@smthrs/kernel 0.0.0-stage → 1.0.0-rc.4

package/dist/cjs/GrantEvent.d.ts

@@ -0,0 +1,240 @@
+/**
+ * Durable grant decision events.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Journal Queue.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { Capability, CapabilityPattern } from "@smthrs/capability/Capability";
+import * as Schema from "effect/Schema";
+/**
+ * The tier at which a capability decision was made.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export declare const GrantTier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+/**
+ * The scope selected for a permission grant.
+ *
+ * @category schemas
+ * @since 1.0.0-rc.0
+ */
+export declare const GrantScope: Schema.Literals<readonly ["once", "run", "remembered"]>;
+declare const OnceGrant_base: Schema.Class<OnceGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/OnceGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.once.v1">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.optional<Schema.String>;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly scope: Schema.Literal<"once">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A one-call grant.
+ *
+ * It is durable audit evidence but is deliberately never replayed as active
+ * authority.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class OnceGrant extends OnceGrant_base {
+}
+declare const RememberedGrant_base: Schema.Class<RememberedGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/RememberedGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.remembered.v1">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.optional<Schema.String>;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly scope: Schema.Literal<"remembered">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A grant remembered across runs.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class RememberedGrant extends RememberedGrant_base {
+}
+declare const RunGrant_base: Schema.Class<RunGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/RunGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.run.v2">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.String;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly ceiling: Schema.$Array<Schema.$Array<typeof CapabilityPattern>>;
+    readonly scope: Schema.Literal<"run">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A grant scoped to the current run.
+ *
+ * Version 2 captures the requesting fiber's normalized conjunction of any-of
+ * capability-pattern groups. Replay intersects it with the constructor ceiling.
+ * Version 1 omitted this boundary and cannot safely activate authority.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class RunGrant extends RunGrant_base {
+}
+declare const DeniedGrant_base: Schema.Class<DeniedGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/DeniedGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.denied.v1">;
+    readonly requestId: Schema.String;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.optional<Schema.String>;
+    readonly capability: typeof Capability;
+    readonly pattern: typeof CapabilityPattern;
+    readonly scope: Schema.Literal<"once">;
+    readonly tier: Schema.Literals<readonly ["sealed", "compensable", "irreversible"]>;
+}>, {}>;
+/**
+ * A denied permission request.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class DeniedGrant extends DeniedGrant_base {
+}
+declare const EnvelopeGrant_base: Schema.Class<EnvelopeGrant, Schema.TaggedStruct<"@smthrs/kernel/GrantEvent/EnvelopeGrant", {
+    readonly eventType: Schema.Literal<"flows.kernel.grant.envelope.v1">;
+    readonly runId: Schema.String;
+    readonly planDigest: Schema.String;
+    readonly patterns: Schema.$Array<typeof CapabilityPattern>;
+    readonly scope: Schema.Literals<readonly ["run", "remembered"]>;
+}>, {}>;
+/**
+ * A capability envelope grant.
+ *
+ * Envelope grants are not attached to an individual request. `planDigest`
+ * binds the decision to exactly the plan shown to the approver. A `run`
+ * envelope is replayed only for that run and digest; a `remembered` envelope
+ * becomes remembered predicate grants for future plans while retaining its
+ * origin digest as audit evidence.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare class EnvelopeGrant extends EnvelopeGrant_base {
+}
+/**
+ * All durable grant events understood by the kernel.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const GrantEventSchema: Schema.Union<readonly [typeof OnceGrant, typeof RememberedGrant, typeof DeniedGrant, typeof EnvelopeGrant, typeof RunGrant]>;
+/**
+ * All durable grant events understood by the kernel.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type GrantEvent = typeof GrantEventSchema.Type;
+/**
+ * Decodes one JSON-compatible journal payload into a grant event.
+ *
+ * Excess payload keys are rejected rather than stripped. Grant payloads are
+ * replayed as active permission authority, so a payload that mixes fields
+ * from two grant variants — for example an envelope carrying request-only
+ * fields — is treated as corrupt instead of silently narrowed to whichever
+ * variant its declared keys happen to satisfy.
