approval-md 0.1.0 → 0.2.0

package/dist/src/core/loop.d.ts

@@ -0,0 +1,274 @@
+/**
+ * Loop safety (SPEC.md §10.2): "three consecutive `execution.failed` events for
+ * one task escalate to `manual` regardless of policy".
+ *
+ * This is a **pure projection over the log** and nothing else. It reads records,
+ * counts, and returns; it never appends, never reads the clock, and never
+ * consults the policy. Two very different consumers need the same answer and
+ * must not be allowed to disagree about it:
+ *
+ * - `core/gate.ts` refuses to admit a *new* non-manual request for an escalated
+ *   task (the `loop-escalated` refusal);
+ * - `core/execute.ts` refuses to *start* a supervised/autonomous execution for
+ *   one, directing the caller to the manual path.
+ *
+ * It lives in its own module rather than inside `core/execute.ts` for a boring
+ * structural reason: `execute.ts` imports the gate, so the gate cannot import
+ * `execute.ts` back without a cycle. `core/execute.ts` re-exports these names, so
+ * the documented home of the projection is still the execution module.
+ *
+ * ## What "consecutive" means here, stated exactly
+ *
+ * The streak is **per task**, not per action key — SPEC.md §10.2 says "for one
+ * task", and an agent that fails three different actions of the same task in a
+ * row is exactly the runaway loop the rule exists to stop.
+ *
+ * Only two event types move the counter:
+ *
+ * - `execution.failed` increments it;
+ * - `execution.completed` resets it to zero.
+ *
+ * Everything else — `execution.started`, approvals, budget events, another
+ * task's failures — is transparent. In particular a *retry* is not a reset: a
+ * failed action that is started again and fails again is two consecutive
+ * failures, which is the entire point. Only a successful completion is evidence
+ * that the loop broke, so only a completion clears the count.
+ *
+ * ## Escalation is a floor, never a ban
+ *
+ * An escalated task is escalated **to manual**, not to refused. Its manual
+ * actions still request, still grant, and still execute with a token — a human
+ * is now in the loop for every one of them, which is what "escalate to manual"
+ * means. Escalation is also **not** cleared by a human decision, only by an
+ * `execution.completed`: the log records the recovery, or the escalation stands.
+ *
+ * ## The harness scopes (APRV-145)
+ *
+ * Everything above is the per-task streak of SPEC.md §10.2 and is unchanged. A
+ * harness adapter (§10.1) mints a fresh task id for every tool call, so that
+ * streak cannot leave zero on that surface however wedged the session is. The
+ * amended §10.2 answers it with two more streaks, both derived here and both
+ * counted in TOOL CALLS rather than in events:
+ *
+ * - the **session**, `hook:<session id>`, which is a real prefix of every task
+ *   id the adapter mints, so the scope is recovered from a string the runtime
+ *   itself wrote rather than from a field an agent hands the gate;
+ * - the **actor**, the identity the adapter runs as, because a session id is
+ *   authored by the party under oversight and a scope key the subject can
+ *   rotate is a streak the subject can clear (§11.1 invariant 4).
+ *
+ * A command is escalated when EITHER reaches {@link LOOP_ESCALATION_THRESHOLD}.
+ *
+ * ## Only side effects accrue (APRV-280, amended SPEC.md §10.2)
+ *
+ * The streak counts failed executions of classes that DO something. A
+ * `read.*` command that exits non-zero has not failed a side effect: a `grep`
+ * that matches nothing and an `ls` of a path that is not there both exit 1, and
+ * that exit IS the command's answer. Counting those escalated whole sessions to
+ * manual over nothing, which is the incident APRV-280 was filed on: forty-eight
+ * requests queued in an hour behind three failed greps.
+ *
+ * The predicate is {@link isSideEffectingClass} and it is stated once. What it
+ * does NOT do is let a read clear anything: a tool call whose classes are all
+ * reads is transparent to the streak in both directions, so a failing write
+ * streak is not cleared by a successful `ls` in between. The strict direction is
+ * kept everywhere else too — a class this projection cannot resolve from the log
+ * counts as side-effecting, because "we could not establish what this was" is
+ * not "this was harmless".
