approval-md 0.2.0 → 0.3.0

package/dist/src/codex/workspace-commit.js

@@ -0,0 +1,549 @@
+/**
+ * The durable half of the Codex workspace broker (APRV-325.2).
+ *
+ * `workspace-plan.ts` decides what a change IS; this module is the only place
+ * that makes one happen. It exists because POSIX gives no atomic multi-file
+ * rename: four `rename(2)` calls are four separate instants, and a crash
+ * between the second and the third leaves a workspace that is neither the state
+ * the human approved nor the state they started from.
+ *
+ * ## The three states, and the one this module refuses to invent
+ *
+ * A committed transaction is `after`. An untouched one is `before`. Anything
+ * else is `mixed`, and mixed is reported as mixed. The classification is made
+ * by READING the filesystem back against the journal's recorded digests, never
+ * from what the applying code believes it did: a `rename` that returned zero
+ * and a `rename` whose effect a crash lost look identical from inside the
+ * process that called it, and only the bytes on disk can tell them apart. That
+ * is why {@link inspectWorkspaceState} runs after a successful apply as well as
+ * after a failed one, and why a mixed result reaches the log as
+ * `execution.indeterminate` with reason `workspace-commit-unknown` rather than
+ * as a failure (SPEC.md §8's closed reason set, extended by this task).
+ *
+ * ## Ordering, and why the journal is written before anything moves
+ *
+ * 1. Stage every new byte and every preimage into a directory on the SAME
+ *    filesystem as the workspace, and `fsync` each file and then the directory.
+ *    Nothing in the workspace has changed yet, so a crash here is `before`.
+ * 2. Write the journal — the plan's payload hash, every endpoint, and the
+ *    before/after digest of each — and `fsync` it and its directory. This is
+ *    the instant after which a crash is RECOVERABLE rather than merely
+ *    undecidable: a journal on disk names what the workspace was and what it
+ *    was becoming, so a later reader can prove which of the two it is in.
+ * 3. Apply, in a fixed order, then `fsync` every touched parent directory.
+ * 4. Read the endpoints back. Only an all-`after` reading removes the journal
+ *    as a success; an all-`before` reading removes it as an untaken
+ *    transaction; a mixed reading LEAVES IT for a person.
+ *
+ * ## Custody is claimed only as far as the platform proves it
+ *
+ * {@link acquireWorkspaceCustody} takes an `O_CREAT | O_EXCL` lock, which
+ * excludes other cooperating brokers and nothing else, and then asks POSIX
+ * ownership and mode whether any other principal can write the endpoints it is
+ * about to touch. It reports `os-exclusive` only when both hold, `advisory`
+ * otherwise, and it always reports `acl-unproven`, because ownership and mode
+ * do not speak about ACLs (the same honesty `codex/trust.ts` already keeps). A
+ * caller that needs the strong answer asks for it and is refused when the host
+ * cannot give it; nothing here silently downgrades.
+ */
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, unlinkSync, writeSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { canonicalize } from "../core/jcs.js";
+export const WORKSPACE_COMMIT_VERSION = "approval.codex.workspace-commit.v1";
+/**
+ * The one directory name inside a workspace root that a proposal may never
+ * name (the broker refuses an endpoint under it before the planner ever reads
+ * a preimage). Staging has to share a filesystem with the workspace for
+ * `rename` to be atomic, so it lives inside it; reserving the name is what
+ * stops a proposal from staging over its own transaction.
+ */
+export const WORKSPACE_TXN_DIR = ".approval-codex-txn";
+/** The lockfile, beside the staging directory and under the same reservation. */
+export const WORKSPACE_LOCK_FILE = ".approval-codex-lock";
+const JOURNAL_FILE = "journal.json";
+function fsyncDir(path) {
+    let fd = null;
+    try {
+        fd = openSync(path, constants.O_RDONLY);
+        fsyncSync(fd);
+    }
+    catch {
+        // A filesystem that refuses to fsync a directory handle (some network and
+        // virtual filesystems do) is reported by the readback, not guessed at here.
