codex-workflow-v2 2.0.0-beta.14 → 2.0.0-beta.14.1

package/dist/src/delegation.d.ts

@@ -1,5 +1,9 @@
 import type { DelegatedAuthorizationEvidence, DelegationGrant, DelegationGrantGate, DelegationPolicyInput, DelegationTransition, MilestoneState, ProjectKnowledgeMap, TaskState } from './contracts.js';
-type DelegationTarget = TaskState | MilestoneState | ProjectKnowledgeMap;
+type DelegationTarget = TaskState | MilestoneState | ProjectKnowledgeMap | {
+    kind: 'project';
+    id: string;
+    milestoneId?: null;
+};
 export declare function prepareDelegationGrantGate(projectId: string, input: DelegationPolicyInput, now: Date): DelegationGrantGate;
 export declare function normalizeDelegationPolicy(input: DelegationPolicyInput, now: Date): DelegationPolicyInput;
 export declare function hashDelegationPolicy(projectId: string, policy: DelegationPolicyInput): string;

package/dist/src/delegation.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { WorkflowError } from './errors.js';
 const TRANSITIONS = [
+    'project.adopt',
     'project_memory.approve',
     'task.execution_authorize',
     'task.final_accept',
@@ -42,6 +43,9 @@ export function normalizeDelegationPolicy(input, now) {
         });
     }
     transitions.sort();
+    if (transitions.includes('project.adopt') && scope.kind !== 'project') {
+        throw new WorkflowError('INVALID_ARGUMENT', 'project.adopt requires project scope.');
+    }
     if (transitions.includes('project_memory.approve') && scope.kind !== 'project') {
         throw new WorkflowError('INVALID_ARGUMENT', 'project_memory.approve requires project scope.');
     }

package/dist/src/delegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,WAAW,GAAoC;IACnD,wBAAwB;IACxB,0BAA0B;IAC1B,mBAAmB;IACnB,+BAA+B;IAC/B,wBAAwB;CACzB,CAAC;AAIF,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,KAA4B,EAC5B,GAAS;IAET,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,8BAA8B,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,gBAAgB,EAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE;KACzG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA4B,EAC5B,GAAS;IAET,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,8DAA8D,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,kEAAkE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,gDAAgD,EAAE;YAC5F,oBAAoB,EAAE,WAAW;SAClC,CAAC,CAAC;IACL,CAAC;IACD,WAAW,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAClB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,SAAS;QACT,QAAQ;QACR,KAAK;QACL,WAAW;QACX,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,MAA6B;IACnF,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,OAAO,EAAE,sBAAsB;QAC/B,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;SACF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAsB,EACtB,UAAgC,EAChC,KAAa,EACb,MAAwB,EACxB,GAAS;IAET,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE;QAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,KAAK,CAAC,EAAE,0BAA0B,EAAE;YACzF,kBAAkB;YAClB,gBAAgB,EAAE,KAAK,CAAC,UAAU;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,KAAK,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,eAAe,EAAE;YACnF,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,6BAA6B,eAAe,IAAI,SAAS,GAAG,EAAE;YAChI,gBAAgB,EAAE,KAAK,CAAC,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,mBAAmB,UAAU,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,mBAAmB,MAAM,CAAC,EAAE,GAAG,EAAE;YACnG,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,UAAgC,EAChC,MAAwB,EACxB,GAAS;IAET,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;WAC3B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;WACvB,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE;WACtB,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;WACtC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAsB,EAAE,MAAwB;IAC9E,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;IAC/F,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,KAAqC;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,WAAW;QACxC,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,+BAA+B,CAAC;IACpC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,cAAc,KAAK,CAAC,IAAI,oCAAoC,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"delegation.js","sourceRoot":"","sources":["../../src/delegation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,WAAW,GAAoC;IACnD,eAAe;IACf,wBAAwB;IACxB,0BAA0B;IAC1B,mBAAmB;IACnB,+BAA+B;IAC/B,wBAAwB;CACzB,CAAC;AAIF,MAAM,UAAU,0BAA0B,CACxC,SAAiB,EACjB,KAA4B,EAC5B,GAAS;IAET,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,8BAA8B,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,SAAS;QACT,MAAM;QACN,UAAU;QACV,gBAAgB,EAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE;KACzG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA4B,EAC5B,GAAS;IAET,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,8DAA8D,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,kEAAkE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,uDAAuD,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACpD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,gDAAgD,EAAE;YAC5F,oBAAoB,EAAE,WAAW;SAClC,CAAC,CAAC;IACL,CAAC;IACD,WAAW,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/E,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAClB,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO;QACL,SAAS;QACT,QAAQ;QACR,KAAK;QACL,WAAW;QACX,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,MAA6B;IACnF,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACrB,OAAO,EAAE,sBAAsB;QAC/B,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;SACF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAsB,EACtB,UAAgC,EAChC,KAAa,EACb,MAAwB,EACxB,GAAS;IAET,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE;QAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,KAAK,CAAC,EAAE,0BAA0B,EAAE;YACzF,kBAAkB;YAClB,gBAAgB,EAAE,KAAK,CAAC,UAAU;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,cAAc,KAAK,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,eAAe,EAAE;YACnF,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,6BAA6B,eAAe,IAAI,SAAS,GAAG,EAAE;YAChI,gBAAgB,EAAE,KAAK,CAAC,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,mBAAmB,UAAU,GAAG,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,cAAc,KAAK,CAAC,EAAE,mBAAmB,MAAM,CAAC,EAAE,GAAG,EAAE;YACnG,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,KAAsB,EACtB,UAAgC,EAChC,MAAwB,EACxB,GAAS;IAET,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACnD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;WAC3B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;WACvB,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE;WACtB,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC;WACtC,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAsB,EAAE,MAAwB;IAC9E,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;IAC/F,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,cAAc,CAAC,KAAqC;IAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,WAAW;QACxC,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,+BAA+B,CAAC;IACpC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,cAAc,KAAK,CAAC,IAAI,oCAAoC,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;AAClC,CAAC"}

package/dist/src/failed-checkpoint-update.d.ts

@@ -0,0 +1,69 @@
+import type { TaskState } from './contracts.js';
+import type { FileStateStore } from './state/store.js';
+export declare const FAILED_CHECKPOINT_SOURCE = "2.0.0-beta.14";
+export declare const FAILED_CHECKPOINT_TARGET = "2.0.0-beta.14.1";
+export interface FailedCheckpointUpdateReceipt {
+    protocol: 'failed-checkpoint-update-source-v1';
+    projectId: string;
+    taskId: string;
+    revision: number;
+    issuedAt: string;
+    taskHash: string;
+    artifactsHash: string;
+    knowledgeHash: string;
+    milestoneHash: string | null;
+    sourceHead: string;
+    sourceBaseHead: string;
+    taskBranch: string;
+    baseBranch: string;
+    sourceVersion: string;
+    targetVersion: string;
+    actor: string;
+    stepId: string;
+    dirtyFiles: string[];
+    sourceDirtyHash: string;
+    remediationEventId: string;
+    remediationEventHash: string;
+    artifact: {
+        sha256: string;
+        runtimeHash: string;
+    };
+}
+export interface FailedCheckpointUpdateBinding {
+    protocol: 'failed-checkpoint-update-v1';
+    sourceHead: string;
+    sourcePlanHash: string;
+    stepId: string;
+    sourceDirtyHash: string;
+    targetDirtyHash: string;
+    dirtyFiles: string[];
+    remediationEventId: string;
+    remediationEventHash: string;
+    sourceReceiptHash: string;
+    artifactHash: string;
+}
+/** Same byte framing as native failure evidence; no normalization of product content. */
+export declare function failedCheckpointDirtyHash(repository: string, files: readonly string[], transported?: boolean): string;
+export declare function assertFailedCheckpointInstalled(repository: string, task: TaskState, version: string): void;
+export declare function failedCheckpointUpdateSource(repository: string, store: FileStateStore, task: TaskState, artifact: FailedCheckpointUpdateReceipt['artifact'], sourceHead?: string, sourceBaseHead?: string, transported?: boolean): FailedCheckpointUpdateReceipt;
+export declare function inspectFailedCheckpointTransport(repository: string, store: FileStateStore, task: TaskState, receipt: FailedCheckpointUpdateReceipt, artifact: FailedCheckpointUpdateReceipt['artifact']): {
+    receipt: FailedCheckpointUpdateReceipt;
+    target: {
+        commitSha: string;
+        parentCommitSha: string;
+        packageVersion: string;
+    };
+    baseTransport: string;
+    targetHead: string;
+    binding: FailedCheckpointUpdateBinding;
+};
+/** Revalidate the registered byte-preserving transport when a later corrective gate reads native failure evidence.
+ * Returns no authority and never changes the original failure record or its hash. */
+export declare function readFailedCheckpointDirtyTransport(store: FileStateStore, repository: string, task: TaskState, stepId: string, sourceHead: string, sourceDirtyHash: string): {
+    sourceHead: string;
+    sourceDirtyHash: string;
+    targetHead: string;
+    targetDirtyHash: string;
+    dirtyFiles: string[];
+    sourceReceiptHash: string;
+} | null;

package/dist/src/failed-checkpoint-update.js

@@ -0,0 +1,171 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { canonicalJsonStringify, sha256Hex } from './alpha6/store-sidecars.js';
+import { readCorrectiveDecisionEvents, readRemediationEvents } from './alpha6/remediation.js';
+import { readTaskC1Posture, readTaskHandoffEvents } from './alpha6/handoff.js';
+import { readPlanRiskAuditEvents } from './alpha6/plan-risk.js';
+import { verifiedHistoricalStepReviewBindings } from './alpha6/review.js';
+import { readVerifiedPlanArtifact } from './domain/plan-semantics.js';
+import { pathAllowed } from './domain/validation.js';
+import { validateTaskHistory } from './git.js';
+import { inspectBoundedWorkflowDependencyCommit, workflowDependencyVersionAt } from './dependency-provenance.js';
