@synapsor/runner 1.6.2 → 1.6.3

package/CHANGELOG.md

@@ -1,6 +1,81 @@
 # Changelog
 
-## 1.6.2 (prepared, not published)
+## 1.6.3 (prepared, not published)
+
+### Guided adoption without weaker authority
+
+- Turns a fresh interactive
+  `npx -y @synapsor/runner@latest start --from-env DATABASE_URL` into one
+  resumable journey: metadata-only inspection, conservative classification,
+  disabled project generation, review-by-exception in the loopback Workbench,
+  exact-digest activation, a real bounded read, and host-neutral MCP setup.
+- Generates the complete local project without requiring hand-edited DSL, JSON,
+  config, store paths, DDL, or grants for the reference development journey.
+  Existing selectors, automation, headless startup, hand-authored projects,
+  active contracts, and tool lists retain their prior behavior.
+- Adds no-ID, project-aware CLI paths for trying active named tools, bounded
+  row/aggregate exploration, protecting a successful analysis, guided action
+  authoring, proposal review, apply, receipt, replay, and compensation.
+- Reworks Workbench onboarding around one plain-language boundary summary,
+  conservative defaults, unresolved exceptions, one primary next action, and
+  progressive disclosure of DSL, canonical JSON, digests, role posture, and
+  generated tests.
+- Adds a guided write-action flow that drafts public DSL, canonical JSON,
+  tests, policy limits, conflict guards, receipt mode, and optional reviewed
+  compensation. It never derives business write authority from schema and
+  never activates, approves, or applies for the human.
+- Adds the FitFlow 30-50-table packed-artifact acceptance journey, including
+  first read, PM-style aggregate Explore, Protect, proposal, bounded policy
+  approval, guarded writeback, receipts/replay, compensation, host parity,
+  privacy gates, and source-unchanged assertions before commit.
+- Documents the full `APPROVAL ROLE` lifecycle from contract requirement
+  through external IdP claims and a verified immutable decision. A separate
+  local OIDC/JWKS issuer proves accepted reviewer/applier roles, role
+  separation, key rotation, and rejection of missing/similar roles, bad or
+  unknown signatures, expired/not-yet-valid tokens, wrong issuer/audience,
+  malformed claims, proof tampering, and cross-proposal replay.
+- Adds default-off operator-supervised automatic apply as a separate execution
+  axis. Contract permission plus an independent deployment allowlist must match
+  one exact digest; old `AUTO APPROVE` remains manual-apply. Eligible
+  single-row INSERT/UPDATE work reuses guarded apply and repeats policy, limit,
+  scope, target/supporting-evidence freshness, writer-posture, receipt, and
+  lease checks before every execution.
+- Adds durable redacted human-attention events and a coalesced Workbench inbox
+  for proposal, worker, boundary, schema, credential, policy, and sensitive
+  override lifecycle. A separately operated dispatcher supports quiet
+  per-sink routing, budgets, cooldowns, digests, JSONL development output, and
+  signed HTTPS webhooks. Notifications are disabled by default and never
+  authorize approval or mutation.
+- Binds dead-letter notification replay to a fresh verified signed-key or OIDC
+  operator decision over the exact delivery revision and reason. Replay
+  requeues only the immutable redacted event, records `notification.replayed`,
+  and cannot replay approval or source mutation. The packed gate exercises two
+  competing dispatchers, zero default success noise, duplicate suppression,
+  metadata-endpoint SSRF refusal, and event-only replay with an unchanged
+  source snapshot.
+- Adds pause/drain, exact-digest enable/disable/revoke, queue cancellation,
+  dead-letter, UNKNOWN/reconciliation, writer-posture, and optional required
+  attention-sink controls outside MCP. Fenced leases, limit reservations,
+  duplicate-consumption, process-death, known-commit, and ambiguous-outcome
+  paths retain the established fail-closed behavior.
+- Makes CLI failure output recovery-oriented and keeps supported `--json`
+  failure paths to one parseable document with redacted diagnostics on stderr,
+  preserved-state information, source-change status, and one next action.
