@open-everywhere/core 0.1.0

package/dist/agent/approvals/access-request.js

@@ -0,0 +1,186 @@
+// The member's tap is execute(), and execute() opens a bot-PR against the config repo; the ADMIN's approval is GitHub's merge button, behind branch protection and CODEOWNERS. The card is the INJECTION gate and the merge is the PRIVILEGE gate, so an unmerged PR grants nothing and opening one pre-approval is safe by construction.
+import { getConfig } from "../access/config.js";
+import { grantSentence, renderDelta } from "../access/delta.js";
+import { applyDelta, emitGrantsModule, emptyGrantsFile, parseGrantsModule } from "../access/grants-codemod.js";
+import { assertBindingsValid, assertBundlesValid } from "../access/bundle.js";
+import { GitHubContents } from "../scm/contents.js";
+import { createBranch, getBranchSha } from "../scm/refs.js";
+import { createOrUpdatePullRequest } from "../scm/pr.js";
+import { getGitHubApp } from "../scm/provider.js";
+import { resolveConfigRepoWriteToken } from "../scm/config-repo-token.js";
+import { isSafeBranchName } from "../scm/git.js";
+import { appendAudit } from "../audit/audit.js";
+import { bridgeSlackForm } from "../channels/slack-bridge.js";
+import { postSurfaceText } from "../channels/surface-message-ops.js";
+import { platformOfScopeKey } from "../access/scope-key.js";
+import { inlineForReview } from "./review-surface.js";
+import { registerActionKind, whereFromScope } from "./actions.js";
+/** The access-requests config, fail-closed: absent loader, missing admin channel, or
+ *  missing config repo all throw — a half-configured flow must refuse loudly, not open
+ *  PRs nobody will hear about. */
+export function requireAccessRequestsConfig(override) {
+    const cfg = override ?? getConfig().loadAccessRequests?.();
+    if (!cfg?.adminChannel || !cfg.configRepo) {
+        throw new Error("access requests aren't enabled on this deployment — an operator must configure the admin channel + config repo " +
+            "(AppConfig.loadAccessRequests; env OE_ACCESS_ADMIN_CHANNEL / OE_ACCESS_CONFIG_REPO). Until then, an admin can PR the grant by hand.");
+    }
+    return cfg;
+}
+/** Code-rendered from the FROZEN args, so the body is a pure function of what a human already read on the card and is never re-derived. Exactly one model-authored string reaches it — `reason` — and it is passed through inlineForReview so it cannot open a markdown block in the admin's view. */
+function prBody(args, decidedBy) {
+    const threadRef = args.permalink ?? `channel ${args.channelId}${args.threadTs ? `, thread ${args.threadTs}` : ""} (scope ${args.scopeKey})`;
+    return [
+        grantSentence(args.delta) + ".",
+        "",
+        // The universe line, when there is one: the full domain or DM reach that the compact delta cannot show by itself.
+        ...(args.universe ? [args.universe, ""] : []),
+        // The exposure delta the member read on the card, so the merging admin decides on the same
+        // reach (OPE-235). Code-rendered from the frozen args — no model text, same as everything else.
+        ...(args.exposure?.length ? [...args.exposure, ""] : []),
+        ...renderDelta(args.delta).join("\n").split("\n"),
+        "",
+        `Requested by \`${args.requestedBy}\` · sent by \`${decidedBy}\` · scope \`${args.scopeKey}\``,
+        ...(args.reason ? [`Reason: ${inlineForReview(args.reason)}`] : []),
+        `Slack thread: ${threadRef}`,
+        "",
+        "---",
+        "This diff was produced by the deterministic grants codemod from a frozen, validated delta — no model authored any",
+        "part of it after the request card was posted. Merging this PR IS the approval: the grant goes live on the next",
+        "deploy of the merged config. Closing it unmerged declines the request. See docs/how-it-works/access-requests.md.",
+    ].join("\n");
+}
+export async function executeAccessRequest(args, decidedBy, deps = {}) {
+    const cfg = requireAccessRequestsConfig(deps.config);
+    const repo = cfg.configRepo;
+    const base = cfg.configBase ?? "main";
+    const grantsPath = cfg.grantsPath ?? "agent/access/grants.generated.ts";
+    const branch = `access-request/${args.requestId}`;
+    if (!isSafeBranchName(branch)) {
+        // requestId is host-minted (randomUUID) so this only fires on a tampered row.
+        throw new Error(`unsafe access-request branch name "${branch}"`);
+    }
+    const sentence = grantSentence(args.delta);
+    // The card freezes the canonical domain name at proposal. Recheck that SAME name against the
+    // current merged registry before any token lookup, branch creation, file write or PR: a domain
+    // may be deleted or renamed while the card waits for a member tap, and silently retargeting the
+    // request would approve a different universe from the one the member read.
+    if (args.delta.scope.level === "domain") {
+        const domainName = args.delta.scope.domain;
+        const domains = cfg.domainRegistry?.();
+        if (!domains) {
+            throw new Error(`cannot revalidate frozen domain "${domainName}" — this deployment doesn't expose its merged domain registry (AccessRequestsConfig.domainRegistry), so no PR was opened`);
+        }
+        if (!domains.some((domain) => domain.name === domainName)) {
+            throw new Error(`frozen domain "${domainName}" is no longer declared — it may have been deleted or renamed after this card was posted. Nothing was changed; request access again from the channel so its current canonical domain is reviewed.`);
+        }
+    }
+    // Merged-result validation comes before ANY side effect, in both modes. Dry-run stops here by design: it proves the delta merges cleanly against the code baseline with zero network.
+    const validateMerged = (grantsText) => {
+        const grants = grantsText ? parseGrantsModule(grantsText) : emptyGrantsFile();
+        const result = applyDelta(grants, args.delta);
+        const mergedBundles = [...cfg.baseBundles(), ...result.grants.bundles];
+        assertBundlesValid(mergedBundles);
+        // The group registry is the third argument on purpose: it is what checks that a group-scoped candidate binding names a group that exists. Passing undefined SKIPS that existence check rather than faking it, and never approves an unknown group.
