@open-everywhere/core 0.1.0

package/dist/agent/tools/clear_connector_override.js

@@ -0,0 +1,134 @@
+// clear_connector_override — PROPOSE reverting an earlier connector revoke back to the
+// config-as-code bundle grants. Same propose/approve mechanics as revoke_connector (see
+// that file's header): this tool posts a confirmation card and returns "awaiting admin
+// approval"; it never clears anything itself. This is a WIDEN-BACK-TO-CONFIG action (it
+// can restore access a revoke had cut), so it goes through the same admin-approval gate
+// as the revoke it undoes — the card is the gate, not a lesser check.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { actingPrincipalId, bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { resolvePartition } from "../memory/partition.js";
+import { domainForChannel } from "../memory/domain.js";
+import { getConfig } from "../access/config.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+/** Pure input -> frozen-args mapping — same card-path / ACTING-sender refusals and
+ *  surface-scoped scopeKey defaulting as planRevokeConnector. No `reason` field: this
+ *  reverts to config, it doesn't introduce a new deviation that needs justifying. */
+export function planClearConnectorOverride(binding, input, domain) {
+    // NO CARD-PATH REFUSAL HERE ANY MORE (OPE-303) — matching planRevokeConnector, and these two must
+    // move TOGETHER for the same reason they had to widen together: a deployment that can revoke a
+    // connector during an incident but cannot clear the override afterwards has a one-way door, which
+    // is worse than not having the pair at all. Where the card goes is execute()'s venue walk.
+    // principal-gate: presence — this is the only WIDEN verb on the runtime connector lane (the file
+    // header says so: it can restore access a revoke had cut). Everything else about access widens
+    // only through a reviewed PR, so the one runtime exception must not be reachable by a schedule.
+    //
+    // 🔴 THE ACTING principal, never the bound one (OPE-273) — `binding.principalId` was answered by
+    // a fire's attested creator, which is exactly the name that makes a "restore the connector we cut
+    // during the incident" card look like it came from the person who cut it.
+    if (!actingPrincipalId(binding)) {
+        throw new Error("clear_connector_override needs a verified sender on this turn — a triggered routine fire has no acting sender (only the creator it is attributed to), and restoring cut access is a person's decision. Ask someone in this conversation to propose it.");
+    }
+    const connector = input.connector.trim();
+    if (!connector) {
+        throw new Error("clear_connector_override needs a non-empty connector name.");
+    }
+    // The domain-grain default, load-bearing rather than defensive since this tool serves Discord threads too — see planRevokeConnector for the full argument.
+    const scopeKey = input.scopeKey?.trim() || `${binding.platform}/${binding.workspace}/${binding.domainSurface ?? binding.surface}`;
+    return {
+        kind: "connector.clear",
+        args: { org: binding.org, scopeKey, connector },
+        scopeKey,
+        domain,
+    };
+}
+// FACTORED + PRE-REGISTERED (access/window-gated.ts's REPLAY DOCTRINE): top-level defineTool const,
+// registered at module load under the deterministic slug-keyed step name, never an inline literal.
+// The surface gate that used to sit on the resolver is gone — see the export at the bottom.
+const clearConnectorOverrideEntry = defineTool({
+    description: "PROPOSE reverting an earlier break-glass connector revoke, restoring this surface's config-as-code bundle grants for that connector — this does NOT clear anything itself. Posts a confirmation card; an org admin, or a domain admin whose domain covers this scope, must click Approve (this widens access back to config, so the admin click is the gate). Use to undo revoke_connector once the incident is resolved. The posted card IS the reply to the user — do not add any narration, summary, or confirmation text after this call; the channel already sees everything the card says. EXCEPT when this surface can't host a card: it then goes to a card-capable channel in the same domain, the `note` field names it, and you MUST relay that.",
+    inputSchema: z.object({
+        connector: z.string().min(1).describe('Connector name to restore, e.g. "notion".'),
+        scopeKey: z
+            .string()
+            .optional()
+            .describe('Override the scope key, e.g. "slack/T123/C456". Defaults to this surface\'s own scope.'),
+    }),
+    outputSchema: z.object({
+        requested: z.boolean(),
+        pendingId: z.string(),
+        expiresAt: z.string().optional().describe("Absent when the chain auto-approved: the row is already decided, so nothing expires."),
+        note: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    // NO `approval:` — an eve DYNAMIC-tool approval fn registers in-process at session.started
+    // resolve time only, so on a RESUMED session in a fresh invocation the replay lookup
+    // fails and eve forces ungrantable "user-approval", killing the turn silently (live
+    // 2026-07-07). Absent approval === never() on both live and replay paths — omit it.
+    async execute(input, ctx) {
+        const binding = bindFrom(ctx);
+        // Approver domain = the TARGET scope's explicit domain (see set_spend_limit.ts for
+        // why) — same domain-grain defaulting expression the plan uses.
+        const scopeKey = input.scopeKey?.trim() || `${binding.platform}/${binding.workspace}/${binding.domainSurface ?? binding.surface}`;
+        const domain = domainForChannel(scopeKey, getConfig().loadDomains())?.name ?? null;
+        const plan = planClearConnectorOverride(binding, input, domain);
+        // WHERE THE CARD GOES (OPE-303) — see revoke_connector.ts; the pair resolves it identically.
+        const venueResult = await checkApprovalVenue(binding, resolvePartition(ctx), () => getConfig().loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "clear that override"));
+        }
+        const venue = venueResult.venue;
+        const posted = await requestApproval({
+            org: plan.args.org,
+            kind: plan.kind,
+            args: plan.args,
+            scopeKey: plan.scopeKey,
+            domain: plan.domain,
+            // The PROVENANCE read on purpose — the card's "asked by" label, guaranteed present by
+            // planClearConnectorOverride's acting-sender refusal above (see set_spend_limit.ts).
+            requestedBy: principalIdOf(ctx),
+            channelId: venue.channelId,
+            // Thread the card under the asking conversation (see set_spend_limit.ts) — only when the
+            // card IS in that conversation.
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback target,
+            // and the VENUE's key because that is where the card actually is.
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, 
+        // The VENUE's own CardPoster — see revoke_connector.ts.
+        approvalPostDeps(venue.platform, ctx));
+        const subject = `clear override for "${plan.args.connector}" on "${plan.args.scopeKey}"`;
+        // Chain-lowered (OPE-296) ⇒ no card, the override is already cleared. See revoke_connector.ts
+        // for why this note stops being internal-only on this branch.
+        if (posted.autoApproved) {
+            return {
+                requested: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                note: autoApprovedNote(subject, posted.autoApproved),
+            };
+        }
+        return {
+            requested: true,
+            pendingId: posted.id,
+            expiresAt: posted.expiresAt,
+            // Internal-only WHEN THE CARD IS HERE (it is then the user-facing reply); on a REDIRECT it is
+            // the only report the asker gets — see revoke_connector.ts.
+            note: `${cardPostedPrefix(venue)} — ${subject} (pending ${posted.id}).` + cardPostedTail(venue, "approve it", posted),
+        };
+    },
+});
+preRegisterDynamicEntry("clear_connector_override", "_single", clearConnectorOverrideEntry);
+// MOUNTED EVERYWHERE (OPE-303) — see forget.ts. The dynamic wrapper stays only for
+// preRegisterDynamicEntry's replay-immunity; the surface gate is gone.
+export default defineDynamic({
+    events: {
+        "session.started": () => clearConnectorOverrideEntry,
+    },
+});
+//# sourceMappingURL=clear_connector_override.js.map