+import { inspectWorkflowVersions } from './diagnostics.js';
+import { changedFiles, currentBranch, headCommit, runGit } from './repository.js';
+import { PACKAGE_VERSION } from './version.js';
+export const FAILED_CHECKPOINT_SOURCE = '2.0.0-beta.14';
+export const FAILED_CHECKPOINT_TARGET = '2.0.0-beta.14.1';
+const hash = (value) => sha256Hex(canonicalJsonStringify(value));
+function require(condition, message) {
+    if (!condition)
+        throw new Error(`FAILED_CHECKPOINT_UPDATE_BLOCKED: ${message}`);
+}
+function filesHash(root) {
+    if (!existsSync(root))
+        return hash([]);
+    const visit = (directory) => readdirSync(directory).sort().flatMap(name => {
+        const file = path.join(directory, name);
+        const info = lstatSync(file);
+        require(!info.isSymbolicLink() && (info.isFile() || info.isDirectory()), 'State artifacts must be regular files.');
+        return info.isDirectory() ? visit(file) : [[path.relative(root, file), sha256Hex(readFileSync(file))]];
+    });
+    return hash(visit(root));
+}
+/** Reverse only the dependency string, retaining every other byte (including whitespace and product scripts). */
+function sourceManifestBytes(content) {
+    const text = content.toString('utf8');
+    const manifest = JSON.parse(text);
+    require(manifest.devDependencies?.['codex-workflow-v2'] === FAILED_CHECKPOINT_TARGET
+        && !manifest.dependencies?.['codex-workflow-v2'], 'Target working manifest must have one exact dev dependency.');
+    const key = /("codex-workflow-v2"\s*:\s*)"2\.0\.0-beta\.14\.1"/g;
+    require([...text.matchAll(key)].length === 1, 'Working manifest must have one unambiguous literal target pin.');
+    return Buffer.from(text.replace(key, `$1"${FAILED_CHECKPOINT_SOURCE}"`));
+}
+/** Same byte framing as native failure evidence; no normalization of product content. */
+export function failedCheckpointDirtyHash(repository, files, transported = false) {
+    const digest = createHash('sha256');
+    for (const file of [...files].sort()) {
+        const absolute = path.resolve(repository, file);
+        const relative = path.relative(repository, absolute);
+        require(relative && !relative.startsWith('..') && !path.isAbsolute(relative), 'Dirty path escapes checkout.');
+        require(existsSync(absolute) && lstatSync(absolute).isFile() && !lstatSync(absolute).isSymbolicLink(), 'This checkpoint supports retained regular files only.');
+        let bytes = readFileSync(absolute);
+        if (transported && file === 'package.json')
+            bytes = sourceManifestBytes(bytes);
+        digest.update(`path\0${file}\0file\0`);
+        digest.update(bytes);
+        digest.update('\0');
+    }
+    return digest.digest('hex');
+}
+function assertPins(repository, commit, version) {
+    const manifest = JSON.parse(runGit(repository, ['show', `${commit}:package.json`]));
+    const lock = JSON.parse(runGit(repository, ['show', `${commit}:package-lock.json`]));
+    require(manifest.devDependencies?.['codex-workflow-v2'] === version && !manifest.dependencies?.['codex-workflow-v2']
+        && workflowDependencyVersionAt(repository, commit) === version
+        && lock.packages?.['']?.devDependencies?.['codex-workflow-v2'] === version
+        && !lock.packages?.['']?.dependencies?.['codex-workflow-v2']
+        && lock.packages?.['node_modules/codex-workflow-v2']?.version === version, 'Exact source manifest and lock bindings are required.');
+}
+export function assertFailedCheckpointInstalled(repository, task, version) {
+    const versions = inspectWorkflowVersions(repository, [task.baseBranch]);
+    require([versions.declared, versions.locked, versions.installed, versions.currentBranch,
+        ...versions.milestoneBases.map(item => item.version)].every(value => value === version), `Every installed and Git version surface must equal ${version}.`);
+}
+export function failedCheckpointUpdateSource(repository, store, task, artifact, sourceHead = headCommit(repository), sourceBaseHead = runGit(repository, ['rev-parse', task.baseBranch]), transported = false) {
+    require(PACKAGE_VERSION === FAILED_CHECKPOINT_TARGET, 'Only the beta.14 to beta.14.1 repair is supported.');
+    require(task.status === 'awaiting_execution_authorization' && task.workspaceOwner === 'external', 'Expected an external failed Task awaiting its new Plan audit.');
+    require(readCorrectiveDecisionEvents(store, task).length === 0, 'A checkpoint with corrective decision history requires its own supported boundary.');
+    require(task.taskBranch && currentBranch(repository) === task.taskBranch, 'Expected the recorded Task branch.');
+    const failed = task.steps.filter(step => step.status === 'failed');
+    require(failed.length === 1 && !task.steps.some(step => step.status === 'in_progress'), 'Exactly one paused failed Step is required.');
+    const step = failed[0];
+    require(step.failurePause && step.evidence === null, 'Native failed-check evidence is required.');
+    require(task.planHash && task.briefHash, 'Current Brief and Plan are required.');
+    const taskRoot = store.taskRoot(task.projectId, task.id);
+    require(store.hashArtifact(taskRoot, 'brief.md') === task.briefHash && store.hashArtifact(taskRoot, 'plan.md') === task.planHash, 'Brief and Plan artifacts must match state.');
+    readVerifiedPlanArtifact(taskRoot, task.planHash, task.planHash);
+    const currentAudit = readPlanRiskAuditEvents(store, task).at(-1);
