourceMappingURL=pane-venue.js.map

package/dist/agent/access/pane-venue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pane-venue.js","sourceRoot":"","sources":["../../../agent/access/pane-venue.ts"],"names":[],"mappings":"AAAA,gRAAgR;AAEhR,iQAAiQ;AAEjQ,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAwB,MAAM,wBAAwB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAe,MAAM,qBAAqB,CAAC;AACxI,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAyB,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAyBzH,wRAAwR;AACxR,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC;QAC1D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAAwC;IAC9C,OAAO,CAAU;IAC1B,YAAY,OAAe,EAAE,MAA6C,EAAE,OAAgB;QAC1F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,SAAS,iBAAiB,CAAC,MAA6C,EAAE,OAA2B,EAAE,IAAY;IACjH,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO,CACL,6BAA6B,IAAI,yFAAyF,OAAO,mCAAmC;YACpK,qFAAqF,OAAO,iGAAiG,CAC9L,CAAC;IACJ,CAAC;IACD,OAAO,CACL,6BAA6B,IAAI,mIAAmI;QACpK,gMAAgM,CACjM,CAAC;AACJ,CAAC;AAED,4OAA4O;AAC5O,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAoB,EAAE,IAAsB;IACjF,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAYD,mGAAmG;AACnG,KAAK,UAAU,gBAAgB,CAAC,GAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5G,kMAAkM;IAClM,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjG,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC;IACrE,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3D,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;IACzG,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3I,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,aAAa,EAAE,CAAC,CAAC,IAAI,KAAK,IAAI;QAC9B,mBAAmB,EAAE,KAAK;QAC1B,WAAW;QACX,iBAAiB,EAAE,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC;KACzE,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACxE,CAAC;AAED;2FAC2F;AAC3F,KAAK,UAAU,aAAa,CAAC,CAAkB,EAAE,IAAY,EAAE,OAAgB;IAC7E,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,MAAM,WAAW,CAAC;QAChB,GAAG,CAAC,CAAC,MAAM;QACX,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE;YACN,IAAI;YACJ,IAAI,EAAE,CAAC,CAAC,UAAU;YAClB,EAAE,EAAE,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAClE,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/F,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC;KACF,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,SAAS,aAAa,CAAC,CAAkB,EAAE,IAAY,EAAE,OAAgB;IACvE,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,CAAC,SAAS,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC,cAAc;IACtH,MAAM,MAAM,GAAG,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,iBAAiB,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACrH,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,6CAA6C,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,OAAO,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,MAAM,GAAG,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC7I,CAAC;AAED;+FAC+F;AAC/F,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,sFAAsF;IAC7E,WAAW,CAAS;IAC7B,YAAY,OAAe,EAAE,WAAmB;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAoB,EACpB,IAAoD,EACpD,OAAyB;IAEzB,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,MAAM,OAAO,EAAE,CAAC;IAE5D,IAAI,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC7C,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,oCAAoC;IACzE,CAAC;IAED,sNAAsN;IACtN,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW;YACvB,CAAC,CAAC,aAAa,CAAC,CAAC,WAAW,qDAAqD;YACjF,CAAC,CAAC,yCAAyC,CAAC;QAC9C,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACrD,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,kGAAkG;IAClG,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,6BAA6B,EAAE,CAAC;QAChD,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC/C,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,QAAQ,qCAAqC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;IAClL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;IAC9B,IAAI,QAAkD,CAAC;IACvD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE;YACxD,WAAW,EAAE,CAAC,CAAC,WAAY;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6FAA6F;QAC7F,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QACxD,MAAM,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,GAAG,CAAC,CAAC,MAAM;QACX,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE;KAC1G,CAAC,CAAC;IAEH,MAAM,IAAI,oBAAoB,CAC5B,6BAA6B,IAAI,CAAC,IAAI,yGAAyG;QAC7I,4JAA4J;QAC5J,sFAAsF,EACxF,QAAQ,CAAC,SAAS,CACnB,CAAC;AACJ,CAAC;AAED;8FAC8F;AAC9F,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,IAAY;IAC7D,OAAO,sBAAsB,IAAI,oBAAoB,OAAO,qFAAqF,IAAI,EAAE,CAAC;AAC1J,CAAC;AAED;qGACqG;AACrG,SAAS,oBAAoB;IAC3B,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC,kBAAkB,CAAC;IAC5C,OAAO,IAAI,EAAE,EAAE,EAAE,YAAY,IAAI,SAAS,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA0B;IACjE,OAAO,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/agent/access/pending-delegation-signal.d.ts