package/dist/agent/tools/clear_connector_override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear_connector_override.js","sourceRoot":"","sources":["../../../agent/tools/clear_connector_override.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,wFAAwF;AACxF,uFAAuF;AACvF,wFAAwF;AACxF,wFAAwF;AACxF,sEAAsE;AAEtE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAuB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAkBpE;;qFAEqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,OAAuB,EAAE,KAAkC,EAAE,MAAqB;IAC3H,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,2FAA2F;IAC3F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,0EAA0E;IAC1E,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wPAAwP,CAAC,CAAC;IAC5Q,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,2JAA2J;IAC3J,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAClI,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC/C,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,4FAA4F;AAC5F,MAAM,2BAA2B,GAAG,UAAU,CAAC;IAC7C,WAAW,EACT,6tBAA6tB;IAC/tB,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,2CAA2C,CAAC;QAClF,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,wFAAwF,CAAC;KACtG,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QACjI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,2FAA2F;IAC3F,qFAAqF;IACrF,oFAAoF;IACpF,oFAAoF;IACpF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,mFAAmF;QACnF,gEAAgE;QAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAClI,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;QACnF,MAAM,IAAI,GAAG,0BAA0B,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAEhE,6FAA6F;QAC7F,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9G,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,sFAAsF;YACtF,qFAAqF;YACrF,WAAW,EAAE,aAAa,CAAC,GAAG,CAAE;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,yFAAyF;YACzF,gCAAgC;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,wFAAwF;YACxF,kEAAkE;YAClE,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC;QACD,wDAAwD;QACxD,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,MAAM,OAAO,GAAG,uBAAuB,IAAI,CAAC,IAAI,CAAC,SAAS,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC;QACzF,8FAA8F;QAC9F,8DAA8D;QAC9D,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,8FAA8F;YAC9F,4DAA4D;YAC5D,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,aAAa,MAAM,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC;SACtH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,0BAA0B,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;AAE5F,mFAAmF;AACnF,uEAAuE;AACvE,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,iBAAiB,EAAE,GAAG,EAAE,CAAC,2BAA2B;KACrD;CACF,CAAC,CAAC"}

package/dist/agent/tools/clear_spend_limit.d.ts

@@ -0,0 +1,51 @@
+import { type SurfaceBinding } from "../identity/binding.js";
+import { type CurrentCaps } from "./set_spend_limit.js";
+import { type CapLevel } from "../operational/store.js";
+type Level = CapLevel;
+export interface ClearSpendLimitInput {
+    readonly level?: Level;
+    readonly scopeKey?: string;
+}
+export interface SpendClearPlan {
+    readonly kind: "spend.clear";
+    readonly args: {
+        readonly org: string;
+        readonly scopeKey: string;
+        readonly level: Level;
+        readonly currentCap: number | null;
+        readonly currentUsd: number | null;
+    };
+    readonly scopeKey: string;
+    readonly domain: string | null;
+}
+/** Pure input → frozen-args mapping, with the same defaulting and refusal rules as its `set` sibling and nothing to freeze beyond the scope and the caps it is about to revert. Shared by this tool and the slash-command front door. */
+export declare function planClearSpendLimit(binding: SurfaceBinding, input: ClearSpendLimitInput, current: CurrentCaps, domain: string | null): SpendClearPlan;
+declare const _default: import("eve/tools").DynamicSentinel<import("eve/tools").ToolDefinition<{
+    level?: "domain" | "surface" | "user" | "workspace" | undefined;
+    scopeKey?: string | undefined;
+}, {
+    requested: boolean;
+    pendingId: string;
+    expiresAt?: string | undefined;
+    note: string;
+    autoApproved?: boolean | undefined;
+}> & {
+    execute(input: {
+        level?: "domain" | "surface" | "user" | "workspace" | undefined;
+        scopeKey?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        requested: boolean;
+        pendingId: string;
+        expiresAt: string;
+        note: string;
+        autoApproved?: undefined;
+    } | {
+        expiresAt?: undefined;
+        requested: boolean;
+        autoApproved: boolean;
+        pendingId: string;
+        note: string;
+    }>;
+}>;
+export default _default;
+//# sourceMappingURL=clear_spend_limit.d.ts.map