+        assertBindingsValid([...cfg.baseBindings(), ...result.grants.bindings], mergedBundles, cfg.groupRegistry?.());
+        return result;
+    };
+    if (cfg.dryRun) {
+        const result = validateMerged("");
+        await appendAudit({
+            ...whereFromScope(args.org, args.scopeKey),
+            principalId: decidedBy,
+            action: "access.request.pr_opened",
+            detail: { requestId: args.requestId, dryRun: true, sentence, bundle: result.bundleName, repo, branch },
+        });
+        return `dry-run — would commit the grant to ${repo}#${branch} (bundle "${result.bundleName}") and open a PR against ${base}; validation passed`;
+    }
+    const token = await (deps.resolveToken ?? resolveConfigRepoWriteToken)(repo);
+    const contents = deps.contents ?? new GitHubContents();
+    const refSha = deps.getBranchSha ?? getBranchSha;
+    const mkBranch = deps.createBranch ?? createBranch;
+    const openPr = deps.createPr ?? createOrUpdatePullRequest;
+    const post = deps.post ?? bridgeSlackForm;
+    // Cut (or reuse) the request branch off base. Reuse is the re-request path: the same
+    // pending's branch accumulates the (idempotent) codemod result and the PR updates.
+    let branchSha = await refSha({ repo, branch, token });
+    if (branchSha === null) {
+        const baseSha = await refSha({ repo, branch: base, token });
+        if (baseSha === null)
+            throw new Error(`config repo ${repo} has no base branch "${base}" — check accessRequests.configBase.`);
+        await mkBranch({ repo, branch, sha: baseSha, token });
+        branchSha = baseSha;
+    }
+    // Ring 2: apply the frozen delta to the branch's current overlay and re-validate the merged result before anything is committed.
+    const existing = await contents.getFile(repo, grantsPath, branch, token);
+    const result = validateMerged(existing?.content ?? "");
+    if (result.changed) {
+        const committer = deps.committer ?? getGitHubApp()?.committer() ?? { name: "open-everywhere[bot]", email: "open-everywhere@users.noreply.github.com" };
+        await contents.putFile(repo, grantsPath, emitGrantsModule(result.grants), `access request: ${sentence}`, branch, token, committer, existing?.sha);
+    }
+    const pr = await openPr({
+        repo,
+        head: branch,
+        base,
+        title: `Access request: ${sentence}`,
+        body: prBody(args, decidedBy),
+        token,
+    });
+    await appendAudit({
+        ...whereFromScope(args.org, args.scopeKey),
+        principalId: decidedBy,
+        action: "access.request.pr_opened",
+        detail: {
+            requestId: args.requestId,
+            sentence,
+            bundle: result.bundleName,
+            repo,
+            branch,
+            pr: pr.number,
+            url: pr.url,
+            updated: pr.updated,
+            requestedBy: args.requestedBy,
+        },
+    });
+    // Notifications are best-effort AFTER the PR exists: a Slack hiccup must not lose an
+    // already-open PR, so failures degrade to a note in the outcome line, never a throw.
+    const adminBody = new URLSearchParams();
+    adminBody.set("channel", cfg.adminChannel);
+    adminBody.set("text", `:inbox_tray: Access request — ${sentence}.\nRequested by <@${args.requestedBy}> · sent by <@${decidedBy}>` +
+        `${args.reason ? ` · reason: ${inlineForReview(args.reason)}` : ""}\nReview and merge to grant: ${pr.url}`);
+    const adminRes = await post("chat.postMessage", adminBody.toString());
+    const adminOk = adminRes?.ok === true;
+    // The thread note goes on the REQUESTER'S OWN platform, read from the frozen scopeKey and never from anything the model or the click supplied. An unparseable scopeKey yields no platform, and a note with no platform has no transport, so it is skipped rather than guessed as Slack.
+    const askingPlatform = platformOfScopeKey(args.scopeKey);
+    if (askingPlatform) {
+        const threadNote = deps.postThreadNote ?? postSurfaceText;
+        await threadNote(askingPlatform, {
+            channelId: args.channelId,
+            threadTs: args.threadTs,
+            text: `Access request sent — PR ${pr.url} is with the admins. Merging it grants: ${sentence.charAt(0).toLowerCase()}${sentence.slice(1)}.`,
+        });
+    }
+    return (`${pr.updated ? `updated PR #${pr.number}` : `opened PR #${pr.number}`} — ${pr.url}; an admin merges it in GitHub to grant` +
+        (adminOk ? "" : " (admin-channel notification failed — flag it to an admin directly)"));
+}
+const accessRequest = {
+    kind: "access.request",
+    policy: "member",
+    summarize(args) {
+        return [
+            `Request wider access — ${grantSentence(args.delta)}`,
+            ...(args.universe ? [args.universe] : []),
+            // BEFORE the click, not after it (OPE-235): how far this widening reaches inside the room's
+            // memory domain, and the audiences Open Everywhere cannot enumerate.
+            ...(args.exposure ?? []),
+            ...renderDelta(args.delta),
+            // Collapsed to one line, because a reason that could open a markdown block could forge card structure around the decision being asked for.
