aimeat 3.1.0 → 3.3.0

package/dist/src/services/scheduler-extension-job.js

@@ -1,85 +1,39 @@
-import { executeExtensionAction, trackMemoryAccess } from './extension-runtime.js';
-import { buildExtensionCtx, buildExtensionNotify, buildExtensionEmail } from './extension-ctx.js';
-import { getEncryptionKey } from './encryption.js';
-import { getExtSecretKeys, getInstanceSecretKeys, decryptSecretFields } from './extension-secrets.js';
+import { runExtensionActionAsSystem } from './extension-system-run.js';
 /**
- * Execute a scheduled `extension` job: resolve the extension + action, build the sandbox context
- * (scheduler runs as a system caller), decrypt secret config (incl. an instance-scoped job's
- * bring-your-own-key config), run the action, and return the tracked memory reads/writes.
+ * Execute a scheduled `extension` job and return the tracked memory reads/writes for the run log.
+ *
+ * Every refusal throws: the scheduler records a thrown error as `lastRunResult: 'error'`, leaves the
+ * run count alone and notifies the owner, while any normal return is recorded as a successful run.
  */
 export async function runExtensionJob(storage, config, emailService, job) {
     if (!job.extensionName || !job.actionId) {
         throw new Error(`Extension job "${job.id}" missing extensionName or actionId`);
     }
-    const ext = await storage.getExtension(job.extensionName);
-    if (!ext) {
-        throw new Error(`Extension "${job.extensionName}" not found`);
+    // A schedule's `ownerScope` is the owner GHII; an extension record carries the BARE installer name
+    // (routes/extensions/crud.ts writes `req.auth!.owner` into it). Both forms are needed: the owner
+    // fence compares bare names, storage is addressed by GHII. Falling back to the extension record's
+    // own installer would make the fence compare a value against itself, so it is not done.
+    const ownerScope = job.ownerScope ?? '';
+    const ownerName = ownerScope.split('@')[0];
+    if (!ownerName) {
+        throw new Error(`Extension job "${job.id}" has no owner scope — reinstall or reactivate extension "${job.extensionName}" to re-register it`);
     }
-    if (ext.status !== 'active') {
-        throw new Error(`Extension "${job.extensionName}" is not active`);
-    }
-    const action = ext.actions.find(a => a.id === job.actionId);
-    if (!action) {
-        throw new Error(`Action "${job.actionId}" not found in extension "${job.extensionName}"`);
-    }
-    // Build the extension context — scheduler runs as a system caller
-    const extMemoryOwner = job.instanceId
-        ? `ext:${ext.name}.${job.instanceId}`
-        : `ext:${ext.name}`;
-    // For an instance-scoped job, load the instance and decrypt its secret config so a scheduled
-    // sync gets the same bring-your-own-key config a live instance action would. `type: 'secret'`
-    // fields are decrypted just before the VM (see services/extension-secrets.ts).
-    const encKey = getEncryptionKey(config);
-    let instanceCtx;
-    if (job.instanceId) {
-        const inst = await storage.getExtensionInstance(ext.name, job.instanceId);
-        instanceCtx = {
-            id: job.instanceId,
-            config: inst
-                ? decryptSecretFields(inst.config, getInstanceSecretKeys(ext), encKey)
-                : (job.input ?? {}),
-        };
-    }
-    // One builder, so this road cannot be the one that forgets a guard again. It was: until
-    // 2026-08-10 the scheduled path wrote memory without the size and key-count limits, and fetched
-    // with a bare fetch rather than safeFetch, so an extension running on a clock had neither the
-    // storage ceiling nor the SSRF check that the same extension had when a person invoked it.
-    const baseCtx = buildExtensionCtx({
-        config,
-        storage,
-        extMemoryOwner,
-        // Scheduled runs have no human present. The installer is the responsible party, and the
-        // 'operator' role is what the sandbox reads to decide it is a system run.
-        caller: {
-            gaii: `scheduler@${config.nodeId}`,
-            owner: ext.installedBy,
-            roles: ['operator'],
-        },
-        extConfig: decryptSecretFields(ext.config, getExtSecretKeys(ext), encKey),
-        instance: instanceCtx,
-        logPrefix: `[ext:${ext.name}:scheduler]`,
-        // No wallet: nobody's balance is available to spend on a schedule.
-        notify: buildExtensionNotify({
-            storage, config, extName: ext.name,
-            recipientGaii: ext.installedBy, recipientOwner: ext.installedBy,
-        }),
-        email: buildExtensionEmail({
-            storage, config, extName: ext.name, extConfig: ext.config,
-            ownerName: ext.installedBy, emailService,
-        }),
+    const ownerGhii = ownerScope.includes('@') ? ownerScope : `${ownerName}@${config.nodeId}`;
+    const out = await runExtensionActionAsSystem({ storage, config, emailService }, {
+        extensionName: job.extensionName,
+        actionId: job.actionId,
+        instanceId: job.instanceId,
+        input: job.input,
+        // Nobody is present, and the scheduler says so rather than borrowing the owner's name for it.
+        callerGaii: `scheduler@${config.nodeId}`,
+        ownerName,
+        storageOwnerGhii: ownerGhii,
+        logLabel: 'scheduler',
+        producerKind: 'extension',
+        producerRef: job.id,
+        producerSchedule: job.cron,
+        trackMemory: true,
     });
-    // Wrap with memory access tracking
-    const { ctx, accessLog } = trackMemoryAccess(baseCtx);
-    // Validate input is a plain object — reject non-serializable values
-    const rawInput = job.input ?? {};
-    let input;
-    try {
-        input = JSON.parse(JSON.stringify(rawInput));
-    }
-    catch {
-        throw new Error(`Scheduled job "${job.id}" has non-serializable input`);
-    }
-    await executeExtensionAction(action.scriptContent, ctx, input, ext.limits);
-    return { reads: accessLog.reads, writes: accessLog.writes };
+    return { reads: out.reads, writes: out.writes };
 }
 //# sourceMappingURL=scheduler-extension-job.js.map