package/dist/agent/tools/clear_spend_limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear_spend_limit.d.ts","sourceRoot":"","sources":["../../../agent/tools/clear_spend_limit.ts"],"names":[],"mappings":"AAOA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAM1F,OAAO,EAA0G,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGhK,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAOpE,KAAK,KAAK,GAAG,QAAQ,CAAC;AAEtB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;KACpC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,yOAAyO;AACzO,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAyBrJ"}

package/dist/agent/tools/clear_spend_limit.js

@@ -0,0 +1,162 @@
+// clear_spend_limit — PROPOSE reverting a spend-limit override back to the config-as-code
+// cap. Same propose/approve mechanics as set_spend_limit (see that file's header and
+// build-2026-07-04-slack-approvals.md): this tool posts a confirmation card and returns
+// "awaiting admin approval"; it never clears anything itself.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { actingPrincipalId, bindFrom } from "../identity/binding.js";
+import { principalIdOf, unattendedOf } from "../access/request.js";
+import { untrustedIngestedThisTurn } from "../access/taint-signal.js";
+import { domainForChannel } from "../memory/domain.js";
+import { resolvePartition } from "../memory/partition.js";
+import { getConfig } from "../access/config.js";
+import { defaultScopeKey, assertScopableFromHere, assertScopeKeyShapeForLevel, approvalPostDeps, currentCapsFor } from "./set_spend_limit.js";
+// 🔴 The levels come from the STORE, not from set_spend_limit.ts. Importing that `const` from the pair's other half is a TDZ ReferenceError at module eval: that file sits in a deliberate cycle with the card-venue module, and a VALUE crossing it is exactly what its header forbids.
+// The store is a leaf neither side of the cycle re-enters, and it owns the vocabulary anyway — these are the levels the spend_limit row can persist.
+import { CAP_LEVELS } from "../operational/store.js";
+import { requestApproval, autoApprovedNote } from "../approvals/flow.js";
+import { checkApprovalVenue, describeVenueRefusal, cardPostedPrefix, cardPostedTail } from "../approvals/card-venue.js";
+import { friendlyScopeLabel } from "../approvals/scope-label.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+const LEVELS = CAP_LEVELS;
+/** Pure input → frozen-args mapping, with the same defaulting and refusal rules as its `set` sibling and nothing to freeze beyond the scope and the caps it is about to revert. Shared by this tool and the slash-command front door. */
+export function planClearSpendLimit(binding, input, current, domain) {
+    // NO CARD-PATH REFUSAL HERE ANY MORE (OPE-312) — matching planSetSpendLimit, and these two must
+    // move TOGETHER for the same reason the connector pair had to (OPE-303): a deployment that can
+    // RAISE a cap from a Teams room but cannot clear the override afterwards has a one-way door,
+    // which is worse than not widening at all. Where the card goes is execute()'s venue walk; the
+    // slash-command front door keeps its own fence (`requireCardPathHere`).
+    // principal-gate: presence — the sharper half of the pair. A clear does not merely move a cap, it
+    // REMOVES the override holding one down, which is a guardrail removed rather than added.
+    //
+    // 🔴 THE ACTING principal, never the bound one (OPE-273) — see planSetSpendLimit for the full
+    // argument. `binding.principalId` was answered by a fire's attested creator, so this refusal
+    // could never fire on a fire.
+    if (!actingPrincipalId(binding)) {
+        throw new Error("clear_spend_limit needs a verified sender on this turn — a triggered routine fire has no acting sender (only the creator it is attributed to), and a fire may not propose removing a spend override in that person's name. Ask a person in this conversation to propose it.");
+    }
+    const level = input.level ?? "surface";
+    assertScopableFromHere("clear_spend_limit", binding, level, input.scopeKey);
+    const scopeKey = input.scopeKey?.trim() || defaultScopeKey(binding, level);
+    assertScopeKeyShapeForLevel("clear_spend_limit", level, scopeKey);
+    return {
+        kind: "spend.clear",
+        args: { org: binding.org, scopeKey, level, currentCap: current.tokens, currentUsd: current.usd },
+        scopeKey,
+        domain,
+    };
+}
+// FACTORED + PRE-REGISTERED (access/window-gated.ts's REPLAY DOCTRINE): top-level factored
+// defineTool const, registered at module load under the deterministic slug-keyed step name, never
+// an inline literal. THE SURFACE GATE IS GONE (OPE-312) — see the export at the bottom.
+const clearSpendLimitEntry = defineTool({
+    description: 'PROPOSE clearing a spend-limit override so the scope reverts to the config-as-code cap — this does NOT clear anything itself. Posts a confirmation card (current override -> reverts to config). Approval standing: an org admin can always decide; a domain admin whose domain covers this scope can too for "surface"/"workspace" — but clearing a DOMAIN-LEVEL or USER-LEVEL override needs an ORG ADMIN specifically (domain admins cannot approve changes to their own domain\'s budget, and a per-person allowance is a change about somebody who is not in the room the card lands in). level defaults to "surface" (this channel/DM); pass level:"workspace" to clear a workspace-wide override, level:"domain" to clear this channel\'s memory-domain override, or level:"user" to clear ONE PERSON\'s allowance override (defaults to the person who just spoke; pass "user:<platform>/<id>" for somebody else). DM turns are spend-capped like any other surface, so from a DM the default level:"surface" clears THIS DM\'s own override and is accepted; level:"domain" needs an explicit scopeKey there (a DM\'s default domain spans every DM), and so does level:"workspace" on Discord (a Discord DM belongs to no server). The posted card IS the reply to the user — do not add any narration, summary, or confirmation text after this call; the channel already sees everything the card says. EXCEPT when this surface can\'t host a card: it then goes to a card-capable channel in the same domain, the `note` field names it, and you MUST relay that.',
+    inputSchema: z.object({
+        level: z
+            .enum(LEVELS)
+            .optional()
+            .describe('"surface" (default — this channel/DM only), "workspace" (the whole Slack workspace / Discord server), "domain" (this channel\'s memory domain — ORG ADMIN approval only), or "user" (ONE PERSON\'s allowance override — ORG ADMIN approval only).'),
+        scopeKey: z
+            .string()
+            .optional()
+            .describe('Override the scope key, e.g. "slack/T123/C456" or "discord/G123/C456" for a surface, "slack/T123" for a workspace, a domain\'s own name for level:"domain", or "user:slack/U123" for level:"user". Defaults to this surface\'s own scope — or, for level:"user", to the person who just spoke.'),
+    }),
+    outputSchema: z.object({
+        requested: z.boolean(),