+    require(!currentAudit || currentAudit.planHash !== task.planHash
+        || currentAudit.decision === 'stop-escalate', 'The checkpoint must await its audit or retain a planning obstruction.');
+    assertPins(repository, sourceHead, FAILED_CHECKPOINT_SOURCE);
+    assertPins(repository, sourceBaseHead, FAILED_CHECKPOINT_SOURCE);
+    validateTaskHistory(repository, task, sourceHead);
+    const completed = task.steps.filter(item => item.status === 'completed');
+    const reviews = verifiedHistoricalStepReviewBindings(store, task);
+    require(completed.length > 0 && completed.every(item => item.evidence
+        && reviews.some(review => review.stepId === item.id && review.commitSha === item.evidence.commitSha)), 'Every retained completed Step must have immutable execution and independent review evidence.');
+    require(step.dependencies.every(id => completed.some(item => item.id === id)), 'Failed Step dependencies must be complete.');
+    const events = readRemediationEvents(store, task).filter(event => event.stepId === step.id && event.failureKind === 'checks-failed');
+    require(events.length === 1, 'This checkpoint supports exactly the first native check failure.');
+    const terminal = events.at(-1);
+    require(terminal && terminal.failureEvidence.completionCommit === sourceHead
+        && terminal.failureEvidence.dirtyWorktreeHash === step.failurePause.dirtyWorktreeHash, 'Native terminal failure must bind source HEAD and retained dirty bytes.');
+    const dirtyFiles = changedFiles(repository).sort();
+    require(dirtyFiles.length > 0 && !dirtyFiles.includes('package-lock.json')
+        && JSON.stringify(dirtyFiles) === JSON.stringify([...step.failurePause.dirtyFiles].sort()), 'Dirty paths must equal the native failure; dirty lockfile transport is unsupported.');
+    require(dirtyFiles.every(file => pathAllowed(file, step.allowedWrites) && !pathAllowed(file, step.forbiddenScope)), 'Retained dirty files must be inside the failed Step scope.');
+    const sourceDirtyHash = failedCheckpointDirtyHash(repository, dirtyFiles, transported);
+    require(sourceDirtyHash === terminal.failureEvidence.dirtyWorktreeHash, 'Product bytes changed since native failure.');
+    const posture = readTaskC1Posture(store, task);
+    const claim = readTaskHandoffEvents(store, task).filter(event => event.eventType === 'claim').at(-1);
+    require(posture.state === 'claimed' && claim && posture.claimant === claim.actor && claim.briefHash === task.briefHash, 'Original immutable Worker claim is required.');
+    return { protocol: 'failed-checkpoint-update-source-v1', projectId: task.projectId, taskId: task.id,
+        revision: task.revision, issuedAt: task.updatedAt, taskHash: hash(task), artifactsHash: filesHash(taskRoot),
+        knowledgeHash: hash(store.readKnowledgeMap(task.projectId)),
+        milestoneHash: task.milestoneId ? hash(store.readMilestone(task.projectId, task.milestoneId)) : null,
+        sourceHead, sourceBaseHead, taskBranch: task.taskBranch, baseBranch: task.baseBranch,
+        sourceVersion: FAILED_CHECKPOINT_SOURCE, targetVersion: FAILED_CHECKPOINT_TARGET, actor: claim.actor,
+        stepId: step.id, dirtyFiles, sourceDirtyHash, remediationEventId: terminal.eventId,
+        remediationEventHash: terminal.eventHash, artifact };
+}
+export function inspectFailedCheckpointTransport(repository, store, task, receipt, artifact) {
+    require(receipt?.protocol === 'failed-checkpoint-update-source-v1', 'Missing or foreign source receipt.');
+    const targetHead = headCommit(repository);
+    const base = runGit(repository, ['rev-parse', task.baseBranch]);
+    const target = inspectBoundedWorkflowDependencyCommit(repository, targetHead);
+    const baseTransport = inspectBoundedWorkflowDependencyCommit(repository, base);
+    require([targetHead, base].every(commit => runGit(repository, ['rev-list', '--parents', '-n', '1', commit]).split(' ').length === 2), 'Transport commits must have exactly one parent.');
+    require(target?.parentCommitSha === receipt.sourceHead && target.packageVersion === FAILED_CHECKPOINT_TARGET
+        && baseTransport?.parentCommitSha === receipt.sourceBaseHead && baseTransport.packageVersion === FAILED_CHECKPOINT_TARGET, 'Exactly one dependency-only transport is required on each bound branch.');
+    const reconstructed = failedCheckpointUpdateSource(repository, store, task, artifact, target.parentCommitSha, baseTransport.parentCommitSha, true);
+    require(canonicalJsonStringify(receipt) === canonicalJsonStringify(reconstructed), 'Source receipt no longer matches state, artifacts, product bytes, history or tarball.');
+    assertFailedCheckpointInstalled(repository, task, FAILED_CHECKPOINT_TARGET);
+    const binding = { protocol: 'failed-checkpoint-update-v1',
+        sourceHead: receipt.sourceHead, sourcePlanHash: task.planHash, stepId: receipt.stepId,
+        sourceDirtyHash: receipt.sourceDirtyHash, targetDirtyHash: failedCheckpointDirtyHash(repository, receipt.dirtyFiles),
+        dirtyFiles: receipt.dirtyFiles, remediationEventId: receipt.remediationEventId,
+        remediationEventHash: receipt.remediationEventHash, sourceReceiptHash: hash(receipt), artifactHash: artifact.sha256 };
+    return { receipt: reconstructed, target, baseTransport: base, targetHead, binding };
+}
+/** Revalidate the registered byte-preserving transport when a later corrective gate reads native failure evidence.
