approval-md 0.1.0 → 0.3.0

package/dist/src/core/harness-wait.d.ts

@@ -0,0 +1,55 @@
+/**
+ * How long a harness hook waits, and how long the question it opened outlives
+ * that wait (APRV-287).
+ *
+ * Two numbers with two readers each, which is the whole reason they live here
+ * rather than beside either one. `cli/hook.ts` uses them to decide when a
+ * request it opened has been abandoned; `cli/channel-telegram.ts` uses the wait
+ * to decide which pending requests on a listener's first cycle are stale enough
+ * to collapse into one message. Two copies of the same duration would be two
+ * answers to "is anybody still waiting on this", and the channel would collapse
+ * questions the hook was still holding open, or leave a dead queue on a phone.
+ *
+ * Nothing here reads a clock, a policy or the log: these are durations, and
+ * every judgment made with them is made by a caller that already holds the
+ * instant it is judging against.
+ */
+/**
+ * The hook's default wait, chosen to sit inside Claude Code's own 60s hook
+ * default. The string form is what the flag parser takes; the millisecond form
+ * is what a comparison takes.
+ */
+export declare const HOOK_DEFAULT_WAIT = "55s";
+/** {@link HOOK_DEFAULT_WAIT} in milliseconds. */
+export declare const HOOK_DEFAULT_WAIT_MS = 55000;
+/**
+ * How long a request outlives the wait that opened it, before the hook takes it
+ * back (APRV-287).
+ *
+ * The window exists for exactly one thing: the retry. A hook whose wait expires
+ * leaves its question open because a decision inside the policy's TTL still
+ * authorizes an identical retry of the identical command (APRV-117), and the
+ * agent that was denied usually retries within a minute or two. So the question
+ * stays live for that long and no longer.
+ *
+ * Past it, nobody is coming back for the answer. The request was accruing on an
+ * approver's phone as one more message a restarted listener would re-deliver,
+ * and on 2026-09-06 a dozen of those arrived at once behind a dead daemon. A
+ * request nothing will adopt is withdrawn (reason `timeout`), which authorizes
+ * nothing, refuses a late tap in the approver's own words, and leaves the log
+ * saying exactly what happened: the asker gave up.
+ *
+ * Five minutes because it is longer than any retry loop this runtime has been
+ * observed to take and shorter than the shortest TTL an operator is likely to
+ * write. It is a default: `--retry-grace` moves it per invocation, and `0`
+ * withdraws at the moment the wait expires.
+ */
+export declare const HOOK_RETRY_GRACE_MS: number;
+/**
+ * How old a request opened under `waitMs` must be before the grace has run out.
+ *
+ * Measured from the `approval.requested` record's own timestamp, which is the
+ * instant the runtime wrote at the write boundary, and never from anything a
+ * caller states about when it started waiting.
+ */
+export declare function abandonedAfterMs(waitMs: number, graceMs: number): number;

package/dist/src/core/head-retry.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The bounded head-moved retry, in one place (APRV-150, APRV-236).
+ *
+ * ## The fact this module is about
+ *
+ * `core/log.ts` takes a compare-and-append precondition: a writer states the
+ * `(seq, hash)` its checks were made against, and the append is refused under
+ * the lock when the tail is something else. That refusal is `append-failed`
+ * with `append.code === "head-moved"`, and it is correct: every read-dependent
+ * check that authorized the write is stale.
+ *
+ * Stale is not the same as wrong. A moved head says the verdict must be
+ * computed again; it does not say what the verdict is. Treating the two as the
+ * same is what turned a busy log into a lottery, twice:
+ *
+ *  - 2026-08-29 (APRV-150): a session's first `git status` — class `read.shell`,
+ *    autonomous, no human anywhere near it — was denied by the Claude Code hook
+ *    because an unrelated record landed a few milliseconds earlier.
+ *  - 2026-09-02 (APRV-236): `approval grant` refused a human's decision with
+ *    `head moved: expected seq 14218, found 14219` while two lanes and the
+ *    daemon were appending. The human ran it again. Twice more.
+ *
+ * The second one is the worse of the two, because the caller it handed the
+ * retry to was a person. A compare-and-append refusal is a fact about timing
+ * rather than about authority, and asking a human to retype is the wrong party
+ * to hand it to.
+ *
+ * ## What a retry is here, and what it is not
+ *
+ * The unit of retry is the WHOLE read-check-append cycle: a new read of the
+ * verified log, a new read of the policy, a fresh attestation, a fresh
+ * derivation of the request's state, fresh escalation, single-use, intake and
+ * budget checks, and a new append against the head that the new read observed.
+ * Nothing crosses an attempt except the caller's own inputs.
