@open-everywhere/core 0.1.0

package/dist/agent/approvals/flow.d.ts

@@ -0,0 +1,398 @@
+import { type UnifiedWakeOrigin } from "../channels/unified-window.js";
+import { dispatchApprovalDecisionWake } from "../channels/unified.js";
+import { type ApprovalOutcome } from "./decision-wake.js";
+import { type HaltDeps } from "../access/halt.js";
+import { type ClickerFloorRefusal } from "./clicker-floor.js";
+import { type ContradictJudgeAllowOutcome } from "./judge-contradiction.js";
+import type { PendingActionRow } from "./types.js";
+import type { BindableContext } from "../identity/binding.js";
+import "./memory-purge.js";
+import "./access-request.js";
+import "./skill-create.js";
+import "./routine-create.js";
+import "./pr-open.js";
+import "./skill-delete.js";
+import "./routine-cancel.js";
+import "./routine-lifecycle.js";
+import "./routine-policy.js";
+import "./webhook.js";
+import "./webhook-declare.js";
+import "./agent-create.js";
+import "./ticket-actions.js";
+import "./ticket-create.js";
+import "./chat-post.js";
+import "./chat-dm.js";
+import "./session-checkpoint.js";
+/** Every button/action_id this feature owns is prefixed with this — the front route's
+ *  classify step uses it to decide "ours" vs. "forward to Eve" (e.g. Eve's own `eve_input:`
+ *  HITL buttons). Also embedded literally (not imported) in card.ts's button `action_id`s —
+ *  see card.ts's import of this same constant; kept as ONE source of truth. */
+export declare const OE_APPROVAL_PREFIX = "oe_approval:";
+/** A minimal structural type for the real/injected Slack `chat.*` client — matches
+ *  agent/channels/slack-events.ts's `slackForm` signature exactly, so the real one satisfies
+ *  it with no adapter. */
+type PostFn = (method: string, body: string) => Promise<Record<string, unknown> | undefined>;
+/** A click decision. `approve_session` approves this proposal AND remembers the granting session, but only on a GRANTABLE kind — exactly one is grantable (`pr.open`); on every other kind the verb degrades to a one-off `approve` and grants nothing. */
+export type ApprovalDecision = "approve" | "reject" | "approve_session" | "contradict";
+/** Parse an `oe_approval:{decision}:{id}` action_id. Returns null for anything else, including a well-formed-looking id with a garbage decision segment, so a caller can treat "not parseable" as "not ours" without a second check. */
+export declare function parseApprovalAction(actionId: string): {
+    decision: ApprovalDecision;
+    id: string;
+} | null;
+/**
+ * WHERE the card was, and therefore where the decision was made. An `approval.*` row's own where-columns come from the ASKING scope, and a REDIRECTED card lands in a room that appears nowhere in the scopeKey. Additive detail only — the partition is deliberately untouched.
+ * 🔴 A VENUE FIELD ONLY EVER CARRIES A REAL PLATFORM IDENTIFIER: a domain-level or principal-level scopeKey names no room, so those rows leave the two keys ABSENT rather than borrow a pseudo-workspace every audit reader filtering on a workspace would silently absorb.
+ */
+export interface DecisionVenueDetail {
+    readonly venuePlatform?: string;
+    readonly venueWorkspace?: string;
+    readonly venueChannel?: string;
+}
+/** The fully-qualified surfaceKey of the surface a card is posted to, frozen at mint. The binding's workspace IS the workspace the card lands in, which is what makes mint-time as authoritative as the click payload's own team/guild id. */
+export declare function postedToSurfaceKey(binding: {
+    readonly platform: string;
+    readonly workspace: string;
+}, channelId: string): string;
+export interface RequestApprovalInput {
+    readonly org: string;
+    readonly kind: string;
+    /** The FROZEN mutation args — validated by the caller against the kind's own arg shape
+     *  BEFORE calling this (requestApproval only checks the kind is registered). */
+    readonly args: unknown;
+    readonly scopeKey: string;
+    readonly domain?: string | null;
+    readonly requestedBy: string;
+    readonly channelId: string;
+    readonly threadTs?: string | null;
+    /** The fully-qualified surfaceKey of the PROPOSING surface the card is posted to, frozen at mint because scopeKey is NOT a workspace source. Absent ⇒ the row freezes NULL and a sweep expiry is audit-only. */
+    readonly postedTo?: string | null;
+    /**
+     * OPTIONAL display-only body lines for the PENDING card, overriding `kind.summarize(args)` — for a kind whose frozen args deliberately REDACT what the approver must still read before clicking (memory.purge freezes only the bullets' hashes).
