@smthrs/kernel 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/Jj.js

@@ -0,0 +1,111 @@
+/**
+ * Permission-aware Jujutsu version-control operations.
+ *
+ * There is no kernel `Jj` interface and no kernel `Jj` tag. `@smthrs/jj` owns
+ * both, and its error channel already names the failures the kernel adds, so
+ * this module is only the middleware: a `Layer` over the same tag that reads
+ * the raw service out of context and returns a guarded one in its place.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md`,
+ * `docs/specs/Concepts/Effect Taxonomy.md`, and
+ * `docs/specs/Concepts/Host Adapters.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { permissionDenied } from "@smthrs/capability/Permission";
+import { Jj } from "@smthrs/jj";
+import { Effect, FileSystem as EffectFileSystem, Layer, Path as EffectPath } from "effect";
+import { canonicalResource } from "./FileSystem.js";
+import { GrantStore } from "./GrantStore.js";
+import { makeCapability } from "./internal/makeCapability.js";
+import { Workspace } from "./Workspace.js";
+/**
+ * `@smthrs/jj`'s own Jujutsu tag, unchanged. Re-exported so the kernel
+ * namespace stays one-stop; it is the *same* tag, never a second one.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export { Jj } from "@smthrs/jj";
+/**
+ * Provides an unavailable Jujutsu stub.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export { layerNoop } from "@smthrs/jj";
+/**
+ * Constructs a Jujutsu service from an implementation.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { make } from "@smthrs/jj";
+/**
+ * Constructs an unavailable Jujutsu stub.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export { makeNoop } from "@smthrs/jj";
+/**
+ * Decorates the Jujutsu service in place with operation-specific capability
+ * checks.
+ *
+ * The layer provides the tag it also requires: compose it over a host jj layer
+ * with `Layer.provide` and every consumer of `Jj` — including one that never
+ * heard of the kernel — resolves the guarded implementation.
+ *
+ * `workspaceAdd` canonicalizes its destination and `root` canonicalizes its
+ * starting directory through the *raw* filesystem before asking for
+ * `jj:workspace-add` and `fs:write`, or for `jj:root`, so an existing symlink
+ * cannot turn an inside-workspace grant into outside authority or separate the
+ * authorized path from the directory jj is run in.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layer = Layer.effect(Jj, Effect.gen(function* () {
+    const jj = yield* Jj;
+    const jjRoot = jj.root;
+    const jjRevert = jj.revert;
+    const jjOpRestore = jj.opRestore;
+    const fileSystem = yield* EffectFileSystem.FileSystem;
+    const path = yield* EffectPath.Path;
+    const workspace = yield* Workspace;
+    const grants = yield* GrantStore;
+    const check = (action, resource) => makeCapability(action, resource).pipe(Effect.flatMap((capability) => grants.check(capability)));
+    return Jj.of({
+        status: Effect.fn("Jj.status")(() => check("jj:status", ".").pipe(Effect.andThen(jj.status()))),
+        diff: Effect.fn("Jj.diff")((from, to) => check("jj:diff", `${from}:${to}`).pipe(Effect.andThen(jj.diff(from, to)))),
+        snapshot: Effect.fn("Jj.snapshot")((message) => check("jj:snapshot", message ?? "").pipe(Effect.andThen(jj.snapshot(message)))),
+        restore: Effect.fn("Jj.restore")((revision) => check("jj:restore", revision).pipe(Effect.andThen(jj.restore(revision)))),
+        workspaceAdd: Effect.fn("Jj.workspaceAdd")((name, destination, revision) => canonicalResource(fileSystem, path, workspace.root, destination).pipe(Effect.flatMap((resource) => check("jj:workspace-add", resource).pipe(Effect.andThen(check("fs:write", resource)), Effect.andThen(canonicalResource(fileSystem, path, workspace.root, destination)), Effect.flatMap((settled) => settled === resource
+            ? jj.workspaceAdd(name, resource, revision)
+            : makeCapability("jj:workspace-add", resource).pipe(Effect.flatMap((capability) => Effect.fail(permissionDenied(capability, "workspace destination no longer names the resource that was authorized"))))))))),
+        workspaceForget: Effect.fn("Jj.workspaceForget")((name) => check("jj:workspace-forget", name).pipe(Effect.andThen(jj.workspaceForget(name)))),
+        // `root`, `revert`, and `opRestore` are optional on the service, so the decorator
+        // forwards the ABSENCE too. A backend that cannot revert must keep
+        // reading as a backend that cannot revert: replacing it with a guarded
+        // method that fails on call would turn "this host has no revert" into
+        // "your revert was refused", which is a different answer to a caller
+        // deciding what it can offer.
+        ...jjRoot === undefined ? {} : {
+            root: Effect.fn("Jj.root")((from) => 
+            // Canonicalized BEFORE the check, and the canonical path is what jj
+            // is then run in. Checking the caller's spelling and inspecting a
+            // different directory is the whole symlink-alias problem: an
+            // authorized name would decide the answer for a repository the grant
+            // never mentioned.
+            canonicalResource(fileSystem, path, workspace.root, from).pipe(Effect.flatMap((resource) => check("jj:root", resource).pipe(Effect.andThen(jjRoot(resource))))))
+        },
+        ...jjRevert === undefined ? {} : {
+            revert: Effect.fn("Jj.revert")((revision) => check("jj:revert", revision).pipe(Effect.andThen(jjRevert(revision))))
+        },
+        ...jjOpRestore === undefined ? {} : {
+            opRestore: Effect.fn("Jj.opRestore")((operationId) => check("jj:op-restore", operationId).pipe(Effect.andThen(jjOpRestore(operationId))))
+        }
+    });
+}));
+//# sourceMappingURL=Jj.js.map

package/dist/esm/Jj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jj.js","sourceRoot":"","sources":["../../src/Jj.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,EAAE,EAAE,EAAmC,MAAM,YAAY,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;;GAMG;AACH,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAA;AAE/B;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEjC;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,KAAK,GAId,KAAK,CAAC,MAAM,CACd,EAAE,EACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,CAAA;IACpB,MAAM,MAAM,GAAG,EAAE,CAAC,IAAI,CAAA;IACtB,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAA;IAC1B,MAAM,WAAW,GAAG,EAAE,CAAC,SAAS,CAAA;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAA;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAA;IACnC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAE,EAAE,CACjD,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjG,OAAO,EAAE,CAAC,EAAE,CAAC;QACX,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/F,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CACtC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAC1E;QACD,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7C,KAAK,CAAC,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAC/E;QACD,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC5C,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CACzE;QACD,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,CACzE,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,CACnE,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,KAAK,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAC3C,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAChF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACzB,OAAO,KAAK,QAAQ;YAClB,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;YAC3C,CAAC,CAAC,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,IAAI,CACjD,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5B,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAC1B,UAAU,EACV,wEAAwE,CACzE,CAAC,CACH,CACF,CACJ,CACF,CACF,CACF,CACF;QACD,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CACxD,KAAK,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAClF;QACD,kFAAkF;QAClF,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,8BAA8B;QAC9B,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE;YAC1C,oEAAoE;YACpE,kEAAkE;YAClE,6DAA6D;YAC7D,qEAAqE;YACrE,mBAAmB;YACnB,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAChG,CACF;SACF;QACD,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,QAAkB,EAAE,EAAE,CACpD,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CACtE;SACF;QACD,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,WAAwB,EAAE,EAAE,CAChE,KAAK,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CACnF;SACF;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CACH,CAAA","sourcesContent":["/**\n * Permission-aware Jujutsu version-control operations.