+ *
+ * The append is never retried on its own. That distinction is the whole safety
+ * argument, and it is worth stating as three properties:
+ *
+ *  - **compare-and-append is untouched.** Every attempt supplies the head it
+ *    read, and a stale write is still refused under the lock. SPEC.md §11.1
+ *    invariant 5 holds per attempt, which is where it has to hold.
+ *  - **A changed verdict is the new verdict.** If the record that moved the head
+ *    decided the request, spent the key, exhausted the budget, lapsed the TTL or
+ *    re-attested a different policy, the next attempt derives that and refuses
+ *    it with the code those fresh facts produce — `already-decided`,
+ *    `request-withdrawn`, `already-executed`, `budget-exceeded`, `expired`,
+ *    `policy-drift` — never `append-failed`. A retry cannot launder a denial
+ *    into an allow, because it never replays the earlier conclusion.
+ *  - **Only `head-moved` retries.** Every other refusal, a real verdict included,
+ *    is returned on the first attempt. So is a lock timeout, a corrupt log and a
+ *    schema refusal at the write boundary: retrying those would be either
+ *    pointless or a second write.
+ *
+ * The bound is what keeps a busy log from turning one call into an unbounded
+ * write loop. When it is spent the last `head-moved` refusal is returned with
+ * its code and its `append` error unchanged, and with the attempt count added to
+ * its message so a reader can tell one lost race from a log under sustained
+ * contention. The caller fails closed on it exactly as it always did.
+ */
+import type { AppendError } from "./log.js";
+/**
+ * How many times a gate writer re-derives its verdict against a moved head
+ * before it gives up. Small, fixed, and not configurable upward.
+ *
+ * APRV-150 chose three for the hook's writers; APRV-236 gives the same three to
+ * every other writer a human or a session drives, rather than inventing a
+ * second number for the same fact.
+ */
+export declare const HEAD_MOVED_ATTEMPTS = 3;
+/**
+ * The shape this module needs of a writer's result: an `ok` discriminator, and
+ * on the refusal side a code and the append error beneath it.
+ *
+ * Deliberately structural. `GateRefusal`, `ExecuteRefusal`, `TokenRefusal` and
+ * `GateWindowRefusal` are four frozen unions in four modules that must not
+ * learn about each other; what they share is this, and this is all the helper
+ * reads.
+ */
+export interface HeadRetryable {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    append?: AppendError;
+}
+/** Did this refusal come from the compare-and-append precondition alone? */
+export declare function isHeadMoved(result: HeadRetryable): boolean;
+/**
+ * The attempt budget for one operation: `ceiling` unless the caller asked for
+ * fewer.
+ *
+ * Clamped rather than trusted, and clamped in the one direction that matters: a
+ * caller may ask for LESS tolerance of a moved head (a test pinning the
+ * unretried behaviour, a caller that would rather fail fast), never for more.
+ * Ambiguity — a non-integer, a zero, a negative — resolves to the value the
+ * runtime chose, not the caller's.
+ */
+export declare function attemptsOf(asked: number | undefined, ceiling?: number): number;
+/**
+ * Run one whole read-check-append cycle, and run it again from the top while it
+ * loses the race, up to `attempts` times.
+ *
+ * `cycle` MUST be the entire operation: it re-reads, re-runs every check on the
+ * head it just read, and returns either the append it attempted or the refusal
+ * those fresh facts produced. A `cycle` that closes over a stale read would
+ * defeat the only property that makes this safe.
+ */
+export declare function withHeadRetry<T extends HeadRetryable>(attempts: number, cycle: () => T): T;

package/dist/src/core/instance.d.ts

@@ -0,0 +1,310 @@
+/**
+ * Which gate instance this process is talking about (APRV-178).
+ *
+ * Everything else in this runtime is directory-scoped already: the policy is
+ * the `APPROVAL.md` beside the working directory, the log is that directory's
+ * `.approval/log/events.jsonl`, the vault and `.approval/env` sit next to it.
+ * Two checkouts on one machine are two gates, and nothing they hold is shared.
+ *
+ * The OS keystore was the exception, and it cost a live incident: the item
+ * names were three fixed strings, so a demo instance provisioned in another
+ * directory stored its bot token over the production instance's item and then
+ * read the production token back. Both gates then long-polled ONE bot, the
+ * `getUpdates` offsets fought, and a human's approval tap was consumed by the
+ * listener that had not asked for it. A keystore is machine-global; the names
+ * put into it have to carry the scoping the filesystem gave everything else.