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+function writeDurable(path, bytes) {
+    const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+    try {
+        let written = 0;
+        while (written < bytes.byteLength) {
+            written += writeSync(fd, bytes, written, bytes.byteLength - written);
+        }
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Is `path` writable by a principal other than this process's effective user,
+ * as far as POSIX ownership and mode can say?
+ *
+ * `null` means the question could not be asked (the path could not be stated),
+ * which is not the same as "no" and is never read as one.
+ */
+function foreignWritable(path) {
+    try {
+        const stats = statSync(path);
+        if ((stats.mode & 0o022) !== 0)
+            return true;
+        return stats.uid !== process.getuid?.();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Take the workspace lock and report how much exclusion it bought.
+ *
+ * The lock is `O_CREAT | O_EXCL` on a reserved name, which is the strongest
+ * primitive available to a process with no privilege: it excludes every other
+ * broker that respects it and no one else. Whether anything else CAN write is a
+ * separate question, asked of POSIX afterwards, and answered conservatively.
+ */
+export function acquireWorkspaceCustody(root, touchedDirectories) {
+    const lockPath = join(root, WORKSPACE_LOCK_FILE);
+    const txnDir = join(root, WORKSPACE_TXN_DIR);
+    let lockFd;
+    try {
+        lockFd = openSync(lockPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+    }
+    catch (cause) {
+        const code = cause.code;
+        if (code === "EEXIST") {
+            return {
+                ok: false,
+                code: "custody-contended",
+                message: `another workspace transaction holds ${lockPath}; no operation was attempted`,
+            };
+        }
+        return {
+            ok: false,
+            code: "custody-unavailable",
+            message: `workspace lock ${lockPath} could not be created: ${String(code ?? cause)}`,
+        };
+    }
+    try {
+        closeSync(lockFd);
+    }
+    catch {
+        // The lock is the file's existence, not the descriptor.
+    }
+    const findings = ["acl-unproven"];
+    let exclusive = true;
+    for (const directory of [root, ...touchedDirectories]) {
+        const foreign = foreignWritable(directory);
+        if (foreign === null) {
+            findings.push(`custody-unreadable:${directory}`);
+            exclusive = false;
+            continue;
+        }
+        if (foreign) {
+            findings.push(`foreign-writable:${directory}`);
+            exclusive = false;
+        }
+    }
+    try {
+        mkdirSync(txnDir, { mode: 0o700 });
+    }
+    catch (cause) {
+        try {
+            unlinkSync(lockPath);
+        }
+        catch {
+            // Best effort: the failure below is the one that matters.
+        }
+        return {
+            ok: false,
+            code: "custody-unavailable",
+            message: `staging directory ${txnDir} could not be created: ${String(cause.code ?? cause)}`,
+        };
+    }
+    fsyncDir(root);
+    return {
+        ok: true,
+        custody: {
+            report: { kind: exclusive ? "os-exclusive" : "advisory", findings },
+            root,
+            txnDir,
+            release: () => {
+                try {
+                    rmSync(txnDir, { recursive: true, force: true });
+                }
+                catch {
+                    // Leaving staging behind is visible to recovery and to a person.
+                }
+                try {
+                    unlinkSync(lockPath);
+                }
+                catch {
+                    // Same.
+                }
+                fsyncDir(root);
+            },
+        },
+    };
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+ * The endpoints one planned operation owns, in the shape recovery reads.
+ *
+ * A move owns two, and the second one's `before` is deliberately `null`: the
+ * planner refuses a move whose destination exists, so "absent" is the state the
+ * transaction started from and the state a rollback must restore.