\n *\n * There is no kernel `Jj` interface and no kernel `Jj` tag. `@smthrs/jj` owns\n * both, and its error channel already names the failures the kernel adds, so\n * this module is only the middleware: a `Layer` over the same tag that reads\n * the raw service out of context and returns a guarded one in its place.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md`,\n * `docs/specs/Concepts/Effect Taxonomy.md`, and\n * `docs/specs/Concepts/Host Adapters.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport type { Action } from \"@smthrs/capability/Capability\"\nimport { permissionDenied } from \"@smthrs/capability/Permission\"\nimport { Jj, type OperationId, type Revision } from \"@smthrs/jj\"\nimport { Effect, FileSystem as EffectFileSystem, Layer, Path as EffectPath } from \"effect\"\nimport { canonicalResource } from \"./FileSystem.ts\"\nimport { GrantStore } from \"./GrantStore.ts\"\nimport { makeCapability } from \"./internal/makeCapability.ts\"\nimport { Workspace } from \"./Workspace.ts\"\n\n/**\n * `@smthrs/jj`'s own Jujutsu tag, unchanged. Re-exported so the kernel\n * namespace stays one-stop; it is the *same* tag, never a second one.\n *\n * @category services\n * @since 1.0.0-rc.0\n */\nexport { Jj } from \"@smthrs/jj\"\n\n/**\n * Provides an unavailable Jujutsu stub.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport { layerNoop } from \"@smthrs/jj\"\n\n/**\n * Constructs a Jujutsu service from an implementation.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport { make } from \"@smthrs/jj\"\n\n/**\n * Constructs an unavailable Jujutsu stub.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport { makeNoop } from \"@smthrs/jj\"\n\n/**\n * Decorates the Jujutsu service in place with operation-specific capability\n * checks.\n *\n * The layer provides the tag it also requires: compose it over a host jj layer\n * with `Layer.provide` and every consumer of `Jj` — including one that never\n * heard of the kernel — resolves the guarded implementation.\n *\n * `workspaceAdd` canonicalizes its destination and `root` canonicalizes its\n * starting directory through the *raw* filesystem before asking for\n * `jj:workspace-add` and `fs:write`, or for `jj:root`, so an existing symlink\n * cannot turn an inside-workspace grant into outside authority or separate the\n * authorized path from the directory jj is run in.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer: Layer.Layer<\n  Jj,\n  never,\n  Jj | EffectFileSystem.FileSystem | EffectPath.Path | Workspace | GrantStore\n> = Layer.effect(\n  Jj,\n  Effect.gen(function*() {\n    const jj = yield* Jj\n    const jjRoot = jj.root\n    const jjRevert = jj.revert\n    const jjOpRestore = jj.opRestore\n    const fileSystem = yield* EffectFileSystem.FileSystem\n    const path = yield* EffectPath.Path\n    const workspace = yield* Workspace\n    const grants = yield* GrantStore\n    const check = (action: Action, resource: string) =>\n      makeCapability(action, resource).pipe(Effect.flatMap((capability) => grants.check(capability)))\n    return Jj.of({\n      status: Effect.fn(\"Jj.status\")(() => check(\"jj:status\", \".\").pipe(Effect.andThen(jj.status()))),\n      diff: Effect.fn(\"Jj.diff\")((from, to) =>\n        check(\"jj:diff\", `${from}:${to}`).pipe(Effect.andThen(jj.diff(from, to)))\n      ),\n      snapshot: Effect.fn(\"Jj.snapshot\")((message) =>\n        check(\"jj:snapshot\", message ?? \"\").pipe(Effect.andThen(jj.snapshot(message)))\n      ),\n      restore: Effect.fn(\"Jj.restore\")((revision) =>\n        check(\"jj:restore\", revision).pipe(Effect.andThen(jj.restore(revision)))\n      ),\n      workspaceAdd: Effect.fn(\"Jj.workspaceAdd\")((name, destination, revision) =>\n        canonicalResource(fileSystem, path, workspace.root, destination).pipe(\n          Effect.flatMap((resource) =>\n            check(\"jj:workspace-add\", resource).pipe(\n              Effect.andThen(check(\"fs:write\", resource)),\n              Effect.andThen(canonicalResource(fileSystem, path, workspace.root, destination)),\n              Effect.flatMap((settled) =>\n                settled === resource\n                  ? jj.workspaceAdd(name, resource, revision)\n                  : makeCapability(\"jj:workspace-add\", resource).pipe(\n                    Effect.flatMap((capability) =>\n                      Effect.fail(permissionDenied(\n                        capability,\n                        \"workspace destination no longer names the resource that was authorized\"\n                      ))\n                    )\n                  )\n              )\n            )\n          )\n        )\n      ),\n      workspaceForget: Effect.fn(\"Jj.workspaceForget\")((name) =>\n        check(\"jj:workspace-forget\", name).pipe(Effect.andThen(jj.workspaceForget(name)))\n      ),\n      // `root`, `revert`, and `opRestore` are optional on the service, so the decorator\n      // forwards the ABSENCE too. A backend that cannot revert must keep\n      // reading as a backend that cannot revert: replacing it with a guarded\n      // method that fails on call would turn \"this host has no revert\" into\n      // \"your revert was refused\", which is a different answer to a caller\n      // deciding what it can offer.\n      ...jjRoot === undefined ? {} : {\n        root: Effect.fn(\"Jj.root\")((from: string) =>\n          // Canonicalized BEFORE the check, and the canonical path is what jj\n          // is then run in. Checking the caller's spelling and inspecting a\n          // different directory is the whole symlink-alias problem: an\n          // authorized name would decide the answer for a repository the grant\n          // never mentioned.\n          canonicalResource(fileSystem, path, workspace.root, from).pipe(\n            Effect.flatMap((resource) => check(\"jj:root\", resource).pipe(Effect.andThen(jjRoot(resource))))\n          )\n        )\n      },\n      ...jjRevert === undefined ? {} : {\n        revert: Effect.fn(\"Jj.revert\")((revision: Revision) =>\n          check(\"jj:revert\", revision).pipe(Effect.andThen(jjRevert(revision)))\n        )\n      },\n      ...jjOpRestore === undefined ? {} : {\n        opRestore: Effect.fn(\"Jj.opRestore\")((operationId: OperationId) =>\n          check(\"jj:op-restore\", operationId).pipe(Effect.andThen(jjOpRestore(operationId)))\n        )\n      }\n    })\n  })\n)\n"]}

package/dist/esm/JournalGrantStore.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Journal-backed persistence and replay for capability decisions.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Capability from "@smthrs/capability/Capability";
+import { GrantStoreError, Rule } from "@smthrs/capability/Permission";
+import * as JournalModule from "@smthrs/journal/Journal";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as GrantStore from "./GrantStore.ts";
+import { Workspace } from "./Workspace.ts";
+/**
+ * Configuration for a journal-backed grant store.
+ *
+ * `policyRunId` is a deliberately dedicated run containing remembered-policy
+ * events. The journal has no global grant projection, so callers that want
+ * remembered grants to span operational runs must keep this id stable.
+ * `planDigest` binds run grants and envelopes to the exact active plan.
+ * `sourceId` is also checked during replay; events from other producers cannot
+ * activate kernel authority.
+ *
+ * The journal is authoritative permission storage: SqlJournal must use the
+ * `reject` overflow policy. Drop-capable overflow policies are unsupported,
+ * because a dropped grant decision cannot safely be treated as persisted.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface JournalGrantStoreOptions {
+    readonly runId: string;
+    readonly policyRunId: string;
+    readonly sourceId: string;
+    readonly planDigest: string;
+    readonly attended?: boolean;
+    readonly rules?: ReadonlyArray<ReadonlyArray<Rule>>;
+    readonly envelope?: {
+        readonly patterns: ReadonlyArray<Capability.CapabilityPattern>;
+        readonly scope?: "run" | "remembered" | undefined;
+    };
+}
+/**
+ * Makes a grant store that replays remembered policy from, and writes decisions
+ * to, the supplied journal.
