@open-everywhere/core 0.1.0

package/dist/agent/access/pending-delegation-signal.js

@@ -0,0 +1,268 @@
+// A turn may not mark a wake ANSWERED while a background task it dispatched THIS TURN still owes that wake its answer; it may still post, with done:false, so the worker's real result can reach the same conversation. Every record here is turn-stamped and never answered for another turn, and every reader fails SOFT — outside an eve context they no-op or answer undefined, which lets the reply through.
+import { defineState } from "eve/context";
+const slot = defineState("open-everywhere.pending-delegation", () => ({}));
+const promisedSlot = defineState("open-everywhere.delegation-report-promised", () => ({}));
+const owedSlot = defineState("open-everywhere.delegation-report-owed", () => ({}));
+/** A cap so a looping turn cannot grow the serialized container without bound. Past it the ledger stops recording, so the extra tasks are UNGUARDED — the guard never starts refusing what it cannot account for. */
+const MAX_PENDING = 16;
+/** The `reply.refused` reason for this guard. Its own string, so a seat that answers over its own
+ *  running worker is countable in production apart from every other reply refusal. */
+export const DELEGATION_PENDING_REFUSAL_REASON = "delegation-pending";
+/** The settle-to-reply link in one row: it carries the task id the settlement wake arrived for and the wake the report was posted to, so an operator can join a delegation.task_settled row to the message the room actually received. */
+export const SETTLEMENT_REPORT_POSTED_ACTION = "delegation.settlement_report_posted";
+/** The action naming a settlement turn that chose silence while it still owed a report. Written per refusal and never gated behind audit.silences, so it stays countable in the actions-only posture production runs in. */
+export const SETTLEMENT_REPORT_SKIPPED_ACTION = "delegation.settlement_report_skipped";
+/** The copy the model reads when the guard refuses. INSTRUCTIVE rather than a wall — it names the legitimate move and the reason — and it discloses no task id and no wake id. */
+export function delegationPendingRefusalMessage() {
+    return ("reply: NOTHING was posted. You started a background worker for this conversation in this turn, " +
+        "and its report has not arrived. You therefore do not hold the answer it was asked for. " +
+        "Do not write that answer from what you believe you know — that is a fabrication, even when it " +
+        "looks right. Post a short hand-off note with `done:false` instead. That keeps this wake " +
+        "answerable, so you can give the real answer the moment the worker's own report reaches you.");
+}
+/** The copy no_reply reads when a settlement turn tries to end in silence while it owes a report. It deliberately does not name the second call: the guard refuses once and then stands aside, and copy that named the valve would buy one extra tool call on the way to the same silence. */
+export function settlementReportOwedMessage() {
+    return ("no_reply: nothing was recorded. You told this conversation you had started this work, and the " +
+        "worker's report has now arrived — that is what woke this turn. The people waiting are waiting " +
+        "for you to relay it, so post it with `reply`: what the worker found, in your own words. " +
+        "This is your own commissioned work coming back, never machine echo.");
+}
+/** Read the durable value defensively — a resumed session can hand back anything a previous
+ *  deployment wrote. Anything unrecognised reads as "no record". */
+function readState(v) {
+    if (v === null || typeof v !== "object")
+        return {};
+    const s = v;
+    if (typeof s.turn !== "string" || s.turn.length === 0)
+        return {};
+    const pending = Array.isArray(s.pending)
+        ? s.pending.flatMap((t) => {
+            if (typeof t !== "object" || t === null)
+                return [];
+            const raw = t;
+            if (typeof raw.taskId !== "string" || raw.taskId.length === 0)
+                return [];
+            return [
+                {
+                    taskId: raw.taskId,
+                    ...(typeof raw.parentWakeId === "string" && raw.parentWakeId.length > 0 ? { parentWakeId: raw.parentWakeId } : {}),
+                },
+            ];
+        })
+        : [];
