codex-orchestrator 0.1.47 → 0.1.49

package/dist/src/runner/mission-patch-audit.js

@@ -0,0 +1,186 @@
+import { Buffer } from 'node:buffer';
+import { globMatches, normalizePath } from '../path-policy.js';
+import { missionPathDenied } from './mission-path-language.js';
+export function auditMissionPatch(input) {
+    if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes <= 0) {
+        throw new Error('Mission patch maxBytes must be a positive integer.');
+    }
+    if (Buffer.byteLength(input.patch, 'utf8') > input.maxBytes) {
+        return rejected('patch-size-limit');
+    }
+    if (/^(?:GIT binary patch|Binary files )/mu.test(input.patch)) {
+        return rejected('binary-patch-forbidden');
+    }
+    const lines = input.patch.split(/\r?\n/u);
+    const files = [];
+    let current;
+    for (const line of lines) {
+        const header = /^diff --git a\/(\S+) b\/(\S+)$/u.exec(line);
+        if (line.startsWith('diff ') && !header) {
+            return rejected('malformed-diff-header');
+        }
+        if (header) {
+            if (current) {
+                if (current.inHunk)
+                    return rejected('hunk-line-count-mismatch');
+                files.push(current);
+            }
+            if (header[1] !== header[2])
+                return rejected('rename-or-copy-forbidden');
+            const path = normalizePath(header[2]);
+            const pathDenial = validatePath(path, input.grantedPaths, input.deniedPaths);
+            if (pathDenial)
+                return rejected(pathDenial);
+            current = {
+                path,
+                oldMode: '100644',
+                newMode: '100644',
+                oldHeader: false,
+                newHeader: false,
+                hunk: false,
+                inHunk: false,
+                remainingOld: 0,
+                remainingNew: 0,
+            };
+            continue;
+        }
+        if (!current) {
+            if (/^(?:--- |\+\+\+ |@@ |Index: )/u.test(line)) {
+                return rejected('patch-record-before-diff-header');
+            }
+            continue;
+        }
+        if (current.inHunk) {
+            if (line === '\')
+                continue;
+            if (line.length === 0)
+                return rejected('hunk-line-count-mismatch');
+            if (line.startsWith(' ')) {
+                current.remainingOld -= 1;
+                current.remainingNew -= 1;
+            }
+            else if (line.startsWith('-')) {
+                current.remainingOld -= 1;
+            }
+            else if (line.startsWith('+')) {
+                current.remainingNew -= 1;
+            }
+            else {
+                return rejected('malformed-hunk-body');
+            }
+            if (current.remainingOld < 0 || current.remainingNew < 0) {
+                return rejected('hunk-line-count-mismatch');
+            }
+            if (current.remainingOld === 0 && current.remainingNew === 0) {
+                current.inHunk = false;
+            }
+            continue;
+        }
+        if (/^(?:rename|copy) (?:from|to) /u.test(line)) {
+            return rejected('rename-or-copy-forbidden');
+        }
+        const oldPath = /^--- (.+)$/u.exec(line)?.[1];
+        if (oldPath && current.oldHeader)
+            return rejected('repeated-file-header');
+        if (oldPath && oldPath !== '/dev/null' && oldPath !== `a/${current.path}`) {
+            return rejected('patch-header-path-mismatch');
+        }
+        if (oldPath) {
+            current.oldHeader = true;
+            if (oldPath === '/dev/null')
+                current.oldMode = null;
+        }
+        const newPath = /^\+\+\+ (.+)$/u.exec(line)?.[1];
+        if (newPath && current.newHeader)