package/dist/src/services/scheduler-extension-job.js.map

@@ -1 +1 @@
-{"version":3,"file":"scheduler-extension-job.js","sourceRoot":"","sources":["../../../src/services/scheduler-extension-job.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGtG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,MAAoB,EACpB,YAAsC,EACtC,GAAuB;IAEvB,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,qCAAqC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,aAAa,iBAAiB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,QAAQ,6BAA6B,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,kEAAkE;IAClE,MAAM,cAAc,GAAG,GAAG,CAAC,UAAU;QACnC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE;QACrC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtB,6FAA6F;IAC7F,8FAA8F;IAC9F,+EAA+E;IAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,WAAwE,CAAC;IAC7E,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1E,WAAW,GAAG;YACZ,EAAE,EAAE,GAAG,CAAC,UAAU;YAClB,MAAM,EAAE,IAAI;gBACV,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;gBACtE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SACtB,CAAC;IACJ,CAAC;IAED,wFAAwF;IACxF,gGAAgG;IAChG,8FAA8F;IAC9F,2FAA2F;IAC3F,MAAM,OAAO,GAAiB,iBAAiB,CAAC;QAC9C,MAAM;QACN,OAAO;QACP,cAAc;QACd,wFAAwF;QACxF,0EAA0E;QAC1E,MAAM,EAAE;YACN,IAAI,EAAE,aAAa,MAAM,CAAC,MAAM,EAAE;YAClC,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,KAAK,EAAE,CAAC,UAAU,CAAC;SACpB;QACD,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QACzE,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,QAAQ,GAAG,CAAC,IAAI,aAAa;QACxC,mEAAmE;QACnE,MAAM,EAAE,oBAAoB,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI;YAClC,aAAa,EAAE,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,GAAG,CAAC,WAAW;SAChE,CAAC;QACF,KAAK,EAAE,mBAAmB,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM;YACzD,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY;SACzC,CAAC;KACH,CAAC,CAAC;IAEH,mCAAmC;IACnC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAEtD,oEAAoE;IACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAA4B,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,sBAAsB,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAE3E,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"scheduler-extension-job.js","sourceRoot":"","sources":["../../../src/services/scheduler-extension-job.ts"],"names":[],"mappings":"AAmCA,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAGvE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAgB,EAChB,MAAoB,EACpB,YAAsC,EACtC,GAAuB;IAEvB,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,qCAAqC,CAAC,CAAC;IACjF,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,kGAAkG;IAClG,wFAAwF;IACxF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,EAAE,6DAA6D,GAAG,CAAC,aAAa,qBAAqB,CAAC,CAAC;IAC/I,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAE1F,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;QAC9E,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,8FAA8F;QAC9F,UAAU,EAAE,aAAa,MAAM,CAAC,MAAM,EAAE;QACxC,SAAS;QACT,gBAAgB,EAAE,SAAS;QAC3B,QAAQ,EAAE,WAAW;QACrB,YAAY,EAAE,WAAW;QACzB,WAAW,EAAE,GAAG,CAAC,EAAE;QACnB,gBAAgB,EAAE,GAAG,CAAC,IAAI;QAC1B,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAClD,CAAC"}

