@open-everywhere/core 0.1.0

package/dist/agent/access/permission-evidence.js

@@ -0,0 +1,412 @@
+// Reads the audit log for both permission loops: refusals saying a grant is too narrow, and usage saying one is too wide. It counts and proposes nothing, it is pure, and it carries no principal, so an unattended routine can run the tightening scan.
+import { awsCommandVerdict, cliOpToIamAction } from "./aws-screen.js";
+// The routine permission key's own grammar, from the zero-import leaf that owns it — never a second
+// regex here. This module stays pure: `routines/permission-key.ts` imports nothing.
+import { routinePermissionKeyIdentity } from "../routines/permission-key.js";
+/** Tightening needs a denominator: over a silent window every grant looks unused. A tightening proposal therefore requires at least this many rows of the relevant family; widening has no equivalent floor beyond MIN_WIDEN_REFUSALS. */
+export const MIN_TIGHTEN_OBSERVATIONS = 5;
+/** …and a window long enough to contain a normal working rhythm. A grant exercised monthly is not
+ *  "unused" because a Tuesday went by without it. Seven days is the shortest window that contains a
+ *  full weekly cycle, which is the shortest cycle most standing work actually has. */
+export const MIN_TIGHTEN_WINDOW_DAYS = 7;
+/** A single refusal is a probe, a typo, or somebody finding out what this scope can do. A REPEATED
+ *  refusal is a need. Below this the observation is still reported as evidence — it is simply not
+ *  dressed up as a proposal. */
+export const MIN_WIDEN_REFUSALS = 2;
+function str(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+function strArray(v) {
+    return Array.isArray(v) && v.every((x) => typeof x === "string") ? v : undefined;
+}
+function counted(counts) {
+    return [...counts.entries()]
+        .map(([label, count]) => ({ label, count }))
+        .sort((a, b) => b.count - a.count || a.label.localeCompare(b.label));
+}
+function bump(m, key) {
+    m.set(key, (m.get(key) ?? 0) + 1);
+}
+/** The key that joins a connector refusal to the arrival of the permission it wanted: the routine, with its generation dropped, and the grant kind. An unjoinable row is never suppressed, and suppression still requires an arrival stamped after the refusal, which keeps a revoked permission proposable. */
+function arrivalJoinKey(routineKey, permissionKind) {
+    if (routineKey === undefined || permissionKind === undefined)
+        return undefined;
+    const routine = routinePermissionKeyIdentity(routineKey);
+    return routine === undefined ? undefined : `${routine}\u0000${permissionKind}`;
+}
+/** `service:operation` → the argv the screen would have seen. A service-only label (`s3`) yields a
+ *  one-token argv, which is exactly what the CLI got. Splits on the FIRST colon only. */
+function argvOfCommandLabel(label) {
+    const sep = label.indexOf(":");
+    if (sep < 0)
+        return [label];
+    return [label.slice(0, sep), label.slice(sep + 1)];
+}
+/** The allow-list entry that would cover a `service:operation` label, IAM-native (`logs:StartQuery`).
+ *  A service-only label yields the bare service entry, which is the grammar's "any operation". */
+export function iamEntryForCommandLabel(label) {
+    const [service, op] = argvOfCommandLabel(label);
+    if (op === undefined)
+        return service ?? label;
+    return `${service}:${cliOpToIamAction(op)}`;
+}
+/** Does ONE allow entry cover ONE observed command? Asked of the REAL screen (see the header) — a
+ *  single-entry allow-list is exactly "would this entry alone have let the command through". */
+export function entryCoversCommand(entry, commandLabel) {
+    return awsCommandVerdict({ argv: argvOfCommandLabel(commandLabel), allow: [entry] }).ok;
+}
+/** Build a closed window ending `now`, `days` wide. */
+export function makeWindow(days, now) {
+    const until = now.toISOString();
+    const since = new Date(now.getTime() - days * 24 * 60 * 60 * 1000).toISOString();
+    return { since, until, days };
+}
+function inWindow(row, w) {
+    return row.ts >= w.since && row.ts <= w.until;
+}
+/** Loop 1's measurement: refusals clustered by role and command, by tool, by host and by connection, with rows outside the window dropped. A cluster nobody proposes on never reaches a human, so a caller that wants those must read this return value directly. */
+export function refusalEvidence(rows, window) {
+    const aws = new Map();
+    const chain = new Map();
+    const egress = new Map();
+    const connectorRefused = new Map();
+    // The arrival side is read first, because a refusal's verdict depends on rows that may sit after it in the array. Only the latest arrival per routine and kind is kept, and the join drops the routine's generation because the report's own remedy mints a new one.