+ *
+ * `emitDurable` commits before `GrantStore` activates a remembered or
+ * run-scoped rule (or resolves a denial). Any journal failure is mapped to
+ * `journal_failed`, so permission decisions fail closed.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const make: (options: JournalGrantStoreOptions) => Effect.Effect<GrantStore.Service, GrantStoreError, import("effect/Scope").Scope | Workspace | JournalModule.Journal>;
+/**
+ * Provides a journal-backed `GrantStore`.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: (options: JournalGrantStoreOptions) => Layer.Layer<GrantStore.GrantStore, GrantStoreError, Workspace | JournalModule.Journal>;
+//# sourceMappingURL=JournalGrantStore.d.ts.map

package/dist/esm/JournalGrantStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JournalGrantStore.d.ts","sourceRoot":"","sources":["../../src/JournalGrantStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AAExD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAIrC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAA;QAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,CAAA;KAClD,CAAA;CACF;AAoPD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,GAAI,SAAS,wBAAwB,yHAmJlD,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,SAAS,wBAAwB,2FAAuD,CAAA"}

package/dist/esm/JournalGrantStore.js

@@ -0,0 +1,350 @@
+/**
+ * Journal-backed persistence and replay for capability decisions.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import * as Capability from "@smthrs/capability/Capability";
+import { GrantStoreError, Rule } from "@smthrs/capability/Permission";
+import * as JournalModule from "@smthrs/journal/Journal";
+import * as JournalEvent from "@smthrs/journal/JournalEvent";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import * as Semaphore from "effect/Semaphore";
+import { decode, GrantEventSchema } from "./GrantEvent.js";
+import * as GrantStore from "./GrantStore.js";
+import { Workspace } from "./Workspace.js";
+const journalFailed = (message, cause) => new GrantStoreError({
+    code: "journal_failed",
+    message,
+    cause
+});
+const knownEventTypes = new Set([
+    "flows.kernel.grant.once.v1",
+    "flows.kernel.grant.run.v1",
+    "flows.kernel.grant.run.v2",
+    "flows.kernel.grant.remembered.v1",
+    "flows.kernel.grant.denied.v1",
+    "flows.kernel.grant.envelope.v1"
+]);
+const invalidReplay = (message) => new GrantStoreError({ code: "invalid_resolution", message });
+const appendReplayedRule = (rules, seen, pattern) => {
+    const rule = new Rule({ effect: "allow", pattern });
+    const key = Capability.format(rule.pattern);
+    if (seen.has(key))
+        return;
+    seen.add(key);
+    rules.push(rule);
+};
+const validId = (value) => {
+    if (typeof value !== "string" || value.length === 0 || value.length > GrantStore.maximumIdentityLength)
+        return false;
+    for (let index = 0; index < value.length; index += 1) {
+        const unit = value.charCodeAt(index);
+        if (unit === 0)
+            return false;
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return false;
+            index += 1;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff) {
+            return false;
+        }
+    }
+    return true;
+};
+const encodeGrantEvent = Schema.encodeSync(GrantEventSchema);
+// Replay reads two runs (`policyRunId` and `runId`) and journal sequences are
+// per run, so every refusal names the run it was replaying: the operator then
+// knows which journal run to inspect. Replay always reads a run from its start
+// and never consults a checkpoint, so compacting a run it replays makes every
+// later construction fail `compacted`.
+const decodeTrustedEntry = (entry, sourceId, runId) => {
+    if (entry.sourceId !== sourceId || !knownEventTypes.has(entry.eventType)) {
+        return Effect.succeed(undefined);
+    }
+    if (entry.eventType === "flows.kernel.grant.run.v1") {
+        return Effect.fail(invalidReplay(`legacy run grant has no captured ceiling in run ${runId} at journal sequence ${entry.seq}`));
+    }
+    const event = decode(entry.payload);
+    if (event._tag === "Failure") {
+        return Effect.fail(invalidReplay(`invalid grant payload in run ${runId} at journal sequence ${entry.seq}`));
+    }
+    if (event.success.eventType !== entry.eventType) {
+        return Effect.fail(invalidReplay(`grant envelope/payload type mismatch in run ${runId} at journal sequence ${entry.seq}`));
+    }
+    return Effect.succeed(event.success);
+};
+// One construction-envelope critical section per Journal service instance.
+// Two concurrent constructors sharing one service object can both replay the
+// envelope's absence before either persists it; the lock serializes the
+// re-check-then-append so exactly one construction envelope lands.
+//
+// The guarantee stops at the service object. The lock is a WeakMap keyed by
+// the in-memory `Journal.Service`, and the persisted Input carries no
+// `sourceSeq` or `dedupe` key, so two service objects over one backing journal
+// (two processes, or two connections in one process) each hold their own
+// permit and can both append the envelope. Replay tolerates the duplicate:
+// the signature set collapses it and the rules are identical.
+const constructionLocks = new WeakMap();
+const constructionLock = (journal) => {
+    const existing = constructionLocks.get(journal);
+    if (existing !== undefined) {
+        return existing;
+    }
+    const created = Semaphore.makeUnsafe(1);
+    constructionLocks.set(journal, created);
+    return created;
+};
+const replayRememberedRules = (policyRunId, sourceId, workspaceRoot) => Effect.gen(function* () {
+    const journal = yield* JournalModule.Journal;
+    const rules = [];
+    const seenRules = new Set();
+    const envelopeSignatures = new Set();
+    let after;
+    do {
+        const page = yield* journal.entries({
+            runId: policyRunId,
+            ...(after === undefined ? {} : { after }),
+            limit: 256
+        });
+        const last = page.entries.at(-1);
+        if (last !== undefined && after !== undefined && last.seq <= after) {
+            // A page that does not advance past the cursor it was asked for is
+            // corrupt journal output. Following it would replay the same events
+            // forever; accepting it would double-apply them. Refuse construction.
+            return yield* Effect.fail(invalidReplay(`non-advancing journal page in run ${policyRunId} at sequence ${last.seq}`));
+        }
+        for (const entry of page.entries) {
+            const event = yield* decodeTrustedEntry(entry, sourceId, policyRunId);
+            if (event === undefined) {
+                continue;
+            }
+            if (event.eventType === "flows.kernel.grant.remembered.v1") {
+                if (!GrantStore.isValidGrantPattern(event.pattern, event.capability, event.tier, workspaceRoot)) {
+                    return yield* Effect.fail(invalidReplay(`unsafe remembered grant event in run ${policyRunId} at sequence ${entry.seq}`));
+                }
+                appendReplayedRule(rules, seenRules, event.pattern);
+                continue;
+            }
+            if (event.eventType === "flows.kernel.grant.envelope.v1" && event.scope === "remembered") {
+                if (event.patterns.some((pattern) => !GrantStore.isValidEnvelopePattern(pattern, workspaceRoot))) {
+                    return yield* Effect.fail(invalidReplay(`unsafe remembered envelope event in run ${policyRunId} at sequence ${entry.seq}`));
+                }
+                for (const pattern of event.patterns)
+                    appendReplayedRule(rules, seenRules, pattern);
+                envelopeSignatures.add(GrantStore.envelopeSignature(event.planDigest, event.scope, event.patterns));
+                continue;
+            }
+            return yield* Effect.fail(invalidReplay(`run-scoped event found in policy journal run ${policyRunId} at sequence ${entry.seq}`));
+        }
+        after = last?.seq;
+        if (!page.hasMore) {
+            return { rules, envelopeSignatures };
+        }
+    } while (after !== undefined);
+    return { rules, envelopeSignatures };
+});
+const replayRunRules = (runId, sourceId, planDigest, workspaceRoot) => Effect.gen(function* () {
+    const journal = yield* JournalModule.Journal;
+    const rules = [];
+    const seenRules = new Set();
+    const envelopeSignatures = new Set();
+    let after;
+    do {
+        const page = yield* journal.entries({
+            runId: runId,
+            ...(after === undefined ? {} : { after }),
+            limit: 256
+        });
+        const last = page.entries.at(-1);
+        if (last !== undefined && after !== undefined && last.seq <= after) {
+            // See the identical guard in `replayRememberedRules`.