package/dist/src/services/scope-vocabulary-migration.d.ts

@@ -32,6 +32,17 @@
  *   // fire-and-forget at boot, after storage is ready
  *   migrateAgentScopeVocabulary(storage).catch(err => logger.error(…));
  * @version-history
+ *   v1.4.0 — 2026-08-14 — SECURITY: a conditional grant is decided from the OWNER-granted scopes, not
+ *     from a set this migration had already widened. agent:permissions is conditional on agent:write,
+ *     which is itself grandfathered, so the second boot handed every agent on the node the one word
+ *     that lets an agent rewrite its own permissions — a word kept out of every wildcard for exactly
+ *     that reason. Found by test/e2e-organism-scope-gate.ts asking whether a second run changes
+ *     anything; it changed two agents out of three.
+ *   v1.3.0 — 2026-08-14 — organism:write now gates three HTTP doors as well as the tools, so the
+ *     entry for it says what removing it would cost. No conditional entry was added: this list
+ *     already hands the word to every agent that has a scope list, and `*` covers it at the door, so
+ *     one would have been dead code that read like a safeguard. An agent with NO recorded scope list
+ *     is now counted and warned about instead of skipped in silence.
  *   v1.2.0 — 2026-08-11 — Says in writing that account:security is in neither list, and why a word
  *     that names NEW reach never belongs in either. Nothing executable changed.
  *   v1.1.0 — 2026-08-11 — CONDITIONAL_SCOPES: a word handed only to agents already holding the
@@ -51,8 +62,17 @@ import type { Storage } from '../storage/interface.js';
  *   ext:invoke       — run an installed extension's action
  *   organism:write   — create a workspace, write and publish in one, comment, revert
  *   organism:invite  — invite a member, grant or revoke a workspace role
+ *
+ * organism:write NOW ALSO CARRIES THREE HTTP DOORS, as of 2026-08-14: POST /v1/organisms, POST
+ * /v1/organisms/:id/workspaces and POST /v1/organisms/:id/comments. Until then all three used
+ * requireRoleOrScope('agent', 'organism:write'), whose role path admitted every agent before it read
+ * a scope, so the word bound the MCP tool surface and nothing else. Tightening them to requireScope
+ * is safe only because the word is already in this list: taking it out would not merely rename a
+ * permission, it would stop every agent on the node from creating an organism. There is deliberately
+ * NO conditional entry for it below — a conditional grant would be dead code here, because this list
+ * hands the word to every agent with a recorded scope list and `*` covers it at the door.
  */
-export declare const GRANDFATHERED_SCOPES: readonly ["agent:write", "app:write", "app:manage", "capability:write", "ext:invoke", "organism:write", "organism:invite"];
+export declare const GRANDFATHERED_SCOPES: readonly ["agent:write", "app:write", "app:manage", "capability:write", "ext:invoke", "organism:write", "organism:invite", "packages:write"];
 /**
  * Words granted only to agents that ALREADY hold the word they are replacing.
  *
@@ -74,4 +94,37 @@ export declare const CONDITIONAL_SCOPES: ReadonlyArray<{
  * nothing to do. Returns the number of agents actually updated, for the boot log.
  */
 export declare function migrateAgentScopeVocabulary(storage: Storage): Promise<number>;
+/**
+ * The same grandfathering, for the OTHER principal family a new permission word can refuse.
+ *
+ * `requireScope` waves an owner session through and deliberately does NOT wave an app grant through
+ * — it is the only middleware that stops one, which is exactly why tightening a route to a new word
+ * is the shape that broke a live app in changelog 1.33.1 and is why H-20 was reverted. Everything
+ * above was written for agents and stopped there, so for five days the node had a mechanism that
+ * made a new word safe for one family and left the family the word actually bites uncovered.
+ *
+ * A grant carries what its owner approved on the consent screen at the time it was made, and an app
+ * gains nothing from being updated. So a word added to the vocabulary today would refuse every grant
+ * approved before it existed — for an act the app was already performing, through a door that asked
+ * nothing. Writing the word onto those grants preserves the reach they have; it does not hand an app
+ * a permission it never had, because the door it names was open to them a moment ago.
+ *
+ * The rule for a NEW grant is unchanged and is where the word does its work: the consent screen
+ * lists it, the owner sees it, and they can uncheck it.
+ *
+ * Conditional words are not applied here. Their `when` is a question about what an owner granted a
+ * particular agent, and an app grant's scope list is a different conversation with a different
+ * screen; the two should not be reasoned about with one table until someone decides they mean the
+ * same thing.
+ */
+export declare function migrateAppGrantScopeVocabulary(storage: Storage): Promise<number>;
+/**
+ * Both families, one call. The boot path takes this rather than either half, so a word added to
+ * GRANDFATHERED_SCOPES cannot reach one principal family and miss the other — which is the failure
+ * this pair exists to prevent, and which it had itself.
+ */
+export declare function migrateScopeVocabulary(storage: Storage): Promise<{
+    agents: number;
+    appGrants: number;
+}>;
 //# sourceMappingURL=scope-vocabulary-migration.d.ts.map

