@vendoai/apps 0.4.0

package/dist/schedules.js

@@ -0,0 +1,334 @@
+import { VendoError, } from "@vendoai/core";
+import { Cron } from "croner";
+import { z } from "zod";
+import { requestAppWithBootRetry } from "./box-agent.js";
+import { parseVendoManifest } from "./manifest.js";
+import { appLifecycleEvent } from "./audit.js";
+import { rowFromRecord } from "./persistence.js";
+/**
+ * execution-v2 Wave 2 Lane D — BYO schedule execution. Any external cron
+ * (Vercel cron, GitHub Actions, crontab — or later the Cloud broker calling
+ * the same surface) hits the host's authenticated tick; this engine reads each
+ * machine-bearing app's `vendo.json` schedule declarations (Lane C's parser)
+ * over the box door, computes due-ness against store-cached last-fired state,
+ * wakes ONLY due machines, POSTs their declared `/fn/<name>` targets as the
+ * app owner's away execution, and lets the normal idle policy put the box back
+ * to sleep.
+ *
+ * The store cache is what keeps sleeping machines asleep: due-ness never
+ * requires a wake. The accepted consequence is that a manifest edited while
+ * the machine sleeps is not seen until the machine is next awake — the engine
+ * re-reads `vendo.json` whenever the machine is awake at tick time (and on the
+ * first tick after graduation, which wakes once to learn the schedules), and
+ * {@link ScheduleEngine.syncManifest} is the explicit hook the Wave-3 in-box
+ * agent calls at edit-complete.
+ */
+export const SCHEDULE_STATE_COLLECTION = "vendo_app_schedules";
+/** Bounded CAS retries before an app's state write reports a conflict. */
+const CLAIM_ATTEMPTS = 3;
+const decoder = new TextDecoder();
+const scheduleStateSchema = z.object({
+    syncedAt: z.string(),
+    schedules: z.array(z.object({
+        cron: z.string(),
+        fn: z.string(),
+        since: z.string(),
+        lastFiredAt: z.string().optional(),
+        lastStatus: z.enum(["ok", "error"]).optional(),
+    })),
+});
+/**
+ * The latest occurrence of `cron` after `baseline` and at or before `at`, or
+ * undefined when none is due. Exact for ANY downtime length: a binary search
+ * over the window (each probe one croner `nextRun`), never a bounded forward
+ * scan — so a host offline for months still collapses to ONE fire at the
+ * latest occurrence, with no truncated catch-up batches (AI-review triage,
+ * PR #406). Occurrences of a five-field cron are ≥60s apart, so once the
+ * window shrinks under a second, `lo` (always a known occurrence ≤ at) is it.
+ */
+const latestDueOccurrence = (cron, baseline, at) => {
+    const job = new Cron(cron, { timezone: "UTC", paused: true });
+    const first = job.nextRun(new Date(baseline));
+    if (first === null || first.getTime() > at.getTime())
+        return undefined;
+    let lo = first.getTime();
+    let hi = at.getTime();
+    while (hi - lo > 1000) {
+        const mid = lo + Math.floor((hi - lo) / 2);
+        const next = job.nextRun(new Date(mid));
+        if (next !== null && next.getTime() <= at.getTime())
+            lo = next.getTime();
+        else
+            hi = mid;
+    }
+    return new Date(lo).toISOString();
+};
+/** Croner is the cron arbiter: a declaration the manifest's field-shape regex
+ *  admits but no calendar time satisfies (e.g. "99 99 * * *") must fail LOUDLY
+ *  at the read boundary, not on a later tick's due computation. */
+const assertCronValid = (cron, appId) => {
+    try {
+        // paused: constructed for validation only, never scheduled.
+        new Cron(cron, { timezone: "UTC", paused: true });
+    }
+    catch (error) {
+        throw new VendoError("validation", `invalid vendo.json: schedule cron "${cron}" is not a valid cron expression: ${error instanceof Error ? error.message : "invalid"}`, { appId });
+    }
+};
+export const createScheduleEngine = (config) => {
+    const states = config.store.records(SCHEDULE_STATE_COLLECTION);
+    const apps = config.store.records("vendo_apps");
+    let running;
+    const machineRows = async () => {
+        const machineBearing = [];
+        let cursor;
+        do {
+            const page = await apps.list(cursor === undefined ? {} : { cursor });
+            for (const record of page.records) {
+                let row;
+                try {
+                    row = rowFromRecord(record);
+                }
+                catch {
+                    continue; // Corrupt rows cannot schedule, and must not break the tick.
+                }
+                if (row.doc.machine === undefined)
+                    continue;
+                machineBearing.push({ id: record.id, subject: row.subject, doc: row.doc });
+            }
+            cursor = page.cursor;
+        } while (cursor !== undefined);
+        return machineBearing;
+    };
+    /** State rows whose app lost its machine (or is gone) are ghost schedules —
+     *  swept by listing the (small) state collection, never by probing every
+     *  layer-1 app row. */
+    const sweepStaleStates = async (machineBearing) => {
+        let cursor;
+        const stale = [];
+        do {
+            const page = await states.list(cursor === undefined ? {} : { cursor });
+            for (const record of page.records) {
+                if (!machineBearing.has(record.id))