+- Allows an explicit empty canonical `capabilities` array to represent a
+  validated zero-authority review draft and adds the optional canonical
+  `execution.supervised_worker` permission plus its public DSL clause. This
+  additive behavior is staged as `@synapsor/spec@1.6.0` and
+  `@synapsor/dsl@1.6.0`; legacy contracts retain their exact normalization and
+  digests.
+- Prepares `@synapsor/runner@1.6.3`, `@synapsor/spec@1.6.0`, and
+  `@synapsor/dsl@1.6.0`. No package is published by this change.
+- Makes the clean Runner tarball gate use the locally packed public Spec while
+  the new Spec version is still unpublished, then automatically return to the
+  stronger registry-only dependency-resolution proof once npm has that exact
+  Spec. This preserves the required Spec-first release order without masking a
+  broken packed Runner manifest.
+
+## 1.6.2 (published 2026-07-23)
 
 ### Registry-installable packaging hotfix
 
@@ -16,7 +91,7 @@
   masking it with a simultaneously packed local Spec.
 - Contains the same proposal/evidence freshness runtime behavior prepared in
   `1.6.1`; this patch changes packaging and version surfaces only.
-- Prepares only `@synapsor/runner@1.6.2`. `@synapsor/spec@1.5.0` and
+- Published only `@synapsor/runner@1.6.2`. `@synapsor/spec@1.5.0` and
   `@synapsor/dsl@1.5.0` remain unchanged.
 
 ## 1.6.1 (published 2026-07-23; install-broken)

package/README.md

@@ -64,22 +64,23 @@ existing Synapsor definitions. It does not execute adopter code, sample source
 rows, or use an LLM:
 
 ```bash
-npm install -g @synapsor/runner
 export DATABASE_URL="postgresql://runner_reader:REPLACE_ME@db.example.com:5432/app?sslmode=require"
 export SYNAPSOR_TENANT_ID="acme"
 export SYNAPSOR_PRINCIPAL="developer-1"
-synapsor-runner start --from-env DATABASE_URL --schema public
+npx -y @synapsor/runner@latest start --from-env DATABASE_URL
 ```
 
-A fresh project opens the secured localhost Workbench and emits disabled DSL,
-canonical JSON, tests, review evidence, and a generation lock. Review scope,
-fields, aggregate members, relationships, privacy budgets, profile, and exact
-role/RLS posture, then activate the exact digest. Existing tools stay unchanged.
+A fresh project checks credentials, inspects metadata, emits a validated
+zero-authority project, and opens secured localhost Workbench. Review its
+disabled DSL, fields, scope, analytical boundary, and role/RLS posture before
+activating the exact digest.
+
+[Database To First Safe Tool](docs/guided-onboarding.md) covers the complete
+path.
 
 ## Ask Your First Real Question In Cursor
 
-After activation, let Runner add only the local authoring entry to this Cursor
-project:
+After activation, install only the local authoring entry in this Cursor project:
 
 ```bash
 synapsor-runner mcp install cursor \
@@ -103,10 +104,9 @@ Which reviewed regions and reason categories contributed most to the increase
 in churned accounts by week?
 ```
 
-Runner accepts a typed plan, not SQL. It validates every member against the
-activated digest, injects trusted scope, and runs a read-only transaction.
-Small cohorts are suppressed and durable budgets limit repeated differencing.
-This is descriptive analysis, not proof of causation.
+Runner validates a typed plan against the activated digest, injects trusted
+scope, and runs a read-only transaction. Cohort suppression and durable budgets
+limit extraction. This is descriptive analysis, not proof of causation.
 
 Scoped Explore is local authoring only. Missing/unknown/production profiles,
 write-capable or owner credentials, stale generation locks, remote/shared HTTP,
@@ -182,9 +182,11 @@ synapsor-runner proposals check-freshness latest \
 ```
 
 See the [own-database guide](docs/getting-started-own-database.md),
-[Cursor plugin guide](docs/cursor-plugin.md), and
-[proposal freshness](docs/proposal-evidence-freshness.md) and
-[store lifecycle](docs/store-lifecycle.md) guides for the complete paths.
