@open-everywhere/core 0.1.0

package/dist/agent/access/tenant-admission.js

@@ -0,0 +1,154 @@
+// On a tenant-scoped platform a person id is issued PER TENANT while a principal key is only platform/id, so a second workspace's delivery can silently hand one person another's standing, and nothing in the front door stops it. Refuse by default in two places, both naming the same admitted set — the config load refuses a deployment declaring two tenants, and the wake door drops a delivery from a tenant nobody declared.
+import { getConfig } from "./config.js";
+import { isTenantScopedPlatform, principalKeyReplacementHint } from "../identity/principal-key.js";
+/** Slack guarantees the shape — a workspace id is T… and an Enterprise Grid organisation is E… — and the two id spaces are disjoint, so ONE reach segment can name either rung and the reader still knows which. Only Slack has a rung above the workspace, so every other platform's segments are workspace-rung. */
+const ENTERPRISE_RUNG_PREFIX = new Map([["slack", "E"]]);
+/** Which rung `tenant` names on `platform`, by id shape. Pure. A platform with no enterprise rung
+ *  answers `"workspace"` for every id. */
+export function tenantRungOf(platform, tenant) {
+    const prefix = ENTERPRISE_RUNG_PREFIX.get(platform);
+    return prefix !== undefined && tenant.startsWith(prefix) ? "enterprise" : "workspace";
+}
+export function splitTenantRungs(platform, tenants) {
+    const workspaces = new Set();
+    const enterprises = new Set();
+    for (const t of tenants)
+        (tenantRungOf(platform, t) === "enterprise" ? enterprises : workspaces).add(t);
+    return { workspaces, enterprises };
+}
+/** The opt-in that turns the whole fence off. It is an ENV knob rather than a config field because it is an operator's assertion about a topology, and because turning it on accepts a KNOWN aliasing exposure until the tenant rung lands in the principal grammar. */
+export const MULTI_TENANT_ENV = "OE_ALLOW_MULTI_TENANT_PRINCIPALS";
+export function multiTenantPrincipalsAllowed() {
+    return process.env[MULTI_TENANT_ENV] === "1";
+}
+/** The tenants this deployment declares: the second segment of every Domain.reach entry, in any of its shapes. An entry that does not parse contributes nothing, because inventing a tenant from a broken string hides the real bug. */
+export function admittedTenants(platform, domains) {
+    const admitted = new Set();
+    const prefix = `${platform}/`;
+    for (const d of domains) {
+        // All three entry shapes are read: reading only one would drop a container-only domain out of the admitted set, and the wake door would then refuse every delivery from a tenant the config plainly serves. A glob's `*` can only be in the LAST segment, so the tenant read is never a pattern.
+        for (const key of d.reach ?? []) {
+            if (!key.startsWith(prefix))
+                continue;
+            const tenant = key.slice(prefix.length).split("/")[0];
+            if (tenant)
+                admitted.add(tenant);
+        }
+    }
+    return admitted;
+}
+/** Fail-soft to an empty set when no config is registered, which the classifier reads as "nothing declared, fence inert", never as "everything refused". */
+export function admittedTenantsFromConfig(platform) {
+    try {
+        return admittedTenants(platform, getConfig().loadDomains());
+    }
+    catch {
+        return new Set();
+    }
+}
+/** The deterministic source for every site with no tenant in hand, and it is deterministic only because the config-load fence refuses two tenants of one tenant-scoped platform. undefined on zero, on more than one, and on ANY declared enterprise: an E… entry admits every workspace under that organisation, so answering with the one workspace written down would stamp it onto people in a sibling one. */
+export function soleAdmittedTenant(platform, domains) {
+    const { workspaces, enterprises } = splitTenantRungs(platform, admittedTenants(platform, domains));
+    if (enterprises.size > 0)
+        return undefined;
+    return workspaces.size === 1 ? [...workspaces][0] : undefined;
+}
+/** {@link soleAdmittedTenant} against the registered app config; `undefined` when no config is
+ *  registered, on the same fail-soft grounds as {@link admittedTenantsFromConfig}. */
+export function soleAdmittedTenantFromConfig(platform) {
+    try {
+        return soleAdmittedTenant(platform, getConfig().loadDomains());
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Fails LOUD at boot rather than degrading at runtime, because the failure it prevents is invisible by construction: two people sharing a principal key produce no error, only the wrong answer to "is this an admin". It counts each RUNG separately, and it still cannot catch the exposure inside ONE organisation, whose workspace count the config does not state. */
+export function assertSingleTenantPerTenantScopedPlatform(domains) {
+    if (multiTenantPrincipalsAllowed())
+        return;
+    const platforms = new Set();
+    for (const d of domains) {
+        for (const key of d.reach ?? []) {
+            const platform = key.split("/")[0];
+            if (platform && isTenantScopedPlatform(platform))
+                platforms.add(platform);
+        }
+    }
+    const bad = [];
+    for (const platform of [...platforms].sort()) {
+        const rungs = splitTenantRungs(platform, admittedTenants(platform, domains));
+        for (const [rung, ids] of [
+            ["tenants", rungs.workspaces],
+            ["enterprises", rungs.enterprises],
+        ]) {
+            const tenants = [...ids].sort();
+            if (tenants.length <= 1)
+                continue;
+            // Each rung gets its own words: one shared body told an operator who had declared two Enterprise Grid organisations that they had declared two workspaces, and the two rungs need different remedies.