+                    stale.push(record.id);
+            }
+            cursor = page.cursor;
+        } while (cursor !== undefined);
+        for (const appId of stale)
+            await states.delete(appId).catch(() => undefined);
+    };
+    const readState = async (appId) => {
+        const record = await states.get(appId);
+        if (record === null)
+            return null;
+        const parsed = scheduleStateSchema.safeParse(record.data);
+        // Corrupt state re-syncs from the box rather than wedging the tick.
+        return parsed.success ? parsed.data : null;
+    };
+    /**
+     * Read-mutate-CAS on one app's schedule state (the lifecycle's document
+     * pattern): EVERY state write is revision-checked where the store supports
+     * it, so a concurrent claim's `lastFiredAt` can never be rolled back by a
+     * racing manifest sync or outcome note (AI-review triage, PR #406). The
+     * mutate callback sees the freshest state on every attempt.
+     */
+    const updateState = async (appId, mutate) => {
+        for (let attempt = 0; attempt < CLAIM_ATTEMPTS; attempt += 1) {
+            const record = await states.get(appId);
+            const parsed = record === null ? null : scheduleStateSchema.safeParse(record.data);
+            const previous = parsed !== null && parsed.success ? parsed.data : null;
+            const next = mutate(previous);
+            const input = { id: appId, data: next };
+            if (record === null || states.atomic === undefined || record.revision === undefined) {
+                await states.put(input);
+                return next;
+            }
+            const swapped = await states.atomic.compareAndSwap(input, record.revision);
+            if (swapped !== null)
+                return next;
+        }
+        throw new VendoError("conflict", `schedule state for ${appId} was concurrently modified`, { appId });
+    };
+    const syncManifest = async (app, at = new Date()) => {
+        const machine = await config.lifecycle.wake(app);
+        // A wake may resume a snapshot whose app is still booting; retry the
+        // manifest read past the provider's transient "port not open".
+        const answer = await requestAppWithBootRetry(machine, { method: "GET", path: "/vendo.json" }, config.bootRetry ?? {});
+        let declared;
+        if (answer.status === 404) {
+            // No manifest is a valid box: it just declares no schedules.
+            declared = [];
+        }
+        else if (answer.status >= 200 && answer.status < 300) {
+            declared = parseVendoManifest(decoder.decode(answer.body)).schedules ?? [];
+        }
+        else {
+            throw new VendoError("validation", `vendo.json read failed (${answer.status})`, { appId: app.id });
+        }
+        for (const { cron } of declared)
+            assertCronValid(cron, app.id);
+        return updateState(app.id, (previous) => {
+            const carried = new Map((previous?.schedules ?? []).map((schedule) => [`${schedule.cron}\n${schedule.fn}`, schedule]));
+            return {
+                syncedAt: at.toISOString(),
+                schedules: declared.map(({ cron, fn }) => {
+                    const kept = carried.get(`${cron}\n${fn}`);
+                    return kept === undefined ? { cron, fn, since: at.toISOString() } : { ...kept };
+                }),
+            };
+        });
+    };
+    /** Claim the due occurrences in the store BEFORE firing (at-most-once): a
+     *  racer re-reads and finds nothing due. CAS when the store supports it;
+     *  read-then-put otherwise (the lifecycle's own degradation posture). */
+    const claimDue = async (appId, at) => {
+        for (let attempt = 0; attempt < CLAIM_ATTEMPTS; attempt += 1) {
+            const record = await states.get(appId);
+            if (record === null)
+                return null;
+            const parsed = scheduleStateSchema.safeParse(record.data);
+            if (!parsed.success)
+                return null;
+            const state = parsed.data;
+            const due = [];
+            const next = {
+                ...state,
+                schedules: state.schedules.map((schedule) => {
+                    // A legacy-cached cron croner rejects is contained per schedule
+                    // (sync validates new declarations; this guards old cache rows).
+                    let scheduledFor;
+                    try {
+                        scheduledFor = latestDueOccurrence(schedule.cron, schedule.lastFiredAt ?? schedule.since, at);
+                    }
+                    catch {
+                        scheduledFor = undefined;
+                    }
+                    if (scheduledFor === undefined)
+                        return schedule;
+                    due.push({ cron: schedule.cron, fn: schedule.fn, scheduledFor });
+                    return { ...schedule, lastFiredAt: scheduledFor };
+                }),
+            };
+            if (due.length === 0)
+                return { state, due };
+            const input = { id: appId, data: next };
+            if (states.atomic === undefined || record.revision === undefined) {
+                await states.put(input);