+            return rejected('repeated-file-header');
+        if (newPath && newPath !== '/dev/null' && newPath !== `b/${current.path}`) {
+            return rejected('patch-header-path-mismatch');
+        }
+        if (newPath) {
+            current.newHeader = true;
+            if (newPath === '/dev/null')
+                current.newMode = null;
+        }
+        if (line.startsWith('@@')) {
+            const hunk = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?$/u.exec(line);
+            if (!hunk || !current.oldHeader || !current.newHeader) {
+                return rejected('malformed-hunk-header');
+            }
+            current.remainingOld = hunk[2] === undefined ? 1 : Number(hunk[2]);
+            current.remainingNew = hunk[4] === undefined ? 1 : Number(hunk[4]);
+            if (!Number.isSafeInteger(current.remainingOld) || !Number.isSafeInteger(current.remainingNew)
+                || (current.remainingOld === 0 && current.remainingNew === 0)) {
+                return rejected('malformed-hunk-header');
+            }
+            current.hunk = true;
+            current.inHunk = current.remainingOld > 0 || current.remainingNew > 0;
+            continue;
+        }
+        const index = /^index [a-f0-9]+\.\.[a-f0-9]+(?: (\d{6}))?$/u.exec(line);
+        if (index?.[1]) {
+            current.oldMode = index[1];
+            current.newMode = index[1];
+        }
+        const oldMode = /^(?:old mode|deleted file mode) (\d{6})$/u.exec(line)?.[1];
+        const newMode = /^(?:new mode|new file mode) (\d{6})$/u.exec(line)?.[1];
+        if (oldMode)
+            current.oldMode = oldMode;
+        if (newMode)
+            current.newMode = newMode;
+        if (current.hunk && /^[ +\-]/u.test(line)) {
+            return rejected('hunk-line-count-mismatch');
+        }
+    }
+    if (current) {
+        if (current.inHunk)
+            return rejected('hunk-line-count-mismatch');
+        files.push(current);
+    }
+    if (files.length === 0) {
+        return rejected('no-file-diffs');
+    }
+    if (files.some((file) => !file.oldHeader || !file.newHeader || !file.hunk)) {
+        return rejected('incomplete-file-diff');
+    }
+    const paths = files.map((file) => file.path);
+    if (new Set(paths).size !== paths.length) {
+        return rejected('duplicate-file-diff');
+    }
+    const foldedPaths = paths.map((path) => path.normalize('NFC').toLocaleLowerCase('en-US'));
+    if (new Set(foldedPaths).size !== foldedPaths.length) {
+        return rejected('case-colliding-file-diff');
+    }
+    if (files.some((file) => (file.oldMode !== null && file.oldMode !== '100644')
+        || (file.newMode !== null && file.newMode !== '100644')
+        || (file.oldMode === null && file.newMode === null))) {
+        return rejected('non-regular-file-mode-forbidden');
+    }
+    return {
+        accepted: true,
+        files: files.map(({ path, oldMode, newMode }) => ({
+            path,
+            operation: oldMode === null ? 'add' : newMode === null ? 'delete' : 'modify',
+            oldMode,
+            newMode,
+        })),
+    };
+}
+function validatePath(path, grants, denies) {
+    if (path.length === 0 || path.startsWith('/') || path.split('/').includes('..')) {
+        return 'invalid-repository-path';
+    }
+    if (path === '.git' || path.startsWith('.git/')) {
+        return 'git-internal-path-forbidden';
+    }
+    if (missionPathDenied(path, denies)) {
+        return 'denied-path';
+    }
+    if (!grants.some((pattern) => globMatches(pattern, path))) {
+        return 'path-outside-granted-scope';
+    }
+    return undefined;
+}
+function rejected(reason) {
+    return { accepted: false, reason };
+}
+//# sourceMappingURL=mission-patch-audit.js.map