+[proposal freshness](docs/proposal-evidence-freshness.md), and
+[store lifecycle](docs/store-lifecycle.md). For production identity, follow
+`APPROVAL ROLE` through verified OIDC/signed-key approval and a separate apply
+role in [Approval Roles And Verified Operator
+Identity](docs/approval-roles-and-operator-identity.md).
 
 ## Safety Model
 
@@ -241,10 +243,22 @@ See [Security Boundary](docs/security-boundary.md) and
 ## Operate The Approval Loop
 
 Policies can combine per-proposal and aggregate ceilings; exceeding one routes
-to human review. Local SQLite is the default, while bounded fleets can use
-verified HTTP claims and a shared Postgres runtime store. See
-[Production](docs/production.md), [Runner Config](docs/runner-config-reference.md),
-and [Small Runner Fleets](docs/running-a-runner-fleet.md).
+to human review. Auto-approval does not mean auto-apply: existing policies wait
+for manual apply unless the exact contract digest and deployment both opt into
+a separately trusted supervised worker. That worker repeats scope, freshness,
+policy, limit, credential-posture, idempotency, and guarded-write checks before
+every execution.
+
+The ledger and secured Workbench also provide a Human Attention Inbox.
+External notifications are disabled and quiet by default; an operator can route
+review-required, UNKNOWN, reconciliation, dead-letter, drift, or sustained
+health incidents through a signed generic webhook without granting the receiver
+approval authority. A webhook response cannot approve, apply, or change Runner
+state. See [Supervised Automatic
+Apply](docs/supervised-automatic-apply.md), [Human Attention And
+Notifications](docs/human-attention-notifications.md),
+[Production](docs/production.md), and [Small Runner
+Fleets](docs/running-a-runner-fleet.md).
 
 ## Packages
 

package/SECURITY.md

@@ -6,6 +6,14 @@ Do not include production credentials, customer data, or full source rows in bug
 
 ## Supported security scope
 
-The v0.1 runner protects the local writeback boundary for approved structured jobs. It does not make the hosted Synapsor control plane self-hosted, and it does not provide HA, compliance certification, or a general database proxy.
+Runner protects the local model/database boundary for reviewed semantic reads,
+structured proposals, verified approval, guarded writeback, receipts, replay,
+and optional exact-digest supervised execution. Human-attention notifications
+are redacted interruption channels and never authority.
 
-See `docs/threat-model.md` for detailed trust boundaries, covered threats, non-goals, and release blockers.
+It does not make the hosted Synapsor control plane self-hosted, prevent prompt
+injection, replace database roles/RLS, or provide HA, compliance certification,
+or a general database proxy.
+
+See `THREAT_MODEL.md` and `docs/security-boundary.md` for detailed trust
+boundaries, covered threats, non-goals, and release blockers.

package/THREAT_MODEL.md

@@ -12,6 +12,8 @@ It is not a general MCP security gateway, not a prompt-injection cure, not a rep
 - Proposal diffs, evidence bundles, query audit, approvals, writeback jobs, receipts, and replay records.
 - Runner/session/operator tokens, local SQLite state, and optional shared
   Postgres proposal/evidence/replay ledger.
+- Exact-digest supervised-worker policy, worker leases, attention events,
+  notification delivery records, and webhook signing secrets.
 
 ## Trust Boundaries
 
@@ -21,8 +23,8 @@ MCP client/model
   -> reviewed capability config
   -> read-only database credential
   -> local proposal/evidence/replay store
-  -> human approval outside the model
-  -> guarded worker with write credential
+  -> human or reviewed deterministic policy approval outside the model
+  -> manual apply or separately enabled guarded worker with write credential
   -> Postgres/MySQL
 ```
 
@@ -37,7 +39,11 @@ MCP client/model
   -> Postgres/MySQL
 ```
 
-The model-facing MCP tool call has request/proposal authority. The trusted runner has execution authority only for already-approved, scoped writeback jobs.
+The model-facing MCP tool call has bounded request/proposal authority. The
+trusted runner has execution authority only for already-approved, scoped
+writeback jobs. Manual apply is the default. Supervised automatic execution
+requires both contract permission and a deployment allowlist for the exact
+active digest; the model controls neither.