+                return { state: next, due };
+            }
+            const swapped = await states.atomic.compareAndSwap(input, record.revision);
+            if (swapped !== null)
+                return { state: next, due };
+        }
+        return { conflict: true };
+    };
+    const recordOutcome = async (appId, fn, cron, status) => {
+        // Best-effort doctor detail; the claim already made the fire durable.
+        await updateState(appId, (previous) => ({
+            syncedAt: previous?.syncedAt ?? new Date().toISOString(),
+            schedules: (previous?.schedules ?? []).map((schedule) => schedule.cron === cron && schedule.fn === fn ? { ...schedule, lastStatus: status } : schedule),
+        })).catch(() => undefined);
+    };
+    const fireApp = async (row, at, report) => {
+        let state = await readState(row.id);
+        if (state === null) {
+            // First tick after graduation: wake once to learn the schedules. Nothing
+            // can be due yet — declarations only fire forward from their sync.
+            state = await syncManifest(row.doc, at);
+            return;
+        }
+        if (config.lifecycle.peek(row.id) !== undefined) {
+            // The box is awake anyway — re-read vendo.json so schedule edits made
+            // inside the box (agent sessions, layer-3 apps) are picked up. A failed
+            // refresh FAILS CLOSED for this tick: the cached declarations were just
+            // proven stale-or-unreadable, so firing them would honor a manifest the
+            // box may no longer declare. Loud error now, retry next tick.
+            try {
+                state = await syncManifest(row.doc, at);
+            }
+            catch (error) {
+                report.errors.push({ appId: row.id, message: error instanceof Error ? error.message : "manifest refresh failed" });
+                return;
+            }
+        }
+        const claimed = await claimDue(row.id, at);
+        if (claimed === null)
+            return;
+        if ("conflict" in claimed) {
+            report.errors.push({ appId: row.id, message: "schedule state was concurrently modified" });
+            return;
+        }
+        for (const { cron, fn, scheduledFor } of claimed.due) {
+            // The app's owner, away, in the app venue — the same authority a tree
+            // action carries when the owner isn't looking; box callbacks during the
+            // run ride the app token through the existing guard seams.
+            const ctx = {
+                principal: { kind: "user", subject: row.subject },
+                venue: "app",
+                presence: "away",
+                sessionId: `schedule_${row.id}`,
+                appId: row.id,
+            };
+            const outcome = await config.callFn(row.doc, fn, {}, ctx);
+            const status = outcome.status === "ok" ? "ok" : "error";
+            report.fired.push({
+                appId: row.id,
+                fn,
+                cron,
+                scheduledFor,
+                status,
+                ...(outcome.status === "error" ? { message: outcome.error.message } : {}),
+            });
+            await recordOutcome(row.id, fn, cron, status);
+            await config.audit?.(appLifecycleEvent({ kind: "user", subject: row.subject }, { venue: "app", presence: "away" }, row.id, { operation: "schedule-fire", fn, cron, scheduledFor }, outcome.status));
+        }
+    };
+    const runTick = async (at) => {
+        const report = { checked: 0, fired: [], errors: [] };
+        const machineBearing = await machineRows();
+        await sweepStaleStates(new Set(machineBearing.map((row) => row.id)));
+        for (const row of machineBearing) {
+            report.checked += 1;
+            try {
+                await fireApp(row, at, report);
+            }
+            catch (error) {
+                report.errors.push({ appId: row.id, message: error instanceof Error ? error.message : "schedule tick failed" });
+            }
+        }
+        return report;
+    };
+    return {
+        tick(at = new Date()) {
+            const inflight = running;
+            if (inflight !== undefined)
+                return inflight;
+            const run = runTick(at).finally(() => {
+                running = undefined;
+            });
+            running = run;
+            return run;
+        },
+        syncManifest,
+        async clearForApp(appId) {
+            await states.delete(appId).catch(() => undefined);
+        },
+        async report() {
+            const machineBearing = await machineRows();
+            const statuses = [];
+            for (const row of machineBearing) {
+                const state = await readState(row.id);
+                statuses.push({
+                    appId: row.id,
+                    name: row.doc.name,
+                    provisionedAt: row.doc.machine?.provisionedAt ?? "",
+                    awake: config.lifecycle.peek(row.id) !== undefined,
+                    ...(state === null ? {} : { syncedAt: state.syncedAt }),
+                    schedules: state?.schedules ?? [],
+                });
+            }
+            return statuses;
+        },
+    };
+};
+//# sourceMappingURL=schedules.js.map