+     * INVARIANT: they must be rendered by CODE from the same source data the args were frozen from, never model text, so the approver still reads exactly what will execute. Never persisted; click-time re-renders use summarize(frozen args).
+     */
+    readonly summaryLines?: readonly string[];
+    /**
+     * APPROVER-CHAIN context the caller can see and this function cannot: requestApproval takes no ctx by design (the control plane calls it headless), so the turn's signals are supplied by the propose tool.
+     * 🔴 `unattended` IS REQUIRED, and an absent `chain` bag defaults it to `true`: a safety control whose unknown state reads as SAFE is not a control. Derive it with `unattendedOf(ctx)` — lint:principal-gate rule 5 refuses any other spelling. `tainted` stays optional and falls back to the chain's own in-turn signal.
+     */
+    readonly chain?: {
+        readonly unattended: boolean;
+        readonly tainted?: boolean;
+    };
+    /**
+     * Mint this pending with NO CLOCK — the far-future sentinel instead of `now + approvals.ttlHours`. A FLAG, NOT A DATE: an arbitrary `expiresAt` would let a propose site mint a row already in the past, whose card posts into the room and whose every click then resolves "expired".
+     * 🔴 Nothing expires such a row on a clock, by construction; the routine GENERATION bounds its authority instead, and an ignored card must stay clickable. A SUPERSEDED `routine.permission` card is reaped by the sweep's second pass, which is scoped to that ONE kind — a future kind setting this flag owes the sweep its own reaper.
+     */
+    readonly noClockExpiry?: true;
+}
+/** Post the code-rendered card for `row` and resolve to the posted message's platform id, or undefined on ANY failure — implementations must never throw. requestApproval treats undefined as "the card never made it", marks the pending expired and throws its own error. */
+export type CardPoster = (row: PendingActionRow, summaryLines: readonly string[]) => Promise<string | undefined>;
+/** Register (or replace) a platform's approval-card poster. Called once per bundle at boot. */
+export declare function registerCardPoster(platform: string, poster: CardPoster): void;
+/** The card poster for `platform`, or undefined (Slack, or any unregistered surface → the default
+ *  render path). The propose tools resolve `{ postCard: cardPosterFor(platform) }` from this. */
+export declare function cardPosterFor(platform: string | undefined): CardPoster | undefined;
+/**
+ * Post the judge-lift NOTICE into the room the card would have gone to — the room's only trace of an act nobody was asked about, carrying the one "This should not have run" button. That button must carry the `contradict` verb bound to `row.id`, in whatever envelope the surface uses.
+ * BEST-EFFORT BY CONTRACT: implementations must never throw. The frozen args have already executed and the audit rows are written, so a failed post must never turn a completed action into a thrown error; nothing consumes a return value.
+ */
+export type JudgeLiftNoticePoster = (row: PendingActionRow, summaryLines: readonly string[], outcomeLine: string) => Promise<void>;
+/** Register (or replace) a platform's judge-lift notice poster. Called once per bundle at boot.
+ *  Slack is deliberately NOT registered — its notice is the built-in Block Kit render below, the
+ *  same way it is the built-in renderer for the pending card. */
+export declare function registerJudgeLiftNoticePoster(platform: string, poster: JudgeLiftNoticePoster): void;
+/** The judge-lift notice poster for `platform`, or undefined — Slack (whose notice is the built-in
+ *  Block Kit render below) and every surface with no component plane, which takes the shared TEXT
+ *  render instead. A registered poster is the BUTTON arm, never the whole road. */
+export declare function judgeLiftNoticePosterFor(platform: string | undefined): JudgeLiftNoticePoster | undefined;
+/** How the judge-lift notice renders on one surface — the three arms of {@link postJudgeLiftNotice},
+ *  and the answer {@link judgeLiftNoticeRenderFor} gives. `none` is a room this deployment cannot
+ *  post into at all. */
+export type JudgeLiftNoticeRender = "poster" | "blocks" | "text" | "none";
+/**
+ * WHICH arm renders the judge-lift notice for `platform`. ONE ROAD, THREE RENDERS (OPE-1854): a bundle's registered poster carries the contradict BUTTON in its own envelope; Slack takes core's built-in Block Kit render; every other surface with a text transport takes the shared plain-text render, which spells the overrule out in words because no button can land there.
+ * 🔴 IT IS A CAPABILITY QUESTION, NOT A PLATFORM LIST — the same shape as {@link hasApprovalCardPath}. A surface reaches `none` only by registering no notice poster AND no `SurfaceMessageOps` transport, which is a room nothing can be posted into, and the parity gate reads this so such a silence has to be declared rather than discovered in production.