+ *
+ * The class is read from the `execution.started` record the RUNTIME wrote for
+ * the action key (its `payload.class`), never from anything the reporter said
+ * (§11.1 invariants 1 and 4). The report chooses the outcome; it does not get to
+ * choose the bucket.
+ *
+ * ## Escalation raises scrutiny on side effects only (APRV-297, amended §10.2)
+ *
+ * APRV-280 above says what a read does not ACCRUE. This says what a tripped
+ * floor does not ROUTE, and it is the same sentence read forward: a tool call
+ * whose classes are all `read.*` is answered by the policy under a tripped floor
+ * exactly as it is under a clear one.
+ *
+ * The floor bounds a harm a read cannot cause. It exists to stop an agent
+ * retrying a side effect that keeps failing, so routing a `grep` to a phone buys
+ * no safety at all, and it costs the thing the floor is spending: a human's
+ * attention, once per read, plus the wait the agent spends before it is refused.
+ * On 2026-09-06/07 a floor tripped and a session that could not get an answer
+ * could not read a file either, which is the state this removes.
+ *
+ * Two edges, both narrow. A MIXED tool call is routed whole, as one question,
+ * because the side-effecting half of it is exactly what the floor is for; its
+ * read classes are neither counted nor separately raised, so the approver sees
+ * one prompt for the command's effects and none for its looking. And the
+ * exemption is about ROUTING alone: a read still clears nothing, so a session
+ * cannot read its way out from under a floor.
+ *
+ * This module states the fact; the two surfaces that apply it are the harness
+ * adapter's verdict (`cli/hook.ts`) and the write boundary that re-checks it
+ * (`core/gate.ts`'s `startHarnessExecution`), and both use
+ * {@link isSideEffectingClass} so neither can drift from the other.
+ */
+import type { EventRecord } from "./log.js";
+/**
+ * Consecutive failures that force a task to manual (SPEC.md §10.2). Three, and
+ * the number is spelled here once so the gate, the executor, and the CLI cannot
+ * hold three opinions about it.
+ */
+export declare const LOOP_ESCALATION_THRESHOLD = 3;
+/**
+ * Does an action in this class have a side effect the loop rule is about?
+ * (APRV-280, amended SPEC.md §10.2.)
+ *
+ * THE PREDICATE, exactly: a class is side-effecting unless it is `read` itself
+ * or sits under the `read.` namespace. Everything else — `files.write.*`,
+ * `files.delete.*`, `vcs.*`, `deps.*`, `network.*`, `communicate.*`,
+ * `policy.*`, `log.*`, a routed `policy.edit.*`, and any class this build has
+ * never heard of — is side-effecting. The unknown falls on the strict side by
+ * construction, which is the whole reason the predicate is written as a
+ * carve-OUT of `read.*` rather than as a list of the namespaces that act.
+ *
+ * `core/command-class.ts` already reads `read.*` this way when it decides which
+ * command substitutions may run unattended, and this is deliberately the same
+ * sentence: one reading of "this command only looks at things", used by the
+ * classifier and by loop safety alike.
+ */
+export declare function isSideEffectingClass(cls: string): boolean;
+/** One task's loop state, derived from the log. */
+export interface TaskLoopState {
+    task: string;
+    /** Failures since the last `execution.completed` for this task. */
+    consecutiveFailures: number;
+    /** `consecutiveFailures >= LOOP_ESCALATION_THRESHOLD`. */
+    escalated: boolean;
+    /** The seq of the failure that opened the current streak, or `null`. */
+    streakStartSeq: number | null;
+    /** The seq of the most recent failure in the streak, or `null`. */
+    lastFailureSeq: number | null;
+}
+/**
+ * Loop state for every task that has recorded an execution outcome.