package/dist/schedules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedules.js","sourceRoot":"","sources":["../src/schedules.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,GAQX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAE/D,0EAA0E;AAC1E,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAkBlC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC,CAAC;CACJ,CAAC,CAAC;AA8DH;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAQ,EAAsB,EAAE;IAC3F,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;IACzB,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE;YAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;;YACpE,EAAE,GAAG,GAAG,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF;;mEAEmE;AACnE,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,KAAY,EAAQ,EAAE;IAC3D,IAAI,CAAC;QACH,4DAA4D;QAC5D,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAClB,YAAY,EACZ,sCAAsC,IAAI,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,EACnI,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAA4B,EAAkB,EAAE;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,OAAgD,CAAC;IAErD,MAAM,WAAW,GAAG,KAAK,IAAuB,EAAE;QAChD,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,IAAI,MAA0B,CAAC;QAC/B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,GAAG,CAAC;gBACR,IAAI,CAAC;oBACH,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,6DAA6D;gBACzE,CAAC;gBACD,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAS;gBAC5C,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACvB,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;QAC/B,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF;;2BAEuB;IACvB,MAAM,gBAAgB,GAAG,KAAK,EAAE,cAAkC,EAAiB,EAAE;QACnF,IAAI,MAA0B,CAAC;QAC/B,MAAM,KAAK,GAAY,EAAE,CAAC;QAC1B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACvE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACvB,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;QAC/B,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,EAAE,KAAY,EAAoC,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,oEAAoE;QACpE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,WAAW,GAAG,KAAK,EACvB,KAAY,EACZ,MAA+D,EACpC,EAAE;QAC7B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC9B,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAuB,EAAE,CAAC;YAC3D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpF,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,sBAAsB,KAAK,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvG,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,GAAgB,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE,EAA6B,EAAE;QAC1F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACtH,IAAI,QAA6C,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,6DAA6D;YAC7D,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvD,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QAC7E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,2BAA2B,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ;YAAE,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvH,OAAO;gBACL,QAAQ,EAAE,EAAE,CAAC,WAAW,EAAE;gBAC1B,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC3C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBAClF,CAAC,CAAC;aACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF;;6EAEyE;IACzE,MAAM,QAAQ,GAAG,KAAK,EACpB,KAAY,EACZ,EAAQ,EAC0H,EAAE;QACpI,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,cAAc,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;YAC1B,MAAM,GAAG,GAA8D,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAqB;gBAC7B,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;oBAC1C,gEAAgE;oBAChE,iEAAiE;oBACjE,IAAI,YAAgC,CAAC;oBACrC,IAAI,CAAC;wBACH,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChG,CAAC;oBAAC,MAAM,CAAC;wBACP,YAAY,GAAG,SAAS,CAAC;oBAC3B,CAAC;oBACD,IAAI,YAAY,KAAK,SAAS;wBAAE,OAAO,QAAQ,CAAC;oBAChD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjE,OAAO,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;gBACpD,CAAC,CAAC;aACH,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAuB,EAAE,CAAC;YAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjE,MAAM,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;YAC9B,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAAE,KAAY,EAAE,EAAU,EAAE,IAAY,EAAE,MAAsB,EAAiB,EAAE;QAC5G,sEAAsE;QACtE,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxD,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACtD,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;SACjG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAAE,EAAQ,EAAE,MAA0B,EAAiB,EAAE;QACzF,IAAI,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,yEAAyE;YACzE,mEAAmE;YACnE,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,8DAA8D;YAC9D,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC;gBACnH,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO;QAC7B,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACrD,sEAAsE;YACtE,wEAAwE;YACxE,2DAA2D;YAC3D,MAAM,GAAG,GAAe;gBACtB,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;gBACjD,KAAK,EAAE,KAAK;gBACZ,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,YAAY,GAAG,CAAC,EAAE,EAAE;gBAC/B,KAAK,EAAE,GAAG,CAAC,EAAE;aACd,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YACxD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBAChB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,EAAE;gBACF,IAAI;gBACJ,YAAY;gBACZ,MAAM;gBACN,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,iBAAiB,CACpC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EACtC,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAClC,GAAG,CAAC,EAAE,EACN,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EACtD,OAAO,CAAC,MAAM,CACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,EAAQ,EAA+B,EAAE;QAC9D,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACzE,MAAM,cAAc,GAAG,MAAM,WAAW,EAAE,CAAC;QAC3C,MAAM,gBAAgB,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC,CAAC;YAClH,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,CAAC,EAAE,GAAG,IAAI,IAAI,EAAE;YAClB,MAAM,QAAQ,GAAG,OAAO,CAAC;YACzB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC;YAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACnC,OAAO,GAAG,SAAS,CAAC;YACtB,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC;YACd,OAAO,GAAG,CAAC;QACb,CAAC;QACD,YAAY;QACZ,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,cAAc,GAAG,MAAM,WAAW,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAwB,EAAE,CAAC;YACzC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI;oBAClB,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE;oBACnD,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;oBAClD,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACvD,SAAS,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/secret-exposure.d.ts