+            ...(args.reason ? [`Reason: ${inlineForReview(args.reason)}`] : []),
+            `Sending opens a bot-PR against \`${args.configRepo}\` for an admin to merge — nothing is granted until they do.`,
+        ];
+    },
+    async execute(args, decidedBy) {
+        return executeAccessRequest(args, decidedBy);
+    },
+};
+registerActionKind(accessRequest);
+//# sourceMappingURL=access-request.js.map

package/dist/agent/approvals/access-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.js","sourceRoot":"","sources":["../../../agent/approvals/access-request.ts"],"names":[],"mappings":"AAAA,0UAA0U;AAE1U,OAAO,EAAE,SAAS,EAA6B,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC/G,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAiB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AA4ClE;;kCAEkC;AAClC,MAAM,UAAU,2BAA2B,CAAC,QAA+B;IACzE,MAAM,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC,kBAAkB,EAAE,EAAE,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,iHAAiH;YAC/G,qIAAqI,CACxI,CAAC;IACJ,CAAC;IACD,OAAO,GAAkC,CAAC;AAC5C,CAAC;AAED,sSAAsS;AACtS,SAAS,MAAM,CAAC,IAAuB,EAAE,SAAiB;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,QAAQ,GAAG,CAAC;IAC5I,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG;QAC/B,EAAE;QACF,kHAAkH;QAClH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,2FAA2F;QAC3F,gGAAgG;QAChG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACjD,EAAE;QACF,kBAAkB,IAAI,CAAC,WAAW,kBAAkB,SAAS,gBAAgB,IAAI,CAAC,QAAQ,IAAI;QAC9F,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,iBAAiB,SAAS,EAAE;QAC5B,EAAE;QACF,KAAK;QACL,mHAAmH;QACnH,gHAAgH;QAChH,kHAAkH;KACnH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAuB,EAAE,SAAiB,EAAE,IAAI,GAA6B,EAAE;IACxH,MAAM,GAAG,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC;IACtC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,kCAAkC,CAAC;IACxE,MAAM,MAAM,GAAG,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC;IAClD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE3C,6FAA6F;IAC7F,+FAA+F;IAC/F,gGAAgG;IAChG,2EAA2E;IAC3E,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,0HAA0H,CACzK,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,kBAAkB,UAAU,mMAAmM,CAChO,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sLAAsL;IACtL,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAiC,EAAE;QAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAClC,mPAAmP;QACnP,mBAAmB,CAAC,CAAC,GAAG,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC9G,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,WAAW,CAAC;YAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;SACvG,CAAC,CAAC;QACH,OAAO,uCAAuC,IAAI,IAAI,MAAM,aAAa,MAAM,CAAC,UAAU,4BAA4B,IAAI,qBAAqB,CAAC;IAClJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,2BAA2B,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,cAAc,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;IAE1C,qFAAqF;IACrF,mFAAmF;IACnF,IAAI,SAAS,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,wBAAwB,IAAI,sCAAsC,CAAC,CAAC;QAC7H,MAAM,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,iIAAiI;IACjI,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IAEvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QACvJ,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,mBAAmB,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC;QACtB,IAAI;QACJ,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,KAAK,EAAE,mBAAmB,QAAQ,EAAE;QACpC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC;QAC7B,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC1C,WAAW,EAAE,SAAS;QACtB,MAAM,EAAE,0BAA0B;QAClC,MAAM,EAAE;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,IAAI;YACJ,MAAM;YACN,EAAE,EAAE,EAAE,CAAC,MAAM;YACb,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B;KACF,CAAC,CAAC;IAEH,qFAAqF;IACrF,qFAAqF;IACrF,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;IACxC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,CACX,MAAM,EACN,iCAAiC,QAAQ,qBAAqB,IAAI,CAAC,WAAW,iBAAiB,SAAS,GAAG;QACzG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gCAAgC,EAAE,CAAC,GAAG,EAAE,CAC7G,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,EAAE,EAAE,KAAK,IAAI,CAAC;IAEtC,wRAAwR;IACxR,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC;QAC1D,MAAM,UAAU,CAAC,cAAc,EAAE;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,4BAA4B,EAAE,CAAC,GAAG,2CAA2C,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG;SAC3I,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CACL,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,yCAAyC;QAC3H,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qEAAqE,CAAC,CACvF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAkC;IACnD,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,QAAQ;IAChB,SAAS,CAAC,IAAI;QACZ,OAAO;YACL,0BAA0B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACrD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,4FAA4F;YAC5F,qEAAqE;YACrE,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YACxB,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1B,2IAA2I;YAC3I,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,oCAAoC,IAAI,CAAC,UAAU,8DAA8D;SAClH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,OAAO,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,aAAa,CAAC,CAAC"}

package/dist/agent/approvals/actions.d.ts

@@ -0,0 +1,95 @@
+import type { CapLevel } from "../operational/store.js";
+import type { ActionKind, PendingActionRow } from "./types.js";
+export declare function registerActionKind(k: ActionKind<any>): void;
+export declare function actionKind(kind: string): ActionKind<any> | undefined;
+/** Every kind registered in THIS process, sorted. The enumeration `lint:consequence` needs to be
+ *  total over the ActionKind plane (OPE-295 item 4): a lookup alone can only check kinds somebody
+ *  already thought to name, which is exactly how three kinds no tool proposes shipped unpinned. */
+export declare function registeredActionKinds(): string[];
+/** Deterministic summary lines for a pending row, derived ONLY from its kind and FROZEN argsJson and never from the raw blob; fail-soft on an unregistered kind or unparseable args. Shared by the card path and the control-plane list view, so both render a pending identically. */
+export declare function summarizeFrozenRow(row: PendingActionRow): string[];
+export declare function whereFromScope(org: string, scopeKey: string): {
+    org: string;
+    platform: string;
+    workspace: string;
+    surface?: string;
+};
+export declare function orgWideWhere(org: string): {
+    org: string;
+    platform: string;
+    workspace: string;
+};
+export interface SpendSetArgs {
+    readonly org: string;
+    readonly scopeKey: string;
+    readonly level: CapLevel;
+    /** ≥1 of monthlyTokens/monthlyUsd is present (planSetSpendLimit validates before
+     *  freezing) — an override sets a token cap, a USD cap, or both in one bridge. */
+    readonly monthlyTokens?: number;
+    readonly monthlyUsd?: number;
+    readonly reason?: string;
+    /** Human label for the scope ("#proj-chat", "the Acme server") resolved at PROPOSE time —
+     *  DISPLAY ONLY (approvals/scope-label.ts, fail-open). The raw scopeKey stays the source
+     *  of truth for execute/audit; frozen with the args so pending AND decided renders agree. */
+    readonly scopeLabel?: string;
+    /** The effective TOKEN cap at propose time — shown on the card as "current → proposed".