+ *
+ * Returned sorted by task id so the projection is byte-stable: two runs over
+ * the same log produce the same list in the same order, which is what lets
+ * `approval status --json` be pinned by a `deepEqual` test.
+ *
+ * Tasks with side-effecting executions but no failures are included with
+ * `consecutiveFailures: 0` — a caller rendering health wants to know the task
+ * was seen and is clean, and filtering is the caller's business, not this
+ * function's.
+ *
+ * APRV-280: outcomes of `read.*` actions are skipped entirely, so a task whose
+ * every execution was a read appears here not at all. That is the transparency
+ * the amended §10.2 asks for, read in both directions: a failed read accrues
+ * nothing, and a completed read clears nothing either.
+ */
+export declare function loopEscalation(records: EventRecord[]): TaskLoopState[];
+/** Is `task` escalated to manual by loop safety right now? */
+export declare function isLoopEscalated(records: EventRecord[], task: string): boolean;
+/** The prefix every harness adapter task id carries (`src/cli/hook.ts`). */
+export declare const HARNESS_TASK_PREFIX = "hook:";
+/**
+ * The bucket every unreadable session identifier lands in.
+ *
+ * ONE shared bucket, not a fresh one per unreadable id, and the difference is
+ * the whole rule: absence must accrue FASTER and never slower. `parseHookInput`
+ * already substitutes this literal for an absent `session_id`, so the two halves
+ * of the runtime spell it the same way.
+ */
+export declare const UNKNOWN_SESSION = "unknown-session";
+/**
+ * The session scope key of a harness task id, or `null` for a task no harness
+ * adapter minted.
+ *
+ * DERIVED, never declared. The id is `hook:<session>:<tool-use id>` and this
+ * reads its middle segment back out; nothing here reads a scope an agent named.
+ * A `hook:` task that does not split into exactly three colon-separated parts is
+ * an id this runtime cannot read, so it lands in {@link UNKNOWN_SESSION} with
+ * every other unreadable one.
+ */
+export declare function harnessSessionOf(task: string): string | null;
+/** Which derivation produced a {@link HarnessLoopState}'s key. */
+export type HarnessScope = "session" | "actor";
+/** One harness scope's loop state, derived from the log. */
+export interface HarnessLoopState {
+    scope: HarnessScope;
+    /** `hook:<session id>` for a session, the actor identity for an actor. */
+    key: string;
+    /** Consecutive failed TOOL CALLS since the last completed one. */
+    consecutiveFailures: number;
+    /** `consecutiveFailures >= LOOP_ESCALATION_THRESHOLD`. */
+    escalated: boolean;
+    /** The seq that opened the current streak, or `null`. */
+    streakStartSeq: number | null;
+    /** The seq of the most recent failure in the streak, or `null`. */
+    lastFailureSeq: number | null;
+}
+/**
+ * Loop state for every harness session and every harness actor the log has seen
+ * an outcome for.
+ *
+ * Sorted by scope then key so the projection is byte-stable, exactly as
+ * {@link loopEscalation} is, which is what lets `approval status --json` be
+ * pinned by a `deepEqual` test.
+ *
+ * What resets a streak is unchanged and deliberately not widened: only an
+ * `execution.completed` in the same scope, of a SIDE-EFFECTING class since
+ * APRV-280. A hook timeout, a deny, a withdrawn request, a granted approval, a
+ * fresh tool call, a successful `grep`, a restarted process and elapsed time all
+ * leave the streak where they found it. Silence is not evidence of recovery, and
+ * neither is a command that did nothing.
+ */
+export declare function harnessLoopEscalation(records: EventRecord[]): HarnessLoopState[];
+/**
+ * The harness scope that escalated this tool call, or `null` for a command no
+ * streak has floored.
+ *
+ * EITHER scope escalates (amended SPEC.md §10.2). The session is the smallest
+ * scope a runaway actually runs away in; the actor is the backstop, because the
+ * session id is authored by the party under oversight and a scope it can rotate
+ * is a streak it can shed. The session is reported in preference to the actor
+ * where both are tripped, because it is the narrower fact and names the run an
+ * operator has to go and look at.
