gh-inari 0.17.0 → 0.18.0

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "inari",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Governed GitHub Issue/PR/template workflows via the inari CLI. Prefer inari over raw gh for operations it owns; use inari skill for operational playbooks.",
   "skills": "skills/inari"
 }

package/dist/admission/authorization.d.ts

@@ -2,8 +2,18 @@ import type { LocalSessionBinding } from "../local-control/session-binding.js";
 import type { LocalExecutorEvidenceRequest } from "../local-control/executor-http.js";
 import { type ExecutionIntent } from "../local-control/execution-intent.js";
 import { type Delegator } from "../agent-authority/delegator.js";
+import type { SessionCertificateRepository } from "../agent-authority/session-certificate.js";
 import { type AuthorizedExecution } from "../authorized-execution.js";
-import { type ObserveLocalBranchInput } from "../cli/runtime/branch-observation.js";
+import { type ChangeProjectionResult } from "../change.js";
+import { type LocalBranchPolicyInput } from "../cli/runtime/branch-observation.js";
+import type { LocalExecutorBranchPolicyRequest } from "../local-control/executor-http.js";
+import { type RuntimeFailure, type RuntimeFailureReason, type RuntimeFailureStage } from "../runtime-contracts/runtime-failure.js";
+/** Bounded Admission denial carrying the owner stage and catalog reason (#1180). */
+export declare class AdmissionAuthorizationError extends Error {
+    readonly code: RuntimeFailureReason;
+    readonly runtimeFailure: RuntimeFailure;
+    constructor(stage: RuntimeFailureStage, code: RuntimeFailureReason, message: string);
+}
 /** Reads current Executor evidence through the neutral Executor client protocol. */
 export type AdmissionEvidenceReader = (request: LocalExecutorEvidenceRequest) => Promise<unknown>;
 export interface AdmissionAuthorizationOptions {
@@ -11,14 +21,49 @@ export interface AdmissionAuthorizationOptions {
     readonly readEvidence: AdmissionEvidenceReader;
     readonly environment?: NodeJS.ProcessEnv;
     readonly now?: () => Date;
-    /** Public owner-port observation supplied by the caller, without provider credentials. */
-    readonly branchObservation?: ObserveLocalBranchInput;
+    /**
+     * Reads the current repository branch-policy input from the Executor owner
+     * (#1179). Admission verifies every observed Session binding against this
+     * current evidence; it never accepts a caller-supplied observation.
+     */
+    readonly readBranchPolicy?: (request: LocalExecutorBranchPolicyRequest) => Promise<unknown>;
 }
+/**
+ * Current, owner-acquired branch-policy input for one governed Implementation.
+ *
+ * #1213: when the owner projects the Implementation's canonical Source set,
+ * Admission attaches the certificate-safe projection of the current authorized
+ * Implementation carrying that set. The Session launcher signs it as the upper
+ * bound of Source-rooted change.* capabilities; the Session task stays the
+ * Implementation. The projected set must equal the owner's parsed set.
+ */
+export declare function currentBranchPolicyInput(repository: SessionCertificateRepository, implementation: number, options: AdmissionAuthorizationOptions, stage: RuntimeFailureStage): Promise<LocalBranchPolicyInput>;
 export interface AdmittedSession {
     readonly id: string;
     readonly status: string;
     readonly exp: number;
 }
+/**
+ * Repository-bound Session readiness (#1182): the same current Executor
+ * repository binding and protected-ref trust evidence Session registration
+ * requires, for the Authority the caller expects Admission to have pinned. It
+ * admits nothing and stores nothing; every failure throws a bounded denial.
+ */
+export declare function observeRepositoryReadiness(repository: SessionCertificateRepository, expectedAuthority: {
+    readonly id: string;
+    readonly publicKeyFingerprint: string;
+}, options: AdmissionAuthorizationOptions): Promise<void>;
+/**
+ * A read on behalf of an active Session (#1181): the Session exists, is active
+ * and is bound to exactly the requested repository. It authorizes no effect.
+ */
+export declare function requireActiveSessionRepository(sessionId: string, repository: SessionCertificateRepository, options: AdmissionAuthorizationOptions): LocalSessionBinding;
+/**
+ * The current Change projection of the Session's Implementation (#1181), from
+ * the same Executor evidence and Authority/repository checks every execution
+ * uses. Read-only; it authorizes nothing.