+        pendingId: z.string(),
+        expiresAt: z.string().optional().describe("Absent when the chain auto-approved: the row is already decided, so nothing expires."),
+        note: z.string(),
+        autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+    }),
+    // NO `approval:` — an eve DYNAMIC-tool approval fn registers in-process at session.started
+    // resolve time only, so on a RESUMED session in a fresh invocation the replay lookup
+    // fails and eve forces ungrantable "user-approval", killing the turn silently (live
+    // 2026-07-07). Absent approval === never() on both live and replay paths — omit it.
+    async execute(input, ctx) {
+        const binding = bindFrom(ctx);
+        const level = input.level ?? "surface";
+        const scopeKey = input.scopeKey?.trim() || defaultScopeKey(binding, level);
+        // The approver domain is the TARGET scope's explicit domain. At `domain` level the scopeKey IS the domain's own name rather than a channel key, so it is frozen directly.
+        // At `user` level it is null: a person is never a domain's business, the same belt-and-braces reasoning the `set` half uses.
+        const domain = level === "user" ? null : level === "domain" ? scopeKey : (domainForChannel(scopeKey, getConfig().loadDomains())?.name ?? null);
+        const workspaceKey = `${binding.platform}/${binding.workspace}`;
+        // EFFECTIVE cap, config plus live overrides — the whole point of a clear is that an override exists, so the card must show the one it is about to revert.
+        // The per-level resolution is shared with set_spend_limit.ts, so the two halves of the pair cannot disagree about what the current cap IS.
+        const current = await currentCapsFor(binding.org, workspaceKey, level, scopeKey, binding.mode, binding.trust);
+        const plan = planClearSpendLimit(binding, input, current, domain);
+        // WHERE THE CARD GOES (OPE-312) — see set_spend_limit.ts's execute(); the pair resolves it
+        // identically, and it also subsumes the old "couldn't resolve this channel's id" throw there.
+        const venueResult = await checkApprovalVenue(binding, resolvePartition(ctx), () => getConfig().loadDomains());
+        if ("refusal" in venueResult) {
+            throw new Error(describeVenueRefusal(venueResult.refusal, binding.platform, "clear that spend override"));
+        }
+        const venue = venueResult.venue;
+        // Friendly display label for the card — same shape as set_spend_limit (fail-open).
+        const scopeLabel = await friendlyScopeLabel(plan.scopeKey);
+        // This turn's untrusted-content taint, frozen onto the card and read here rather than in the pure planner because it is an execute-time session signal.
+        // A clear is the sharper half of the pair — it removes the override that was holding a cap down — and the card is the only place a reviewer can learn the ask came out of content the org did not write.
+        const tainted = untrustedIngestedThisTurn();
+        const posted = await requestApproval({
+            org: plan.args.org,
+            kind: plan.kind,
+            args: { ...plan.args, ...(scopeLabel ? { scopeLabel } : {}), tainted },
+            scopeKey: plan.scopeKey,
+            domain: plan.domain,
+            // The PROVENANCE read on purpose — the card's "asked by" label (see set_spend_limit.ts's
+            // execute for the full note). `planClearSpendLimit` already refused a turn with nobody
+            // acting, so the two answers agree by here and the `!` holds.
+            requestedBy: principalIdOf(ctx),
+            channelId: venue.channelId,
+            // Thread the card under the asking conversation (see set_spend_limit.ts) — only when the
+            // card IS in that conversation.
+            threadTs: venue.sameRoom ? binding.threadTs ?? null : null,
+            // Mint-frozen proposing-surface identity (task #105) — the TTL sweep's feedback target,
+            // and the VENUE's key because that is where the card actually is.
+            postedTo: venue.surfaceKey,
+            chain: { unattended: unattendedOf(ctx) },
+        }, 
+        // The VENUE's own CardPoster — see set_spend_limit.ts. Discord swaps in its own; Slack keeps
+        // the default path untouched.
+        approvalPostDeps(venue.platform, ctx));
+        // An identical clear proposal was already awaiting a click, so requestApproval returned the LIVE card rather than minting a second one — relay that the existing card still needs an admin decision. A prior rejected or expired proposal never dedups.
+        // Naming the venue here is a fact rather than an inference: the dedup identity includes the frozen `channelId`, which IS the venue's.
+        if (posted.deduped) {
+            return {
+                requested: false,
+                pendingId: posted.id,
+                expiresAt: posted.expiresAt,
+                note: `Already pending — an identical clear of the ${plan.args.level} override on "${plan.args.scopeKey}" is awaiting an admin's Approve/Reject (pending ${posted.id}). ` +
+                    `No new card was posted; tell the user the existing card${venue.sameRoom ? "" : ` in ${venue.surfaceKey}`} still needs an admin to tap Approve or Reject.` +
+                    (venue.sameRoom ? "" : " Name that channel — the card is not in this conversation, so the user cannot see it from here."),
+            };
+        }
+        const subject = `clear ${plan.args.level} override on "${plan.args.scopeKey}"${tainted ? " ⚠ tainted" : ""}`;
+        // Chain-lowered (OPE-296) ⇒ no card, the override is already back to the config cap. See
+        // revoke_connector.ts for why this note stops being internal-only on this branch.
+        if (posted.autoApproved) {
+            return {
+                requested: false,
+                autoApproved: true,
+                pendingId: posted.id,
+                note: autoApprovedNote(subject, posted.autoApproved),
+            };
+        }
+        return {
+            requested: true,
+            pendingId: posted.id,
+            expiresAt: posted.expiresAt,
+            // Internal-only WHEN THE CARD IS HERE (it is then the user-facing reply); on a REDIRECT it is
+            // the only report the asker gets — see set_spend_limit.ts.
+            note: `${cardPostedPrefix(venue)} — ${subject} (pending ${posted.id}).` + cardPostedTail(venue, "approve it", posted),
+        };
+    },
+});
+preRegisterDynamicEntry("clear_spend_limit", "_single", clearSpendLimitEntry);
+// Mounted everywhere. The dynamic wrapper stays only for the pre-registration's replay-immunity; the surface gate is gone.
+// Hiding a tool that WORKS — its card routes to a card-capable channel in the domain — made the agent misread its surface in the other direction, reporting that a spend override could not be cleared from here, which is false whenever the domain has anywhere to put a card.
+export default defineDynamic({
+    events: {
+        "session.started": () => clearSpendLimitEntry,
+    },
+});
+//# sourceMappingURL=clear_spend_limit.js.map