+    return { turn: s.turn, pending };
+}
+/** Record that THIS turn dispatched a background task that has not settled, with the same parentWakeId the dispatch edge registers the task's own wake against. Recorded even when no wake could be minted: the guard is about the parent's honesty, not about the settlement plumbing. */
+export function notePendingDelegation(turnId, taskId, parentWakeId) {
+    if (turnId === undefined || turnId.length === 0)
+        return;
+    if (taskId.length === 0)
+        return;
+    const entry = { taskId, ...(parentWakeId !== undefined && parentWakeId.length > 0 ? { parentWakeId } : {}) };
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            if (state.turn !== turnId)
+                return { turn: turnId, pending: [entry] };
+            const pending = state.pending ?? [];
+            if (pending.length >= MAX_PENDING || pending.some((t) => t.taskId === taskId))
+                return state;
+            return { turn: turnId, pending: [...pending, entry] };
+        });
+    }
+    catch {
+        /* no eve context — nothing to record, and never a reason to disturb the turn */
+    }
+}
+/** Record that a dispatched task SETTLED, so the guard stops holding this turn's wake open for it. The usual later-turn settlement is a no-op against the turn-stamped ledger; the call that matters is a task the seat sees settle inside the dispatching turn. */
+export function noteDelegationSettled(turnId, taskId) {
+    if (turnId === undefined || turnId.length === 0)
+        return;
+    if (taskId.length === 0)
+        return;
+    try {
+        slot.update((cur) => {
+            const state = readState(cur);
+            if (state.turn !== turnId)
+                return state;
+            const pending = state.pending ?? [];
+            if (!pending.some((t) => t.taskId === taskId))
+                return state;
+            return { turn: turnId, pending: pending.filter((t) => t.taskId !== taskId) };
+        });
+    }
+    catch {
+        /* no eve context — nothing to clear */
+    }
+}
+/** The task id of a dispatch this turn made that still owes wakeId its answer. addressedWake is passed IN rather than imported, so this module stays a dependency-light leaf, and every undefined case is "let the reply through" — the fail-soft direction. */
+export function pendingDelegationOwing(turnId, wakeId, addressedWake) {
+    return pendingDelegationsOwing(turnId, wakeId, addressedWake)[0];
+}
+/** The WAKE-FREE reader, for a per-surface door that holds one conversation and no wake id at all. It assumes the seat is bound to ONE conversation for the whole turn, so it may never be pointed at a unified door, where the first pending dispatch can belong to a sibling conversation and only the wake-keyed sibling can tell them apart. */
+export function pendingDelegationThisTurn(turnId) {
+    if (turnId === undefined || turnId.length === 0)
+        return undefined;
+    let state;
+    try {
+        state = readState(slot.get());
+    }
+    catch {
+        return undefined;
+    }
+    if (state.turn !== turnId)
+        return undefined;
+    return (state.pending ?? [])[0]?.taskId;
+}
+/** Every task of this turn that owes wakeId its answer, in dispatch order. The guard needs only the FIRST id, but the promise needs all of them: a turn that fans out to three workers and posts one hand-off note owes a report on whichever settles first. */
+export function pendingDelegationsOwing(turnId, wakeId, addressedWake) {
+    if (turnId === undefined || turnId.length === 0)
+        return [];
+    if (wakeId.length === 0)
+        return [];
+    let state;
+    try {
+        state = readState(slot.get());
+    }
+    catch {
+        return [];
+    }
+    if (state.turn !== turnId)
+        return [];
+    const pending = state.pending ?? [];
+    if (pending.length === 0)
+        return [];
+    const named = pending.filter((t) => t.parentWakeId === wakeId);
+    if (named.length > 0)
+        return named.map((t) => t.taskId);
+    // 2. The turn has addressed nothing yet, so THIS reply is the statement about which conversation
+    //    the turn is working for — and OPE-601 re-points every task dispatched before it to this wake.
+    if (addressedWake === undefined)
+        return pending.map((t) => t.taskId);
+    // 3. Once the turn has addressed a wake, its pending tasks are pinned there.