+    const grantedAt = new Map();
+    for (const row of rows) {
+        if (!inWindow(row, window))
+            continue;
+        if (row.action !== "routine.permission_granted" && row.action !== "connector.unattended_lift")
+            continue;
+        const d = row.detail ?? {};
+        // The two rows spell the grant key in different fields, and the difference matters: the click
+        // row's `routine` is the routine ID, not the key, so reading it here would join on a value no
+        // refusal row ever carries. Each action is read at its own field, never at whichever is present.
+        const routineKey = row.action === "routine.permission_granted" ? str(d.key) : str(d.routine);
+        // `grant` is the PERSISTED detail key for the permission kind and does not move (OPE-1303) —
+        // the rows it names are already in deployed audit chains.
+        const permissionKind = str(d.grant);
+        const joinKey = arrivalJoinKey(routineKey, permissionKind);
+        if (joinKey === undefined)
+            continue;
+        const prior = grantedAt.get(joinKey);
+        if (prior === undefined || row.ts > prior)
+            grantedAt.set(joinKey, row.ts);
+    }
+    for (const row of rows) {
+        if (!inWindow(row, window))
+            continue;
+        const d = row.detail ?? {};
+        if (row.action === "aws.refused") {
+            if (str(d.reason) !== "allow-list")
+                continue;
+            const roleArn = str(d.roleArn);
+            const command = str(d.command);
+            if (roleArn === undefined || command === undefined)
+                continue;
+            const key = `${roleArn}\u0000${command}`;
+            const prior = aws.get(key);
+            const allow = strArray(d.allow) ?? prior?.allow ?? [];
+            aws.set(key, {
+                roleArn,
+                command,
+                allow,
+                refusals: (prior?.refusals ?? 0) + 1,
+                unattended: (prior?.unattended ?? 0) + (d.unattended === true ? 1 : 0),
+                first: prior === undefined || row.ts < prior.first ? row.ts : prior.first,
+                last: prior === undefined || row.ts > prior.last ? row.ts : prior.last,
+            });
+            continue;
+        }
+        if (row.action === "egress.denied") {
+            // HOST ONLY — the row is written that way (egress-denial-poller.ts) and read that way. A row
+            // with no host, or a `count` that is not a positive integer, is a row this reader does not
+            // understand, and the fail-quiet posture the whole plane is built on says drop it rather than
+            // guess a count.
+            const host = str(d.host);
+            const rawCount = typeof d.count === "number" ? d.count : 1;
+            if (host === undefined || !Number.isInteger(rawCount) || rawCount <= 0)
+                continue;
+            let acc = egress.get(host);
+            if (acc === undefined) {
+                acc = { host, denials: 0, windows: 0, fingerprints: new Set(), first: row.ts, last: row.ts };
+                egress.set(host, acc);
+            }
+            acc.denials += rawCount;
+            acc.windows++;
+            const fp = str(d.policyFingerprint);
+            if (fp !== undefined)
+                acc.fingerprints.add(fp);
+            if (row.ts < acc.first)
+                acc.first = row.ts;
+            if (row.ts > acc.last)
+                acc.last = row.ts;
+            continue;
+        }
+        if (row.action === "connector.refused") {
+            // The connection name is the whole cluster key and the only field the remedy needs, so a row
+            // without one is a row this reader cannot attribute — dropped rather than bucketed under a
+            // placeholder, the same posture the egress family takes on a missing host.
