@open-everywhere/core 0.1.0

package/dist/agent/channels/approval-card.d.ts

@@ -0,0 +1,266 @@
+import type { DirectMessageAction } from "./post-arms.js";
+import { type BridgeableQuestion, type BridgedQuestionStore } from "./question-bridge.js";
+/** The action-id prefix a tappable bridged-approval button carries. One greppable literal, shared by
+ *  the minting side here and by each surface front's classifier, exactly as `oe_approval:` and
+ *  `oe-link:` are for their own planes. */
+export declare const OE_INPUT_CLICK_PREFIX = "oe_input:";
+/**
+ * The HOST-authored label for one eve-minted approval option id. The table is the allowlist: an id
+ * absent from it renders NO button (see the header's frozen-args paragraph), so adding a surface
+ * never widens what may appear on one.
+ *
+ * `intent` is what each surface styles from — `reject` renders Slack's `danger` and Discord's
+ * destructive button — so the deny half reads as the deny half without any surface knowing the
+ * vocabulary.
+ */
+export declare const APPROVAL_BUTTON_LABELS: ReadonlyMap<string, {
+    readonly label: string;
+    readonly intent: "affirm" | "reject";
+}>;
+/** The action id one option's button carries: `oe_input:<ticket>:<optionId>`. Both halves are
+ *  host-minted — the ticket here, the option id by eve — so nothing model-authored reaches it. */
+export declare function approvalClickId(ticket: string, optionId: string): string;
+/**
+ * Read an `oe_input:` action id back, or `undefined` when it is not one of ours or does not parse.
+ * SPLIT ON THE FIRST SEPARATOR ONLY: a ticket is a UUID and never carries a colon, while an option id
+ * is eve's and this host must not assume it carries none.
+ */
+export declare function parseApprovalClickId(raw: unknown): {
+    readonly ticket: string;
+    readonly optionId: string;
+} | undefined;
+/** A fresh ticket. A UUID rather than a counter: it is the only thing standing between a click and a
+ *  parked approval, so it must not be guessable from another one. */
+export declare function mintApprovalCardTicket(): string;
+/**
+ * The buttons for one bridged question, or `[]` when it must be posted as text alone.
+ *
+ * EMPTY FOR EVERY NON-APPROVAL, deliberately: an `ask_question` is answered with free text — eve
+ * consumes the room's next message whatever it says — so a button could only ever put one of the
+ * model's own suggested answers under the person's finger, which is the frozen-args rule's exact
+ * target. Empty too when no offered option has a host label, which is what keeps an unrecognised eve
+ * vocabulary a TEXT post rather than a half-rendered card.
+ */
+export declare function approvalCardActions(question: BridgeableQuestion, ticket: string): readonly DirectMessageAction[];
+/**
+ * What a tap resolves to — the address the answer must be delivered at, plus the room it was asked
+ * in. IDS ONLY, the same redaction rule {@link OutstandingQuestion} holds: the prompt is the room's,
+ * never this row's.
+ */
+export interface ApprovalCardTicket {
+    /**
+     * THE ADDRESS THE ANSWER TAKES: the durable eve session id of the window session the request is
+     * parked on. A SESSION ID AND NOT A TOKEN, and that is the whole of OPE-1863 — see
+     * {@link approvalCardRespondVia}.
+     */
+    readonly sessionId: string;
+    /**
+     * The BARE window token the parked session lives on. It is the KEY OF THE OUTSTANDING-QUESTION
+     * ROW — what {@link ApprovalClickDeps.stillOutstanding} reads and what a settle consumes — and it
+     * is NOT the answer's address: a continuation token is channel-local, and the tap arrives on a
+     * surface channel rather than on the window's own.
+     */
+    readonly bareToken: string;
+    /** The platform-prefixed container the card was posted into. A tap from anywhere else is refused:
+     *  see {@link resolveApprovalCardClick}. Absent ⇒ the poster could not derive one, and then no tap
+     *  can settle this card at all (fail-closed). */
+    readonly containerKey?: string;
+    /** eve's request id, so a settle needs no second read of the question row. */
+    readonly requestId: string;
+    /** Every option id the parked request OFFERED. A tap naming anything else settles nothing. */
+    readonly optionIds: readonly string[];
+    readonly at: string;
+}
+/**
+ * Record the ticket a posted card's buttons carry. NEVER THROWS — it runs beside an already-parked
+ * turn, and a store blip must cost the buttons, not the event dispatch. Returns whether the row
+ * landed, so the caller can say whether the card it posted is tappable.
+ */
+export declare function rememberApprovalCardTicket(store: BridgedQuestionStore, org: string, ticket: string, input: {
+    readonly sessionId: string;
+    readonly bareToken: string;
+    readonly containerKey?: string;
+    readonly requestId: string;
+    readonly optionIds: readonly string[];
+    readonly at?: string;
+}): Promise<boolean>;
+/** Read one ticket back, or `undefined` for an absent, expired, malformed or unreadable row.