+            return yield* Effect.fail(invalidReplay(`non-advancing journal page in run ${runId} at sequence ${last.seq}`));
+        }
+        for (const entry of page.entries) {
+            const event = yield* decodeTrustedEntry(entry, sourceId, runId);
+            if (event === undefined) {
+                continue;
+            }
+            if (event.runId !== runId) {
+                return yield* Effect.fail(invalidReplay(`grant payload run mismatch in run ${runId} at journal sequence ${entry.seq}`));
+            }
+            if (event.eventType === "flows.kernel.grant.once.v1" || event.eventType === "flows.kernel.grant.denied.v1") {
+                continue;
+            }
+            if (event.eventType === "flows.kernel.grant.run.v2") {
+                if (event.planDigest !== planDigest) {
+                    continue;
+                }
+                if (!GrantStore.isValidGrantPattern(event.pattern, event.capability, event.tier, workspaceRoot)) {
+                    return yield* Effect.fail(invalidReplay(`unsafe run grant event in run ${runId} at sequence ${entry.seq}`));
+                }
+                const key = `run:${JSON.stringify([event.pattern, event.ceiling])}`;
+                if (!seenRules.has(key)) {
+                    seenRules.add(key);
+                    rules.push({ rule: new Rule({ effect: "allow", pattern: event.pattern }), ceiling: event.ceiling });
+                }
+                continue;
+            }
+            if (event.eventType === "flows.kernel.grant.envelope.v1" && event.scope === "run") {
+                if (event.planDigest !== planDigest) {
+                    continue;
+                }
+                if (event.patterns.some((pattern) => !GrantStore.isValidEnvelopePattern(pattern, workspaceRoot))) {
+                    return yield* Effect.fail(invalidReplay(`unsafe run envelope event in run ${runId} at sequence ${entry.seq}`));
+                }
+                for (const pattern of event.patterns)
+                    appendReplayedRule(rules, seenRules, pattern);
+                envelopeSignatures.add(GrantStore.envelopeSignature(event.planDigest, event.scope, event.patterns));
+                continue;
+            }
+            return yield* Effect.fail(invalidReplay(`remembered event found in run journal ${runId} at sequence ${entry.seq}`));
+        }
+        after = last?.seq;
+        if (!page.hasMore) {
+            return { rules, envelopeSignatures };
+        }
+    } while (after !== undefined);
+    return { rules, envelopeSignatures };
+});
+/**
+ * Makes a grant store that replays remembered policy from, and writes decisions
+ * to, the supplied journal.
+ *
+ * `emitDurable` commits before `GrantStore` activates a remembered or
+ * run-scoped rule (or resolves a denial). Any journal failure is mapped to
+ * `journal_failed`, so permission decisions fail closed.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export const make = (options) => Effect.gen(function* () {
+    const runId = options.runId;
+    const policyRunId = options.policyRunId;
+    const sourceId = options.sourceId;
+    const planDigest = options.planDigest;
+    if (!validId(runId))
+        return yield* Effect.fail(invalidReplay("runId must be non-empty, bounded, well-formed text"));
+    if (!validId(policyRunId)) {
+        return yield* Effect.fail(invalidReplay("policyRunId must be non-empty, bounded, well-formed text"));
+    }
+    if (!validId(sourceId)) {
+        return yield* Effect.fail(invalidReplay("sourceId must be non-empty, bounded, well-formed text"));
+    }
+    if (!validId(planDigest)) {
+        return yield* Effect.fail(invalidReplay("planDigest must be non-empty, bounded, well-formed text"));
+    }
+    if (runId === policyRunId) {
+        return yield* Effect.fail(invalidReplay("runId and policyRunId must be distinct"));
+    }
+    const journal = yield* JournalModule.Journal;
+    const workspace = yield* Workspace;
+    const replayPolicy = replayRememberedRules(policyRunId, sourceId, workspace.root).pipe(Effect.mapError((cause) => cause instanceof GrantStoreError ? cause : journalFailed("could not replay remembered grants", cause)));
+    const replayRun = replayRunRules(runId, sourceId, planDigest, workspace.root).pipe(Effect.mapError((cause) => cause instanceof GrantStoreError ? cause : journalFailed("could not replay run grants", cause)));
+    let replayedPolicy = yield* replayPolicy;
+    let replayedRun = yield* replayRun;
+    const persist = (event) => {
+        const payload = encodeGrantEvent(event);
+        return Effect.gen(function* () {
+            // Unfenced: the grant store is the kernel's own ledger, not a run's
+            // lifecycle — it owns no run, and grant admissions are
+            // first-writer-wins records replayed by every later process.
+            yield* journal.emitDurableUnfenced(new JournalEvent.Input({
+                runId: (event.eventType === "flows.kernel.grant.remembered.v1"
+                    || (event.eventType === "flows.kernel.grant.envelope.v1" && event.scope === "remembered")
+                    ? policyRunId
+                    : runId),
+                sourceId: sourceId,
+                eventType: event.eventType,
+                payload
+            }));
+        }).pipe(Effect.mapError((cause) => journalFailed("could not persist grant event", cause)), Effect.asVoid);
+    };
+    const envelope = options.envelope;
+    const build = () => {
+        const configuredCount = options.rules?.reduce((count, rules) => count + rules.length, 0) ?? 0;
+        const rememberedCount = replayedPolicy.rules.length;
+        const runCount = replayedRun.rules.length;
+        const total = configuredCount + rememberedCount + runCount;
+        if (total > GrantStore.maximumRules) {
+            return Effect.fail(invalidReplay(`policy run ${policyRunId} replayed ${rememberedCount} remembered rules; configured rules (${configuredCount}) and replayed run rules (${runCount}) bring the total to ${total}, which exceeds the ${GrantStore.maximumRules}-rule ceiling; remove configured rules or start a new policyRunId and grant again`));
+        }
+        // Envelope signatures accumulate in the policy journal exactly the way
+        // remembered rules do, and `GrantStore.make` refuses more than
+        // `maximumRules` of them with a message that names neither the journal
+        // nor the counts. Diagnose it here instead, so an operator reading the
+        // failure knows which policy run filled rather than which field overflowed.
+        const policySignatureCount = replayedPolicy.envelopeSignatures.size;
+        const runSignatureCount = replayedRun.envelopeSignatures.size;
+        const signatureTotal = policySignatureCount + runSignatureCount;
+        if (signatureTotal > GrantStore.maximumRules) {
+            return Effect.fail(invalidReplay(`policy run ${policyRunId} replayed ${policySignatureCount} remembered envelope signatures; replayed run envelope signatures (${runSignatureCount}) bring the total to ${signatureTotal}, which exceeds the ${GrantStore.maximumRules}-envelope-signature ceiling; start a new policyRunId and grant again`));
+        }
+        // GrantStore's shared envelope admission adds only patterns not already
+        // replayed for a seeded envelope, and checks the combined rule and
+        // signature counts before any construction event is persisted.