+            const exposure = rung === "enterprises"
+                ? `Each \`E…\` entry admits EVERY workspace under that organisation, and a person id is issued PER WORKSPACE — so two organisations' ` +
+                    `members share one \`${platform}/<id>\` principal key, across a population no entry here names.`
+                : `On ${platform} a person id is issued PER TENANT, but a principal key is only \`${platform}/<id>\` — so two workspaces' members ` +
+                    `share one key.`;
+            const remedy = rung === "enterprises" ? `Keep one ${platform} Enterprise Grid organisation per deployment` : `Keep one ${platform} tenant per deployment`;
+            bad.push(`  "${platform}" declares ${tenants.length} ${rung === "enterprises" ? "Enterprise Grid organisations" : "tenants"} ` +
+                `(${tenants.map((t) => JSON.stringify(t)).join(", ")}). ` +
+                `${exposure} Every matcher over that key (admin rosters, wake trust, approval clickers, a DM's personal credentials) can hand one ` +
+                `person another's standing on a chance id collision. ${remedy}, or set ${MULTI_TENANT_ENV}=1 to accept ` +
+                `that exposure deliberately until the tenant rung lands in the principal grammar (OPE-309 phase 1).`);
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error("open-everywhere: multi-tenant principal exposure:\n" + bad.join("\n") + "\n(access/tenant-admission.ts / identity/principal-key.ts)");
+    }
+}
+/** The remedy sentence for a rejected principal-key entry on a tenant-scoped platform, and "" for every other entry, so a validator can concatenate it unconditionally. `domains` is passed explicitly by a validator that already holds the array, because reaching back through getConfig would re-enter the validator currently running. */
+export function tenantRungRemedy(entry, domains) {
+    const slash = entry.indexOf("/");
+    const platform = slash > 0 ? entry.slice(0, slash) : "";
+    if (!isTenantScopedPlatform(platform))
+        return "";
+    const tenant = domains ? soleAdmittedTenant(platform, domains) : soleAdmittedTenantFromConfig(platform);
+    return ` ${principalKeyReplacementHint(entry, tenant)}`;
+}
+/** The trimmed id a delivery named, or `""` when it named none. One reader, so the workspace and
+ *  the enterprise rung can never disagree about what "named nothing" means. */
+function namedId(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+/** Four proceed paths, each deliberate: the platform is not tenant-scoped, the operator opted in, the admitted set is EMPTY (fence inert, never refuse-everything), or the delivery named NEITHER a workspace nor an enterprise. Otherwise each named id is matched at its OWN rung, and a delivery carrying both is admitted when either is declared. */
+export function classifyTenantAdmission(input) {
+    if (!isTenantScopedPlatform(input.platform))
+        return "proceed";
+    if (multiTenantPrincipalsAllowed())
+        return "proceed";
+    if (input.admitted.size === 0)
+        return "proceed";
+    const tenant = namedId(input.tenant);
+    const enterprise = namedId(input.enterprise);
+    if (tenant.length === 0 && enterprise.length === 0)
+        return "proceed";
+    // Each id is matched against ITS OWN rung, never the whole declared set, so a workspace id can never admit itself off an enterprise declaration. Slack's id spaces are disjoint today, so this costs nothing and cannot rot.
+    const rungs = splitTenantRungs(input.platform, input.admitted);
+    if (tenant.length > 0 && rungs.workspaces.has(tenant))
+        return "proceed";
+    if (enterprise.length > 0 && rungs.enterprises.has(enterprise))
+        return "proceed";
+    return "unadmitted";
+}
+/** The audit `reason` an unadmitted-tenant drop carries — one greppable string, shared by every
+ *  door and its test (same convention as UNMAPPED_WAKE_DROP_REASON). */
+export const UNADMITTED_TENANT_DROP_REASON = "tenant is not admitted on this deployment — principal keys would alias";
+/** Deliberately NOT posted into the originating room: we cannot safely identify anybody there, and a foreign tenant learning it reached a real deployment is more than it needs to know. It names EVERY id the refused delivery carried, because an org-wide install names only the enterprise. */
+export function unadmittedTenantLog(platform, tenant, admitted, enterprise) {
+    const named = [
+        ...(namedId(tenant) ? [`workspace "${namedId(tenant)}"`] : []),
+        ...(namedId(enterprise) ? [`enterprise "${namedId(enterprise)}"`] : []),
+    ];
+    return (`[open-everywhere:${platform}] wake dropped — ${named.join(" / ") || "a delivery naming no tenant"} is not admitted on this deployment ` +
+        `(declared: ${[...admitted].sort().join(", ") || "none"}). A ${platform} person id is issued per tenant, so admitting a second one ` +
+        `would let two people share one principal key. Add a channel for that tenant to agent/memory/config/domains.ts, or set ${MULTI_TENANT_ENV}=1 ` +
+        "to accept multi-tenant principals deliberately (OPE-309).");
+}
+//# sourceMappingURL=tenant-admission.js.map

package/dist/agent/access/tenant-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-admission.js","sourceRoot":"","sources":["../../../agent/access/tenant-admission.ts"],"names":[],"mappings":"AAAA,uaAAua;AAEva,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAcnG,sTAAsT;AACtT,MAAM,sBAAsB,GAAgC,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtF;0CAC0C;AAC1C,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,MAAc;IAC3D,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAyB;IAC1E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAED,wQAAwQ;AACxQ,MAAM,CAAC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAEnE,MAAM,UAAU,4BAA4B;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,CAAC;AAC/C,CAAC;AAED,wOAAwO;AACxO,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,OAA0B;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,iSAAiS;QACjS,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACtC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,MAAM;gBAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4JAA4J;AAC5J,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mZAAmZ;AACnZ,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAA0B;IAC7E,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IACnG,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4WAA4W;AAC5W,MAAM,UAAU,yCAAyC,CAAC,OAA0B;IAClF,IAAI,4BAA4B,EAAE;QAAE,OAAO;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI;YACxB,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC;YAC7B,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;SAC1B,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC;gBAAE,SAAS;YAClC,sMAAsM;YACtM,MAAM,QAAQ,GACZ,IAAI,KAAK,aAAa;gBACpB,CAAC,CAAC,oIAAoI;oBACpI,uBAAuB,QAAQ,iEAAiE;gBAClG,CAAC,CAAC,MAAM,QAAQ,oEAAoE,QAAQ,uCAAuC;oBACjI,gBAAgB,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,YAAY,QAAQ,8CAA8C,CAAC,CAAC,CAAC,YAAY,QAAQ,wBAAwB,CAAC;YAC1J,GAAG,CAAC,IAAI,CACN,MAAM,QAAQ,cAAc,OAAO,CAAC,MAAM,IAAI,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS,GAAG;gBACnH,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACzD,GAAG,QAAQ,wHAAwH;gBACnI,uDAAuD,MAAM,YAAY,gBAAgB,eAAe;gBACxG,oGAAoG,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,4DAA4D,CAAC,CAAC;IACzJ,CAAC;AACH,CAAC;AAED,+UAA+U;AAC/U,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAA2B;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IACxG,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;AAC1D,CAAC;AAkBD;+EAC+E;AAC/E,SAAS,OAAO,CAAC,KAAgC;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,0VAA0V;AAC1V,MAAM,UAAU,uBAAuB,CAAC,KAA2B;IACjE,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,IAAI,4BAA4B,EAAE;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,6NAA6N;IAC7N,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;wEACwE;AACxE,MAAM,CAAC,MAAM,6BAA6B,GAAG,wEAAwE,CAAC;AAEtH,mSAAmS;AACnS,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,MAAiC,EACjC,QAA6B,EAC7B,UAAsC;IAEtC,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IACF,OAAO,CACL,oBAAoB,QAAQ,oBAAoB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,6BAA6B,sCAAsC;QACxI,cAAc,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,QAAQ,QAAQ,6DAA6D;QACpI,yHAAyH,gBAAgB,KAAK;QAC9I,2DAA2D,CAC5D,CAAC;AACJ,CAAC"}

package/dist/agent/access/untrusted-projection.d.ts

@@ -0,0 +1,23 @@
+/** Record that the entry mounted under this name authors its own toModelOutput; preRegisterDynamicEntry calls it, never a tool. Its one job is CLASSIFICATION — a double-underscore name counts as connector-external only while this set does not hold it — so emptying the set would double-wrap an extension tool that already fenced its own result. */
+export declare function registerAuthoredProjectionName(name: string): void;
+/** Test seam: what names author their own projection (window-gated import side-effects). */
+export declare function registeredProjectionNames(): readonly string[];
+/** Declare that EVERY variant behind this mounted name authors its own toModelOutput; installVariants recomputes the answer over the whole accumulated variant set. Without it the outer connector wrap would fence an envelope the variant already fenced, defanging its origin tags and burying its host-authored disclosure. The skip stays fail-closed in both directions: the family must be declared, AND the rendered text must open with this module's own fence. */
+export declare function setVariantProjectedName(mountedName: string, projected: boolean): void;
+/** Test seam: the names whose whole variant family authors its own envelope. */
+export declare function variantProjectedNameList(): readonly string[];
+/**
+ * The host-authored line that opens a gated connector op's result, or `undefined` when the call is a read, is not an eve-native connector op, or its output is a denial. The line states that the call RAN and is not waiting for approval, names the object ids the result returned, and says so when the connector reported an error.
+ */
+export declare function connectorExecutedFact(toolName: string, output: unknown): string | undefined;
+/** Write a worker.toolset row for this worker session, or nothing; both conditions fail toward SILENCE. The dedupe is on the ROSTER, not on "have I written a row yet": a worker's first model call does not see its final toolset, because eve resolves connection-discovered tools only after connection_search has run, so a changed roster earns a second row. */
+export declare function recordWorkerToolset(tools: readonly string[], withheld: readonly string[]): void;
+/** The two names a BREAK-GLASS HALT can only reach by absence. Every other consequential verb is REFUSED at an arrow instead, which is the stronger control and the one that teaches the model why. */
+export declare const HALTED_WITHHELD_TOOLS: readonly string[];
+/** Mutate the final AI-SDK toolset in place per the policy in the header, once per model call, after the toolset is fully assembled. Throws propagate: a broken projection fails the model call loudly rather than silently running unfenced. */
+export declare function projectToolSet(toolset: Record<string, unknown>): void;
+/** Install the hook the eve patch consults. Idempotent; runs at module load (this module is
+ *  imported by access/window-gated.ts, which every dynamic tool file imports, so any process
+ *  that can replay our tools has the hook armed before its first model call). */
+export declare function installToolResultProjectionHook(): void;
+//# sourceMappingURL=untrusted-projection.d.ts.map

package/dist/agent/access/untrusted-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-projection.d.ts","sourceRoot":"","sources":["../../../agent/access/untrusted-projection.ts"],"names":[],"mappings":"AA6CA,4VAA4V;AAC5V,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEjE;AAED,4FAA4F;AAC5F,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAID,6cAA6c;AAC7c,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAGrF;AAED,gFAAgF;AAChF,wBAAgB,wBAAwB,IAAI,SAAS,MAAM,EAAE,CAE5D;AAoED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAW3F;AAED,sWAAsW;AACtW,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAW/F;AAED,uMAAuM;AACvM,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAEpF,iPAAiP;AACjP,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA6FrE;AAID;;iFAEiF;AACjF,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD"}

package/dist/agent/access/untrusted-projection.js

@@ -0,0 +1,258 @@
+// ALL policy for the carried eve toolset patch lives here: the patch calls this module with the fully-assembled tool set before the model call, and the hook MUTATES tool objects in place rather than replacing them — eve keys tool approvals in a WeakMap on the built tool object, so a swap would silently drop approval gates. Provider-executed web_search is not coverable here at all: it runs server-side at the provider, so its results reach the model before any byte passes through this process.