+ *
+ * ## What the identity is
+ *
+ * The absolute path of the instance's `.approval` directory, hashed. Not the
+ * repository root (a gate may be configured with `--log` somewhere else), not
+ * a random id written into a file (a file the operator can copy is an identity
+ * that travels, which is the bug), and not the log path itself (a `--log` that
+ * names the same instance's log by a different but equivalent spelling should
+ * not mint a second identity, and `envFilePathFor` already normalises the two
+ * spellings this runtime supports).
+ *
+ * Symlinks are deliberately NOT resolved. `realpathSync` would touch the
+ * filesystem, so the identity of an instance would depend on whether its
+ * directory currently exists — and `approval setup` must be able to name the
+ * item it is about to create before anything is on disk. Two paths that reach
+ * one directory by different routes are therefore two identities; that is the
+ * safe direction of the error (two names, no sharing) rather than the unsafe
+ * one.
+ *
+ * ## What the names look like
+ *
+ * ```
+ * approval-tg-token-3f2a9c11
+ * approval-vault-passphrase-3f2a9c11
+ * approval-sampling-secret-3f2a9c11
+ * ```
+ *
+ * Eight hex digits: long enough that two instances on one machine will not
+ * collide by accident, short enough that an operator reading
+ * `keychain:approval-tg-token-3f2a9c11` in `.approval/env` and the same suffix
+ * in `approval doctor` can compare them at a glance. The suffix is not a
+ * secret and is not derived from one — it is a hash of a directory path, which
+ * `.approval/env` already carries in the open.
+ */
+import { type ResolvedVariable, type SourceRunner } from "./env-file.js";
+import type { PolicyLoadResult } from "./policy-load.js";
+/**
+ * The unscoped item names this project used before APRV-178.
+ *
+ * Kept, and kept named, for two reasons: an instance provisioned before the
+ * change still has its token under one of them, and the migration path is to
+ * READ them as a fallback and say so out loud, never to silently adopt them.
+ */
+export declare const LEGACY_SERVICE_TELEGRAM_TOKEN = "approval-tg-token";
+export declare const LEGACY_SERVICE_VAULT_PASSPHRASE = "approval-vault-passphrase";
+export declare const LEGACY_SERVICE_SAMPLING_SECRET = "approval-sampling-secret";
+/**
+ * The sender key (APRV-370). Born scoped, so it has no legacy instance to be a
+ * fallback for; it sits in this list because the naming rule is the list's, and
+ * a name minted outside it is a name `approval env --check` reports as unknown.
+ */
+export declare const SERVICE_SENDER_KEY = "approval-sender-key";
+/** Every unscoped name, for the "is this the legacy one?" test. */
+export declare const LEGACY_SERVICES: readonly string[];
+/** How many hex digits of the digest a scoped name carries. */
+export declare const INSTANCE_ID_LENGTH = 8;
+/**
+ * The `.approval` directory this log path belongs to, absolute as given.
+ *
+ * `envFilePathFor` already answers "which instance is this log in", by walking
+ * up out of `log/` when it is there; the env file's own directory IS the
+ * instance home, so this is that answer with the filename removed rather than
+ * a second rule that could disagree with it.
+ */
+export declare function instanceHomeFor(logPath: string): string;
+/** The instance's short identity: {@link INSTANCE_ID_LENGTH} hex digits. */
+export declare function instanceIdFor(logPath: string): string;
+/** The keystore item name `base` takes in the instance owning `logPath`. */
+export declare function scopedService(base: string, logPath: string): string;
+/**
+ * How a service name relates to the instance owning `logPath`.
+ *
+ * Answered from the NAME alone, with no keystore lookup: `approval doctor`
+ * reports on this and a diagnostic may not pop a keychain-unlock prompt (see
+ * `cli/doctor.ts`'s `NON_RESOLVING_RUNNER`). The name is enough, because the
+ * name is what decides which item a lookup would find.
+ *
+ * - `mine` — the scoped name this instance writes.
+ * - `legacy` — one of the unscoped pre-APRV-178 names, which every instance on
+ *   the machine resolves to the same item.
+ * - `other-instance` — a scoped name whose suffix is some other instance's.
+ * - `unknown` — a name this runtime never wrote; the operator chose it, and
+ *   nothing here can say whose it is.
+ */
+export type ServiceScope = "mine" | "legacy" | "other-instance" | "unknown";
+export declare function scopeOfService(service: string, logPath: string): ServiceScope;
+/**
+ * The variable `approval env`'s export block uses to say what it exported.