+     *  (Field name kept from the tokens-only era so a pending card frozen before USD caps
+     *  landed still renders correctly after a deploy.) */
+    readonly currentCap: number | null;
+    /** The effective USD cap at propose time. Absent on pre-USD frozen cards. */
+    readonly currentUsd?: number | null;
+    /** The proposing turn had ingested untrusted external content — reviewer-scrutiny flag, never an
+     *  auto-reject (see {@link spendTaintLines}). Optional because a card frozen before the propose
+     *  tools started passing it renders without the banner rather than failing to render. */
+    readonly tainted?: boolean;
+    /** Pricing coverage, measured and frozen at propose time, and deliberately PART OF THE DEDUP IDENTITY: two otherwise identical proposals that measured different coverage mint two cards, because handing back a card whose coverage line has been overtaken would show the approver a gap that no longer exists. A REDELIVERED step body is covered separately by volatileArgs, so both deliveries of one ask still land on one card. */
+    readonly coverage?: SpendCoverage;
+}
+/** A USD cap is enforced against the ledger's priced rows, so a call on a model with no committed rate adds nothing and is not metered; the propose door measures which models the scope ran on and freezes the answer here. The four states are EXPLICIT and never inferred from an empty list, because "every model is priced" and "we could not look" are opposite facts about the same cap. */
+export type SpendCoverage = 
+/** Every model this scope ran on in the window carries a committed price. */
+{
+    readonly measured: "full";
+    readonly windowDays: number;
+}
+/** The scope ran NO traffic in the window, so nothing was priced either way — coverage unproven, not clean. */
+ | {
+    readonly measured: "no-traffic";
+    readonly windowDays: number;
+}
+/** TWO LISTS, never one, because the remedies differ: unratedModels are real model ids with no committed rate and can be priced, while unobservedModels are the ledger's placeholders for rows that record no model at all, which is an instrumentation gap no rate can close. At least one is non-empty and both are present, so a reader never mistakes "no such models" for a card that predates the split. */
+ | {
+    readonly measured: "gap";
+    readonly windowDays: number;
+    readonly unratedModels: readonly string[];
+    readonly unobservedModels: readonly string[];
+}
+/** Coverage could not be measured at all — the reason, in the approver's terms. */
+ | {
+    readonly measured: "none";
+    readonly why: string;
+};
+export interface SpendClearArgs {
+    readonly org: string;
+    readonly scopeKey: string;
+    readonly level: CapLevel;
+    /** Effective token cap at propose time (name kept from the tokens-only era — see
+     *  SpendSetArgs.currentCap). */
+    readonly currentCap: number | null;
+    /** Effective USD cap at propose time. Absent on pre-USD frozen cards. */
+    readonly currentUsd?: number | null;
+    /** Display-only scope label — see SpendSetArgs.scopeLabel. */
+    readonly scopeLabel?: string;
+    /** Reviewer-scrutiny taint flag — see SpendSetArgs.tainted. */
+    readonly tainted?: boolean;
+}
+export interface HaltResumeArgs {
+    readonly org: string;
+    /** Exactly one address, mirroring the store's own union — see access/halt.ts haltAddressFromParts. */
+    readonly orgWide?: true;
+    readonly level?: CapLevel;
+    readonly scopeKey?: string;
+    /** A friendly label for the card, resolved host-side. Never an address. */
+    readonly scopeLabel?: string;
+}
+//# sourceMappingURL=actions.d.ts.map

package/dist/agent/approvals/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../agent/approvals/actions.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK/D,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAE3D;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,SAAS,CAEpE;AAED;;mGAEmG;AACnG,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD;AAED,uRAAuR;AACvR,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAWlE;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAiBpI;AAGD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAE9F;AAsBD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB;sFACkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;iGAE6F;IAC7F,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;0DAEsD;IACtD,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;6FAEyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,0aAA0a;IAC1a,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;CACnC;AAED,mYAAmY;AACnY,MAAM,MAAM,aAAa;AACvB,6EAA6E;AAC3E;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAC5D,+GAA+G;GAC7G;IAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAClE,kZAAkZ;GAChZ;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AACpJ,mFAAmF;GACjF;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAmIxD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB;oCACgC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAuFD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sGAAsG;IACtG,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/agent/approvals/actions.js

@@ -0,0 +1,293 @@
+// The ActionKind registry: a kind is looked up by its kind string at BOTH propose time and decide time, so the card and the execution can never drift. Every execute() here calls the same operational-store functions the control-plane write tools call and appends the same admin audit action — one mutation path, two front doors, never a parallel implementation.
+import { getOperationalStore } from "../operational/provider.js";
+import { haltAddressFields, haltAddressFromParts } from "../access/halt.js";
+import { appendAudit } from "../audit/audit.js";
+import { parseScopeKey } from "../access/scope-key.js";
+import { principalKey } from "../identity/principal-key.js";
+import { withTaintDisclosure } from "./taint-disclosure.js";
+const REGISTRY = new Map();
+export function registerActionKind(k) {
+    REGISTRY.set(k.kind, k);
+}
+export function actionKind(kind) {
+    return REGISTRY.get(kind);
+}
+/** Every kind registered in THIS process, sorted. The enumeration `lint:consequence` needs to be
+ *  total over the ActionKind plane (OPE-295 item 4): a lookup alone can only check kinds somebody
+ *  already thought to name, which is exactly how three kinds no tool proposes shipped unpinned. */
+export function registeredActionKinds() {
+    return [...REGISTRY.keys()].sort();
+}
+/** Deterministic summary lines for a pending row, derived ONLY from its kind and FROZEN argsJson and never from the raw blob; fail-soft on an unregistered kind or unparseable args. Shared by the card path and the control-plane list view, so both render a pending identically. */
+export function summarizeFrozenRow(row) {
+    const kindDef = actionKind(row.kind);
+    if (!kindDef)
+        return [`(no registered ActionKind for "${row.kind}")`];
+    try {
+        const args = JSON.parse(row.argsJson);
+        // OPE-307 taint disclosure, from the FROZEN flag only (`live: false`): a control-plane list is
+        // rendered in somebody else's turn entirely, so a live read here would be another proposal's.