+            const connection = str(d.connection);
+            if (connection === undefined)
+                continue;
+            let acc = connectorRefused.get(connection);
+            if (acc === undefined) {
+                acc = {
+                    connection,
+                    refusals: 0,
+                    reasons: new Map(),
+                    ops: new Map(),
+                    tiers: new Map(),
+                    ungranted: 0,
+                    liftable: 0,
+                    unrouted: 0,
+                    armedSince: 0,
+                    first: row.ts,
+                    last: row.ts,
+                };
+                connectorRefused.set(connection, acc);
+            }
+            acc.refusals++;
+            if (row.ts < acc.first)
+                acc.first = row.ts;
+            if (row.ts > acc.last)
+                acc.last = row.ts;
+            const reason = str(d.reason);
+            bump(acc.reasons, reason ?? "unrecorded");
+            const op = str(d.op);
+            if (op !== undefined)
+                bump(acc.ops, op);
+            const tier = str(d.tier);
+            if (tier !== undefined)
+                bump(acc.tiers, tier);
+            if (reason === "ungranted")
+                acc.ungranted++;
+            // The join is done here because only the row knows which tier its reason belonged to and which row carried a routine. A present routine key says a standing permission is the actuator, and the actuator must still be missing; a row with no grant kind cannot be joined and is never suppressed.
+            if (reason === "ask-unattended" && tier === "write") {
+                const routineKey = str(d.routine);
+                const permissionKind = str(d.grant);
+                const joinKey = arrivalJoinKey(routineKey, permissionKind);
+                const arrived = joinKey === undefined ? undefined : grantedAt.get(joinKey);
+                if (routineKey === undefined)
+                    acc.unrouted++;
+                else if (arrived !== undefined && arrived > row.ts)
+                    acc.armedSince++;
+                else
+                    acc.liftable++;
+            }
+            continue;
+        }
+        if (row.action === "approval.chain") {
+            if (str(d.verdict) !== "deny")
+                continue;
+            const tool = str(d.tool);
+            if (tool === undefined)
+                continue;
+            let acc = chain.get(tool);
+            if (acc === undefined) {
+                acc = {
+                    tool,
+                    denies: 0,
+                    unattended: 0,
+                    reasons: new Map(),
+                    resolvedBy: new Map(),
+                    domains: new Set(),
+                    first: row.ts,
+                    last: row.ts,
+                };
+                chain.set(tool, acc);
+            }
+            acc.denies++;
+            if (d.unattended === true)
+                acc.unattended++;
+            if (row.ts < acc.first)
+                acc.first = row.ts;
+            if (row.ts > acc.last)
+                acc.last = row.ts;
+            const domain = str(d.domain);
+            if (domain !== undefined)
+                acc.domains.add(domain);
+            const resolvedBy = str(d.resolvedBy);
+            if (resolvedBy !== undefined)
+                bump(acc.resolvedBy, resolvedBy);
+            // The reason vocabulary: a transform's own `reason` when a transform produced the deny,
+            // otherwise `element` — an absolute element deny, which carries no transform at all.