@@ -0,0 +1,55 @@
+import { type AppId, type ApprovalId, type IsoDateTime, type StoreAdapter } from "@vendoai/core";
+/**
+ * ENG-345 — the guarded per-secret in-sandbox exposure grant (secrets
+ * fast-follow to the Option B gateway pick).
+ *
+ * Option B stays the DEFAULT: a declared secret enters the sandbox as an opaque
+ * handle and is substituted only at the egress proxy (06-apps §4.3). This grant
+ * is the EXCEPTION path — an explicit, per-secret × per-app, owner-only opt-in
+ * that places the REAL value into the sandbox env instead of a handle. It is:
+ *   - off by default (no record → handle),
+ *   - owner-only (only the principal who owns the app copy can set it),
+ *   - gated by the guard's existing high-risk approval flow (written `active`
+ *     only after the parked critical approval is decided approved),
+ *   - audited per run (machine.ts emits one exposed-run event per run), and
+ *   - NEVER carried by shares/remixes.
+ *
+ * The last invariant is enforced structurally, not by stripping: these grants
+ * live in their OWN store collection keyed by the app's id, and are never part
+ * of the app document that exportApp/share/publish/fork/importApp copy. A copy
+ * always gets a fresh AppId (06-apps §7), which by construction has no grants —
+ * so a copied app can never inherit an exposure grant.
+ */
+export interface SecretExposureGrant {
+    appId: AppId;
+    secretName: string;
+    /** The app owner's principal subject — the only principal who may set this. */
+    owner: string;
+    /** `pending` = parked on a high-risk approval; `active` = approved and live. */
+    status: "pending" | "active";
+    /** The guard approval that gates turning this on (06-apps §9 approval model). */
+    approvalId: ApprovalId;
+    requestedAt: IsoDateTime;
+    grantedAt?: IsoDateTime;
+}
+/** ENG-345 — persistence for per-secret × per-app in-sandbox exposure grants. */
+export interface SecretExposure {
+    /** Active grants for one app (owner-scoped by construction). */
+    active(appId: AppId): Promise<SecretExposureGrant[]>;
+    /** Names of secrets currently exposed in-sandbox for one app. */
+    activeNames(appId: AppId): Promise<Set<string>>;
+    /** Every grant (pending + active) for one app. */
+    list(appId: AppId): Promise<SecretExposureGrant[]>;
+    /** Park a grant on a high-risk approval (status `pending`). */
+    putPending(grant: Omit<SecretExposureGrant, "status">): Promise<void>;
+    /** Flip a parked grant to `active` once its approval is approved. Returns the grant, or null if none pending. */
+    activate(appId: AppId, secretName: string): Promise<SecretExposureGrant | null>;
+    /** Turn a secret off — reverts to the Option B handle default. */
+    revoke(appId: AppId, secretName: string): Promise<void>;
+    /** Grants (pending/active) parked on a specific approval id. */
+    byApproval(approvalId: ApprovalId): Promise<SecretExposureGrant[]>;
+    /** Delete every grant for one app (app deletion cleanup). */
+    clearForApp(appId: AppId): Promise<void>;
+}
+export declare const createSecretExposure: (store: StoreAdapter) => SecretExposure;
+//# sourceMappingURL=secret-exposure.d.ts.map