+ */
+export function journalEndpointsOf(operation) {
+    switch (operation.kind) {
+        case "create":
+            return [{ path: operation.path, before_sha256: null, after_sha256: operation.after.sha256 }];
+        case "replace":
+            return [{
+                    path: operation.path,
+                    before_sha256: operation.before.sha256,
+                    after_sha256: operation.after.sha256,
+                }];
+        case "delete":
+            return [{ path: operation.path, before_sha256: operation.before.sha256, after_sha256: null }];
+        case "move":
+            return [
+                { path: operation.from, before_sha256: operation.before.sha256, after_sha256: null },
+                { path: operation.to, before_sha256: null, after_sha256: operation.before.sha256 },
+            ];
+    }
+}
+function newBytesOf(operation) {
+    if (operation.kind === "create" || operation.kind === "replace") {
+        return Buffer.from(operation.after.base64, "base64");
+    }
+    return null;
+}
+function preimageBytesOf(operation) {
+    if (operation.kind === "create")
+        return null;
+    return Buffer.from(operation.before.base64, "base64");
+}
+/** Every parent directory a transaction will write into, absolute and deduplicated. */
+export function touchedDirectories(plan) {
+    const seen = new Set();
+    for (const operation of plan.payload.operations) {
+        for (const endpoint of journalEndpointsOf(operation)) {
+            seen.add(dirname(resolve(plan.payload.root, endpoint.path)));
+        }
+    }
+    return [...seen].sort();
+}
+const MAX_READBACK_BYTES = 1_048_576;
+/**
+ * The digest of a regular single-link file, `null` when it is absent, and
+ * `undefined` when the question could not be answered.
+ *
+ * `O_NOFOLLOW` and the `nlink` test are the planner's rules, repeated here
+ * because a readback that followed a symlink planted between the apply and the
+ * inspection would report someone else's bytes as this transaction's outcome.
+ */
+function readbackDigest(path) {
+    let fd = null;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (cause) {
+        const code = cause.code;
+        if (code === "ENOENT")
+            return null;
+        return undefined;
+    }
+    try {
+        const stats = fstatSync(fd, { bigint: true });
+        if (!stats.isFile() || stats.nlink !== 1n)
+            return undefined;
+        if (stats.size > BigInt(MAX_READBACK_BYTES))
+            return undefined;
+        const buffer = Buffer.alloc(Number(stats.size));
+        let length = 0;
+        while (length < buffer.byteLength) {
+            const count = readSync(fd, buffer, length, buffer.byteLength - length, length);
+            if (count === 0)
+                break;
+            length += count;
+        }
+        if (length !== buffer.byteLength)
+            return undefined;
+        return sha256(buffer);
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function endpointState(root, endpoint) {
+    const digest = readbackDigest(resolve(root, endpoint.path));
+    if (digest === undefined)
+        return "unreadable";
+    const isAfter = digest === endpoint.after_sha256;
+    const isBefore = digest === endpoint.before_sha256;
+    // `before` wins a tie, and a tie is real: a replace whose new bytes equal its
+    // old bytes is both, and calling it `before` can only under-claim.
+    if (isBefore)
+        return "before";
+    if (isAfter)
+        return "after";
+    return "other";
+}
+/**
+ * Classify the workspace against a journal by reading it.
+ *
+ * `mixed` is the honest answer for anything that is not uniformly one state,
+ * INCLUDING a single unreadable endpoint: "I could not look" and "it is half
+ * done" are both "nobody knows", and collapsing the first into `before` would
+ * be the runtime deciding an effect did not happen.
+ */
+export function inspectWorkspaceState(journal) {
+    const endpoints = [];
+    for (const operation of journal.operations) {
+        for (const endpoint of operation.endpoints) {
+            endpoints.push({ path: endpoint.path, state: endpointState(journal.root, endpoint) });
+        }
+    }
+    const every = (state) => endpoints.every((entry) => entry.state === state);
+    if (endpoints.length > 0 && every("after"))
+        return { state: "after", endpoints };
+    if (endpoints.length === 0 || every("before"))
+        return { state: "before", endpoints };
+    return { state: "mixed", endpoints };
+}
+function journalPath(txnDir) {
+    return join(txnDir, JOURNAL_FILE);
+}
+/**
+ * Stage, journal, apply, read back.