+        return withTaintDisclosure(kindDef.summarize(args), args, { live: false });
+    }
+    catch {
+        return ["(failed to render this pending's summary)"];
+    }
+}
+// THE one derivation of the audit where from a scopeKey, for every front door: the control plane once kept a private near-copy missing the domain branch, and stamped a wrong platform on every domain-scoped row. FAIL-OPEN by contract — a malformed key salvages what it can and substitutes "unknown" — because appendAudit must never be the thing that fails a mutation.
+export function whereFromScope(org, scopeKey) {
+    const parsed = parseScopeKey(scopeKey);
+    switch (parsed.kind) {
+        case "domain":
+            return { org, platform: "domain", workspace: parsed.name || "unknown" };
+        // A PERSON's row puts the KIND in platform and the identifier in workspace, the same shape as the domain case. Deliberately not a platform name plus a user id: that is a workspace id naming no workspace, and every audit reader filtering by workspace would silently absorb it.
+        case "principal":
+            return { org, platform: "user", workspace: principalKey(parsed.platform, parsed.tenant, parsed.id) };
+        case "tenant":
+            return { org, platform: parsed.platform, workspace: parsed.workspace };
+        case "surface":
+            return { org, platform: parsed.platform, workspace: parsed.workspace, surface: parsed.surface };
+        case "malformed": {
+            const [platform, workspace, surface] = parsed.parts;
+            return { org, platform: platform || "unknown", workspace: workspace || "unknown", ...(surface ? { surface } : {}) };
+        }
+    }
+}
+// The org-wide audit envelope, built here directly rather than routed through a made-up scopeKey: the grammar has no org-wide shape, and an empty key is a DOMAIN key with an empty name. The org is read back to partition the ledger, so one org's operator rows never answer another's; platform and workspace stay envelope only.
+export function orgWideWhere(org) {
+    return { org, platform: "org", workspace: org };
+}
+function fmtCap(tokens) {
+    return tokens === null ? "none (uncapped)" : `${tokens.toLocaleString()} tokens/mo`;
+}
+function fmtCapUsd(usd) {
+    return usd === null ? "none (uncapped)" : `$${usd.toFixed(2)}/mo`;
+}
+/** The card's scope line: the friendly label when the propose tool resolved one, else the
+ *  raw key. The label alone is enough for the deciding human (the exact key is frozen in
+ *  the args + audited on execute); showing both just re-creates the unreadable line. */
+function scopeLine(label, scopeKey, level) {
+    return label ? `${label} (${level})` : `scope \`${scopeKey}\` (${level})`;
+}
+/** A tainted proposal is never auto-rejected: it is shown to a human WITH the warning, and a clean card stays byte-identical. The remedy names WHO to check rather than what to read, because a money card has no body to scrutinise — the one thing an injected proposal cannot fake is that a person actually asked for it. */
+function spendTaintLines(tainted) {
+    return tainted ? ["⚠ proposed in a turn that read external content — confirm a person actually asked for this budget change before approving"] : [];
+}
+/** Rendered from the FROZEN args, so the pending card and the decided card say the same thing however long the click took, and every line anchors its claim to the moment the card was POSTED — a card lives for hours and the window rolls, so a live-present tick would be a stale claim. The default arm says the state is unreadable rather than falling through into another state's branch, which threw and killed the whole card render. */
+/** How many model ids a coverage line names before it summarises the rest. This list is the only unbounded thing on a spend card, and a card past a surface's length limit fails to POST — no card, so no approval, from a line that was only ever advisory. */
+const COVERAGE_MODELS_SHOWN = 8;
+function namedModels(models) {
+    if (models.length <= COVERAGE_MODELS_SHOWN)
+        return models.join(", ");
+    return `${models.slice(0, COVERAGE_MODELS_SHOWN).join(", ")} and ${models.length - COVERAGE_MODELS_SHOWN} more`;
+}
+function spendCoverageLines(coverage) {
+    if (coverage === undefined)
+        return [];
+    switch (coverage.measured) {
+        case "none":
+            return [`⚠ pricing coverage NOT MEASURED when this card was posted — ${coverage.why} This $ figure may not meter all of this scope's traffic.`];
+        case "no-traffic":
+            // 🔴 NEVER the "full" tick. A scope with no rows priced nothing, so the tick would be a green
+            // light earned by an empty window — the same false clean bill as an unmeasurable read.
+            return [`ℹ pricing coverage: this scope ran no traffic in the ${coverage.windowDays} days before this card was posted, so nothing here shows whether this $ cap would meter it`];
+        case "full":
+            return [`✅ pricing coverage: every model this scope ran on in the ${coverage.windowDays} days before this card was posted carried a committed price`];
+        case "gap": {
+            const lines = [];
+            if (coverage.unratedModels.length > 0) {
+                lines.push(`⚠ pricing coverage: this $ cap does NOT count calls on ${namedModels(coverage.unratedModels)} — they carry no committed price and add $0 to the spend ledger` +
+                    ` (measured over the ${coverage.windowDays} days before this card was posted). The cap still sums every other priced row, and a token cap is unaffected.`);
+            }
+            if (coverage.unobservedModels.length > 0) {
+                lines.push(`⚠ pricing coverage: some of this scope's rows record no model at all (${namedModels(coverage.unobservedModels)}), so the cap does not count them either` +
+                    ` (measured over the ${coverage.windowDays} days before this card was posted).` +
+                    ` That is an instrumentation gap, not a pricing one — no rate can be committed for them, because nothing observed which model ran.`);
+            }
+            return lines;
+        }
+        default:
+            // An unrecognised tag from a newer deploy. Say the state is unreadable rather than render
+            // nothing: silence here is the clean bill this whole feature exists to remove.