+ *  FAIL-SOFT TO "NO TICKET", which refuses the tap and leaves the question answerable in words. */
+export declare function readApprovalCardTicket(store: BridgedQuestionStore, org: string, ticket: string): Promise<ApprovalCardTicket | undefined>;
+/** Consume a ticket. Called once the answer is delivered, so a second tap on the same card cannot
+ *  answer a request eve has already settled. Never throws. */
+export declare function forgetApprovalCardTicket(store: BridgedQuestionStore, org: string, ticket: string): Promise<boolean>;
+/** Why a tap settled nothing. Each is a DIFFERENT wrong thing and they must stay distinguishable in
+ *  the log: `no-ticket` is an expired or already-consumed card, `foreign-room` a tap from a room the
+ *  card was never posted in, `unoffered-option` an action id naming an option the request never
+ *  offered, `already-answered` a card whose request was settled through the TEXT leg, and `refused`
+ *  the admission floor's own verdict. */
+export type ApprovalClickRefusal = "no-ticket" | "foreign-room" | "unoffered-option" | "already-answered" | "refused";
+/** What the caller does with one verified tap. */
+export type ApprovalClickRouting = {
+    readonly kind: "settle";
+    /** WHERE THE ANSWER GOES — the parked window session's durable id (OPE-1863). */
+    readonly sessionId: string;
+    /** The key of the outstanding-question row this settle consumes. Never the answer's address. */
+    readonly bareToken: string;
+    readonly requestId: string;
+    readonly optionId: string;
+    /** The admission floor that let this tap through — for the audit row, as on the text leg. */
+    readonly floor: string;
+} | {
+    readonly kind: "refuse";
+    readonly reason: ApprovalClickRefusal;
+    readonly notice?: string;
+};
+/** The injected edges of {@link resolveApprovalCardClick} — the ticket read and the admission floor.
+ *  Both are functions so the decision is unit-testable with no store and no config. */
+export interface ApprovalClickDeps {
+    read(ticket: string): Promise<ApprovalCardTicket | undefined>;
+    /**
+     * Is the request this card was raised for STILL PARKED — that is, does the window's
+     * outstanding-question row still name it? Live callers answer it with `readBridgedQuestion`.
+     *
+     * 🔴 IT IS THE JOIN BETWEEN THE TWO ANSWER PATHS, and without it the card outlives its own request.
+     * A bridged approval can be answered in WORDS as well as tapped; the text leg consumes the
+     * outstanding-question row and knows nothing about this card's ticket, so the buttons stay live on
+     * a message the room can still see. A later tap would then pass every other check and deliver a
+     * SECOND `respond` for a request eve has already settled — refused by eve, but it would spend an
+     * admission and write a settled audit row that says an approval was decided by a tap when it was
+     * not. This reads the row the text leg consumes, so whichever path answers first closes both.
+     */
+    stillOutstanding(bareToken: string, requestId: string): Promise<boolean>;
+    admit(): Promise<{
+        readonly ok: boolean;
+        readonly floor: string;
+        readonly notice: string;
+    }>;
+}
+/**
+ * Decide what one verified tap on a bridged approval card does.
+ *
+ * 🔴 THE ROOM IS PART OF THE DECISION, and the comparison runs BEFORE the admission for the same
+ * reason the text leg's does: a tap from a room the card was never posted in is not this question's
+ * business at all, so it must not spend an admission call or write a refusal row against somebody who
+ * was not answering. An ABSENT container on either side refuses — a card whose room could not be
+ * derived is not tappable, which is the fail-closed direction.
+ *
+ * 🔴 THE OPTION MUST HAVE BEEN OFFERED. The action id is signed by the platform on its way back, so a
+ * room member cannot mint one; this check is what makes that irrelevant. eve settles an approval on
+ * `optionId` alone, and an id the request never offered resolves `invalid` — which DENIES the tool
+ * call and consumes the request. So an unoffered id refuses HERE and leaves the approval parked,
+ * rather than being handed to eve as a deny nobody chose.
+ *
+ * A refusal never consumes the ticket: the card stays live for somebody who may answer it, and the
+ * question stays answerable in words.
+ */
+export declare function resolveApprovalCardClick(input: {
+    readonly ticket: string;
+    readonly optionId: string;
+    readonly containerKey?: string;
+}, deps: ApprovalClickDeps): Promise<ApprovalClickRouting>;
+/** The one answer a tap delivers: eve's `{requestId, optionId, text}` input response, and nothing
+ *  else. `optionId` is what settles the approval; `text` is transcript only. */
+export interface ApprovalCardInputResponse {
+    readonly requestId: string;
+    readonly optionId: string;
+    readonly text: string;
+}
+/**
+ * eve's I/O-free fixed-session door, narrowed to the one method this road uses. Injected rather than
+ * imported, for the reason `channels/turn-cancel.ts`'s `AttachSessionForCancel` states: the real one
+ * is only reachable as `args.attachSession` inside a channel route handler.