+    if (addressedWake === wakeId)
+        return pending.map((t) => t.taskId);
+    return [];
+}
+/** A cap so a looping session cannot grow the serialized container without bound. Past it the OLDEST promise is dropped, so the newest hand-off note — the one the room is waiting on — keeps its duty. */
+const MAX_PROMISED = 32;
+/** Record that this seat TOLD a conversation it had started this task — the promise the settlement duty is armed from. Session-durable and idempotent; a no-op on an empty id, and it never throws. */
+export function notePromisedReport(taskId) {
+    if (taskId.length === 0)
+        return;
+    try {
+        promisedSlot.update((cur) => {
+            const promised = readPromised(cur);
+            if (promised.includes(taskId))
+                return { promised };
+            const next = [...promised, taskId];
+            return { promised: next.length > MAX_PROMISED ? next.slice(next.length - MAX_PROMISED) : next };
+        });
+    }
+    catch {
+        /* no eve context — nothing to record, and never a reason to disturb the turn */
+    }
+}
+/** Was a report promised for this task? Reading it REMOVES it, so one hand-off note buys one duty and a task cannot arm a second turn. False for an unpromised task, an empty id and outside an eve context — all of which are "no duty", the fail-soft direction. */
+export function claimPromisedReport(taskId) {
+    if (taskId.length === 0)
+        return false;
+    try {
+        let held = false;
+        promisedSlot.update((cur) => {
+            const promised = readPromised(cur);
+            held = promised.includes(taskId);
+            return held ? { promised: promised.filter((t) => t !== taskId) } : { promised };
+        });
+        return held;
+    }
+    catch {
+        return false;
+    }
+}
+/** Record that THIS turn was woken by the settlement of a task it promised to report on, so the silence verb can refuse. Called only where the promise held AND the settlement really installed the task's own reply address: the address is a precondition, because a turn with no address can post nothing and demanding a post there is a loop the model cannot win. */
+export function noteSettlementReportOwed(turnId, taskId, wakeId) {
+    if (turnId === undefined || turnId.length === 0)
+        return;
+    if (taskId.length === 0)
+        return;
+    // The wake is REQUIRED, and its absence is a no-op rather than a duty with no address: a duty whose conversation nobody can name cannot be checked at discharge.
+    if (wakeId === undefined || wakeId.length === 0)
+        return;
+    try {
+        owedSlot.update(() => ({ turn: turnId, task: taskId, wake: wakeId }));
+    }
+    catch {
+        /* no eve context — nothing to record */
+    }
+}
+/** The report THIS turn still owes, or undefined; a record stamped for another turn is never answered for this one. Module-private, because a third reader that only looks would let a caller read the duty without ever discharging it. */
+function settlementReportOwed(turnId) {
+    if (turnId === undefined || turnId.length === 0)
+        return undefined;
+    try {
+        const state = owedSlot.get();
+        if (state === null || typeof state !== "object")
+            return undefined;
+        if (state.turn !== turnId)
+            return undefined;
+        const { task, wake } = state;
+        if (typeof task !== "string" || task.length === 0)
+            return undefined;
+        if (typeof wake !== "string" || wake.length === 0)
+            return undefined;
+        return { task, wake };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read-only — dischargeSettlementReport is what clears it. The two are split because A POST IS NOT PROOF OF A REPORT: a standing seat holds several conversations in one turn, so discharging on any post would write a settle-to-reply row naming a room that heard nothing. */
+export function settlementReportOwedOn(turnId) {
+    return settlementReportOwed(turnId);
+}
+/** DISCHARGE the duty — the report reached the conversation it was owed to. Called by the reply
+ *  plane once it has checked that, and never on a post to a sibling conversation. */
+export function dischargeSettlementReport() {
+    clearReportOwed();
+}
+/** A VALVE, NOT A WALL: a settlement turn's report can still be refused by the freshness, fold or stale-conversation gates below this plane, so an unbounded refusal could hold a turn open with no move left that succeeds. The first refusal MARKS and does not clear — the duty must survive it, or the reply plane cannot write the settle-to-reply row — and the second call clears and lets the turn end. */
+export function refuseSettlementReport(turnId) {
+    if (turnId === undefined || turnId.length === 0)
+        return undefined;
+    const owed = settlementReportOwed(turnId);
+    if (owed === undefined)
+        return undefined;
+    try {
+        const already = owedSlot.get()?.refused === true;
+        if (already) {
+            clearReportOwed();
+            return undefined;
+        }