+ */
+export declare function harnessLoopFloor(records: EventRecord[], task: string, actor: string): HarnessLoopState | null;
+/**
+ * What clears this streak, in one sentence, for the surface that has to say so
+ * (APRV-280).
+ *
+ * Written here rather than at each call site because three surfaces print it —
+ * the gate's `loop-escalated` refusals, the hook's denies, and `approval
+ * status` — and three copies of a sentence about how to get out of a floor are
+ * three chances to tell an operator something that is not true. Everything in
+ * it is a fact of this module: a completion of a SIDE-EFFECTING class in the
+ * same scope, and nothing else, resets the counter.
+ *
+ * The gate window is named for the harness scopes only, because that is the
+ * surface it reaches: an open window routes every gated tool call through the
+ * bypass path before the floor is ever consulted (SPEC.md §5.2, APRV-214). It is
+ * named as the human's ceremony, which is what it is — it needs a terminal and a
+ * typed `understood`, and an agent may not run it.
+ *
+ * The harness sentence also states the routing exemption of APRV-297, and states
+ * it here for the same reason the clearance is here: the operator reading it in
+ * `approval status` and the agent reading it in a deny need the same account of
+ * what a floor does and does not reach, and two copies would eventually give two.
+ */
+export declare function loopClearance(scope: "task" | HarnessScope, key: string): string;
+/** Is this harness tool call floored to manual by either scope right now? */
+export declare function isHarnessLoopEscalated(records: EventRecord[], task: string, actor: string): boolean;
+/** How many harness starts carry an outcome, and how many do not (§10.2). */
+export interface HarnessOutcomeCoverage {
+    started: number;
+    reported: number;
+    unreported: number;
+}
+/**
+ * Coverage of the completion counterpart, for `approval status`.
+ *
+ * INFORMATIONAL. It moves no health verdict and no exit code, for the reason
+ * §8's timestamp anomalies move neither: it is a coverage measurement rather
+ * than an integrity verdict, and a control an operator learns to silence is
+ * worse than one that reports beside the verdict. A persistently high
+ * `unreported` is how an operator learns the post-execution hook is not
+ * installed or not firing.
+ */
+export declare function harnessOutcomeCoverage(records: EventRecord[]): HarnessOutcomeCoverage;

package/dist/src/core/loop.js

@@ -269,6 +269,17 @@ export function harnessSessionOf(task) {
     if (!task.startsWith(HARNESS_TASK_PREFIX))
         return null;
     const parts = task.split(":");
+    // APRV-311: Codex native ids may themselves contain colons, so the adapter
+    // writes fixed-width digests as `hook:codex:<session-digest>:<call-digest>`.
+    // Preserve the session digest as the loop bucket. This arm is deliberately
+    // exact; malformed Codex-shaped tasks fall through to the legacy unknown
+    // bucket rather than selecting a scope from attacker-authored fragments.
