@open-everywhere/core 0.1.0

package/dist/agent/commands/rate.js

@@ -0,0 +1,146 @@
+// `/oe rate <1-5>` — THE HUMAN MARK on a model A/B test (OPE-34).
+//
+// The champion/challenger split (model/ab-test.ts) answers "what did each arm cost" from the spend
+// rows on its own. It cannot answer "which arm was BETTER" — nothing in a token count knows whether
+// the reply was any good. This command is that missing half: a person in the room says 1-5, and the
+// mark lands on an audit row carrying the ARM the room's last turn actually ran.
+//
+// 🔴 IT RATES THE ROOM'S LAST ARMED TURN, READ BACK — never a recomputed guess. The command looks up
+// the newest `model.ab_arm` audit row for this surface and copies its `arm`, `bucketKey`,
+// `modelId`, `sessionId` and `turnId` onto the rating. Recomputing the arm from the bucket would be
+// the same function on the same input TODAY and silently wrong the day the declared percentage
+// changes — a rating carrying the wrong arm is worse than no rating, because nothing downstream can
+// detect it. Reading the row means the rating is keyed to a turn that demonstrably happened.
+//
+// NOTHING TO RATE IS A NORMAL ANSWER, not an error. With the experiment unarmed no arm rows exist,
+// so the command says so and writes nothing. That is the whole behaviour on every deployment that
+// has not opted in.
+//
+// A SLASH COMMAND CARRIES NO THREAD on Slack (its payload has a channel id and nothing else that
+// addresses a message), which is exactly why the lookup is by SURFACE and by recency rather than by
+// thread. The consequence is stated plainly in docs/extending/models-and-gateway.md: in a busy
+// channel with several live threads, `/oe rate` marks the most recent armed turn in the channel,
+// whichever thread it was in.
+//
+// MVP SCOPE, DELIBERATELY. There is no `reaction_added` ingest — a 👍 is not a scale, and wiring a
+// second ingestion route to carry one is a bigger change than the eval needs to start producing
+// data. One command, one row, one number.
+//
+// ZERO-INFERENCE like every other `/oe` branch: pure logic plus two store calls, so it answers
+// during a spend-cap decline or a model outage — the states in which a human is most likely to
+// have something to say about the reply they just got.
+import { appendAudit, readAudit } from "../audit/audit.js";
+import { defaultScopeKey } from "../tools/set_spend_limit.js";
+import { MODEL_AB_ARM_ACTION, MODEL_AB_RATING_ACTION, MODEL_AB_RATING_MAX, MODEL_AB_RATING_MIN } from "../model/ab-test.js";
+/** The `/oe help` line for this command — owned here so the command and its help cannot drift. */
+export const RATE_HELP_LINE = `• \`/oe rate <${MODEL_AB_RATING_MIN}-${MODEL_AB_RATING_MAX}>\` — mark the model A/B test: rate the last answer in this channel.`;
+/**
+ * Parse the rest-tokens of `/oe rate`. NEVER throws: garbage resolves to an `"error"` variant whose
+ * message is already user-facing, the same contract every other `/oe` parser keeps.
+ *
+ * The bound check is `Number.isInteger`, not a range clamp: a person who typed `9` meant something,
+ * and silently storing `5` would put a number in the ledger nobody chose.
+ */
+export function parseRateTokens(rest) {
+    const raw = rest[0];
+    const score = Number(raw);
+    if (!raw || !Number.isInteger(score) || score < MODEL_AB_RATING_MIN || score > MODEL_AB_RATING_MAX) {
+        return {
+            kind: "error",
+            message: `"/oe rate" needs a whole number from ${MODEL_AB_RATING_MIN} to ${MODEL_AB_RATING_MAX}, ` +
+                `e.g. "/oe rate 4" (got ${JSON.stringify(raw ?? "")}).`,
+        };
+    }
+    return { kind: "rate", score };
+}
+/**
+ * The newest armed turn on `surfaceKey`, or undefined when the room has none. Fail-soft: an
+ * unreadable audit store answers "nothing to rate" rather than throwing at a person who typed a
+ * slash command.
+ *
+ * Pure over its inputs otherwise — exported so the test can drive every shape of row, including a
+ * malformed detail blob (an old row, a hand-edited store), which must be REJECTED rather than
+ * carried onto a rating as `undefined`.
+ */
+export async function lastArmedTurn(org, surfaceKey, deps = {}) {
+    const read = deps.readAudit ?? readAudit;
+    let rows;
+    try {
+        rows = await read({ org, surface: surfaceKey, action: MODEL_AB_ARM_ACTION, limit: 1 });
+    }
+    catch {
+        return undefined;
+    }
+    const row = rows[0];
+    const d = row?.detail;
+    if (!row || !d)
+        return undefined;
+    const arm = d["arm"];
+    const bucketKey = d["bucketKey"];
+    const modelId = d["modelId"];
+    const turnId = d["turnId"];
+    const sessionId = d["sessionId"];
+    if ((arm !== "champion" && arm !== "challenger") || typeof bucketKey !== "string" || typeof modelId !== "string" || typeof turnId !== "string") {
+        return undefined;
+    }
+    return {
+        arm,
+        bucketKey,
+        modelId,
+        turnId,
+        ...(typeof sessionId === "string" && sessionId.length > 0 ? { sessionId } : {}),
+        ts: row.ts,
+    };
+}
+/**
+ * Record one human mark. Returns the EPHEMERAL reply text (the caller wraps it in its platform's
+ * envelope). Never throws — every failure path is a sentence a person can read.
+ *
+ * The row it writes is the eval's quality half: `arm` joins it to the cost half (the `modelArm`
+ * key on the turn's usage row), and `sessionId`/`turnId` name the exact turn the mark is about.
+ * `ratedAt` is the arm row's own ts, so a report can see how long after the turn the mark arrived.
+ */
+export async function runRate(binding, score, deps = {}) {
+    // The DOMAIN-grain surface key (`domainSurface ?? surface`) — the same key model/ab-test.ts's
+    // `noteModelAbArm` files an arm row under. A thread-grain key would miss every Discord/Teams row.
+    const surfaceKey = defaultScopeKey(binding, "surface");
+    const turn = await lastArmedTurn(binding.org, surfaceKey, deps);
+    if (!turn) {
+        // 🔴 THE REPLY NAMES THE OBSERVATION, NOT A CAUSE. "No arm row here" has several causes — the
+        // test is off, this room's route pins a model or a tier, or the room's last turn ran on an
+        // OE-structured seat (a worker/supervisor session resolves the `supervisor` role, not the
+        // champion, so it is outside the experiment). Asserting "the test is switched off" would be a
+        // claim about state this command never read, and an operator who believed it would go and edit
+        // `percent` again.
+        return ("Nothing to rate here yet — `/oe rate` marks a model A/B test, and this channel has no recorded " +
+            "A/B turn. That is the normal answer when the test is off, when this room's model is pinned, or " +
+            "when the room's last turn ran on a worker or supervisor seat.");
+    }
+    try {
+        await (deps.appendAudit ?? appendAudit)({
+            org: binding.org,
+            platform: binding.platform,
+            workspace: binding.workspace,
+            surface: surfaceKey,
+            ...(binding.principalId ? { principalId: binding.principalId } : {}),
+            action: MODEL_AB_RATING_ACTION,
+            detail: {
+                score,
+                arm: turn.arm,
+                bucketKey: turn.bucketKey,
+                modelId: turn.modelId,
+                turnId: turn.turnId,
+                ...(turn.sessionId !== undefined ? { sessionId: turn.sessionId } : {}),
+                ratedAt: turn.ts,
+            },
+        });
+    }
+    catch (err) {
+        return `Couldn't record that rating: ${String(err)}`;
+    }
+    // The arm is NOT named back to the rater. Telling somebody which model they just marked invites
+    // the next mark to be about the model rather than the answer, and this whole affordance is worth
+    // exactly as much as its blindness.
+    return `Thanks — recorded ${score}/${MODEL_AB_RATING_MAX} for this channel's last answer.`;
+}
+//# sourceMappingURL=rate.js.map