+ */
+export declare function judgeLiftNoticeRenderFor(platform: string | undefined): JudgeLiftNoticeRender;
+/** Does a judge-lifted act leave a trace in a `platform` room at all? The predicate the surface-parity
+ *  gate probes its `judge-lift-notice` cell with. */
+export declare function hasJudgeLiftNoticePath(platform: string): boolean;
+/**
+ * The approver chain LOWERED a gated verb, so nothing was proposed: the frozen args already EXECUTED, and `outcome` is what the kind's own `execute` returned. `resolvedBy` names the chain ELEMENT that produced the verdict and only ever that — a mode lift records itself in `ChainResolution.transforms` instead.
+ * 🔴 Do NOT write a discriminator against a closed list of element names: the surface elements are latent today rather than absent, and a caller for either one puts its name here without touching this file.
+ */
+export interface AutoApprovedOutcome {
+    readonly outcome: string;
+    readonly resolvedBy: string;
+    /** The HUMAN whose click let this run proceed — set only on the routine permission card's in-window approval, absent on every chain lift. A chain lift is config-reviewed policy acting with nobody present; reporting the second as the first would tell a routine's owner the machine decided something they decided. */
+    readonly grantedBy?: string;
+}
+/** What {@link requestApproval} hands back. `autoApproved` present ⇒ NO card exists and the
+ *  mutation has ALREADY happened; `deduped` ⇒ the LIVE card of an identical earlier proposal. */
+export interface RequestApprovalResult {
+    readonly id: string;
+    readonly expiresAt: string;
+    readonly deduped?: boolean;
+    readonly autoApproved?: AutoApprovedOutcome;
+    /** Set on the CARD path only, when a person REJECTED a proposal with the same dedup identity within the approval TTL. It is information for the proposer's result and never a block: a second human ask must still mint a card. */
+    readonly priorRejection?: PriorRejection;
+}
+/** The newest reject of the same proposal inside the approval TTL: who rejected it and when. */
+export interface PriorRejection {
+    readonly decidedBy: string;
+    readonly decidedAt: string;
+}
+/**
+ * The propose tools' reply line for the auto-approved branch: one place where the sentence is guaranteed to say the two things the card path's "posted, awaiting a human" would get wrong here — no card exists to wait on, and the action has already run.
+ * THE RELAY INSTRUCTION IS LOAD-BEARING: half these tools return an internal-only note on the card path, so with nothing posted anywhere this string is the ONLY report the asker can receive, and it has to ask to be spoken.
+ */
+export declare function autoApprovedNote(what: string, autoApproved: AutoApprovedOutcome): string;
+export interface RequestApprovalDeps {
+    readonly post?: PostFn;
+    /** Platform-aware card poster override. Absent → the default Slack Block Kit render+post
+     *  below, byte-for-byte the original path (approvals-test.ts pins it). Present (e.g. the
+     *  Discord poster, approvals/discord-flow.ts) → it owns render+post for its surface. */
+    readonly postCard?: CardPoster;
+    /** The live proposal turn, used only to freeze its already-validated wake authority for a later
+     * decision continuation. Headless control-plane proposals omit it. */
+    readonly authorityContext?: BindableContext;
+}
+/** Propose one pending action: validate the kind, freeze `args` as JSON, insert the row, post the code-rendered card, stamp its message ts and audit `approval.requested`. If the card fails to post, the pending is marked expired immediately and this THROWS — a pending nobody can see must never linger silently. */
+export declare function requestApproval(input: RequestApprovalInput, deps?: RequestApprovalDeps): Promise<RequestApprovalResult>;
+/** Platform-aware CardPoster selection: a non-Slack surface's poster is registered by its provider bundle, and Slack registers none so requestApproval's default Block Kit path runs unchanged. Platforms with no card path never get here — {@link hasApprovalCardPath} refuses them at plan time. */
+export declare function approvalPostDeps(platform: string, authorityContext?: BindableContext): RequestApprovalDeps;
+/**
+ * The surfaces that can render Approve/Reject: Slack (the built-in Block Kit path) plus any platform whose bundle registered a CardPoster.
+ * 🔴 It answers a property of a ROOM, never of a request — for "can this REQUEST work from here", reach for {@link checkApprovalVenue} instead. A surface with no card path is now ROUTED (approvals/card-venue.ts) rather than refused.
+ */
+export declare function hasApprovalCardPath(platform: string): boolean;
+/**
+ * Is `row` a spend-cap pending whose level needs ORG-ADMIN approval specifically? Two levels qualify: "domain", because a domain admin is a domain LEAD and not the budget owner, and "user", because a per-person allowance is an act about a NAMED THIRD PARTY who is not in the room the card lands in and has no seat.