+ *
+ * ## The bug this exists to close
+ *
+ * The bleed rule below reads no values, on purpose: it runs inside `approval
+ * doctor` and `approval up`, neither of which may pop a keystore-unlock dialog
+ * to produce a diagnostic (`NON_RESOLVING_RUNNER`). So it saw "this variable is
+ * exported, and the file has a line for it" and reported that the value in use
+ * was not the one the instance configured. It could not know that. The
+ * documented start ritual is
+ *
+ * ```sh
+ * eval "$(approval env)"
+ * ```
+ *
+ * which exports THIS instance's own values from THIS instance's own file, and
+ * leaves behind exactly the state the rule was calling an incident: exported,
+ * with a file line naming a source. Observed on 2026-09-06 in the primary,
+ * where `unset APPROVAL_SAMPLING_SECRET && eval "$(approval env)" && approval
+ * up` printed the finding for the variable the eval had just resolved from the
+ * gate's own keychain item. A check that asserts a fact it never tested is
+ * worse than no check: it teaches the operator to skip the line.
+ *
+ * ## What is exported, and why it is value-free
+ *
+ * ```
+ * APPROVAL_ENV_PROVENANCE=1:3f2a9c11:<64 hex>:APPROVAL_TG_TOKEN,APPROVAL_TG_CHAT
+ *                         │ │        │        └ the NAMES it exported from the file
+ *                         │ │        └ sha256 of the env file bytes it read
+ *                         │ └ the instance whose file that was
+ *                         └ the format version
+ * ```
+ *
+ * Four colon-separated fields; the names are shell variable names, which cannot
+ * contain a colon or a comma, so the shape needs no escaping. Every field is a
+ * NAME, an id or a digest: the same three kinds of thing `.approval/env` already
+ * carries in the open, and none of them is a value. The rule stays as value-free
+ * after this change as it was before it, which is the point — a check that had
+ * to read the secret to decide whether to complain about the secret would be a
+ * worse trade than the false positive.
+ *
+ * ## What it does NOT weaken
+ *
+ * Invariant 7 (no verb loads `.approval/env` implicitly) is untouched: this
+ * variable reaches a shell only when a human evaluates `approval env`'s output,
+ * exactly like every other line in that block, and no verb gains the ability to
+ * read the file for its values. And it cannot launder a foreign export, because
+ * `approval env` lists only the names it resolved FROM THE FILE. A value that
+ * was already in the environment is re-exported by that block for fidelity, and
+ * deliberately left out of this list, so a bled variable stays reported however
+ * many times the ritual is run over it.
+ *
+ * Trusting the variable is safe in the only direction that matters. Anything
+ * able to set it in this process's environment could already set the credential
+ * variables themselves, so it buys an attacker nothing; and being wrong here
+ * silences a WARNING rather than opening a gate. The reverse default — believing
+ * the exported value is foreign — is the bug being fixed.
+ */
+export declare const ENV_PROVENANCE_VAR = "APPROVAL_ENV_PROVENANCE";
+/** The only format version this build writes, and the only one it reads. */
+export declare const ENV_PROVENANCE_VERSION = "1";
+/** What one `approval env` export block claims about itself. */
+export interface EnvProvenance {
+    /** The instance whose env file it resolved from. */
+    instanceId: string;
+    /** `envFileDigest` of the bytes it resolved from (`core/env-file.ts`). */
+    digest: string;
+    /** The names it exported FROM that file. Never the ones it passed through. */
+    names: ReadonlySet<string>;
+}
+/**
+ * The value for {@link ENV_PROVENANCE_VAR}, for an export block that resolved
+ * `names` out of the file `digest` identifies.
+ */
+export declare function formatEnvProvenance(logPath: string, digest: string, names: readonly string[]): string;
+/**
+ * Read the claim back, or `null` for anything this build does not recognise.
+ *
+ * Strict on every field, and `null` rather than a partial answer: a malformed
+ * claim is an unverified one, an unverified one earns no credit, and no credit
+ * means the finding is still reported. That is the fail-closed direction (the
+ * check stays loud) for a value whose whole job is to make the check quieter.
+ */
+export declare function parseEnvProvenance(raw: string | undefined): EnvProvenance | null;
+/**
+ * One way this instance's credentials can belong to somebody else.
+ *
+ * - `foreign-instance` — `.approval/env` names a keystore item whose scope
+ *   suffix is another instance's. Two gates then hold one credential, which is
+ *   the incident: one bot, two long pollers, and a human's tap consumed by the
+ *   listener that did not ask the question. This is WRONG, not a state.
+ * - `legacy-shared` — the file names one of the unscoped pre-APRV-178 items.
+ *   Correct on a machine with one gate and a trap on a machine with two, so it
+ *   is reported and not failed: it is what every existing installation looks
+ *   like, and the repair is one re-run of `approval setup channel telegram`.