package/dist/agent/commands/rate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate.js","sourceRoot":"","sources":["../../../agent/commands/rate.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,oGAAoG;AACpG,iFAAiF;AACjF,EAAE;AACF,qGAAqG;AACrG,0FAA0F;AAC1F,oGAAoG;AACpG,+FAA+F;AAC/F,oGAAoG;AACpG,6FAA6F;AAC7F,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,oBAAoB;AACpB,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,+FAA+F;AAC/F,iGAAiG;AACjG,8BAA8B;AAC9B,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,0CAA0C;AAC1C,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,uDAAuD;AAEvD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,mBAAmB,EAAiB,MAAM,qBAAqB,CAAC;AAQ3I,kGAAkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,mBAAmB,IAAI,mBAAmB,sEAAsE,CAAC;AAEhK;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,mBAAmB,IAAI,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACnG,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EACL,wCAAwC,mBAAmB,OAAO,mBAAmB,IAAI;gBACzF,0BAA0B,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI;SAC1D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,UAAkB,EAAE,IAAI,GAAa,EAAE;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IACzC,IAAI,IAA2C,CAAC;IAChD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,GAAG,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACrB,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/I,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,GAAG;QACH,SAAS;QACT,OAAO;QACP,MAAM;QACN,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB,EAAE,KAAa,EAAE,IAAI,GAAa,EAAE;IACvF,8FAA8F;IAC9F,kGAAkG;IAClG,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,8FAA8F;QAC9F,2FAA2F;QAC3F,0FAA0F;QAC1F,8FAA8F;QAC9F,+FAA+F;QAC/F,mBAAmB;QACnB,OAAO,CACL,iGAAiG;YACjG,iGAAiG;YACjG,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC;YACtC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU;YACnB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE;gBACN,KAAK;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,OAAO,EAAE,IAAI,CAAC,EAAE;aACjB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,gCAAgC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,gGAAgG;IAChG,iGAAiG;IACjG,oCAAoC;IACpC,OAAO,qBAAqB,KAAK,IAAI,mBAAmB,kCAAkC,CAAC;AAC7F,CAAC"}