+        return GrantStore.make({
+            runId,
+            planDigest,
+            ...(options.attended === undefined ? {} : { attended: options.attended }),
+            rules: options.rules === undefined || options.rules.length === 0
+                ? [[], replayedPolicy.rules]
+                : [...options.rules, replayedPolicy.rules],
+            runRules: replayedRun.rules,
+            envelopeSignatures: [
+                ...replayedPolicy.envelopeSignatures,
+                ...replayedRun.envelopeSignatures
+            ],
+            ...(envelope === undefined ? {} : {
+                envelope: {
+                    planDigest,
+                    patterns: envelope.patterns,
+                    ...(envelope.scope === undefined ? {} : { scope: envelope.scope })
+                }
+            }),
+            persist
+        });
+    };
+    if (envelope === undefined || envelope.patterns.length === 0) {
+        return yield* build();
+    }
+    const scope = envelope.scope ?? "run";
+    const signature = GrantStore.envelopeSignature(planDigest, scope, envelope.patterns);
+    const replayedSignatures = scope === "remembered"
+        ? replayedPolicy.envelopeSignatures
+        : replayedRun.envelopeSignatures;
+    if (replayedSignatures.has(signature)) {
+        // Already durable: the seeded signature makes the construction envelope
+        // activate without persisting again.
+        return yield* build();
+    }
+    // The envelope was absent when this constructor replayed, but a concurrent
+    // constructor sharing this Journal service may persist it before we do.
+    // Re-replay the target run inside the per-service critical section, so
+    // exactly one such constructor appends the envelope and every other one
+    // replays it instead.
+    return yield* constructionLock(journal).withPermit(Effect.gen(function* () {
+        if (scope === "remembered") {
+            replayedPolicy = yield* replayPolicy;
+        }
+        else {
+            replayedRun = yield* replayRun;
+        }
+        return yield* build();
+    }));
+});
+/**
+ * Provides a journal-backed `GrantStore`.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layer = (options) => Layer.effect(GrantStore.GrantStore)(make(options));
+//# sourceMappingURL=JournalGrantStore.js.map

package/dist/esm/JournalGrantStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JournalGrantStore.js","sourceRoot":"","sources":["../../src/JournalGrantStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,KAAK,aAAa,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,SAAS,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAmB,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAgC1C,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,KAAc,EAAmB,EAAE,CACzE,IAAI,eAAe,CAAC;IAClB,IAAI,EAAE,gBAAgB;IACtB,OAAO;IACP,KAAK;CACN,CAAC,CAAA;AAEJ,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,4BAA4B;IAC5B,2BAA2B;IAC3B,2BAA2B;IAC3B,kCAAkC;IAClC,8BAA8B;IAC9B,gCAAgC;CACjC,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,OAAe,EAAmB,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAA;AAExH,MAAM,kBAAkB,GAAG,CACzB,KAAqE,EACrE,IAAiB,EACjB,OAAqC,EAC/B,EAAE;IACR,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAM;IACzB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACb,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,qBAAqB;QAAE,OAAO,KAAK,CAAA;IACpH,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5B,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACxC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;YACrD,KAAK,IAAI,CAAC,CAAA;QACZ,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;AAE5D,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,kBAAkB,GAAG,CACzB,KAAyB,EACzB,QAAgB,EAChB,KAAa,EAC2C,EAAE;IAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAClC,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,2BAA2B,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,IAAI,CAChB,aAAa,CAAC,mDAAmD,KAAK,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAC3G,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,gCAAgC,KAAK,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,IAAI,CAChB,aAAa,CAAC,+CAA+C,KAAK,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CACvG,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACtC,CAAC,CAAA;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,mEAAmE;AACnE,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,+EAA+E;AAC/E,yEAAyE;AACzE,2EAA2E;AAC3E,8DAA8D;AAC9D,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAA8C,CAAA;AAEnF,MAAM,gBAAgB,GAAG,CAAC,OAA8B,EAAuB,EAAE;IAC/E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACvC,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAC5B,WAAmB,EACnB,QAAgB,EAChB,aAAqB,EACrB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAA;IAC5C,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC5C,IAAI,KAAmC,CAAA;IAEvC,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,WAAiC;YACxC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,sEAAsE;YACtE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,qCAAqC,WAAW,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,CAC1F,CAAA;QACH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;YACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,kCAAkC,EAAE,CAAC;gBAC3D,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;oBAChG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,wCAAwC,WAAW,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAC9F,CAAA;gBACH,CAAC;gBACD,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBACnD,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,gCAAgC,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;gBACzF,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;oBACjG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,2CAA2C,WAAW,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CACjG,CAAA;gBACH,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ;oBAAE,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;gBACnF,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACnG,SAAQ;YACV,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,gDAAgD,WAAW,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CACtG,CAAA;QACH,CAAC;QACD,KAAK,GAAG,IAAI,EAAE,GAAG,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;QACtC,CAAC;IACH,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAC;IAE7B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;AACtC,CAAC,CAAC,CAAA;AAEJ,MAAM,cAAc,GAAG,CACrB,KAAa,EACb,QAAgB,EAChB,UAAkB,EAClB,aAAqB,EACrB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAA;IAC5C,MAAM,KAAK,GAAmE,EAAE,CAAA;IAChF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC5C,IAAI,KAAmC,CAAA;IAEvC,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,KAA2B;YAClC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YACzC,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC;YACnE,sDAAsD;YACtD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,qCAAqC,KAAK,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAChH,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;YAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,qCAAqC,KAAK,wBAAwB,KAAK,CAAC,GAAG,EAAE,CAAC,CAC7F,CAAA;YACH,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,4BAA4B,IAAI,KAAK,CAAC,SAAS,KAAK,8BAA8B,EAAE,CAAC;gBAC3G,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,2BAA2B,EAAE,CAAC;gBACpD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACpC,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;oBAChG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,iCAAiC,KAAK,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;gBAC7G,CAAC;gBACD,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAA;gBACnE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBAClB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBACrG,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,gCAAgC,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAClF,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBACpC,SAAQ;gBACV,CAAC;gBACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,sBAAsB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;oBACjG,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,oCAAoC,KAAK,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CACpF,CAAA;gBACH,CAAC;gBACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ;oBAAE,kBAAkB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;gBACnF,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;gBACnG,SAAQ;YACV,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,aAAa,CAAC,yCAAyC,KAAK,gBAAgB,KAAK,CAAC,GAAG,EAAE,CAAC,CACzF,CAAA;QACH,CAAC;QACD,KAAK,GAAG,IAAI,EAAE,GAAG,CAAA;QACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;QACtC,CAAC;IACH,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAC;IAE7B,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAA;AACtC,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAiC,EAAE,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,oDAAoD,CAAC,CAAC,CAAA;IACnH,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,0DAA0D,CAAC,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,uDAAuD,CAAC,CAAC,CAAA;IACnG,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,yDAAyD,CAAC,CAAC,CAAA;IACrG,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,wCAAwC,CAAC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,OAAO,CAAA;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAClC,MAAM,YAAY,GAAG,qBAAqB,CACxC,WAAW,EACX,QAAQ,EACR,SAAS,CAAC,IAAI,CACf,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,oCAAoC,EAAE,KAAK,CAAC,CACtG,CACF,CAAA;IACD,MAAM,SAAS,GAAG,cAAc,CAC9B,KAAK,EACL,QAAQ,EACR,UAAU,EACV,SAAS,CAAC,IAAI,CACf,CAAC,IAAI,CACJ,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAC/F,CACF,CAAA;IACD,IAAI,cAAc,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IACxC,IAAI,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;IAClC,MAAM,OAAO,GAAG,CAAC,KAAiB,EAAwC,EAAE;QAC1E,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACvC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzB,oEAAoE;YACpE,uDAAuD;YACvD,6DAA6D;YAC7D,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAChC,IAAI,YAAY,CAAC,KAAK,CAAC;gBACrB,KAAK,EAAE,CACL,KAAK,CAAC,SAAS,KAAK,kCAAkC;uBACjD,CAAC,KAAK,CAAC,SAAS,KAAK,gCAAgC,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,CAAC;oBACzF,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,KAAK,CACY;gBACvB,QAAQ,EAAE,QAAiC;gBAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO;aACR,CAAC,CACH,CAAA;QACH,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC,EACjF,MAAM,CAAC,MAAM,CACd,CAAA;IACH,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7F,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAA;QACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,MAAM,KAAK,GAAG,eAAe,GAAG,eAAe,GAAG,QAAQ,CAAA;QAC1D,IAAI,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,IAAI,CAChB,aAAa,CACX,cAAc,WAAW,aAAa,eAAe,wCAAwC,eAAe,6BAA6B,QAAQ,wBAAwB,KAAK,uBAAuB,UAAU,CAAC,YAAY,mFAAmF,CAChT,CACF,CAAA;QACH,CAAC;QACD,uEAAuE;QACvE,+DAA+D;QAC/D,uEAAuE;QACvE,uEAAuE;QACvE,4EAA4E;QAC5E,MAAM,oBAAoB,GAAG,cAAc,CAAC,kBAAkB,CAAC,IAAI,CAAA;QACnE,MAAM,iBAAiB,GAAG,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAA;QAC7D,MAAM,cAAc,GAAG,oBAAoB,GAAG,iBAAiB,CAAA;QAC/D,IAAI,cAAc,GAAG,UAAU,CAAC,YAAY,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,IAAI,CAChB,aAAa,CACX,cAAc,WAAW,aAAa,oBAAoB,sEAAsE,iBAAiB,wBAAwB,cAAc,uBAAuB,UAAU,CAAC,YAAY,sEAAsE,CAC5S,CACF,CAAA;QACH,CAAC;QACD,wEAAwE;QACxE,mEAAmE;QACnE,+DAA+D;QAC/D,OAAO,UAAU,CAAC,IAAI,CAAC;YACrB,KAAK;YACL,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzE,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAC9D,CAAC,CAAC,CAAC,EAAE,EAAE,cAAc,CAAC,KAAK,CAAC;gBAC5B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;YAC5C,QAAQ,EAAE,WAAW,CAAC,KAAK;YAC3B,kBAAkB,EAAE;gBAClB,GAAG,cAAc,CAAC,kBAAkB;gBACpC,GAAG,WAAW,CAAC,kBAAkB;aAClC;YACD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChC,QAAQ,EAAE;oBACR,UAAU;oBACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;iBACnE;aACF,CAAC;YACF,OAAO;SACR,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAA;IACrC,MAAM,SAAS,GAAG,UAAU,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACpF,MAAM,kBAAkB,GAAG,KAAK,KAAK,YAAY;QAC/C,CAAC,CAAC,cAAc,CAAC,kBAAkB;QACnC,CAAC,CAAC,WAAW,CAAC,kBAAkB,CAAA;IAClC,IAAI,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,wEAAwE;QACxE,qCAAqC;QACrC,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC;IACD,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,sBAAsB;IACtB,OAAO,KAAK,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,UAAU,CAChD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;YAC3B,cAAc,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;QACtC,CAAC;aAAM,CAAC;YACN,WAAW,GAAG,KAAK,CAAC,CAAC,SAAS,CAAA;QAChC,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAiC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA","sourcesContent":["/**\n * Journal-backed persistence and replay for capability decisions.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md` and\n * `docs/specs/Concepts/Journal Queue.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport * as Capability from \"@smthrs/capability/Capability\"\nimport { GrantStoreError, Rule } from \"@smthrs/capability/Permission\"\nimport * as JournalModule from \"@smthrs/journal/Journal\"\nimport * as JournalEvent from \"@smthrs/journal/JournalEvent\"\nimport * as Effect from \"effect/Effect\"\nimport * as Layer from \"effect/Layer\"\nimport * as Schema from \"effect/Schema\"\nimport * as Semaphore from \"effect/Semaphore\"\nimport { decode, type GrantEvent, GrantEventSchema } from \"./GrantEvent.ts\"\nimport * as GrantStore from \"./GrantStore.ts\"\nimport { Workspace } from \"./Workspace.ts\"\n\n/**\n * Configuration for a journal-backed grant store.\n *\n * `policyRunId` is a deliberately dedicated run containing remembered-policy\n * events. The journal has no global grant projection, so callers that want\n * remembered grants to span operational runs must keep this id stable.\n * `planDigest` binds run grants and envelopes to the exact active plan.\n * `sourceId` is also checked during replay; events from other producers cannot\n * activate kernel authority.\n *\n * The journal is authoritative permission storage: SqlJournal must use the\n * `reject` overflow policy. Drop-capable overflow policies are unsupported,\n * because a dropped grant decision cannot safely be treated as persisted.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport interface JournalGrantStoreOptions {\n  readonly runId: string\n  readonly policyRunId: string\n  readonly sourceId: string\n  readonly planDigest: string\n  readonly attended?: boolean\n  readonly rules?: ReadonlyArray<ReadonlyArray<Rule>>\n  readonly envelope?: {\n    readonly patterns: ReadonlyArray<Capability.CapabilityPattern>\n    readonly scope?: \"run\" | \"remembered\" | undefined\n  }\n}\n\nconst journalFailed = (message: string, cause: unknown): GrantStoreError =>\n  new GrantStoreError({\n    code: \"journal_failed\",\n    message,\n    cause\n  })\n\nconst knownEventTypes: ReadonlySet<string> = new Set([\n  \"flows.kernel.grant.once.v1\",\n  \"flows.kernel.grant.run.v1\",\n  \"flows.kernel.grant.run.v2\",\n  \"flows.kernel.grant.remembered.v1\",\n  \"flows.kernel.grant.denied.v1\",\n  \"flows.kernel.grant.envelope.v1\"\n])\n\nconst invalidReplay = (message: string): GrantStoreError => new GrantStoreError({ code: \"invalid_resolution\", message })\n\nconst appendReplayedRule = (\n  rules: Array<NonNullable<GrantStore.MakeOptions[\"runRules\"]>[number]>,\n  seen: Set<string>,\n  pattern: Capability.CapabilityPattern\n): void => {\n  const rule = new Rule({ effect: \"allow\", pattern })\n  const key = Capability.format(rule.pattern)\n  if (seen.has(key)) return\n  seen.add(key)\n  rules.push(rule)\n}\n\nconst validId = (value: unknown): value is string => {\n  if (typeof value !