+ * - `ambient-bleed` — the value was exported before this process started, the
+ *   file names a source of its own, and the export is NOT one this instance's
+ *   `approval env` made (see {@link ENV_PROVENANCE_VAR}). The shell wins on
+ *   purpose (invariant 7); what was missing is anyone saying so. This is the
+ *   half of the incident that survived fixing the file: the operator's rc
+ *   exported the production token, so every fresh terminal kept using the
+ *   production bot.
+ * - `stale-export` — the value in this shell is NOT what this instance's file
+ *   resolves to today (APRV-390). The name-only rules above cannot see this at
+ *   all, and it is the case that actually cost an evening: a token re-stored in
+ *   the keychain does not reach a shell that exported the old one, because
+ *   `approval env` never overrides a variable that is already set. The daemon
+ *   then answered 401 while the keychain item behind the same line passed
+ *   `getMe` by hand. Only {@link valueFindings} produces it, because only that
+ *   function is allowed to read a value.
+ */
+export type InstanceFindingKind = "foreign-instance" | "legacy-shared" | "ambient-bleed" | "stale-export";
+export interface InstanceFinding {
+    kind: InstanceFindingKind;
+    /** The environment variable the finding is about. */
+    variable: string;
+    /** The item name, for the two name-shaped findings. */
+    service?: string;
+    /** One sentence, and never a value. */
+    detail: string;
+}
+/**
+ * What is wrong with WHOSE credentials this instance is using (APRV-178).
+ *
+ * Answered from names alone. No keystore is consulted ({@link
+ * NON_RESOLVING_RUNNER}), so this may be called from `approval doctor` and from
+ * `approval up`'s start-up without either of them blocking on an unlock dialog.
+ * No value is read, compared or printed on any path: the inputs are a service
+ * name, a scheme, a variable name, and (since APRV-278) an instance id, a file
+ * digest and a list of variable names out of {@link ENV_PROVENANCE_VAR} — all of
+ * which `.approval/env` and `approval env --check` carry in the open. The
+ * exported VALUES this reports on are still never read, compared or printed.
+ *
+ * A file this runtime cannot read at all produces no findings rather than a
+ * guess; `approval env --check` and doctor's `environment` row are what report
+ * an unreadable or wrong-moded file, and saying it twice in different words is
+ * how two commands come to disagree.
+ */
+export declare function instanceFindings(logPath: string, load: PolicyLoadResult, ambientEnv?: NodeJS.ProcessEnv): InstanceFinding[];
+/**
+ * What the rule may consult beyond the names (APRV-278).
+ *
+ * Both fields are optional and an absent one only ever makes the report LOUDER:
+ * a caller that supplies neither gets the pre-APRV-278 behaviour, where every
+ * exported variable with a file line is reported.
+ */
+export interface FindingsContext {
+    /** The environment the report is about. Read for {@link ENV_PROVENANCE_VAR}. */
+    ambientEnv?: NodeJS.ProcessEnv;
+    /** `envFileDigest` of this instance's env file as it now reads. */
+    envFileDigest?: string;
+}
+/**
+ * The exported names this instance's OWN current `approval env` vouches for
+ * (APRV-278).
+ *
+ * Empty unless {@link ENV_PROVENANCE_VAR} parses, names this instance, and
+ * matches the env file as it now reads. `approval env --check` and the finding
+ * rule below both answer "is this export the documented ritual's?" from this one
+ * function, because two spellings of that question are two chances for `approval
+ * env --check` and `approval up` to say different things about one shell.
+ */
+export declare function ownEnvExports(logPath: string, context?: FindingsContext): ReadonlySet<string>;
+/**
+ * The same question, answered by COMPARING VALUES (APRV-390).
+ *
+ * ## Why a second function, and why only start-up may call it
+ *
+ * Everything above answers from names, so that a diagnostic never blocks on a
+ * keystore-unlock dialog ({@link NON_RESOLVING_RUNNER}). That constraint is
+ * right for `approval doctor` and wrong for the thing `approval up` is about to
+ * do, which is USE the value. Two cases observed on 2026-09-19 are invisible to
+ * every name-only rule:
+ *
+ * 1. **A stale export.** `approval env` never overrides a variable already set
+ *    in the shell — that is invariant 7 working as designed — so a token
+ *    re-stored in the keychain never reaches a terminal that exported the old
+ *    one. The names agree, the file is this instance's, the provenance claim is
+ *    this instance's own, and the value is wrong. The daemon got 401 from a
+ *    token that passed `getMe` when read from the keychain by hand.
+ * 2. **A false positive on the correct ritual.** `APPROVAL_HUMAN` was reported
+ *    cross-instance when the export came from this instance's own `eval
+ *    "$(approval env)"` seconds earlier, because the provenance claim did not
+ *    match. A finding about a value that IS the file's value is noise, and
+ *    noise in a refusal is how a refusal gets overridden by habit.