+            return ["⚠ pricing coverage: this card carries a coverage state this deploy cannot read — treat the $ figure's coverage as unknown"];
+    }
+}
+/** What the approver READ, recorded beside what they approved; empty for a proposal that froze none, so a token-only row stays byte-identical. "full" is an EXPLICIT match and never the fallthrough, because a default that wrote a clean bill for a tag it does not recognise is the one lie this record must never tell. */
+function spendCoverageDetail(coverage) {
+    if (coverage === undefined)
+        return {};
+    switch (coverage.measured) {
+        case "gap":
+            return {
+                pricingCoverage: "gap",
+                // Positive-only per list, and the two names are disjoint by construction — `unratedModels`
+                // takes a rate, `unobservedModels` cannot. An audit reader must not have to guess which.
+                ...(coverage.unratedModels.length > 0 ? { unratedModels: [...coverage.unratedModels] } : {}),
+                ...(coverage.unobservedModels.length > 0 ? { unobservedModels: [...coverage.unobservedModels] } : {}),
+            };
+        case "none":
+            return { pricingCoverage: "not-measured" };
+        case "no-traffic":
+            return { pricingCoverage: "no-traffic" };
+        case "full":
+            return { pricingCoverage: "full" };
+        default:
+            return { pricingCoverage: "unknown" };
+    }
+}
+/** The "current → proposed" card lines — one per component the proposal SETS (a
+ *  component it doesn't name isn't changing, so showing it would only invite a
+ *  misread of what the click approves). */
+function spendChangeLines(args) {
+    const lines = [];
+    if (args.monthlyTokens != null)
+        lines.push(`tokens: ${fmtCap(args.currentCap)} → ${fmtCap(args.monthlyTokens)}`);
+    if (args.monthlyUsd != null)
+        lines.push(`$: ${fmtCapUsd(args.currentUsd ?? null)} → ${fmtCapUsd(args.monthlyUsd)}`);
+    return lines;
+}
+const spendSet = {
+    kind: "spend.set",
+    policy: "admin",
+    // coverage is the ONE measured arg: every other frozen field is the request the human made and is byte-identical on a redelivery. Naming it here keys the redelivery guard on the request rather than on the measurement, while the frozen value still rides the row and the card.
+    volatileArgs: ["coverage"],
+    // reason is the proposer's free text. A model that retries a proposal rewrites it every time (OPE-2066: three cards for one $1609 ask, each with a new reason), so the live-card dedup ignores it. Every figure, the scope, the level, the coverage and the taint flag stay in the identity.
+    proseArgs: ["reason"],
+    summarize(args) {
+        return [
+            `Set spend limit — ${scopeLine(args.scopeLabel, args.scopeKey, args.level)}`,
+            ...spendChangeLines(args),
+            // Directly under the figures it qualifies, and above the reason: the reason is the proposer's
+            // account of why, and the coverage line is the card's own evidence about what the figure meters.
+            ...spendCoverageLines(args.coverage),
+            ...(args.reason ? [`Reason: ${args.reason}`] : []),
+            ...spendTaintLines(args.tainted),
+        ];
+    },
+    async execute(args, decidedBy) {
+        const store = getOperationalStore();
+        await store.setSpendLimit(args.org, args.scopeKey, args.level, { monthlyTokens: args.monthlyTokens, monthlyUsd: args.monthlyUsd }, { reason: args.reason, setBy: decidedBy });
+        await appendAudit({
+            ...whereFromScope(args.org, args.scopeKey),
+            principalId: decidedBy,
+            action: "admin.spend.set_limit",
+            detail: {
+                scopeKey: args.scopeKey,
+                level: args.level,
+                ...(args.monthlyTokens != null ? { monthlyTokens: args.monthlyTokens } : {}),
+                ...(args.monthlyUsd != null ? { monthlyUsd: args.monthlyUsd } : {}),
+                ...(args.reason ? { reason: args.reason } : {}),
+                // POSITIVE-ONLY (remember.ts's shape): a clean row's detail is byte-identical to before,
+                // so no golden or audit reader changes — but an approved-anyway tainted cap change stays
+                // findable after the fact, which is the only forensics this plane offers.