package/dist/agent/connections/auth-retry-memo.d.ts

@@ -0,0 +1,28 @@
+export declare function markInSet(set: Set<string>, connector: string): void;
+export declare function hasInSet(set: Set<string>, connector: string): boolean;
+export declare function clearFromSet(set: Set<string>, connector: string): void;
+/**
+ * A missing probe, a `false`, and a throw all report false — fail toward the churn protection.
+ * eve auto-resumes a mid-turn consent, so turn.started never refires — hence this mid-turn self-heal.
+ */
+export declare function freshGrantConfirmed(probe: (() => Promise<boolean>) | undefined): Promise<boolean>;
+/**
+ * The error thrown on a short-circuited retry — the same needsAuthorization meaning as the first refusal.
+ * Never includes a token or secret.
+ */
+export declare function connectorAuthRequiredError(connector: string, url?: string): Error;
+/** Flag a connector as having returned needsAuthorization this turn (optionally caching the personal
+ *  authorization URL minted for it, so a same-turn retry repeats the SAME link). Fail-soft outside a session. */
+export declare function markConnectorAuthRequired(connector: string, url?: string): void;
+/** Has this connector already returned needsAuthorization this turn? Fail-soft ⇒ false. */
+export declare function connectorAuthRequiredThisTurn(connector: string): boolean;
+/** The personal authorization URL cached for this connector THIS turn (if any). Fail-soft ⇒ undefined. */
+export declare function connectorAuthUrlThisTurn(connector: string): string | undefined;
+/** Clear the per-turn memo — called by the turn.started hook so each turn re-attempts for real. */
+export declare function resetConnectorAuthMemo(): void;
+/**
+ * Targeted clear — forgets this connector's flag and cached URL only, never the whole memo.
+ * connector-auth.ts calls it once a fresh grant is confirmed mid-turn. Fail-soft outside a session.
+ */
+export declare function clearConnectorAuthRequired(connector: string): void;
+//# sourceMappingURL=auth-retry-memo.d.ts.map

package/dist/agent/connections/auth-retry-memo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-retry-memo.d.ts","sourceRoot":"","sources":["../../../agent/connections/auth-retry-memo.ts"],"names":[],"mappings":"AAKA,wBAAgB,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEnE;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAErE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEtE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvG;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAQjF;AAOD;iHACiH;AACjH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAa/E;AAED,2FAA2F;AAC3F,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOxE;AAED,0GAA0G;AAC1G,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM9E;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,IAAI,IAAI,CAO7C;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAelE"}