 
 In small-fleet mode, a TLS load balancer sends signed sessions to stateless
 Runner instances. Every effective capability context must bind tenant and
@@ -65,7 +71,17 @@ idempotency boundary for effects.
 - Over-broad write: direct INSERT/UPDATE/DELETE is single-row, tenant-bound,
   operation-guarded, and success requires exactly one affected row.
 - Cloud credential leakage: database URLs and write credentials stay local and are not sent to Cloud.
-- Model-callable approval: approval/commit tools are not exposed to MCP clients by default.
+- Model-callable approval or execution: activation, approval, apply, worker,
+  notification-routing, and recovery controls are not exposed to MCP clients.
+- Stale policy-approved work: supervised execution repeats current policy,
+  limit, tenant/principal, target and supporting-evidence freshness,
+  generation-lock, writer-posture, receipt, and lease checks before apply.
+- Notification confused deputy or replay: webhook destinations and filters are
+  operator-owned; payloads are redacted and HMAC-signed with event ID and
+  timestamp; response content and delivery replay cannot authorize or mutate.
+- Notification flood: the default external route is quiet; related incidents
+  coalesce, transient recovery stays internal, and per-sink budgets/cooldowns
+  bound non-critical interruption while retaining immutable events.
 - Claims/environment confusion: an `http_claims` server fails before serving
   if a capability resolves an environment/static contract context.
 - Leaked local resource handle: proposal, evidence, and replay reads resolve
@@ -94,6 +110,7 @@ idempotency boundary for effects.
   predicates, or cross-database atomicity in the Runner direct-write path.
 - A compromised IdP/JWKS host, ledger database, source database, TLS
   terminator, or administrator-approved contract.
+- A compromised operator-approved notification destination or signing secret.
 - Unbounded/high-throughput or multi-region ledger scale, compliance
   certification, or production SLA.
 
@@ -106,6 +123,12 @@ idempotency boundary for effects.
 - Prefer version/timestamp conflict guards over weak row-hash fallback.
 - Review proposal diffs and evidence before approval.
 - Monitor conflict/failed receipt rates.
+- Keep automatic execution disabled unless both exact-digest opt-ins and a
+  separately scoped least-privilege writer are reviewed. Monitor queue,
+  dead-letter, UNKNOWN, reconciliation, and writer-posture state.
+- Keep notifications disabled unless needed. Store webhook URL/signing secret
+  only in operator environment, allowlist egress, and treat Workbench/ledger as
+  authoritative rather than a chat or incident system.
 - Allowlist JWKS egress, keep `/metrics` separately authorized, budget source
   pools across replicas, back up/verify the shared ledger, and retain the
   configured `max_entries` safety bound.

package/dist/authoring.mjs

@@ -37,7 +37,7 @@ var SUBJECT_KEYS = /* @__PURE__ */ new Set(["resource", "schema", "table", "prim
 var ARG_KEYS = /* @__PURE__ */ new Set(["type", "description", "required", "max_length", "minimum", "maximum", "enum", "max_items", "fields"]);
 var LOOKUP_KEYS = /* @__PURE__ */ new Set(["id_from_arg"]);
 var EVIDENCE_KEYS = /* @__PURE__ */ new Set(["required", "sources", "query_audit", "handle_prefix"]);
-var PROPOSAL_KEYS = /* @__PURE__ */ new Set(["action", "operation", "allowed_fields", "patch", "numeric_bounds", "transition_guards", "reversibility", "conflict_guard", "approval", "writeback"]);
+var PROPOSAL_KEYS = /* @__PURE__ */ new Set(["action", "operation", "allowed_fields", "patch", "numeric_bounds", "transition_guards", "reversibility", "conflict_guard", "approval", "execution", "writeback"]);
 var OPERATION_KEYS = /* @__PURE__ */ new Set(["kind", "cardinality", "selection", "max_rows", "aggregate_bounds", "batch", "deduplication", "version_advance"]);
