agentfootprint 9.31.0 → 9.32.0

package/dist/esm/hosting/admission.d.ts

@@ -12,6 +12,31 @@
  * and cost events every run already emits). This module is the join, plus the
  * seam where an operator's own rule goes.
  *
+ * **Status, split rather than averaged, because the two halves were not earned
+ * equally:**
+ *
+ *   • **The `admission: { decide }` seam is field-validated — an independent
+ *     field trial, 2026-08-13.** Running against a real hosted door (a live
+ *     `nodeHost` in a live Google Cloud project, sessions in a real Firestore),
+ *     the trial had one caller's first two turns run and the third answer **429
+ *     before the provider or the session store was invoked** — the
+ *     cheapest-refusal claim, measured rather than asserted.
+ *
+ *   • **`turnsPerHour` itself is contract-shaped and tested.** The finding
+ *     records the refusal and restates this helper's per-process bound; it does
+ *     not record the shipped helper as the policy under test, and a run of a few
+ *     minutes cannot have crossed an HOUR boundary in any case. So the window's
+ *     own arithmetic — the roll-off, the reset a caller is told about — is
+ *     proven here by tests and not by a field run.
+ *
+ * The honest bound the trial restated is the one already on {@link RecentSpend}:
+ * `turnsPerHour` is an in-process reference policy, its counters are not shared
+ * across instances and do not survive a restart, so a fleet-wide or billing
+ * control needs a `decide` that reads a transactional store of your own.
+ *
+ * The refusal itself is invisible to `auditExport()` — it happens before a run
+ * exists. `standingAgent({ onIngressDecision })` is where it lands instead.
+ *
  * ── One decision, three answers, no fourth ───────────────────────────────────
  * `'allow'` · `{ queue: true }` · `{ refuse: '<sentence>' }`. Deliberately not
  * "delay by N ms" (a sleep is a thread the caller is paying for), not "degrade

package/dist/esm/hosting/admission.js

@@ -12,6 +12,31 @@
  * and cost events every run already emits). This module is the join, plus the
  * seam where an operator's own rule goes.
  *
+ * **Status, split rather than averaged, because the two halves were not earned
+ * equally:**
+ *
+ *   • **The `admission: { decide }` seam is field-validated — an independent
+ *     field trial, 2026-08-13.** Running against a real hosted door (a live
+ *     `nodeHost` in a live Google Cloud project, sessions in a real Firestore),
+ *     the trial had one caller's first two turns run and the third answer **429
+ *     before the provider or the session store was invoked** — the
+ *     cheapest-refusal claim, measured rather than asserted.
+ *
+ *   • **`turnsPerHour` itself is contract-shaped and tested.** The finding
+ *     records the refusal and restates this helper's per-process bound; it does
+ *     not record the shipped helper as the policy under test, and a run of a few
+ *     minutes cannot have crossed an HOUR boundary in any case. So the window's
+ *     own arithmetic — the roll-off, the reset a caller is told about — is
+ *     proven here by tests and not by a field run.
+ *
+ * The honest bound the trial restated is the one already on {@link RecentSpend}:
+ * `turnsPerHour` is an in-process reference policy, its counters are not shared
+ * across instances and do not survive a restart, so a fleet-wide or billing
+ * control needs a `decide` that reads a transactional store of your own.
+ *
+ * The refusal itself is invisible to `auditExport()` — it happens before a run
+ * exists. `standingAgent({ onIngressDecision })` is where it lands instead.
+ *
  * ── One decision, three answers, no fourth ───────────────────────────────────
  * `'allow'` · `{ queue: true }` · `{ refuse: '<sentence>' }`. Deliberately not
  * "delay by N ms" (a sleep is a thread the caller is paying for), not "degrade

