approval-md 0.1.0 → 0.3.0

package/dist/src/core/gesture-refusal.d.ts

@@ -0,0 +1,166 @@
+/**
+ * What the log says when a decision surface refused a gesture that is not a
+ * decision (APRV-355, amended SPEC.md §8).
+ *
+ * ## The fact this module is about
+ *
+ * Found while landing APRV-324 (PR #427, 2026-09-17). Once the policy maps
+ * Telegram senders, a tap on a CHECKPOINT signature or on a REVIEW from an
+ * account the attested policy names nobody for is refused before any verb runs
+ * — and records nothing. The only refusal record in the system is
+ * `audit.decision_refused`, and it requires a record-level `action_key` and a
+ * `payload.decision` of grant, reject or revoke. A signature answers for a
+ * chain head and a review answers for a sampled record; neither has either
+ * field, so writing one of these there would mean manufacturing both. The lane
+ * that found it declined to, correctly.
+ *
+ * The cost of recording nothing is the same cost `core/decision-refusal.ts`
+ * exists to end. Somebody's attention was spent — SPEC.md §11 calls human
+ * attention the audit budget — and an attempt was made from an account the
+ * operator did not map, and the only trace is a line on a terminal and an
+ * answer in a chat. An operator deciding whether to map that account has
+ * nothing in the log to read.
+ *
+ * ## What this record is, and what it is not
+ *
+ * `audit.gesture_refused` is an AUDIT-TIER record on the strict terms
+ * `audit.decision_refused` set, and the terms are the whole of its safety:
+ *
+ * - it grants nothing and mints no token;
+ * - `core/state.ts` settles nothing on it, so no verdict moves;
+ * - `core/budgets.ts` charges nothing for it, so no budget moves;
+ * - `core/audit.ts` does not sample it and no streak counts it;
+ * - NO ENFORCEMENT PATH READS IT. `tests/gesture-refusal.test.ts` pins that by
+ *   reading the module graph rather than by asserting an intention.
+ *
+ * The record's own actor is `system:`, for the reason `audit.dark_session`'s
+ * and `audit.decision_refused`'s are: this is the runtime's statement about a
+ * refusal the runtime made, and a record of a refusal authored by either party
+ * to it is a record neither party can be held to. The person, when the runtime
+ * can name one, is the SUBJECT and sits in the payload.
+ *
+ * ## The asymmetry it inherits
+ *
+ * Refusals handed to AGENTS stay unlogged here too. An agent that is refused
+ * reads the code, stops or asks again, and nothing was spent that a record
+ * could account for. And a gesture is human by construction: an agent has no
+ * checkpoint to sign and no review to give.
+ *
+ * ## No attestation check, deliberately
+ *
+ * Nothing here asks whether the policy is attested, for the reason
+ * `core/decision-refusal.ts` does not: this write confers no authority.
+ * Refusing to record a refusal because a file changed would be the strict
+ * direction pointing the wrong way, and the case where it would bite hardest is
+ * `policy-not-attested` itself — exactly the refusal an operator most needs the
+ * log to remember. The write boundary still validates every record.
+ *
+ * ## Invariants
+ *
+ * - **Gate-typed events never accept caller timestamps** (§11.1). `ts` comes
+ *   from the injected clock at the write boundary; there is no parameter.
+ * - **Every check-then-append passes through compare-and-append** (§11.1(5)).
+ *   The write states the head it was derived against and the whole cycle
+ *   re-enters from a fresh read on `head-moved` through {@link withHeadRetry}.
+ * - **Self-reported fields never reduce scrutiny** (§11.1). Everything here
+ *   only ADDS to what a reviewer sees. The sender is the transport's own
+ *   attribution, never anything the message claimed about itself.
+ * - **Refusals stay machine-readable and distinct** (§11.1). The surface's code
+ *   is copied verbatim; nothing here invents, merges or softens one.