+    if (parts.length === 4 &&
+        parts[1] === "codex" &&
+        /^[a-f0-9]{64}$/u.test(parts[2] ?? "") &&
+        /^[a-f0-9]{64}$/u.test(parts[3] ?? "")) {
+        return `${HARNESS_TASK_PREFIX}codex:${parts[2]}`;
+    }
     if (parts.length !== 3)
         return `${HARNESS_TASK_PREFIX}${UNKNOWN_SESSION}`;
     const session = parts[1];

package/dist/src/core/loop.js.map

@@ -1 +1 @@
-{"version":3,"file":"loop.js","sourceRoot":"","sources":["../../../src/core/loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,SAAS;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,MAAmB,EAAE,OAA4B;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAiB,EAAE;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAkB;YAC7B,IAAI;YACJ,mBAAmB,EAAE,CAAC;YACtB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,SAAS;QAC5F,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;YACzE,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;gBAAE,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;YACrE,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;YACxB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE,IAAY;IAClE,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AA6BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,SAAS;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,SAAS;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAC1B,6EAA6E;QAC7E,uCAAuC;QACvC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,GAAW,EAAoB,EAAE;QACtE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,KAAK;YACL,GAAG;YACH,mBAAmB,EAAE,CAAC;YACtB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;gBAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;gBACzE,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;oBAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;YACxB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GACb,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;IACjF,IAAI,SAAS,EAAE,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IACvF,OAAO,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,KAA4B,EAAE,GAAW;IACrE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,mCAAmC,GAAG,0GAA0G,CAAC;IAC1J,CAAC;IACD,OAAO,mDAAmD,KAAK,WAAW,GAAG,idAAid,CAAC;AACjiB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAAsB,EACtB,IAAY,EACZ,KAAa;IAEb,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAsB;IAC3D,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,KAAK,KAAK,qBAAqB;YACtC,MAAM,CAAC,KAAK,KAAK,kBAAkB;YACnC,MAAM,CAAC,KAAK,KAAK,yBAAyB,EAC1C,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,QAAQ,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"loop.js","sourceRoot":"","sources":["../../../src/core/loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,SAAS;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,MAAmB,EAAE,OAA4B;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAiB,EAAE;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAkB;YAC7B,IAAI;YACJ,mBAAmB,EAAE,CAAC;YACtB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,SAAS;QAC5F,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;YACzE,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;gBAAE,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;YACrE,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;YACxB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE,IAAY;IAClE,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EACtC,CAAC;QACD,OAAO,GAAG,mBAAmB,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AA6BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,SAAS;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,SAAS;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAC1B,6EAA6E;QAC7E,uCAAuC;QACvC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,GAAW,EAAoB,EAAE;QACtE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,KAAK;YACL,GAAG;YACH,mBAAmB,EAAE,CAAC;YACtB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;gBAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;gBACzE,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;oBAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;YACxB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GACb,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;IACjF,IAAI,SAAS,EAAE,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IACvF,OAAO,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,KAA4B,EAAE,GAAW;IACrE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,mCAAmC,GAAG,0GAA0G,CAAC;IAC1J,CAAC;IACD,OAAO,mDAAmD,KAAK,WAAW,GAAG,idAAid,CAAC;AACjiB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAAsB,EACtB,IAAY,EACZ,KAAa;IAEb,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAsB;IAC3D,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,KAAK,KAAK,qBAAqB;YACtC,MAAM,CAAC,KAAK,KAAK,kBAAkB;YACnC,MAAM,CAAC,KAAK,KAAK,yBAAyB,EAC1C,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,QAAQ,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC;AAC/D,CAAC"}

package/dist/src/core/md-fence.d.ts

@@ -0,0 +1,41 @@
+/**
+ * CommonMark fenced-block scanning, as a leaf module.
+ *
+ * `APPROVAL.md` is prose for humans plus fenced blocks for machines: exactly
+ * one ` ```yaml approval-policy ` block (SPEC.md §5) and at most one optional
+ * ` ```yaml approval-values ` block (SPEC.md §5.3). Two readers, two info
+ * strings, one question: which fenced blocks in this markdown carry that label,
+ * and was one of them left open at end of file.
+ *
+ * This module answers that question and nothing else. It was lifted out of
+ * `policy-load.ts` unchanged (APRV-238) so the values reader could ask it too
+ * without importing the policy loader, which is the module a values reader must
+ * stay clear of (SPEC.md §11.1 invariant 10, `tests/values-inert.test.ts`). The
+ * splitter is the one place allowed to know both info strings, because knowing
+ * a label is not reading a block: what it returns is text, and what a caller
+ * does with the text is the caller's whole subject.
+ *
+ * Pure function of the markdown and the info string. No filesystem, no clock,
+ * no schema, no YAML.
+ */
+/** The blocks a scan found, and whether one was left open at end of file. */
+export interface FenceScan {
+    /** Bodies of every block whose info string matched, in document order. */
+    blocks: string[];
+    /** True when a MATCHING fence was opened and never closed before EOF. */
+    unterminated: boolean;
+}
+/**
+ * Scan CommonMark fenced code blocks and collect the bodies of those whose info
+ * string is `infoString` (compared after {@link normaliseInfoString}).