package/dist/esm/hosting/admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../src/hosting/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AA0FH,gEAAgE;AAChE,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,MAAM,CAAC,KAAK,CAAC,uCAAuC;YACrF,uFAAuF;YACvF,gFAAgF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,4CAA4C,MAAM,CAAC,cAAc,CAAC,wBAAwB;YACxF,gFAAgF;YAChF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAoB;YAChD,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;YAChE,IAAI,WAAW,CAAC,KAAK,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU,CAAC;YAC5E,OAAO;gBACL,MAAM,EACJ,GAAG,GAAG,eAAe,OAAO,uBAC1B,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAC9C,OAAO,WAAW,CAAC,KAAK,IAAI;oBAC5B,mFAAmF;oBACnF,sDAAsD;oBACtD,CAAC,QAAQ,KAAK,SAAS;wBACrB,CAAC,CAAC,4EAA4E;wBAC9E,CAAC,CAAC,EAAE,CAAC;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAoCD,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAWnC,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB;yEACqE;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAgB,EAAE;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,OAAqB,EAAE,EAAU,EAAgB,EAAE;QAChE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC;QAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,yEAAyE;QACzE,sEAAsE;QACtE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,MAAM;YAC7B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAW;YACf,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,YAAY;YACZ,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;YAC5C,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;gBACvB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAW;YACd,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,GAAG,CAAC,CAAC;YACZ,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC;gBACjC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC;gBACnC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;gBACjB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;YAC1B,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,WAAW;gBACX,YAAY;gBACZ,uEAAuE;gBACvE,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC;gBACtB,QAAQ;gBACR,QAAQ,EAAE,EAAE,GAAG,SAAS,IAAI,QAAQ;aACrC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI;YACN,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAAsC;IAChE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../src/hosting/admission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AA0FH,gEAAgE;AAChE,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B;IACvD,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CACjB,mCAAmC,MAAM,CAAC,KAAK,CAAC,uCAAuC;YACrF,uFAAuF;YACvF,gFAAgF,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,4CAA4C,MAAM,CAAC,cAAc,CAAC,wBAAwB;YACxF,gFAAgF;YAChF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAoB;YAChD,MAAM,OAAO,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;YAChE,IAAI,WAAW,CAAC,KAAK,GAAG,OAAO;gBAAE,OAAO,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,UAAU,CAAC;YAC5E,OAAO;gBACL,MAAM,EACJ,GAAG,GAAG,eAAe,OAAO,uBAC1B,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAC9C,OAAO,WAAW,CAAC,KAAK,IAAI;oBAC5B,mFAAmF;oBACnF,sDAAsD;oBACtD,CAAC,QAAQ,KAAK,SAAS;wBACrB,CAAC,CAAC,4EAA4E;wBAC9E,CAAC,CAAC,EAAE,CAAC;aACV,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAoCD,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAWnC,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB;yEACqE;IACrE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEjD,MAAM,KAAK,GAAG,CAAC,GAAW,EAAgB,EAAE;QAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM;YAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,OAAqB,EAAE,EAAU,EAAgB,EAAE;QAChE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC;QAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,yEAAyE;QACzE,sEAAsE;QACtE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,EAAE,GAAG,MAAM;gBAAE,MAAM;YAC7B,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAW;YACf,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,GAAG,CAAC,GAAG,EAAE,KAAK;YACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,YAAY;YACZ,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;YAC5C,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC5B,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;gBACvB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,GAAW;YACd,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,GAAG,GAAG,CAAC,CAAC;YACZ,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC;gBACjC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAC;gBACnC,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC;gBACjB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;YAC1B,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,MAAM;gBACrB,WAAW;gBACX,YAAY;gBACZ,uEAAuE;gBACvE,GAAG,CAAC,MAAM,IAAI,EAAE,GAAG,EAAE,CAAC;gBACtB,QAAQ;gBACR,QAAQ,EAAE,EAAE,GAAG,SAAS,IAAI,QAAQ;aACrC,CAAC;QACJ,CAAC;QACD,IAAI,IAAI;YACN,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,QAAsC;IAChE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC3E,CAAC"}

package/dist/esm/hosting/envelope.d.ts

@@ -138,6 +138,16 @@ export declare function checkEnvelope(envelope: unknown, sessionId?: string): Ch
  * session nobody signed for is a session nobody can list, and inventing an
  * owner would be inventing an entitlement.
  *
+ * **Status: the CONTRACT is field-validated — an independent field trial,
+ * 2026-08-13.** A live multi-user run against a real Firestore: an owner
+ * written once and never moved, a cross-user transcript answering the same
+ * not-found a missing session gets, one caller's own two sessions listed over
+ * two pages, `listByUser` / `ownerOf` feature detection, and `mayOpenSession`
+ * refusing an ordinary turn on somebody else's conversation. The store
+ * underneath was **the trial's own Firestore `SessionLifecycle`**, not one this
+ * package ships — so the rung belongs to this derivation and the rules above
+ * it, and no shipped Google adapter may borrow the credit.
+ *
  * Reads both formats, so a session that is mid-question is owned exactly as
  * firmly as one that is finished. Returns `undefined` rather than throwing on
  * a shape it cannot read — an index is a convenience, and refusing to WRITE a

package/dist/esm/hosting/envelope.js

@@ -165,6 +165,16 @@ export function checkEnvelope(envelope, sessionId) {
  * session nobody signed for is a session nobody can list, and inventing an
  * owner would be inventing an entitlement.
  *
+ * **Status: the CONTRACT is field-validated — an independent field trial,
+ * 2026-08-13.** A live multi-user run against a real Firestore: an owner
+ * written once and never moved, a cross-user transcript answering the same
+ * not-found a missing session gets, one caller's own two sessions listed over
+ * two pages, `listByUser` / `ownerOf` feature detection, and `mayOpenSession`
+ * refusing an ordinary turn on somebody else's conversation. The store
+ * underneath was **the trial's own Firestore `SessionLifecycle`**, not one this
+ * package ships — so the rung belongs to this derivation and the rules above
+ * it, and no shipped Google adapter may borrow the credit.
+ *
  * Reads both formats, so a session that is mid-question is owned exactly as
  * firmly as one that is finished. Returns `undefined` rather than throwing on
  * a shape it cannot read — an index is a convenience, and refusing to WRITE a