package/dist/src/runner/mission-patch-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-patch-audit.js","sourceRoot":"","sources":["../../../src/runner/mission-patch-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAoB/D,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5D,OAAO,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAUN,EAAE,CAAC;IACR,IAAI,OAA2C,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,OAAO,CAAC,MAAM;oBAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;gBAChE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YACvC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7E,IAAI,UAAU;gBAAE,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5C,OAAO,GAAG;gBACR,IAAI;gBACJ,OAAO,EAAE,QAAQ;gBACjB,OAAO,EAAE,QAAQ;gBACjB,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;aAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,QAAQ,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,IAAI,IAAI,KAAK,8BAA8B;gBAAE,SAAS;YACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YACnE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;gBAC1B,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;gBAC7D,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAC1E,IAAI,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YACzB,IAAI,OAAO,KAAK,WAAW;gBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;QACtD,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAC1E,IAAI,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,OAAO,QAAQ,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YACzB,IAAI,OAAO,KAAK,WAAW;gBAAE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;QACtD,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtD,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;mBACzF,CAAC,OAAO,CAAC,YAAY,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QACvC,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QACvC,IAAI,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC;WACxE,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC;WACpD,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,QAAQ,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI;YACJ,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC5E,OAAO;YACP,OAAO;SACR,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAgB,EAAE,MAAgB;IACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1D,OAAO,4BAA4B,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC"}