+ * Returns no authority and never changes the original failure record or its hash. */
+export function readFailedCheckpointDirtyTransport(store, repository, task, stepId, sourceHead, sourceDirtyHash) {
+    const records = (task.dependencyProvenanceRecoveries ?? []).filter(record => {
+        const binding = record.failedCheckpoint;
+        return binding?.stepId === stepId && binding.sourceHead === sourceHead && binding.sourceDirtyHash === sourceDirtyHash;
+    });
+    if (records.length === 0)
+        return null;
+    require(records.length === 1, 'Registered failed checkpoint is ambiguous.');
+    const record = records[0];
+    const binding = record.failedCheckpoint;
+    require(task.planHash, 'Current Plan is required to validate the historical checkpoint.');
+    readVerifiedPlanArtifact(store.taskRoot(task.projectId, task.id), binding.sourcePlanHash, task.planHash);
+    require(binding.protocol === 'failed-checkpoint-update-v1' && task.systemCommits.includes(record.commitSha)
+        && record.packageVersion === FAILED_CHECKPOINT_TARGET && record.packageName === 'codex-workflow-v2'
+        && record.parentCommitSha === sourceHead && JSON.stringify(record.files) === JSON.stringify(['package-lock.json', 'package.json']), 'Registered failed checkpoint dependency record is invalid.');
+    const inspected = inspectBoundedWorkflowDependencyCommit(repository, record.commitSha);
+    require(inspected?.parentCommitSha === sourceHead && inspected.packageVersion === FAILED_CHECKPOINT_TARGET, 'Registered failed checkpoint no longer identifies a dependency-only commit.');
+    require(headCommit(repository) === record.commitSha, 'Dirty checkpoint requires its exact transported HEAD.');
+    const terminal = readRemediationEvents(store, task).filter(event => event.stepId === stepId && event.failureKind === 'checks-failed').at(-1);
+    require(terminal?.eventId === binding.remediationEventId && terminal.eventHash === binding.remediationEventHash
+        && terminal.failureEvidence.completionCommit === sourceHead && terminal.failureEvidence.dirtyWorktreeHash === sourceDirtyHash, 'Registered failed checkpoint does not bind the terminal native failure.');
+    const dirty = changedFiles(repository).sort();
+    require(JSON.stringify(dirty) === JSON.stringify(binding.dirtyFiles)
+        && failedCheckpointDirtyHash(repository, dirty, true) === sourceDirtyHash
+        && failedCheckpointDirtyHash(repository, dirty) === binding.targetDirtyHash, 'Retained product bytes changed after the registered dependency transport.');
+    return { sourceHead, sourceDirtyHash, targetHead: record.commitSha, targetDirtyHash: binding.targetDirtyHash,
+        dirtyFiles: [...dirty], sourceReceiptHash: binding.sourceReceiptHash };
+}
+//# sourceMappingURL=failed-checkpoint-update.js.map

package/dist/src/failed-checkpoint-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failed-checkpoint-update.js","sourceRoot":"","sources":["../../src/failed-checkpoint-update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oCAAoC,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,sCAAsC,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACjH,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iBAAiB,CAAC;AAC1D,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,SAAS,OAAO,CAAC,SAAkB,EAAE,OAAe;IAClD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;AAClF,CAAC;AAiBD,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,CAAC,SAAiB,EAA2B,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACzG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,wCAAwC,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3B,CAAC;AACD,iHAAiH;AACjH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,mBAAmB,CAAC,KAAK,wBAAwB;WAC/E,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,mBAAmB,CAAC,EAAE,6DAA6D,CAAC,CAAC;IACnH,MAAM,GAAG,GAAG,oDAAoD,CAAC;IACjE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,gEAAgE,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,wBAAwB,GAAG,CAAC,CAAC,CAAC;AAC3E,CAAC;AACD,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,KAAwB,EAAE,WAAW,GAAG,KAAK;IACzG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtG,OAAO,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAC,CAAC;QAC9G,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EACnG,uDAAuD,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAW,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,WAAW,IAAI,IAAI,KAAK,cAAc;YAAE,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AACD,SAAS,UAAU,CAAC,UAAkB,EAAE,MAAc,EAAE,OAAe;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,mBAAmB,CAAC,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,mBAAmB,CAAC;WAC/G,2BAA2B,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,OAAO;WAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,mBAAmB,CAAC,KAAK,OAAO;WACvE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,mBAAmB,CAAC;WACzD,IAAI,CAAC,QAAQ,EAAE,CAAC,gCAAgC,CAAC,EAAE,OAAO,KAAK,OAAO,EACzE,uDAAuD,CAAC,CAAC;AAC7D,CAAC;AACD,MAAM,UAAU,+BAA+B,CAAC,UAAkB,EAAE,IAAe,EAAE,OAAe;IAClG,MAAM,QAAQ,GAAG,uBAAuB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,aAAa;QACrF,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACvF,sDAAsD,OAAO,GAAG,CAAC,CAAC;AACtE,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,UAAkB,EAAE,KAAqB,EAAE,IAAe,EACrG,QAAmD,EACnD,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,EACxG,WAAW,GAAG,KAAK;