+ */
+import { type AppendError, type EventRecord } from "./log.js";
+import type { GateOptions } from "./gate.js";
+import type { RecordedSender, SenderSource } from "./sender-identity.js";
+/** The actor every record here carries: the gate stating what the gate did. */
+export declare const GESTURE_REFUSAL_ACTOR = "system:gate";
+/**
+ * The gestures this record can be about. **Closed and additive-only** (§11.1
+ * invariant 6), and pinned against the event schema's own enum by
+ * `tests/gesture-refusal.test.ts`: a kind the sweep can produce and the write
+ * boundary refuses is an observation that never reaches a human, which is the
+ * failure APRV-358 named a few hours before this task.
+ *
+ * `review` and `review-note` are two members rather than one because a note is
+ * attention spent WRITING rather than attention spent tapping, and an operator
+ * reading this record to decide whether to map an account wants to know which
+ * they lost.
+ */
+export declare const REFUSED_GESTURES: readonly ["checkpoint-signature", "review", "review-note"];
+export type RefusedGestureKind = (typeof REFUSED_GESTURES)[number];
+/**
+ * The refusals a gesture can meet before any verb runs. **Closed**, and exactly
+ * what sender resolution can answer: `sender-unmapped`, `sender-ambiguous` and
+ * `sender-key-unavailable` from `core/sender-identity.ts`'s own union, and
+ * `policy-not-attested` from `core/attest.ts`, which fires when the policy
+ * declaring the mapping is not the attested one and is therefore not in force.
+ *
+ * `attest-requires-terminal` is deliberately absent: it belongs to an
+ * attestation tap, which is a decision and is recorded as one.
+ */
+export declare const REFUSED_GESTURE_CODES: readonly ["sender-unmapped", "sender-ambiguous", "sender-key-unavailable", "policy-not-attested"];
+export type RefusedGestureCode = (typeof REFUSED_GESTURE_CODES)[number];
+/** Is `code` one this record can carry? Used where a code arrives as a string. */
+export declare function isRefusedGestureCode(code: string): code is RefusedGestureCode;
+/** What was attempted, by whom, on which surface. */
+export interface RefusedGesture {
+    /** Which gesture. */
+    gesture: RefusedGestureKind;
+    /**
+     * The person, `human:<id>`, when the surface could name one.
+     *
+     * `null` for the refusal where it could not: a transport authenticated an
+     * account the attested policy binds to nobody. The record then carries
+     * {@link RefusedGesture.sender} and no `actor`, and the event schema requires
+     * one or the other.
+     */
+    actor: string | null;
+    /** The surface that collected the gesture: `telegram`, `web`, `cli`. */
+    channel: string;
+    /**
+     * The authenticated sender it arrived from, when the surface observed one,
+     * in the form the record carries it (APRV-370: raw, or the keyed digest).
+     */
+    sender?: RecordedSender;
+    /** How the sender became the actor, when one did. */
+    senderSource?: SenderSource;
+}
+/** The refusal being recorded. Only these fields are ever read. */
+export interface GestureRefusalFacts {
+    /** The surface's code, verbatim. */
+    code: string;
+    /** The surface's message, verbatim. */
+    message: string;
+}
+/** What the module could not do. Never thrown; the caller carries on regardless. */
+export interface GestureRefusalFailure {
+    ok: false;
+    code: "log-unreadable" | "append-failed";
+    message: string;
+    append?: AppendError;
+}
+export type RecordRefusedGestureResult = {
+    ok: true;
+    /** The record, or `null` when there was nothing to record. */
+    audit: EventRecord | null;
+} | GestureRefusalFailure;
+/**
+ * Record that a human's gesture was refused.
+ *
+ * Called by the surface that collected the gesture, on the branch where it
+ * refused — never from inside the verb the gesture would have reached, which is
+ * never called at all on this path.
+ *
+ * Best-effort by design: a failure here is returned, never thrown, and the
+ * caller shows the refusal either way. The gesture was already refused before
+ * this ran, and nothing about that outcome depends on this write landing.
+ *
+ * Two cases append nothing, and both are the honest answer rather than a
+ * silence:
+ *
+ * - a non-human actor, which is the misconfigured-surface case: nobody's
+ *   attention was spent, so there is no spend for a record to account for;
+ * - a code this record cannot carry, which means a surface refused for a reason
+ *   this vocabulary does not name. Minting a member here to fit it would widen
+ *   a closed union at the write boundary from inside a best-effort path.