+ */
+export declare function currentSessionChange(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<ChangeProjectionResult>;
 /** Admits a validated Session binding against current Executor trust evidence. */
 export declare function admitSession(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<AdmittedSession>;
 /** Closes a validated Session binding against current Executor trust evidence. */

package/dist/admission/authorization.js

@@ -20,25 +20,80 @@ import { createAuthorizedExecution } from "../authorized-execution.js";
 import { changeReadRequest } from "../change-execution-port.js";
 import { validateChangeProjectionResult } from "../change.js";
 import { tryAuthorizeImplementation } from "../implementation-authorization.js";
-import { projectImplementationSessionAuthorizationBinding } from "../implementation-session-binding.js";
+import { projectImplementationSessionAuthorizationBinding, } from "../implementation-session-binding.js";
 import { tryProjectImplementationScope } from "../implementation-scope-projection.js";
 import { assertTrustedExecution, validateIssuerRepositoryIdentity, } from "../github/effect-authorizer.js";
-import { observeLocalBranch } from "../cli/runtime/branch-observation.js";
-function requireCurrentBranchObservation(binding, options) {
+import { observeLocalBranch, validateLocalBranchPolicyInput, } from "../cli/runtime/branch-observation.js";
+import { runtimeFailure, } from "../runtime-contracts/runtime-failure.js";
+/** Bounded Admission denial carrying the owner stage and catalog reason (#1180). */
+export class AdmissionAuthorizationError extends Error {
+    code;
+    runtimeFailure;
+    constructor(stage, code, message) {
+        super(message);
+        this.name = "AdmissionAuthorizationError";
+        this.code = code;
+        this.runtimeFailure = runtimeFailure(stage, code);
+    }
+}
+function deny(stage, code, message) {
+    throw new AdmissionAuthorizationError(stage, code, message);
+}
+/** Current owner-read branch-policy input; the owner never supplies an Implementation binding. */
+async function readCurrentBranchPolicyInput(repository, implementation, options, stage) {
+    if (options.readBranchPolicy === undefined)
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_MISSING", "Current repository branch observation is missing.");
+    const input = validateLocalBranchPolicyInput(await options.readBranchPolicy({ version: 1, repository: evidenceRepository(repository), implementation }));
+    if (input === undefined || input.implementationBinding !== undefined)
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_STALE", "Current repository branch observation is invalid or stale.");
+    return input;
+}
+/**
+ * Current, owner-acquired branch-policy input for one governed Implementation.
+ *
+ * #1213: when the owner projects the Implementation's canonical Source set,
+ * Admission attaches the certificate-safe projection of the current authorized
+ * Implementation carrying that set. The Session launcher signs it as the upper
+ * bound of Source-rooted change.* capabilities; the Session task stays the
+ * Implementation. The projected set must equal the owner's parsed set.
+ */
+export async function currentBranchPolicyInput(repository, implementation, options, stage) {
+    const input = await readCurrentBranchPolicyInput(repository, implementation, options, stage);
+    if (input.sources === undefined)
+        return input;
+    const pinned = options.runtimeAuthority;
+    const subject = {
+        repository,
+        authority: { id: pinned.id, publicKeyFingerprint: delegatorPublicKeyFingerprint(pinned.key) },
+    };
+    const evidence = validateEvidence(await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(repository),
+        authorityId: pinned.id,
+        issue: implementation,
+        implementationIssue: implementation,
+    }), subject, pinned, stage);
+    const current = currentImplementationAuthorization(evidence, { kind: "issue", number: implementation }, true, stage);
+    if (current.binding.sources === undefined ||
+        canonicalJsonString(current.binding.sources) !==
+            canonicalJsonString(input.sources))
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_STALE", "Current Implementation Source evidence is inconsistent.");
+    return Object.freeze({ ...input, implementationBinding: current.binding });
+}
+async function requireCurrentBranchObservation(binding, options, stage) {
     if (binding.branchObservation === undefined)
         return;
-    if (options.branchObservation === undefined)
-        throw new Error("Current repository branch observation is missing.");
+    const input = await readCurrentBranchPolicyInput(binding.repository, binding.task.number, options, stage);
     let current;
     try {
-        current = observeLocalBranch(options.branchObservation);
+        current = observeLocalBranch({ ...input, observedBranch: binding.branchObservation.observedBranch });
     }
     catch {
-        throw new Error("Current repository branch observation is invalid or stale.");
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_STALE", "Current repository branch observation is invalid or stale.");
     }
     if (canonicalJsonString(current) !==
         canonicalJsonString(binding.branchObservation))
-        throw new Error("Current repository branch observation contradicts Session binding.");
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_CONTRADICTED", "Current repository branch observation contradicts Session binding.");
 }
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -46,12 +101,29 @@ function isRecord(value) {
 function exactKeys(value, allowed) {
     return Object.keys(value).every((key) => allowed.includes(key));
 }
-function pinnedRuntimeAuthority(value) {
+function pinnedRuntimeAuthority(value, stage) {
     const result = validateDelegator(value);
     if (!result.valid || result.value === undefined)
-        throw new Error("Public Runtime Authority trust is invalid.");
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Public Runtime Authority trust is invalid.");