package/dist/agent/connections/auth-retry-memo.js

@@ -0,0 +1,109 @@
+// Per-turn memo: a connector that returned needsAuthorization fails fast for the rest of the turn.
+// The turn.started hook (hooks/loop-breaker.ts) clears it; outside an eve session nothing is flagged.
+import { defineState } from "eve/context";
+export function markInSet(set, connector) {
+    set.add(connector);
+}
+export function hasInSet(set, connector) {
+    return set.has(connector);
+}
+export function clearFromSet(set, connector) {
+    set.delete(connector);
+}
+/**
+ * A missing probe, a `false`, and a throw all report false — fail toward the churn protection.
+ * eve auto-resumes a mid-turn consent, so turn.started never refires — hence this mid-turn self-heal.
+ */
+export async function freshGrantConfirmed(probe) {
+    if (!probe)
+        return false;
+    try {
+        return await probe();
+    }
+    catch {
+        return false; // probe failed — fail toward churn protection (keep short-circuiting)
+    }
+}
+/**
+ * The error thrown on a short-circuited retry — the same needsAuthorization meaning as the first refusal.
+ * Never includes a token or secret.
+ */
+export function connectorAuthRequiredError(connector, url) {
+    return new Error(`connection "${connector}": authorization is required and already failed this turn — not ` +
+        `retrying (deterministic within a turn). ` +
+        (url
+            ? `Open your personal authorization link (expires soon): ${url} — complete it, then ask again on a new turn.`
+            : `Authorize the connector, then ask again on a new turn.`));
+}
+const slot = defineState("open-everywhere.connector-auth-required-turn", () => null);
+// Same turn-scope as `slot`, cleared together in reset. The URL is capability-bearing — only ever
+// thrown, never logged.
+const urlSlot = defineState("open-everywhere.connector-auth-url-turn", () => null);
+/** Flag a connector as having returned needsAuthorization this turn (optionally caching the personal
+ *  authorization URL minted for it, so a same-turn retry repeats the SAME link). Fail-soft outside a session. */
+export function markConnectorAuthRequired(connector, url) {
+    try {
+        const set = slot.get() ?? new Set();
+        markInSet(set, connector);
+        slot.update(() => set);
+        if (url) {
+            const map = urlSlot.get() ?? new Map();
+            map.set(connector, url);
+            urlSlot.update(() => map);
+        }
+    }
+    catch {
+        /* no session context — nothing to memoise */
+    }
+}
+/** Has this connector already returned needsAuthorization this turn? Fail-soft ⇒ false. */
+export function connectorAuthRequiredThisTurn(connector) {
+    try {
+        const set = slot.get();
+        return set ? hasInSet(set, connector) : false;
+    }
+    catch {
+        return false;
+    }
+}
+/** The personal authorization URL cached for this connector THIS turn (if any). Fail-soft ⇒ undefined. */
+export function connectorAuthUrlThisTurn(connector) {
+    try {
+        return urlSlot.get()?.get(connector);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Clear the per-turn memo — called by the turn.started hook so each turn re-attempts for real. */
+export function resetConnectorAuthMemo() {
+    try {
+        slot.update(() => new Set());
+        urlSlot.update(() => new Map());
+    }
+    catch {
+        /* no session context — nothing to reset */
+    }
+}
+/**
+ * Targeted clear — forgets this connector's flag and cached URL only, never the whole memo.
+ * connector-auth.ts calls it once a fresh grant is confirmed mid-turn. Fail-soft outside a session.
+ */
+export function clearConnectorAuthRequired(connector) {
+    try {
+        const set = slot.get();
+        if (set) {
+            clearFromSet(set, connector);
+            slot.update(() => set);
+        }
+        const map = urlSlot.get();
+        if (map) {
+            map.delete(connector);
+            urlSlot.update(() => map);
+        }
+    }
+    catch {
+        /* no session context — nothing to clear */
+    }
+}
+//# sourceMappingURL=auth-retry-memo.js.map

package/dist/agent/connections/auth-retry-memo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-retry-memo.js","sourceRoot":"","sources":["../../../agent/connections/auth-retry-memo.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,sGAAsG;AAEtG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,SAAiB;IAC3D,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAgB,EAAE,SAAiB;IAC1D,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB,EAAE,SAAiB;IAC9D,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA2C;IACnF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,sEAAsE;IACtF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB,EAAE,GAAY;IACxE,OAAO,IAAI,KAAK,CACd,eAAe,SAAS,kEAAkE;QACxF,0CAA0C;QAC1C,CAAC,GAAG;YACF,CAAC,CAAC,yDAAyD,GAAG,+CAA+C;YAC7G,CAAC,CAAC,wDAAwD,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,WAAW,CAAqB,8CAA8C,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACzG,kGAAkG;AAClG,wBAAwB;AACxB,MAAM,OAAO,GAAG,WAAW,CAA6B,yCAAyC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAE/G;iHACiH;AACjH,MAAM,UAAU,yBAAyB,CAAC,SAAiB,EAAE,GAAY;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,EAAU,CAAC;QAC5C,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,EAAkB,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,6BAA6B,CAAC,SAAiB;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAkB,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,EAAE,CAAC;YACR,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC"}