+ */
+export type AttachSessionForRespond = (sessionId: string) => {
+    respond(inputResponses: readonly ApprovalCardInputResponse[], options: {
+        readonly auth: null;
+    }): Promise<{
+        readonly status?: string;
+    } | undefined>;
+};
+/** The delivery a surface's front route binds and hands to its tap handler. */
+export type ApprovalCardRespondFn = (sessionId: string, response: ApprovalCardInputResponse) => Promise<void>;
+/**
+ * Bind the settle delivery for one front route. ONE ROAD, CORE-OWNED, and every surface that renders
+ * a bridged approval card takes it.
+ *
+ * 🔴 WHY A SESSION ID AND NOT THE WINDOW TOKEN (OPE-1863). eve's `from(address)` is CHANNEL-LOCAL:
+ * `createChannelAddress` builds the continuation as `` `${channelName}:${address}` ``. A bridged
+ * approval parks on the UNIFIED window session, whose continuation is `unified:<bare>`, while the
+ * tap arrives on the SURFACE channel's own front route — so `args.from(bareToken)` there names
+ * `slack:<bare>` or `discord:<bare>`, an address no session has ever owned. eve's dispatch then
+ * returns `session_not_active` and `deliver` throws "Cannot deliver inputResponses — the target
+ * session was not found via continuation token." The handler's outer catch swallowed that — a log
+ * line alone on ship #212, and one audited `error` row once OPE-1856 landed — the route still
+ * answered 200, and the approval stayed parked forever: the measured S-EVE-CARD failure on ships
+ * #212, #213 and #214.
+ *
+ * `attachSession(id)` is channel-agnostic — it dispatches by durable session id — so the same
+ * delivery reaches the parked window session from any surface's route. The id is the one the ticket
+ * recorded when the card was posted, which is the session the `input.requested` event fired on.
+ *
+ * A ticket with no session id NEVER delivers: the throw leaves both rows in place, so the card stays
+ * tappable and the question stays answerable in words.
+ *
+ * 🔴 AND IT READS eve's ANSWER, because this road does NOT throw on a dead target the way the one it
+ * replaced did. `createChannelAddress.deliver` checked `status === "accepted"` itself and threw;
+ * `Session.respond` hands the status back instead — `dispatchWorkflowCommand` catches
+ * `HookNotFoundError`, `RunExpiredError`, `WorkflowRunNotFoundError` and `EntityConflictError` and
+ * returns `{status:"session_not_active"}` (`execution/workflow-runtime.js`). A caller that ignored
+ * that would treat an undelivered answer as a settle: the tap handler would consume the ticket AND
+ * the outstanding-question row, and write an `input_response.card_settled` row for a tool call that
+ * never ran. The card would be gone, the question would no longer be answerable in words, and the
+ * audit would assert a decision nobody's tap actually took. So anything but `accepted` throws, which
+ * is the one direction that leaves both rows in place.
+ */
+export declare function approvalCardRespondVia(attach: AttachSessionForRespond): ApprovalCardRespondFn;
+/** The `input_response.routed` sibling for a tap: an approval settled through a BUTTON rather than a
+ *  typed reply. Ids, enums and counts only — the same redaction rule the text leg holds.
+ *  🔴 CORE OWNS BOTH NAMES. Each surface used to spell them itself, which is two places one action
+ *  name can drift from the other; a scorer that joins on the row would then under-count one surface
+ *  and nothing would say so. */
+export declare const APPROVAL_CARD_SETTLED_AUDIT_ACTION = "input_response.card_settled";
+/** A verified tap that settled nothing, carrying WHICH refusal it was. */
+export declare const APPROVAL_CARD_REFUSED_AUDIT_ACTION = "input_response.card_refused";
+/**
+ * Every reason a verified tap left the approval parked — {@link ApprovalClickRefusal} plus the two
+ * outcomes that never reach a routing decision at all.
+ *
+ * 🔴 THOSE TWO ARE WHY THIS TYPE EXISTS (OPE-1856). `spend-declined` and `error` used to be LOGGED
+ * and never audited, so a tap that settled nothing left the same trace as a tap that never arrived:
+ * no row anywhere. Ship #212's S-EVE-CARD leg is exactly that — the card rendered, the click was
+ * accepted 200, and the audit trail holds no row of any kind for it, so the run could not say which
+ * of the two it was. A decision this deployment took must be countable whichever way it went.
+ */
+export type ApprovalClickAuditReason = ApprovalClickRefusal | "spend-declined" | "error";
+/** What one verified tap did, in the vocabulary the audit row records. */
+export type ApprovalCardTapOutcome = {
+    readonly kind: "settled";
+    readonly requestId: string;
+    readonly optionId: string;
+    readonly floor: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: ApprovalClickAuditReason;
+};
+/**
+ * Write the ONE row a verified tap leaves, for every surface that carries a bridged approval card.
+ *
+ * 🔴 IT NEVER THROWS, and that is load-bearing rather than tidy: its callers include the outer
+ * `catch` of a handler that has already answered the person waiting on the other end, so a throw
+ * here would replace one lost row with a lost row and a broken response.