package/dist/secret-exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-exposure.d.ts","sourceRoot":"","sources":["../src/secret-exposure.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EAElB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,iFAAiF;IACjF,UAAU,EAAE,UAAU,CAAC;IACvB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,WAAW,CAAC;CACzB;AAYD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACrD,iEAAiE;IACjE,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,kDAAkD;IAClD,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACnD,+DAA+D;IAC/D,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iHAAiH;IACjH,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAChF,kEAAkE;IAClE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,gEAAgE;IAChE,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACnE,6DAA6D;IAC7D,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,eAAO,MAAM,oBAAoB,GAAI,OAAO,YAAY,KAAG,cA+C1D,CAAC"}

package/dist/secret-exposure.js

@@ -0,0 +1,53 @@
+import { listAllRecords } from "./persistence.js";
+/** Deterministic id so re-requesting the same (app, secret) overwrites, never duplicates. */
+const recordId = (appId, secretName) => `xpo_${appId}__${secretName}`;
+const COLLECTION = "vendo_secret_exposure";
+const grantData = (record) => record.data;
+const listAll = (store, refs) => listAllRecords(store.records(COLLECTION), { refs });
+export const createSecretExposure = (store) => {
+    const collection = store.records(COLLECTION);
+    const refsFor = (grant) => ({
+        subject: grant.owner,
+        app_id: grant.appId,
+        secret: grant.secretName,
+        status: grant.status,
+        approval: grant.approvalId,
+    });
+    const list = async (appId) => (await listAll(store, { app_id: appId })).map(grantData);
+    return {
+        list,
+        async active(appId) {
+            return (await list(appId)).filter((grant) => grant.status === "active");
+        },
+        async activeNames(appId) {
+            return new Set((await list(appId)).filter((grant) => grant.status === "active").map((grant) => grant.secretName));
+        },
+        async putPending(grant) {
+            const full = { ...grant, status: "pending" };
+            await collection.put({ id: recordId(grant.appId, grant.secretName), data: full, refs: refsFor(full) });
+        },
+        async activate(appId, secretName) {
+            const record = await collection.get(recordId(appId, secretName));
+            if (record === null)
+                return null;
+            const grant = grantData(record);
+            if (grant.status === "active")
+                return grant;
+            const activated = { ...grant, status: "active", grantedAt: new Date().toISOString() };
+            await collection.put({ id: record.id, data: activated, refs: refsFor(activated) });
+            return activated;
+        },
+        async revoke(appId, secretName) {
+            await collection.delete(recordId(appId, secretName));
+        },
+        async byApproval(approvalId) {
+            return (await listAll(store, { approval: approvalId })).map(grantData);
+        },
+        async clearForApp(appId) {
+            for (const record of await listAll(store, { app_id: appId })) {
+                await collection.delete(record.id);
+            }
+        },
+    };
+};
+//# sourceMappingURL=secret-exposure.js.map

package/dist/secret-exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-exposure.js","sourceRoot":"","sources":["../src/secret-exposure.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAoClD,6FAA6F;AAC7F,MAAM,QAAQ,GAAG,CAAC,KAAY,EAAE,UAAkB,EAAU,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;AAE7F,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,MAAM,SAAS,GAAG,CAAC,MAAmB,EAAuB,EAAE,CAAC,MAAM,CAAC,IAA2B,CAAC;AAEnG,MAAM,OAAO,GAAG,CAAC,KAAmB,EAAE,IAA4B,EAA0B,EAAE,CAC5F,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AAsBtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAmB,EAAkB,EAAE;IAC1E,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,CAAC,KAA0B,EAA0B,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,MAAM,EAAE,KAAK,CAAC,UAAU;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,UAAU;KAC3B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,KAAK,EAAE,KAAY,EAAkC,EAAE,CAClE,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAE3D,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACpH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,MAAM,IAAI,GAAwB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAClE,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU;YAC9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;YACjE,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACjC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5C,MAAM,SAAS,GAAwB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3G,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU;YAC5B,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,UAAU;YACzB,OAAO,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBAC7D,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/ship-diff.d.ts