package/dist/agent/connections/aws-exec.d.ts

@@ -0,0 +1,27 @@
+import type { AwsCredentials } from "./aws-identity.js";
+/** One host-side `aws` invocation. `args` are the CLI arguments AFTER `aws` (e.g.
+ *  ["logs", "start-query", "--log-group-name", "…"]); the executor injects `credentials` + `region`
+ *  and NEVER lets either reach the sandbox. */
+export interface AwsExecRequest {
+    readonly credentials: AwsCredentials;
+    readonly region?: string;
+    readonly args: readonly string[];
+}
+/** The captured result of the invocation. A non-zero `exitCode` is returned (not thrown) so the model
+ *  can read the CLI's own error text; the executor throws only on a failure to LAUNCH. */
+export interface AwsExecResult {
+    readonly exitCode: number;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+/** The vendor-neutral executor port — the ONLY place the `aws` binary / a signing SDK is invoked. */
+export interface AwsExecutor {
+    run(req: AwsExecRequest): Promise<AwsExecResult>;
+}
+export declare function registerAwsExecutor(executor: AwsExecutor): void;
+/** Test seam / rollback: forget the registered executor. */
+export declare function resetAwsExecutor(): void;
+export declare function awsExecutor(): AwsExecutor | undefined;
+/** The registered executor, or a clear throw when none is wired — the fail-closed accessor. */
+export declare function requireAwsExecutor(): AwsExecutor;
+//# sourceMappingURL=aws-exec.d.ts.map

package/dist/agent/connections/aws-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-exec.d.ts","sourceRoot":"","sources":["../../../agent/connections/aws-exec.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;+CAE+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED;0FAC0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,qGAAqG;AACrG,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAClD;AAID,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,WAAW,GAAG,IAAI,CAE/D;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,wBAAgB,WAAW,IAAI,WAAW,GAAG,SAAS,CAErD;AAED,+FAA+F;AAC/F,wBAAgB,kBAAkB,IAAI,WAAW,CAQhD"}

package/dist/agent/connections/aws-exec.js

@@ -0,0 +1,22 @@
+// The AWS-executor port: one host-side `aws` run with scoped credentials in that one process's env, so
+// the sandbox never holds them. access/aws-screen.ts refuses the CLI's credential-echo paths.
+let registered;
+export function registerAwsExecutor(executor) {
+    registered = executor;
+}
+/** Test seam / rollback: forget the registered executor. */
+export function resetAwsExecutor() {
+    registered = undefined;
+}
+export function awsExecutor() {
+    return registered;
+}
+/** The registered executor, or a clear throw when none is wired — the fail-closed accessor. */
+export function requireAwsExecutor() {
+    if (!registered) {
+        throw new Error("no AWS executor is registered — the AWS adapter (packages/adapters/agent/aws) is not wired. " +
+            "Register it at boot (register-adapters.ts). Fail-closed: no AWS access.");
+    }
+    return registered;
+}
+//# sourceMappingURL=aws-exec.js.map

package/dist/agent/connections/aws-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-exec.js","sourceRoot":"","sources":["../../../agent/connections/aws-exec.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,8FAA8F;AA0B9F,IAAI,UAAmC,CAAC;AAExC,MAAM,UAAU,mBAAmB,CAAC,QAAqB;IACvD,UAAU,GAAG,QAAQ,CAAC;AACxB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,UAAU,GAAG,SAAS,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,8FAA8F;YAC5F,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/agent/connections/aws-identity.d.ts