package/dist/agent/tools/clear_spend_limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clear_spend_limit.js","sourceRoot":"","sources":["../../../agent/tools/clear_spend_limit.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,qFAAqF;AACrF,wFAAwF;AACxF,8DAA8D;AAE9D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAuB,MAAM,wBAAwB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,cAAc,EAAoB,MAAM,sBAAsB,CAAC;AAChK,yRAAyR;AACzR,qJAAqJ;AACrJ,OAAO,EAAE,UAAU,EAAiB,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACxH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,MAAM,MAAM,GAAG,UAAU,CAAC;AAqB1B,yOAAyO;AACzO,MAAM,UAAU,mBAAmB,CAAC,OAAuB,EAAE,KAA2B,EAAE,OAAoB,EAAE,MAAqB;IACnI,gGAAgG;IAChG,+FAA+F;IAC/F,6FAA6F;IAC7F,8FAA8F;IAC9F,wEAAwE;IACxE,kGAAkG;IAClG,yFAAyF;IACzF,EAAE;IACF,8FAA8F;IAC9F,6FAA6F;IAC7F,8BAA8B;IAC9B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6QAA6Q,CAAC,CAAC;IACjS,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC;IACvC,sBAAsB,CAAC,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3E,2BAA2B,CAAC,mBAAmB,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE;QAChG,QAAQ;QACR,MAAM;KACP,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,kGAAkG;AAClG,wFAAwF;AACxF,MAAM,oBAAoB,GAAG,UAAU,CAAC;IACtC,WAAW,EACT,i/CAAi/C;IACn/C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,MAAM,CAAC;aACZ,QAAQ,EAAE;aACV,QAAQ,CACP,mPAAmP,CACpP;QACH,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gSAAgS,CACjS;KACJ,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QACjI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;KAClI,CAAC;IACF,2FAA2F;IAC3F,qFAAqF;IACrF,oFAAoF;IACpF,oFAAoF;IACpF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3E,0KAA0K;QAC1K,6HAA6H;QAC7H,MAAM,MAAM,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;QAC/I,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAChE,0JAA0J;QAC1J,2IAA2I;QAC3I,MAAM,OAAO,GAAgB,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE3H,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAElE,2FAA2F;QAC3F,8FAA8F;QAC9F,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9G,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAEhC,mFAAmF;QACnF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3D,wJAAwJ;QACxJ,yMAAyM;QACzM,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC;YACE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE;YACtE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,yFAAyF;YACzF,uFAAuF;YACvF,8DAA8D;YAC9D,WAAW,EAAE,aAAa,CAAC,GAAG,CAAE;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,yFAAyF;YACzF,gCAAgC;YAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;YAC1D,wFAAwF;YACxF,kEAAkE;YAClE,QAAQ,EAAE,KAAK,CAAC,UAAU;YAC1B,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE;SACzC;QACD,6FAA6F;QAC7F,8BAA8B;QAC9B,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CACtC,CAAC;QAEF,wPAAwP;QACxP,sIAAsI;QACtI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,IAAI,EACF,+CAA+C,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,oDAAoD,MAAM,CAAC,EAAE,KAAK;oBACnK,0DAA0D,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,UAAU,EAAE,iDAAiD;oBAC1J,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iGAAiG,CAAC;aAC5H,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7G,yFAAyF;QACzF,kFAAkF;QAClF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,MAAM,CAAC,EAAE;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,8FAA8F;YAC9F,2DAA2D;YAC3D,IAAI,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,OAAO,aAAa,MAAM,CAAC,EAAE,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC;SACtH,CAAC;IACJ,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,mBAAmB,EAAE,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAE9E,2HAA2H;AAC3H,iRAAiR;AACjR,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,iBAAiB,EAAE,GAAG,EAAE,CAAC,oBAAoB;KAC9C;CACF,CAAC,CAAC"}