package/dist/src/runner/mission-path-language.d.ts

@@ -0,0 +1,6 @@
+export declare const missionDefaultDeniedRepositoryPaths: readonly [".env*", "**/.env*", ".git", ".git/**", "id_rsa", "**/id_rsa", "id_ed25519", "**/id_ed25519"];
+export declare function assertMissionPathPattern(pattern: string, context: string): string;
+export declare function scopePatternContainedBy(request: string, grant: string): boolean;
+export declare function missionPathDenied(path: string, patterns: string[]): boolean;
+export declare function missionPathPatternsOverlap(left: string, right: string): boolean;
+//# sourceMappingURL=mission-path-language.d.ts.map

package/dist/src/runner/mission-path-language.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-path-language.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-path-language.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mCAAmC,yGAStC,CAAC;AAEX,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAOjF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAM/E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAQ3E;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAyB/E"}

package/dist/src/runner/mission-path-language.js

@@ -0,0 +1,106 @@
+import { globMatches, normalizePath } from '../path-policy.js';
+export const missionDefaultDeniedRepositoryPaths = [
+    '.env*',
+    '**/.env*',
+    '.git',
+    '.git/**',
+    'id_rsa',
+    '**/id_rsa',
+    'id_ed25519',
+    '**/id_ed25519',
+];
+export function assertMissionPathPattern(pattern, context) {
+    const normalized = normalizePath(pattern);
+    if (normalized.length === 0 || normalized.startsWith('/')
+        || normalized.split('/').some((segment) => segment.length === 0 || segment === '..')) {
+        throw new Error(`${context} must be a non-empty repository-relative glob without empty segments.`);
+    }
+    return normalized;
+}
+export function scopePatternContainedBy(request, grant) {
+    const normalizedRequest = assertMissionPathPattern(request, 'Mission requested path');
+    const normalizedGrant = assertMissionPathPattern(grant, 'Mission granted path');
+    if (normalizedRequest === normalizedGrant)
+        return true;
+    if (!normalizedRequest.includes('*'))
+        return globMatches(normalizedGrant, normalizedRequest);
+    return false;
+}
+export function missionPathDenied(path, patterns) {
+    const normalized = normalizePath(path).normalize('NFC');
+    const folded = normalized.toLocaleLowerCase('en-US');
+    return patterns.some((pattern) => {
+        const normalizedPattern = normalizePath(pattern).normalize('NFC');
+        return globMatches(normalizedPattern, normalized)
+            || globMatches(normalizedPattern.toLocaleLowerCase('en-US'), folded);
+    });
+}
+export function missionPathPatternsOverlap(left, right) {
+    const leftSegments = assertMissionPathPattern(left, 'Mission scope path').split('/');
+    const rightSegments = assertMissionPathPattern(right, 'Mission scope path').split('/');
+    const queue = [[0, 0]];
+    const visited = new Set();
+    while (queue.length > 0) {
+        const [leftIndex, rightIndex] = queue.shift();
+        const key = `${leftIndex}:${rightIndex}`;
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        if (leftIndex === leftSegments.length && rightIndex === rightSegments.length)
+            return true;
+        const leftSegment = leftSegments[leftIndex];
+        const rightSegment = rightSegments[rightIndex];
+        if (leftSegment === '**')
+            queue.push([leftIndex + 1, rightIndex]);
+        if (rightSegment === '**')
+            queue.push([leftIndex, rightIndex + 1]);
+        if (leftSegment === undefined || rightSegment === undefined)
+            continue;
+        if (leftSegment === '**' || rightSegment === '**'
+            || segmentPatternsOverlap(leftSegment, rightSegment)) {
+            queue.push([
+                leftSegment === '**' ? leftIndex : leftIndex + 1,
+                rightSegment === '**' ? rightIndex : rightIndex + 1,
+            ]);
+        }
+    }
+    return false;
+}
+function segmentPatternsOverlap(left, right) {
+    const alphabet = new Set([
+        ...[...left].filter((character) => character !== '*'),
+        ...[...right].filter((character) => character !== '*'),
+        '\u0001',
+    ]);
+    const queue = [[0, 0, false]];
+    const visited = new Set();
+    while (queue.length > 0) {
+        const [leftIndex, rightIndex, consumed] = queue.shift();
+        const key = `${leftIndex}:${rightIndex}:${consumed ? 1 : 0}`;
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        if (leftIndex === left.length && rightIndex === right.length && consumed)
+            return true;
+        if (left[leftIndex] === '*')
+            queue.push([leftIndex + 1, rightIndex, consumed]);
+        if (right[rightIndex] === '*')
+            queue.push([leftIndex, rightIndex + 1, consumed]);
+        for (const character of alphabet) {
+            const nextLeft = consumeSegmentCharacter(left, leftIndex, character);
+            const nextRight = consumeSegmentCharacter(right, rightIndex, character);
+            if (nextLeft !== undefined && nextRight !== undefined)
+                queue.push([nextLeft, nextRight, true]);
+        }
+    }
+    return false;
+}
+function consumeSegmentCharacter(pattern, index, character) {
+    const expected = pattern[index];
+    if (expected === '*')
+        return index;
+    if (expected === character)
+        return index + 1;
+    return undefined;
+}
+//# sourceMappingURL=mission-path-language.js.map