+ */
+export declare function recordRefusedGesture(logPath: string, gesture: RefusedGesture, refusal: GestureRefusalFacts, options?: GateOptions): RecordRefusedGestureResult;

package/dist/src/core/gesture-refusal.js

@@ -0,0 +1,188 @@
+/**
+ * What the log says when a decision surface refused a gesture that is not a
+ * decision (APRV-355, amended SPEC.md §8).
+ *
+ * ## The fact this module is about
+ *
+ * Found while landing APRV-324 (PR #427, 2026-09-17). Once the policy maps
+ * Telegram senders, a tap on a CHECKPOINT signature or on a REVIEW from an
+ * account the attested policy names nobody for is refused before any verb runs
+ * — and records nothing. The only refusal record in the system is
+ * `audit.decision_refused`, and it requires a record-level `action_key` and a
+ * `payload.decision` of grant, reject or revoke. A signature answers for a
+ * chain head and a review answers for a sampled record; neither has either
+ * field, so writing one of these there would mean manufacturing both. The lane
+ * that found it declined to, correctly.
+ *
+ * The cost of recording nothing is the same cost `core/decision-refusal.ts`
+ * exists to end. Somebody's attention was spent — SPEC.md §11 calls human
+ * attention the audit budget — and an attempt was made from an account the
+ * operator did not map, and the only trace is a line on a terminal and an
+ * answer in a chat. An operator deciding whether to map that account has
+ * nothing in the log to read.
+ *
+ * ## What this record is, and what it is not
+ *
+ * `audit.gesture_refused` is an AUDIT-TIER record on the strict terms
+ * `audit.decision_refused` set, and the terms are the whole of its safety:
+ *
+ * - it grants nothing and mints no token;
+ * - `core/state.ts` settles nothing on it, so no verdict moves;
+ * - `core/budgets.ts` charges nothing for it, so no budget moves;
+ * - `core/audit.ts` does not sample it and no streak counts it;
+ * - NO ENFORCEMENT PATH READS IT. `tests/gesture-refusal.test.ts` pins that by
+ *   reading the module graph rather than by asserting an intention.
+ *
+ * The record's own actor is `system:`, for the reason `audit.dark_session`'s
+ * and `audit.decision_refused`'s are: this is the runtime's statement about a
+ * refusal the runtime made, and a record of a refusal authored by either party
+ * to it is a record neither party can be held to. The person, when the runtime
+ * can name one, is the SUBJECT and sits in the payload.
+ *
+ * ## The asymmetry it inherits
+ *
+ * Refusals handed to AGENTS stay unlogged here too. An agent that is refused
+ * reads the code, stops or asks again, and nothing was spent that a record
+ * could account for. And a gesture is human by construction: an agent has no
+ * checkpoint to sign and no review to give.
+ *
+ * ## No attestation check, deliberately
+ *
+ * Nothing here asks whether the policy is attested, for the reason
+ * `core/decision-refusal.ts` does not: this write confers no authority.
+ * Refusing to record a refusal because a file changed would be the strict
+ * direction pointing the wrong way, and the case where it would bite hardest is
+ * `policy-not-attested` itself — exactly the refusal an operator most needs the
+ * log to remember. The write boundary still validates every record.
+ *
+ * ## Invariants
+ *
+ * - **Gate-typed events never accept caller timestamps** (§11.1). `ts` comes
+ *   from the injected clock at the write boundary; there is no parameter.
+ * - **Every check-then-append passes through compare-and-append** (§11.1(5)).
+ *   The write states the head it was derived against and the whole cycle
+ *   re-enters from a fresh read on `head-moved` through {@link withHeadRetry}.
+ * - **Self-reported fields never reduce scrutiny** (§11.1). Everything here
+ *   only ADDS to what a reviewer sees. The sender is the transport's own
+ *   attribution, never anything the message claimed about itself.
+ * - **Refusals stay machine-readable and distinct** (§11.1). The surface's code
+ *   is copied verbatim; nothing here invents, merges or softens one.