package/dist/esm/hosting/envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/hosting/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,0BAA0B,CAAC;AASvF,+DAA+D;AAC/D,MAAM,aAAa,GAAsB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,UAA8B;IACvD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,QAAiB;IAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,mFAAmF;YACjF,mFAAmF;YACnF,kFAAkF;YAClF,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAE,QAAiC,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CACjB,sFAAsF;YACpF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAE,QAA8B,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB,EAAE,SAAkB;IACjE,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,cAAc,EAAE,CAAC;QACvD,iBAAiB,CAAE,QAA8B,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAE,QAAiC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAA8B,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC;IACpD,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAI,OAA8B,CAAC,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW;YAAE,SAAS;QACtD,MAAM,OAAO,GAAI,OAAiC,CAAC,OAAO,CAAC;QAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAgD,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAI,IAAmC,CAAC,YAAY,CAAC;QACvE,OAAO,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;YACrD,CAAC,CAAE,YAA0E;YAC7E,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACjC,OAAO,IAAiE,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAAiB,EAAE,SAAkB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAI,QAAwC,CAAC,MAAM,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,wCAAwC,MAAM,CAAC,KAAK,CAAC,KAAK;YACxD,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnD,6EAA6E;YAC7E,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,KAA2C,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,KAA2B,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,UAAiD,CAAC;IACjE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,8DAA8D;YAC5D,gFAAgF;YAChF,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ;QACpC,CAAC,EAAE,CAAC,WAAW;QACf,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,+EAA+E;YAC7E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CACjB,+EAA+E;YAC7E,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,GAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../src/hosting/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,0BAA0B,CAAC;AASvF,+DAA+D;AAC/D,MAAM,aAAa,GAAsB,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,UAA8B;IACvD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAChD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,QAAiB;IAC5C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,cAAc,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,mFAAmF;YACjF,mFAAmF;YACnF,kFAAkF;YAClF,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAE,QAAiC,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CACjB,sFAAsF;YACpF,6EAA6E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAE,QAA8B,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB,EAAE,SAAkB;IACjE,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,cAAc,EAAE,CAAC;QACvD,iBAAiB,CAAE,QAA8B,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAE,QAAiC,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAA8B,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,aAAa,CAAC,QAAiB;IAC7C,MAAM,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,YAAY,EAAE,QAAQ,EAAE,SAAS,CAAC;IACpD,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAI,OAA8B,CAAC,IAAI,CAAC;QAClD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,WAAW;YAAE,SAAS;QACtD,MAAM,OAAO,GAAI,OAAiC,CAAC,OAAO,CAAC;QAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,QAAiB;IAEjB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAgD,CAAC;IAC1E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAI,IAAmC,CAAC,YAAY,CAAC;QACvE,OAAO,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;YACrD,CAAC,CAAE,YAA0E;YAC7E,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACjC,OAAO,IAAiE,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,QAAiB,EAAE,SAAkB;IACvD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAI,QAAwC,CAAC,MAAM,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,wCAAwC,MAAM,CAAC,KAAK,CAAC,KAAK;YACxD,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnD,6EAA6E;YAC7E,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,KAA2C,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,KAA2B,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,UAAiD,CAAC;IACjE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,SAAS,CACjB,8DAA8D;YAC5D,gFAAgF;YAChF,6BAA6B,CAChC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ;QACpC,CAAC,EAAE,CAAC,WAAW;QACf,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,EAClC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,+EAA+E;YAC7E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CACjB,+EAA+E;YAC7E,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,GAAgB,CAAC;AAC1B,CAAC"}

package/dist/esm/hosting/index.d.ts

@@ -101,6 +101,7 @@ export { bearerToken, verifyRequestIdentity } from './identityVerification.js';
 export type { IdentityVerificationOptions, IdentityVerifier, VerifiedIdentity, } from './identityVerification.js';
 export { spendKeyFor, spendLedger, turnsPerHour } from './admission.js';
 export type { AdmissionContext, AdmissionPolicy, AdmissionVerdict, RecentSpend, SpendLedger, SpendLedgerOptions, TurnsPerHourOptions, } from './admission.js';
+export type { IngressAdmissionVerdict, IngressDoor, IngressOutcome, IngressRecord, IngressSink, } from './ingressRecord.js';
 export { readSessionWireOp, sessionWireBody, SESSION_LIST_OP, SESSION_TRANSCRIPT_OP, } from './sessionWire.js';
 export type { SessionSummary, SessionWireRequest, SessionWireResult, TranscriptMessage, } from './sessionWire.js';
 export { ALL_WIRE_OPS, isWireOp, refuseUnknownWireOp, WIRE_OPS } from './wireOps.js';