+ *
+ * The caller holds custody (and therefore the staging directory) and keeps it
+ * until this returns. A `stage-failed` result is the one result that guarantees
+ * the workspace is untouched by construction rather than by inspection: nothing
+ * visible has been attempted when it fires.
+ */
+export function commitWorkspacePlan(plan, custody, options = {}) {
+    const { root, txnDir } = custody;
+    const operations = [];
+    // --- Phase 1: stage. Nothing in the workspace changes. ------------------
+    try {
+        for (let index = 0; index < plan.payload.operations.length; index += 1) {
+            const operation = plan.payload.operations[index];
+            const newBytes = newBytesOf(operation);
+            const preimage = preimageBytesOf(operation);
+            const staged = newBytes === null ? null : `new-${String(index)}`;
+            const saved = preimage === null ? null : `old-${String(index)}`;
+            if (staged !== null && newBytes !== null)
+                writeDurable(join(txnDir, staged), newBytes);
+            if (saved !== null && preimage !== null)
+                writeDurable(join(txnDir, saved), preimage);
+            operations.push({
+                index,
+                kind: operation.kind,
+                endpoints: journalEndpointsOf(operation),
+                staged,
+                preimage: saved,
+            });
+        }
+        fsyncDir(txnDir);
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            code: "stage-failed",
+            message: `workspace staging failed before any mutation: ${cause instanceof Error ? cause.message : String(cause)}`,
+        };
+    }
+    const journal = {
+        version: WORKSPACE_COMMIT_VERSION,
+        root,
+        payload_hash: plan.payload_hash,
+        custody: custody.report.kind,
+        operations,
+    };
+    // --- Phase 2: the journal, durable, before anything moves. --------------
+    try {
+        writeDurable(journalPath(txnDir), Buffer.from(canonicalize(journal), "utf8"));
+        fsyncDir(txnDir);
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            code: "stage-failed",
+            message: `workspace journal could not be made durable before any mutation: ${cause instanceof Error ? cause.message : String(cause)}`,
+        };
+    }
+    // --- Phase 3: apply. From here the answer comes from reading. -----------
+    let failure;
+    try {
+        options.onStep?.(0);
+        for (const entry of operations) {
+            const operation = plan.payload.operations[entry.index];
+            applyOne(root, txnDir, operation, entry);
+            options.onStep?.(entry.index + 1);
+        }
+    }
+    catch (cause) {
+        failure = cause instanceof Error ? cause.message : String(cause);
+    }
+    for (const directory of touchedDirectories(plan))
+        fsyncDir(directory);
+    // --- Phase 4: a failed apply tries to undo itself, and is then read. ----
+    if (failure !== undefined) {
+        try {
+            rollback(root, txnDir, operations);
+        }
+        catch (cause) {
+            failure = `${failure}; rollback also failed: ${cause instanceof Error ? cause.message : String(cause)}`;
+        }
+        for (const directory of touchedDirectories(plan))
+            fsyncDir(directory);
+    }
+    const inspection = inspectWorkspaceState(journal);
+    const retained = inspection.state === "mixed";
+    if (!retained) {
+        try {
+            unlinkSync(journalPath(txnDir));
+            fsyncDir(txnDir);
+        }
+        catch {
+            // Recovery reads a journal beside a settled workspace as settled.
+        }
+    }
+    return {
+        ok: true,
+        outcome: {
+            state: inspection.state,
+            inspection,
+            journal,
+            journalRetained: retained,
+            ...(failure === undefined ? {} : { failure }),
+        },
+    };
+}
+function applyOne(root, txnDir, operation, entry) {
+    switch (operation.kind) {
+        case "create":
+        case "replace":
+            renameSync(join(txnDir, entry.staged), resolve(root, operation.path));
+            return;
+        case "delete":
+            unlinkSync(resolve(root, operation.path));
+            return;
+        case "move":
+            renameSync(resolve(root, operation.from), resolve(root, operation.to));
+            return;
+    }
+}
+/**
+ * Put every endpoint back the way the journal says it was, from the staged
+ * preimages.