 var SELECTION_KEYS = /* @__PURE__ */ new Set(["all"]);
 var PREDICATE_TERM_KEYS = /* @__PURE__ */ new Set(["column", "operator", "value"]);
@@ -52,6 +52,7 @@ var NUMERIC_BOUND_KEYS = /* @__PURE__ */ new Set(["minimum", "maximum"]);
 var TRANSITION_GUARD_KEYS = /* @__PURE__ */ new Set(["from_column", "allowed"]);
 var CONFLICT_GUARD_KEYS = /* @__PURE__ */ new Set(["column", "weak_guard_ack"]);
 var APPROVAL_KEYS = /* @__PURE__ */ new Set(["mode", "required_role", "required_approvals", "policy"]);
+var EXECUTION_KEYS = /* @__PURE__ */ new Set(["supervised_worker"]);
 var WRITEBACK_KEYS = /* @__PURE__ */ new Set(["mode", "executor", "idempotency_key"]);
 var REVERSIBILITY_KEYS = /* @__PURE__ */ new Set(["mode"]);
 var AGGREGATE_READ_KEYS = /* @__PURE__ */ new Set(["function", "count_mode", "column", "selection", "minimum_group_size"]);
@@ -273,8 +274,8 @@ function validateContexts(value, errors, warnings) {
 }
 function validateCapabilities(value, contextNames, resourceNames, errors, warnings) {
   const names = /* @__PURE__ */ new Set();
-  if (!Array.isArray(value) || value.length === 0) {
-    errors.push({ path: "$.capabilities", code: "CAPABILITIES_REQUIRED", message: "At least one capability is required." });
+  if (!Array.isArray(value)) {
+    errors.push({ path: "$.capabilities", code: "CAPABILITIES_REQUIRED", message: "capabilities must be an array; an empty array represents zero authority." });
     return names;
   }
   value.forEach((capability, index) => {
@@ -1001,6 +1002,55 @@ function validateProposalAction(value, subject, path, errors) {
       });
     }
   }
+  if (value.execution !== void 0) {
+    validateNestedObject(value.execution, EXECUTION_KEYS, `${path}.execution`, errors);
+    if (isRecord(value.execution) && value.execution.supervised_worker !== "allowed") {
+      errors.push({
+        path: `${path}.execution.supervised_worker`,
+        code: "INVALID_SUPERVISED_WORKER_PERMISSION",
+        message: "execution.supervised_worker must be allowed when the optional permission is present."
+      });
+    }
+    if (isRecord(value.execution) && value.execution.supervised_worker === "allowed") {
+      const cardinality = isRecord(value.operation) ? value.operation.cardinality ?? "single" : "single";
+      const writebackMode = isRecord(value.writeback) ? value.writeback.mode : "direct_sql";
+      if (writebackMode !== "direct_sql") {
+        errors.push({
+          path: `${path}.writeback.mode`,
+          code: "SUPERVISED_WORKER_DIRECT_SQL_REQUIRED",
+          message: "supervised-worker execution is initially limited to Runner-owned direct_sql writeback."
+        });
+      }
+      if (cardinality !== "single") {
+        errors.push({
+          path: `${path}.operation.cardinality`,
+          code: "SUPERVISED_WORKER_SINGLE_ROW_REQUIRED",
+          message: "supervised-worker execution is initially limited to deterministic single-row writes."
+        });
+      }
+      if (deleteOperation) {
+        errors.push({
+          path: `${path}.operation.kind`,
+          code: "SUPERVISED_WORKER_DELETE_FORBIDDEN",
+          message: "hard DELETE is not eligible for supervised-worker execution in this release."
+        });
+      }
+      if (value.reversibility !== void 0) {
+        errors.push({
+          path: `${path}.reversibility`,
+          code: "SUPERVISED_WORKER_REVERSIBILITY_FORBIDDEN",
+          message: "reviewed compensation actions require manual execution in this release."
+        });
+      }
+      if (operation === "update" && (!isRecord(value.conflict_guard) || !isSafeIdentifier(value.conflict_guard.column) || value.conflict_guard.weak_guard_ack === true)) {
+        errors.push({
+          path: `${path}.conflict_guard.column`,
+          code: "SUPERVISED_WORKER_EXACT_CONFLICT_GUARD_REQUIRED",
+          message: "supervised-worker UPDATE requires an exact source version/conflict column; a weak row hash is not eligible."