IACnB,OAAO,CAAC,eAAe,KAAK,wBAAwB,EAAE,oDAAoD,CAAC,CAAC;IAC5G,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,kCAAkC,IAAI,IAAI,CAAC,cAAc,KAAK,UAAU,EAC9F,+DAA+D,CAAC,CAAC;IACnE,OAAO,CAAC,4BAA4B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAC5D,oFAAoF,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,EAAE,6CAA6C,CAAC,CAAC;IACvI,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,2CAA2C,CAAC,CAAC;IAClG,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,QAAQ,EAC9H,4CAA4C,CAAC,CAAC;IAChD,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;WAC3D,YAAY,CAAC,QAAQ,KAAK,eAAe,EAAE,uEAAuE,CAAC,CAAC;IACzH,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC;IAAC,UAAU,CAAC,UAAU,EAAE,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAC/H,mBAAmB,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ;WAChE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,QAAS,CAAC,SAAS,CAAC,CAAC,EACtG,8FAA8F,CAAC,CAAC;IAClG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,4CAA4C,CAAC,CAAC;IAC7H,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,IAAI,KAAK,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC;IACrI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,kEAAkE,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,gBAAgB,KAAK,UAAU;WACvE,QAAQ,CAAC,eAAe,CAAC,iBAAiB,KAAK,IAAI,CAAC,YAAY,CAAC,iBAAiB,EACrF,yEAAyE,CAAC,CAAC;IAC7E,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;WACrE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,EAC1F,qFAAqF,CAAC,CAAC;IACzF,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAChH,4DAA4D,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,yBAAyB,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACvF,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EACpH,8CAA8C,CAAC,CAAC;IAClD,OAAO,EAAE,QAAQ,EAAE,oCAAoC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QACjG,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC;QAC3G,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACpG,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;QACpF,aAAa,EAAE,wBAAwB,EAAE,aAAa,EAAE,wBAAwB,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;QACpG,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,kBAAkB,EAAE,QAAQ,CAAC,OAAO;QAClF,oBAAoB,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;AACzD,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,UAAkB,EAAE,KAAqB,EAAE,IAAe,EACzG,OAAsC,EAAE,QAAmD;IAC3F,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,oCAAoC,EAAE,oCAAoC,CAAC,CAAC;IAC1G,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAAC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,sCAAsC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,sCAAsC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAClI,iDAAiD,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,cAAc,KAAK,wBAAwB;WACvG,aAAa,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC,cAAc,KAAK,wBAAwB,EACzH,yEAAyE,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,4BAA4B,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAClF,MAAM,CAAC,eAAe,EAAE,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,KAAK,sBAAsB,CAAC,aAAa,CAAC,EAC/E,uFAAuF,CAAC,CAAC;IAC3F,+BAA+B,CAAC,UAAU,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAkC,EAAE,QAAQ,EAAE,6BAA6B;QACtF,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,QAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtF,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,eAAe,EAAE,yBAAyB,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACpH,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9E,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AAED;qFACqF;AACrF,MAAM,UAAU,kCAAkC,CAAC,KAAqB,EAAE,UAAkB,EAAE,IAAe,EAC3G,MAAc,EAAE,UAAkB,EAAE,eAAuB;IAC3D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;QAC1E,MAAM,OAAO,GAAI,MAA+E,CAAC,gBAAgB,CAAC;QAClH,OAAO,OAAO,EAAE,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,IAAI,OAAO,CAAC,eAAe,KAAK,eAAe,CAAC;IACxH,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,4CAA4C,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAC3B,MAAM,OAAO,GAAI,MAA8E,CAAC,gBAAgB,CAAC;IACjH,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,iEAAiE,CAAC,CAAC;IAC1F,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzG,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,6BAA6B,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;WACtG,MAAM,CAAC,cAAc,KAAK,wBAAwB,IAAI,MAAM,CAAC,WAAW,KAAK,mBAAmB;WAChG,MAAM,CAAC,eAAe,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,mBAAmB,EAAC,cAAc,CAAC,CAAC,EACjI,4DAA4D,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,sCAAsC,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,OAAO,CAAC,SAAS,EAAE,eAAe,KAAK,UAAU,IAAI,SAAS,CAAC,cAAc,KAAK,wBAAwB,EACxG,6EAA6E,CAAC,CAAC;IACjF,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7I,OAAO,CAAC,QAAQ,EAAE,OAAO,KAAK,OAAO,CAAC,kBAAkB,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,oBAAoB;WAC1G,QAAQ,CAAC,eAAe,CAAC,gBAAgB,KAAK,UAAU,IAAI,QAAQ,CAAC,eAAe,CAAC,iBAAiB,KAAK,eAAe,EAC7H,yEAAyE,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;WAC/D,yBAAyB,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,eAAe;WACtE,yBAAyB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,OAAO,CAAC,eAAe,EAC3E,2EAA2E,CAAC,CAAC;IAC/E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe;QAC1G,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;AAC3E,CAAC"}

package/dist/src/lifecycle/corrective-replan-credential-core.d.ts