package/dist/src/runner/mission-path-language.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-path-language.js","sourceRoot":"","sources":["../../../src/runner/mission-path-language.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE/D,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,OAAO;IACP,UAAU;IACV,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,eAAe;CACP,CAAC;AAEX,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,OAAe;IACvE,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;WACpD,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,uEAAuE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,KAAa;IACpE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IAChF,IAAI,iBAAiB,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,WAAW,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAkB;IAChE,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,MAAM,iBAAiB,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC,iBAAiB,EAAE,UAAU,CAAC;eAC5C,WAAW,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,KAAa;IACpE,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrF,MAAM,aAAa,GAAG,wBAAwB,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvF,MAAM,KAAK,GAA4B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,SAAS,KAAK,YAAY,CAAC,MAAM,IAAI,UAAU,KAAK,aAAa,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC1F,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAClE,IAAI,YAAY,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS;YAAE,SAAS;QACtE,IAAI,WAAW,KAAK,IAAI,IAAI,YAAY,KAAK,IAAI;eAC5C,sBAAsB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;YACvD,KAAK,CAAC,IAAI,CAAC;gBACT,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC;gBAChD,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC;aACpD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAa;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;QAC/B,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC;QACrD,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,GAAG,CAAC;QACtD,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,KAAK,GAAqC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACzD,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,IAAI,UAAU,KAAK,KAAK,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtF,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe,EAAE,KAAa,EAAE,SAAiB;IAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,GAAG,CAAC,CAAC;IAC7C,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/src/runner/mission-permit-authority.d.ts

@@ -0,0 +1,26 @@
+import { type MissionCapabilityPermit } from './mission-capability-kernel.js';
+import { MissionStateStore } from './mission-state-store.js';
+export type MissionPermitBeginResult = {
+    kind: 'execute';
+} | {
+    kind: 'resume-in-flight';
+} | {
+    kind: 'completed';
+    receiptSha256: string;
+};
+export interface MissionPermitAuthority {
+    begin(permit: MissionCapabilityPermit): Promise<MissionPermitBeginResult>;
+    complete(permit: MissionCapabilityPermit, payload: Uint8Array, artifacts?: Uint8Array[]): Promise<string>;
+    readReceipt(receiptSha256: string): Promise<Buffer>;
+}
+export declare class MissionStatePermitAuthority implements MissionPermitAuthority {
+    private readonly store;
+    private readonly now;
+    constructor(store: MissionStateStore, now?: () => Date);
+    begin(permit: MissionCapabilityPermit): Promise<MissionPermitBeginResult>;
+    complete(permit: MissionCapabilityPermit, payload: Uint8Array, artifacts?: Uint8Array[]): Promise<string>;
+    readReceipt(receiptSha256: string): Promise<Buffer>;
+    private requireAuthorizedMission;
+    private assertNotExpired;
+}
+//# sourceMappingURL=mission-permit-authority.d.ts.map