+            const transforms = Array.isArray(d.transforms) ? d.transforms : [];
+            const denyReasons = transforms
+                .filter((t) => typeof t === "object" && t !== null)
+                .filter((t) => t.to === "deny")
+                .map((t) => str(t.reason) ?? "transform")
+                .sort();
+            if (denyReasons.length === 0)
+                bump(acc.reasons, "element");
+            else
+                for (const r of denyReasons)
+                    bump(acc.reasons, r);
+        }
+    }
+    const awsOut = [...aws.values()]
+        .map((a) => ({
+        kind: "aws-allow-list",
+        roleArn: a.roleArn,
+        command: a.command,
+        iamEntry: iamEntryForCommandLabel(a.command),
+        allow: a.allow,
+        refusals: a.refusals,
+        unattendedRefusals: a.unattended,
+        firstSeen: a.first,
+        lastSeen: a.last,
+    }))
+        .sort((x, y) => y.refusals - x.refusals || x.roleArn.localeCompare(y.roleArn) || x.command.localeCompare(y.command));
+    const chainOut = [...chain.values()]
+        .map((c) => ({
+        kind: "chain-deny",
+        tool: c.tool,
+        denies: c.denies,
+        unattendedDenies: c.unattended,
+        reasons: counted(c.reasons),
+        resolvedBy: counted(c.resolvedBy),
+        domains: [...c.domains].sort(),
+        firstSeen: c.first,
+        lastSeen: c.last,
+    }))
+        .sort((x, y) => y.denies - x.denies || x.tool.localeCompare(y.tool));
+    const egressOut = [...egress.values()]
+        .map((e) => ({
+        kind: "egress-denied",
+        host: e.host,
+        denials: e.denials,
+        windows: e.windows,
+        fingerprints: [...e.fingerprints].sort(),
+        firstSeen: e.first,
+        lastSeen: e.last,
+    }))
+        .sort((x, y) => y.denials - x.denials || x.host.localeCompare(y.host));
+    const connectorOut = [...connectorRefused.values()]
+        .map((c) => ({
+        kind: "connector-refused",
+        connection: c.connection,
+        refusals: c.refusals,
+        reasons: counted(c.reasons),
+        ops: counted(c.ops),
+        tiers: counted(c.tiers),
+        ungranted: c.ungranted,
+        liftableUnattended: c.liftable,
+        unroutedUnattended: c.unrouted,
+        armedSinceUnattended: c.armedSince,
+        firstSeen: c.first,
+        lastSeen: c.last,
+    }))
+        .sort((x, y) => y.refusals - x.refusals || x.connection.localeCompare(y.connection));
+    return [...awsOut, ...chainOut, ...egressOut, ...connectorOut];
+}
+/**
+ * LOOP 2's measurement: for every declared grant, what the window actually exercised. Grants with
+ * ZERO uses are returned too — a zero is the whole point of this loop, and suppressing it here would
+ * move the "was there enough activity to believe the zero?" judgement into the wrong module (it
+ * lives in the proposal renderer, against {@link EvidenceActivity}).
+ */
+function grantUsageEvidence(rows, grants, window) {
+    const awsByRole = new Map();
+    const connByName = new Map();
+    for (const row of rows) {
+        if (!inWindow(row, window))
+            continue;
+        const d = row.detail ?? {};
+        if (row.action === "aws.exec") {
+            const roleArn = str(d.roleArn);
+            const command = str(d.command);
+            if (roleArn === undefined || command === undefined)
+                continue;
+            let acc = awsByRole.get(roleArn);
+            if (acc === undefined) {
+                acc = { commands: new Map(), uses: 0 };
+                awsByRole.set(roleArn, acc);
+            }
+            acc.uses++;
+            bump(acc.commands, command);
+            if (acc.last === undefined || row.ts > acc.last)
+                acc.last = row.ts;
+            continue;
+        }
+        if (row.action === "connector.op") {
+            const connection = str(d.connection);
+            const op = str(d.op);
+            if (connection === undefined)
+                continue;
+            let acc = connByName.get(connection);
+            if (acc === undefined) {
+                acc = { ops: new Map(), uses: 0 };
+                connByName.set(connection, acc);
+            }
+            acc.uses++;
+            if (op !== undefined)
+                bump(acc.ops, op);
+            if (acc.last === undefined || row.ts > acc.last)
+                acc.last = row.ts;
+        }
+    }
+    // AWS grants are deduped by roleArn across bundles (the resolver's own narrowest-wins key), so the
+    // report names every bundle that declares the ARN and lets the reviewer pick — see the tool.