+ *
+ * Best effort by construction: it is attempted, and then the workspace is READ.
+ * A rollback that half worked produces `mixed` from the inspection, which is
+ * the same answer a rollback that was never attempted would produce, and that
+ * is deliberate — the classification must not depend on what this function
+ * thinks it achieved.
+ */
+function rollback(root, txnDir, operations) {
+    const problems = [];
+    for (let index = operations.length - 1; index >= 0; index -= 1) {
+        const entry = operations[index];
+        try {
+            for (let slot = 0; slot < entry.endpoints.length; slot += 1) {
+                const endpoint = entry.endpoints[slot];
+                const target = resolve(root, endpoint.path);
+                if (endpoint.before_sha256 === null) {
+                    try {
+                        unlinkSync(target);
+                    }
+                    catch (cause) {
+                        if (cause.code !== "ENOENT")
+                            throw cause;
+                    }
+                    continue;
+                }
+                if (readbackDigest(target) === endpoint.before_sha256)
+                    continue;
+                if (entry.preimage === null)
+                    continue;
+                const restored = join(txnDir, `restore-${String(index)}-${String(slot)}`);
+                writeDurable(restored, readFileSync(join(txnDir, entry.preimage)));
+                renameSync(restored, target);
+            }
+        }
+        catch (cause) {
+            problems.push(cause instanceof Error ? cause.message : String(cause));
+        }
+    }
+    if (problems.length > 0)
+        throw new Error(problems.join("; "));
+}
+/**
+ * Read a workspace's retained journal and say which of the three states it is
+ * in. It CHANGES NOTHING in the workspace.
+ *
+ * That is the whole contract, and the restraint is the point: a recovery that
+ * rolled a mixed workspace forward would be guessing which half of it the
+ * human approved, and a recovery that rolled one back would be deleting the
+ * half that already committed. Both are the runtime inventing a fact. A proven
+ * `before` or `after` needs no repair by definition, so there is nothing left
+ * for this function to do but say so and let the operator clear the staging
+ * directory.
+ */
+export function recoverWorkspaceCommit(root) {
+    const path = journalPath(join(root, WORKSPACE_TXN_DIR));
+    let raw;
+    try {
+        raw = readFileSync(path, "utf8");
+    }
+    catch (cause) {
+        if (cause.code === "ENOENT") {
+            return { ok: true, state: "none", message: `no workspace transaction journal at ${path}` };
+        }
+        return {
+            ok: false,
+            code: "journal-unreadable",
+            message: `workspace transaction journal ${path} could not be read: ${String(cause.code ?? cause)}`,
+        };
+    }
+    let journal;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null ||
+            parsed.version !== WORKSPACE_COMMIT_VERSION ||
+            !Array.isArray(parsed.operations)) {
+            return { ok: false, code: "journal-unreadable", message: `${path} is not a v1 workspace transaction journal` };
+        }
+        journal = parsed;
+    }
+    catch (cause) {
+        return {
+            ok: false,
+            code: "journal-unreadable",
+            message: `${path} is not parseable JSON: ${cause instanceof Error ? cause.message : String(cause)}`,
+        };
+    }
+    const inspection = inspectWorkspaceState(journal);
+    return { ok: true, state: inspection.state, inspection, journal };
+}
+//# sourceMappingURL=workspace-commit.js.map

package/dist/src/codex/workspace-commit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-commit.js","sourceRoot":"","sources":["../../../src/codex/workspace-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,MAAM,EACN,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAA6C,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAEvD,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,MAAM,YAAY,GAAG,cAAc,CAAC;AAkCpC,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,4EAA4E;IAC9E,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAiB;IACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAY,EACZ,kBAAqC;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC7C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,uCAAuC,QAAQ,8BAA8B;aACvF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,kBAAkB,QAAQ,0BAA0B,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE;SACrF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAa,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;YACjD,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;YAC/C,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,qBAAqB,MAAM,0BAA0B,MAAM,CAAE,KAA+B,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE;SACvH,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEf,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE;YACnE,IAAI;YACJ,MAAM;YACN,OAAO,EAAE,GAAG,EAAE;gBACZ,IAAI,CAAC;oBACH,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,iEAAiE;gBACnE,CAAC;gBACD,IAAI,CAAC;oBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ;gBACV,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAkCD,SAAS,MAAM,CAAC,KAAiB;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoC;IACrE,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,QAAQ;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,KAAK,SAAS;YACZ,OAAO,CAAC;oBACN,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;oBACtC,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM;iBACrC,CAAC,CAAC;QACL,KAAK,QAAQ;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,KAAK,MAAM;YACT,OAAO;gBACL,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE;gBACpF,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE;aACnF,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,SAAoC;IACtD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,SAAoC;IAC3D,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,IAAmB;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAChD,KAAK,MAAM,QAAQ,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAkBD,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAC5D,IAAI,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/E,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAyB;IAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,YAAY,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAC,aAAa,CAAC;IACnD,8EAA8E;IAC9E,mEAAmE;IACnE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACnE,MAAM,SAAS,GAA6C,EAAE,CAAC;IAC/D,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3C,KAAK,MAAM,QAAQ,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,KAAoB,EAAW,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACnG,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACjF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACrF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAiCD,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAmB,EACnB,OAAyB,EACzB,OAAO,GAAkB,EAAE;IAE3B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,2EAA2E;IAC3E,IAAI,CAAC;QACH,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAA8B,CAAC;YAC9E,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvF,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACrF,UAAU,CAAC,IAAI,CAAC;gBACd,KAAK;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,SAAS,EAAE,kBAAkB,CAAC,SAAS,CAAC;gBACxC,MAAM;gBACN,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACnH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,OAAO,EAAE,wBAAwB;QACjC,IAAI;QACJ,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;QAC5B,UAAU;KACX,CAAC;IAEF,2EAA2E;IAC3E,IAAI,CAAC;QACH,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,oEAAoE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACtI,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAA8B,CAAC;YACpF,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACzC,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEtE,2EAA2E;IAC3E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,GAAG,GAAG,OAAO,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1G,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,KAAK,OAAO,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC;YACH,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,UAAU;YACV,OAAO;YACP,eAAe,EAAE,QAAQ;YACzB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,IAAY,EACZ,MAAc,EACd,SAAoC,EACpC,KAAuB;IAEvB,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAgB,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAChF,OAAO;QACT,KAAK,QAAQ;YACX,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,OAAO;QACT,KAAK,MAAM;YACT,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,QAAQ,CACf,IAAY,EACZ,MAAc,EACd,UAAuC;IAEvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAqB,CAAC;QACpD,IAAI,CAAC;YACH,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAoB,CAAC;gBAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5C,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;oBACpC,IAAI,CAAC;wBACH,UAAU,CAAC,MAAM,CAAC,CAAC;oBACrB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,KAAK,CAAC;oBACtE,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,aAAa;oBAAE,SAAS;gBAChE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;oBAAE,SAAS;gBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1E,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACnE,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAWD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACxD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,IAAI,EAAE,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,iCAAiC,IAAI,uBAAuB,MAAM,CAAE,KAA+B,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE;SAC9H,CAAC;IACJ,CAAC;IACD,IAAI,OAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IACE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAC5C,MAAiC,CAAC,OAAO,KAAK,wBAAwB;YACvE,CAAC,KAAK,CAAC,OAAO,CAAE,MAAiC,CAAC,UAAU,CAAC,EAC7D,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,IAAI,4CAA4C,EAAE,CAAC;QACjH,CAAC;QACD,OAAO,GAAG,MAAgC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,GAAG,IAAI,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACpE,CAAC"}

package/dist/src/core/advance-cycle.d.ts

@@ -9,7 +9,9 @@
  * (`tests/layering.test.ts`). One home, so the three cannot disagree about
  * which records are an advance's own.