+ *
+ * Comparing answers both: a value equal to what the file resolves to is
+ * correct however it got there, and a value that differs is wrong however
+ * honest its provenance looks.
+ *
+ * ## What it does with the values
+ *
+ * It compares them and drops them. Nothing is printed, returned, logged or put
+ * in a message on any path — every finding this produces carries a variable
+ * name, a file path and a line number, exactly like the name-only ones. The
+ * only new capability is answering "same or different".
+ *
+ * ## Where it fails soft, and in which direction
+ *
+ * A file entry that cannot be resolved (a locked keychain, a helper that is not
+ * installed, a `secret-tool` with no D-Bus) yields no comparison, and the
+ * name-only finding for that variable stands unchanged. That is the safe
+ * direction: an unverifiable value keeps whatever scrutiny it already had, and
+ * a caller that cannot resolve anything gets exactly the pre-APRV-390 report.
+ */
+export declare function valueFindings(logPath: string, load: PolicyLoadResult, runner: SourceRunner, ambientEnv?: NodeJS.ProcessEnv): InstanceFinding[];
+/** The name-only rules, over an already-resolved variable set. */
+export declare function findingsFor(logPath: string, variables: readonly ResolvedVariable[], context?: FindingsContext): InstanceFinding[];

package/dist/src/core/instance.js

@@ -60,11 +60,18 @@ import { NON_RESOLVING_RUNNER, envFilePathFor, resolveEnvironment, } from "./env
 export const LEGACY_SERVICE_TELEGRAM_TOKEN = "approval-tg-token";
 export const LEGACY_SERVICE_VAULT_PASSPHRASE = "approval-vault-passphrase";
 export const LEGACY_SERVICE_SAMPLING_SECRET = "approval-sampling-secret";
+/**
+ * The sender key (APRV-370). Born scoped, so it has no legacy instance to be a
+ * fallback for; it sits in this list because the naming rule is the list's, and
+ * a name minted outside it is a name `approval env --check` reports as unknown.
+ */
+export const SERVICE_SENDER_KEY = "approval-sender-key";
 /** Every unscoped name, for the "is this the legacy one?" test. */
 export const LEGACY_SERVICES = [
     LEGACY_SERVICE_TELEGRAM_TOKEN,
     LEGACY_SERVICE_VAULT_PASSPHRASE,
     LEGACY_SERVICE_SAMPLING_SECRET,
+    SERVICE_SENDER_KEY,
 ];
 /** How many hex digits of the digest a scoped name carries. */
 export const INSTANCE_ID_LENGTH = 8;
@@ -265,6 +272,112 @@ export function ownEnvExports(logPath, context = {}) {
     const view = provenanceView(logPath, context);
     return view.claimsThisFile ? view.names : new Set();
 }
+/**
+ * The same question, answered by COMPARING VALUES (APRV-390).
+ *
+ * ## Why a second function, and why only start-up may call it
+ *
+ * Everything above answers from names, so that a diagnostic never blocks on a
+ * keystore-unlock dialog ({@link NON_RESOLVING_RUNNER}). That constraint is
+ * right for `approval doctor` and wrong for the thing `approval up` is about to
+ * do, which is USE the value. Two cases observed on 2026-09-19 are invisible to
+ * every name-only rule:
+ *
+ * 1. **A stale export.** `approval env` never overrides a variable already set
+ *    in the shell — that is invariant 7 working as designed — so a token
+ *    re-stored in the keychain never reaches a terminal that exported the old
+ *    one. The names agree, the file is this instance's, the provenance claim is
+ *    this instance's own, and the value is wrong. The daemon got 401 from a
+ *    token that passed `getMe` when read from the keychain by hand.
+ * 2. **A false positive on the correct ritual.** `APPROVAL_HUMAN` was reported
+ *    cross-instance when the export came from this instance's own `eval
+ *    "$(approval env)"` seconds earlier, because the provenance claim did not
+ *    match. A finding about a value that IS the file's value is noise, and
+ *    noise in a refusal is how a refusal gets overridden by habit.
+ *
+ * Comparing answers both: a value equal to what the file resolves to is
+ * correct however it got there, and a value that differs is wrong however
+ * honest its provenance looks.
+ *
+ * ## What it does with the values
+ *
+ * It compares them and drops them. Nothing is printed, returned, logged or put
+ * in a message on any path — every finding this produces carries a variable
+ * name, a file path and a line number, exactly like the name-only ones. The
+ * only new capability is answering "same or different".