@@ -0,0 +1,47 @@
+import type { AppDocument, AppId } from "@vendoai/core";
+import { type PinBaseline } from "./pins.js";
+/**
+ * 06-apps §8–§9 — the reviewable ship-diff for one app version: everything the
+ * app would ship into the host page relative to the captured host baselines.
+ * This is the artifact a human approver reads before minting an
+ * `InClientApproval` (OSS computes and verifies; Cloud's review console
+ * displays it and mints). Additive runtime surface — not part of the frozen
+ * 06 §1 method table.
+ */
+export interface ShipDiff {
+    appId: AppId;
+    /** `appVersionHash` of the reviewed version — the hash an approval pins. */
+    versionHash: string;
+    /** Pinned host slots: the net diff of the fork against the captured baseline. */
+    pins: ShipDiffPin[];
+    /** Generated components with no host baseline: reviewed as pure additions. */
+    generated: ShipDiffGenerated[];
+}
+export interface ShipDiffPin {
+    slot: string;
+    /** The generated-component name the fork ships under (`pinComponentName`). */
+    component: string;
+    /** The baseline hash the pin was forked from (`Pin.base`). */
+    baseHash: string;
+    /** The hash of the currently captured host baseline, when one exists. */
+    baselineHash?: string;
+    /**
+     * True when the host component changed under the pin (baseline hash no
+     * longer matches `baseHash`) or the baseline is missing entirely — the
+     * approver is not looking at the source the fork was made from.
+     */
+    drifted: boolean;
+    /** Unified diff from the captured host source to the shipped fork source. */
+    diff: string;
+}
+export interface ShipDiffGenerated {
+    component: string;
+    /** Unified diff from nothing — the entire shipped source, as additions. */
+    diff: string;
+}
+/**
+ * Compute the ship-diff of an app version against the captured host baselines.
+ * Pure over its inputs so Cloud's console and tests can reuse it verbatim.
+ */
+export declare const computeShipDiff: (doc: AppDocument, baselines: readonly PinBaseline[]) => ShipDiff;
+//# sourceMappingURL=ship-diff.d.ts.map

package/dist/ship-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ship-diff.d.ts","sourceRoot":"","sources":["../src/ship-diff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAmC,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG9E;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,8EAA8E;IAC9E,SAAS,EAAE,iBAAiB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,KAAK,WAAW,EAChB,WAAW,SAAS,WAAW,EAAE,KAChC,QA8BF,CAAC"}

package/dist/ship-diff.js

@@ -0,0 +1,39 @@
+import { appVersionHash } from "./version-hash.js";
+import { pinComponentName, pinForkSource } from "./pins.js";
+import { unifiedDiff } from "./unified-diff.js";
+/**
+ * Compute the ship-diff of an app version against the captured host baselines.
+ * Pure over its inputs so Cloud's console and tests can reuse it verbatim.
+ */
+export const computeShipDiff = (doc, baselines) => {
+    const pins = (doc.pins ?? []).map((pin) => {
+        const component = pinComponentName(pin.slot);
+        const baseline = baselines.find((candidate) => candidate.slot === pin.slot);
+        const shipped = doc.components?.[component] ?? "";
+        return {
+            slot: pin.slot,
+            component,
+            baseHash: pin.base,
+            ...(baseline === undefined ? {} : { baselineHash: baseline.hash }),
+            drifted: baseline?.hash !== pin.base,
+            // Diff from the source the fork actually started as (`pinForkSource`):
+            // the synthesized default-export alias on a named-export capture is fork
+            // plumbing, not a host edit, so an unedited fork reads as an empty diff.
+            diff: unifiedDiff(`${pin.slot}/${component}.tsx`, baseline === undefined ? "" : pinForkSource(baseline.source), shipped),
+        };
+    });
+    const pinnedComponents = new Set(pins.map((pin) => pin.component));
+    const generated = Object.entries(doc.components ?? {})
+        .filter(([name]) => !pinnedComponents.has(name))
+        .map(([name, source]) => ({
+        component: name,
+        diff: unifiedDiff(`generated/${name}.tsx`, "", source),
+    }));
+    return {
+        appId: doc.id,
+        versionHash: appVersionHash(doc),
+        pins,
+        generated,
+    };
+};
+//# sourceMappingURL=ship-diff.js.map