  */
+import { ADVANCE_DAEMON_CLASS } from "./command-class.js";
 import type { EventRecord } from "./log.js";
+import type { PolicyLoadResult } from "./policy-load.js";
 import { type RequestState } from "./state.js";
 /**
  * Who proposes an advance.
@@ -23,6 +25,55 @@ import { type RequestState } from "./state.js";
 export declare const ADVANCE_ACTOR = "agent:daemon";
 /** The class an advance is gated as. Declared, resolved, and never assumed. */
 export declare const ADVANCE_CLASS = "log.advance";
+export { ADVANCE_DAEMON_CLASS };
+/** Every class an advance cycle may be gated as, newest first. */
+export declare const ADVANCE_CLASSES: readonly string[];
+/** The refusal a non-daemon actor gets where the route would be autonomous. */
+export declare const ADVANCE_ACTOR_REFUSAL = "advance-actor-not-daemon";
+/** Which class this cycle asks under, or the refusal that stops it. */
+export type AdvanceRoute = {
+    ok: true;
+    cls: string;
+    daemon: boolean;
+} | {
+    ok: false;
+    code: typeof ADVANCE_ACTOR_REFUSAL;
+    message: string;
+};
+/**
+ * The class this advance asks under, decided by WHO is running it (APRV-382).
+ *
+ * Carter's 2026-09-19 question, answered as policy plus one check. An advance
+ * appends nothing and decides nothing: it publishes records the log already
+ * holds to a records branch, and the CI guard reads grants that exist whether
+ * or not an advance ran. So the DAEMON may make it unattended. Every other
+ * actor — a session in a worktree, a human terminal — stays where the class was
+ * declared at seq 513, because a lane that could publish the log could choose
+ * which records the world sees first.
+ *
+ * The policy grammar has no actor condition, so the rule is two classes and
+ * this function is the actor half of it. Three outcomes, and each one is the
+ * stricter reading of its case:
+ *
+ * 1. **The daemon, with a rule on {@link ADVANCE_DAEMON_CLASS}.** The daemon's
+ *    own class, whatever autonomy the operator gave it.
+ * 2. **The daemon, with no such rule.** {@link ADVANCE_CLASS}, exactly as every
+ *    build before this one. A policy that has not declared the daemon class has
+ *    not decided anything about it, and resolving to the fail-closed default
+ *    there would put a phone tap on every cadence advance between the day this
+ *    code ships and the day the page is applied. Falling back to the class the
+ *    operator DID write is the behaviour they attested to.
+ * 3. **Any other actor.** {@link ADVANCE_CLASS}, unless that class resolves
+ *    `autonomous`, which is refused {@link ADVANCE_ACTOR_REFUSAL}. The
+ *    autonomous route is the daemon's, so an actor that is not the daemon
+ *    taking it is a policy that was loosened past what this repository decided,
+ *    and the refusal says so rather than publishing the log unattended.
+ *
+ * PURE: the policy load is an argument and the actor answer is a boolean the
+ * caller read from `core/daemon-actor.ts`, so the whole rule is testable in
+ * both directions with no daemon, no git, and no clock.
+ */
+export declare function advanceRoute(daemon: boolean, load: PolicyLoadResult): AdvanceRoute;
 /** The task id every advance cycle registers under, plus its head seq. */
 export declare const ADVANCE_TASK_PREFIX = "daemon-advance";
 /** The idempotency key prefix. One key per (published head → working head) span. */