== \"string\" || value.length === 0 || value.length > GrantStore.maximumIdentityLength) return false\n  for (let index = 0; index < value.length; index += 1) {\n    const unit = value.charCodeAt(index)\n    if (unit === 0) return false\n    if (unit >= 0xd800 && unit <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index += 1\n    } else if (unit >= 0xdc00 && unit <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n\nconst encodeGrantEvent = Schema.encodeSync(GrantEventSchema)\n\n// Replay reads two runs (`policyRunId` and `runId`) and journal sequences are\n// per run, so every refusal names the run it was replaying: the operator then\n// knows which journal run to inspect. Replay always reads a run from its start\n// and never consults a checkpoint, so compacting a run it replays makes every\n// later construction fail `compacted`.\nconst decodeTrustedEntry = (\n  entry: JournalEvent.Entry,\n  sourceId: string,\n  runId: string\n): Effect.Effect<GrantEvent | undefined, GrantStoreError> => {\n  if (entry.sourceId !== sourceId || !knownEventTypes.has(entry.eventType)) {\n    return Effect.succeed(undefined)\n  }\n  if (entry.eventType === \"flows.kernel.grant.run.v1\") {\n    return Effect.fail(\n      invalidReplay(`legacy run grant has no captured ceiling in run ${runId} at journal sequence ${entry.seq}`)\n    )\n  }\n  const event = decode(entry.payload)\n  if (event._tag === \"Failure\") {\n    return Effect.fail(invalidReplay(`invalid grant payload in run ${runId} at journal sequence ${entry.seq}`))\n  }\n  if (event.success.eventType !== entry.eventType) {\n    return Effect.fail(\n      invalidReplay(`grant envelope/payload type mismatch in run ${runId} at journal sequence ${entry.seq}`)\n    )\n  }\n  return Effect.succeed(event.success)\n}\n\n// One construction-envelope critical section per Journal service instance.\n// Two concurrent constructors sharing one service object can both replay the\n// envelope's absence before either persists it; the lock serializes the\n// re-check-then-append so exactly one construction envelope lands.\n//\n// The guarantee stops at the service object. The lock is a WeakMap keyed by\n// the in-memory `Journal.Service`, and the persisted Input carries no\n// `sourceSeq` or `dedupe` key, so two service objects over one backing journal\n// (two processes, or two connections in one process) each hold their own\n// permit and can both append the envelope. Replay tolerates the duplicate:\n// the signature set collapses it and the rules are identical.\nconst constructionLocks = new WeakMap<JournalModule.Service, Semaphore.Semaphore>()\n\nconst constructionLock = (journal: JournalModule.Service): Semaphore.Semaphore => {\n  const existing = constructionLocks.get(journal)\n  if (existing !== undefined) {\n    return existing\n  }\n  const created = Semaphore.makeUnsafe(1)\n  constructionLocks.set(journal, created)\n  return created\n}\n\nconst replayRememberedRules = (\n  policyRunId: string,\n  sourceId: string,\n  workspaceRoot: string\n) =>\n  Effect.gen(function*() {\n    const journal = yield* JournalModule.Journal\n    const rules: Array<Rule> = []\n    const seenRules = new Set<string>()\n    const envelopeSignatures = new Set<string>()\n    let after: JournalEvent.Seq | undefined\n\n    do {\n      const page = yield* journal.entries({\n        runId: policyRunId as JournalEvent.RunId,\n        ...(after === undefined ? {} : { after }),\n        limit: 256\n      })\n      const last = page.entries.at(-1)\n      if (last !== undefined && after !== undefined && last.seq <= after) {\n        // A page that does not advance past the cursor it was asked for is\n        // corrupt journal output. Following it would replay the same events\n        // forever; accepting it would double-apply them. Refuse construction.\n        return yield* Effect.fail(\n          invalidReplay(`non-advancing journal page in run ${policyRunId} at sequence ${last.seq}`)\n        )\n      }\n      for (const entry of page.entries) {\n        const event = yield* decodeTrustedEntry(entry, sourceId, policyRunId)\n        if (event === undefined) {\n          continue\n        }\n        if (event.eventType === \"flows.kernel.grant.remembered.v1\") {\n          if (!GrantStore.isValidGrantPattern(event.pattern, event.capability, event.tier, workspaceRoot)) {\n            return yield* Effect.fail(\n              invalidReplay(`unsafe remembered grant event in run ${policyRunId} at sequence ${entry.seq}`)\n            )\n          }\n          appendReplayedRule(rules, seenRules, event.pattern)\n          continue\n        }\n        if (event.eventType === \"flows.kernel.grant.envelope.v1\" && event.scope === \"remembered\") {\n          if (event.patterns.some((pattern) => !GrantStore.isValidEnvelopePattern(pattern, workspaceRoot))) {\n            return yield* Effect.fail(\n              invalidReplay(`unsafe remembered envelope event in run ${policyRunId} at sequence ${entry.seq}`)\n            )\n          }\n          for (const pattern of event.patterns) appendReplayedRule(rules, seenRules, pattern)\n          envelopeSignatures.add(GrantStore.envelopeSignature(event.planDigest, event.scope, event.patterns))\n          continue\n        }\n        return yield* Effect.fail(\n          invalidReplay(`run-scoped event found in policy journal run ${policyRunId} at sequence ${entry.seq}`)\n        )\n      }\n      after = last?.seq\n      if (!page.hasMore) {\n        return { rules, envelopeSignatures }\n      }\n    } while (after !== undefined)\n\n    return { rules, envelopeSignatures }\n  })\n\nconst replayRunRules = (\n  runId: string,\n  sourceId: string,\n  planDigest: string,\n  workspaceRoot: string\n) =>\n  Effect.gen(function*() {\n    const journal = yield* JournalModule.Journal\n    const rules: Array<NonNullable<GrantStore.MakeOptions[\"runRules\"]>[number]> = []\n    const seenRules = new Set<string>()\n    const envelopeSignatures = new Set<string>()\n    let after: JournalEvent.Seq | undefined\n\n    do {\n      const page = yield* journal.entries({\n        runId: runId as JournalEvent.RunId,\n        ...(after === undefined ? {} : { after }),\n        limit: 256\n      })\n      const last = page.entries.at(-1)\n      if (last !== undefined && after !== undefined && last.seq <= after) {\n        // See the identical guard in `replayRememberedRules`.\n        return yield* Effect.fail(invalidReplay(`non-advancing journal page in run ${runId} at sequence ${last.seq}`))\n      }\n      for (const entry of page.entries) {\n        const event = yield* decodeTrustedEntry(entry, sourceId, runId)\n        if (event === undefined) {\n          continue\n        }\n        if (event.runId !== runId) {\n          return yield* Effect.fail(\n            invalidReplay(`grant payload run mismatch in run ${runId} at journal sequence ${entry.seq}`)\n          )\n        }\n        if (event.eventType === \"flows.kernel.grant.once.v1\" || event.eventType === \"flows.kernel.grant.denied.v1\") {\n          continue\n        }\n        if (event.eventType === \"flows.kernel.grant.run.v2\") {\n          if (event.planDigest !== planDigest) {\n            continue\n          }\n          if (!GrantStore.isValidGrantPattern(event.pattern, event.capability, event.tier, workspaceRoot)) {\n            return yield* Effect.fail(invalidReplay(`unsafe run grant event in run ${runId} at sequence ${entry.seq}`))\n          }\n          const key = `run:${JSON.stringify([event.pattern, event.ceiling])}`\n          if (!seenRules.has(key)) {\n            seenRules.add(key)\n            rules.push({ rule: new Rule({ effect: \"allow\", pattern: event.pattern }), ceiling: event.ceiling })\n          }\n          continue\n        }\n        if (event.eventType === \"flows.kernel.grant.envelope.v1\" && event.scope === \"run\") {\n          if (event.planDigest !