+ * The frozen `domain` is independently null on every user-level row, so the domain-admin fallback is unreachable there twice over — a fence a single future edit can open is not a fence. Parse failure reads as "not one of those levels", fail-soft, which can only narrow what this refuses.
+ */
+export declare function isOrgAdminOnlySpendCap(row: PendingActionRow): boolean;
+export declare function clickerMayDecide(row: PendingActionRow, clickerId: string, clickerPlatform: string | undefined, clickerTenant: string | undefined): boolean;
+export interface HandleApprovalDeps {
+    readonly post?: PostFn;
+    /** Seam for the cross-thread DECISION WAKE (task #102): injected in tests to capture the dispatch
+     *  without a live eve receive. Absent ⇒ the real {@link wakeWindowOnDecision} deps (the live
+     *  {@link dispatchApprovalDecisionWake}). */
+    readonly decisionWake?: DecisionWakeDeps;
+    /** OPTIONAL positive per-clicker guest verdict, fed to {@link resolveApprovalClick}'s `clickerIsGuest`. `true`/`false` when the surface can positively classify the clicker, `undefined` when it cannot — `undefined` is ALWAYS inert. Core stays Slack-probe-free, so there is no live default; the Slack front wires one in. */
+    readonly clickerIsGuest?: (userId: string, teamId: string | undefined) => Promise<boolean | undefined>;
+    /** The Slack route's own `waitUntil`, forwarded whole to {@link ResolveApprovalClickInput.waitUntil} — see there for what it governs and what an absent one means. This handler is core, so the front route supplies it rather than this module reaching for a host API. */
+    readonly waitUntil?: (p: Promise<unknown>) => void;
+}
+/**
+ * The transport's own refusal reason for a failed card post, or undefined when the error is not one.
+ * 🔴 IT IS A PROPERTY, NOT THE MESSAGE. A caller that must tell a person what to do next used to
+ * have only the thrown sentence to read, and that sentence also interpolates the kind and the scope
+ * key — so a room called `404` classified as an unreachable room (OPE-1861). The reason travels
+ * beside the message instead, and the message stays the human-readable half.
+ */
+export declare function cardPostFailureReason(err: unknown): string | undefined;
+/** What one decide attempt resolved to — the discriminated result every surface renders in its own idiom. The store mutation, the audit rows and the kind execution have ALREADY happened by the time this returns: a caller only draws UI from it, never decides anything further. */
+export type ApprovalClickResolution = 
+/** No row for (org, id) — a stale card from before an aged-out sweep, or garbage. */
+{
+    readonly outcome: "unknown";
+}
+/** Already decided/expired — a stale re-click or a double-click race that lost. Nothing to
+ *  do; re-rendering risks clobbering a legitimate decided card with an outdated `row`. */
+ | {
+    readonly outcome: "not-pending";
+}
+/** This click's lazy-expiry CAS won: the row is now expired, render the expired card. */
+ | {
+    readonly outcome: "expired";
+    readonly row: PendingActionRow;
+    readonly summaryLines: string[];
+}
+/** The row was past its TTL but someone else's CAS (click or sweep) got there first. */
+ | {
+    readonly outcome: "expired-race";
+}
+/** No registered ActionKind for the row's kind — cannot decide (already console.error'd). */
+ | {
+    readonly outcome: "unregistered-kind";
+}
+/** Admin-policy kind, clicker has no standing. The row is NOT consumed — it stays
+ *  "pending" so a real admin can still act on the same card. */
+ | {
+    readonly outcome: "denied";
+    readonly row: PendingActionRow;
+}
+/** The CLICK ITSELF was refused before the policy branch (OPE-185, approvals/clicker-floor.ts):
+ *  an observed-guest room, an unattested room on a beneficiary kind, or a click from a room that
+ *  isn't the card's. Like "denied", the row is NOT consumed — it stays "pending" so the same card
+ *  can still be decided from an internal room. `reason` selects the copy the surface renders. */
+ | {
+    readonly outcome: "clicker-denied";
+    readonly row: PendingActionRow;
+    readonly reason: ClickerFloorRefusal;
+}
+/** Someone else's click won the decide CAS first — silent, the winner renders the card. */
+ | {
+    readonly outcome: "lost-race";
+}
+/**
+ * A BREAK-GLASS HALT covers the row's frozen address, and the lift's own card is EXEMPT here. 🔴 THE HALT EDITS NO ROW: the pending stays `pending` — no decide CAS, no lazy-expiry CAS, no execute — so the SAME card is clickable again once an admin runs `resume`.