+ *
+ * @category decoding
+ * @since 1.0.0-rc.0
+ */
+export declare const decode: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Result").Result<OnceGrant | RememberedGrant | RunGrant | DeniedGrant | EnvelopeGrant, Schema.SchemaError>;
+/**
+ * Encodes a grant event into its JSON-compatible journal payload.
+ *
+ * @category encoding
+ * @since 1.0.0-rc.0
+ */
+export declare const encode: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => import("effect/Result").Result<{
+    readonly _tag: "@smthrs/kernel/GrantEvent/OnceGrant";
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly requestId: string;
+    readonly runId: string;
+    readonly tier: "sealed" | "compensable" | "irreversible";
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly eventType: "flows.kernel.grant.once.v1";
+    readonly scope: "once";
+    readonly planDigest?: string | undefined;
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/RememberedGrant";
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly requestId: string;
+    readonly runId: string;
+    readonly tier: "sealed" | "compensable" | "irreversible";
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly eventType: "flows.kernel.grant.remembered.v1";
+    readonly scope: "remembered";
+    readonly planDigest?: string | undefined;
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/RunGrant";
+    readonly eventType: "flows.kernel.grant.run.v2";
+    readonly requestId: string;
+    readonly runId: string;
+    readonly planDigest: string;
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly ceiling: readonly (readonly {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    }[])[];
+    readonly scope: "run";
+    readonly tier: "sealed" | "compensable" | "irreversible";
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/DeniedGrant";
+    readonly pattern: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    };
+    readonly requestId: string;
+    readonly runId: string;
+    readonly tier: "sealed" | "compensable" | "irreversible";
+    readonly capability: {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore";
+        readonly resource: string;
+    };
+    readonly eventType: "flows.kernel.grant.denied.v1";
+    readonly scope: "once";
+    readonly planDigest?: string | undefined;
+} | {
+    readonly _tag: "@smthrs/kernel/GrantEvent/EnvelopeGrant";
+    readonly eventType: "flows.kernel.grant.envelope.v1";
+    readonly runId: string;
+    readonly planDigest: string;
+    readonly patterns: readonly {
+        readonly action: "fs:read" | "fs:write" | "net:get" | "net:post" | "net:private" | "model:call" | "memory:read" | "memory:write" | "proc:spawn" | "jj:status" | "jj:diff" | "jj:snapshot" | "jj:restore" | "jj:workspace-add" | "jj:workspace-forget" | "jj:root" | "jj:revert" | "jj:op-restore" | "fs:*" | "net:*" | "model:*" | "memory:*" | "proc:*" | "jj:*" | "*";
+        readonly resource: string;
+    }[];
+    readonly scope: "run" | "remembered";
+}, Schema.SchemaError>;
+export {};
+//# sourceMappingURL=GrantEvent.d.ts.map

package/dist/cjs/GrantEvent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantEvent.d.ts","sourceRoot":"","sources":["../../src/GrantEvent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAEvC;;;;;GAKG;AACH,eAAO,MAAM,SAAS,qEAA6D,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,yDAAiD,CAAA;;;;;;;;;;;AAExE;;;;;;;;GAQG;AACH,qBAAa,SAAU,SAAQ,cAS7B;CAAG;;;;;;;;;;;AAEL;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,oBAYpC;CAAG;;;;;;;;;;;;AAEJ;;;;;;;;;GASG;AACH,qBAAa,QAAS,SAAQ,aAU5B;CAAG;;;;;;;;;;;AAEL;;;;;GAKG;AACH,qBAAa,WAAY,SAAQ,gBAS/B;CAAG;;;;;;;;AAEL;;;;;;;;;;;GAWG;AACH,qBAAa,aAAc,SAAQ,kBASlC;CAAG;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,8HAM3B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAErD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,MAAM,iMAA8E,CAAA;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;sBAA+C,CAAA"}