package/dist/esm/hosting/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEzF,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,oCAAoC;AAEpC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAWtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,yDAAyD;AACzD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAO/E,+EAA+E;AAC/E,uEAAuE;AACvE,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAWxE,+EAA+E;AAC/E,yEAAyE;AACzE,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGrF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsFG;AAEH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEzF,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,oCAAoC;AAEpC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAWtD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EACL,UAAU,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAEzD,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,4BAA4B,EAC5B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAGrB,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,yDAAyD;AACzD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAO/E,+EAA+E;AAC/E,uEAAuE;AACvE,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAuBxE,+EAA+E;AAC/E,yEAAyE;AACzE,qBAAqB;AACrB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAO1B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGrF,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/esm/hosting/ingressRecord.d.ts

@@ -0,0 +1,177 @@
+/**
+ * hosting/ingressRecord — what the door decided, for the requests that never
+ * became a run.
+ *
+ *   await standingAgent({
+ *     agent, sessions, host,
+ *     identity: { verify },
+ *     admission: turnsPerHour({ limit: 60 }),
+ *     onIngressDecision: (record) => myAuditSink.write(record),
+ *   });
+ *
+ * ── The gap this closes, named exactly ───────────────────────────────────────
+ * `auditExport()` is a record of RUNS. A 401 out of `identity.verify` and a 429
+ * out of `admission.decide` both happen before a run exists — no agent has been
+ * built, no observer is attached, no typed event is emitted — so neither is in
+ * the bundle. Two independent review rounds wrote that down as the same finding,
+ * and the honest consequence is the sharp one: **an empty bundle is not evidence
+ * that nobody was turned away.** It is evidence that nobody ran.
+ *
+ * This is the seam where the turned-away go. One record per request the composer
+ * decided, handed to a sink you own, at the moment the reply reaches its
+ * terminal.
+ *
+ * ── What it is NOT, said before anything else ────────────────────────────────
+ * **It does not join the audit hash chain.** Nothing here is hashed, chained,
+ * sequenced against `auditExport()`'s records, or verifiable by
+ * `verifyAuditBundle`. It is a STREAM you chain into your own sink. Saying
+ * otherwise would make this fix the exact failure it exists to close — a
+ * mechanism that looks like evidence and is not. If you need ingress decisions
+ * inside a tamper-evident chain, write them into the same store your audit
+ * bundle lands in and chain them there, where the sequence is yours to define.
+ *
+ * ── Secrets never travel ─────────────────────────────────────────────────────
+ * A record carries the CLASS of what happened and the identifiers the caller
+ * already knew. Never the bearer token, never a header, never a claim set,
+ * never an error's message — the `sdkFailure` law, applied to the front door.
+ * `errorName` and `errorCode` are this package's own vocabulary; a message may
+ * carry an SDK's text, an operator's sentence or a store's detail, so no message
+ * is copied. The one identity field is `userId`, and it is the id the token
+ * PROVED — never one a request merely claimed.
+ *
+ * ── What the composer can decide, and what it never sees ─────────────────────
+ * Every ingress exit of `standingAgent` funnels through one reply terminal, so
+ * all of these land here — including the ones a consumer's own `verify` and
+ * `decide` never observe:
+ *
+ *   - a request with no `Authorization: Bearer …` at all (`verify` is never
+ *     called, so nothing you wrote could have logged it);
+ *   - a verifier that could not answer (503) as distinct from a bad credential;
+ *   - an admission refusal, and also an admission ALLOW — the census is what
+ *     makes an absence readable;
+ *   - a turn or a transcript naming somebody else's session (the 404 that is
+ *     deliberately indistinguishable from "no such session");
+ *   - a session op at a door with no verifier, a store with no owner index, a
+ *     concurrent-run refusal, an artifact ref that did not resolve;
+ *   - and a request that was SERVED.
+ *
+ * What it does not carry, stated rather than implied: a body the TRANSPORT
+ * refused before the composer ever saw it — unparseable JSON, or an `op` this
+ * host's wire grammar does not speak (`InvalidWireOpError`, answered 400 by
+ * `httpHost` inside its own request reader). That is a malformed request rather
+ * than a decision about a caller, and the composer does not claim it. Your HTTP
+ * access log has it.
+ *
+ * Pattern: Observer at a composition boundary. Zero-cost when unset — with no
+ * sink configured nothing is built, nothing is wrapped, and the reply object the
+ * handler uses is the host's own, to the byte.
+ */
+import { type VerifiedIdentity } from './identityVerification.js';
+import { type IdentityFailureClass } from './errors.js';
+import type { HostReply, HostRequest } from './types.js';
+/** Which of the composer's three doors this request knocked at. */
+export type IngressDoor = 'turn' | 'session-op' | 'artifact';
+/**