+ */
+import { tick } from "./clock.js";
+import { attemptsOf, withHeadRetry } from "./head-retry.js";
+import { appendEvent } from "./log.js";
+import { readVerifiedRecords } from "./state.js";
+/** The actor every record here carries: the gate stating what the gate did. */
+export const GESTURE_REFUSAL_ACTOR = "system:gate";
+/**
+ * The gestures this record can be about. **Closed and additive-only** (§11.1
+ * invariant 6), and pinned against the event schema's own enum by
+ * `tests/gesture-refusal.test.ts`: a kind the sweep can produce and the write
+ * boundary refuses is an observation that never reaches a human, which is the
+ * failure APRV-358 named a few hours before this task.
+ *
+ * `review` and `review-note` are two members rather than one because a note is
+ * attention spent WRITING rather than attention spent tapping, and an operator
+ * reading this record to decide whether to map an account wants to know which
+ * they lost.
+ */
+export const REFUSED_GESTURES = ["checkpoint-signature", "review", "review-note"];
+/**
+ * The refusals a gesture can meet before any verb runs. **Closed**, and exactly
+ * what sender resolution can answer: `sender-unmapped`, `sender-ambiguous` and
+ * `sender-key-unavailable` from `core/sender-identity.ts`'s own union, and
+ * `policy-not-attested` from `core/attest.ts`, which fires when the policy
+ * declaring the mapping is not the attested one and is therefore not in force.
+ *
+ * `attest-requires-terminal` is deliberately absent: it belongs to an
+ * attestation tap, which is a decision and is recorded as one.
+ */
+export const REFUSED_GESTURE_CODES = [
+    "sender-unmapped",
+    "sender-ambiguous",
+    // APRV-370. A keyed mapping this process holds no key for: the runtime could
+    // resolve no account at all, which is a different fact from "this account is
+    // not mapped" and wants a different repair.
+    "sender-key-unavailable",
+    "policy-not-attested",
+];
+/** Is `code` one this record can carry? Used where a code arrives as a string. */
+export function isRefusedGestureCode(code) {
+    return REFUSED_GESTURE_CODES.includes(code);
+}
+/** The gestures this module records: a person's, and nobody else's. */
+const HUMAN_ACTOR = /^human:.+/u;
+/**
+ * Record that a human's gesture was refused.
+ *
+ * Called by the surface that collected the gesture, on the branch where it
+ * refused — never from inside the verb the gesture would have reached, which is
+ * never called at all on this path.
+ *
+ * Best-effort by design: a failure here is returned, never thrown, and the
+ * caller shows the refusal either way. The gesture was already refused before
+ * this ran, and nothing about that outcome depends on this write landing.
+ *
+ * Two cases append nothing, and both are the honest answer rather than a
+ * silence:
+ *
+ * - a non-human actor, which is the misconfigured-surface case: nobody's
+ *   attention was spent, so there is no spend for a record to account for;
+ * - a code this record cannot carry, which means a surface refused for a reason
+ *   this vocabulary does not name. Minting a member here to fit it would widen
+ *   a closed union at the write boundary from inside a best-effort path.
+ */
+export function recordRefusedGesture(logPath, gesture, refusal, options = {}) {
+    if (gesture.actor !== null && !HUMAN_ACTOR.test(gesture.actor)) {
+        return { ok: true, audit: null };
+    }
+    // No person and no account is nothing to say: the record would name neither
+    // the subject nor the reason it could not, and the schema refuses it.