+    const awsBundles = new Map();
+    for (const g of grants) {
+        for (const r of g.awsRoles) {
+            const prior = awsBundles.get(r.roleArn);
+            if (prior === undefined)
+                awsBundles.set(r.roleArn, { bundles: new Set([g.bundle]), allow: r.allow });
+            else
+                prior.bundles.add(g.bundle);
+        }
+    }
+    const out = [];
+    for (const [roleArn, decl] of [...awsBundles.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+        const observed = awsByRole.get(roleArn);
+        const commands = observed === undefined ? [] : counted(observed.commands);
+        const covering = decl.allow.filter((entry) => commands.some((c) => entryCoversCommand(entry, c.label)));
+        const unexercised = decl.allow.filter((entry) => !covering.includes(entry));
+        const services = [...new Set(commands.map((c) => argvOfCommandLabel(c.label)[0] ?? ""))].filter((s) => s.length > 0).sort();
+        out.push({
+            kind: "aws-role",
+            bundles: [...decl.bundles].sort(),
+            roleArn,
+            allow: decl.allow,
+            uses: observed?.uses ?? 0,
+            commands,
+            covering,
+            unexercised,
+            services,
+            ...(observed?.last !== undefined ? { lastUsed: observed.last } : {}),
+        });
+    }
+    for (const g of grants) {
+        for (const connector of g.connectors) {
+            const observed = connByName.get(connector);
+            out.push({
+                kind: "connector",
+                bundle: g.bundle,
+                connector,
+                bundleConnectors: g.connectors,
+                uses: observed?.uses ?? 0,
+                ops: observed === undefined ? [] : counted(observed.ops),
+                ...(observed?.last !== undefined ? { lastUsed: observed.last } : {}),
+            });
+        }
+    }
+    return out;
+}
+/** Both loops' measurements plus the denominators, in one pass-shaped call. */
+export function permissionEvidence(rows, grants, window) {
+    const inside = rows.filter((r) => inWindow(r, window));
+    return {
+        window,
+        rowsConsidered: inside.length,
+        activity: {
+            awsExec: inside.filter((r) => r.action === "aws.exec").length,
+            connectorOps: inside.filter((r) => r.action === "connector.op").length,
+            chainResolutions: inside.filter((r) => r.action === "approval.chain").length,
+            egressDenialRows: inside.filter((r) => r.action === "egress.denied").length,
+        },
+        refusals: refusalEvidence(rows, window),
+        usage: grantUsageEvidence(rows, grants, window),
+    };
+}
+//# sourceMappingURL=permission-evidence.js.map

package/dist/agent/access/permission-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-evidence.js","sourceRoot":"","sources":["../../../agent/access/permission-evidence.ts"],"names":[],"mappings":"AAAA,yPAAyP;AAEzP,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACtE,oGAAoG;AACpG,oFAAoF;AACpF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAsC7E,0OAA0O;AAC1O,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C;;sFAEsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC;;gCAEgC;AAChC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AA0IpC,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1G,CAAC;AAED,SAAS,OAAO,CAAC,MAAmC;IAClD,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;SAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,IAAI,CAAC,CAAsB,EAAE,GAAW;IAC/C,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,gTAAgT;AAChT,SAAS,cAAc,CAAC,UAA8B,EAAE,cAAkC;IACxF,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/E,MAAM,OAAO,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;IACzD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,SAAS,cAAc,EAAE,CAAC;AACjF,CAAC;AAED;yFACyF;AACzF,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;kGACkG;AAClG,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,OAAO,IAAI,KAAK,CAAC;IAC9C,OAAO,GAAG,OAAO,IAAI,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,YAAoB;IACpE,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAS;IAChD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAgB,EAAE,CAAiB;IACnD,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,qQAAqQ;AACrQ,MAAM,UAAU,eAAe,CAAC,IAA4B,EAAE,MAAsB;IAUlF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IAYtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAU1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAe5C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEpD,qQAAqQ;IACrQ,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAAE,SAAS;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,4BAA4B,IAAI,GAAG,CAAC,MAAM,KAAK,2BAA2B;YAAE,SAAS;QACxG,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC3B,8FAA8F;QAC9F,8FAA8F;QAC9F,iGAAiG;QACjG,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,KAAK,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7F,6FAA6F;QAC7F,0DAA0D;QAC1D,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