+        });
+      }
+    }
+  }
   if (value.writeback !== void 0) {
     validateNestedObject(value.writeback, WRITEBACK_KEYS, `${path}.writeback`, errors);
     if (isRecord(value.writeback) && !["direct_sql", "app_handler", "cloud_worker", "none"].includes(String(value.writeback.mode)))

package/dist/cli.d.ts

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
-import { type DbRowReader } from "@synapsor-runner/mcp-server";
-import { type StoredWritebackIntent } from "@synapsor-runner/proposal-store";
+import { type DbRowReader, type RuntimeCapabilityConfig, type RuntimeConfig, type RuntimeSupervisedWorkerCapabilityPolicy } from "@synapsor-runner/mcp-server";
+import { ProposalStore, type PolicyApprovalLimit, type StoredProposal, type StoredWritebackIntent } from "@synapsor-runner/proposal-store";
 import { type ExecutionReceiptV2, type ExecutionReceiptV3, type ExecutionReceiptV4, type WritebackJob } from "@synapsor-runner/protocol";
 import { type SchemaInspection } from "@synapsor-runner/schema-inspector";
 import { type ReconciliationObservation } from "@synapsor-runner/worker-core";
+import { type WorkbenchDeploymentProfile } from "./local-ui.js";
 export declare function main(argv: string[]): Promise<number>;
 type WizardAsk = (question: string, defaultValue?: string) => Promise<string>;
 export declare function runInitWizard(args: string[], options?: {
@@ -19,5 +20,21 @@ export declare function verifyLocalWritebackAuthority(job: WritebackJob, configP
 }): Promise<void>;
 export declare function reconciliationSupportedOutcome(observation: ReconciliationObservation): "applied" | "conflict" | "failed";
 export declare function reconciliationReceipt(intent: StoredWritebackIntent, observation: ReconciliationObservation, outcome: "applied" | "conflict" | "failed", runnerId: string, reason: string): ExecutionReceiptV2 | ExecutionReceiptV3 | ExecutionReceiptV4;
+export declare function assertSupervisedPolicyApprovalCurrent(store: ProposalStore, config: RuntimeConfig, capability: RuntimeCapabilityConfig, proposal: StoredProposal): {
+    policy: string;
+    limits: PolicyApprovalLimit[];
+} | undefined;
+export type SupervisedWriterPostureAssessment = {
+    ok: boolean;
+    fingerprint: `sha256:${string}`;
+    expected_fingerprint: `sha256:${string}` | null;
+    reasons: string[];
+    allowed_relations: string[];
+    writable_relations: string[];
+};
+export declare function assessSupervisedWriterPosture(config: RuntimeConfig, policy: RuntimeSupervisedWorkerCapabilityPolicy, inspection: SchemaInspection): SupervisedWriterPostureAssessment;
+export declare function updateSupervisedProposalExpiryAttention(store: ProposalStore, config: RuntimeConfig, now?: string): void;
+export declare function workbenchDeploymentProfileArg(args: string[]): WorkbenchDeploymentProfile | undefined;
+export declare function runCliProcess(argv: string[]): Promise<number>;
 export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,OAAO,EAAsc,KAAK,WAAW,EAA2L,MAAM,6BAA6B,CAAC;AAI5rB,OAAO,EAsBL,KAAK,qBAAqB,EAK3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAiL,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAqG,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAEjb,OAAO,EAQL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAaL,KAAK,yBAAyB,EAG/B,MAAM,8BAA8B,CAAC;AAgXtC,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsE1D;AAwID,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA+YjB;AA81JD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAc/H;AAojBD,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,IAAI,CAAC,CA0Hf;AAsvDD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAaA,OAAO,EAAkgB,KAAK,WAAW,EAAuD,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,KAAK,uCAAuC,EAAoF,MAAM,6BAA6B,CAAC;AAItyB,OAAO,EAEL,aAAa,EAab,KAAK,mBAAmB,EAcxB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAO3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAiL,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAE,KAAK,kBAAkB,EAAqG,KAAK,YAAY,EAAwB,MAAM,2BAA2B,CAAC;AAEjb,OAAO,EASL,KAAK,gBAAgB,EAEtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAcL,KAAK,yBAAyB,EAG/B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,KAAK,0BAA0B,EAQhC,MAAM,eAAe,CAAC;AA8ZvB,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6E1D;AAwID,KAAK,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAE9E,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IACP,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CACvC,GACL,OAAO,CAAC,MAAM,CAAC,CA+YjB;AAokKD,wBAAsB,0BAA0B,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAc/H;AAojBD,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,IAAI,CAAC,CA0Hf;AA41DD,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAKxH;AA2BD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,WAAW,EAAE,yBAAyB,EACtC,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,EAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,kBAAkB,GAAG,kBAAkB,GAAG,kBAAkB,CAgH9D;AAqtHD,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,uBAAuB,EACnC,QAAQ,EAAE,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,mBAAmB,EAAE,CAAA;CAAE,GAAG,SAAS,CAgD/D;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC9C,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,UAAU,MAAM,EAAE,CAAC;IAChC,oBAAoB,EAAE,UAAU,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,uCAAuC,EAC/C,UAAU,EAAE,gBAAgB,GAC3B,iCAAiC,CA2HnC;AA8sBD,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,aAAa,EACrB,GAAG,SAA2B,GAC7B,IAAI,CAqFN;AAizBD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,0BAA0B,GAAG,SAAS,CAOpG;AAovKD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BnE"}

package/dist/local-ui.d.ts

@@ -1,6 +1,7 @@
 import { type Server } from "node:http";
 import { type ProposalFreshnessEvaluation } from "@synapsor-runner/mcp-server";
-import { ProposalStore, type StoredProposal } from "@synapsor-runner/proposal-store";
+import { ProposalStore, type StoredProposal, type WorkerControlAction } from "@synapsor-runner/proposal-store";
+import { inspectDatabase } from "@synapsor-runner/schema-inspector";
 type JsonRecord = Record<string, unknown>;
 export type LocalUiOptions = {
     configPath?: string;
@@ -15,8 +16,78 @@ export type LocalUiOptions = {
     projectRoot?: string;
     storeAccess?: LocalUiStoreAccess;
     safeActionPreview?: SafeActionPreview;
+    guidedActionPreview?: GuidedActionPreview;
     freshnessEvaluator?: ProposalFreshnessEvaluator;
+    schemaInspector?: typeof inspectDatabase;
+    ledgerScope?: WorkbenchLedgerScope;
+    deploymentProfile?: WorkbenchDeploymentProfile;
+    proposalApprove?: WorkbenchProposalDecision;
+    proposalApply?: WorkbenchProposalDecision;
+    attentionAcknowledge?: WorkbenchAttentionDecision;
+    workerDecision?: WorkbenchWorkerDecision;
+    workerReconciliationInspect?: WorkbenchReconciliationInspect;
+    workerReconciliationResolve?: WorkbenchReconciliationResolve;
 };
+export type WorkbenchDeploymentProfile = "development" | "staging" | "production" | "unknown";
+export type WorkbenchLedgerScope = {
+    tenant?: string;
+    principal?: string;
+    required?: boolean;
+};
+export type WorkbenchProposalDecision = (input: {
+    proposalId: string;
+    actor?: string;
+    reason?: string;
+    identityToken?: string;
+}) => Promise<{
+    code: number;
+}>;
+export type WorkbenchAttentionDecision = (input: {
+    attentionId: string;
+    actor?: string;
+    identityToken?: string;
+}) => Promise<{
+    code: number;
+}>;
+export type WorkbenchWorkerDecision = (input: {
+    action: WorkerControlAction | "cancel" | "dead_letter_requeue" | "dead_letter_discard";
+    capability?: string;
+    contractDigest?: `sha256:${string}`;
+    proposalId?: string;
+    retryBudget?: number;
+    actor?: string;
+    reason?: string;
+    identityToken?: string;
+}) => Promise<{
+    code: number;
+}>;
+export type WorkbenchReconciliationView = {
+    intent_id: string;
+    proposal_id: string;
+    operation: string;
+    intent_status: string;
+    reconciliation_reason?: string;
+    classification: string;
+    supported_outcome: "applied" | "conflict" | "failed";
+    observed_digest: `sha256:${string}`;
+    expected_fields: string[];
+    observed_fields: string[];