package/dist/src/services/scope-vocabulary-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope-vocabulary-migration.d.ts","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAIvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,4HAQvB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAc1F,CAAC;AAEF;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAkCnF"}
+{"version":3,"file":"scope-vocabulary-migration.d.ts","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAIvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,8IAavB,CAAC;AAEX;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAc1F,CAAC;AAEF;;;GAGG;AACH,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA0DnF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBtF;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAK7G"}

package/dist/src/services/scope-vocabulary-migration.js

@@ -11,6 +11,15 @@ import { scopeIsCovered } from '../utils/scope-coverage.js';
  *   ext:invoke       — run an installed extension's action
  *   organism:write   — create a workspace, write and publish in one, comment, revert
  *   organism:invite  — invite a member, grant or revoke a workspace role
+ *
+ * organism:write NOW ALSO CARRIES THREE HTTP DOORS, as of 2026-08-14: POST /v1/organisms, POST
+ * /v1/organisms/:id/workspaces and POST /v1/organisms/:id/comments. Until then all three used
+ * requireRoleOrScope('agent', 'organism:write'), whose role path admitted every agent before it read
+ * a scope, so the word bound the MCP tool surface and nothing else. Tightening them to requireScope
+ * is safe only because the word is already in this list: taking it out would not merely rename a
+ * permission, it would stop every agent on the node from creating an organism. There is deliberately
+ * NO conditional entry for it below — a conditional grant would be dead code here, because this list
+ * hands the word to every agent with a recorded scope list and `*` covers it at the door.
  */
 export const GRANDFATHERED_SCOPES = [
     'agent:write',
@@ -20,6 +29,11 @@ export const GRANDFATHERED_SCOPES = [
     'ext:invoke',
     'organism:write',
     'organism:invite',
+    // Added 2026-08-15 with the door that now demands it (routes/instances/install.ts). Installing a
+    // package asked for nothing before, so every principal that could reach the route could install;
+    // the word describes what was already happening rather than granting anything new, which is the
+    // only condition under which a word belongs on this list.
+    'packages:write',
 ];
 /**
  * Words granted only to agents that ALREADY hold the word they are replacing.
@@ -54,21 +68,37 @@ export const CONDITIONAL_SCOPES = [
 export async function migrateAgentScopeVocabulary(storage) {
     const agents = await storage.listAgents();
     let changed = 0;
+    let noScopeList = 0;
     for (const agent of agents) {
         const held = agent.defaultScopes;
         // No recorded scopes at all: nothing to grandfather. An agent with none is minted from
-        // config.defaultAgentScopes, which is a separate decision.
-        if (!Array.isArray(held))
+        // config.defaultAgentScopes, which is a separate decision — and writing a list here would
+        // REPLACE that fallback rather than extend it, narrowing the agent to whatever this file
+        // happens to name. Counted instead, because it is a real population with a real consequence
+        // (see the warning below) and it was previously invisible.
+        if (!Array.isArray(held)) {
+            noScopeList++;
             continue;
+        }
         // The grandfathered words ride inside a wildcard already, so a '*' agent needs none of them.
         const missing = held.includes('*')
             ? []
             : GRANDFATHERED_SCOPES.filter(s => !held.includes(s));
-        // The conditional words do NOT ride inside a wildcard — that is their whole point — so a
-        // '*' agent DOES need them written out, or it silently loses a tool it has today. Coverage
-        // is asked of the 'when' word, which '*' does carry.
+        // A conditional grant asks "did the OWNER already give this agent the word it depends on?",
+        // and the answer has to come from what the owner granted — never from a word this migration
+        // itself wrote on an earlier boot. Read literally, `held` mixes the two, and one pair
+        // overlaps: agent:write is GRANDFATHERED and agent:permissions is conditional on it. That
+        // handed agent:permissions — a word deliberately outside every wildcard, because it lets an
+        // agent rewrite its own permissions — to EVERY agent on the node, on the second boot, in