+ *
+ * The partition is OPTIONAL for the same reason: the `error` arm can be reached by a throw from the
+ * partition resolve itself, and a row stamped `unknown` is a better outcome than no row — the whole
+ * defect this closes is an absent row. `platform` is the surface's own id and is always known.
+ */
+export declare function auditApprovalCardTap(input: {
+    readonly platform: string;
+    readonly principalId: string;
+    readonly partition?: {
+        readonly workspace: string;
+        readonly surface?: string;
+        readonly surfaceKey?: string;
+    };
+    readonly outcome: ApprovalCardTapOutcome;
+}): Promise<void>;
+//# sourceMappingURL=approval-card.d.ts.map

package/dist/agent/channels/approval-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-card.d.ts","sourceRoot":"","sources":["../../../agent/channels/approval-card.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAyB,KAAK,kBAAkB,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAGjH;;2CAE2C;AAC3C,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAMvH,CAAC;AAEH;kGACkG;AAClG,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMrH;AAED;qEACqE;AACrE,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,mBAAmB,EAAE,CAShH;AASD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;qDAEiD;IACjD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,oBAAoB,EAC3B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IACL,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB,GACA,OAAO,CAAC,OAAO,CAAC,CAuBlB;AAED;mGACmG;AACnG,wBAAsB,sBAAsB,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CA2B9I;AAED;8DAC8D;AAC9D,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMzH;AAED;;;;yCAIyC;AACzC,MAAM,MAAM,oBAAoB,GAAG,WAAW,GAAG,cAAc,GAAG,kBAAkB,GAAG,kBAAkB,GAAG,SAAS,CAAC;AAEtH,kDAAkD;AAClD,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iFAAiF;IACjF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG;uFACuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAC;IAC9D;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,KAAK,IAAI,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7F,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAe/B;AAED;gFACgF;AAChF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK;IAC3D,OAAO,CAAC,cAAc,EAAE,SAAS,yBAAyB,EAAE,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;CACpJ,CAAC;AAwBF,+EAA+E;AAC/E,MAAM,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,yBAAyB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,uBAAuB,GAAG,qBAAqB,CAQ7F;AAED;;;;gCAIgC;AAChC,eAAO,MAAM,kCAAkC,gCAAgC,CAAC;AAChF,0EAA0E;AAC1E,eAAO,MAAM,kCAAkC,gCAAgC,CAAC;AAEhF;;;;;;;;;GASG;AACH,MAAM,MAAM,wBAAwB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAEzF,0EAA0E;AAC1E,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3G;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7G,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBhB"}

package/dist/agent/channels/approval-card.js

@@ -0,0 +1,328 @@
+// approval-card — the TAPPABLE half of the question bridge (OPE-1720). channels/question-bridge.ts
+// renders a bridged eve `tool-approval` as TEXT and answers it from the room's next message. That is
+// the whole affordance on a unified-window seat, because `PostArm` used to carry no component plane
+// for a unified origin: `dispatchUnified` took one string, so no interactive card could reach any
+// unified origin on any surface. This module adds the other half — the buttons, and the route a tap
+// takes back to eve.
+//
+// 🔴 THE CARD AND THE TAP ARE ONE SEAM, AND THIS MODULE OWNS BOTH ENDS. A button that settles nothing
+// is worse than no button at all on a governed connector write: the person taps Approve, the turn
+// stays parked, and the room has no way to tell. So an arm renders these actions only where the tap
+// route exists, and the two halves are minted and read by the same file.
+//
+// 🔴 INCLUDING THE DELIVERY (OPE-1863). The module owns the address the answer is delivered AT, not
+// only the decision to deliver it: {@link approvalCardRespondVia} is the one settle road, and its
+// own note records why a channel-local continuation token could never be that address.
+//
+// ── WHAT THE BUTTON CARRIES, AND WHY IT IS A TICKET AND NOT THE ADDRESS ──────────────────────────
+// 🔴 The action id carries an OPAQUE TICKET, never the window token. A unified window token is the
+// address of a live context window across every room on its domain; an action id round-trips through
+// the platform and is readable by anyone who can read the message (`conversations.history` on Slack),
+// so putting the address on a button would publish it to the room. The ticket is a freshly minted
+// UUID whose only meaning is a row in this deployment's own store, it expires with the question, and
+// it is consumed on the tap.
+//
+// ── THE LABELS ARE HOST COPY, ALWAYS ────────────────────────────────────────────────────────────
+// 🔴 NEVER MODEL TEXT ON A BUTTON — the frozen-args rule. eve mints an approval's own options as
+// framework constants (`harness/input-extraction.js` mints `approve`/`Approve` and `cancel`/`Cancel`),
+// but {@link BridgeOption}'s labels are model-authored on an `ask_question`, and one kind check is a
+// thin thing to hang a governed write on. So the button label is looked up in {@link
+// APPROVAL_BUTTON_LABELS} from the eve-minted option ID, and an option this host has no label for
+// gets NO BUTTON. It is still printed in the message's own option list, which is where a reader
+// answers it in words — the text stands on its own, exactly as `DirectMessageAction` requires.