package/dist/src/runner/mission-permit-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-permit-authority.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-permit-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1E,QAAQ,CAAC,MAAM,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1G,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED,qBAAa,2BAA4B,YAAW,sBAAsB;IAEtE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,KAAK,EAAE,iBAAiB,EACxB,GAAG,GAAE,MAAM,IAAuB;IAGxC,KAAK,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IA2DzE,QAAQ,CACnB,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,UAAU,EACnB,SAAS,GAAE,UAAU,EAAO,GAC3B,OAAO,CAAC,MAAM,CAAC;IA+CL,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOhE,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,gBAAgB;CAKzB"}

package/dist/src/runner/mission-permit-authority.js

@@ -0,0 +1,145 @@
+import { missionCapabilityPermitFingerprint, } from './mission-capability-kernel.js';
+export class MissionStatePermitAuthority {
+    store;
+    now;
+    constructor(store, now = () => new Date()) {
+        this.store = store;
+        this.now = now;
+    }
+    async begin(permit) {
+        const fingerprint = missionCapabilityPermitFingerprint(permit);
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+            const snapshot = await this.store.load();
+            const mission = this.requireAuthorizedMission(snapshot.missions[permit.missionId], permit, fingerprint);
+            const existing = mission.actionExecutions?.[permit.actionKey];
+            if (existing) {
+                if (existing.permitFingerprint !== fingerprint) {
+                    if (existing.status === 'completed') {
+                        throw new Error(`Mission completed action is bound to a different permit: ${permit.actionKey}.`);
+                    }
+                    try {
+                        await this.store.mutate(snapshot.generation, (draft) => {
+                            const current = this.requireAuthorizedMission(draft.missions[permit.missionId], permit, fingerprint);
+                            const stale = current.actionExecutions?.[permit.actionKey];
+                            if (!stale || stale.status !== 'in-flight') {
+                                throw new Error(`Mission action cannot rebind permit: ${permit.actionKey}.`);
+                            }
+                            current.actionExecutions[permit.actionKey] = {
+                                permitFingerprint: fingerprint,
+                                status: 'in-flight',
+                            };
+                            current.revision += 1;
+                        });
+                        return { kind: 'execute' };
+                    }
+                    catch (error) {
+                        if (error instanceof Error && /generation conflict/u.test(error.message))
+                            continue;
+                        throw error;
+                    }
+                }
+                if (existing.status === 'completed') {
+                    return { kind: 'completed', receiptSha256: existing.receiptSha256 };
+                }
+                this.assertNotExpired(permit);
+                return { kind: 'resume-in-flight' };
+            }
+            this.assertNotExpired(permit);
+            try {
+                await this.store.mutate(snapshot.generation, (draft) => {
+                    const current = this.requireAuthorizedMission(draft.missions[permit.missionId], permit, fingerprint);
+                    current.actionExecutions = {
+                        ...(current.actionExecutions ?? {}),
+                        [permit.actionKey]: { permitFingerprint: fingerprint, status: 'in-flight' },
+                    };
+                    current.revision += 1;
+                });
+                return { kind: 'execute' };
+            }
+            catch (error) {
+                if (error instanceof Error && /generation conflict/u.test(error.message))
+                    continue;
+                throw error;
+            }
+        }
+        throw new Error('Mission permit could not begin after repeated generation conflicts.');
+    }
+    async complete(permit, payload, artifacts = []) {
+        const fingerprint = missionCapabilityPermitFingerprint(permit);
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+            const snapshot = await this.store.load();
+            const mission = this.requireAuthorizedMission(snapshot.missions[permit.missionId], permit, fingerprint);
+            const existing = mission.actionExecutions?.[permit.actionKey];
+            if (!existing || existing.permitFingerprint !== fingerprint) {
+                throw new Error(`Mission action is not in flight: ${permit.actionKey}.`);
+            }
+            if (existing.status === 'completed') {
+                const persisted = await this.readReceipt(existing.receiptSha256);
+                if (!persisted.equals(Buffer.from(payload))) {
+                    throw new Error(`Mission action completed with a different receipt: ${permit.actionKey}.`);
+                }
+                return existing.receiptSha256;
+            }
+            this.assertNotExpired(permit);
+            try {
+                const saved = await this.store.mutateWithBlobs(snapshot.generation, [payload, ...artifacts], (draft, [reference, ...artifactReferences]) => {
+                    if (!reference)
+                        throw new Error('Mission action receipt was not materialized.');
+                    const current = this.requireAuthorizedMission(draft.missions[permit.missionId], permit, fingerprint);
+                    const action = current.actionExecutions?.[permit.actionKey];
+                    if (!action || action.permitFingerprint !== fingerprint || action.status !== 'in-flight') {
+                        throw new Error(`Mission action is not in flight: ${permit.actionKey}.`);
+                    }
+                    current.actionExecutions[permit.actionKey] = {
+                        permitFingerprint: fingerprint,
+                        status: 'completed',
+                        receiptSha256: reference.sha256,
+                    };
+                    draft.blobs[reference.sha256] = reference;
+                    for (const artifactReference of artifactReferences) {
+                        draft.blobs[artifactReference.sha256] = artifactReference;
+                    }
+                    current.revision += 1;
+                });
+                return saved.missions[permit.missionId].actionExecutions[permit.actionKey].receiptSha256;
+            }
+            catch (error) {
+                if (error instanceof Error && /generation conflict/u.test(error.message))
+                    continue;
+                throw error;
+            }
+        }
+        throw new Error('Mission action could not complete after repeated generation conflicts.');
+    }
+    async readReceipt(receiptSha256) {
+        const snapshot = await this.store.load();
+        const reference = snapshot.blobs[receiptSha256];
+        if (!reference)
+            throw new Error(`Mission action receipt is missing: ${receiptSha256}.`);
+        return this.store.readBlob(reference);
+    }
+    requireAuthorizedMission(mission, permit, fingerprint) {
+        if (!mission)
+            throw new Error(`Mission permit references unknown mission: ${permit.missionId}.`);
+        if (mission.state !== 'executing') {
+            throw new Error(`Mission permit is revoked by current state: ${mission.state}.`);
+        }
+        if (mission.fencingEpoch !== permit.fencingEpoch) {
+            throw new Error('Mission permit fencing epoch is stale.');
+        }
+        if (mission.inputSnapshot !== permit.inputSnapshot) {
+            throw new Error('Mission permit input snapshot is stale.');
+        }
+        if (mission.actionKey !== permit.actionKey || !mission.authorizedPermit
+            || missionCapabilityPermitFingerprint(mission.authorizedPermit) !== fingerprint) {
+            throw new Error('Mission permit does not match the durable authorization.');
+        }
+        return mission;
+    }
+    assertNotExpired(permit) {
+        if (Date.parse(permit.expiresAt) <= this.now().getTime()) {
+            throw new Error('Mission permit has expired.');
+        }
+    }
+}
+//# sourceMappingURL=mission-permit-authority.js.map