+        // silence. This runs on every boot, so "it only happens once" was never true of anything
+        // here. Testing coverage against the owner-granted set makes the answer the same on run one
+        // and run fifty. A '*' agent still gets these words written out, which is the whole point of
+        // the list — they sit OUTSIDE every wildcard, so a '*' agent would silently lose a tool it
+        // uses today. The filter does not touch that: '*' is not a grandfathered word, so it survives
+        // and still confers every 'when'.
+        const ownerGranted = held.filter(s => !GRANDFATHERED_SCOPES.includes(s));
         for (const c of CONDITIONAL_SCOPES) {
-            if (scopeIsCovered(held, c.when) && !held.includes(c.grant))
+            if (scopeIsCovered(ownerGranted, c.when) && !held.includes(c.grant))
                 missing.push(c.grant);
         }
         if (!missing.length)
@@ -82,6 +112,71 @@ export async function migrateAgentScopeVocabulary(storage) {
             scopes: GRANDFATHERED_SCOPES.join(', '),
         });
     }
+    if (noScopeList) {
+        // These agents keep whatever config.defaultAgentScopes says, which names none of the words
+        // above. Every gate that now asks for one of them refuses this agent, and the owner's only
+        // fix is to set its scopes explicitly in the agent editor. Say so out loud rather than
+        // leaving the population to be discovered by a support ticket.
+        logger.warn('Scope vocabulary migration: agents with no recorded scope list were left alone', {
+            agents: noScopeList,
+            effect: 'they fall back to config.defaultAgentScopes, which carries none of these words',
+        });
+    }
     return changed;
 }
+/**
+ * The same grandfathering, for the OTHER principal family a new permission word can refuse.
+ *
+ * `requireScope` waves an owner session through and deliberately does NOT wave an app grant through
+ * — it is the only middleware that stops one, which is exactly why tightening a route to a new word
+ * is the shape that broke a live app in changelog 1.33.1 and is why H-20 was reverted. Everything
+ * above was written for agents and stopped there, so for five days the node had a mechanism that
+ * made a new word safe for one family and left the family the word actually bites uncovered.
+ *
+ * A grant carries what its owner approved on the consent screen at the time it was made, and an app
+ * gains nothing from being updated. So a word added to the vocabulary today would refuse every grant
+ * approved before it existed — for an act the app was already performing, through a door that asked
+ * nothing. Writing the word onto those grants preserves the reach they have; it does not hand an app
+ * a permission it never had, because the door it names was open to them a moment ago.
+ *
+ * The rule for a NEW grant is unchanged and is where the word does its work: the consent screen
+ * lists it, the owner sees it, and they can uncheck it.
+ *
+ * Conditional words are not applied here. Their `when` is a question about what an owner granted a
+ * particular agent, and an app grant's scope list is a different conversation with a different
+ * screen; the two should not be reasoned about with one table until someone decides they mean the
+ * same thing.
+ */
+export async function migrateAppGrantScopeVocabulary(storage) {
+    const grants = await storage.listAppGrants();
+    let changed = 0;
+    for (const grant of grants) {
+        const held = grant.scopes;
+        if (!Array.isArray(held) || held.includes('*'))
+            continue;
+        const missing = GRANDFATHERED_SCOPES.filter(s => !held.includes(s));
+        if (!missing.length)
+            continue;
+        await storage.updateAppGrant(grant.grantId, { scopes: [...held, ...missing] });
+        changed++;
+    }
+    if (changed) {
+        logger.info('Scope vocabulary migration: live app grants grandfathered onto the new words', {
+            grantsUpdated: changed,
+            scopes: GRANDFATHERED_SCOPES.join(', '),
+        });
+    }
+    return changed;
+}
+/**
+ * Both families, one call. The boot path takes this rather than either half, so a word added to
+ * GRANDFATHERED_SCOPES cannot reach one principal family and miss the other — which is the failure
+ * this pair exists to prevent, and which it had itself.
+ */
+export async function migrateScopeVocabulary(storage) {
+    return {
+        agents: await migrateAgentScopeVocabulary(storage),
+        appGrants: await migrateAppGrantScopeVocabulary(storage),
+    };
+}
 //# sourceMappingURL=scope-vocabulary-migration.js.map