+import { randomUUID } from "node:crypto";
+import { appendAudit } from "../audit/audit.js";
+import { deploymentOrg } from "../identity/deployment-identity.js";
+import { APPROVAL_REQUEST_KIND } from "./question-bridge.js";
+import { WAKE_TARGET_TTL_MS } from "./unified-window.js";
+/** The action-id prefix a tappable bridged-approval button carries. One greppable literal, shared by
+ *  the minting side here and by each surface front's classifier, exactly as `oe_approval:` and
+ *  `oe-link:` are for their own planes. */
+export const OE_INPUT_CLICK_PREFIX = "oe_input:";
+/**
+ * The HOST-authored label for one eve-minted approval option id. The table is the allowlist: an id
+ * absent from it renders NO button (see the header's frozen-args paragraph), so adding a surface
+ * never widens what may appear on one.
+ *
+ * `intent` is what each surface styles from — `reject` renders Slack's `danger` and Discord's
+ * destructive button — so the deny half reads as the deny half without any surface knowing the
+ * vocabulary.
+ */
+export const APPROVAL_BUTTON_LABELS = new Map([
+    ["approve", { label: "Approve", intent: "affirm" }],
+    ["allow", { label: "Allow", intent: "affirm" }],
+    ["cancel", { label: "Cancel", intent: "reject" }],
+    ["deny", { label: "Deny", intent: "reject" }],
+    ["reject", { label: "Reject", intent: "reject" }],
+]);
+/** The action id one option's button carries: `oe_input:<ticket>:<optionId>`. Both halves are
+ *  host-minted — the ticket here, the option id by eve — so nothing model-authored reaches it. */
+export function approvalClickId(ticket, optionId) {
+    return `${OE_INPUT_CLICK_PREFIX}${ticket}:${optionId}`;
+}
+/**
+ * Read an `oe_input:` action id back, or `undefined` when it is not one of ours or does not parse.
+ * SPLIT ON THE FIRST SEPARATOR ONLY: a ticket is a UUID and never carries a colon, while an option id
+ * is eve's and this host must not assume it carries none.
+ */
+export function parseApprovalClickId(raw) {
+    if (typeof raw !== "string" || !raw.startsWith(OE_INPUT_CLICK_PREFIX))
+        return undefined;
+    const body = raw.slice(OE_INPUT_CLICK_PREFIX.length);
+    const cut = body.indexOf(":");
+    if (cut <= 0 || cut === body.length - 1)
+        return undefined;
+    return { ticket: body.slice(0, cut), optionId: body.slice(cut + 1) };
+}
+/** A fresh ticket. A UUID rather than a counter: it is the only thing standing between a click and a
+ *  parked approval, so it must not be guessable from another one. */
+export function mintApprovalCardTicket() {
+    return randomUUID();
+}
+/**
+ * The buttons for one bridged question, or `[]` when it must be posted as text alone.
+ *
+ * EMPTY FOR EVERY NON-APPROVAL, deliberately: an `ask_question` is answered with free text — eve
+ * consumes the room's next message whatever it says — so a button could only ever put one of the
+ * model's own suggested answers under the person's finger, which is the frozen-args rule's exact
+ * target. Empty too when no offered option has a host label, which is what keeps an unrecognised eve
+ * vocabulary a TEXT post rather than a half-rendered card.
+ */
+export function approvalCardActions(question, ticket) {
+    if (question.kind !== APPROVAL_REQUEST_KIND || ticket.length === 0)
+        return [];
+    const actions = [];
+    for (const option of question.options) {
+        const known = APPROVAL_BUTTON_LABELS.get(option.id.toLowerCase());
+        if (option.id.length === 0 || known === undefined)
+            continue;
+        actions.push({ id: approvalClickId(ticket, option.id), label: known.label, intent: known.intent });
+    }
+    return actions;
+}
+/** The store key for one card ticket. LOCAL, and it stays local: the three row functions below are
+ *  the only callers, and a second file that spelled this key would be a second place the key's shape
+ *  can drift from this one. A caller outside gets a row function, never the key. */
+function approvalCardTicketKey(ticket) {
+    return `oe-approval-card:${ticket}`;
+}
+/**
+ * Record the ticket a posted card's buttons carry. NEVER THROWS — it runs beside an already-parked
+ * turn, and a store blip must cost the buttons, not the event dispatch. Returns whether the row
+ * landed, so the caller can say whether the card it posted is tappable.
+ */
+export async function rememberApprovalCardTicket(store, org, ticket, input) {
+    try {
+        // NO SESSION ID ⇒ NO ROW, and therefore no card: the tap would have nowhere to deliver, and a
+        // button that settles nothing is worse than no button at all (the header's first rule).