package/dist/cjs/GrantEvent.js

@@ -0,0 +1,115 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var GrantEvent_exports = {};
+__export(GrantEvent_exports, {
+  DeniedGrant: () => DeniedGrant,
+  EnvelopeGrant: () => EnvelopeGrant,
+  GrantEventSchema: () => GrantEventSchema,
+  GrantScope: () => GrantScope,
+  GrantTier: () => GrantTier,
+  OnceGrant: () => OnceGrant,
+  RememberedGrant: () => RememberedGrant,
+  RunGrant: () => RunGrant,
+  decode: () => decode,
+  encode: () => encode
+});
+module.exports = __toCommonJS(GrantEvent_exports);
+var import_Capability = require("@smthrs/capability/Capability");
+var Schema = __toESM(require("effect/Schema"), 1);
+const GrantTier = Schema.Literals(["sealed", "compensable", "irreversible"]);
+const GrantScope = Schema.Literals(["once", "run", "remembered"]);
+class OnceGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/OnceGrant", {
+  eventType: Schema.Literal("flows.kernel.grant.once.v1"),
+  requestId: Schema.String,
+  runId: Schema.String,
+  planDigest: Schema.optional(Schema.String),
+  capability: import_Capability.Capability,
+  pattern: import_Capability.CapabilityPattern,
+  scope: Schema.Literal("once"),
+  tier: GrantTier
+}) {
+}
+class RememberedGrant extends Schema.TaggedClass()(
+  "@smthrs/kernel/GrantEvent/RememberedGrant",
+  {
+    eventType: Schema.Literal("flows.kernel.grant.remembered.v1"),
+    requestId: Schema.String,
+    runId: Schema.String,
+    planDigest: Schema.optional(Schema.String),
+    capability: import_Capability.Capability,
+    pattern: import_Capability.CapabilityPattern,
+    scope: Schema.Literal("remembered"),
+    tier: GrantTier
+  }
+) {
+}
+class RunGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/RunGrant", {
+  eventType: Schema.Literal("flows.kernel.grant.run.v2"),
+  requestId: Schema.String,
+  runId: Schema.String,
+  planDigest: Schema.String,
+  capability: import_Capability.Capability,
+  pattern: import_Capability.CapabilityPattern,
+  ceiling: Schema.Array(Schema.Array(import_Capability.CapabilityPattern)),
+  scope: Schema.Literal("run"),
+  tier: GrantTier
+}) {
+}
+class DeniedGrant extends Schema.TaggedClass()("@smthrs/kernel/GrantEvent/DeniedGrant", {
+  eventType: Schema.Literal("flows.kernel.grant.denied.v1"),
+  requestId: Schema.String,
+  runId: Schema.String,
+  planDigest: Schema.optional(Schema.String),
+  capability: import_Capability.Capability,
+  pattern: import_Capability.CapabilityPattern,
+  scope: Schema.Literal("once"),
+  tier: GrantTier
+}) {
+}
+class EnvelopeGrant extends Schema.TaggedClass()(
+  "@smthrs/kernel/GrantEvent/EnvelopeGrant",
+  {
+    eventType: Schema.Literal("flows.kernel.grant.envelope.v1"),
+    runId: Schema.String,
+    planDigest: Schema.String,
+    patterns: Schema.Array(import_Capability.CapabilityPattern),
+    scope: Schema.Literals(["run", "remembered"])
+  }
+) {
+}
+const GrantEventSchema = Schema.Union([
+  OnceGrant,
+  RememberedGrant,
+  DeniedGrant,
+  EnvelopeGrant,
+  RunGrant
+]);
+const decode = Schema.decodeUnknownResult(GrantEventSchema, { onExcessProperty: "error" });