+        owedSlot.update(() => ({ turn: turnId, task: owed.task, wake: owed.wake, refused: true }));
+        return owed.task;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Drop the duty record. Never throws — outside an eve context there is nothing to clear. */
+function clearReportOwed() {
+    try {
+        owedSlot.update(() => ({}));
+    }
+    catch {
+        /* no eve context */
+    }
+}
+/** Read the promise list defensively, for the same reason {@link readState} exists: a resumed
+ *  session can hand back anything a previous deployment wrote. */
+function readPromised(v) {
+    if (v === null || typeof v !== "object")
+        return [];
+    const raw = v.promised;
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((t) => typeof t === "string" && t.length > 0);
+}
+//# sourceMappingURL=pending-delegation-signal.js.map

package/dist/agent/access/pending-delegation-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-delegation-signal.js","sourceRoot":"","sources":["../../../agent/access/pending-delegation-signal.ts"],"names":[],"mappings":"AAAA,kZAAkZ;AAElZ,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgB1C,MAAM,IAAI,GAAG,WAAW,CAAyB,oCAAoC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AASnG,MAAM,YAAY,GAAG,WAAW,CAAsB,4CAA4C,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAYhH,MAAM,QAAQ,GAAG,WAAW,CAAkB,wCAAwC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEpG,qNAAqN;AACrN,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;sFACsF;AACtF,MAAM,CAAC,MAAM,iCAAiC,GAAG,oBAAoB,CAAC;AAEtE,0OAA0O;AAC1O,MAAM,CAAC,MAAM,+BAA+B,GAAG,qCAAqC,CAAC;AAErF,4NAA4N;AAC5N,MAAM,CAAC,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;AAEvF,kLAAkL;AAClL,MAAM,UAAU,+BAA+B;IAC7C,OAAO,CACL,iGAAiG;QACjG,yFAAyF;QACzF,gGAAgG;QAChG,0FAA0F;QAC1F,6FAA6F,CAC9F,CAAC;AACJ,CAAC;AAED,8RAA8R;AAC9R,MAAM,UAAU,2BAA2B;IACzC,OAAO,CACL,gGAAgG;QAChG,gGAAgG;QAChG,0FAA0F;QAC1F,qEAAqE,CACtE,CAAC;AACJ,CAAC;AAED;oEACoE;AACpE,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,CAAC,GAAG,CAA0C,CAAC;IACrD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAuB,EAAE;YAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,CAAiD,CAAC;YAC9D,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACzE,OAAO;gBACL;oBACE,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,GAAG,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnH;aACF,CAAC;QACJ,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,2RAA2R;AAC3R,MAAM,UAAU,qBAAqB,CAAC,MAA0B,EAAE,MAAc,EAAE,YAAgC;IAChH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,MAAM,KAAK,GAAsB,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAChI,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED,oQAAoQ;AACpQ,MAAM,UAAU,qBAAqB,CAAC,MAA0B,EAAE,MAAc;IAC9E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAClB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;AACH,CAAC;AAED,gQAAgQ;AAChQ,MAAM,UAAU,sBAAsB,CAAC,MAA0B,EAAE,MAAc,EAAE,aAAiC;IAClH,OAAO,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,oVAAoV;AACpV,MAAM,UAAU,yBAAyB,CAAC,MAA0B;IAClE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,KAA6B,CAAC;IAClC,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;AAC1C,CAAC;AAED,gQAAgQ;AAChQ,MAAM,UAAU,uBAAuB,CAAC,MAA0B,EAAE,MAAc,EAAE,aAAiC;IACnH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,IAAI,KAA6B,CAAC;IAClC,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,iGAAiG;IACjG,mGAAmG;IACnG,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrE,6EAA6E;IAC7E,IAAI,aAAa,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2MAA2M;AAC3M,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,uMAAuM;AACvM,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClG,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED,sQAAsQ;AACtQ,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2WAA2W;AAC3W,MAAM,UAAU,wBAAwB,CAAC,MAA0B,EAAE,MAAc,EAAE,MAA0B;IAC7G,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,iKAAiK;IACjK,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACxD,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;AACH,CAAC;AAED,4OAA4O;AAC5O,SAAS,oBAAoB,CAAC,MAA0B;IACtD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAA4B,CAAC;QACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC7B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,kRAAkR;AAClR,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;qFACqF;AACrF,MAAM,UAAU,yBAAyB;IACvC,eAAe,EAAE,CAAC;AACpB,CAAC;AAED,mZAAmZ;AACnZ,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAI,QAAQ,CAAC,GAAG,EAA6B,EAAE,OAAO,KAAK,IAAI,CAAC;QAC7E,IAAI,OAAO,EAAE,CAAC;YACZ,eAAe,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,oBAAoB;IACtB,CAAC;AACH,CAAC;AAED;kEACkE;AAClE,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,GAAG,GAAI,CAA4B,CAAC,QAAQ,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/agent/access/permission-evidence.d.ts

@@ -0,0 +1,184 @@
+/**
+ * The shape of one audit row this module reads. Structurally a subset of `AuditEntry`
+ * (operational/store.ts) so a real row satisfies it, DECLARED HERE rather than imported so the pure
+ * module has no edge to the store at all — same posture as `aws-screen.ts` next door.