+    member_count: number;
+    member_classifications: Record<string, number>;
+    source_database_changed: false;
+};
+export type WorkbenchReconciliationInspect = (input: {
+    intentId: string;
+}) => Promise<WorkbenchReconciliationView>;
+export type WorkbenchReconciliationResolve = (input: {
+    intentId: string;
+    outcome: "applied" | "conflict" | "failed";
+    actor?: string;
+    reason: string;
+    identityToken?: string;
+}) => Promise<{
+    code: number;
+}>;
 export type SafeActionPreview = (input: {
     projectRoot: string;
     configPath: string;
@@ -28,6 +99,19 @@ export type SafeActionPreview = (input: {
     proposal_hash: string;
     source_database_changed: boolean;
 }>;
+export type GuidedActionPreview = (input: {
+    projectRoot: string;
+    configPath: string;
+    storePath: string;
+    capabilityName: string;
+    args: JsonRecord;
+    env: NodeJS.ProcessEnv;
+}) => Promise<{
+    draft_digest: `sha256:${string}`;
+    proposal_id: string;
+    proposal_hash: string;
+    source_database_changed: boolean;
+}>;
 export type ProposalFreshnessEvaluator = (proposal: StoredProposal) => Promise<ProposalFreshnessEvaluation>;
 export type LocalUiStoreAccess = <T>(mode: "read" | "write", operation: string, callback: (store: ProposalStore) => T) => Promise<T>;
 export type LocalUiServer = {

package/dist/local-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAmG,KAAK,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAChL,OAAO,EAAE,aAAa,EAA2B,KAAK,cAAc,EAAE,MAAM,iCAAiC,CAAC;AA0B9G,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;CACjD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;CAClB,KAAK,OAAO,CAAC;IACZ,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CACvC,QAAQ,EAAE,cAAc,KACrB,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAE1C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAqD7F"}
+{"version":3,"file":"local-ui.d.ts","sourceRoot":"","sources":["../src/local-ui.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,WAAW,CAAC;AAIjG,OAAO,EAAmG,KAAK,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAChL,OAAO,EACL,aAAa,EAQb,KAAK,cAAc,EACnB,KAAK,mBAAmB,EAEzB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AA6DpE,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkB1C,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD,eAAe,CAAC,EAAE,OAAO,eAAe,CAAC;IACzC,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C,eAAe,CAAC,EAAE,yBAAyB,CAAC;IAC5C,aAAa,CAAC,EAAE,yBAAyB,CAAC;IAC1C,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,cAAc,CAAC,EAAE,uBAAuB,CAAC;IACzC,2BAA2B,CAAC,EAAE,8BAA8B,CAAC;IAC7D,2BAA2B,CAAC,EAAE,8BAA8B,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9F,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhC,MAAM,MAAM,0BAA0B,GAAG,CAAC,KAAK,EAAE;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhC,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE;IAC5C,MAAM,EACF,mBAAmB,GACnB,QAAQ,GACR,qBAAqB,GACrB,qBAAqB,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,UAAU,MAAM,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhC,MAAM,MAAM,2BAA2B,GAAG;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACrD,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC;IACpC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,uBAAuB,EAAE,KAAK,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,CAAC,KAAK,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAE3C,MAAM,MAAM,8BAA8B,GAAG,CAAC,KAAK,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhC,MAAM,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,UAAU,CAAC;CAClB,KAAK,OAAO,CAAC;IACZ,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB,KAAK,OAAO,CAAC;IACZ,YAAY,EAAE,UAAU,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,uBAAuB,EAAE,OAAO,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CACvC,QAAQ,EAAE,cAAc,KACrB,OAAO,CAAC,2BAA2B,CAAC,CAAC;AAE1C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,EACjC,IAAI,EAAE,MAAM,GAAG,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,CAAC,KAClC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAAC;AAEF,wBAAsB,kBAAkB,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC,CAkF7F"}