+ * 🔴 THE BOUND ON "STILL CLICKABLE": the TTL SWEEP is not halt-gated, so a halt longer than `approvals.ttlHours` loses the outstanding cards to the sweep anyway and those proposals have to be re-asked. This arrow refuses; it does not preserve.
+ */
+ | {
+    readonly outcome: "halted";
+    readonly row: PendingActionRow;
+    readonly notice: string;
+}
+/** Decided (approved — executed, possibly `FAILED: …` — or rejected). `row` carries the
+ *  decided status/decidedBy; `outcomeLine` is the executor's outcome line — or, on a reject, the
+ *  literal "rejected" unless the kind implements `declined()` (approvals/types.ts), in which case
+ *  it is that hook's line and BOTH renderers show it. Audits already appended. */
+ | {
+    readonly outcome: "decided";
+    readonly row: PendingActionRow;
+    readonly summaryLines: string[];
+    readonly outcomeLine: string;
+    /** Whether the kind's `execute` RAN and how it ended — "none" for a reject (nothing runs).
+     *  Required, so a new decide return site cannot forget the fact the decision wake needs
+     *  (OPE-1097): the resumed seat is told the approved act already ran, in the executor's own
+     *  words, and a `FAILED:` prefix on `outcomeLine` is never the thing that decides it. */
+    readonly executed: "ok" | "failed" | "none";
+}
+/** A "this should not have run" click on a judge-lift wedge row: NOTHING executes and no row is consumed — the act already happened, and this only records the human's overrule in the audit trail, where it changes nothing automatically. */
+ | {
+    readonly outcome: "contradicted";
+    readonly row: PendingActionRow;
+    readonly summaryLines: string[];
+    readonly contradiction: ContradictJudgeAllowOutcome;
+};
+export interface ResolveApprovalClickInput {
+    readonly org: string;
+    readonly id: string;
+    readonly decision: ApprovalDecision;
+    readonly clickerId: string;
+    /**
+     * OPTIONAL platform-native admin standing, evaluated against the FROZEN row and OR-ed with the config-as-code roster. Discord passes guild-administrator standing; Slack passes nothing, so its only admin source is the roster.
+     * A predicate rather than a boolean because the standing may depend on the row being decided, and async because the DM-click leg needs I/O. Only evaluated on a roster MISS, so the common case never pays it.
+     */
+    readonly platformAdmin?: (row: PendingActionRow) => boolean | Promise<boolean>;
+    /**
+     * Where the click PHYSICALLY happened, as a fully-qualified `platform/workspace/surface` key, taken from the CLICK and never from the frozen row — an explicit-scope override can freeze a scopeKey naming a foreign workspace.
+     * 🔴 ABSENT ⇒ THE CLICKER GATE DOES NOT RUN AT ALL, deliberately: the headless control plane has no room and no clicker context and is already authorized by its own RBAC. Keying the gate on `platformAdmin` instead would kill that plane, since it asserts `() => true` there.
+     */
+    readonly clickContext?: {
+        readonly surfaceKey: string;
+    };
+    /** Notice deps for the session-grant RELEASE, and nothing else on this path: the rows it decides have no platform handler above them, so the release posts their notices itself off each row's own frozen `postedTo`. Absent ⇒ the live posters. The clicked row's OWN feedback is unaffected. */
+    readonly releaseFeedback?: SweepFeedbackDeps;
+    /** The PLATFORM the clicker's id lives in — supplied explicitly by the surface, because a click id is only meaningful inside its own vendor's namespace and nothing else on this input reliably carries it. Absent ⇒ the ROSTER arm of `clickerMayDecide` refuses; `platformAdmin` is unaffected. */
+    readonly clickerPlatform?: string;
+    /** The TENANT the clicker's id was issued by, on a tenant-scoped platform, and ignored by the rest so a provider need not know which those are. Omitted, it falls back to the WORKSPACE segment of the click's own room key. Absent AND underivable on a tenant-scoped platform ⇒ the ROSTER arm refuses. */
+    readonly clickerTenant?: string;
+    /** OPTIONAL positive per-clicker guest verdict — clicker-floor.ts's leg D, supplied by a surface that can positively classify the clicking person. `undefined` (the default) leaves leg D inert, exactly as if the surface had never been asked. */
+    readonly clickerIsGuest?: boolean;
+    /** Injection seam for the HALT arrow below — the same `HaltDeps` shape access/halt.ts gives every other arrow, so a test can drive a halted click without an operational store. Absent ⇒ the live store. */
+    readonly halt?: HaltDeps;
+    /**
+     * The host's "keep this promise alive past the response" hook. It governs the session-grant RELEASE and nothing else: PRESENT ⇒ the release runs OFF the response path, so the interactivity ack is written before any sibling card executes.