,GAAG,KAAK;YAAE,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,YAAY;gBAAE,SAAS;YAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YAC7D,MAAM,GAAG,GAAG,GAAG,OAAO,SAAS,OAAO,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;YACtD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBACX,OAAO;gBACP,OAAO;gBACP,KAAK;gBACL,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;gBACpC,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtE,KAAK,EAAE,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK;gBACzE,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;aACvE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACnC,6FAA6F;YAC7F,2FAA2F;YAC3F,8FAA8F;YAC9F,iBAAiB;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;gBAAE,SAAS;YACjF,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;gBAC7F,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACxB,CAAC;YACD,GAAG,CAAC,OAAO,IAAI,QAAQ,CAAC;YACxB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACpC,IAAI,EAAE,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;YACvC,6FAA6F;YAC7F,2FAA2F;YAC3F,2EAA2E;YAC3E,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,GAAG,GAAG;oBACJ,UAAU;oBACV,QAAQ,EAAE,CAAC;oBACX,OAAO,EAAE,IAAI,GAAG,EAAE;oBAClB,GAAG,EAAE,IAAI,GAAG,EAAE;oBACd,KAAK,EAAE,IAAI,GAAG,EAAE;oBAChB,SAAS,EAAE,CAAC;oBACZ,QAAQ,EAAE,CAAC;oBACX,QAAQ,EAAE,CAAC;oBACX,UAAU,EAAE,CAAC;oBACb,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,IAAI,EAAE,GAAG,CAAC,EAAE;iBACb,CAAC;gBACF,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,GAAG,CAAC,QAAQ,EAAE,CAAC;YACf,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,YAAY,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,WAAW;gBAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YAC5C,mSAAmS;YACnS,IAAI,MAAM,KAAK,gBAAgB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpD,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACpC,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBAC3D,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3E,IAAI,UAAU,KAAK,SAAS;oBAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;qBACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,GAAG,CAAC,EAAE;oBAAE,GAAG,CAAC,UAAU,EAAE,CAAC;;oBAChE,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtB,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,SAAS;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,GAAG,GAAG;oBACJ,IAAI;oBACJ,MAAM,EAAE,CAAC;oBACT,UAAU,EAAE,CAAC;oBACb,OAAO,EAAE,IAAI,GAAG,EAAE;oBAClB,UAAU,EAAE,IAAI,GAAG,EAAE;oBACrB,OAAO,EAAE,IAAI,GAAG,EAAE;oBAClB,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,IAAI,EAAE,GAAG,CAAC,EAAE;iBACb,CAAC;gBACF,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;gBAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YAC5C,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAC/D,wFAAwF;YACxF,qFAAqF;YACrF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,UAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,WAAW,GAAG,UAAU;iBAC3B,MAAM,CAAC,CAAC,CAAC,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;iBAChF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC;iBACxC,IAAI,EAAE,CAAC;YACV,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;;gBACtD,KAAK,MAAM,CAAC,IAAI,WAAW;oBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAyB,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;SACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,gBAAyB;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5C,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,kBAAkB,EAAE,CAAC,CAAC,UAAU;QAChC,SAAS,EAAE,CAAC,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;KACjB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvH,MAAM,QAAQ,GAAwB,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,YAAqB;QAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,gBAAgB,EAAE,CAAC,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3B,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;QACjC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;QAC9B,SAAS,EAAE,CAAC,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;KACjB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvE,MAAM,SAAS,GAA2B,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;SAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,eAAwB;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;QACxC,SAAS,EAAE,CAAC,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;KACjB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzE,MAAM,YAAY,GAA+B,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,IAAI,EAAE,mBAA4B;QAClC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3B,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACvB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,kBAAkB,EAAE,CAAC,CAAC,QAAQ;QAC9B,kBAAkB,EAAE,CAAC,CAAC,QAAQ;QAC9B,oBAAoB,EAAE,CAAC,CAAC,UAAU;QAClC,SAAS,EAAE,CAAC,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;KACjB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvF,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,GAAG,SAAS,EAAE,GAAG,YAAY,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,IAA4B,