package/dist/agent/tools/complete_job.d.ts

@@ -0,0 +1,15 @@
+declare const _default: import("eve/tools").ToolDefinition<{
+    reason: string;
+}, {
+    completed: boolean;
+    note: string;
+}> & {
+    execute(input: {
+        reason: string;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        completed: boolean;
+        note: string;
+    }>;
+};
+export default _default;
+//# sourceMappingURL=complete_job.d.ts.map

package/dist/agent/tools/complete_job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete_job.d.ts","sourceRoot":"","sources":["../../../agent/tools/complete_job.ts"],"names":[],"mappings":""}

package/dist/agent/tools/complete_job.js

@@ -0,0 +1,59 @@
+// complete_job lets a DURABLE JOB declare the whole job DONE and retire itself cleanly: the job keeps firing on its schedule until its own fired session reaches completion and calls this, which flips the routine to the terminal `done` status, nulls its next run, and audits the completion.
+// Located by the dispatcher-stamped routine marker rather than a caller-supplied id, so a job can only ever complete ITSELF. Not consequential in the guardrail-removal sense cancel_routine is — completing is the job reaching its own intended done-state from inside its own run. Idempotent, and completing a NON-job routine is a structured error.
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { routineMarker } from "../routines/routine.js";
+import { completeJob } from "../routines/lifecycle.js";
+import { getRoutine, updateRoutine } from "../routines/store.js";
+import { auditToolAction } from "../audit/tool-action.js";
+export default defineTool({
+    description: "Mark this DURABLE JOB done — call it once the WHOLE job you were set to drive is finished (not " +
+        "just this fire's step). The job then retires and never fires again; its record is kept for audit. " +
+        "Only valid inside a job routine's own run; use cancel_routine to stop an ordinary routine.",
+    inputSchema: z.object({
+        reason: z.string().min(1).describe("One line on the final outcome — what got done (audit + list visibility)."),
+    }),
+    outputSchema: z.object({
+        completed: z.boolean(),
+        note: z.string(),
+    }),
+    // `never()` = open: completing is the job reaching its own done-state from inside its own run
+    // (marker-located, never a supplied id), not a guardrail removal. Also the dynamic-tool-on-
+    // resumed-session pin the reply/react/record_watch_state tools use.
+    approval: never(),
+    async execute(input, ctx) {
+        const auth = ctx.session?.auth;
+        const marker = routineMarker(auth?.current?.attributes ?? auth?.initiator?.attributes);
+        if (!marker) {
+            throw new Error("complete_job only works inside a job routine's own run — this session has no routine attached.");
+        }
+        const routine = await getRoutine(marker.org, marker.surfaceKey, marker.id);
+        if (!routine)
+            throw new Error(`Routine ${marker.id} no longer exists (cancelled while this job ran).`);
+        const result = completeJob(routine, input.reason, new Date());
+        if (result.kind === "not-a-job") {
+            throw new Error(`Routine ${marker.id} is an ordinary routine, not a durable job — there is no job to complete. ` +
+                `Use cancel_routine to stop a scheduled routine, or record_watch_state for a watch.`);
+        }
+        if (result.kind === "already-done") {
+            // Idempotent: a re-run (durable-replay) or a double call after the job already retired.
+            return { completed: true, note: `Job ${marker.id} was already marked done — nothing to do.` };
+        }
+        const r = result.routine;
+        await updateRoutine(marker.org, marker.surfaceKey, marker.id, {
+            status: r.status,
+            completedAt: r.completedAt,
+            completedReason: r.completedReason,
+            disabledReason: r.disabledReason,
+            nextRunAt: r.nextRunAt,
+        });
+        await auditToolAction(ctx, "routine.complete", {
+            id: marker.id,
+            surfaceKey: marker.surfaceKey,
+            reason: r.completedReason,
+        });
+        return { completed: true, note: `Job ${marker.id} marked done — it will not fire again.` };
+    },
+});
+//# sourceMappingURL=complete_job.js.map

package/dist/agent/tools/complete_job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete_job.js","sourceRoot":"","sources":["../../../agent/tools/complete_job.ts"],"names":[],"mappings":"AAAA,kSAAkS;AAClS,0VAA0V;AAE1V,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,eAAe,UAAU,CAAC;IACxB,WAAW,EACT,iGAAiG;QACjG,oGAAoG;QACpG,4FAA4F;IAC9F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,0EAA0E,CAAC;KAC/G,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,8FAA8F;IAC9F,4FAA4F;IAC5F,oEAAoE;IACpE,QAAQ,EAAE,KAAK,EAAE;IACjB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,mDAAmD,CAAC,CAAC;QAEvG,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,WAAW,MAAM,CAAC,EAAE,4EAA4E;gBAC9F,oFAAoF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,wFAAwF;YACxF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,EAAE,2CAA2C,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;QACzB,MAAM,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE;YAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;QACH,MAAM,eAAe,CAAC,GAAsB,EAAE,kBAAkB,EAAE;YAChE,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,CAAC,CAAC,eAAe;SAC1B,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,MAAM,CAAC,EAAE,wCAAwC,EAAE,CAAC;IAC7F,CAAC;CACF,CAAC,CAAC"}