     return result.value;
 }
+function requirePinnedAuthorityMatch(current, binding, pinnedAuthority, stage) {
+    if (current.id !== binding.authority.id ||
+        delegatorPublicKeyFingerprint(current.key) !== binding.authority.publicKeyFingerprint ||
+        canonicalJsonString(current) !==
+            canonicalJsonString(pinnedAuthority))
+        deny(stage, "ADMISSION_RUNTIME_AUTHORITY_MISMATCH", "Current Runtime Authority trust does not match Admission configuration.");
+}
+function requireAuthorityRef(authority, stage) {
+    if (!isRecord(authority) ||
+        !exactKeys(authority, ["ref", "sha"]) ||
+        typeof authority.ref !== "string" ||
+        !/^refs\/heads\/[A-Za-z0-9._/-]+$/u.test(authority.ref) ||
+        typeof authority.sha !== "string" ||
+        !/^[a-f0-9]{40}$/u.test(authority.sha))
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Executor Authority evidence is malformed.");
+    return { ref: authority.ref, sha: authority.sha };
+}
 function sameRepository(left, right) {
     if (!isRecord(left))
         return false;
@@ -114,32 +186,21 @@ function readTreeDelta(intent) {
         changes: request.changes.map((change) => ({ operation: "modify", path: change.path })),
     };
 }
-function validateEvidence(value, binding, pinnedAuthority) {
+function validateEvidence(value, binding, pinnedAuthority, stage = "implementation-admission") {
     if (!isRecord(value) ||
         !exactKeys(value, ["repository", "authority", "runtimeAuthority", "change", "implementation", "reviewEvidence"]))
-        throw new Error("Executor evidence response is malformed.");
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Executor evidence response is malformed.");
     const repositoryResult = validateIssuerRepositoryIdentity(value.repository);
     if (!repositoryResult.valid ||
         repositoryResult.value === undefined ||
         !sameRepository(repositoryResult.value, binding.repository))
-        throw new Error("Executor repository evidence does not match Session.");
-    const authority = value.authority;
-    if (!isRecord(authority) ||
-        !exactKeys(authority, ["ref", "sha"]) ||
-        typeof authority.ref !== "string" ||
-        !/^refs\/heads\/[A-Za-z0-9._/-]+$/u.test(authority.ref) ||
-        typeof authority.sha !== "string" ||
-        !/^[a-f0-9]{40}$/u.test(authority.sha))
-        throw new Error("Executor Authority evidence is malformed.");
-    const runtime = pinnedRuntimeAuthority(value.runtimeAuthority);
-    if (runtime.id !== binding.authority.id ||
-        delegatorPublicKeyFingerprint(runtime.key) !== binding.authority.publicKeyFingerprint ||
-        canonicalJsonString(runtime) !==
-            canonicalJsonString(pinnedAuthority))
-        throw new Error("Current Runtime Authority trust does not match Admission configuration.");
+        deny(stage, "ADMISSION_REPOSITORY_MISMATCH", "Executor repository evidence does not match Session.");
+    const authority = requireAuthorityRef(value.authority, stage);
+    const runtime = pinnedRuntimeAuthority(value.runtimeAuthority, stage);
+    requirePinnedAuthorityMatch(runtime, binding, pinnedAuthority, stage);
     const projection = validateChangeProjectionResult(value.change);
     if (!projection.valid || projection.projection === undefined)
-        throw new Error("Current Change evidence is malformed.");
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Current Change evidence is malformed.");
     if (!isRecord(value.implementation) ||
         !exactKeys(value.implementation, [
             "implementation",
@@ -150,37 +211,27 @@ function validateEvidence(value, binding, pinnedAuthority) {
             "change",
             "pullRequest",
         ]))
-        throw new Error("Current Implementation evidence is malformed.");
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Current Implementation evidence is malformed.");
     return {
         repository: repositoryResult.value,
-        authority: { ref: authority.ref, sha: authority.sha },
+        authority,
         change: projection.projection,
         implementation: value.implementation,
         ...(value.reviewEvidence === undefined ? {} : { reviewEvidence: value.reviewEvidence }),
     };
 }
-function validateTrustEvidence(value, binding, pinnedAuthority) {
+function validateTrustEvidence(value, subject, pinnedAuthority) {
+    const stage = "trust-evidence";
     if (!isRecord(value) || !exactKeys(value, ["repository", "authority", "runtimeAuthority"]))
-        throw new Error("Executor Runtime Authority evidence is malformed.");
-    if (!sameRepository(value.repository, binding.repository))
-        throw new Error("Executor repository evidence does not match Session.");
-    const authority = value.authority;
-    if (!isRecord(authority) ||
-        !exactKeys(authority, ["ref", "sha"]) ||
-        typeof authority.ref !== "string" ||
-        !/^refs\/heads\/[A-Za-z0-9._/-]+$/u.test(authority.ref) ||
-        typeof authority.sha !== "string" ||
-        !/^[a-f0-9]{40}$/u.test(authority.sha))
-        throw new Error("Executor Authority evidence is malformed.");
-    const current = pinnedRuntimeAuthority(value.runtimeAuthority);
-    if (current.id !== binding.authority.id ||
-        delegatorPublicKeyFingerprint(current.key) !== binding.authority.publicKeyFingerprint ||
-        canonicalJsonString(current) !==
-            canonicalJsonString(pinnedAuthority))
-        throw new Error("Current Runtime Authority trust does not match Admission configuration.");
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Executor Runtime Authority evidence is malformed.");
+    if (!sameRepository(value.repository, subject.repository))
+        deny(stage, "ADMISSION_REPOSITORY_MISMATCH", "Executor repository evidence does not match Session.");
+    requireAuthorityRef(value.authority, stage);
+    const current = pinnedRuntimeAuthority(value.runtimeAuthority, stage);
+    requirePinnedAuthorityMatch(current, subject, pinnedAuthority, stage);
     return current;
 }
-function currentImplementationAuthorization(evidence, binding) {