+ */
+export interface EvidenceRow {
+    readonly ts: string;
+    readonly action: string;
+    readonly detail?: Readonly<Record<string, unknown>>;
+}
+/** The observation window, closed at both ends. `days` is carried because the tightening floor is
+ *  expressed in days and re-deriving it from two ISO strings invites an off-by-one. */
+export interface EvidenceWindow {
+    readonly since: string;
+    readonly until: string;
+    readonly days: number;
+}
+/**
+ * The grants ONE bundle declares that are effective in the scope being reported on — the units a
+ * tightening diff edits. Bundle-grained rather than grant-grained because a diff that removes a
+ * connector has to show the array it is removing it FROM.
+ */
+export interface DeclaredGrants {
+    readonly bundle: string;
+    readonly awsRoles: readonly {
+        readonly roleArn: string;
+        readonly allow: readonly string[];
+    }[];
+    readonly connectors: readonly string[];
+}
+/** A label with an occurrence count — sorted count-desc, then label-asc, everywhere. */
+export interface CountedLabel {
+    readonly label: string;
+    readonly count: number;
+}
+/** Tightening needs a denominator: over a silent window every grant looks unused. A tightening proposal therefore requires at least this many rows of the relevant family; widening has no equivalent floor beyond MIN_WIDEN_REFUSALS. */
+export declare const MIN_TIGHTEN_OBSERVATIONS = 5;
+/** …and a window long enough to contain a normal working rhythm. A grant exercised monthly is not
+ *  "unused" because a Tuesday went by without it. Seven days is the shortest window that contains a
+ *  full weekly cycle, which is the shortest cycle most standing work actually has. */
+export declare const MIN_TIGHTEN_WINDOW_DAYS = 7;
+/** A single refusal is a probe, a typo, or somebody finding out what this scope can do. A REPEATED
+ *  refusal is a need. Below this the observation is still reported as evidence — it is simply not
+ *  dressed up as a proposal. */
+export declare const MIN_WIDEN_REFUSALS = 2;
+/** The one aws refusal family that is a grant-width question. The other three codes are the unconditional fences or a domain's approval mode doing what it was configured to do, so widening any of them would propose deleting a control that works. */
+export interface AwsRefusalEvidence {
+    readonly kind: "aws-allow-list";
+    readonly roleArn: string;
+    /** `service:operation`, the audit row's own grain — which is the grain the allow-list narrows on. */
+    readonly command: string;
+    /** The allow-list entry that would cover it, in the IAM-native spelling the config prefers. */
+    readonly iamEntry: string;
+    /** The grant's list AS THE REFUSAL ROW RECORDED IT — the width at refusal time, which may differ
+     *  from the width now. The proposal renderer prefers the CURRENT declared list and falls back
+     *  here; the divergence is itself worth a reviewer's eye. */
+    readonly allow: readonly string[];
+    readonly refusals: number;
+    readonly unattendedRefusals: number;
+    readonly firstSeen: string;
+    readonly lastSeen: string;
+}
+/**
+ * An `approval.chain` deny cluster for one tool. `reasons` is the transform-reason vocabulary
+ * (`ask-unattended`, `mode-deny-all`, `taint-refused`) plus `element` for an absolute element deny;
+ * the renderer proposes on `ask-unattended` alone and says why for the rest.