+ *
+ * CommonMark rules honoured, because they decide what is and is not a fence:
+ * an opening fence is 3+ backticks indented at most 3 spaces; its info string
+ * may not contain a backtick; the closing fence is at least as long as the
+ * opener and carries nothing but whitespace. Every non-matching fenced block
+ * (```js, ```yaml, …) is still scanned as a block, so text *inside* it can
+ * never be mistaken for a matching fence. Everything outside a fence — including
+ * yaml-looking prose and 4-space-indented code blocks, which are not fences —
+ * is ignored entirely.
+ */
+export declare function scanFences(markdown: string, infoString: string): FenceScan;

package/dist/src/core/money.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Monetary amounts in hashed material (APRV-121).
+ *
+ * ## The representation, and why
+ *
+ * Every USD amount that enters hashed material — an envelope's
+ * `actions[].est_cost_usd` and `budget.max_cost_usd`, the `est_cost_usd` the
+ * gate records on `approval.requested`, `approval.granted`, `execution.started`
+ * and `budget.exceeded`, and the `est_cost_usd` an execution token binds to —
+ * is a **decimal string**: `"0"`, `"0.02"`, `"1200.5"`. Not a JSON number.
+ *
+ * RFC 8785 pins ES6 number serialization, so a single TypeScript runtime is
+ * internally consistent with itself. Cross-language it is not: the fast-path of
+ * SPEC.md §13 and any second implementation must reproduce the same bytes from
+ * the same value, and float formatting is precisely where that breaks. A
+ * decimal string has one spelling, and every language agrees on it because
+ * nobody has to reserialize anything.
+ *
+ * **String decimal, not integer minor units.** Both remove the float; the
+ * choice is about what a human writes and reads. The field is named
+ * `est_cost_usd` and a task author writes it in YAML frontmatter next to a
+ * one-line summary; `est_cost_usd: "0.02"` still says two cents, while
+ * `est_cost_usd: 20000` says nothing without knowing the exponent this project
+ * picked, and picking one commits the format to a currency decision (USD has
+ * two decimal places, other currencies do not) that the field name does not
+ * make. The string also round-trips into and out of a channel message, a CLI
+ * table, and a policy discussion without a conversion anyone can get wrong.
+ *
+ * ## The canonical form
+ *
+ * {@link USD_STRING_PATTERN}: an optional integer part with no leading zeros,
+ * an optional fraction of one to six digits, no sign, no exponent, no trailing
+ * dot, no trailing zeros beyond the last significant digit. One value, one
+ * spelling — `"0.10"` and `"0.1"` cannot both be written, so two records
+ * carrying the same amount always hash the same way.
+ *
+ * Six fractional digits is the resolution, matching the micro-USD unit the
+ * arithmetic below runs in. It is far finer than any real amount and far
+ * coarser than IEEE-754 drift.
+ *
+ * ## The arithmetic
+ *
+ * All budget arithmetic runs in **integer micro-USD**. A decimal string parses
+ * to micros by integer string manipulation, never through a double, so no
+ * rounding happens on the way in and none is possible on the way back out.
+ * Sums, comparisons, and remainders are exact integers: `"0.1" + "0.2"` is
+ * `"0.3"`, and a window of ten thousand two-cent actions is exactly `"200"`
+ * rather than a value that depends on the order they were added in.
+ *
+ * ## Historical compatibility (SPEC.md §8, additive-change precedent)
+ *
+ * The log is append-only, so records written before this change carry JSON
+ * numbers and must keep validating, verifying, and feeding budget math exactly
+ * as before. Every reader here therefore accepts both forms: a decimal string
+ * (the only form the write boundary now admits) and a finite non-negative JSON
+ * number (the historical form). A historical number converts to micros by
+ * `Math.round(value * 1e6)`, which is deterministic for every amount the old
+ * write boundary could have admitted. The write boundary is the only place the
+ * two forms are told apart: `schema/*.schema.json` types the fields as decimal
+ * strings, and `validate(..., { mode: "historical" })` is the one documented
+ * relaxation, used by the verifier and nothing else.