+function currentImplementationAuthorization(evidence, task, includeSources, stage = "implementation-admission") {
     const implementationEvidence = evidence.implementation;
     const authorizationInput = {
         implementation: implementationEvidence.implementation,
@@ -190,17 +241,59 @@ function currentImplementationAuthorization(evidence, binding) {
         readiness: implementationEvidence.readiness,
     };
     const authorization = tryAuthorizeImplementation(authorizationInput);
-    if (!authorization.valid || authorization.status !== "authorized" || authorization.authorization === undefined)
-        throw new Error("Current Implementation is not authorized.");
+    if (!authorization.valid ||
+        authorization.status !== "authorized" ||
+        authorization.authorization === undefined ||
+        authorization.contract === undefined)
+        deny(stage, "ADMISSION_IMPLEMENTATION_UNAUTHORIZED", "Current Implementation is not authorized.");
     const currentInput = { ...authorizationInput, authorization: authorization.authorization };
-    const bindingProjection = projectImplementationSessionAuthorizationBinding({
-        ...currentInput,
-        task: binding.task,
-    });
+    let bindingProjection;
+    try {
+        bindingProjection = projectImplementationSessionAuthorizationBinding({
+            ...currentInput,
+            task,
+            ...(includeSources ? { includeSources: true } : {}),
+        });
+    }
+    catch {
+        deny(stage, "ADMISSION_IMPLEMENTATION_UNAUTHORIZED", "Current Implementation is not authorized.");
+    }
     const scope = tryProjectImplementationScope(currentInput);
     if (!scope.valid || scope.projection === undefined)
-        throw new Error("Current Implementation scope is unavailable.");
-    return { binding: bindingProjection, scope: scope.projection };
+        deny(stage, "ADMISSION_IMPLEMENTATION_SCOPE_UNAVAILABLE", "Current Implementation scope is unavailable.");
+    return { binding: bindingProjection, scope: scope.projection, sources: authorization.contract.sources };
+}
+const CHANGE_OPERATIONS = new Set([
+    "change.show",
+    "change.issue",
+    "change.ready",
+    "change.abort",
+    "change.merge",
+]);
+function sameRepositorySource(source, repository, issue) {
+    return (source.repositoryHost.toLowerCase() === "github.com" &&
+        source.repositoryId === repository.id &&
+        source.number === issue);
+}
+/**
+ * #1213: a Change operation's root must be an exact same-repository member of
+ * the signed Session Source set. There is no primary Source. The task-bound
+ * compatibility claim of a Source-bound Session is never a Change root. A
+ * legacy Session without a signed Source set keeps its task-rooted identity.
+ */
+function requireSignedChangeRoot(binding, issue) {
+    const signed = binding.implementationBinding?.sources;
+    if (signed === undefined) {
+        if (binding.task.number !== issue)
+            deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Execution task does not match Session.");
+    }
+    else if (!signed.some((source) => sameRepositorySource(source, binding.repository, issue)))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Change root is not a Session Source.");
+}
+/** The Change root must also still be a same-repository Source of the current Implementation contract. */
+function requireCurrentChangeRoot(binding, issue, currentSources) {
+    if (!currentSources.some((source) => sameRepositorySource(source, binding.repository, issue)))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Change root is not a current Implementation Source.");
 }
 async function currentTrust(binding, options) {
     const evidence = await options.readEvidence({
@@ -210,9 +303,65 @@ async function currentTrust(binding, options) {
     });
     return validateTrustEvidence(evidence, binding, options.runtimeAuthority);
 }
+/**
+ * Repository-bound Session readiness (#1182): the same current Executor
+ * repository binding and protected-ref trust evidence Session registration
+ * requires, for the Authority the caller expects Admission to have pinned. It
+ * admits nothing and stores nothing; every failure throws a bounded denial.
+ */
+export async function observeRepositoryReadiness(repository, expectedAuthority, options) {
+    const pinned = options.runtimeAuthority;
+    if (pinned.id !== expectedAuthority.id ||
+        delegatorPublicKeyFingerprint(pinned.key) !== expectedAuthority.publicKeyFingerprint)
+        deny("trust-evidence", "ADMISSION_RUNTIME_AUTHORITY_MISMATCH", "The Authority Admission pins differs from the configured setup Authority.");
+    const subject = {
+        repository,
+        authority: { id: pinned.id, publicKeyFingerprint: expectedAuthority.publicKeyFingerprint },
+    };
+    const evidence = await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(repository),
+        authorityId: pinned.id,
+    });
+    validateTrustEvidence(evidence, subject, pinned);
+}
+/**
+ * A read on behalf of an active Session (#1181): the Session exists, is active
+ * and is bound to exactly the requested repository. It authorizes no effect.
+ */
+export function requireActiveSessionRepository(sessionId, repository, options) {
+    const stored = readAdmissionSession(sessionId, options.runtimeAuthority, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    if (stored === undefined || stored.status !== "active")
+        deny("implementation-admission", "ADMISSION_SESSION_UNAVAILABLE", "Session is unavailable.");
+    const binding = stored.record.binding;
+    if (binding.repository.id !== repository.id ||
+        binding.repository.name.toLocaleLowerCase("en-US") !== repository.name.toLocaleLowerCase("en-US"))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "The read repository does not match the Session.");
+    return binding;
+}
+/**
+ * The current Change projection of the Session's Implementation (#1181), from
+ * the same Executor evidence and Authority/repository checks every execution
+ * uses. Read-only; it authorizes nothing.