+    if (gesture.actor === null && gesture.sender === undefined) {
+        return { ok: true, audit: null };
+    }
+    if (!isRefusedGestureCode(refusal.code))
+        return { ok: true, audit: null };
+    const appended = withHeadRetry(attemptsOf(options.retryOnHeadMoved), () => appendAudit(logPath, gesture, refusal, options));
+    return appended.ok ? { ok: true, audit: appended.record } : appended;
+}
+/** The whole cycle: a fresh read for the head, then one append against it. */
+function appendAudit(logPath, gesture, refusal, options) {
+    const ts = tick(options);
+    const read = readVerifiedRecords(logPath, options.schemaDir === undefined ? {} : { schemaDir: options.schemaDir });
+    if (!read.ok) {
+        return { ok: false, code: "log-unreadable", message: read.message };
+    }
+    const payload = {
+        ...(gesture.actor === null ? {} : { actor: gesture.actor }),
+        gesture: gesture.gesture,
+        code: refusal.code,
+        message: refusal.message,
+    };
+    if (gesture.sender !== undefined) {
+        payload["sender"] = {
+            channel: gesture.sender.channel,
+            id: gesture.sender.id,
+            // APRV-370: only when true, so a raw record does not change shape.
+            ...(gesture.sender.hashed === true ? { hashed: true } : {}),
+        };
+        if (gesture.senderSource !== undefined)
+            payload["sender_source"] = gesture.senderSource;
+    }
+    return appendOne(logPath, { ts, actor: GESTURE_REFUSAL_ACTOR, channel: gesture.channel, payload }, options, read.head);
+}
+function appendOne(logPath, input, options, expectedHead) {
+    const append = { ...options.append };
+    if (options.schemaDir !== undefined)
+        append.schemaDir = options.schemaDir;
+    const result = appendEvent(logPath, { ...input, event: "audit.gesture_refused" }, { ...append, expectedHead });
+    if (result.ok)
+        return { ok: true, record: result.record };
+    return {
+        ok: false,
+        code: "append-failed",
+        message: `audit.gesture_refused could not be appended: ${result.error.message}`,
+        append: result.error,
+    };
+}
+//# sourceMappingURL=gesture-refusal.js.map

package/dist/src/core/gesture-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gesture-refusal.js","sourceRoot":"","sources":["../../../src/core/gesture-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAoD,MAAM,UAAU,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAIjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,sBAAsB,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAI3F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB;IACjB,kBAAkB;IAClB,6EAA6E;IAC7E,6EAA6E;IAC7E,4CAA4C;IAC5C,wBAAwB;IACxB,qBAAqB;CACb,CAAC;AAIX,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAQ,qBAA2C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAkDD,uEAAuE;AACvE,MAAM,WAAW,GAAG,YAAY,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,OAAuB,EACvB,OAA4B,EAC5B,OAAO,GAAgB,EAAE;IAEzB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAE1E,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CACxE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAChD,CAAC;IACF,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvE,CAAC;AAID,8EAA8E;AAC9E,SAAS,WAAW,CAClB,OAAe,EACf,OAAuB,EACvB,OAA4B,EAC5B,OAAoB;IAEpB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,mBAAmB,CAC9B,OAAO,EACP,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC3D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,GAAG;YAClB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;YAC/B,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;YACrB,mEAAmE;YACnE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;QACF,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1F,CAAC;IAED,OAAO,SAAS,CACd,OAAO,EACP,EAAE,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,EACvE,OAAO,EACP,IAAI,CAAC,IAAI,CACV,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,OAAe,EACf,KAAuF,EACvF,OAAoB,EACpB,YAA4B;IAE5B,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC1E,MAAM,MAAM,GAAG,WAAW,CACxB,OAAO,EACP,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAC5C,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAC5B,CAAC;IACF,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC1D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,gDAAgD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;QAC/E,MAAM,EAAE,MAAM,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC"}

package/dist/src/core/git-run.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Running `git` and `gh` as values rather than as exceptions.
+ *
+ * This used to live in `cli/git-scope.ts`, which is the wrong home for it since
+ * APRV-245: the coverage sources under `core/coverage-sources/` shell out to git
+ * to learn what actually happened in a repository, and core code that imported a
+ * CLI module would invert the direction `tests/layering.test.ts` exists to keep.
+ * So the two runners moved down here and `cli/git-scope.ts` re-exports them; its
+ * callers are unchanged and there is still exactly one spelling of "run git".
+ *
+ * Nothing here decides anything. `ok` means "exit status 0", a process that did
+ * not start is `ok: false` with the reason in `stderr`, and no call throws.
+ */
+/**
+ * How much of a child's output this runtime will hold, in bytes.