EAC5B,MAAiC,EACjC,MAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0E,CAAC;IACpG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqE,CAAC;IAEhG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YAC7D,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,GAAG,GAAG,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACvC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC9B,CAAC;YACD,GAAG,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,GAAG,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,6FAA6F;IAC7F,MAAM,UAAU,GAAG,IAAI,GAAG,EAA8D,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;;gBAChG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAiB,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5H,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;YACjC,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC;YACzB,QAAQ;YACR,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,GAAG,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,SAAS,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS;gBACT,gBAAgB,EAAE,CAAC,CAAC,UAAU;gBAC9B,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC;gBACzB,GAAG,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACxD,GAAG,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAChC,IAA4B,EAC5B,MAAiC,EACjC,MAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,OAAO;QACL,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,QAAQ,EAAE;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM;YAC7D,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM;YACtE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,MAAM;YAC5E,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,MAAM;SAC5E;QACD,QAAQ,EAAE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC;QACvC,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/dist/agent/access/permission-proposal.d.ts

@@ -0,0 +1,33 @@
+import { type PermissionEvidence } from "./permission-evidence.js";
+/** The config file every proposal in v1 edits — the deployer app's bundle definitions. */
+export declare const PERMISSION_CONFIG_FILE = "agent/access/bundles.ts";
+/** A concrete, reviewable config edit. `before`/`after` are the array the edit rewrites; a whole-grant removal is spelled `after: []` with a `path` that names the grant rather than its `allow`. */
+export interface PermissionDiff {
+    readonly file: string;
+    /** Every loaded bundle that declares this grant. Where several do, naming all of them is the honest answer: the resolver dedupes an ARN across bundles and does not report which binding won. */
+    readonly bundles: readonly string[];
+    readonly path: string;
+    readonly before: readonly string[];
+    readonly after: readonly string[];
+    readonly text: string;
+}
+export interface PermissionProposal {
+    /** Stable and deterministic — the same evidence yields the same id, so a routine that posts these
+     *  weekly can be de-duplicated by a human (or by a rule) without a fingerprint scheme. */
+    readonly id: string;
+    readonly direction: "widen" | "tighten";
+    readonly subject: string;
+    readonly summary: string;
+    /** The rows this stands on, as sentences with counts. Never a principal, never an argument value. */
+    readonly evidence: readonly string[];
+    /** Present when a mechanical config edit is derivable. Absent is NOT a weaker proposal — it means
+     *  the actuator is not a config diff, and {@link remedy} names what it is instead. */
+    readonly diff?: PermissionDiff;
+    readonly remedy?: string;
+}
+export type ProposalDirection = "both" | "widen" | "tighten";
+/** Evidence into proposals. Deterministic: the same evidence yields the same list in the same order, widen first. */
+export declare function proposePermissionChanges(ev: PermissionEvidence, direction?: ProposalDirection): readonly PermissionProposal[];
+/** The human-readable report. It leads with the window and the denominators, because "no proposals" over 4 rows means something different from "no proposals" over 4,000. */
+export declare function renderPermissionProposals(ev: PermissionEvidence, proposals: readonly PermissionProposal[]): string;
+//# sourceMappingURL=permission-proposal.d.ts.map

package/dist/agent/access/permission-proposal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-proposal.d.ts","sourceRoot":"","sources":["../../../agent/access/permission-proposal.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAC;AAElC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,4BAA4B,CAAC;AAEhE,qMAAqM;AACrM,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iMAAiM;IACjM,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC;8FAC0F;IAC1F,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;0FACsF;IACtF,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAgRD,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7D,qHAAqH;AACrH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,kBAAkB,EAAE,SAAS,GAAE,iBAA0B,GAAG,SAAS,kBAAkB,EAAE,CAKrI;AAED,6KAA6K;AAC7K,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAsClH"}