+const encode = Schema.encodeUnknownResult(GrantEventSchema);
+//# sourceMappingURL=GrantEvent.js.map

package/dist/cjs/GrantEvent.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/GrantEvent.ts"],
+  "sourcesContent": ["/**\n * Durable grant decision events.\n *\n * Governing design:\n * `docs/specs/Concepts/Permission Kernel.md` and\n * `docs/specs/Concepts/Journal Queue.md`.\n *\n * @since 1.0.0-rc.0\n */\n\nimport { Capability, CapabilityPattern } from \"@smthrs/capability/Capability\"\nimport * as Schema from \"effect/Schema\"\n\n/**\n * The tier at which a capability decision was made.\n *\n * @category schemas\n * @since 1.0.0-rc.0\n */\nexport const GrantTier = Schema.Literals([\"sealed\", \"compensable\", \"irreversible\"])\n\n/**\n * The scope selected for a permission grant.\n *\n * @category schemas\n * @since 1.0.0-rc.0\n */\nexport const GrantScope = Schema.Literals([\"once\", \"run\", \"remembered\"])\n\n/**\n * A one-call grant.\n *\n * It is durable audit evidence but is deliberately never replayed as active\n * authority.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class OnceGrant extends Schema.TaggedClass<OnceGrant>()(\"@smthrs/kernel/GrantEvent/OnceGrant\", {\n  eventType: Schema.Literal(\"flows.kernel.grant.once.v1\"),\n  requestId: Schema.String,\n  runId: Schema.String,\n  planDigest: Schema.optional(Schema.String),\n  capability: Capability,\n  pattern: CapabilityPattern,\n  scope: Schema.Literal(\"once\"),\n  tier: GrantTier\n}) {}\n\n/**\n * A grant remembered across runs.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class RememberedGrant extends Schema.TaggedClass<RememberedGrant>()(\n  \"@smthrs/kernel/GrantEvent/RememberedGrant\",\n  {\n    eventType: Schema.Literal(\"flows.kernel.grant.remembered.v1\"),\n    requestId: Schema.String,\n    runId: Schema.String,\n    planDigest: Schema.optional(Schema.String),\n    capability: Capability,\n    pattern: CapabilityPattern,\n    scope: Schema.Literal(\"remembered\"),\n    tier: GrantTier\n  }\n) {}\n\n/**\n * A grant scoped to the current run.\n *\n * Version 2 captures the requesting fiber's normalized conjunction of any-of\n * capability-pattern groups. Replay intersects it with the constructor ceiling.\n * Version 1 omitted this boundary and cannot safely activate authority.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class RunGrant extends Schema.TaggedClass<RunGrant>()(\"@smthrs/kernel/GrantEvent/RunGrant\", {\n  eventType: Schema.Literal(\"flows.kernel.grant.run.v2\"),\n  requestId: Schema.String,\n  runId: Schema.String,\n  planDigest: Schema.String,\n  capability: Capability,\n  pattern: CapabilityPattern,\n  ceiling: Schema.Array(Schema.Array(CapabilityPattern)),\n  scope: Schema.Literal(\"run\"),\n  tier: GrantTier\n}) {}\n\n/**\n * A denied permission request.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class DeniedGrant extends Schema.TaggedClass<DeniedGrant>()(\"@smthrs/kernel/GrantEvent/DeniedGrant\", {\n  eventType: Schema.Literal(\"flows.kernel.grant.denied.v1\"),\n  requestId: Schema.String,\n  runId: Schema.String,\n  planDigest: Schema.optional(Schema.String),\n  capability: Capability,\n  pattern: CapabilityPattern,\n  scope: Schema.Literal(\"once\"),\n  tier: GrantTier\n}) {}\n\n/**\n * A capability envelope grant.\n *\n * Envelope grants are not attached to an individual request. `planDigest`\n * binds the decision to exactly the plan shown to the approver. A `run`\n * envelope is replayed only for that run and digest; a `remembered` envelope\n * becomes remembered predicate grants for future plans while retaining its\n * origin digest as audit evidence.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport class EnvelopeGrant extends Schema.TaggedClass<EnvelopeGrant>()(\n  \"@smthrs/kernel/GrantEvent/EnvelopeGrant\",\n  {\n    eventType: Schema.Literal(\"flows.kernel.grant.envelope.v1\"),\n    runId: Schema.String,\n    planDigest: Schema.String,\n    patterns: Schema.Array(CapabilityPattern),\n    scope: Schema.Literals([\"run\", \"remembered\"])\n  }\n) {}\n\n/**\n * All durable grant events understood by the kernel.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const GrantEventSchema = Schema.Union([\n  OnceGrant,\n  RememberedGrant,\n  DeniedGrant,\n  EnvelopeGrant,\n  RunGrant\n])\n\n/**\n * All durable grant events understood by the kernel.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type GrantEvent = typeof GrantEventSchema.Type\n\n/**\n * Decodes one JSON-compatible journal payload into a grant event.\n *\n * Excess payload keys are rejected rather than stripped. Grant payloads are\n * replayed as active permission authority, so a payload that mixes fields\n * from two grant variants \u2014 for example an envelope carrying request-only\n * fields \u2014 is treated as corrupt instead of silently narrowed to whichever\n * variant its declared keys happen to satisfy.\n *\n * @category decoding\n * @since 1.0.0-rc.0\n */\nexport const decode = Schema.decodeUnknownResult(GrantEventSchema, { onExcessProperty: \"error\" })\n\n/**\n * Encodes a grant event into its JSON-compatible journal payload.\n *\n * @category encoding\n * @since 1.0.0-rc.0\n */\nexport const encode = Schema.encodeUnknownResult(GrantEventSchema)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,wBAA8C;AAC9C,aAAwB;AAQjB,MAAM,YAAY,OAAO,SAAS,CAAC,UAAU,eAAe,cAAc,CAAC;AAQ3E,MAAM,aAAa,OAAO,SAAS,CAAC,QAAQ,OAAO,YAAY,CAAC;AAWhE,MAAM,kBAAkB,OAAO,YAAuB,EAAE,uCAAuC;AAAA,EACpG,WAAW,OAAO,QAAQ,4BAA4B;AAAA,EACtD,WAAW,OAAO;AAAA,EAClB,OAAO,OAAO;AAAA,EACd,YAAY,OAAO,SAAS,OAAO,MAAM;AAAA,EACzC,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC5B,MAAM;AACR,CAAC,EAAE;AAAC;AAQG,MAAM,wBAAwB,OAAO,YAA6B;AAAA,EACvE;AAAA,EACA;AAAA,IACE,WAAW,OAAO,QAAQ,kCAAkC;AAAA,IAC5D,WAAW,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,YAAY,OAAO,SAAS,OAAO,MAAM;AAAA,IACzC,YAAY;AAAA,IACZ,SAAS;AAAA,IACT,OAAO,OAAO,QAAQ,YAAY;AAAA,IAClC,MAAM;AAAA,EACR;AACF,EAAE;AAAC;AAYI,MAAM,iBAAiB,OAAO,YAAsB,EAAE,sCAAsC;AAAA,EACjG,WAAW,OAAO,QAAQ,2BAA2B;AAAA,EACrD,WAAW,OAAO;AAAA,EAClB,OAAO,OAAO;AAAA,EACd,YAAY,OAAO;AAAA,EACnB,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,SAAS,OAAO,MAAM,OAAO,MAAM,mCAAiB,CAAC;AAAA,EACrD,OAAO,OAAO,QAAQ,KAAK;AAAA,EAC3B,MAAM;AACR,CAAC,EAAE;AAAC;AAQG,MAAM,oBAAoB,OAAO,YAAyB,EAAE,yCAAyC;AAAA,EAC1G,WAAW,OAAO,QAAQ,8BAA8B;AAAA,EACxD,WAAW,OAAO;AAAA,EAClB,OAAO,OAAO;AAAA,EACd,YAAY,OAAO,SAAS,OAAO,MAAM;AAAA,EACzC,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,OAAO,OAAO,QAAQ,MAAM;AAAA,EAC5B,MAAM;AACR,CAAC,EAAE;AAAC;AAcG,MAAM,sBAAsB,OAAO,YAA2B;AAAA,EACnE;AAAA,EACA;AAAA,IACE,WAAW,OAAO,QAAQ,gCAAgC;AAAA,IAC1D,OAAO,OAAO;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,UAAU,OAAO,MAAM,mCAAiB;AAAA,IACxC,OAAO,OAAO,SAAS,CAAC,OAAO,YAAY,CAAC;AAAA,EAC9C;AACF,EAAE;AAAC;AAQI,MAAM,mBAAmB,OAAO,MAAM;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAsBM,MAAM,SAAS,OAAO,oBAAoB,kBAAkB,EAAE,kBAAkB,QAAQ,CAAC;AAQzF,MAAM,SAAS,OAAO,oBAAoB,gBAAgB;",
+  "names": []
+}

package/dist/cjs/GrantStore.d.ts

@@ -0,0 +1,270 @@
+/**
+ * In-memory capability grants with an attended Deferred request lifecycle.