@@ -66,7 +66,9 @@ export interface CorrectiveReplanCredentialCorePorts {
 export interface CorrectiveReplanCredentialKernel {
     issuePlanValidation(input: unknown): Result<JsonRecord>;
     issueHumanChallenge(input: unknown): Result<JsonRecord>;
+    issueDelegatedChallenge(input: unknown): Result<JsonRecord>;
     confirmHuman(input: unknown): Result<JsonRecord>;
+    confirmDelegated(input: unknown): Result<JsonRecord>;
     issueReceipt(input: unknown): Result<JsonRecord>;
     verifyReceipt(input: unknown): Verification<JsonRecord>;
     materializeStoredEvent(input: unknown): Result<JsonRecord>;

package/dist/src/lifecycle/corrective-replan-credential-core.js

@@ -27,6 +27,8 @@ export function createCorrectiveReplanCredentialKernel(ports) {
     return deepFreeze({
         issuePlanValidation: (input) => totalResult(() => issuePlanValidation(issuer, input)),
         issueHumanChallenge: (input) => totalResult(() => issueHumanChallenge(issuer, input)),
+        issueDelegatedChallenge: (input) => totalResult(() => issueDelegatedChallenge(issuer, input)),
+        confirmDelegated: (input) => totalResult(() => confirmDelegated(issuer, input)),
         confirmHuman: (input) => totalResult(() => confirmHuman(issuer, input)),
         issueReceipt: (input) => totalResult(() => issueReceipt(issuer, input)),
         verifyReceipt: (input) => totalVerification(() => verifyReceipt(issuer, input)),
@@ -95,10 +97,11 @@ const issuePlanValidation = (issuer, input) => {
         const values = { ...clone(base), planValidationHash };
         if (!canonicalManifestValues(values, true))
             return rejected('credential.binding.values-invalid', '/binding/values', 'binding');
+        const delegated = snapshot.delegatedAuthority;
         const capability = { id: 'capability.task.corrective-replan', version: 1,
-            issuer: { kind: 'human', identityHash: values.humanPrincipalIdentityHash }, source: 'human-confirmation',
+            issuer: { kind: delegated ? 'delegate' : 'human', identityHash: delegated ? values.actorIdentityHash : values.humanPrincipalIdentityHash }, source: delegated ? 'delegation-grant' : 'human-confirmation',
             scope: { transitionId: values.transitionId, taskId: values.taskId, candidatePlanHash: values.candidatePlanHash,
-                manifestSha256: correctiveReplanBindingManifest.manifestSha256 }, delegation: 'forbidden' };
+                manifestSha256: correctiveReplanBindingManifest.manifestSha256 }, delegation: delegated ?? 'forbidden' };
         const bindingBase = { schemaVersion: 1, manifestRef: { id: correctiveReplanBindingManifest.id, version: 1 },
             manifestSha256: correctiveReplanBindingManifest.manifestSha256, values, capability };
         const binding = { ...bindingBase, bindingSha256: hashCanonical(bindingBase) };
@@ -127,7 +130,7 @@ const issuePlanValidation = (issuer, input) => {
             kernel.preparations.delete(preparationKey);
     }
 };
-const issueHumanChallenge = (issuer, input) => {
+const issueHumanChallenge = (issuer, input, delegated = false) => {
     const kernel = kernels.get(object(issuer));
     if (!kernel)
         return rejected('credential.provenance.invalid', '/', 'provenance');
@@ -137,6 +140,8 @@ const issueHumanChallenge = (issuer, input) => {
     const plan = kernel.plans.get(handle);
     if (!plan)
         return rejected('credential.provenance.invalid', '/planValidation', 'provenance');
+    if (Boolean(plan.snapshot.delegatedAuthority) !== delegated)
+        return rejected('credential.authority.mode-mismatch', '/planValidation', 'authority');
     if (!activePreparation(kernel, plan))
         return rejected('credential.preparation.superseded', '/planValidation', 'provenance');
     if (kernel.challenged.has(handle))
@@ -162,8 +167,11 @@ const issueHumanChallenge = (issuer, input) => {
     kernel.challenges.set(challengeHandle, deepFreeze({ plan, challenge }));
     kernel.challenged.add(handle);
     return accepted({ handle: challengeHandle,
-        delivery: { kind: 'corrective-replan-human-challenge-delivery', version: 1, challengeId, confirmationCode: code, expiresAtMs } });
+        delivery: delegated
+            ? { kind: 'corrective-replan-delegation-binding', version: 1, challengeId, expiresAtMs }
+            : { kind: 'corrective-replan-human-challenge-delivery', version: 1, challengeId, confirmationCode: code, expiresAtMs } });
 };
+const issueDelegatedChallenge = (issuer, input) => issueHumanChallenge(issuer, input, true);
 const confirmHuman = (issuer, input) => {
     const kernel = kernels.get(object(issuer));
     if (!kernel)
@@ -181,6 +189,8 @@ const confirmHuman = (issuer, input) => {
         return rejected('credential.preparation.superseded', '/challenge', 'provenance');
     if (kernel.confirmed.has(challengeHandle))
         return rejected('credential.provenance.invalid', '/challenge', 'provenance');
+    if (challenge.plan.snapshot.delegatedAuthority)
+        return rejected('credential.authority.mode-mismatch', '/challenge', 'authority');
     const candidate = confirmation;
     const now = safeTime(kernel.ports.now());
     if (now === null)
@@ -202,6 +212,29 @@ const confirmHuman = (issuer, input) => {
     kernel.confirmed.add(challengeHandle);
     return accepted({ handle: handle, projection });
 };
+// The authority comes exclusively from the Core snapshot, never from caller assertions.