+        if (ticket.length === 0 || input.sessionId.length === 0 || input.bareToken.length === 0 || input.requestId.length === 0)
+            return false;
+        const optionIds = input.optionIds.filter((id) => id.length > 0);
+        if (optionIds.length === 0)
+            return false;
+        const at = input.at ?? new Date().toISOString();
+        const row = {
+            sessionId: input.sessionId,
+            bareToken: input.bareToken,
+            ...(input.containerKey !== undefined && input.containerKey.length > 0 ? { containerKey: input.containerKey } : {}),
+            requestId: input.requestId,
+            optionIds,
+            at,
+        };
+        // The SAME lifetime the outstanding-question row takes: the ticket must not outlive the question
+        // it answers, and it must not expire while the question is still answerable in words.
+        await store.putTaskResult(org, approvalCardTicketKey(ticket), JSON.stringify(row), at, WAKE_TARGET_TTL_MS);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Read one ticket back, or `undefined` for an absent, expired, malformed or unreadable row.
+ *  FAIL-SOFT TO "NO TICKET", which refuses the tap and leaves the question answerable in words. */
+export async function readApprovalCardTicket(store, org, ticket) {
+    try {
+        if (ticket.length === 0)
+            return undefined;
+        const raw = await store.getTaskResult(org, approvalCardTicketKey(ticket));
+        if (raw === null)
+            return undefined;
+        const parsed = JSON.parse(raw);
+        const sessionId = parsed?.sessionId;
+        const bareToken = parsed?.bareToken;
+        const requestId = parsed?.requestId;
+        // A row written before the session id joined the shape reads as NO TICKET, which refuses the tap
+        // and leaves the question answerable in words — the same fail-soft every other arm takes.
+        if (typeof sessionId !== "string" || sessionId.length === 0)
+            return undefined;
+        if (typeof bareToken !== "string" || bareToken.length === 0)
+            return undefined;
+        if (typeof requestId !== "string" || requestId.length === 0)
+            return undefined;
+        const optionIds = Array.isArray(parsed?.optionIds) ? parsed.optionIds.filter((id) => typeof id === "string" && id.length > 0) : [];
+        if (optionIds.length === 0)
+            return undefined;
+        return {
+            sessionId,
+            bareToken,
+            ...(typeof parsed?.containerKey === "string" && parsed.containerKey.length > 0 ? { containerKey: parsed.containerKey } : {}),
+            requestId,
+            optionIds,
+            at: typeof parsed?.at === "string" ? parsed.at : "",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Consume a ticket. Called once the answer is delivered, so a second tap on the same card cannot
+ *  answer a request eve has already settled. Never throws. */
+export async function forgetApprovalCardTicket(store, org, ticket) {
+    try {
+        return await store.deleteTaskResult(org, approvalCardTicketKey(ticket));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Decide what one verified tap on a bridged approval card does.
+ *
+ * 🔴 THE ROOM IS PART OF THE DECISION, and the comparison runs BEFORE the admission for the same
+ * reason the text leg's does: a tap from a room the card was never posted in is not this question's
+ * business at all, so it must not spend an admission call or write a refusal row against somebody who
+ * was not answering. An ABSENT container on either side refuses — a card whose room could not be
+ * derived is not tappable, which is the fail-closed direction.
+ *
+ * 🔴 THE OPTION MUST HAVE BEEN OFFERED. The action id is signed by the platform on its way back, so a
+ * room member cannot mint one; this check is what makes that irrelevant. eve settles an approval on
+ * `optionId` alone, and an id the request never offered resolves `invalid` — which DENIES the tool
+ * call and consumes the request. So an unoffered id refuses HERE and leaves the approval parked,
+ * rather than being handed to eve as a deny nobody chose.
+ *
+ * A refusal never consumes the ticket: the card stays live for somebody who may answer it, and the
+ * question stays answerable in words.
+ */
+export async function resolveApprovalCardClick(input, deps) {
+    const row = await deps.read(input.ticket);
+    if (row === undefined)
+        return { kind: "refuse", reason: "no-ticket" };
+    const asked = row.containerKey;
+    const here = input.containerKey;
+    if (asked === undefined || asked.length === 0 || here === undefined || here.length === 0 || asked !== here) {
+        return { kind: "refuse", reason: "foreign-room" };
+    }
+    if (!row.optionIds.includes(input.optionId))
+        return { kind: "refuse", reason: "unoffered-option" };
+    // STILL PARKED? Also before the admission, and for the third time for the same reason: a tap on a
+    // request somebody already answered in words is not this question's business either.
+    if (!(await deps.stillOutstanding(row.bareToken, row.requestId)))
+        return { kind: "refuse", reason: "already-answered" };
+    const verdict = await deps.admit();
+    if (!verdict.ok)
+        return { kind: "refuse", reason: "refused", notice: verdict.notice };
+    return { kind: "settle", sessionId: row.sessionId, bareToken: row.bareToken, requestId: row.requestId, optionId: input.optionId, floor: verdict.floor };
+}
+/** eve's own word for a delivery it accepted. Anything else is a delivery that did not land — see
+ *  {@link approvalCardRespondVia}, which refuses to call it a settle. */
+const EVE_DELIVERY_ACCEPTED = "accepted";
+/**
+ * The options one settle delivery carries, and the whole point is the key that is ABSENT.