+ *
+ * Governing design:
+ * `docs/specs/Concepts/Permission Kernel.md` and
+ * `docs/specs/Concepts/Trust Granularity.md`.
+ *
+ * @since 1.0.0-rc.0
+ */
+import { type Capability, CapabilityPattern, type EffectTier } from "@smthrs/capability/Capability";
+import { GrantStoreError, type PermissionDenied, type PermissionRequired, Rule } from "@smthrs/capability/Permission";
+import { Context, Effect, Layer, type Scope } from "effect";
+import { type CapabilitySet } from "./CapabilitySet.ts";
+import { type GrantEvent } from "./GrantEvent.ts";
+import { Workspace } from "./Workspace.ts";
+/**
+ * A capability request waiting for an attended reply.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface PendingRequest {
+    readonly requestId: string;
+    readonly capability: Capability;
+    readonly tier: EffectTier;
+    readonly meta: Record<string, unknown>;
+}
+/**
+ * A resolution supplied by an attended permission surface.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Resolution = "once" | "run" | "remembered" | "deny";
+/**
+ * Scope and plan identity for a bulk envelope approval.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface EnvelopeGrantOptions {
+    readonly planDigest: string;
+    readonly patterns: ReadonlyArray<CapabilityPattern>;
+    readonly scope?: "run" | "remembered" | undefined;
+}
+/** A policy rule and the authority captured when it was granted.
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface PolicyRule {
+    readonly rule: Rule;
+    readonly ceiling: Pick<CapabilitySet, "groups">;
+}
+/** Atomic ordered policy snapshot, bounded by the calling fiber.
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Policy {
+    readonly groups: ReadonlyArray<ReadonlyArray<PolicyRule>>;
+    readonly ceiling: CapabilitySet;
+}
+/** A conservative snapshot for services that expose no durable authority.
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export declare const emptyPolicy: Effect.Effect<Policy>;
+/** Operations exposed by the grant store.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface Service {
+    readonly policy: Effect.Effect<Policy, GrantStoreError>;
+    readonly check: (capability: Capability, meta?: Record<string, unknown>) => Effect.Effect<void, PermissionRequired | PermissionDenied | GrantStoreError>;
+    readonly reply: (requestId: string, resolution: Resolution, pattern?: CapabilityPattern) => Effect.Effect<void, GrantStoreError>;
+    readonly list: Effect.Effect<ReadonlyArray<PendingRequest>>;
+    readonly grantEnvelope: (options: EnvelopeGrantOptions) => Effect.Effect<void, GrantStoreError>;
+}
+declare const GrantStore_base: Context.ServiceClass<GrantStore, "@smthrs/kernel/GrantStore", Service>;
+/**
+ * Service key for permission decisions and attended grant requests.
+ *
+ * @category services
+ * @since 1.0.0-rc.0
+ */
+export declare class GrantStore extends GrantStore_base {
+}
+/**
+ * A hook that durably records a grant decision before it becomes active.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Persist = (event: GrantEvent) => Effect.Effect<void, GrantStoreError>;
+/**
+ * Configuration for an in-memory grant store.
+ *
+ * A nested `rules` value is also accepted by the journal adapter: its first
+ * ruleset is configured policy and subsequent rulesets are replayed remembered
+ * grants.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export interface MakeOptions {
+    readonly attended?: boolean | undefined;
+    readonly rules?: ReadonlyArray<Rule> | ReadonlyArray<ReadonlyArray<Rule>> | undefined;
+    /** Bare rules use the constructor ceiling; captured groups intersect it. */
+    readonly runRules?: ReadonlyArray<Rule | {
+        readonly rule: Rule;
+        readonly ceiling: ReadonlyArray<ReadonlyArray<CapabilityPattern>>;
+    }> | undefined;
+    readonly envelope?: EnvelopeGrantOptions | undefined;
+    /**
+     * {@link envelopeSignature} values of envelopes that are already durable —
+     * typically replayed from a journal. A construction or runtime envelope
+     * matching a seeded signature still activates its rules but is not
+     * persisted again.