+import { hostAuthoredModelOutput, ingestUntrustedModelOutput, UNTRUSTED_OPEN } from "./untrusted.js";
+import { declaredContentOriginForConnectionSearch, declaredContentOriginForToolName } from "./connector-content-origin-state.js";
+import { restrictToolsetForJobWake } from "./job-posture.js";
+import { currentJobWakePosture } from "./job-session-state.js";
+import { restrictToolsetForLeanSeat } from "./lean-seat.js";
+import { currentLeanSeatIsDm, currentLeanSeatPosture } from "./lean-seat-state.js";
+import { restrictToolsetForWorkerSeat } from "./worker-seat.js";
+import { currentHaltStamp } from "./halt-state.js";
+import { currentWorkerWake } from "./worker-seat-state.js";
+import { restrictToolsetForInvokerPosture } from "./invoker-posture.js";
+import { currentInvokerPosture } from "./invoker-posture-state.js";
+import { nativeAgentAllowedNow } from "./native-delegation-state.js";
+import { TASK_PARENT_TOOL_NAMES } from "./background-tasks.js";
+import { refuseAgentContinuation } from "./worker-continuation.js";
+import { nullableOptionalToolSet } from "./nullable-optional-fields.js";
+import { claimWorkerToolsetEvidence, currentWorkerToolsetIdentity } from "./worker-toolset-state.js";
+import { auditWorkerToolset } from "../audit/worker-toolset.js";
+import { classifyConnectorOpTier, isConnectorOpTool, isReservedNamespaceTool } from "./consequence.js";
+/** eve's authorization-pending brand (harness/authorization.js AUTHORIZATION_PENDING_BRAND) — a
+ *  plain string property on the execute output, so userland can detect it without eve internals.
+ *  Pinned by the unit test against the installed bytes. */
+const AUTH_PENDING_BRAND = "__eveAuthorizationPending";
+function isAuthPendingOutput(output) {
+    return typeof output === "object" && output !== null && output[AUTH_PENDING_BRAND] === true;
+}
+const authoredProjectionNames = new Set();
+/** Record that the entry mounted under this name authors its own toModelOutput; preRegisterDynamicEntry calls it, never a tool. Its one job is CLASSIFICATION — a double-underscore name counts as connector-external only while this set does not hold it — so emptying the set would double-wrap an extension tool that already fenced its own result. */
+export function registerAuthoredProjectionName(name) {
+    authoredProjectionNames.add(name);
+}
+/** Test seam: what names author their own projection (window-gated import side-effects). */
+export function registeredProjectionNames() {
+    return [...authoredProjectionNames];
+}
+const variantProjectedNames = new Set();
+/** Declare that EVERY variant behind this mounted name authors its own toModelOutput; installVariants recomputes the answer over the whole accumulated variant set. Without it the outer connector wrap would fence an envelope the variant already fenced, defanging its origin tags and burying its host-authored disclosure. The skip stays fail-closed in both directions: the family must be declared, AND the rendered text must open with this module's own fence. */
+export function setVariantProjectedName(mountedName, projected) {
+    if (projected)
+        variantProjectedNames.add(mountedName);
+    else
+        variantProjectedNames.delete(mountedName);
+}
+/** Test seam: the names whose whole variant family authors its own envelope. */
+export function variantProjectedNameList() {
+    return [...variantProjectedNames];
+}
+/** eve mounts MCP-connection tools as <connection>__<tool> and extension-namespaced dynamic tools as <ns>__<name>, and a connection_search result can carry MCP-server-authored descriptions. None of OUR tools use a double underscore. */
+function isConnectorExternalName(name) {
+    return (name.includes("__") || name === "connection_search") && !authoredProjectionNames.has(name);
+}
+// A connection_search result made ENTIRELY of eve-authored status rows carries no external bytes — the error strings are eve's own and the descriptions are OE's registered ones — so it is fenced but does not taint the turn. The shape check is fail-closed: anything it cannot decompose falls through to the tainting path, so an eve reshape degrades to over-taint and never to under-taint.
+function isStatusOnlyConnectionSearch(output) {
+    if (!Array.isArray(output) || output.length === 0)
+        return false;
+    return output.every((el) => {
+        if (el === null || typeof el !== "object")
+            return false;
+        const row = el;
+        if ("tool" in row || "qualifiedName" in row)
+            return false; // a discovered tool = MCP-authored bytes
+        return typeof row.error === "string" || row.needsAuthorization === true;
+    });
+}
+// 🔴 THE EXECUTED FACT (OPE-2129). When a gated connector call parks on an approval, eve writes a DURABLE framework note into the history: "[Pending approvals] The following tool calls are awaiting approval and have not executed". eve never removes that note after the approval, and the call's own result reaches the model only inside the untrusted fence. So the only TRUSTED text about the call said it had not run, and a worker reported an approved and executed page create as "awaiting approval and has not executed" (board #241, S-SUSPENDED-slack). The fact below is HOST text outside the fence, and it comes first.
+// It is true by construction: `toModelOutput` receives only what `execute` returned, so the call ran. An approval policy that refuses throws, and eve's denial is a separate `execution-denied` part, so neither reaches this seam. The denied-shape check below is defence in depth.
+// Scope: gated ops of eve-native connections only (write and destructive tier). A read never parks under the shipped tiering, and a line on every read result is noise. An OE-authored tool under a `__` name (a reserved `grant__` name, or a variant family that authors its own envelope) is out of scope: its execute can RETURN a refusal, so "it ran" is not true by construction there.