+ * How the door answered — coarse on purpose, because this is the field a
+ * dashboard groups by. `errorCode` carries the precision beside it.
+ *
+ *  - `'served'` — the reply reached a DELIVERING terminal: an answer, a
+ *    question a person must answer, a transcript, a listing, an artifact.
+ *
+ *    Read it as **delivered**, not as *admitted*. The record is filed at the
+ *    terminal the reply actually reached, and a failure is not a delivery — so
+ *    a request the door admitted whose RUN, store or provider then broke ends
+ *    at `reply.fail` and is filed `'failed'` (or `'refused'`, when the error
+ *    names itself with an `ERR_…` code), carrying that error's class. It is
+ *    NOT `'served'`. To count what the door let through, count everything that
+ *    is not one of the door's own refusals — `'identity-refused'`,
+ *    `'verifier-unavailable'`, `'admission-refused'`, `'session-refused'` — or
+ *    read `admission`, which is the verdict a policy actually returned and is
+ *    present on a refused record and a broken one alike.
+ *  - `'identity-refused'` — 401. The credential did not identify anybody, or
+ *    none arrived at a door that insists.
+ *  - `'verifier-unavailable'` — 503. The verifier could not do its job; the
+ *    caller's token was never judged and this is not their fault.
+ *  - `'admission-refused'` — 429. A policy said no before any work started.
+ *  - `'session-refused'` — the one indistinguishable not-found: a session that
+ *    does not exist, belongs to somebody else, or names no owner.
+ *  - `'refused'` — every other refusal the door made by name (a session op with
+ *    no verifier configured, a store with no owner index, a concurrent run, an
+ *    artifact ref that did not resolve, a pause the wire could not carry).
+ *  - `'failed'` — the request ended in an error that is not one of the door's
+ *    own refusals. Usually the run, the store or the provider — which is why
+ *    an admitted request that then broke lands HERE and not in `'served'`.
+ */
+export type IngressOutcome = 'served' | 'identity-refused' | 'verifier-unavailable' | 'admission-refused' | 'session-refused' | 'refused' | 'failed';
+/** What an admission policy answered, when one was consulted. */
+export type IngressAdmissionVerdict = 'allow' | 'queue' | 'refuse';
+/**
+ * One decision the door made, as plain data.
+ *
+ * Every field is either a class of what happened or an identifier the caller
+ * already had. Nothing here is a secret, and nothing here is a message.
+ */
+export interface IngressRecord {
+    /** When the request left the door, `Date.now()`. */
+    readonly at: number;
+    /** Which door it knocked at. */
+    readonly door: IngressDoor;
+    /** The wire op it named, in the spelling a body uses. Absent for a turn. */
+    readonly op?: string;
+    /** How the door answered. */
+    readonly outcome: IngressOutcome;
+    /** The refusal's own `code` (`'ERR_IDENTITY_NOT_VERIFIED'`, …). Never a message. */
+    readonly errorCode?: string;
+    /** The error's class name, for a failure this package did not author. */
+    readonly errorName?: string;
+    /** WHICH token check failed — the whole vocabulary a refusal may say about a
+     *  credential, and never one character of the credential. */
+    readonly identityFailure?: IdentityFailureClass;
+    /** `true` when the refused request also NAMED a user it could not prove —
+     *  the impersonation shape, kept separate so a sink can count it. */
+    readonly claimedUser?: boolean;
+    /** The id the token PROVED, when one was proven. Never a claimed one. */
+    readonly userId?: string;
+    /** The conversation this request named, when it named one. */
+    readonly sessionId?: string;
+    /** Whether a bearer credential was PRESENT. Never its value. */
+    readonly bearerPresent: boolean;
+    /** What the admission policy answered, when one was consulted. */
+    readonly admission?: IngressAdmissionVerdict;
+}
+/**
+ * Where records go — {@link StandingAgentBaseOptions.onIngressDecision}.
+ *
+ * Called once per request, synchronously, at the moment the reply reaches its
+ * terminal. A sink that throws is contained (a broken log must not turn a served
+ * request into a failed one) and reported once on `console.warn`, because a
+ * silently-dropped security record is the failure this whole seam exists to
+ * close. Do the slow part yourself: buffer, batch, and never `await` the network
+ * inside it.
+ */
+export type IngressSink = (record: IngressRecord) => void;
+/**
+ * The per-request bookkeeping: the facts known at the door, the facts learned
+ * on the way in, and the ONE record that leaves.
+ *
+ * Built only when a sink is configured. `settle` is idempotent — the first
+ * terminal wins, and a reply that somehow reaches two of them (a host that
+ * completes and then fails) still produces exactly one record, because two
+ * records for one request would be a census that over-counts.
+ */
+export interface IngressNote {
+    /** Wrap the host's reply so its first terminal files the record. */
+    watch(reply: HostReply): HostReply;
+    /** The verifier proved somebody — record the proven id, never a claimed one. */
+    identified(verified: VerifiedIdentity | undefined): void;
+    /** An admission policy answered. */
+    admitted(verdict: IngressAdmissionVerdict): void;
+    /** File the record for a request that left without any terminal at all. */
+    settle(): void;
+}
+/**
+ * Begin one request's ingress record.
+ *
+ * @internal — the option is public, this bookkeeping is not.
+ */
+export declare function beginIngress(request: HostRequest, sink: IngressSink): IngressNote;