+ */
+export async function currentSessionChange(binding, options) {
+    if (binding.task.kind !== "issue")
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "The Session has no Implementation task.");
+    const evidence = validateEvidence(await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(binding.repository),
+        authorityId: binding.authority.id,
+        issue: binding.task.number,
+        implementationIssue: binding.task.number,
+    }), binding, options.runtimeAuthority);
+    return evidence.change;
+}
 /** Admits a validated Session binding against current Executor trust evidence. */
 export async function admitSession(binding, options) {
-    requireCurrentBranchObservation(binding, options);
+    await requireCurrentBranchObservation(binding, options, "session-registration");
     const current = await currentTrust(binding, options);
     const snapshot = createAdmissionSession(binding, current, {
         environment: options.environment,
@@ -240,18 +389,23 @@ export async function authorizeExecutionIntent(intent, sessionId, options) {
         now: options.now?.(),
     });
     if (stored === undefined || stored.status !== "active")
-        throw new Error("Session is unavailable.");
+        deny("implementation-admission", "ADMISSION_SESSION_UNAVAILABLE", "Session is unavailable.");
     const binding = stored.record.binding;
-    requireCurrentBranchObservation(binding, options);
+    await requireCurrentBranchObservation(binding, options, "implementation-admission");
     if (binding.branchObservation !== undefined &&
         intent.operation === "branch.advance" &&
         intent.request.branch !== binding.branchObservation.expectedBranch)
-        throw new Error("Branch advance does not match the Session policy branch.");
+        deny("implementation-admission", "ADMISSION_BRANCH_SCOPE_DENIED", "Branch advance does not match the Session policy branch.");
     if (!intentRepositoryMatchesBinding(intent.repository, binding.repository))
-        throw new Error("Execution repository does not match Session.");
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Execution repository does not match Session.");
     const issue = executionIntentIssue(intent);
-    if (issue === undefined || binding.task.kind !== "issue" || binding.task.number !== issue)
-        throw new Error("Execution task does not match Session.");
+    const changeOperation = CHANGE_OPERATIONS.has(intent.operation);
+    // The Implementation task is the Session identity; a Change operation's root
+    // is validated below against current and signed Source evidence instead.
+    if (issue === undefined || binding.task.kind !== "issue" || (!changeOperation && binding.task.number !== issue))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Execution task does not match Session.");
+    if (changeOperation)
+        requireSignedChangeRoot(binding, issue);
     const evidenceValue = await options.readEvidence({
         version: 1,
         repository: evidenceRepository(binding.repository),
@@ -260,7 +414,17 @@ export async function authorizeExecutionIntent(intent, sessionId, options) {
         implementationIssue: binding.task.number,
     });
     const evidence = validateEvidence(evidenceValue, binding, options.runtimeAuthority);
-    const current = currentImplementationAuthorization(evidence, binding);
+    const sourceBound = binding.implementationBinding?.sources !== undefined;
+    const current = currentImplementationAuthorization(evidence, binding.task, sourceBound);
+    if (sourceBound &&
+        (binding.implementationBinding === undefined ||
+            binding.implementationBinding.task.number !== binding.task.number ||
+            binding.implementationBinding.authorization.implementation.number !==
+                current.binding.authorization.implementation.number ||
+            binding.implementationBinding.repository.repositoryId !== current.binding.repository.repositoryId))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Signed Implementation binding does not match.");
+    if (changeOperation)
+        requireCurrentChangeRoot(binding, issue, current.sources);
     const operation = capabilityOperation(intent);
     const nowSeconds = Math.floor((options.now?.() ?? new Date()).getTime() / 1000);
     const context = {
@@ -268,19 +432,33 @@ export async function authorizeExecutionIntent(intent, sessionId, options) {
         implementationBinding: current.binding,
         implementationScope: current.scope,
     };
-    const admission = admitAuthenticatedSessionCapability({
-        context,
-        operation,
-        subject: intentSubject(intent),
-        projection: evidence.change,
-        ...(readTreeDelta(intent) === undefined ? {} : { treeDelta: readTreeDelta(intent) }),
-        ...(evidence.reviewEvidence === undefined ? {} : { reviewEvidence: evidence.reviewEvidence }),
-    });
+    let admission;
+    try {
+        admission = admitAuthenticatedSessionCapability({
+            context,
+            operation,
+            subject: intentSubject(intent),
+            projection: evidence.change,
+            ...(readTreeDelta(intent) === undefined ? {} : { treeDelta: readTreeDelta(intent) }),
+            ...(evidence.reviewEvidence === undefined ? {} : { reviewEvidence: evidence.reviewEvidence }),
+        });
+    }
+    catch (error) {
+        // Keep the capability owner's own denial (name/reason) and attach the bounded wire diagnostic.
+        if (error instanceof Error) {
+            Object.defineProperty(error, "runtimeFailure", {
+                value: runtimeFailure("implementation-admission", "ADMISSION_CAPABILITY_DENIED"),
+                enumerable: false,
+            });
+            throw error;
+        }
+        deny("implementation-admission", "ADMISSION_CAPABILITY_DENIED", "The Session capability does not authorize this operation.");
+    }
     let branchAuthorization;
     if (intent.operation === "branch.advance") {
         const authorized = authorizeBranchAdvance({ context, admission, request: intent.request });
         if (!authorized.valid)
-            throw new Error("Branch advance is outside the current authorized scope.");
+            deny("implementation-admission", "ADMISSION_BRANCH_SCOPE_DENIED", "Branch advance is outside the current authorized scope.");
         branchAuthorization = authorized.authorization;
     }
     const provenanceRequest = {
@@ -312,7 +490,10 @@ export async function authorizeExecutionIntent(intent, sessionId, options) {
         version: 1,
         operation: intent.operation,
         repository: evidence.repository,
-        task: binding.task,
+        // The closed AuthorizedExecution task names the execution's own root Issue.
+        // A Source-rooted Change (#1213) is identified by its Source subject; the
+        // Implementation task is not restated as that root.