+/** The eve code on a denied approval's action result (`harness/hitl/approval-input-requests.js`). */
+const TOOL_EXECUTION_DENIED_CODE = "TOOL_EXECUTION_DENIED";
+/** The maximum number of object ids the fact names. */
+const EXECUTED_FACT_MAX_IDS = 10;
+/** An object id the fact may lift out of the fence: a UUID, with or without dashes. HEX ONLY, so the lifted bytes cannot carry an instruction. Any other value stays inside the fence. */
+const LIFTABLE_ID = /^[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}$/i;
+function isDeniedOutput(output) {
+    if (output === null || typeof output !== "object")
+        return false;
+    const o = output;
+    const tool = o.tool;
+    return o.code === TOOL_EXECUTION_DENIED_CODE || (tool !== null && typeof tool === "object" && tool.result === "not_run");
+}
+/** Collect the values of `id` keys that match {@link LIFTABLE_ID}, in document order, deduplicated. An MCP result carries its payload as JSON text in `content[].text`, so a text part that parses as JSON is walked too. */
+function collectLiftableIds(value, into, depth = 0) {
+    if (depth > 8 || into.length >= EXECUTED_FACT_MAX_IDS)
+        return;
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (depth > 0 && (trimmed.startsWith("{") || trimmed.startsWith("["))) {
+            try {
+                collectLiftableIds(JSON.parse(trimmed), into, depth + 1);
+            }
+            catch {
+                /* not JSON — the bytes stay inside the fence */
+            }
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const el of value)
+            collectLiftableIds(el, into, depth + 1);
+        return;
+    }
+    if (value === null || typeof value !== "object")
+        return;
+    for (const [key, v] of Object.entries(value)) {
+        if (into.length >= EXECUTED_FACT_MAX_IDS)
+            return;
+        if (key === "id" && typeof v === "string" && LIFTABLE_ID.test(v)) {
+            if (!into.includes(v))
+                into.push(v);
+            continue;
+        }
+        if (key === "_meta")
+            continue; // server identity, never a result object
+        collectLiftableIds(v, into, depth + 1);
+    }
+}
+/**
+ * The host-authored line that opens a gated connector op's result, or `undefined` when the call is a read, is not an eve-native connector op, or its output is a denial. The line states that the call RAN and is not waiting for approval, names the object ids the result returned, and says so when the connector reported an error.
+ */
+export function connectorExecutedFact(toolName, output) {
+    if (!isConnectorOpTool(toolName) || isReservedNamespaceTool(toolName) || variantProjectedNames.has(toolName))
+        return undefined;
+    if (classifyConnectorOpTier(toolName) === "read")
+        return undefined;
+    if (isAuthPendingOutput(output) || isDeniedOutput(output))
+        return undefined;
+    const failed = output !== null && typeof output === "object" && output.isError === true;
+    const ids = [];
+    if (!failed)
+        collectLiftableIds(output, ids);
+    const head = `[Host fact, not connector data] This ${toolName} call RAN. It is NOT waiting for approval: if it needed an approval, a person gave it before the call ran. A "[Pending approvals]" note that names this call is out of date.`;
+    if (failed)
+        return `${head} The connector reported an ERROR, so read the output below before you say that anything changed.`;
+    const named = ids.length > 0 ? ` The result names these ids: ${ids.join(", ")}.` : "";
+    return `${head}${named} The connector's own output follows, as data.`;
+}
+/** Write a worker.toolset row for this worker session, or nothing; both conditions fail toward SILENCE. The dedupe is on the ROSTER, not on "have I written a row yet": a worker's first model call does not see its final toolset, because eve resolves connection-discovered tools only after connection_search has run, so a changed roster earns a second row. */
+export function recordWorkerToolset(tools, withheld) {
+    try {
+        const who = currentWorkerToolsetIdentity();
+        if (who === null)
+            return;
+        // The claim key is the SORTED names, rendered in the same order the row records them, so a toolset whose key order differs cannot masquerade as a changed roster. JSON rather than a joined string, because a delimiter would have to be a byte no tool name can hold.
+        const reason = claimWorkerToolsetEvidence(JSON.stringify([...tools].sort()));
+        if (reason === null)
+            return;
+        void auditWorkerToolset({ who, reason, tools, withheld }).catch(() => undefined);
+    }
+    catch {
+        /* evidence is best-effort — the mount itself has already happened, and it is not in question */
+    }
+}
+/** The two names a BREAK-GLASS HALT can only reach by absence. Every other consequential verb is REFUSED at an arrow instead, which is the stronger control and the one that teaches the model why. */
+export const HALTED_WITHHELD_TOOLS = ["web_search", "web_fetch"];
+/** Mutate the final AI-SDK toolset in place per the policy in the header, once per model call, after the toolset is fully assembled. Throws propagate: a broken projection fails the model call loudly rather than silently running unfenced. */
+export function projectToolSet(toolset) {
+    // The job arm runs FIRST and the lean arm is its else, and that else is load-bearing: intersecting the two rosters would strip a job fire's reads and so change its fire posture. Both work by ABSENCE rather than refusal, so the model never sees a tool it cannot call and no injected instruction has a refusal to argue with.
+    if (currentJobWakePosture() === "restricted")
+        restrictToolsetForJobWake(toolset);
+    else if (currentLeanSeatPosture() === "lean")
+        restrictToolsetForLeanSeat(toolset, currentLeanSeatIsDm());
+    // A delegated worker is neither a job wake nor a lean seat, so this subtracts ALONGSIDE the two arms above rather than as a third. It removes WORKER_UNMOUNTED_TOOLS, which is two sets and not one: the four names that are structurally wrong on a worker (the seat's own silence and stand-down verbs, and its two chat reads) plus the four the DM seat shape RESERVES, so the carve-in is containment and not merely routing. Whichever of those eight the toolset actually carried, and nothing else, is what the worker.toolset row's withheld field records.