package/dist/esm/hosting/ingressRecord.js

@@ -0,0 +1,246 @@
+/**
+ * hosting/ingressRecord — what the door decided, for the requests that never
+ * became a run.
+ *
+ *   await standingAgent({
+ *     agent, sessions, host,
+ *     identity: { verify },
+ *     admission: turnsPerHour({ limit: 60 }),
+ *     onIngressDecision: (record) => myAuditSink.write(record),
+ *   });
+ *
+ * ── The gap this closes, named exactly ───────────────────────────────────────
+ * `auditExport()` is a record of RUNS. A 401 out of `identity.verify` and a 429
+ * out of `admission.decide` both happen before a run exists — no agent has been
+ * built, no observer is attached, no typed event is emitted — so neither is in
+ * the bundle. Two independent review rounds wrote that down as the same finding,
+ * and the honest consequence is the sharp one: **an empty bundle is not evidence
+ * that nobody was turned away.** It is evidence that nobody ran.
+ *
+ * This is the seam where the turned-away go. One record per request the composer
+ * decided, handed to a sink you own, at the moment the reply reaches its
+ * terminal.
+ *
+ * ── What it is NOT, said before anything else ────────────────────────────────
+ * **It does not join the audit hash chain.** Nothing here is hashed, chained,
+ * sequenced against `auditExport()`'s records, or verifiable by
+ * `verifyAuditBundle`. It is a STREAM you chain into your own sink. Saying
+ * otherwise would make this fix the exact failure it exists to close — a
+ * mechanism that looks like evidence and is not. If you need ingress decisions
+ * inside a tamper-evident chain, write them into the same store your audit
+ * bundle lands in and chain them there, where the sequence is yours to define.
+ *
+ * ── Secrets never travel ─────────────────────────────────────────────────────
+ * A record carries the CLASS of what happened and the identifiers the caller
+ * already knew. Never the bearer token, never a header, never a claim set,
+ * never an error's message — the `sdkFailure` law, applied to the front door.
+ * `errorName` and `errorCode` are this package's own vocabulary; a message may
+ * carry an SDK's text, an operator's sentence or a store's detail, so no message
+ * is copied. The one identity field is `userId`, and it is the id the token
+ * PROVED — never one a request merely claimed.
+ *
+ * ── What the composer can decide, and what it never sees ─────────────────────
+ * Every ingress exit of `standingAgent` funnels through one reply terminal, so
+ * all of these land here — including the ones a consumer's own `verify` and
+ * `decide` never observe:
+ *
+ *   - a request with no `Authorization: Bearer …` at all (`verify` is never
+ *     called, so nothing you wrote could have logged it);
+ *   - a verifier that could not answer (503) as distinct from a bad credential;
+ *   - an admission refusal, and also an admission ALLOW — the census is what
+ *     makes an absence readable;
+ *   - a turn or a transcript naming somebody else's session (the 404 that is
+ *     deliberately indistinguishable from "no such session");
+ *   - a session op at a door with no verifier, a store with no owner index, a
+ *     concurrent-run refusal, an artifact ref that did not resolve;
+ *   - and a request that was SERVED.
+ *
+ * What it does not carry, stated rather than implied: a body the TRANSPORT
+ * refused before the composer ever saw it — unparseable JSON, or an `op` this
+ * host's wire grammar does not speak (`InvalidWireOpError`, answered 400 by
+ * `httpHost` inside its own request reader). That is a malformed request rather
+ * than a decision about a caller, and the composer does not claim it. Your HTTP
+ * access log has it.
+ *
+ * Pattern: Observer at a composition boundary. Zero-cost when unset — with no
+ * sink configured nothing is built, nothing is wrapped, and the reply object the
+ * handler uses is the host's own, to the byte.
+ */
+import { bearerToken } from './identityVerification.js';
+import { AdmissionRefusedError, IdentityNotVerifiedError, SessionNotFoundError, VerifierUnavailableError, } from './errors.js';
+import { ARTIFACT_GET_OP, ARTIFACT_HEAD_OP } from './artifactWire.js';
+import { SESSION_LIST_OP, SESSION_TRANSCRIPT_OP } from './sessionWire.js';
+/**
+ * Classify one refusal into the record's vocabulary.
+ *
+ * The order is deliberate: the classes this package authored are matched by
+ * `instanceof` first, so a door refusal never reads as a generic failure, and
+ * anything else keeps only its class NAME. No message is read, from any error,
+ * ever.
+ */
+function classify(err) {
+    if (err instanceof IdentityNotVerifiedError) {
+        return {
+            outcome: 'identity-refused',
+            errorCode: err.code,
+            errorName: err.name,
+            identityFailure: err.failure,
+            claimedUser: err.claimedUser,
+        };
+    }
+    if (err instanceof VerifierUnavailableError) {
+        return { outcome: 'verifier-unavailable', errorCode: err.code, errorName: err.name };
+    }
+    if (err instanceof AdmissionRefusedError) {
+        return { outcome: 'admission-refused', errorCode: err.code, errorName: err.name };
+    }
+    if (err instanceof SessionNotFoundError) {
+        return { outcome: 'session-refused', errorCode: err.code, errorName: err.name };
+    }
+    const code = err?.code;
+    const name = err?.name;
+    // A hosting refusal names itself with an `ERR_…` code. Anything else is a
+    // failure rather than a decision — and either way only the class travels.
+    const hasHostingCode = typeof code === 'string' && code.startsWith('ERR_');