+ *
+ * ## Where it fails soft, and in which direction
+ *
+ * A file entry that cannot be resolved (a locked keychain, a helper that is not
+ * installed, a `secret-tool` with no D-Bus) yields no comparison, and the
+ * name-only finding for that variable stands unchanged. That is the safe
+ * direction: an unverifiable value keeps whatever scrutiny it already had, and
+ * a caller that cannot resolve anything gets exactly the pre-APRV-390 report.
+ */
+export function valueFindings(logPath, load, runner, ambientEnv = process.env) {
+    const envPath = envFilePathFor(logPath);
+    const named = instanceFindings(logPath, load, ambientEnv);
+    // EVERY variable whose value came from the shell and whose file has a line
+    // for it — not only the ones the name-only rule complained about.
+    //
+    // This is the correction that matters, and the reason the set is not taken
+    // from `named`. The provenance claim (APRV-278) vouches for an export by
+    // naming this instance, this file's DIGEST and this variable, and all three
+    // stay true when the file is untouched and the KEYSTORE ITEM behind one of
+    // its lines is re-stored. The claim is honest and the value is stale, so the
+    // vouched variables are exactly the ones this check must still look at.
+    const nameOnly = resolveEnvironment(load, envPath, NON_RESOLVING_RUNNER, ambientEnv);
+    if (!nameOnly.ok)
+        return named;
+    const ambientNames = new Set(nameOnly.variables
+        .filter((variable) => variable.status === "set-in-environment" && variable.fileSource !== undefined)
+        .map((variable) => variable.name));
+    if (ambientNames.size === 0)
+        return named;
+    // Resolve the FILE, by hiding exactly those names from the resolution: the
+    // ambient environment wins otherwise, and the answer would be the value we
+    // are trying to check. Nothing here is exported — this process's own
+    // environment is untouched, so invariant 7 is as true after this call as
+    // before it. The file cannot SET anything; it can only fail to match.
+    const hidden = { ...ambientEnv };
+    for (const name of ambientNames)
+        delete hidden[name];
+    const fromFile = resolveEnvironment(load, envPath, runner, hidden);
+    if (!fromFile.ok)
+        return named;
+    const fileValues = new Map();
+    for (const variable of fromFile.variables) {
+        if (variable.value !== undefined && variable.status !== "set-in-environment") {
+            fileValues.set(variable.name, variable.value);
+        }
+    }
+    // Everything the name-only rule found that is NOT about an ambient value: a
+    // foreign item name and a legacy shared one are facts about names, and no
+    // comparison of values can make either of them go away.
+    const findings = named.filter((finding) => finding.kind !== "ambient-bleed");
+    for (const name of ambientNames) {
+        const fileValue = fileValues.get(name);
+        const ambientValue = ambientEnv[name];
+        // Unresolvable (a locked keychain, a missing helper, a missing item): no
+        // comparison was made, so whatever the name-only rule said still stands.
+        if (fileValue === undefined) {
+            const bleed = named.find((finding) => finding.kind === "ambient-bleed" && finding.variable === name);
+            if (bleed !== undefined)
+                findings.push(bleed);
+            continue;
+        }
+        // The shell holds exactly what the file configures. Correct, however it got
+        // there, and whatever the provenance claim did or did not say.
+        if (ambientValue === fileValue)
+            continue;
+        findings.push({
+            kind: "stale-export",
+            variable: name,
+            detail: `${name} is exported in this shell with a value that is NOT what ${envPath} resolves to today, and an export always wins over the file, so this process would use the stale one`,
+        });
+    }
+    return findings;
+}
 /** The name-only rules, over an already-resolved variable set. */
 export function findingsFor(logPath, variables, context = {}) {
     const home = instanceHomeFor(logPath);

package/dist/src/core/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/core/instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,kBAAkB,GAEnB,MAAM,eAAe,CAAC;AAGvB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,2BAA2B,CAAC;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AAEzE,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,6BAA6B;IAC7B,+BAA+B;IAC/B,8BAA8B;CAC/B,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,wEAAwE;AACxE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,cAAc,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SACxC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAClC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,OAAO,GAAG,IAAI,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7C,CAAC;AAmBD,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAe;IAC7D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC1C,OAAO,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,MAAM,sBAAsB,GAAG,IAAI,MAAM,CAAC,aAAa,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAYpD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAAc,EACd,KAAwB;IAExB,OAAO,CAAC,sBAAsB,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAA0C,CAAC;IACzF,IAAI,OAAO,KAAK,sBAAsB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAqCD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,IAAsB,EACtB,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,IAAI,EACJ,cAAc,CAAC,OAAO,CAAC,EACvB,oBAAoB,EACpB,UAAU,CACX,CAAC;IACF,OAAO,QAAQ,CAAC,EAAE;QAChB,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE;YACvC,UAAU;YACV,sEAAsE;YACtE,oEAAoE;YACpE,gEAAgE;YAChE,aAAa,EAAE,QAAQ,CAAC,MAAM;SAC/B,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AA0BD,SAAS,cAAc,CAAC,OAAe,EAAE,OAAwB;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC;IACvE,OAAO;QACL,kBAAkB;QAClB,4EAA4E;QAC5E,kEAAkE;QAClE,cAAc,EACZ,kBAAkB;YAClB,OAAO,CAAC,aAAa,KAAK,SAAS;YACnC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;AAC9D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAsC,EACtC,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QAEnC,IAAI,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,cAAc,IAAI,OAAO;gBAAE,SAAS;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,MAAM,EACJ,kBAAkB,IAAI,OAAO;oBAC3B,CAAC,CAAC,+DAA+D;wBAC/D,gEAAgE;wBAChE,gEAAgE;wBAChE,GAAG,QAAQ,CAAC,IAAI,yEAAyE,IAAI,wCAAwC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC;oBAC9L,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,0GAA0G,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,+BAA+B;aAC9L,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO;gBACP,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,UAAU,OAAO,gDAAgD,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,4DAA4D;aACrL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO;gBACP,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,UAAU,OAAO,gFAAgF;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../../src/core/instance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,kBAAkB,GAGnB,MAAM,eAAe,CAAC;AAGvB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAAmB,CAAC;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG,2BAA2B,CAAC;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AACzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAExD,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,6BAA6B;IAC7B,+BAA+B;IAC/B,8BAA8B;IAC9B,kBAAkB;CACnB,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,wEAAwE;AACxE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,cAAc,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAEpF;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;SACxC,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAClC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,OAAO,GAAG,IAAI,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7C,CAAC;AAmBD,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAe;IAC7D,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QACtC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC1C,OAAO,MAAM,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,MAAM,sBAAsB,GAAG,IAAI,MAAM,CAAC,aAAa,MAAM,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAYpD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAe,EACf,MAAc,EACd,KAAwB;IAExB,OAAO,CAAC,sBAAsB,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,MAA0C,CAAC;IACzF,IAAI,OAAO,KAAK,sBAAsB;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAiDD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,IAAsB,EACtB,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,MAAM,QAAQ,GAAG,kBAAkB,CACjC,IAAI,EACJ,cAAc,CAAC,OAAO,CAAC,EACvB,oBAAoB,EACpB,UAAU,CACX,CAAC;IACF,OAAO,QAAQ,CAAC,EAAE;QAChB,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE;YACvC,UAAU;YACV,sEAAsE;YACtE,oEAAoE;YACpE,gEAAgE;YAChE,aAAa,EAAE,QAAQ,CAAC,MAAM;SAC/B,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AA0BD,SAAS,cAAc,CAAC,OAAe,EAAE,OAAwB;IAC/D,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,UAAU,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC;IACvE,OAAO;QACL,kBAAkB;QAClB,4EAA4E;QAC5E,kEAAkE;QAClE,cAAc,EACZ,kBAAkB;YAClB,OAAO,CAAC,aAAa,KAAK,SAAS;YACnC,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,aAAa;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,IAAsB,EACtB,MAAoB,EACpB,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,kEAAkE;IAClE,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC;IACrF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,QAAQ,CAAC,SAAS;SACf,MAAM,CACL,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,oBAAoB,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAC5F;SACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACpC,CAAC;IACF,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,MAAM,GAAsB,EAAE,GAAG,UAAU,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAC7E,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,QAAQ,GAAsB,KAAK,CAAC,MAAM,CAC9C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,CAC9C,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtC,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CACtB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAC3E,CAAC;YACF,IAAI,KAAK,KAAK,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9C,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,YAAY,KAAK,SAAS;YAAE,SAAS;QAEzC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,IAAI,4DAA4D,OAAO,sGAAsG;SACzL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,SAAsC,EACtC,OAAO,GAAoB,EAAE;IAE7B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QAEnC,IAAI,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,cAAc,IAAI,OAAO;gBAAE,SAAS;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,MAAM,EACJ,kBAAkB,IAAI,OAAO;oBAC3B,CAAC,CAAC,+DAA+D;wBAC/D,gEAAgE;wBAChE,gEAAgE;wBAChE,GAAG,QAAQ,CAAC,IAAI,yEAAyE,IAAI,wCAAwC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC;oBAC9L,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,0GAA0G,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,+BAA+B;aAC9L,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO;gBACP,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,UAAU,OAAO,gDAAgD,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,4DAA4D;aACrL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO;gBACP,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,UAAU,OAAO,gFAAgF;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}