package/dist/src/services/scope-vocabulary-migration.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope-vocabulary-migration.js","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AA0CA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,aAAa;IACb,WAAW;IACX,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;CACX,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgE;IAC3F;QACI,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,uFAAuF;KAC/F;IACD,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,mCAAmC,EAAE;IAC1F,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,qCAAqC,EAAE;IACzG,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,iCAAiC,EAAE;IAC3F,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,oDAAoD,EAAE;IAC9G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,sBAAsB,EAAE;CACjF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;QACjC,uFAAuF;QACvF,2DAA2D;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAEnC,6FAA6F;QAC7F,MAAM,OAAO,GAAa,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,yFAAyF;QACzF,2FAA2F;QAC3F,qDAAqD;QACrD,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACjC,IAAI,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAE9B,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;YACxF,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC"}
+{"version":3,"file":"scope-vocabulary-migration.js","sourceRoot":"","sources":["../../../src/services/scope-vocabulary-migration.ts"],"names":[],"mappings":"AAqDA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,aAAa;IACb,WAAW;IACX,YAAY;IACZ,kBAAkB;IAClB,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,iGAAiG;IACjG,iGAAiG;IACjG,gGAAgG;IAChG,0DAA0D;IAC1D,gBAAgB;CACV,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgE;IAC3F;QACI,KAAK,EAAE,sBAAsB;QAC7B,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE,uFAAuF;KAC/F;IACD,8FAA8F;IAC9F,6FAA6F;IAC7F,4FAA4F;IAC5F,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,mCAAmC,EAAE;IAC1F,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,qCAAqC,EAAE;IACzG,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,iCAAiC,EAAE;IAC3F,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,oDAAoD,EAAE;IAC9G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,sBAAsB,EAAE;CACjF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAgB;IAC9D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC;QACjC,uFAAuF;QACvF,0FAA0F;QAC1F,yFAAyF;QACzF,4FAA4F;QAC5F,2DAA2D;QAC3D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,WAAW,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAEtD,6FAA6F;QAC7F,MAAM,OAAO,GAAa,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,4FAA4F;QAC5F,4FAA4F;QAC5F,sFAAsF;QACtF,0FAA0F;QAC1F,4FAA4F;QAC5F,yFAAyF;QACzF,yFAAyF;QACzF,4FAA4F;QAC5F,6FAA6F;QAC7F,2FAA2F;QAC3F,8FAA8F;QAC9F,kCAAkC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,oBAA0C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACjC,IAAI,cAAc,CAAC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAE9B,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;YACxF,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QACd,2FAA2F;QAC3F,2FAA2F;QAC3F,uFAAuF;QACvF,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,gFAAgF,EAAE;YAC1F,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,gFAAgF;SAC3F,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAAgB;IACjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC9B,MAAM,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;YACxF,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAgB;IACzD,OAAO;QACH,MAAM,EAAE,MAAM,2BAA2B,CAAC,OAAO,CAAC;QAClD,SAAS,EAAE,MAAM,8BAA8B,CAAC,OAAO,CAAC;KAC3D,CAAC;AACN,CAAC"}