package/dist/agent/tools/complete_thread.d.ts

@@ -0,0 +1,8 @@
+import { type BindableContext } from "../identity/binding.js";
+/** Does THIS seat run on a thread-seat window token? Fail-CLOSED: `resolveOwnWindowToken` returns
+ *  `undefined` when neither identity channel yields a parseable window token, and
+ *  `isThreadSeatWindowToken(undefined)` is false. Exported for the guard's own unit pack. */
+export declare function isOwnTokenThreadSeat(ctx: BindableContext): boolean;
+declare const _default: unknown;
+export default _default;
+//# sourceMappingURL=complete_thread.d.ts.map

package/dist/agent/tools/complete_thread.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete_thread.d.ts","sourceRoot":"","sources":["../../../agent/tools/complete_thread.ts"],"names":[],"mappings":"AAMA,OAAO,EAAgC,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAW5F;;6FAE6F;AAC7F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAElE"}

package/dist/agent/tools/complete_thread.js

@@ -0,0 +1,125 @@
+// complete_thread lets a THREAD SEAT declare its thread done and RELEASE ownership: clearing the ownership row means later messages fall back to the STANDING seat, which may open a fresh seat if new work arrives. Grain-gated thread-only, with the execute-time token check as defence-in-depth, and the seat recovers the thread it owns from ITS own wake origin, so it always clears exactly its own row.
+// 🔴 The guard reads BOTH host identity channels, never `ctx.channel`: a tool-execute context carries no channel object at all, so the old read answered FALSE on every real thread seat and this tool refused its own population. It does NOT widen the verb to a delegated child — a subagent child inherits its parent's window stamp, but its grain is forced to `task`, so it is absent at the mount and refused by the backstop, and it holds no wake identity either.
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+import { windowGated } from "../access/window-gated.js";
+import { currentWakeId, deploymentOrg } from "../identity/binding.js";
+import { resolveUnifiedWakeTarget, unifiedThreadRef, mintWakeId } from "../channels/unified-window.js";
+import { clearThreadOwner } from "../channels/thread-ownership.js";
+import { recordThreadSeatReport } from "../channels/thread-seat-state.js";
+import { dispatchSeatMessage } from "../channels/unified.js";
+import { getOperationalStore } from "../operational/provider.js";
+import { resolveOwnWindowToken } from "../access/delegation-mount.js";
+import { isThreadSeatWindowToken, parseWindowToken } from "../channels/window-key.js";
+import { appendAudit } from "../audit/audit.js";
+/** Does THIS seat run on a thread-seat window token? Fail-CLOSED: `resolveOwnWindowToken` returns
+ *  `undefined` when neither identity channel yields a parseable window token, and
+ *  `isThreadSeatWindowToken(undefined)` is false. Exported for the guard's own unit pack. */
+export function isOwnTokenThreadSeat(ctx) {
+    return isThreadSeatWindowToken(resolveOwnWindowToken(ctx));
+}
+/**
+ * Deliver the closing report to the seat that spawned this one (OPE-1696). It resolves the parent's LIVE token from its registry row rather than reusing the token that spawned this seat, because a parent rotates and the retired generation would swallow the report.
+ * AMBIENT, so the parent reads it as context and stays silent unless it decides otherwise — a hand-back is news, not an instruction to announce. BEST-EFFORT: every failure answers false, the report is already stored, and `read_thread_seat` remains the parent's way to find it. The report TEXT is the seat's own words and is delivered verbatim; nothing here summarises it.
+ */
+async function reportToParent(state, ref, origin, report) {
+    try {
+        const parent = await getOperationalStore().getChannelSession(deploymentOrg(), state.parentRegistryKey);
+        if (!parent)
+            return false;
+        const domain = parseWindowToken(parent.token)?.domain;
+        if (domain === undefined)
+            return false;
+        return await dispatchSeatMessage({
+            token: parent.token,
+            origin,
+            wakeId: mintWakeId(),
+            domain,
+            message: `A thread seat you opened has handed its thread back.\n\n` +
+                `Thread: ${ref.threadKey} (in ${ref.channelKey})\n` +
+                `Its report:\n${report}\n\n` +
+                `The thread is yours again: later messages in it wake you. Nothing is owed to the room — speak only if this changes what someone is waiting for.`,
+            // The seat's own auth bag carries no identity this delivery may forward: the PARENT's session
+            // binding supplies workspace and surface, exactly as the approval decision wake relies on.
+            authAttributes: {},
+        });
+    }
+    catch {
+        return false;
+    }
+}
+export default windowGated("complete_thread", defineTool({
+    description: "Mark this thread DONE and hand it back to the channel. Call it when the conversation you were opened " +
+        "to hold is finished and there is nothing left to watch for — later messages then go to the channel " +
+        "watcher again. Your `summary` is what the channel watcher is told at the hand-back, and what it can " +
+        "read back later, so write it for them: what the thread settled, and anything they have to carry. Only " +
+        "reach for it once the thread is genuinely complete.",
+    inputSchema: z.object({
+        // `summary` keeps its name — it is a live tool argument on running seats, and a rename would make
+        // every in-flight call fail its schema. What CHANGED is where the text goes: it is now stored and
+        // delivered to the parent seat (OPE-1696), not audit-only, and the description says so.
+        summary: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Your closing report for the channel watcher: what the thread settled and what it must carry. Stored, and delivered to it at hand-back."),
+    }),
+    outputSchema: z.object({ completed: z.boolean(), note: z.string() }),
+    // NO `approval:` — `open`; releasing ownership only widens who the NEXT message wakes (the standing seat).
+    async execute(input, ctx) {
+        const c = ctx;
+        // Thread-only: a standing/native/task seat has no thread-seat ownership to release (grain makes this structural).
+        if (!isOwnTokenThreadSeat(c)) {
+            throw new Error("complete_thread: only a thread seat can complete its thread — this session owns no thread-seat row to release.");
+        }
+        const org = deploymentOrg();
+        const wakeId = currentWakeId(c);
+        const origin = wakeId ? await resolveUnifiedWakeTarget(getOperationalStore(), org, wakeId) : null;
+        if (!origin) {
+            throw new Error("complete_thread: couldn't resolve this thread to release — try again on a message-driven turn.");
+        }
+        const ref = unifiedThreadRef(origin);
+        // THE HAND-BACK REPORT (OPE-1696) — an EVENT at hand-back, which is the ruled shape: the seat
+        // does not get a "report" verb it must remember to call, and the one moment it always passes
+        // through carries its words to the parent. Stored FIRST, then delivered: the record is what
+        // `read_thread_seat` answers with, and a lost wake must never lose the report itself.
+        // Ordered BEFORE the ownership clear so a report that fails to store cannot leave the thread
+        // released AND unexplained.
+        const store = getOperationalStore();
+        const report = input.summary?.trim();
+        const closed = report ? await recordThreadSeatReport(store, org, ref, report, new Date().toISOString()).catch(() => null) : null;
+        const reported = closed ? await reportToParent(closed, ref, origin, report ?? "") : false;
+        const cleared = await clearThreadOwner(store, org, ref);
+        // `thread_seat.completed` — names/ids/flags ONLY (no summary TEXT; the note is generic).
+        await appendAudit({
+            org,
+            platform: "unified",
+            workspace: ref.channelKey,
+            action: "thread_seat.completed",
+            detail: {
+                channelKey: ref.channelKey,
+                threadKey: ref.threadKey,
+                cleared,
+                hasSummary: Boolean(input.summary),
+                // ids/flags only, as before: WHETHER the report stored and whether the parent's wake landed,
+                // never the report text, which lives in its own row and in the parent's transcript.
+                reportStored: closed !== null,
+                reportDelivered: reported,
+                wakeId: wakeId ?? null,
+                sessionId: c.session?.id ?? null,
+            },
+        }).catch(() => undefined);
+        return {
+            completed: true,
+            note: (cleared ? "Thread released — the channel watcher handles it from here." : "Thread marked done (no active ownership row to release).") +
+                (closed === null
+                    ? report
+                        ? " Your report could not be filed for this thread, so say anything the watcher must carry in the thread itself."
+                        : " You left no report, so the watcher gets the hand-back and nothing else."
+                    : reported
+                        ? " Your report is filed and the watcher has been told."
+                        : " Your report is filed; the watcher will read it when it next looks."),
+        };
+    },
+}));
+//# sourceMappingURL=complete_thread.js.map