+ *
+ * `spawnSync` defaults `maxBuffer` to one mebibyte, and a child that writes
+ * more than that is KILLED: `error` is set to `ENOBUFS`, `status` comes back
+ * null, and `stdout` holds a truncated prefix. Nothing about that is loud. The
+ * caller sees a failed run with no exit code and, if it only checks whether it
+ * got bytes, sees nothing at all.
+ *
+ * That default cost this project a live regression. `git show <rev>:<log>` is
+ * how every committed copy of `events.jsonl` is read (the anchor check, the
+ * published-seq count, the sync's incoming blob), and the committed log passed
+ * a megabyte long ago. Every one of those reads had been failing, silently, for
+ * as long as the log had been over the ceiling: `approval log verify --anchor`
+ * reported no committed copy in a checkout where `git show` printed one, the
+ * daemon's started line said anchor none, the doctor's log-drift row misread,
+ * and the advance cadence put the highest published seq at 0.
+ *
+ * A cap is still a cap and this one can still be reached. Two things make that
+ * survivable rather than silent: it is not preallocated, so naming a large
+ * number costs nothing until a child actually produces that much; and every
+ * caller that reads a blob now reports the command it ran and what the runner
+ * said when it comes back empty-handed, so the next ceiling arrives as a
+ * sentence naming the command rather than as a wrong answer.
+ */
+export declare const GIT_OUTPUT_LIMIT_BYTES: number;
+/** One process invocation's result. `ok` is "exit status 0", nothing more. */
+export interface GitRun {
+    ok: boolean;
+    stdout: string;
+    stderr: string;
+    /**
+     * The child's exit status, or `null` when it never got one — it failed to
+     * start, was killed by a signal, or outran {@link GIT_OUTPUT_LIMIT_BYTES}.
+     *
+     * `ok` cannot carry that distinction and a diagnostic needs it: "exited 128"
+     * is a git that answered, and `null` is a git that was stopped mid-sentence.
+     */
+    status: number | null;
+}
+/**
+ * Run git in `cwd`. Never throws: a git that did not run is `ok: false`.
+ *
+ * `env` is merged over `process.env`, and exists for exactly one caller:
+ * `commitOnBase` points `GIT_INDEX_FILE` at a scratch index so that a commit can
+ * be assembled without going anywhere near the operator's own.
+ */
+export declare function git(args: string[], cwd: string, env?: Record<string, string>): GitRun;
+/** `gh`, run the way {@link git} runs git: never throws, always answers. */
+export declare function gh(args: string[], cwd: string): GitRun;
+/**
+ * Is `bin` reachable on this process's PATH?
+ *
+ * Asked with the tool's own `--version`, because `which` is one more program
+ * that may be absent and a PATH walk would have to reimplement the platform's
+ * lookup rules. A binary that is present and refuses `--version` is reported
+ * absent, which is the fail-quiet direction for a reporting verb: the coverage
+ * report says the source is unavailable rather than inventing a gap.
+ */
+export declare function onPath(bin: string, cwd: string): boolean;

package/dist/src/core/harness-version.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Which harness binary issued a hook-written record (APRV-227).
+ *
+ * ## The hole
+ *
+ * A harness upgrade — `claude update`, a global npm install, an unattended
+ * updater on a launchd timer — swaps the binary that hosts the PreToolUse hook
+ * without a line anywhere. A new harness release can change the hook envelope
+ * semantics and quietly stop the gate firing, and the first evidence would be
+ * an action nobody was asked about. The gate cannot stop a person upgrading
+ * their own machine, and should not. What it can do is notice the effect: the
+ * records the hook writes name the harness that issued them, and `approval
+ * doctor` says so when the installed binary no longer matches the last one the
+ * log saw.
+ *
+ * ## What this field is, and what it is emphatically not
+ *
+ * It is INFORMATIONAL. Nothing in the runtime reads it back as an input:
+ * no class resolution, no irreversibility floor, no loop-escalation streak, no
+ * budget arithmetic, no sampling draw. SPEC.md §11.1 invariant 4 says a
+ * self-reported field never reduces scrutiny, and the discipline that keeps
+ * that true here is that the value has exactly one reader — a doctor row that
+ * can only ADD a red line — and exactly one direction it can move a human's
+ * attention, which is toward the log rather than away from it. A harness that
+ * lies about its own version buys itself nothing: the row it defeats is a row
+ * that would have asked for a look.