+    const workerWake = currentWorkerWake();
+    const workerWithheld = workerWake ? restrictToolsetForWorkerSeat(toolset) : [];
+    // A bounded SUBTRACTION of the wide-hands family, keyed on WHO CAUSED THE RUN rather than on the seat, so it composes with whatever the seat would otherwise hold: this is the line that keeps remote input out of a window's own bash. It stops at the window — a fire's delegated worker keeps the wide-hands kit, because delegation escalates HANDS and not AUTHORITY, and the control for untrusted content is the envelope plus taint.
+    restrictToolsetForInvokerPosture(toolset, currentInvokerPosture(), workerWake);
+    // The halt's ABSENCE half, and it is not the halt: two egress paths sit outside all seven refusal arrows, so while halted they are SUBTRACTED. Do not read it as "all egress is denied" — the honest bound is that a model call already in flight is not reached — and the read is the per-session stamp, because this function is synchronous and has no OE context.
+    if (currentHaltStamp() === true) {
+        for (const name of HALTED_WITHHELD_TOOLS)
+            delete toolset[name];
+    }
+    // eve injects the built-in agent on every root-node session and it is not a dynamic tool, so there is no mount to gate and subtraction at this seam is the only lever. It is unconditional and the verdict slot clears to DENY, so an UNCLASSIFIED seat loses agent rather than keeping it; a tainted turn keeps it, because the forward leg now marks the child instead.
+    const agentAllowed = nativeAgentAllowedNow();
+    if (toolset["agent"] !== undefined && !agentAllowed) {
+        delete toolset["agent"];
+    }
+    // The task-parent tools FOLLOW the delegation verb they coordinate: a seat that may not hold agent can never have dispatched a task, so withdrawing them costs it nothing it could have used. This projection only ever SUBTRACTS from what eve assembled, and OE's verdict is strictly narrower than eve's own advertise-time narrowing, so it can never add a tool eve withheld.
+    if (!agentAllowed) {
+        for (const name of TASK_PARENT_TOOL_NAMES) {
+            if (toolset[name] !== undefined)
+                delete toolset[name];
+        }
+    }
+    // No child-only cut here any more: eve 0.54.1 REMOVED `task_update` and shipped no replacement
+    // verb, so there is no progress tool for a non-child seat to hold and nothing left to subtract.
+    // The parent cut above still stands. Those three names are eve's ACROSS VERSIONS, not eve's today:
+    // 0.40.0 deleted `task_peek` and 0.42.0 deleted `task_sleep`, so at 0.54.3 eve mounts only
+    // `task_cancel` of them. The other two are inert and kept deliberately, so the rule stays pinned
+    // over every name it might meet rather than over the one name this release happens to ship.
+    // A delegated worker is SINGLE-TURN: a continuation is a second turn on the same child, which clears its turn-scoped taint bit over unchanged hostile history and carries no auth for the forward leg to re-arm it, so it is refused. It is deliberately not guarded by the seat verdict, and it reads no flag — it keys on the AFFORDANCE, so a build whose schema lacks the field is a no-op.
+    refuseAgentContinuation(toolset);
+    // Every optional field is advertised as nullable and a null for it is stripped before the tool validates (OPE-2068): gpt-6-luna fills every property it is shown, and null is the only honest value it can send for a field it has no value for. It runs AFTER the continuation refusal so it wraps the schema that refusal advertises.
+    nullableOptionalToolSet(toolset);
+    // This must run LAST of the seat rules: the row's whole value is that it names the MOUNTED set, so reading the keys any earlier would name tools the rules above were about to take. Fire-and-forget and totally swallowing, because this function's throws propagate on purpose and its bookkeeping may never be the thing that throws.
+    if (workerWake)
+        recordWorkerToolset(Object.keys(toolset), workerWithheld);
+    // A name this process REGISTERED is not touched at all: eve's own closure serves its authored envelope live and on replay, and it validates the result on the way. The only thing left is to keep the connector wrap off it, which isConnectorExternalName does by reading the same registry.
+    for (const [name, raw] of Object.entries(toolset)) {
+        if (raw === null || typeof raw !== "object")
+            continue;
+        const tool = raw;
+        if (isConnectorExternalName(name) && typeof tool.execute === "function") {
+            const prev = tool.toModelOutput?.bind(tool);
+            const fenced = async (args) => {
+                const output = args?.output;
+                if (isAuthPendingOutput(output)) {
+                    // eve's closure renders the sign-in text; keep it unfenced so the auth flow reads as
+                    // the system's own notice, not as data.
+                    if (prev !== undefined)
+                        return prev(args);
+                    return { type: "text", value: "Authorization required. Waiting for the user to sign in." };
+                }
+                let base;
+                let text;
+                if (prev !== undefined) {
+                    base = await prev(args);
+                    text = base.type === "text" ? String(base.value) : JSON.stringify(base.value ?? null);
+                }
+                else {
+                    text = typeof output === "string" ? output : JSON.stringify(output ?? null);
+                }
+                // A variant family that authors its OWN envelope has already fenced, capped, tainted and named the origin of these bytes, and wrapping again defangs its tags and buries its host-authored lines. BOTH conditions are required and each fails closed alone: the family must be declared, and the rendered text must OPEN with this module's fence.
+                if (base !== undefined && base.type === "text" && variantProjectedNames.has(name) && text.startsWith(`${UNTRUSTED_OPEN} `)) {
+                    return base;
+                }
+                // Same funnel as our own read tools: fence, cap, taint and loop-breaker. A status-only connection_search result carries no external bytes, so it is fenced and kept in the loop breaker but does NOT taint the turn.