package/dist/agent/tools/complete_thread.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete_thread.js","sourceRoot":"","sources":["../../../agent/tools/complete_thread.ts"],"names":[],"mappings":"AAAA,iZAAiZ;AACjZ,6cAA6c;AAE7c,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AAC5F,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,UAAU,EAA0B,MAAM,+BAA+B,CAAC;AAC/H,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD;;6FAE6F;AAC7F,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,OAAO,uBAAuB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,KAAyB,EACzB,GAAgE,EAChE,MAAyB,EACzB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,MAAM,mBAAmB,CAAC;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM;YACN,MAAM,EAAE,UAAU,EAAE;YACpB,MAAM;YACN,OAAO,EACL,0DAA0D;gBAC1D,WAAW,GAAG,CAAC,SAAS,QAAQ,GAAG,CAAC,UAAU,KAAK;gBACnD,gBAAgB,MAAM,MAAM;gBAC5B,iJAAiJ;YACnJ,8FAA8F;YAC9F,2FAA2F;YAC3F,cAAc,EAAE,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,eAAe,WAAW,CAAC,iBAAiB,EAAE,UAAU,CAAC;IACvD,WAAW,EACT,uGAAuG;QACvG,qGAAqG;QACrG,sGAAsG;QACtG,wGAAwG;QACxG,qDAAqD;IACvD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,kGAAkG;QAClG,kGAAkG;QAClG,wFAAwF;QACxF,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,wIAAwI,CAAC;KACtJ,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,2GAA2G;IAC3G,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,CAAC,GAAG,GAAsB,CAAC;QACjC,kHAAkH;QAClH,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAC;QACpI,CAAC;QACD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACrC,8FAA8F;QAC9F,6FAA6F;QAC7F,4FAA4F;QAC5F,sFAAsF;QACtF,6FAA6F;QAC7F,4BAA4B;QAC5B,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjI,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1F,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACxD,yFAAyF;QACzF,MAAM,WAAW,CAAC;YAChB,GAAG;YACH,QAAQ,EAAE,SAAS;YACnB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE;gBACN,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,OAAO;gBACP,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;gBAClC,6FAA6F;gBAC7F,oFAAoF;gBACpF,YAAY,EAAE,MAAM,KAAK,IAAI;gBAC7B,eAAe,EAAE,QAAQ;gBACzB,MAAM,EAAE,MAAM,IAAI,IAAI;gBACtB,SAAS,EAAG,CAAC,CAAC,OAA2B,EAAE,EAAE,IAAI,IAAI;aACtD;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,OAAO;YACL,SAAS,EAAE,IAAI;YACf,IAAI,EACF,CAAC,OAAO,CAAC,CAAC,CAAC,6DAA6D,CAAC,CAAC,CAAC,0DAA0D,CAAC;gBACtI,CAAC,MAAM,KAAK,IAAI;oBACd,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,+GAA+G;wBACjH,CAAC,CAAC,0EAA0E;oBAC9E,CAAC,CAAC,QAAQ;wBACR,CAAC,CAAC,sDAAsD;wBACxD,CAAC,CAAC,qEAAqE,CAAC;SAC/E,CAAC;IACJ,CAAC;CACF,CAAC,CAAC,CAAC"}