+const confirmDelegated = (issuer, input) => {
+    const kernel = kernels.get(object(issuer));
+    if (!kernel || !exactKeys(input, ['challenge']))
+        return rejected('credential.provenance.invalid', '/', 'provenance');
+    const handle = object(input.challenge);
+    const challenge = kernel.challenges.get(handle);
+    if (!challenge || !challenge.plan.snapshot.delegatedAuthority || kernel.confirmed.has(handle))
+        return rejected('credential.authority.mode-mismatch', '/challenge', 'authority');
+    const freshness = receiptFreshnessIssue(kernel, challenge.plan);
+    if (freshness)
+        return rejected(freshness.issueId, freshness.path, freshness.reasonClass);
+    const now = safeTime(kernel.ports.now());
+    if (now === null || now < number(challenge.challenge.issuedAtMs) || now >= number(challenge.challenge.expiresAtMs))
+        return rejected('credential.delegation.expired', '/challenge', 'time');
+    const projection = { challengeId: challenge.challenge.challengeId, challengeHash: challenge.challenge.challengeHash,
+        bindingSha256: challenge.plan.binding.bindingSha256, delegatedAuthority: challenge.plan.snapshot.delegatedAuthority,
+        confirmedAtMs: now };
+    const confirmation = opaque();
+    kernel.confirmations.set(confirmation, deepFreeze({ challenge, projection }));
+    kernel.confirmed.add(handle);
+    return accepted({ handle: confirmation, projection });
+};
 const issueReceipt = (issuer, input) => {
     const kernel = kernels.get(object(issuer));
     if (!kernel)
@@ -254,8 +287,10 @@ const issueReceipt = (issuer, input) => {
         expiresAtMs: plan.attestation.expiresAtMs };
     const base = { schemaVersion: 1, receiptId, domain: 'codex-workflow/corrective-replan-receipt/v1',
         binding: plan.binding, validation, audit: { riskAuditHash: values.riskAuditHash, riskAuditorIdentityHash: values.riskAuditorIdentityHash },
-        human: { challengeId: confirmation.projection.challengeId, challengeHash: confirmation.projection.challengeHash,
-            humanPrincipalIdentityHash: confirmation.projection.humanPrincipalIdentityHash, confirmedAtMs: confirmation.projection.confirmedAtMs },
+        ...(plan.snapshot.delegatedAuthority
+            ? { delegated: { authority: plan.snapshot.delegatedAuthority, authorizedAtMs: confirmation.projection.confirmedAtMs } }
+            : { human: { challengeId: confirmation.projection.challengeId, challengeHash: confirmation.projection.challengeHash,
+                    humanPrincipalIdentityHash: confirmation.projection.humanPrincipalIdentityHash, confirmedAtMs: confirmation.projection.confirmedAtMs } }),
         supersession: { priorGrantHash: snapshotGrant.grantHash, disposition: 'superseded' },
         issuedAtMs: now, expiresAtMs };
     const withDomain = { ...base, domainHash: hashCanonical(base) };
@@ -348,11 +383,12 @@ const verifyStoredEvent = (issuer, input) => {
         return verificationRejected('credential.event.mismatch', '/candidate', 'integrity');
     return verified(recordValue.event);
 };
-const functions = [issuePlanValidation, issueHumanChallenge, confirmHuman, issueReceipt, verifyReceipt, materializeStoredEvent, verifyStoredEvent];
+const functions = [issuePlanValidation, issueHumanChallenge, confirmHuman, issueReceipt, verifyReceipt, materializeStoredEvent, verifyStoredEvent, issueDelegatedChallenge, confirmDelegated];
 const ids = ['credential-materializer.corrective-replan.plan-validation-attestation', 'credential-materializer.corrective-replan.expected-human-challenge',
     'credential-verifier.corrective-replan.human-confirmation', 'credential-materializer.corrective-replan.receipt',
     'credential-verifier.corrective-replan.receipt', 'credential-materializer.corrective-replan.stored-plan-validation-event',
-    'credential-verifier.corrective-replan.stored-plan-validation-event'];
+    'credential-verifier.corrective-replan.stored-plan-validation-event',
+    'credential-materializer.corrective-replan.delegated-binding', 'credential-verifier.corrective-replan.delegated-authorization'];
 export const correctiveReplanCredentialFunctionBindings = deepFreeze(ids.map((id, index) => ({ id, version: 1,
     kind: id.includes('materializer') ? 'materializer' : 'verifier', implementationId: `implementation.${id}`,
     implementationVersion: 1, wiring: 'invoked', callable: functions[index] })));
@@ -377,7 +413,7 @@ function receiptFreshnessIssue(kernel, plan) {
     return loaded.snapshotBindingHash === plan.snapshotBindingHash ? null : issue('credential.receipt.snapshot-stale', '/snapshotBindingHash', 'binding');
 }
 function snapshotIssue(snapshot, taskId) {
-    if (!exactKeys(snapshot, ['snapshotVersion', 'bindingManifest', 'worktree', 'baseValues', 'validationExpectation', 'priorPlanAuthorization']) || snapshot.snapshotVersion !== 2)
+    if (!exactKeys(snapshot, ['snapshotVersion', 'bindingManifest', 'worktree', 'baseValues', 'validationExpectation', 'priorPlanAuthorization', ...(snapshot.delegatedAuthority ? ['delegatedAuthority'] : [])]) || snapshot.snapshotVersion !== 2)
         return issue('credential.snapshot.invalid', '/snapshot', 'schema');
     const base = record(snapshot.baseValues);
     const expected = record(snapshot.validationExpectation);