package/dist/src/runner/mission-permit-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-permit-authority.js","sourceRoot":"","sources":["../../../src/runner/mission-permit-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAEnC,MAAM,gCAAgC,CAAC;AAexC,MAAM,OAAO,2BAA2B;IAEnB;IACA;IAFnB,YACmB,KAAwB,EACxB,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QADlC,UAAK,GAAL,KAAK,CAAmB;QACxB,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEG,KAAK,CAAC,KAAK,CAAC,MAA+B;QAChD,MAAM,WAAW,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,iBAAiB,KAAK,WAAW,EAAE,CAAC;oBAC/C,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;wBACpC,MAAM,IAAI,KAAK,CAAC,4DAA4D,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;oBACnG,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;4BACrD,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAC3C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CACtD,CAAC;4BACF,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;4BAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gCAC3C,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;4BAC/E,CAAC;4BACD,OAAO,CAAC,gBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;gCAC5C,iBAAiB,EAAE,WAAW;gCAC9B,MAAM,EAAE,WAAW;6BACpB,CAAC;4BACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;wBACxB,CAAC,CAAC,CAAC;wBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;oBAC7B,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;4BAAE,SAAS;wBACnF,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;oBACpC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAc,EAAE,CAAC;gBACvE,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAC9B,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;oBACrD,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAC3C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CACtD,CAAC;oBACF,OAAO,CAAC,gBAAgB,GAAG;wBACzB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;wBACnC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE;qBAC5E,CAAC;oBACF,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACxB,CAAC,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAEM,KAAK,CAAC,QAAQ,CACnB,MAA+B,EAC/B,OAAmB,EACnB,YAA0B,EAAE;QAE5B,MAAM,WAAW,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,iBAAiB,KAAK,WAAW,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAc,CAAC,CAAC;gBAClE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;gBAC7F,CAAC;gBACD,OAAO,QAAQ,CAAC,aAAc,CAAC;YACjC,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,kBAAkB,CAAC,EAAE,EAAE;oBACzI,IAAI,CAAC,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;oBAChF,MAAM,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAC3C,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,WAAW,CACtD,CAAC;oBACF,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;wBACzF,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;oBAC3E,CAAC;oBACD,OAAO,CAAC,gBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG;wBAC5C,iBAAiB,EAAE,WAAW;wBAC9B,MAAM,EAAE,WAAW;wBACnB,aAAa,EAAE,SAAS,CAAC,MAAM;qBAChC,CAAC;oBACF,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;oBAC1C,KAAK,MAAM,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;wBACnD,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,iBAAiB,CAAC;oBAC5D,CAAC;oBACD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACxB,CAAC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAE,CAAC,gBAAiB,CAAC,MAAM,CAAC,SAAS,CAAE,CAAC,aAAc,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,KAAK,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,SAAS;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,aAAqB;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,aAAa,GAAG,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAEO,wBAAwB,CAC9B,OAAkC,EAClC,MAA+B,EAC/B,WAAmB;QAEnB,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;QACjG,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,gBAAgB;eAClE,kCAAkC,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,WAAW,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,gBAAgB,CAAC,MAA+B;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}