+    return {
+        outcome: hasHostingCode ? 'refused' : 'failed',
+        ...(typeof code === 'string' && { errorCode: code }),
+        ...(typeof name === 'string' && { errorName: name }),
+    };
+}
+/** Which op name a request named, in the spelling a body uses. */
+function opOf(request) {
+    if (request.session !== undefined) {
+        return request.session.op === 'list' ? SESSION_LIST_OP : SESSION_TRANSCRIPT_OP;
+    }
+    if (request.artifact !== undefined) {
+        return request.artifact.op === 'head' ? ARTIFACT_HEAD_OP : ARTIFACT_GET_OP;
+    }
+    return undefined;
+}
+/** Which door a request knocked at — the same discriminants the handler uses. */
+function doorOf(request) {
+    if (request.session !== undefined)
+        return 'session-op';
+    if (request.artifact !== undefined)
+        return 'artifact';
+    return 'turn';
+}
+/**
+ * Which conversation this request named. A `session-transcript` names it inside
+ * the op rather than beside it, and a record that missed that would be blind to
+ * exactly the refusal the ownership rule produces.
+ */
+function sessionOf(request) {
+    if (request.session !== undefined && request.session.op === 'transcript') {
+        return request.session.sessionId;
+    }
+    return request.sessionId;
+}
+let warnedOnce = false;
+/** Report a throwing sink once. A broken record is a fault worth naming; a
+ *  fault reported on every request is a second outage. */
+function warnSink(err) {
+    if (warnedOnce)
+        return;
+    warnedOnce = true;
+    // eslint-disable-next-line no-console
+    console.warn(`[hosting] the onIngressDecision sink threw and the record was dropped. The request was ` +
+        `unaffected — a broken log must not turn a served request into a failed one — but this ` +
+        `door's ingress decisions are not being recorded. Reported once per process. Cause: ` +
+        `${err?.name ?? 'unknown'}`);
+}
+/**
+ * Begin one request's ingress record.
+ *
+ * @internal — the option is public, this bookkeeping is not.
+ */
+export function beginIngress(request, sink) {
+    const door = doorOf(request);
+    const op = opOf(request);
+    const sessionId = sessionOf(request);
+    // Presence, never the value: the whole point of the class vocabulary above is
+    // that an operator can act without a single character of the credential.
+    const bearerPresent = bearerToken(request.headers) !== undefined;
+    let userId;
+    let admission;
+    let filed = false;
+    function file(outcome, err) {
+        if (filed)
+            return;
+        filed = true;
+        const detail = err === undefined ? undefined : classify(err);
+        const record = {
+            at: Date.now(),
+            door,
+            ...(op !== undefined && { op }),
+            outcome: detail?.outcome ?? outcome,
+            ...(detail?.errorCode !== undefined && { errorCode: detail.errorCode }),
+            ...(detail?.errorName !== undefined && { errorName: detail.errorName }),
+            ...(detail?.identityFailure !== undefined && { identityFailure: detail.identityFailure }),
+            ...(detail?.claimedUser !== undefined && { claimedUser: detail.claimedUser }),
+            ...(userId !== undefined && { userId }),
+            ...(sessionId !== undefined && { sessionId }),
+            bearerPresent,
+            ...(admission !== undefined && { admission }),
+        };
+        try {
+            sink(record);
+        }
+        catch (sinkErr) {
+            warnSink(sinkErr);
+        }
+    }
+    return {
+        watch(reply) {
+            // Every optional terminal is forwarded ONLY when the host has it: the
+            // composer feature-detects `awaiting`/`artifact`/`sessions`, so a wrapper
+            // that defined them unconditionally would tell it the host can describe a
+            // pause it cannot, and the named refusal for that case would never fire.
+            return {
+                complete(output) {
+                    file('served');
+                    reply.complete(output);
+                },
+                fail(error) {
+                    file('failed', error);
+                    reply.fail(error);
+                },
+                ...(reply.awaiting && {
+                    awaiting: (pending) => {
+                        file('served');
+                        reply.awaiting?.(pending);
+                    },
+                }),
+                ...(reply.artifact && {
+                    artifact: (result) => {
+                        file('served');
+                        reply.artifact?.(result);
+                    },
+                }),
+                ...(reply.sessions && {
+                    sessions: (result) => {
+                        file('served');
+                        reply.sessions?.(result);
+                    },
+                }),
+                // Not a terminal: a chunk is part of an answer still being written.
+                ...(reply.emit && { emit: (chunk) => reply.emit?.(chunk) }),
+            };
+        },
+        identified(verified) {
+            if (verified !== undefined)
+                userId = verified.userId;
+        },
+        admitted(verdict) {
+            admission = verdict;
+        },
+        settle() {
+            // Only reachable if a request left the door without ending its reply,
+            // which the composer never does. Recorded as a failure rather than
+            // silently dropped: a census with holes is the thing this replaces.
+            file('failed');
+        },
+    };
+}
+//# sourceMappingURL=ingressRecord.js.map