+     */
+    readonly envelopeSignatures?: ReadonlyArray<string> | undefined;
+    readonly runId?: string | undefined;
+    readonly planDigest?: string | undefined;
+    readonly persist?: Persist | undefined;
+}
+/**
+ * Maximum policy rules retained by one store.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumRules = 1024;
+/**
+ * Maximum predicates in one approval envelope.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumEnvelopePatterns = 256;
+/**
+ * Maximum permission requests parked at once.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumPendingRequests = 1024;
+/**
+ * Maximum nesting depth of permission metadata.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumMetadataDepth = 16;
+/**
+ * Maximum members across one permission metadata graph.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumMetadataMembers = 1024;
+/**
+ * Maximum encoded bytes retained for one metadata value.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumMetadataBytes: number;
+/**
+ * Maximum encoded bytes persisted for one grant event.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumEventBytes: number;
+/**
+ * Maximum milliseconds one grant journal write may take before its reply or
+ * envelope admission fails with `journal_failed`. Journal writes never hold
+ * the store's mutation permit, so a slow write stalls only the admission that
+ * issued it.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumPersistMillis = 30000;
+/**
+ * Maximum length of a run, plan, request, or signature identity.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumIdentityLength = 4096;
+/**
+ * Maximum capability resource length enforced by the capability vocabulary.
+ * @category limits
+ * @since 1.0.0-rc.0
+ */
+export declare const maximumCapabilityResourceLength = 4096;
+/**
+ * Canonicalizes an envelope pattern list: duplicate predicates collapse to
+ * their first occurrence and the survivors sort by their formatted identity.
+ *
+ * An envelope is a *set* of predicates, so two envelopes listing the same
+ * predicates in a different order or multiplicity are the same approval. Every
+ * envelope is canonicalized before it is persisted or compared, which makes
+ * envelope idempotency structural rather than dependent on caller discipline.
+ *
+ * The ordering is the code-unit sort of `format(pattern)` — the one renderer
+ * for capability identity. RFC 8785 canonical JSON (`@smthrs/canonical`)
+ * was considered and does not fit: it canonicalizes object keys but preserves
+ * array order as semantic, and the ordering that matters here is exactly the
+ * pattern-array order.
+ *
+ * @category validation
+ * @since 1.0.0-rc.0
+ */
+export declare const canonicalEnvelopePatterns: (patterns: ReadonlyArray<CapabilityPattern>) => ReadonlyArray<CapabilityPattern>;
+/**
+ * Computes the canonical identity of an envelope approval.
+ *
+ * Two envelopes with the same plan digest, scope, and predicate set produce
+ * the same signature regardless of pattern order or repetition. The signature
+ * is how the store, and journal replay above it, recognise an envelope that
+ * is already durable. It is `sha256:` followed by 64 lowercase hex digits.
+ *
+ * @category validation
+ * @since 1.0.0-rc.0
+ */
+export declare const envelopeSignature: (planDigest: string, scope: "run" | "remembered", patterns: ReadonlyArray<CapabilityPattern>) => string;
+/**
+ * Checks that a request-scoped grant cannot authorize a different action or a
+ * more dangerous effect tier than the request displayed to the user. A
+ * wildcard-bearing pattern identical to the resource is ambiguous because the
+ * grammar has no escape, so its wildcard reading would silently widen access.
+ *
+ * @category validation
+ * @since 1.0.0-rc.0
+ */
+export declare const isValidGrantPattern: (pattern: CapabilityPattern, capability: Capability, tier: EffectTier, workspaceRoot: string) => boolean;
+/**
+ * Checks that a bulk envelope pattern preserves exact action and filesystem
+ * effect-tier boundaries.