== planDigest) {\n            continue\n          }\n          if (event.patterns.some((pattern) => !GrantStore.isValidEnvelopePattern(pattern, workspaceRoot))) {\n            return yield* Effect.fail(\n              invalidReplay(`unsafe run envelope event in run ${runId} at sequence ${entry.seq}`)\n            )\n          }\n          for (const pattern of event.patterns) appendReplayedRule(rules, seenRules, pattern)\n          envelopeSignatures.add(GrantStore.envelopeSignature(event.planDigest, event.scope, event.patterns))\n          continue\n        }\n        return yield* Effect.fail(\n          invalidReplay(`remembered event found in run journal ${runId} at sequence ${entry.seq}`)\n        )\n      }\n      after = last?.seq\n      if (!page.hasMore) {\n        return { rules, envelopeSignatures }\n      }\n    } while (after !== undefined)\n\n    return { rules, envelopeSignatures }\n  })\n\n/**\n * Makes a grant store that replays remembered policy from, and writes decisions\n * to, the supplied journal.\n *\n * `emitDurable` commits before `GrantStore` activates a remembered or\n * run-scoped rule (or resolves a denial). Any journal failure is mapped to\n * `journal_failed`, so permission decisions fail closed.\n *\n * @category constructors\n * @since 1.0.0-rc.0\n */\nexport const make = (options: JournalGrantStoreOptions) =>\n  Effect.gen(function*() {\n    const runId = options.runId\n    const policyRunId = options.policyRunId\n    const sourceId = options.sourceId\n    const planDigest = options.planDigest\n    if (!validId(runId)) return yield* Effect.fail(invalidReplay(\"runId must be non-empty, bounded, well-formed text\"))\n    if (!validId(policyRunId)) {\n      return yield* Effect.fail(invalidReplay(\"policyRunId must be non-empty, bounded, well-formed text\"))\n    }\n    if (!validId(sourceId)) {\n      return yield* Effect.fail(invalidReplay(\"sourceId must be non-empty, bounded, well-formed text\"))\n    }\n    if (!validId(planDigest)) {\n      return yield* Effect.fail(invalidReplay(\"planDigest must be non-empty, bounded, well-formed text\"))\n    }\n    if (runId === policyRunId) {\n      return yield* Effect.fail(invalidReplay(\"runId and policyRunId must be distinct\"))\n    }\n    const journal = yield* JournalModule.Journal\n    const workspace = yield* Workspace\n    const replayPolicy = replayRememberedRules(\n      policyRunId,\n      sourceId,\n      workspace.root\n    ).pipe(\n      Effect.mapError((cause) =>\n        cause instanceof GrantStoreError ? cause : journalFailed(\"could not replay remembered grants\", cause)\n      )\n    )\n    const replayRun = replayRunRules(\n      runId,\n      sourceId,\n      planDigest,\n      workspace.root\n    ).pipe(\n      Effect.mapError((cause) =>\n        cause instanceof GrantStoreError ? cause : journalFailed(\"could not replay run grants\", cause)\n      )\n    )\n    let replayedPolicy = yield* replayPolicy\n    let replayedRun = yield* replayRun\n    const persist = (event: GrantEvent): Effect.Effect<void, GrantStoreError> => {\n      const payload = encodeGrantEvent(event)\n      return Effect.gen(function*() {\n        // Unfenced: the grant store is the kernel's own ledger, not a run's\n        // lifecycle — it owns no run, and grant admissions are\n        // first-writer-wins records replayed by every later process.\n        yield* journal.emitDurableUnfenced(\n          new JournalEvent.Input({\n            runId: (\n              event.eventType === \"flows.kernel.grant.remembered.v1\"\n                || (event.eventType === \"flows.kernel.grant.envelope.v1\" && event.scope === \"remembered\")\n                ? policyRunId\n                : runId\n            ) as JournalEvent.RunId,\n            sourceId: sourceId as JournalEvent.SourceId,\n            eventType: event.eventType,\n            payload\n          })\n        )\n      }).pipe(\n        Effect.mapError((cause) => journalFailed(\"could not persist grant event\", cause)),\n        Effect.asVoid\n      )\n    }\n    const envelope = options.envelope\n    const build = () => {\n      const configuredCount = options.rules?.reduce((count, rules) => count + rules.length, 0) ?? 0\n      const rememberedCount = replayedPolicy.rules.length\n      const runCount = replayedRun.rules.length\n      const total = configuredCount + rememberedCount + runCount\n      if (total > GrantStore.maximumRules) {\n        return Effect.fail(\n          invalidReplay(\n            `policy run ${policyRunId} replayed ${rememberedCount} remembered rules; configured rules (${configuredCount}) and replayed run rules (${runCount}) bring the total to ${total}, which exceeds the ${GrantStore.maximumRules}-rule ceiling; remove configured rules or start a new policyRunId and grant again`\n          )\n        )\n      }\n      // Envelope signatures accumulate in the policy journal exactly the way\n      // remembered rules do, and `GrantStore.make` refuses more than\n      // `maximumRules` of them with a message that names neither the journal\n      // nor the counts. Diagnose it here instead, so an operator reading the\n      // failure knows which policy run filled rather than which field overflowed.\n      const policySignatureCount = replayedPolicy.envelopeSignatures.size\n      const runSignatureCount = replayedRun.envelopeSignatures.size\n      const signatureTotal = policySignatureCount + runSignatureCount\n      if (signatureTotal > GrantStore.maximumRules) {\n        return Effect.fail(\n          invalidReplay(\n            `policy run ${policyRunId} replayed ${policySignatureCount} remembered envelope signatures; replayed run envelope signatures (${runSignatureCount}) bring the total to ${signatureTotal}, which exceeds the ${GrantStore.maximumRules}-envelope-signature ceiling; start a new policyRunId and grant again`\n          )\n        )\n      }\n      // GrantStore's shared envelope admission adds only patterns not already\n      // replayed for a seeded envelope, and checks the combined rule and\n      // signature counts before any construction event is persisted.\n      return GrantStore.make({\n        runId,\n        planDigest,\n        ...(options.attended === undefined ? {} : { attended: options.attended }),\n        rules: options.rules === undefined || options.rules.length === 0\n          ? [[], replayedPolicy.rules]\n          : [...options.rules, replayedPolicy.rules],\n        runRules: replayedRun.rules,\n        envelopeSignatures: [\n          ...replayedPolicy.envelopeSignatures,\n          ...replayedRun.envelopeSignatures\n        ],\n        ...(envelope === undefined ? {} : {\n          envelope: {\n            planDigest,\n            patterns: envelope.patterns,\n            ...(envelope.scope === undefined ? {} : { scope: envelope.scope })\n          }\n        }),\n        persist\n      })\n    }\n    if (envelope === undefined || envelope.patterns.length === 0) {\n      return yield* build()\n    }\n    const scope = envelope.scope ?? \"run\"\n    const signature = GrantStore.envelopeSignature(planDigest, scope, envelope.patterns)\n    const replayedSignatures = scope === \"remembered\"\n      ? replayedPolicy.envelopeSignatures\n      : replayedRun.envelopeSignatures\n    if (replayedSignatures.has(signature)) {\n      // Already durable: the seeded signature makes the construction envelope\n      // activate without persisting again.\n      return yield* build()\n    }\n    // The envelope was absent when this constructor replayed, but a concurrent\n    // constructor sharing this Journal service may persist it before we do.\n    // Re-replay the target run inside the per-service critical section, so\n    // exactly one such constructor appends the envelope and every other one\n    // replays it instead.\n    return yield* constructionLock(journal).withPermit(\n      Effect.gen(function*() {\n        if (scope === \"remembered\") {\n          replayedPolicy = yield* replayPolicy\n        } else {\n          replayedRun = yield* replayRun\n        }\n        return yield* build()\n      })\n    )\n  })\n\n/**\n * Provides a journal-backed `GrantStore`.\n *\n * @category layers\n * @since 1.0.0-rc.0\n */\nexport const layer = (options: JournalGrantStoreOptions) => Layer.effect(GrantStore.GrantStore)(make(options))\n"]}