@@ -0,0 +1,38 @@
+/** The `reply.refused` reason for this guard. Its own string, so a seat that answers over its own
+ *  running worker is countable in production apart from every other reply refusal. */
+export declare const DELEGATION_PENDING_REFUSAL_REASON = "delegation-pending";
+/** The settle-to-reply link in one row: it carries the task id the settlement wake arrived for and the wake the report was posted to, so an operator can join a delegation.task_settled row to the message the room actually received. */
+export declare const SETTLEMENT_REPORT_POSTED_ACTION = "delegation.settlement_report_posted";
+/** The action naming a settlement turn that chose silence while it still owed a report. Written per refusal and never gated behind audit.silences, so it stays countable in the actions-only posture production runs in. */
+export declare const SETTLEMENT_REPORT_SKIPPED_ACTION = "delegation.settlement_report_skipped";
+/** The copy the model reads when the guard refuses. INSTRUCTIVE rather than a wall — it names the legitimate move and the reason — and it discloses no task id and no wake id. */
+export declare function delegationPendingRefusalMessage(): string;
+/** The copy no_reply reads when a settlement turn tries to end in silence while it owes a report. It deliberately does not name the second call: the guard refuses once and then stands aside, and copy that named the valve would buy one extra tool call on the way to the same silence. */
+export declare function settlementReportOwedMessage(): string;
+/** Record that THIS turn dispatched a background task that has not settled, with the same parentWakeId the dispatch edge registers the task's own wake against. Recorded even when no wake could be minted: the guard is about the parent's honesty, not about the settlement plumbing. */
+export declare function notePendingDelegation(turnId: string | undefined, taskId: string, parentWakeId: string | undefined): void;
+/** Record that a dispatched task SETTLED, so the guard stops holding this turn's wake open for it. The usual later-turn settlement is a no-op against the turn-stamped ledger; the call that matters is a task the seat sees settle inside the dispatching turn. */
+export declare function noteDelegationSettled(turnId: string | undefined, taskId: string): void;
+/** The task id of a dispatch this turn made that still owes wakeId its answer. addressedWake is passed IN rather than imported, so this module stays a dependency-light leaf, and every undefined case is "let the reply through" — the fail-soft direction. */
+export declare function pendingDelegationOwing(turnId: string | undefined, wakeId: string, addressedWake: string | undefined): string | undefined;
+/** The WAKE-FREE reader, for a per-surface door that holds one conversation and no wake id at all. It assumes the seat is bound to ONE conversation for the whole turn, so it may never be pointed at a unified door, where the first pending dispatch can belong to a sibling conversation and only the wake-keyed sibling can tell them apart. */
+export declare function pendingDelegationThisTurn(turnId: string | undefined): string | undefined;
+/** Every task of this turn that owes wakeId its answer, in dispatch order. The guard needs only the FIRST id, but the promise needs all of them: a turn that fans out to three workers and posts one hand-off note owes a report on whichever settles first. */
+export declare function pendingDelegationsOwing(turnId: string | undefined, wakeId: string, addressedWake: string | undefined): readonly string[];
+/** Record that this seat TOLD a conversation it had started this task — the promise the settlement duty is armed from. Session-durable and idempotent; a no-op on an empty id, and it never throws. */
+export declare function notePromisedReport(taskId: string): void;
+/** Was a report promised for this task? Reading it REMOVES it, so one hand-off note buys one duty and a task cannot arm a second turn. False for an unpromised task, an empty id and outside an eve context — all of which are "no duty", the fail-soft direction. */
+export declare function claimPromisedReport(taskId: string): boolean;
+/** Record that THIS turn was woken by the settlement of a task it promised to report on, so the silence verb can refuse. Called only where the promise held AND the settlement really installed the task's own reply address: the address is a precondition, because a turn with no address can post nothing and demanding a post there is a loop the model cannot win. */
+export declare function noteSettlementReportOwed(turnId: string | undefined, taskId: string, wakeId: string | undefined): void;
+/** Read-only — dischargeSettlementReport is what clears it. The two are split because A POST IS NOT PROOF OF A REPORT: a standing seat holds several conversations in one turn, so discharging on any post would write a settle-to-reply row naming a room that heard nothing. */
+export declare function settlementReportOwedOn(turnId: string | undefined): {
+    readonly task: string;
+    readonly wake: string;
+} | undefined;
+/** DISCHARGE the duty — the report reached the conversation it was owed to. Called by the reply
+ *  plane once it has checked that, and never on a post to a sibling conversation. */
+export declare function dischargeSettlementReport(): void;
+/** A VALVE, NOT A WALL: a settlement turn's report can still be refused by the freshness, fold or stale-conversation gates below this plane, so an unbounded refusal could hold a turn open with no move left that succeeds. The first refusal MARKS and does not clear — the duty must survive it, or the reply plane cannot write the settle-to-reply row — and the second call clears and lets the turn end. */
+export declare function refuseSettlementReport(turnId: string | undefined): string | undefined;
+//# sourceMappingURL=pending-delegation-signal.d.ts.map

package/dist/agent/access/pending-delegation-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-delegation-signal.d.ts","sourceRoot":"","sources":["../../../agent/access/pending-delegation-signal.ts"],"names":[],"mappings":"AA4CA;sFACsF;AACtF,eAAO,MAAM,iCAAiC,uBAAuB,CAAC;AAEtE,0OAA0O;AAC1O,eAAO,MAAM,+BAA+B,wCAAwC,CAAC;AAErF,4NAA4N;AAC5N,eAAO,MAAM,gCAAgC,yCAAyC,CAAC;AAEvF,kLAAkL;AAClL,wBAAgB,+BAA+B,IAAI,MAAM,CAQxD;AAED,8RAA8R;AAC9R,wBAAgB,2BAA2B,IAAI,MAAM,CAOpD;AAwBD,2RAA2R;AAC3R,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAexH;AAED,oQAAoQ;AACpQ,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CActF;AAED,gQAAgQ;AAChQ,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAExI;AAED,oVAAoV;AACpV,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUxF;AAED,gQAAgQ;AAChQ,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAoBxI;AAKD,uMAAuM;AACvM,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAYvD;AAED,sQAAsQ;AACtQ,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAa3D;AAED,2WAA2W;AAC3W,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAUrH;AAkBD,kRAAkR;AAClR,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAE/H;AAED;qFACqF;AACrF,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,mZAAmZ;AACnZ,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAerF"}