+ */
+/** Micro-USD per USD: the resolution of every amount in this module. */
+export declare const USD_MICROS_SCALE = 1000000;
+/** Fractional digits the canonical form admits (the micro-USD resolution). */
+export declare const USD_FRACTION_DIGITS = 6;
+/**
+ * The canonical decimal-string form, as a JSON Schema `pattern` source.
+ *
+ * Exported so the schemas and the runtime cannot drift: `tests/money.test.ts`
+ * asserts the schema files carry exactly this string.
+ */
+export declare const USD_STRING_PATTERN = "^(0|[1-9][0-9]*)(\\.[0-9]{0,5}[1-9])?$";
+/** Is `value` a canonical decimal USD string? */
+export declare function isUsdString(value: unknown): value is string;
+/**
+ * A canonical decimal string as integer micro-USD, or `null` when the string is
+ * not canonical.
+ *
+ * Parsed by integer arithmetic on the digits: the fraction is padded to six
+ * places and the two halves are combined, so the double never sees the value.
+ */
+export declare function usdStringToMicros(value: string): number | null;
+/**
+ * A historical JSON number as integer micro-USD, or `null` when it is not a
+ * usable amount (non-finite, negative, or beyond the safe-integer range once
+ * scaled).
+ *
+ * `Math.round` is the documented conversion. It is deterministic, and for every
+ * value the pre-APRV-121 write boundary admitted (`minimum: 0`, ES6-serialized)
+ * it lands on the micro the author wrote.
+ */
+export declare function usdNumberToMicros(value: number): number | null;
+/**
+ * Either accepted form as integer micro-USD, or `null` when the value is not a
+ * usable amount.
+ *
+ * This is the reader every enforcement path uses. It accepts the historical
+ * number deliberately: a record already in the log must feed budget math
+ * identically to before this change.
+ */
+export declare function usdToMicros(value: unknown): number | null;
+/** Integer micro-USD as the canonical decimal string. */
+export declare function microsToUsdString(micros: number): string;
+/**
+ * Integer micro-USD as a JSON number, for **display and CLI output only**.
+ *
+ * Never write the result of this function into hashed material: that is the
+ * float this module exists to remove. Budget verdicts report through it because
+ * a verdict is a rendered explanation of a decision the integers already made.
+ */
+export declare function microsToUsdNumber(micros: number): number;
+/**
+ * Either accepted form as a canonical decimal string, or `null` when the value
+ * is not a usable amount.
+ *
+ * The normalizer at every boundary where an amount arrives from outside: a task
+ * envelope, a CLI flag, a historical log record.
+ */
+export declare function normalizeUsd(value: unknown): string | null;
+/**
+ * Either accepted form as a canonical decimal string, defaulting to `"0"`.
+ *
+ * The budgets contract of `core/budgets.ts` requires `est_cost_usd` on every
+ * consuming event, and an action that declared no cost is recorded as `"0"` —
+ * an authorization with no declared cost is still an authorization.
+ */
+export declare function usdOrZero(value: unknown): string;
+/**
+ * Either accepted form as a JSON number, for **display surfaces only**: a
+ * channel card, a CLI table, a `--json` field a human reads.
+ *
+ * `0` for anything unusable, so a renderer never has to decide what to print
+ * for a malformed amount. Same warning as {@link microsToUsdNumber}: the result
+ * of this function must never be written into hashed material.
+ */
+export declare function usdNumber(value: unknown): number;
+/**
+ * Either accepted form as a JSON number, or `null` when there is no amount.
+ *
+ * The display counterpart of {@link normalizeUsd}: it keeps "declared nothing"
+ * distinct from "declared zero", which is a distinction the queue's own columns
+ * make.