+ *
+ * 🔴 NO `auth` KEY, EVER. eve's turn step writes the session's auth slot only when the delivery
+ * positively supplies one — `n.input?.kind==="deliver" && n.input.auth !== void 0 && i.set(AuthKey,
+ * n.input.auth ?? null)` (`execution/workflow-steps.js`, pinned by
+ * `scripts/auth-attribute-provenance-test.ts`). An approval resume delivers with no auth field, so
+ * the parked turn keeps the stamps it parked with — the spawn taint seed, the job-wake withholding
+ * and the principal binding all read that bag. Sending `auth: null` is not a drop; it is an explicit
+ * WRITE of null, and it would clear every one of those stamps on the resumed turn.
+ *
+ * 🔴 THE CAST IS THE POINT, not a convenience. eve types the option as `auth: SessionAuthContext |
+ * null` and REQUIRES the property, so the value must claim that shape to stay assignable while the
+ * object itself carries no key. Writing `{ auth: null }` would satisfy the type and break the
+ * invariant above, which is the direction this cast exists to refuse.
+ */
+const NO_AUTH_REWRITE = {};
+/**
+ * Bind the settle delivery for one front route. ONE ROAD, CORE-OWNED, and every surface that renders
+ * a bridged approval card takes it.
+ *
+ * 🔴 WHY A SESSION ID AND NOT THE WINDOW TOKEN (OPE-1863). eve's `from(address)` is CHANNEL-LOCAL:
+ * `createChannelAddress` builds the continuation as `` `${channelName}:${address}` ``. A bridged
+ * approval parks on the UNIFIED window session, whose continuation is `unified:<bare>`, while the
+ * tap arrives on the SURFACE channel's own front route — so `args.from(bareToken)` there names
+ * `slack:<bare>` or `discord:<bare>`, an address no session has ever owned. eve's dispatch then
+ * returns `session_not_active` and `deliver` throws "Cannot deliver inputResponses — the target
+ * session was not found via continuation token." The handler's outer catch swallowed that — a log
+ * line alone on ship #212, and one audited `error` row once OPE-1856 landed — the route still
+ * answered 200, and the approval stayed parked forever: the measured S-EVE-CARD failure on ships
+ * #212, #213 and #214.
+ *
+ * `attachSession(id)` is channel-agnostic — it dispatches by durable session id — so the same
+ * delivery reaches the parked window session from any surface's route. The id is the one the ticket
+ * recorded when the card was posted, which is the session the `input.requested` event fired on.
+ *
+ * A ticket with no session id NEVER delivers: the throw leaves both rows in place, so the card stays
+ * tappable and the question stays answerable in words.
+ *
+ * 🔴 AND IT READS eve's ANSWER, because this road does NOT throw on a dead target the way the one it
+ * replaced did. `createChannelAddress.deliver` checked `status === "accepted"` itself and threw;
+ * `Session.respond` hands the status back instead — `dispatchWorkflowCommand` catches
+ * `HookNotFoundError`, `RunExpiredError`, `WorkflowRunNotFoundError` and `EntityConflictError` and
+ * returns `{status:"session_not_active"}` (`execution/workflow-runtime.js`). A caller that ignored
+ * that would treat an undelivered answer as a settle: the tap handler would consume the ticket AND
+ * the outstanding-question row, and write an `input_response.card_settled` row for a tool call that
+ * never ran. The card would be gone, the question would no longer be answerable in words, and the
+ * audit would assert a decision nobody's tap actually took. So anything but `accepted` throws, which
+ * is the one direction that leaves both rows in place.
+ */
+export function approvalCardRespondVia(attach) {
+    return async (sessionId, response) => {
+        if (sessionId.length === 0)
+            throw new Error("approval card settle: the ticket names no session — refusing to deliver the answer");
+        const result = await attach(sessionId).respond([response], NO_AUTH_REWRITE);
+        if (result?.status !== EVE_DELIVERY_ACCEPTED) {
+            throw new Error(`approval card settle: eve did not accept the answer (${result?.status ?? "no status"}) — the approval stays parked`);
+        }
+    };
+}
+/** The `input_response.routed` sibling for a tap: an approval settled through a BUTTON rather than a
+ *  typed reply. Ids, enums and counts only — the same redaction rule the text leg holds.
+ *  🔴 CORE OWNS BOTH NAMES. Each surface used to spell them itself, which is two places one action
+ *  name can drift from the other; a scorer that joins on the row would then under-count one surface
+ *  and nothing would say so. */
+export const APPROVAL_CARD_SETTLED_AUDIT_ACTION = "input_response.card_settled";
+/** A verified tap that settled nothing, carrying WHICH refusal it was. */
+export const APPROVAL_CARD_REFUSED_AUDIT_ACTION = "input_response.card_refused";
+/**
+ * Write the ONE row a verified tap leaves, for every surface that carries a bridged approval card.
+ *
+ * 🔴 IT NEVER THROWS, and that is load-bearing rather than tidy: its callers include the outer
+ * `catch` of a handler that has already answered the person waiting on the other end, so a throw
+ * here would replace one lost row with a lost row and a broken response.