+     * ABSENT ⇒ the release is AWAITED, not deferred: on a serverless host a promise with nowhere to live is frozen with the invocation, so a defer with no `waitUntil` would DROP the release rather than defer it.
+     */
+    readonly waitUntil?: (p: Promise<unknown>) => void;
+}
+/**
+ * How many sibling cards ONE session grant releases. Each released row runs a real `execute`, so the candidate set is the only thing that bounds the work a single button press does — the cap stops a looping seat or a grown pending set turning one click into an arbitrarily long chain.
+ * 🔴 PAST THE CAP THE EXTRA CARDS ARE LEFT PENDING, NOT DECIDED: they stay clickable, which is the pre-release position and is safe.
+ */
+export declare const MAX_SESSION_GRANT_RELEASES = 32;
+/** The audit action naming the cards ONE session grant released — the join between a human's single click and the several actions it decided. Without it an operator sees N `approval.approved` rows attributed to someone who pressed one button, with nothing saying why. */
+export declare const SESSION_GRANT_RELEASED_ACTION = "approval.session_grant_released";
+/** The ONE decide implementation: load the row, lazily expire it, check the approver policy, CAS-decide, execute the frozen args and audit the outcome, then report what happened for the surface to render. Throws only on genuinely unexpected failures; platform handlers wrap it in their own fail-soft catch. */
+export declare function resolveApprovalClick(input: ResolveApprovalClickInput): Promise<ApprovalClickResolution>;
+/** Test seams for the sweep's expiry FEEDBACK (task #105) — absent ⇒ the live posters/dispatch. */
+export interface SweepFeedbackDeps {
+    readonly post?: PostFn;
+    /** Discord notice poster — defaults to {@link postDiscordDecisionNotice}. */
+    readonly discordNotice?: (row: PendingActionRow, text: string) => Promise<unknown>;
+    readonly decisionWake?: DecisionWakeDeps;
+}
+/**
+ * An unclicked pending that ages past its TTL never gets a terminal row on its own, so this CAS-expires each one, audits `approval.expired` (cause "ttl") and feeds the expiry back to the proposing session, which would otherwise keep believing in a dead card. Best-effort per row: a failed CAS, audit or feedback never aborts the sweep.
+ * IT RUNS TWO PASSES: the TTL pass closes every row whose clock ran out, and {@link reapSupersededRoutineCards} closes the rows that HAVE no clock. Both counts are returned together.
+ */
+export declare function sweepExpiredPendings(org: string, now?: Date, deps?: SweepFeedbackDeps): Promise<number>;
+/**
+ * REAP the routine permission cards a later `edit_routine` or delete left unanswerable. Such a row is minted with the far-future sentinel on purpose, so no TTL reaches it and its bound is the GENERATION inside the frozen `grantKey` — without this pass the routine's room keeps a card with live buttons whose every click answers "nothing was armed". The sweep is where it belongs: an edited routine may never fire again, and a deleted one never will.
+ * 🔴 EVERY CARD IT EXPIRES IS ONE A CLICK WOULD REFUSE, and the set is a strict SUBSET: an unreadable routine or an unparseable args blob is left alone, because expiring a live card because one read blinked is the failure the fail-closed posture exists to prevent.
+ */
+export declare function reapSupersededRoutineCards(org: string, now?: Date, deps?: SweepFeedbackDeps): Promise<number>;
+export interface DecisionWakeDeps {
+    /** The dispatch seam — defaults to the live cross-process window dispatch. Injected in tests to
+     *  capture the payload without a live eve receive. */
+    readonly dispatch?: typeof dispatchApprovalDecisionWake;
+    readonly now?: () => string;
+    readonly mintWakeId?: () => string;
+}
+/**
+ * Push a DECIDED/EXPIRED outcome into the PROPOSING window session. No-op unless the proposing surface windows AND a live window session exists — a classic per-thread session backscrolls the in-thread notice on its next human wake, so it needs no push. Best-effort and NEVER throws.
+ * The token is read LIVE off the window's own registry row, so the wake targets the live seat even across a rotation, and the origin is the card's anchor thread.