+                if (name === "connection_search" && isStatusOnlyConnectionSearch(output)) {
+                    return hostAuthoredModelOutput(text, { source: `connector ${name}` });
+                }
+                // A connector whose bundle grant declares contentOrigin "internal" FOR THIS TOOL fences its result and leaves the turn CLEAN; a declared-external or silent connector still taints, because the ruled default for silence is untrusted. The lookup is per TOOL, resolved by connection name from a session slot stamped by hooks/egress.ts, and undefined keeps the old behaviour — nothing here can manufacture a declaration reviewed config did not write.
+                // `connection_search` resolves from its RESULT, row by row, because its name belongs to no one connection.
+                const grantContentOrigin = name === "connection_search" ? declaredContentOriginForConnectionSearch(output) : declaredContentOriginForToolName(name);
+                return ingestUntrustedModelOutput(text, {
+                    source: `connector ${name}`,
+                    ingestion: { kind: "connector", label: name, ...(grantContentOrigin !== undefined ? { grantContentOrigin } : {}) },
+                });
+            };
+            // The executed fact goes FIRST and OUTSIDE the fence (see connectorExecutedFact). The fenced part is unchanged.
+            tool.toModelOutput = async (args) => {
+                const projected = await fenced(args);
+                const fact = connectorExecutedFact(name, args?.output);
+                if (fact === undefined)
+                    return projected;
+                const value = projected.type === "text" ? String(projected.value) : JSON.stringify(projected.value ?? null);
+                return { type: "text", value: `${fact}\n\n${value}` };
+            };
+        }
+    }
+}
+const HOOK_KEY = "__oeToolResultProjection";
+/** Install the hook the eve patch consults. Idempotent; runs at module load (this module is
+ *  imported by access/window-gated.ts, which every dynamic tool file imports, so any process
+ *  that can replay our tools has the hook armed before its first model call). */
+export function installToolResultProjectionHook() {
+    globalThis[HOOK_KEY] = projectToolSet;
+}
+installToolResultProjectionHook();
+//# sourceMappingURL=untrusted-projection.js.map

package/dist/agent/access/untrusted-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted-projection.js","sourceRoot":"","sources":["../../../agent/access/untrusted-projection.ts"],"names":[],"mappings":"AAAA,ifAAif;AAEjf,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,wCAAwC,EAAE,gCAAgC,EAAE,MAAM,qCAAqC,CAAC;AACjI,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEvG;;2DAE2D;AAC3D,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAEvD,SAAS,mBAAmB,CAAC,MAAe;IAC1C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAkC,CAAC,kBAAkB,CAAC,KAAK,IAAI,CAAC;AAC3H,CAAC;AAeD,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAElD,4VAA4V;AAC5V,MAAM,UAAU,8BAA8B,CAAC,IAAY;IACzD,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,GAAG,uBAAuB,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEhD,6cAA6c;AAC7c,MAAM,UAAU,uBAAuB,CAAC,WAAmB,EAAE,SAAkB;IAC7E,IAAI,SAAS;QAAE,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;;QACjD,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB;IACtC,OAAO,CAAC,GAAG,qBAAqB,CAAC,CAAC;AACpC,CAAC;AAED,4OAA4O;AAC5O,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,mBAAmB,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrG,CAAC;AAED,oYAAoY;AACpY,SAAS,4BAA4B,CAAC,MAAe;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE;QACzB,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,GAAG,GAAG,EAA6B,CAAC;QAC1C,IAAI,MAAM,IAAI,GAAG,IAAI,eAAe,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;QACpG,OAAO,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4mBAA4mB;AAC5mB,sRAAsR;AACtR,+XAA+X;AAE/X,qGAAqG;AACrG,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAE3D,uDAAuD;AACvD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,0LAA0L;AAC1L,MAAM,WAAW,GAAG,qEAAqE,CAAC;AAE1F,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,IAA2C,CAAC;IAC3D,OAAO,CAAC,CAAC,IAAI,KAAK,0BAA0B,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;AAC3H,CAAC;AAED,6NAA6N;AAC7N,SAAS,kBAAkB,CAAC,KAAc,EAAE,IAAc,EAAE,KAAK,GAAG,CAAC;IACnE,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB;QAAE,OAAO;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC;gBACH,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,KAAK;YAAE,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,IAAI,qBAAqB;YAAE,OAAO;QACjD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,OAAO;YAAE,SAAS,CAAC,yCAAyC;QACxE,kBAAkB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAe;IACrE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/H,IAAI,uBAAuB,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACnE,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAK,MAAkC,CAAC,OAAO,KAAK,IAAI,CAAC;IACrH,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,MAAM;QAAE,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,wCAAwC,QAAQ,8KAA8K,CAAC;IAC5O,IAAI,MAAM;QAAE,OAAO,GAAG,IAAI,kGAAkG,CAAC;IAC7H,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,OAAO,GAAG,IAAI,GAAG,KAAK,+CAA+C,CAAC;AACxE,CAAC;AAED,sWAAsW;AACtW,MAAM,UAAU,mBAAmB,CAAC,KAAwB,EAAE,QAA2B;IACvF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,4BAA4B,EAAE,CAAC;QAC3C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO;QACzB,uQAAuQ;QACvQ,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAC5B,KAAK,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;IAClG,CAAC;AACH,CAAC;AAED,uMAAuM;AACvM,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AAEpF,iPAAiP;AACjP,MAAM,UAAU,cAAc,CAAC,OAAgC;IAC7D,mUAAmU;IACnU,IAAI,qBAAqB,EAAE,KAAK,YAAY;QAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC;SAC5E,IAAI,sBAAsB,EAAE,KAAK,MAAM;QAAE,0BAA0B,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAEzG,qiBAAqiB;IACriB,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,6aAA6a;IAC7a,gCAAgC,CAAC,OAAO,EAAE,qBAAqB,EAAE,EAAE,UAAU,CAAC,CAAC;IAE/E,sWAAsW;IACtW,IAAI,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,qBAAqB;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,0WAA0W;IAC1W,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,mXAAmX