+ *
+ * The partition is OPTIONAL for the same reason: the `error` arm can be reached by a throw from the
+ * partition resolve itself, and a row stamped `unknown` is a better outcome than no row — the whole
+ * defect this closes is an absent row. `platform` is the surface's own id and is always known.
+ */
+export async function auditApprovalCardTap(input) {
+    try {
+        const { partition, outcome } = input;
+        await appendAudit({
+            org: deploymentOrg(),
+            platform: input.platform,
+            workspace: partition?.workspace ?? "unknown",
+            ...(partition?.surface === undefined ? {} : { surface: partition.surface }),
+            ...(input.principalId.length > 0 ? { principalId: input.principalId } : {}),
+            action: outcome.kind === "settled" ? APPROVAL_CARD_SETTLED_AUDIT_ACTION : APPROVAL_CARD_REFUSED_AUDIT_ACTION,
+            // eve-minted enums and ids only — never the prompt, never the room's prose.
+            detail: outcome.kind === "settled"
+                ? { requestId: outcome.requestId, optionId: outcome.optionId, floor: outcome.floor, ...(partition?.surfaceKey === undefined ? {} : { surfaceKey: partition.surfaceKey }) }
+                : { reason: outcome.reason, ...(partition?.surfaceKey === undefined ? {} : { surfaceKey: partition.surfaceKey }) },
+        });
+    }
+    catch {
+        /* best-effort: auditing a tap must never break the response the tapper is waiting on */
+    }
+}
+//# sourceMappingURL=approval-card.js.map

package/dist/agent/channels/approval-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-card.js","sourceRoot":"","sources":["../../../agent/channels/approval-card.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,kGAAkG;AAClG,oGAAoG;AACpG,qBAAqB;AACrB,EAAE;AACF,sGAAsG;AACtG,kGAAkG;AAClG,oGAAoG;AACpG,yEAAyE;AACzE,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,uFAAuF;AACvF,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,sGAAsG;AACtG,kGAAkG;AAClG,qGAAqG;AACrG,6BAA6B;AAC7B,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,uGAAuG;AACvG,qGAAqG;AACrG,qFAAqF;AACrF,kGAAkG;AAClG,gGAAgG;AAChG,+FAA+F;AAE/F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAsD,MAAM,sBAAsB,CAAC;AACjH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;2CAE2C;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0F,IAAI,GAAG,CAAC;IACnI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;IAC5D,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;IACxD,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;IAC1D,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;IACtD,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC;CAC3D,CAAC,CAAC;AAEH;kGACkG;AAClG,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,QAAgB;IAC9D,OAAO,GAAG,qBAAqB,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;qEACqE;AACrE,MAAM,UAAU,sBAAsB;IACpC,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA4B,EAAE,MAAc;IAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,qBAAqB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9E,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAC5D,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;oFAEoF;AACpF,SAAS,qBAAqB,CAAC,MAAc;IAC3C,OAAO,oBAAoB,MAAM,EAAE,CAAC;AACtC,CAAC;AAgCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAA2B,EAC3B,GAAW,EACX,MAAc,EACd,KAOC;IAED,IAAI,CAAC;QACH,8FAA8F;QAC9F,wFAAwF;QACxF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtI,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,GAAG,GAAuB;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClH,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,EAAE;SACH,CAAC;QACF,iGAAiG;QACjG,sFAAsF;QACtF,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;mGACmG;AACnG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAA2B,EAAE,GAAW,EAAE,MAAc;IACnG,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;QACpC,iGAAiG;QACjG,0FAA0F;QAC1F,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjJ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7C,OAAO;YACL,SAAS;YACT,SAAS;YACT,GAAG,CAAC,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5H,SAAS;YACT,SAAS;YACT,EAAE,EAAE,OAAO,MAAM,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;8DAC8D;AAC9D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAA2B,EAAE,GAAW,EAAE,MAAc;IACrG,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AA4CD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA6F,EAC7F,IAAuB;IAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;IAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnG,kGAAkG;IAClG,qFAAqF;IACrF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACtF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;AAC1J,CAAC;AAmBD;yEACyE;AACzE,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,eAAe,GAAG,EAA6B,CAAC;AAKtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA+B;IACpE,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAClI,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,MAAM,EAAE,MAAM,KAAK,qBAAqB,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,EAAE,MAAM,IAAI,WAAW,+BAA+B,CAAC,CAAC;QACxI,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;gCAIgC;AAChC,MAAM,CAAC,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAChF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAmBhF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAK1C;IACC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACrC,MAAM,WAAW,CAAC;YAChB,GAAG,EAAE,aAAa,EAAE;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS;YAC5C,GAAG,CAAC,SAAS,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,kCAAkC;YAC5G,4EAA4E;YAC5E,MAAM,EACJ,OAAO,CAAC,IAAI,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE;gBAC1K,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE;SACvH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;IAC1F,CAAC;AACH,CAAC"}