+                ...(args.tainted ? { tainted: true } : {}),
+                ...spendCoverageDetail(args.coverage),
+            },
+        });
+        const set = [
+            ...(args.monthlyTokens != null ? [fmtCap(args.monthlyTokens)] : []),
+            ...(args.monthlyUsd != null ? [fmtCapUsd(args.monthlyUsd)] : []),
+        ].join(" + ");
+        return `spend limit set to ${set} for ${args.scopeLabel ?? `\`${args.scopeKey}\``} (${args.level})`;
+    },
+};
+const spendClear = {
+    kind: "spend.clear",
+    policy: "admin",
+    summarize(args) {
+        const current = [
+            ...(args.currentCap !== null ? [fmtCap(args.currentCap)] : []),
+            ...(args.currentUsd != null ? [fmtCapUsd(args.currentUsd)] : []),
+        ];
+        return [
+            `Clear spend limit override — ${scopeLine(args.scopeLabel, args.scopeKey, args.level)}`,
+            `${current.length ? current.join(" + ") : "none (uncapped)"} → reverts to the config-as-code cap`,
+            ...spendTaintLines(args.tainted),
+        ];
+    },
+    async execute(args, decidedBy) {
+        const store = getOperationalStore();
+        const cleared = await store.clearSpendLimit(args.org, args.scopeKey, args.level);
+        await appendAudit({
+            ...whereFromScope(args.org, args.scopeKey),
+            principalId: decidedBy,
+            action: "admin.spend.clear_limit",
+            detail: { scopeKey: args.scopeKey, level: args.level, cleared, ...(args.tainted ? { tainted: true } : {}) },
+        });
+        const scope = args.scopeLabel ?? `\`${args.scopeKey}\``;
+        return cleared
+            ? `spend limit override cleared for ${scope} (${args.level}) — reverted to config`
+            : `no spend limit override was set for ${scope} (${args.level}) — nothing to clear`;
+    },
+};
+const connectorRevoke = {
+    kind: "connector.revoke",
+    policy: "admin",
+    summarize(args) {
+        return [`Revoke connector \`${args.connector}\` — scope \`${args.scopeKey}\``, ...(args.reason ? [`Reason: ${args.reason}`] : [])];
+    },
+    async execute(args, decidedBy) {
+        const store = getOperationalStore();
+        await store.setConnectorOverride(args.org, args.scopeKey, args.connector, false, { reason: args.reason, setBy: decidedBy });
+        await appendAudit({
+            ...whereFromScope(args.org, args.scopeKey),
+            principalId: decidedBy,
+            action: "admin.connector.revoke",
+            detail: { connector: args.connector, ...(args.reason ? { reason: args.reason } : {}) },
+        });
+        return `connector \`${args.connector}\` revoked for \`${args.scopeKey}\``;
+    },
+};
+const connectorClear = {
+    kind: "connector.clear",
+    policy: "admin",
+    summarize(args) {
+        return [`Clear connector override \`${args.connector}\` — scope \`${args.scopeKey}\``, `Reverts to the config-as-code bundle grant`];
+    },
+    async execute(args, decidedBy) {
+        const store = getOperationalStore();
+        const cleared = await store.clearConnectorOverride(args.org, args.scopeKey, args.connector);
+        await appendAudit({
+            ...whereFromScope(args.org, args.scopeKey),
+            principalId: decidedBy,
+            action: "admin.connector.clear_override",
+            detail: { connector: args.connector, cleared },
+        });
+        return cleared
+            ? `connector override cleared for \`${args.connector}\` on \`${args.scopeKey}\` — reverted to config`
+            : `no connector override was set for \`${args.connector}\` on \`${args.scopeKey}\` — nothing to clear`;
+    },
+};
+const haltResume = {
+    kind: "halt.resume",
+    policy: "admin",
+    summarize(args) {
+        const where = args.orgWide === true ? "everywhere in this org" : `\`${args.scopeKey}\` (${args.level})`;
+        return [
+            `Resume — lift the break-glass halt ${where}`,
+            "Consequential acts start working again: approvals, routine fires, connector calls, credential grants and outbound network access.",
+            ...(args.scopeLabel ? [`Scope: ${args.scopeLabel}`] : []),
+        ];
+    },
+    async execute(args, decidedBy) {
+        const address = haltAddressFromParts(args);
+        const cleared = await getOperationalStore().clearHalt(args.org, address, { clearedBy: decidedBy });
+        await appendAudit({
+            // `orgWideWhere`, never `whereFromScope(org, "")` — an empty scope key is a DOMAIN key with an
+            // empty name, which salvages to `{platform:"domain", workspace:"unknown"}` (the OPE-240
+            // costume). An org-wide halt is about the org, so it is stamped as one.
+            ...(address.orgWide ? orgWideWhere(args.org) : whereFromScope(args.org, address.scopeKey)),
+            principalId: decidedBy,
+            action: "admin.halt.cleared",
+            detail: { ...haltAddressFields(address), cleared },
+        });
+        return cleared
+            ? `halt cleared${args.orgWide === true ? " org-wide" : ` for \`${args.scopeKey}\``} — consequential acts work again`
+            : `no halt was in force${args.orgWide === true ? " org-wide" : ` for \`${args.scopeKey}\``} — nothing to clear`;
+    },
+};
+registerActionKind(spendSet);
+registerActionKind(spendClear);
+registerActionKind(connectorRevoke);
+registerActionKind(connectorClear);
+registerActionKind(haltResume);
+//# sourceMappingURL=actions.js.map