@@ -0,0 +1,138 @@
+import type { AwsRoleGrant } from "../access/bundle.js";
+import type { BindableContext } from "../identity/binding.js";
+/** Short-lived AWS credentials, as an STS AssumeRole* result. `expiresAtMs` is the seam the
+ *  warm-credential cache (credentials/warm.ts) refreshes against — STS temp creds live ~1h. */
+export interface AwsCredentials {
+    readonly accessKeyId: string;
+    readonly secretAccessKey: string;
+    readonly sessionToken: string;
+    readonly expiresAtMs?: number;
+}
+/** Which identity the credentials represent — a standing domain service role, or a human's own
+ *  federated SSO identity. */
+export type AwsIdentityKind = "domain-role" | "user-sso";
+/** What the provider is asked to mint. `roleSessionName` is stamped for CloudTrail attribution
+ *  (the domain, or the acting principal); `principalSubject` is present ONLY for user-sso (the verified
+ *  human, already qualified), so an adapter can never be handed a user-sso mint with nobody named. */
+export interface AwsIdentityRequest {
+    readonly kind: AwsIdentityKind;
+    readonly roleArn: string;
+    readonly region?: string;
+    readonly audience?: string;
+    readonly roleSessionName: string;
+    /**
+     * The mint's ORG — an adapter's warm-credential cache key must be org-scoped, and a `domain-role` key
+     * is not otherwise org-unique. Not an authorization input, never sent to AWS; set for BOTH kinds.
+     */
+    readonly org?: string;
+    /**
+     * The acting human's QUALIFIED vault subject (identity/oauth-vault-share.ts), composed by planAwsIdentity;
+     * user-sso only. An OPAQUE key for the SSO vault and warm cache — never a bare native id, never CloudTrail.
+     */
+    readonly principalSubject?: string;
+    /**
+     * The grant's `allow` compiled to an IAM policy, intersected by STS at mint — DOMAIN-ROLE only, because
+     * `sso:GetRoleCredentials` takes no session policy. Absent ⇒ no narrowing at mint; the screen still runs.
+     */
+    readonly sessionPolicy?: string;
+}
+/** The vendor-neutral AWS-identity port. One adapter satisfies it structurally and is the ONLY place
+ *  an AWS SDK / STS transport is named. */
+export interface AwsIdentityProvider {
+    mint(req: AwsIdentityRequest): Promise<AwsCredentials>;
+}
+export interface ResolvedAwsIdentity {
+    readonly credentials: AwsCredentials;
+    readonly roleArn: string;
+    readonly region?: string;
+    readonly boundAs: AwsIdentityKind;
+    readonly roleSessionName: string;
+    /**
+     * The DOMAIN this call acts inside, for the audit row. Carried from the PLAN rather than re-derived: the
+     * session name is built from the same value, so a re-resolve could disagree with what CloudTrail sees.
+     */
+    readonly domain?: string;
+    /** The selected grant's REQUIRED host-side service/action allow-list (OPE-296 §8), carried from
+     *  the VERIFIED grant (`plan.grant.allow`) — never model input. `["*"]` = explicitly
+     *  unrestricted; absent/empty REFUSES at the screen (fail closed). Enforced BEFORE the CLI runs
+     *  via the approver chain's L2 aws element (access/aws-screen.ts awsCommandVerdict). */
+    readonly allow: readonly string[];
+}
+/**
+ * The screen's boolean face — the whole decision lives in `awsCommandVerdict` (access/aws-screen.ts).
+ * ABSENT or EMPTY `allow` REFUSES (fail closed); unrestricted is the explicit `["*"]`.
+ */
+export declare function isAwsCommandAllowed(args: readonly string[], allow: readonly string[] | undefined): boolean;
+export declare function registerAwsIdentityProvider(provider: AwsIdentityProvider): void;
+/** Test seam / rollback: forget the registered provider. */
+export declare function resetAwsIdentityProvider(): void;
+export declare function awsIdentityProvider(): AwsIdentityProvider | undefined;
+/** The registered provider, or a clear throw when none is wired — the fail-closed accessor. */
+export declare function requireAwsIdentityProvider(): AwsIdentityProvider;
+/** AWS RoleSessionName grammar: `[\w+=,.@-]{2,64}`. Sanitise an arbitrary label (a domain name,
+ *  a principal id, a surface key) into a valid, audit-legible session name, prefixed `oe-`. */
+export declare function awsRoleSessionName(label: string): string;
+export interface AwsIdentityPlan {
+    readonly kind: AwsIdentityKind;
+    readonly grant: AwsRoleGrant;
+    readonly roleSessionName: string;
+    /** This turn's org — rides onto {@link AwsIdentityRequest.org} for the adapter's cache key. */
+    readonly org: string;
+    /** The acting human's QUALIFIED vault subject, for user-sso only — see
+     *  {@link AwsIdentityRequest.principalSubject}. Composed here, where the binding's platform is in
+     *  scope; downstream treats it as an opaque key. */
+    readonly principalSubject?: string;