+ */
+export declare function wakeWindowOnDecision(input: {
+    readonly row: PendingActionRow;
+    readonly outcome: ApprovalOutcome;
+    readonly summaryLine: string;
+    /** The admin who decided — absent for a system (TTL) expiry. */
+    readonly clickerId?: string;
+    /** What the kind's `execute` did, for an APPROVED outcome (OPE-1097) — see
+     *  {@link ApprovalDecisionWakeInput.execution}. */
+    readonly execution?: {
+        readonly ran: "ok" | "failed";
+        readonly line: string;
+    };
+    /** The PROPOSING channel's fully-qualified surfaceKey (`platform/workspace/surface`). */
+    readonly surfaceKey: string;
+    readonly origin: UnifiedWakeOrigin;
+}, deps?: DecisionWakeDeps): Promise<boolean>;
+/**
+ * The Discord analogue: surfaceKey and wake origin from the frozen row plus a guild id, taken from the click's signed interaction or from the mint-frozen `postedTo`, never from the frozen scopeKey.
+ * 🔴 GUILD-ONLY because a decision wake is dispatched into a WINDOW and needs a surfaceKey naming a window-enabled surface. A DM belongs to no domain and no shared window, so there is nothing to name — hence null, not a DM-shaped origin.
+ */
+export declare function discordDecisionWakeTarget(row: PendingActionRow, guildId: string | undefined): {
+    surfaceKey: string;
+    origin: UnifiedWakeOrigin;
+} | null;
+/** A FRESH message into the card's own channel, anchored to the card — fresh because the click path's card edit is invisible to backscroll, exactly like Slack's chat.update. Throws on failure; callers reach it only through {@link deliverDecisionFeedback}, which swallows notice failures. */
+export declare function postDiscordDecisionNotice(row: PendingActionRow, text: string): Promise<unknown>;
+export interface DecisionFeedbackInput {
+    /** The DECIDED row (status already flipped — the CAS won before any feedback fires). */
+    readonly row: PendingActionRow;
+    readonly summaryLines: string[];
+    readonly outcome: ApprovalOutcome;
+    /** The executor's outcome line. "expired" for a sweep, and "rejected" for a reject — unless the
+     *  kind implements `declined()` (approvals/types.ts), whose line replaces it and IS rendered:
+     *  {@link decisionNoticeText} reads it on a rejection too, and drops its "propose again" tail. */
+    readonly outcomeLine: string;
+    /** Whether the kind's `execute` ran (OPE-1097). "none" on every non-approval path — a reject and
+     *  an expiry run nothing. Required so a new feedback call site states it rather than inherits a
+     *  default: this is what tells the resumed seat the approved act is already done. */
+    readonly executed: "ok" | "failed" | "none";
+    /** The deciding admin — absent for a system (TTL) expiry. */
+    readonly clickerId?: string;
+    /** The wake target, or null to skip the wake (no authoritative workspace id — fail-soft). */
+    readonly target: {
+        surfaceKey: string;
+        origin: UnifiedWakeOrigin;
+    } | null;
+    readonly postNotice: (text: string) => Promise<unknown>;
+}
+/**
+ * The ONE decision-feedback sequence, shared by both click paths and the TTL sweep: post the human-facing notice into the pending's anchor conversation, then push the outcome into the owning window session. BOTH legs are independently best-effort, and no transport failure throws.
+ * 🔴 The NOTICE leg takes the shared egress exit; the WAKE leg deliberately does not, because it puts nothing in a room. The one thing that CAN throw is the spoof's Vercel refusal — a deploy misconfiguration, loud by design, impossible on a deploy that has not set the flag.
+ */
+export declare function deliverDecisionFeedback(input: DecisionFeedbackInput, decisionWake?: DecisionWakeDeps): Promise<void>;
+/**
+ * Handle one parsed Slack `block_actions` payload. Returns false for anything that is not an `oe_approval:` action (the caller forwards those to eve); otherwise it owns the click end to end and NEVER throws — Slack's interactivity endpoint must always get its 200.
+ * 🔴 That includes the egress spoof's Vercel refusal, deliberately: Slack retries a POST that does not answer, so letting it escape would turn one misconfigured deploy into a retry storm. It stays loud at `requestApproval`, which mints no card on such a deploy.