+ */
+export interface ChainDenyEvidence {
+    readonly kind: "chain-deny";
+    readonly tool: string;
+    readonly denies: number;
+    readonly unattendedDenies: number;
+    readonly reasons: readonly CountedLabel[];
+    readonly resolvedBy: readonly CountedLabel[];
+    readonly domains: readonly string[];
+    readonly firstSeen: string;
+    readonly lastSeen: string;
+}
+/** An egress.denied cluster for one host. Rows exist only on the self-host tier, where the proxy is ours, so this family is simply empty on Vercel; the row carries host and counts only, never a path, a query string or a method. */
+export interface EgressDenialEvidence {
+    readonly kind: "egress-denied";
+    readonly host: string;
+    /** Denied requests, summed across every row in the window. */
+    readonly denials: number;
+    /** How many audit ROWS carried them — i.e. how many poll windows this host was denied in. A
+     *  host with 200 denials across 1 row is one crash-loop; the same 200 across 12 rows is a
+     *  standing need, and a reader cannot tell those apart from the sum alone. */
+    readonly windows: number;
+    /** Distinct policy generations that denied it, sorted. More than one means the host stayed
+     *  unreachable across a config change, which is a stronger statement than a single generation. */
+    readonly fingerprints: readonly string[];
+    readonly firstSeen: string;
+    readonly lastSeen: string;
+}
+/** A connector.refused cluster for one connection. Two reason codes are grant-width questions, ungranted and ask-unattended at the write tier whose permission has not since arrived; the rest are controls working, and no principal is read into this type. */
+export interface ConnectorRefusalEvidence {
+    readonly kind: "connector-refused";
+    /** The connection name the credential gate refused — the slug a bundle's `connectors` declares. */
+    readonly connection: string;
+    readonly refusals: number;
+    /** Every reason code observed, counted. The full vocabulary is reported; only two are proposed. */
+    readonly reasons: readonly CountedLabel[];
+    /** The qualified op names refused, counted. Absent from the grant-gate rows, which refuse before
+     *  an op is named, so this can be empty while {@link refusals} is not. */
+    readonly ops: readonly CountedLabel[];
+    /** Consequence tiers observed (`read` | `write` | `destructive`), counted. Same caveat as
+     *  {@link ops}: the grant-gate rows carry no tier. */
+    readonly tiers: readonly CountedLabel[];
+    readonly ungranted: number;
+    /** Rows with reason `ask-unattended`, `tier: "write"`, a routine permission key AND no later row
+     *  showing that permission arriving — the ONLY unattended connector refusal a standing routine
+     *  permission can still lift. Counted as a join rather than derived from {@link reasons} and
+     *  {@link tiers} separately, because those two counters cannot say which reason a tier belonged
+     *  to, nor which row carried a routine. */
+    readonly liftableUnattended: number;
+    /** The same reason and tier, but the row stamped `routine: null` — an unattended turn with no
+     *  routine behind it. Reported so the count is not silently lost, and kept OUT of
+     *  {@link liftableUnattended} because there is no routine card to re-arm: the actuator a standing
+     *  permission would be does not exist for these. */
+    readonly unroutedUnattended: number;
+    /** Refusals whose permission has since arrived, kept out of the liftable count because a proposal already actioned teaches its reader to ignore the report. The join is the routine and the permission kind with the generation dropped, and only an arrival stamped after the refusal suppresses it. */
+    readonly armedSinceUnattended: number;
+    readonly firstSeen: string;
+    readonly lastSeen: string;
+}
+export type RefusalEvidence = AwsRefusalEvidence | ChainDenyEvidence | EgressDenialEvidence | ConnectorRefusalEvidence;
+export interface AwsGrantUsage {
+    readonly kind: "aws-role";
+    readonly bundles: readonly string[];
+    readonly roleArn: string;
+    readonly allow: readonly string[];
+    readonly uses: number;
+    readonly commands: readonly CountedLabel[];
+    /** Allow entries that covered at least one observed command. */
+    readonly covering: readonly string[];
+    /** Allow entries that covered NOTHING observed in the window. */
+    readonly unexercised: readonly string[];
+    /** Distinct `service` tokens observed, sorted — what a `["*"]` grant would narrow TO. */
+    readonly services: readonly string[];
+    readonly lastUsed?: string;
+}
+export interface ConnectorGrantUsage {
+    readonly kind: "connector";
+    readonly bundle: string;
+    readonly connector: string;