+ */
+export declare function usdNumberOrNull(value: unknown): number | null;
+/** An amount as accepted from a caller: canonical string, or historical number. */
+export type UsdInput = string | number;

package/dist/src/core/payload-census.d.ts

@@ -0,0 +1,74 @@
+/**
+ * What the payload store holds, read against what the log says about it
+ * (APRV-41's counts, APRV-59's home for them).
+ *
+ * The census is a *reporting* question, asked by `approval doctor` and by
+ * `approval status`, and answered from two sources that can disagree: the files
+ * under `.approval/payloads/` and the records of `events.jsonl`. It decides
+ * nothing and deletes nothing. The daemon's pruner (`daemon/prune.ts`) is the
+ * only caller allowed to act on the same facts, and it derives its plan through
+ * the two helpers exported here so that the counts a reader is shown and the
+ * files the daemon would remove are computed by one piece of code.
+ *
+ * ## Why this lives in `core/` and not beside the pruner
+ *
+ * The CLI reports these numbers, and a CLI verb reaching into `daemon/` to do it
+ * is the wrong direction: `daemon/` is a caller of the core, never a dependency
+ * of the surfaces. This module is that shared core. Nothing here reads a clock,
+ * loads a policy, appends an event, or unlinks a file.
+ *
+ * ## Why not in `core/payload-store.ts`
+ *
+ * The store module is deliberately ignorant of the log ("Nothing here opens
+ * `events.jsonl`"): it addresses bytes by hash and verifies them, and that
+ * narrowness is what makes it safe to call from every channel. The census is the
+ * opposite kind of thing, a comparison between the log and the store, so it gets
+ * its own module rather than teaching the store to read events.
+ */
+import type { EventRecord } from "./log.js";
+/** Hashes a `payload.pruned` record already names. */
+export declare function prunedHashes(records: EventRecord[]): Set<string>;
+export interface Binding {
+    /** Action keys that declared this hash. */
+    actionKeys: Set<string>;
+    /** A record named the hash without an action key: bound, but unattributable. */
+    unattributed: boolean;
+}
+/**
+ * Every hash any record binds to, mapped to the actions that declared it.
+ *
+ * Two attributions are understood, because they are the two the runtime writes:
+ * a `payload_hash` beside a record's own `action_key` (`approval.requested` and
+ * `approval.granted` carry it there), and the `payload_hash` of each action
+ * inside a `task.registered` envelope, attributed to that action's
+ * `idempotency_key` — which is where a *registered but not yet requested* action
+ * declares its bytes. Without the second, a payload stored at registration time
+ * would look like residue nothing bound and be pruned out from under the request
+ * about to be made for it.
+ *
+ * Everything else is caught by a deep scan and deliberately treated as a
+ * binding this module cannot attribute: an unattributable binding is never
+ * prunable, so an event shape nobody here anticipated makes a payload immortal
+ * rather than making it disposable. The only event exempt from the scan is
+ * `payload.pruned`, whose whole job is to name bytes that are going.
+ */
+export declare function bindingsOf(records: EventRecord[]): Map<string, Binding>;
+export interface PayloadStoreCensus {
+    /** Files the store currently holds, by hash. */
+    files: number;
+    /** Distinct hashes a `payload.pruned` event names — evidence that outlived bytes. */
+    pruned: number;
+    /** Files present that no record binds: head-moved residue, prunable when enabled. */
+    orphans: number;
+    /** Files present whose prune event is already logged (a crash mid-prune). */
+    awaitingRemoval: number;
+}
+/**
+ * Count what the store holds against what the log says about it.
+ *
+ * Honest in both directions and about both failure modes: `pruned` is a fact of
+ * the log (it stays true forever, whatever the store does), `orphans` and
+ * `awaitingRemoval` are facts about the disagreement between the two. None of
+ * them is a health verdict; a reader is being told what is there.
+ */
+export declare function payloadStoreCensus(records: EventRecord[], storeDir: string): PayloadStoreCensus;