+    /** This scope's explicit domain, when it has one — the audit row's `channel/domain` half. Recorded
+     *  for BOTH kinds: a user-sso call still happened somewhere, and "which domain was this person
+     *  acting in" is the question an auditor asks next. Not an authorization input. */
+    readonly domain?: string;
+}
+/** Options a caller may pass to steer selection — WITHIN the granted set only. */
+export interface AwsIdentityOptions {
+    /** Disambiguate when the scope is granted more than one role. Must be one of the granted ARNs;
+     *  an unknown value is refused (selection can never widen beyond the reviewed grant). */
+    readonly roleArn?: string;
+    /** Which identity mode to act under. Default "domain-role". "user-sso" adds the attended-human /
+     *  DM-only fences. */
+    readonly as?: AwsIdentityKind;
+}
+/**
+ * PURE identity selection — the security-relevant decision, factored out of ctx so it is testable
+ * without config wiring. Throws (fail-closed) on: no grant, unknown/ambiguous role, or — for user-sso
+ * — a routine fire (no acting sender) or a non-DM surface. All inputs are already VERIFIED
+ * (grants/domains from the resolver; mode/actingPrincipalId from the binding), never model input.
+ */
+export declare function planAwsIdentity(input: {
+    readonly grants: readonly AwsRoleGrant[];
+    readonly mode: string;
+    readonly actingPrincipalId: string | undefined;
+    /** The binding's org + platform — the two facts the acting human's vault subject is qualified by
+     *  (OPE-286). Both are VERIFIED surface facts off the same binding `mode`/`actingPrincipalId` come
+     *  from; `platform` in particular must reach here from the binding and never be inferred from the
+     *  id's shape (identity/principal-key.ts). */
+    readonly org: string;
+    readonly platform: string;
+    /** The binding's WORKSPACE — the tenant rung of the acting human's subject on a tenant-scoped
+     *  platform (OPE-309). Same provenance rule as `platform`: it reaches here from the binding, and
+     *  a subject that cannot name it is refused rather than composed without it. */
+    readonly workspace: string | undefined;
+    readonly domains: readonly string[];
+    readonly surfaceKey: string;
+    readonly opts?: AwsIdentityOptions;
+}): AwsIdentityPlan;
+/**
+ * Plan WITHOUT minting, so the tool runs the host-side command screen before any credential exists:
+ * a refused command must never cause a mint.
+ */
+export declare function planAwsIdentityFor(ctx: BindableContext, opts?: AwsIdentityOptions): AwsIdentityPlan;
+/**
+ * Mint for an already-screened plan. The DOMAIN-ROLE path compiles the grant's `allow` into an STS
+ * session policy; the per-user path structurally cannot take one.
+ */
+export declare function mintPlannedAwsIdentity(plan: AwsIdentityPlan): Promise<ResolvedAwsIdentity>;
+/**
+ * Plan and mint in one call. Host-side only: the credentials must be injected into one executor run
+ * and never reach the sandbox or the model.
+ */
+export declare function resolveAwsIdentity(ctx: BindableContext, opts?: AwsIdentityOptions): Promise<ResolvedAwsIdentity>;
+//# sourceMappingURL=aws-identity.d.ts.map

package/dist/agent/connections/aws-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-identity.d.ts","sourceRoot":"","sources":["../../../agent/connections/aws-identity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAG9D;+FAC+F;AAC/F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;8BAC8B;AAC9B,MAAM,MAAM,eAAe,GAAG,aAAa,GAAG,UAAU,CAAC;AAEzD;;sGAEsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;2CAC2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;4FAGwF;IACxF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAE1G;AAID,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAE/E;AAED,4DAA4D;AAC5D,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,wBAAgB,mBAAmB,IAAI,mBAAmB,GAAG,SAAS,CAErE;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,IAAI,mBAAmB,CAQhE;AAED;+FAC+F;AAC/F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+FAA+F;IAC/F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;wDAEoD;IACpD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;uFAEmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC;6FACyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;0BACsB;IACtB,QAAQ,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/C;;;kDAG8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;oFAEgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;CACpC,GAAG,eAAe,CAsElB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,kBAAkB,GAAG,eAAe,CAiBnG;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsBhG;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE,kBAAkB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAE9B"}