package/dist/ship-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ship-diff.js","sourceRoot":"","sources":["../src/ship-diff.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAoB,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA4ChD;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,GAAgB,EAChB,SAAiC,EACvB,EAAE;IACZ,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAe,EAAE;QACrD,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;YACT,QAAQ,EAAE,GAAG,CAAC,IAAI;YAClB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClE,OAAO,EAAE,QAAQ,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI;YACpC,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,EAAE,WAAW,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;SACzH,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;SACnD,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAqB,EAAE,CAAC,CAAC;QAC3C,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,WAAW,CAAC,aAAa,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC;KACvD,CAAC,CAAC,CAAC;IACN,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC;QAChC,IAAI;QACJ,SAAS;KACV,CAAC;AACJ,CAAC,CAAC"}

package/dist/testing/fake-box.d.ts

@@ -0,0 +1,67 @@
+import type { SandboxAdapter, SandboxMachine } from "../sandbox.js";
+import type { BoxEditResult } from "../box-agent.js";
+/** The mutable inside-the-box state an in-box agent edits. */
+export interface FakeBoxState {
+    env: Record<string, string>;
+    /** The vendo.json the box serves (schedules + egress declarations). */
+    manifest: {
+        schedules?: Array<{
+            cron: string;
+            fn: string;
+        }>;
+        egress?: string[];
+    };
+    /** POST /fn/<name> handlers the agent installed. */
+    fns: Map<string, (args: unknown, env: Record<string, string>) => unknown>;
+    /**
+     * Wave 4 (layer 3) — served pages the agent installed on non-/fn GET paths
+     * (path → HTML body). When present, the box "serves a real web app".
+     */
+    pages: Map<string, string>;
+}
+/** The injectable in-box coding agent: mutates box state, returns a result. */
+export type FakeBoxAgent = (task: {
+    prompt: string;
+    context?: string;
+    env: Record<string, string>;
+    box: FakeBoxState;
+}) => BoxEditResult | Promise<BoxEditResult>;
+interface FakeBoxOptions {
+    agent?: FakeBoxAgent;
+}
+export interface FakeBoxAdapter extends SandboxAdapter {
+    /** Every machine this adapter created (for assertions on live/torn-down state). */
+    readonly machines: FakeBoxMachine[];
+}
+declare class FakeBoxMachine implements SandboxMachine {
+    readonly state: FakeBoxState;
+    readonly allowedDomains: readonly string[] | undefined;
+    private readonly agent;
+    readonly id: string;
+    destroyed: boolean;
+    stopped: boolean;
+    /** Task results by id (control-port task store). */
+    private readonly tasks;
+    constructor(state: FakeBoxState, allowedDomains: readonly string[] | undefined, agent: FakeBoxAgent);
+    private appPort;
+    request(req: {
+        method: string;
+        path: string;
+        port?: number;
+        headers?: Record<string, string>;
+        body?: Uint8Array | string;
+    }): Promise<{
+        status: number;
+        headers: Record<string, string>;
+        body: Uint8Array;
+    }>;
+    private control;
+    private app;
+    url(port?: number): Promise<string>;
+    snapshot(): Promise<string>;
+    stop(): Promise<void>;
+    destroy(): Promise<void>;
+}
+export declare const fakeBoxSandbox: (options?: FakeBoxOptions) => FakeBoxAdapter;
+export {};
+//# sourceMappingURL=fake-box.d.ts.map

package/dist/testing/fake-box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-box.d.ts","sourceRoot":"","sources":["../../src/testing/fake-box.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAgBrD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE;QAAE,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACjF,oDAAoD;IACpD,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,CAAC;IAC1E;;;OAGG;IACH,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,+EAA+E;AAC/E,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,YAAY,CAAC;CACnB,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAU7C,UAAU,cAAc;IACtB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB;AAMD,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC;CACrC;AAED,cAAM,cAAe,YAAW,cAAc;IAQ1C,QAAQ,CAAC,KAAK,EAAE,YAAY;IAC5B,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK;IATxB,QAAQ,CAAC,EAAE,SAAqB;IAChC,SAAS,UAAS;IAClB,OAAO,UAAS;IAChB,oDAAoD;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6E;gBAGxF,KAAK,EAAE,YAAY,EACnB,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACrC,KAAK,EAAE,YAAY;IAGtC,OAAO,CAAC,OAAO;IAKT,OAAO,CAAC,GAAG,EAAE;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,CAAC;YAcpE,OAAO;IAiCrB,OAAO,CAAC,GAAG;IAqCL,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAa3B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IACrB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAC/B;AAED,eAAO,MAAM,cAAc,GAAI,UAAS,cAAmB,KAAG,cAgC7D,CAAC"}