package/dist/src/services/screenshot-capture.d.ts

@@ -6,8 +6,22 @@
  *   storage. No HTTP, no token, no operator action: it self-authenticates by virtue of running
  *   inside the node. Disables itself gracefully (one log line, no crash) if no browser is available.
  *   Opt-in via config.screenshotAutoCapture so nodes without a browser never try.
- * @structure startScreenshotAutoCapture() entry; launchBrowser() channel fallback; pass() one scan.
+ *
+ *   It also serves ONE app on demand (captureAppScreenshot), which is a different job wearing the
+ *   same machinery. The batch exists so a catalogue is not full of blank cards; the on-demand call
+ *   exists because an agent that has just published an app cannot otherwise see what it made. A
+ *   hosted agent has no browser and no shell, so without this it ships blind and says "done" on the
+ *   strength of a 200.
+ * @structure startScreenshotAutoCapture() entry; launchBrowser() channel fallback;
+ *   runScreenshotCapturePass() one batch scan; captureAppScreenshot() one app, with its own
+ *   per-owner throttle; renderAndStore() the shared render both paths use.
  * @version-history
+ *   v1.3.0 — 2026-08-16 — captureAppScreenshot(): one named app, on demand, answering with a reason
+ *     instead of a number. The render moved into renderAndStore() so the batch and the request run
+ *     the same code. The module-level `running` flag stays a BATCH guard only — it used to make any
+ *     second caller return 0 silently, which is the wrong answer to give someone who asked a
+ *     question. Rendering is expensive and unauthenticated rendering is a denial-of-service shape,
+ *     so the on-demand path carries a per-owner throttle of its own.
  *   v1.0.0 — 2026-06-20 — initial: interval backfill writing straight to storage; channel-fallback
  *     browser via lazy playwright-core; graceful self-disable when no browser is present.
  *   v1.1.0 — 2026-06-20 — render the app's STORED HTML directly (fulfill the main document) instead of
@@ -18,11 +32,36 @@
  */
 import type { AimeatConfig } from '../config.js';
 import type { Storage } from '../storage/interface.js';
+/** What one on-demand capture can answer. Every failure names itself, because the caller is an agent
+ *  deciding what to do next rather than a log nobody reads. */
+export type CaptureResult = {
+    ok: true;
+    sizeBytes: number;
+} | {
+    ok: false;
+    status: number;
+    code: string;
+    message: string;
+};
 /**
  * One scan: capture + store a thumbnail for every published app that still has none. Returns the
  * number captured. Exported so a manual trigger / test can run a single pass on demand.
  */
 export declare function runScreenshotCapturePass(config: AimeatConfig, storage: Storage): Promise<number>;
+/**
+ * Capture ONE app now, for a caller who asked.
+ *
+ * Separate from the batch on purpose. The batch may skip, retry next interval and answer with a
+ * count; someone who just published an app and wants to look at it needs either a picture or a
+ * reason. The batch's `running` flag is deliberately NOT consulted here: a scan in progress is no
+ * reason to refuse a person, and the two writing the same key is an upsert either way.
+ *
+ * Rendering is the most expensive thing this node does per request, so it is throttled per owner.
+ */
+export declare function captureAppScreenshot(config: AimeatConfig, storage: Storage, app: {
+    ownerName: string;
+    filename: string;
+}): Promise<CaptureResult>;
 /** Start the interval-driven auto-capture job (no-op unless config.screenshotAutoCapture is on). */
 export declare function startScreenshotAutoCapture(config: AimeatConfig, storage: Storage): void;
 //# sourceMappingURL=screenshot-capture.d.ts.map

package/dist/src/services/screenshot-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"screenshot-capture.d.ts","sourceRoot":"","sources":["../../../src/services/screenshot-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AA8CvD;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAyFtG;AAED,oGAAoG;AACpG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvF"}
+{"version":3,"file":"screenshot-capture.d.ts","sourceRoot":"","sources":["../../../src/services/screenshot-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAmBvD;+DAC+D;AAC/D,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAoHjE;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCtG;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnF,OAAO,CAAC,aAAa,CAAC,CAqDxB;AAED,oGAAoG;AACpG,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOvF"}