+ */
+export declare function handleApprovalPayload(payload: unknown, deps?: HandleApprovalDeps): Promise<boolean>;
+export {};
+//# sourceMappingURL=flow.d.ts.map

package/dist/agent/approvals/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../../agent/approvals/flow.ts"],"names":[],"mappings":"AAaA,OAAO,EAAc,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAEtE,OAAO,EAAiC,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkBzF,OAAO,EAAkE,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlH,OAAO,EAAkE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9H,OAAO,EAAkD,KAAK,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAW5H,OAAO,KAAK,EAAc,gBAAgB,EAAiB,MAAM,YAAY,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,mBAAmB,CAAC;AAC3B,OAAO,qBAAqB,CAAC;AAE7B,OAAO,mBAAmB,CAAC;AAC3B,OAAO,qBAAqB,CAAC;AAC7B,OAAO,cAAc,CAAC;AACtB,OAAO,mBAAmB,CAAC;AAC3B,OAAO,qBAAqB,CAAC;AAC7B,OAAO,wBAAwB,CAAC;AAChC,OAAO,qBAAqB,CAAC;AAE7B,OAAO,cAAc,CAAC;AACtB,OAAO,sBAAsB,CAAC;AAC9B,OAAO,mBAAmB,CAAC;AAC3B,OAAO,qBAAqB,CAAC;AAC7B,OAAO,oBAAoB,CAAC;AAC5B,OAAO,gBAAgB,CAAC;AACxB,OAAO,cAAc,CAAC;AACtB,OAAO,yBAAyB,CAAC;AA0BjC;;;+EAG+E;AAC/E,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD;;0BAE0B;AAC1B,KAAK,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AAE7F,2PAA2P;AAC3P,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,YAAY,CAAC;AAMvF,wOAAwO;AACxO,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASvG;AA2BD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AA6BD,8OAA8O;AAC9O,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhI;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;oFACgF;IAChF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gNAAgN;IAChN,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;CAC/B;AAED,+QAA+Q;AAC/Q,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAMjH,+FAA+F;AAC/F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAG7E;AAED;iGACiG;AACjG,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAElF;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,gBAAgB,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAInI;;iEAEiE;AACjE,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAGnG;AAED;;mFAEmF;AACnF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,qBAAqB,GAAG,SAAS,CAExG;AAED;;wBAEwB;AACxB,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,qBAAqB,CAK5F;AAED;qDACqD;AACrD,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE;AAsCD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2TAA2T;IAC3T,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAWD;iGACiG;AACjG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,mOAAmO;IACnO,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAqFD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,GAAG,MAAM,CAcxF;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;4FAEwF;IACxF,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAC/B;0EACsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC;CAC7C;AAED,0TAA0T;AAC1T,wBAAsB,eAAe,CACnC,KAAK,EAAE,oBAAoB,EAC3B,IAAI,GAAE,mBAAwB,GAC7B,OAAO,CAAC,qBAAqB,CAAC,CAqdhC;AAwND,uSAAuS;AACvS,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,eAAe,GAAG,mBAAmB,CAM1G;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAQrE;AAeD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAUT;AAgBD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;iDAE6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;IACzC,kUAAkU;IAClU,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACvG,4QAA4Q;IAC5Q,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACpD;AAgED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAItE;AA8CD,uRAAuR;AACvR,MAAM,MAAM,uBAAuB;AACjC,qFAAqF;AACnF;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE;AACjC;0FAC0F;GACxF;IAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE;AACrC,yFAAyF;GACvF;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE;AAClG,wFAAwF;GACtF;IAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE;AACtC,6FAA6F;GAC3F;IAAE,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE;AAC3C;gEACgE;GAC9D;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE;AAChE;;;iGAGiG;GAC/F;IAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE;AAC9G,2FAA2F;GACzF;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE;AACnC;;;GAGG;GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACzF;;;kFAGkF;GAChF;IACE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;6FAGyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC7C;AACH,+OAA+O;GAC7O;IACE,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,2BAA2B,CAAC;CACrD,CAAC;AAEN,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,kSAAkS;IAClS,QAAQ,CAAC,eAAe,CAAC,EAAE,iBAAiB,CAAC;IAC7C,qSAAqS;IACrS,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,6SAA6S;IAC7S,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oPAAoP;IACpP,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,4MAA4M;IAC5M,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACpD;AAiCD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AA4F7C,+QAA+Q;AAC/Q,eAAO,MAAM,6BAA6B,oCAAoC,CAAC;AAwB/E,sTAAsT;AACtT,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAkK7G;AAED,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC;CAC1C;AAuCD;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB7H;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgCnI;AAKD,MAAM,WAAW,gBAAgB;IAC/B;0DACsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,4BAA4B,CAAC;IACxD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,MAAM,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE;IACL,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;uDACmD;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,GAAG,QAAQ,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC,EACD,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,OAAO,CAAC,CA8DlB;AAWD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAAG,IAAI,CAMtJ;AAED,mSAAmS;AACnS,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAI/F;AAED,MAAM,WAAW,qBAAqB;IACpC,wFAAwF;IACxF,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;;sGAEkG;IAClG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;yFAEqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC5C,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,iBAAiB,CAAA;KAAE,GAAG,IAAI,CAAC;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,qBAAqB,EAAE,YAAY,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB1H;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CA8H7G"}