package/dist/esm/hosting/ingressRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingressRecord.js","sourceRoot":"","sources":["../../../src/hosting/ingressRecord.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAE,WAAW,EAAyB,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,GAEzB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAgG1E;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,GAAY;IAO5B,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,kBAAkB;YAC3B,SAAS,EAAE,GAAG,CAAC,IAAI;YACnB,SAAS,EAAE,GAAG,CAAC,IAAI;YACnB,eAAe,EAAE,GAAG,CAAC,OAAO;YAC5B,WAAW,EAAE,GAAG,CAAC,WAAW;SAC7B,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAI,GAAsC,EAAE,IAAI,CAAC;IAC3D,MAAM,IAAI,GAAI,GAAsC,EAAE,IAAI,CAAC;IAC3D,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,cAAc,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;QAC9C,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACrD,CAAC;AACJ,CAAC;AAsBD,kEAAkE;AAClE,SAAS,IAAI,CAAC,OAAoB;IAChC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,MAAM,CAAC,OAAoB;IAClC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACtD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAoB;IACrC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,CAAC;IACD,OAAO,OAAO,CAAC,SAAS,CAAC;AAC3B,CAAC;AAED,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB;0DAC0D;AAC1D,SAAS,QAAQ,CAAC,GAAY;IAC5B,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAClB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,yFAAyF;QACvF,wFAAwF;QACxF,qFAAqF;QACrF,GAAI,GAAqC,EAAE,IAAI,IAAI,SAAS,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAoB,EAAE,IAAiB;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC;IACjE,IAAI,MAA0B,CAAC;IAC/B,IAAI,SAA8C,CAAC;IACnD,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,SAAS,IAAI,CAAC,OAAuB,EAAE,GAAa;QAClD,IAAI,KAAK;YAAE,OAAO;QAClB,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAkB;YAC5B,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,IAAI;YACJ,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC;YAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,OAAO;YACnC,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;YACzF,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;YAC7E,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;YACvC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,aAAa;YACb,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;SAC9C,CAAC;QACF,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAgB;YACpB,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,OAAO;gBACL,QAAQ,CAAC,MAAc;oBACrB,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACf,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACzB,CAAC;gBACD,IAAI,CAAC,KAAY;oBACf,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;gBACD,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI;oBACpB,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;wBACpB,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACf,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;oBAC5B,CAAC;iBACF,CAAC;gBACF,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI;oBACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;wBACnB,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACf,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC;iBACF,CAAC;gBACF,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI;oBACpB,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;wBACnB,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACf,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC;iBACF,CAAC;gBACF,oEAAoE;gBACpE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;aACpE,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,QAAsC;YAC/C,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC;QACD,QAAQ,CAAC,OAAgC;YACvC,SAAS,GAAG,OAAO,CAAC;QACtB,CAAC;QACD,MAAM;YACJ,sEAAsE;YACtE,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}