;IACnX,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,sBAAsB,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,gGAAgG;IAChG,mGAAmG;IACnG,2FAA2F;IAC3F,iGAAiG;IACjG,4FAA4F;IAE5F,gYAAgY;IAChY,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEjC,wUAAwU;IACxU,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEjC,yUAAyU;IACzU,IAAI,UAAU;QAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAE1E,8RAA8R;IAC9R,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,IAAI,GAAG,GAAoB,CAAC;QAElC,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACxE,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,KAAK,EAAE,IAA6C,EAAiC,EAAE;gBACpG,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;gBAC5B,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,qFAAqF;oBACrF,wCAAwC;oBACxC,IAAI,IAAI,KAAK,SAAS;wBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC;gBAC7F,CAAC;gBACD,IAAI,IAAsC,CAAC;gBAC3C,IAAI,IAAY,CAAC;gBACjB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oBACxB,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;gBACxF,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;gBAC9E,CAAC;gBACD,mVAAmV;gBACnV,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;oBAC3H,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,qNAAqN;gBACrN,IAAI,IAAI,KAAK,mBAAmB,IAAI,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzE,OAAO,uBAAuB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,8bAA8b;gBAC9b,2GAA2G;gBAC3G,MAAM,kBAAkB,GAAG,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,wCAAwC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC;gBACpJ,OAAO,0BAA0B,CAAC,IAAI,EAAE;oBACtC,MAAM,EAAE,aAAa,IAAI,EAAE;oBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;iBACnH,CAAC,CAAC;YACL,CAAC,CAAC;YACF,gHAAgH;YAChH,IAAI,CAAC,aAAa,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE;gBAClC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrC,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBACvD,IAAI,IAAI,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAC;gBACzC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;gBAC5G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YACxD,CAAC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C;;iFAEiF;AACjF,MAAM,UAAU,+BAA+B;IAC5C,UAAsC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC;AACrE,CAAC;AAED,+BAA+B,EAAE,CAAC"}

package/dist/agent/access/untrusted.d.ts

@@ -0,0 +1,34 @@
+import type { IngestionSource } from "./taint-tiers.js";
+/** The opening-tag PREFIX. A rendered open carries this render's nonce and, when a site declares
+ *  one, a source label: `<untrusted_external_data nonce="a1b2c3d4" source="notion">`. */
+export declare const UNTRUSTED_OPEN = "<untrusted_external_data";
+/** The closing-tag PREFIX, not a complete close: a real close carries the matching render's nonce. Build one with untrustedCloseTag and treat this constant as a prefix to search for. */
+export declare const UNTRUSTED_CLOSE = "</untrusted_external_data";
+/** The one place a real closing tag is spelled. */
+export declare function untrustedCloseTag(nonce: string): string;
+/** For tests and byte-goldens only: replace every fence nonce with a fixed placeholder. A test using it must ALSO keep a negative control that the un-normalised renders differ, or it has stopped proving the nonce is per-render. */
+export declare function normalizeFenceNonce(text: string, placeholder?: string): string;
+export interface UntrustedOpts {
+    /** Short provenance label, e.g. `web_fetch https://…` or `notion`. */
+    source?: string;
+    /** Declaring the source hands the taint decision to the ratified table; absent means the site taints unconditionally and writes no row. The decision is RELAXATION-ONLY, and a RENDER-TIME site must not declare here - it calls noteIngestionVerdict itself with the honest effect on the reading turn. */
+    ingestion?: IngestionSource;
+}
+/** Wrap external content in a delimited, instruction-resistant envelope. The notice is repeated AFTER the content because a long body can push a leading instruction out of the model's attention, and delimiters inside are defanged first. */
+export declare function wrapUntrusted(content: string, opts?: UntrustedOpts): string;
+export declare function untrustedModelOutput(content: string, opts?: UntrustedOpts): {
+    type: "text";
+    value: string;
+};
+export declare function ingestUntrusted(content: string, opts?: UntrustedOpts): string;
+/** The tool-result projection for untrusted bodies, and the composition site of the result-reducing arm: an oversized body is offered to the deployment's reducer BEFORE the fence and before the built-in cap. The loop breaker counts the RAW body, so two identical failing results collide whatever a reducer rewrote. */
+export declare function ingestUntrustedModelOutput(content: string, opts?: UntrustedOpts): Promise<{
+    type: "text";
+    value: string;
+}>;
+/** Fence and loop-breaker WITHOUT the taint. The one admissible reason is that the body contains NO bytes authored outside the trust boundary; anything with a page, comment, diff, description or payload in it uses ingestUntrustedModelOutput. */
+export declare function hostAuthoredModelOutput(content: string, opts?: UntrustedOpts): {
+    type: "text";
+    value: string;
+};
+//# sourceMappingURL=untrusted.d.ts.map

package/dist/agent/access/untrusted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"untrusted.d.ts","sourceRoot":"","sources":["../../../agent/access/untrusted.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD;yFACyF;AACzF,eAAO,MAAM,cAAc,6BAA6B,CAAC;AAEzD,0LAA0L;AAC1L,eAAO,MAAM,eAAe,8BAA8B,CAAC;AAE3D,mDAAmD;AACnD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,uOAAuO;AACvO,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,MAAM,CAKjF;AAyBD,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4SAA4S;IAC5S,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAWD,gPAAgP;AAChP,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CAiB/E;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAEjC;AAID,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,aAAkB,GAAG,MAAM,CASjF;AAED,8TAA8T;AAC9T,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAQ1C;AAED,qPAAqP;AACrP,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,aAAkB,GACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAIjC"}