+ *
+ * It is also OPTIONAL and additive. A record written before the field existed
+ * carries neither half and still validates and still verifies; a hook that
+ * cannot establish a version writes neither half rather than a guess.
+ *
+ * ## Where the value comes from, in order
+ *
+ * 1. The hook event's own version field, where the harness supplies one.
+ *    Claude Code's PreToolUse event may carry it; Cursor's does not.
+ * 2. `<binary> --version`, read at most ONCE per process ({@link
+ *    installedHarnessVersion} memoizes, including the failures) with a short
+ *    hard timeout.
+ * 3. Absent.
+ *
+ * Step 2 is why this module is careful about cost. A hook process exists per
+ * gated tool call, and APRV-186/188/212 each removed a term from what that
+ * process pays. So the probe is reached only on a path that is about to WRITE a
+ * record — a registration or a bypass — and never on the pass-through path that
+ * answers `cat README.md`. The memo makes a multi-class command pay once.
+ *
+ * ## Why the binary name is not configurable
+ *
+ * `cli/gloss.ts` already settled this: a runtime that let a policy or an
+ * environment variable name the executable it runs would have invented a new
+ * way to be told what to execute. The map below is the whole list, PATH is the
+ * only seam, and a test puts a stub binary in front of it.
+ */
+/** The harnesses this runtime speaks a hook protocol for. */
+export declare const HARNESS_KINDS: readonly ["claude-code", "cursor", "codex", "grok", "muse"];
+export type HarnessKind = (typeof HARNESS_KINDS)[number];
+/** Is `value` one of the harnesses this runtime knows? */
+export declare function isHarnessKind(value: unknown): value is HarnessKind;
+/**
+ * The executable each harness installs on PATH.
+ *
+ * Not configurable, deliberately (see the header). A harness whose binary is
+ * not one of these has no version to read here, and the field is simply absent.
+ */
+export declare const HARNESS_BINARY: Readonly<Record<HarnessKind, string>>;
+/**
+ * How long a version string may be, and the reason there is a cap at all.
+ *
+ * `<binary> --version` is the output of a third-party process, and this value
+ * is appended to an append-only log. SPEC.md §11.1 invariant 3 has no exception
+ * for provenance: a field that accepted arbitrary bytes is a field where a
+ * banner, a stack trace, or the credential quoted inside one arrives and stays
+ * forever. So the write boundary takes one line, printable ASCII only, capped.
+ */
+export declare const HARNESS_VERSION_LIMIT = 64;
+/**
+ * The one spelling of a harness version this runtime ever writes or compares.
+ *
+ * First line, trimmed, and nothing else: `claude --version` prints
+ * `2.0.14 (Claude Code)` and a future release may add a second line of banner.
+ * Both the hook (which records) and doctor (which compares) call this, so the
+ * comparison is between two values normalized identically — a row that failed
+ * because one side kept a trailing newline would be a false alarm, and a false
+ * alarm in a health check trains an operator to ignore it.
+ *
+ * Returns `null` for anything that is not a usable version: empty output, a
+ * line that is not printable ASCII, or one longer than the cap. Absence is
+ * always available and always honest.
+ */
+export declare function normalizeHarnessVersion(raw: unknown): string | null;
+/**
+ * How long the probe may take before it is killed and reported as absent.
+ *
+ * A bound against a HUNG binary, not a latency target: `<binary> --version`
+ * answers in milliseconds on any machine that is not already in trouble, and
+ * this number is only ever reached by one that is. It is generous for the same
+ * reason `cli/gloss.ts`'s is (20s there): a timeout tuned to a healthy machine
+ * turns a loaded one into a silent, intermittent absence, and an absence that
+ * appears under load is the least useful failure a provenance field could have.