package/dist/agent/approvals/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../../agent/approvals/actions.ts"],"names":[],"mappings":"AAAA,yWAAyW;AAEzW,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpD,MAAM,UAAU,kBAAkB,CAAC,CAAkB;IACnD,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;mGAEmG;AACnG,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,uRAAuR;AACvR,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,kCAAkC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,+FAA+F;QAC/F,8FAA8F;QAC9F,OAAO,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,2CAA2C,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,+WAA+W;AAC/W,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,QAAgB;IAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;QAC1E,oRAAoR;QACpR,KAAK,WAAW;YACd,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACvG,KAAK,QAAQ;YACX,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QACzE,KAAK,SAAS;YACZ,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAClG,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YACpD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACtH,CAAC;IACH,CAAC;AACH,CAAC;AAED,sUAAsU;AACtU,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,MAAM,CAAC,MAAqB;IACnC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAAC,GAAkB;IACnC,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AACpE,CAAC;AAED;;wFAEwF;AACxF,SAAS,SAAS,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,QAAQ,OAAO,KAAK,GAAG,CAAC;AAC5E,CAAC;AAED,iUAAiU;AACjU,SAAS,eAAe,CAAC,OAA4B;IACnD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,2HAA2H,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtJ,CAAC;AAwCD,mbAAmb;AACnb,gQAAgQ;AAChQ,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,SAAS,WAAW,CAAC,MAAyB;IAC5C,IAAI,MAAM,CAAC,MAAM,IAAI,qBAAqB;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,GAAG,qBAAqB,OAAO,CAAC;AAClH,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAmC;IAC7D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,QAAQ,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM;YACT,OAAO,CAAC,+DAA+D,QAAQ,CAAC,GAAG,2DAA2D,CAAC,CAAC;QAClJ,KAAK,YAAY;YACf,8FAA8F;YAC9F,uFAAuF;YACvF,OAAO,CAAC,wDAAwD,QAAQ,CAAC,UAAU,4FAA4F,CAAC,CAAC;QACnL,KAAK,MAAM;YACT,OAAO,CAAC,4DAA4D,QAAQ,CAAC,UAAU,6DAA6D,CAAC,CAAC;QACxJ,KAAK,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CACR,0DAA0D,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,iEAAiE;oBAC5J,uBAAuB,QAAQ,CAAC,UAAU,+GAA+G,CAC5J,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CACR,yEAAyE,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,0CAA0C;oBACvJ,uBAAuB,QAAQ,CAAC,UAAU,qCAAqC;oBAC/E,mIAAmI,CACtI,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD;YACE,0FAA0F;YAC1F,+EAA+E;YAC/E,OAAO,CAAC,2HAA2H,CAAC,CAAC;IACzI,CAAC;AACH,CAAC;AAED,+TAA+T;AAC/T,SAAS,mBAAmB,CAAC,QAAmC;IAC9D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,QAAQ,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC1B,KAAK,KAAK;YACR,OAAO;gBACL,eAAe,EAAE,KAAK;gBACtB,2FAA2F;gBAC3F,yFAAyF;gBACzF,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,GAAG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtG,CAAC;QACJ,KAAK,MAAM;YACT,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;QAC7C,KAAK,YAAY;YACf,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;QAC3C,KAAK,MAAM;YACT,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACrC;YACE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;2CAE2C;AAC3C,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACjH,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAA6B;IACzC,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,OAAO;IACf,mRAAmR;IACnR,YAAY,EAAE,CAAC,UAAU,CAAC;IAC1B,6RAA6R;IAC7R,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,SAAS,CAAC,IAAI;QACZ,OAAO;YACL,qBAAqB,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YAC5E,GAAG,gBAAgB,CAAC,IAAI,CAAC;YACzB,8FAA8F;YAC9F,iGAAiG;YACjG,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;SACjC,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,KAAK,CAAC,aAAa,CACvB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,EACV,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,EAClE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAC1C,CAAC;QACF,MAAM,WAAW,CAAC;YAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,yFAAyF;gBACzF,yFAAyF;gBACzF,0EAA0E;gBAC1E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;aACtC;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG;YACV,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,OAAO,sBAAsB,GAAG,QAAQ,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,CAAC,KAAK,GAAG,CAAC;IACtG,CAAC;CACF,CAAC;AAiBF,MAAM,UAAU,GAA+B;IAC7C,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,OAAO;IACf,SAAS,CAAC,IAAI;QACZ,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,OAAO;YACL,gCAAgC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACvF,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,sCAAsC;YACjG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;SACjC,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACjF,MAAM,WAAW,CAAC;YAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,yBAAyB;YACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC5G,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC;QACxD,OAAO,OAAO;YACZ,CAAC,CAAC,oCAAoC,KAAK,KAAK,IAAI,CAAC,KAAK,wBAAwB;YAClF,CAAC,CAAC,uCAAuC,KAAK,KAAK,IAAI,CAAC,KAAK,sBAAsB,CAAC;IACxF,CAAC;CACF,CAAC;AASF,MAAM,eAAe,GAAoC;IACvD,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,OAAO;IACf,SAAS,CAAC,IAAI;QACZ,OAAO,CAAC,sBAAsB,IAAI,CAAC,SAAS,gBAAgB,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrI,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC5H,MAAM,WAAW,CAAC;YAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACvF,CAAC,CAAC;QACH,OAAO,eAAe,IAAI,CAAC,SAAS,oBAAoB,IAAI,CAAC,QAAQ,IAAI,CAAC;IAC5E,CAAC;CACF,CAAC;AAQF,MAAM,cAAc,GAAmC;IACrD,IAAI,EAAE,iBAAiB;IACvB,MAAM,EAAE,OAAO;IACf,SAAS,CAAC,IAAI;QACZ,OAAO,CAAC,8BAA8B,IAAI,CAAC,SAAS,gBAAgB,IAAI,CAAC,QAAQ,IAAI,EAAE,4CAA4C,CAAC,CAAC;IACvI,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5F,MAAM,WAAW,CAAC;YAChB,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC;YAC1C,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,gCAAgC;YACxC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE;SAC/C,CAAC,CAAC;QACH,OAAO,OAAO;YACZ,CAAC,CAAC,oCAAoC,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,QAAQ,yBAAyB;YACrG,CAAC,CAAC,uCAAuC,IAAI,CAAC,SAAS,WAAW,IAAI,CAAC,QAAQ,uBAAuB,CAAC;IAC3G,CAAC;CACF,CAAC;AAcF,MAAM,UAAU,GAA+B;IAC7C,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,OAAO;IACf,SAAS,CAAC,IAAI;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC;QACxG,OAAO;YACL,sCAAsC,KAAK,EAAE;YAC7C,mIAAmI;YACnI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACnG,MAAM,WAAW,CAAC;YAChB,+FAA+F;YAC/F,wFAAwF;YACxF,wEAAwE;YACxE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC1F,WAAW,EAAE,SAAS;YACtB,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE;SACnD,CAAC,CAAC;QACH,OAAO,OAAO;YACZ,CAAC,CAAC,eAAe,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,kCAAkC;YACpH,CAAC,CAAC,uBAAuB,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,qBAAqB,CAAC;IACpH,CAAC;CACF,CAAC;AAEF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAC7B,kBAAkB,CAAC,UAAU,CAAC,CAAC;AAC/B,kBAAkB,CAAC,eAAe,CAAC,CAAC;AACpC,kBAAkB,CAAC,cAAc,CAAC,CAAC;AACnC,kBAAkB,CAAC,UAAU,CAAC,CAAC"}