+ *
+ * @category validation
+ * @since 1.0.0-rc.0
+ */
+export declare const isValidEnvelopePattern: (pattern: CapabilityPattern, workspaceRoot: string) => boolean;
+/**
+ * Builds an in-memory grant store.
+ *
+ * Attended stores suspend an asking fiber on a request-local `Deferred`.
+ * Unattended stores fail immediately with `PermissionRequired`. The returned
+ * service is scoped: closing its scope rejects every waiter and clears the
+ * pending map.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const make: (options?: MakeOptions) => Effect.Effect<Service, GrantStoreError, Scope.Scope | Workspace>;
+/**
+ * Provides a scoped in-memory grant store.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layer: (options?: MakeOptions) => Layer.Layer<GrantStore, GrantStoreError, Workspace>;
+/**
+ * An allow-all grant store.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.0
+ */
+export declare const makeNoop: Service;
+/**
+ * Provides the allow-all grant store.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export declare const layerNoop: Layer.Layer<GrantStore>;
+export {};
+//# sourceMappingURL=GrantStore.d.ts.map

package/dist/cjs/GrantStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GrantStore.d.ts","sourceRoot":"","sources":["../../src/GrantStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,KAAK,UAAU,EAEf,iBAAiB,EACjB,KAAK,UAAU,EAQhB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAEL,eAAe,EACf,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EAEvB,IAAI,EACL,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAkB,KAAK,KAAK,EAAa,MAAM,QAAQ,CAAA;AACvG,OAAO,EAAU,KAAK,aAAa,EAAoC,MAAM,oBAAoB,CAAA;AACjG,OAAO,EAA8B,KAAK,UAAU,EAAwC,MAAM,iBAAiB,CAAA;AACnH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE1C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,GAAG,MAAM,CAAA;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,CAAA;CAClD;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAA;IACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAE7C,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IACvD,QAAQ,CAAC,KAAK,EAAE,CACd,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,eAAe,CAAC,CAAA;IACjF,QAAQ,CAAC,KAAK,EAAE,CACd,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,UAAU,EACtB,OAAO,CAAC,EAAE,iBAAiB,KACxB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAA;IAC3D,QAAQ,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;CAChG;;AAED;;;;;GAKG;AACH,qBAAa,UAAW,SAAQ,eAAmE;CAAG;AAEtG;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AAEjF;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAA;IACrF,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EACd,aAAa,CACb,IAAI,GAAG;QACL,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;QACnB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAA;KAClE,CACF,GACC,SAAS,CAAA;IACb,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAA;IACpD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACvC;AAOD;;;;GAIG;AACH,eAAO,MAAM,YAAY,OAAQ,CAAA;AACjC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAC1C;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,OAAQ,CAAA;AAC3C;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AACtC;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,OAAQ,CAAA;AAC3C;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAAY,CAAA;AAC7C;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAa,CAAA;AAC3C;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAC1C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,OAAQ,CAAA;AAC1C;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,OAAoB,CAAA;AAgMhE;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACpC,UAAU,aAAa,CAAC,iBAAiB,CAAC,KACzC,aAAa,CAAC,iBAAiB,CAUjC,CAAA;AAQD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC5B,YAAY,MAAM,EAClB,OAAO,KAAK,GAAG,YAAY,EAC3B,UAAU,aAAa,CAAC,iBAAiB,CAAC,KACzC,MAA+E,CAAA;AAwBlF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC9B,SAAS,iBAAiB,EAC1B,YAAY,UAAU,EACtB,MAAM,UAAU,EAChB,eAAe,MAAM,KACpB,OAqBF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GACjC,SAAS,iBAAiB,EAC1B,eAAe,MAAM,KACpB,OAYF,CAAA;AA8BD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,IAAI,GACf,UAAS,WAAgB,KACxB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,KAAK,GAAG,SAAS,CAyrB9D,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAChB,UAAS,WAAgB,KACxB,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,CAA4C,CAAA;AAEjG;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,OAgBrB,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAuC,CAAA"}