+ * The cost is bounded by the fact that this runs only where a record is being
+ * written, and at most once per process.
+ */
+export declare const HARNESS_PROBE_TIMEOUT_MS = 10000;
+/**
+ * Run `<binary> --version` once, uncached, and normalize what came back.
+ *
+ * Every failure is a value rather than an exception, in the manner of
+ * {@link spawnGloss}: a missing binary, a non-zero exit and a timeout kill are
+ * all reported on the result object, and all of them are simply "no version".
+ *
+ * The child is STARVED, for the reason the gloss runner is: this is a
+ * third-party CLI spawned by a process that may be holding a bot token and a
+ * vault passphrase, and it has no use for either. Nothing is declared, because
+ * reading a version is not a granted action.
+ */
+export declare function probeHarnessVersion(kind: HarnessKind): string | null;
+/**
+ * The installed version of `kind`, read at most once per process.
+ *
+ * This is the only entry point callers should use. `probeHarnessVersion` is
+ * exported for the test that proves the memo is a memo.
+ */
+export declare function installedHarnessVersion(kind: HarnessKind): string | null;
+/** Drop the memo. TEST ONLY: a process reads a version once, by design. */
+export declare function resetHarnessVersionCache(): void;
+/**
+ * The provenance pair a hook-written record carries, or `null` when this
+ * process could not establish one.
+ *
+ * Both halves or neither. A version with no harness beside it is a string
+ * doctor cannot attribute to a binary — one log holds the records of every
+ * harness that ever wrote to it — and a harness with no version is a field that
+ * says nothing.
+ */
+export interface HarnessProvenance {
+    harness: HarnessKind;
+    harness_version: string;
+}
+/**
+ * Build the pair for `kind`, preferring the version the hook event supplied.
+ *
+ * `eventVersion` is whatever the harness put in its own event, unvalidated:
+ * it goes through {@link normalizeHarnessVersion} exactly as the probe's
+ * output does, because it arrives from the same untrusted side of the boundary
+ * and the write boundary does not have two standards.
+ */
+export declare function harnessProvenance(kind: HarnessKind, eventVersion?: unknown): HarnessProvenance | null;
+/**
+ * The provenance pair carried by an already-written record's payload, or
+ * `null` when it carries none (or carries half of one).
+ *
+ * The read side of the same contract, used by `approval doctor`. Strict on
+ * purpose: a record whose `harness` is a string this runtime does not know is a
+ * record from a harness this build cannot probe, so it is not evidence about
+ * any binary here and is skipped rather than guessed at.
+ */
+export declare function readHarnessProvenance(payload: unknown): HarnessProvenance | null;

package/dist/src/core/harness-version.js

@@ -54,7 +54,7 @@
 import { spawnSync } from "node:child_process";
 import { childEnvironment } from "./child-env.js";
 /** The harnesses this runtime speaks a hook protocol for. */
-export const HARNESS_KINDS = ["claude-code", "cursor"];
+export const HARNESS_KINDS = ["claude-code", "cursor", "codex", "grok", "muse"];
 /** Is `value` one of the harnesses this runtime knows? */
 export function isHarnessKind(value) {
     return typeof value === "string" && HARNESS_KINDS.includes(value);
@@ -68,6 +68,9 @@ export function isHarnessKind(value) {
 export const HARNESS_BINARY = {
     "claude-code": "claude",
     cursor: "cursor-agent",
+    codex: "codex",
+    grok: "grok",
+    muse: "muse",
 };
 /**
  * How long a version string may be, and the reason there is a cap at all.

package/dist/src/core/harness-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-version.js","sourceRoot":"","sources":["../../../src/core/harness-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAU,CAAC;AAIhE,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,oFAAoF;AACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,4DAA4D;YAC5D,SAAS,EAAE,EAAE,GAAG,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,YAAY,GAAY,IAAI;IAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"harness-version.js","sourceRoot":"","sources":["../../../src/core/harness-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAIzF,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;CACb,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,oFAAoF;AACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,4DAA4D;YAC5D,SAAS,EAAE,EAAE,GAAG,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,YAAY,GAAY,IAAI;IAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}