+    /** The bundle's whole declared `connectors` array — the `before` side of a removal diff. */
+    readonly bundleConnectors: readonly string[];
+    readonly uses: number;
+    readonly ops: readonly CountedLabel[];
+    readonly lastUsed?: string;
+}
+export type GrantUsage = AwsGrantUsage | ConnectorGrantUsage;
+/** How much the scope did AT ALL in the window, per family — the denominators
+ *  {@link MIN_TIGHTEN_OBSERVATIONS} is checked against. */
+export interface EvidenceActivity {
+    readonly awsExec: number;
+    readonly connectorOps: number;
+    readonly chainResolutions: number;
+    /** `egress.denied` ROWS in the window (not the denials they sum to). Reported as a denominator
+     *  like the others, but note it is NOT one: there is no tightening loop on the egress plane —
+     *  a reachable host that nothing used leaves no row to count, so "unused host" is unobservable
+     *  from this log and is deliberately not proposed. */
+    readonly egressDenialRows: number;
+}
+export interface PermissionEvidence {
+    readonly window: EvidenceWindow;
+    readonly rowsConsidered: number;
+    readonly activity: EvidenceActivity;
+    readonly refusals: readonly RefusalEvidence[];
+    readonly usage: readonly GrantUsage[];
+}
+/** The allow-list entry that would cover a `service:operation` label, IAM-native (`logs:StartQuery`).
+ *  A service-only label yields the bare service entry, which is the grammar's "any operation". */
+export declare function iamEntryForCommandLabel(label: string): string;
+/** Does ONE allow entry cover ONE observed command? Asked of the REAL screen (see the header) — a
+ *  single-entry allow-list is exactly "would this entry alone have let the command through". */
+export declare function entryCoversCommand(entry: string, commandLabel: string): boolean;
+/** Build a closed window ending `now`, `days` wide. */
+export declare function makeWindow(days: number, now: Date): EvidenceWindow;
+/** Loop 1's measurement: refusals clustered by role and command, by tool, by host and by connection, with rows outside the window dropped. A cluster nobody proposes on never reaches a human, so a caller that wants those must read this return value directly. */
+export declare function refusalEvidence(rows: readonly EvidenceRow[], window: EvidenceWindow): readonly RefusalEvidence[];
+/** Both loops' measurements plus the denominators, in one pass-shaped call. */
+export declare function permissionEvidence(rows: readonly EvidenceRow[], grants: readonly DeclaredGrants[], window: EvidenceWindow): PermissionEvidence;
+//# sourceMappingURL=permission-evidence.d.ts.map

package/dist/agent/access/permission-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-evidence.d.ts","sourceRoot":"","sources":["../../../agent/access/permission-evidence.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAED;uFACuF;AACvF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC9F,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,0OAA0O;AAC1O,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C;;sFAEsF;AACtF,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC;;gCAEgC;AAChC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,yPAAyP;AACzP,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;iEAE6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,EAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,uOAAuO;AACvO,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;kFAE8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;sGACkG;IAClG,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,iQAAiQ;AACjQ,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,mGAAmG;IACnG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mGAAmG;IACnG,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C;8EAC0E;IAC1E,QAAQ,CAAC,GAAG,EAAE,SAAS,YAAY,EAAE,CAAC;IACtC;0DACsD;IACtD,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;+CAI2C;IAC3C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;wDAGoD;IACpD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,ySAAyS;IACzS,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,eAAe,GAAG,kBAAkB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,wBAAwB,CAAC;AAEvH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,YAAY,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,mBAAmB,CAAC;AAE7D;2DAC2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC;;;0DAGsD;IACtD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAmCD;kGACkG;AAClG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7D;AAED;gGACgG;AAChG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE/E;AAED,uDAAuD;AACvD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,cAAc,CAIlE;AAMD,qQAAqQ;AACrQ,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,cAAc,GAAG,SAAS,eAAe,EAAE,CAiQhH;AAmGD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,MAAM,EAAE,cAAc,GACrB,kBAAkB,CAcpB"}