package/dist/src/runner/mission-plan-parent-coordinator.d.ts

@@ -0,0 +1,87 @@
+import { type PlanParentChildDescriptor, type PlanParentIntegrationIntent, type PlanParentRecord, type PlanParentResumeTarget } from './mission-plan-parent.js';
+import { type MissionClaim } from './mission-state-machine.js';
+import { type MissionPublicationRecord } from './mission-publication.js';
+import type { MissionStateSnapshot, MissionStateStore } from './mission-state-store.js';
+export declare class MissionPlanParentCoordinator {
+    private readonly store;
+    constructor(store: MissionStateStore);
+    create(input: {
+        expectedGeneration: number;
+        parent: PlanParentRecord;
+    }): Promise<MissionStateSnapshot>;
+    linkNextWave(input: ParentFence): Promise<MissionStateSnapshot>;
+    prepareWave(input: ParentFence & {
+        descriptors: PlanParentChildDescriptor[];
+    }): Promise<MissionStateSnapshot>;
+    startIntegration(input: ParentFence & {
+        intent: PlanParentIntegrationIntent;
+    }): Promise<MissionStateSnapshot>;
+    completeIntegration(input: ParentFence & {
+        actionKey: string;
+    }): Promise<MissionStateSnapshot>;
+    recordValidation(input: ParentFence & {
+        receiptIds: string[];
+    }): Promise<MissionStateSnapshot>;
+    checkpoint(input: ParentFence & {
+        checkpoint: {
+            commitSha: string;
+            treeSha: string;
+        };
+    }): Promise<MissionStateSnapshot>;
+    defer(input: ParentFence & {
+        resumeTarget: PlanParentResumeTarget;
+        actionKey: string;
+        nextEligibleAt: string;
+        reason: string;
+        requiredPredicate: string;
+    }): Promise<MissionStateSnapshot>;
+    claim(input: ParentFence & {
+        now: string;
+        claim: MissionClaim;
+    }): Promise<MissionStateSnapshot>;
+    recordIntegrationConflict(input: ParentFence): Promise<MissionStateSnapshot>;
+    completeIntegrationRecovery(input: ParentFence & {
+        descriptor: PlanParentChildDescriptor;
+    }): Promise<MissionStateSnapshot>;
+    recordValidationFailure(input: ParentFence): Promise<MissionStateSnapshot>;
+    completeValidationRecovery(input: ParentFence): Promise<MissionStateSnapshot>;
+    reconcileIntegration(input: ParentFence & {
+        execute(intent: PlanParentIntegrationIntent): Promise<{
+            kind: 'applied';
+        } | {
+            kind: 'transient-failure';
+            nextEligibleAt: string;
+            reason: string;
+        } | {
+            kind: 'conflict';
+        } | {
+            kind: 'safety-stop';
+        }>;
+    }): Promise<MissionStateSnapshot>;
+    preparePublication(input: ParentFence & {
+        receiptIds: string[];
+        validationSnapshot: string;
+        publication: MissionPublicationRecord;
+    }): Promise<MissionStateSnapshot>;
+    requestCancellation(input: ParentFence & {
+        requestedAt: string;
+        requestedBy: string;
+    }): Promise<MissionStateSnapshot>;
+    reconcileCancellationIntegration(input: ParentFence & {
+        observedIdentity: 'old' | 'new' | 'third';
+    }): Promise<MissionStateSnapshot>;
+    completeCancellation(input: ParentFence): Promise<MissionStateSnapshot>;
+}
+export declare function listEligiblePlanParents(snapshot: MissionStateSnapshot, now: string, limit?: number): Array<{
+    parentId: string;
+    revision: number;
+    state: string;
+    nextEligibleAt: string;
+}>;
+interface ParentFence {
+    expectedGeneration: number;
+    parentId: string;
+    expectedRevision: number;
+}
+export {};
+//# sourceMappingURL=mission-plan-parent-coordinator.d.ts.map

package/dist/src/runner/mission-plan-parent-coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-plan-parent-coordinator.d.ts","sourceRoot":"","sources":["../../../src/runner/mission-plan-parent-coordinator.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACzG,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAa,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAEnG,qBAAa,4BAA4B;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,iBAAiB;IAErD,MAAM,CAAC,KAAK,EAAE;QACnB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,MAAM,EAAE,gBAAgB,CAAC;KAC1B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAS1B,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwB/D,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG;QACtC,WAAW,EAAE,yBAAyB,EAAE,CAAC;KAC1C,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgB1B,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG;QAC3C,MAAM,EAAE,2BAA2B,CAAC;KACrC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoB1B,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoB9F,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAU9F,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG;QACrC,UAAU,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC;KACpD,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAU1B,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG;QAChC,YAAY,EAAE,sBAAsB,CAAC;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAoB1B,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+B/F,yBAAyB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+B5E,2BAA2B,CAAC,KAAK,EAAE,WAAW,GAAG;QACtD,UAAU,EAAE,yBAAyB,CAAC;KACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAa1B,uBAAuB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwB1E,0BAA0B,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAavE,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG;QACrD,OAAO,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CACjD;YAAE,IAAI,EAAE,SAAS,CAAA;SAAE,GACnB;YAAE,IAAI,EAAE,mBAAmB,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,GACrE;YAAE,IAAI,EAAE,UAAU,CAAA;SAAE,GACpB;YAAE,IAAI,EAAE,aAAa,CAAA;SAAE,CAC1B,CAAC;KACH,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmC1B,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG;QAC7C,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,WAAW,EAAE,wBAAwB,CAAC;KACvC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+B1B,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG;QAC9C,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgC1B,gCAAgC,CAAC,KAAK,EAAE,WAAW,GAAG;QAC3D,gBAAgB,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;KAC3C,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAc1B,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;CA6B/E;AAYD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,MAAM,EACX,KAAK,SAAM,GACV,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBtF;AAED,UAAU,WAAW;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;CAC1B"}