+        ...(binding.task.number === issue ? { task: binding.task } : {}),
         subject: admission.subject,
         capability: admission.capability,
         provenance,

package/dist/admission/authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/admission/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGxH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,mCAAmC,GAGpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAqC,MAAM,sCAAsC,CAAC;AACjH,OAAO,EACL,mCAAmC,GAEpC,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAA2B,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAA4B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAA+B,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAyC,MAAM,oCAAoC,CAAC;AACvH,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,gCAAgC,GAEjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,kBAAkB,EAAgC,MAAM,sCAAsC,CAAC;AAcxG,SAAS,+BAA+B,CAAC,OAA4B,EAAE,OAAsC;IAC3G,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IACpD,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAClH,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,IACE,mBAAmB,CAAC,OAAwC,CAAC;QAC7D,mBAAmB,CAAC,OAAO,CAAC,iBAAkD,CAAC;QAE/E,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;AAC1F,CAAC;AAQD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,OAA0B;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,KAAmC;IACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CACL,IAAI,CAAC,cAAc,KAAK,YAAY;QACpC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,EAAE;QAC9B,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7G,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAwC;IAClE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,OAAqC;IAErC,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,YAAY;QACtC,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE;QAClC,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC3C,MAAM,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAA4B,EAC5B,UAA8B,EAC9B,SAAyD,EACzD,MAAuB,EACvB,SAAuC,EACvC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS;QACT,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,UAAU,GAAG,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACxF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;QACT,OAAO;QACP,eAAe,EAAE,MAAM,CAAC,OAAkE;KAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAA+B,CAAC;QACvD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;IAC/D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAA4B,EAC5B,eAA0B;IAQ1B,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEhH,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,IACE,CAAC,gBAAgB,CAAC,KAAK;QACvB,gBAAgB,CAAC,KAAK,KAAK,SAAS;QACpC,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;QAE3D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAEtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE;QACnC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,oBAAoB;QACrF,mBAAmB,CAAC,OAAwC,CAAC;YAC3D,mBAAmB,CAAC,eAAgD,CAAC;QAEvE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAC1D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/B,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE;YAC/B,gBAAgB;YAChB,OAAO;YACP,YAAY;YACZ,MAAM;YACN,WAAW;YACX,QAAQ;YACR,aAAa;SACd,CAAC;QAEF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,KAAK;QAClC,SAAS,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE;QACrD,MAAM,EAAE,UAAU,CAAC,UAAU;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,OAA4B,EAAE,eAA0B;IACrG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAEtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE;QACnC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,oBAAoB;QACrF,mBAAmB,CAAC,OAAwC,CAAC;YAC3D,mBAAmB,CAAC,eAAgD,CAAC;QAEvE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC,CACzC,QAA6C,EAC7C,OAA4B;IAE5B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvD,MAAM,kBAAkB,GAAqC;QAC3D,cAAc,EAAE,sBAAsB,CAAC,cAAoE;QAC3G,KAAK,EAAE,sBAAsB,CAAC,KAAkD;QAChF,UAAU,EAAE,sBAAsB,CAAC,UAA4D;QAC/F,IAAI,EAAE,sBAAsB,CAAC,IAAgD;QAC7E,SAAS,EAAE,sBAAsB,CAAC,SAAS;KAC5C,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY,IAAI,aAAa,CAAC,aAAa,KAAK,SAAS;QAC5G,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,EAAE,GAAG,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;IAC3F,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;QACzE,GAAG,YAAY;QACf,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACpH,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE,OAAsC;IAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;KAClC,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,+BAA+B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE;QACxD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9G,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAuB,EACvB,SAAiB,EACjB,OAAsC;IAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACtC,+BAA+B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,IACE,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACvC,MAAM,CAAC,SAAS,KAAK,gBAAgB;QACpC,MAAM,CAAC,OAAwC,CAAC,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,cAAc;QAEpG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;QACvF,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,KAAK;QACL,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/F,qBAAqB,EAAE,OAAO,CAAC,OAAO;QACtC,mBAAmB,EAAE,OAAO,CAAC,KAAK;KACK,CAAC;IAC1C,MAAM,SAAS,GAAG,mCAAmC,CAAC;QACpD,OAAO;QACP,SAAS;QACT,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;QAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;KAC9F,CAAC,CAAC;IACH,IAAI,mBAA4B,CAAC;IACjC,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAClG,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,GAAG,OAAO,CAAC,OAAO;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,UAAU,GAAkC,mCAAmC,CAAC;QACpF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;QACrD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,uBAAuB;QAChC,KAAK,EAAE,8BAA8B;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,uBAAuB,EAAE,OAAO,CAAC,SAAS;QAC1C,SAAS,EAAE,WAAW,OAAO,CAAC,SAAS,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,cAAc,GAA4B;QAC9C,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;KACxF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa;QAAE,cAAc,CAAC,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC;SACtF,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,cAAc,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;;QACpG,cAAc,CAAC,SAAS,GAAG,uBAAuB,CAAC;IACxD,OAAO,yBAAyB,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/admission/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGxH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,mCAAmC,GAGpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAqC,MAAM,sCAAsC,CAAC;AACjH,OAAO,EACL,mCAAmC,GAEpC,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAA2B,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAA4B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAA+B,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAyC,MAAM,oCAAoC,CAAC;AACvH,OAAO,EACL,gDAAgD,GAEjD,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,gCAAgC,GAEjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,kBAAkB,EAClB,8BAA8B,GAE/B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,cAAc,GAIf,MAAM,yCAAyC,CAAC;AAEjD,oFAAoF;AACpF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAAuB;IAC3B,cAAc,CAAiB;IAExC,YAAY,KAA0B,EAAE,IAA0B,EAAE,OAAe;QACjF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAA0B,EAAE,IAA0B,EAAE,OAAe;IACnF,MAAM,IAAI,2BAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAkBD,kGAAkG;AAClG,KAAK,UAAU,4BAA4B,CACzC,UAAwC,EACxC,cAAsB,EACtB,OAAsC,EACtC,KAA0B;IAE1B,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,EAAE,sCAAsC,EAAE,mDAAmD,CAAC,CAAC;IAC3G,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAC3G,CAAC;IACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS;QAClE,IAAI,CAAC,KAAK,EAAE,oCAAoC,EAAE,4DAA4D,CAAC,CAAC;IAClH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAwC,EACxC,cAAsB,EACtB,OAAsC,EACtC,KAA0B;IAE1B,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7F,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,MAAM,OAAO,GAAG;QACd,UAAU;QACV,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;KAC9F,CAAC;IACF,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,OAAO,CAAC,YAAY,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,WAAW,EAAE,MAAM,CAAC,EAAE;QACtB,KAAK,EAAE,cAAc;QACrB,mBAAmB,EAAE,cAAc;KACpC,CAAC,EACF,OAAO,EACP,MAAM,EACN,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrH,IACE,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;QACrC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAwC,CAAC;YAC3E,mBAAmB,CAAC,KAAK,CAAC,OAAwC,CAAC;QAErE,IAAI,CAAC,KAAK,EAAE,oCAAoC,EAAE,yDAAyD,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,OAA4B,EAC5B,OAAsC,EACtC,KAA0B;IAE1B,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IACpD,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,EAAE,oCAAoC,EAAE,4DAA4D,CAAC,CAAC;IAClH,CAAC;IACD,IACE,mBAAmB,CAAC,OAAwC,CAAC;QAC7D,mBAAmB,CAAC,OAAO,CAAC,iBAAkD,CAAC;QAE/E,IAAI,CACF,KAAK,EACL,2CAA2C,EAC3C,oEAAoE,CACrE,CAAC;AACN,CAAC;AAQD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,OAA0B;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAA0B;IACxE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAC7C,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,4CAA4C,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAkB,EAClB,OAA+C,EAC/C,eAA0B,EAC1B,KAA0B;IAE1B,IACE,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE;QACnC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,oBAAoB;QACrF,mBAAmB,CAAC,OAAwC,CAAC;YAC3D,mBAAmB,CAAC,eAAgD,CAAC;QAEvE,IAAI,CACF,KAAK,EACL,sCAAsC,EACtC,yEAAyE,CAC1E,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAkB,EAAE,KAA0B;IACzE,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAEtC,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,2CAA2C,CAAC,CAAC;IAC3F,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,KAAmC;IACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CACL,IAAI,CAAC,cAAc,KAAK,YAAY;QACpC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,EAAE;QAC9B,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7G,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAwC;IAClE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,OAAqC;IAErC,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,YAAY;QACtC,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE;QAClC,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC3C,MAAM,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAA4B,EAC5B,UAA8B,EAC9B,SAAyD,EACzD,MAAuB,EACvB,SAAuC,EACvC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS;QACT,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,UAAU,GAAG,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACxF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;QACT,OAAO;QACP,eAAe,EAAE,MAAM,CAAC,OAAkE;KAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAA+B,CAAC;QACvD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;IAC/D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAA8D,EAC9D,eAA0B,EAC1B,QAA6B,0BAA0B;IAQvD,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEhH,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,0CAA0C,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,IACE,CAAC,gBAAgB,CAAC,KAAK;QACvB,gBAAgB,CAAC,KAAK,KAAK,SAAS;QACpC,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;QAE3D,IAAI,CAAC,KAAK,EAAE,+BAA+B,EAAE,sDAAsD,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACtE,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAC1D,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,uCAAuC,CAAC,CAAC;IACvF,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/B,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE;YAC/B,gBAAgB;YAChB,OAAO;YACP,YAAY;YACZ,MAAM;YACN,WAAW;YACX,QAAQ;YACR,aAAa;SACd,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,+CAA+C,CAAC,CAAC;IAC/F,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,KAAK;QAClC,SAAS;QACT,MAAM,EAAE,UAAU,CAAC,UAAU;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,OAA8D,EAC9D,eAA0B;IAE1B,MAAM,KAAK,GAAG,gBAAgB,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,mDAAmD,CAAC,CAAC;IACnG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,+BAA+B,EAAE,sDAAsD,CAAC,CAAC;IACvG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACtE,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC,CACzC,QAA6C,EAC7C,IAA4B,EAC5B,cAAuB,EACvB,QAA6B,0BAA0B;IAMvD,MAAM,sBAAsB,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvD,MAAM,kBAAkB,GAAqC;QAC3D,cAAc,EAAE,sBAAsB,CAAC,cAAoE;QAC3G,KAAK,EAAE,sBAAsB,CAAC,KAAkD;QAChF,UAAU,EAAE,sBAAsB,CAAC,UAA4D;QAC/F,IAAI,EAAE,sBAAsB,CAAC,IAAgD;QAC7E,SAAS,EAAE,sBAAsB,CAAC,SAAS;KAC5C,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;IACrE,IACE,CAAC,aAAa,CAAC,KAAK;QACpB,aAAa,CAAC,MAAM,KAAK,YAAY;QACrC,aAAa,CAAC,aAAa,KAAK,SAAS;QACzC,aAAa,CAAC,QAAQ,KAAK,SAAS;QAEpC,IAAI,CAAC,KAAK,EAAE,uCAAuC,EAAE,2CAA2C,CAAC,CAAC;IACpG,MAAM,YAAY,GAAG,EAAE,GAAG,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;IAC3F,IAAI,iBAA4D,CAAC;IACjE,IAAI,CAAC;QACH,iBAAiB,GAAG,gDAAgD,CAAC;YACnE,GAAG,YAAY;YACf,IAAI;YACJ,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,EAAE,uCAAuC,EAAE,2CAA2C,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,KAAK,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAChD,IAAI,CAAC,KAAK,EAAE,4CAA4C,EAAE,8CAA8C,CAAC,CAAC;IAC5G,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC1G,CAAC;AAED,MAAM,iBAAiB,GAA8C,IAAI,GAAG,CAAC;IAC3E,aAAa;IACb,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH,SAAS,oBAAoB,CAC3B,MAAsB,EACtB,UAAwC,EACxC,KAAa;IAEb,OAAO,CACL,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,KAAK,YAAY;QACpD,MAAM,CAAC,YAAY,KAAK,UAAU,CAAC,EAAE;QACrC,MAAM,CAAC,MAAM,KAAK,KAAK,CACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,OAA4B,EAAE,KAAa;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;YAC/B,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,wCAAwC,CAAC,CAAC;IAC1G,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC1F,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;AACxG,CAAC;AAED,0GAA0G;AAC1G,SAAS,wBAAwB,CAC/B,OAA4B,EAC5B,KAAa,EACb,cAAyC;IAEzC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC3F,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,qDAAqD,CAAC,CAAC;AACvH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE,OAAsC;IAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;KAClC,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAwC,EACxC,iBAAiF,EACjF,OAAsC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IACE,MAAM,CAAC,EAAE,KAAK,iBAAiB,CAAC,EAAE;QAClC,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,iBAAiB,CAAC,oBAAoB;QAEpF,IAAI,CACF,gBAAgB,EAChB,sCAAsC,EACtC,2EAA2E,CAC5E,CAAC;IACJ,MAAM,OAAO,GAAG;QACd,UAAU;QACV,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB,EAAE;KAClC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,WAAW,EAAE,MAAM,CAAC,EAAE;KACvB,CAAC,CAAC;IACH,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAiB,EACjB,UAAwC,EACxC,OAAsC;IAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QACpD,IAAI,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACtC,IACE,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE;QACvC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAEjG,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,iDAAiD,CAAC,CAAC;IACjH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA4B,EAC5B,OAAsC;IAEtC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QAC/B,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,OAAO,CAAC,YAAY,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QAC1B,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,EACF,OAAO,EACP,OAAO,CAAC,gBAAgB,CACzB,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,MAAM,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE;QACxD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9G,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAuB,EACvB,SAAiB,EACjB,OAAsC;IAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QACpD,IAAI,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACtC,MAAM,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACpF,IACE,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACvC,MAAM,CAAC,SAAS,KAAK,gBAAgB;QACpC,MAAM,CAAC,OAAwC,CAAC,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,cAAc;QAEpG,IAAI,CACF,0BAA0B,EAC1B,+BAA+B,EAC/B,0DAA0D,CAC3D,CAAC;IACJ,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACxE,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChE,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;QAC7G,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,wCAAwC,CAAC,CAAC;IACxG,IAAI,eAAe;QAAE,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,KAAK;QACL,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,OAAO,CAAC,qBAAqB,EAAE,OAAO,KAAK,SAAS,CAAC;IACzE,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxF,IACE,WAAW;QACX,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS;YAC1C,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM;YACjE,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM;gBAC/D,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM;YACrD,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;QAEpG,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,+CAA+C,CAAC,CAAC;IAC/G,IAAI,eAAe;QAAE,wBAAwB,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/F,qBAAqB,EAAE,OAAO,CAAC,OAAO;QACtC,mBAAmB,EAAE,OAAO,CAAC,KAAK;KACK,CAAC;IAC1C,IAAI,SAAiE,CAAC;IACtE,IAAI,CAAC;QACH,SAAS,GAAG,mCAAmC,CAAC;YAC9C,OAAO;YACP,SAAS;YACT,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,+FAA+F;QAC/F,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;gBAC7C,KAAK,EAAE,cAAc,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;gBAChF,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CACF,0BAA0B,EAC1B,6BAA6B,EAC7B,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,mBAA4B,CAAC;IACjC,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,KAAK;YACnB,IAAI,CACF,0BAA0B,EAC1B,+BAA+B,EAC/B,yDAAyD,CAC1D,CAAC;QACJ,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,GAAG,OAAO,CAAC,OAAO;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,UAAU,GAAkC,mCAAmC,CAAC;QACpF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;QACrD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,uBAAuB;QAChC,KAAK,EAAE,8BAA8B;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,uBAAuB,EAAE,OAAO,CAAC,SAAS;QAC1C,SAAS,EAAE,WAAW,OAAO,CAAC,SAAS,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,cAAc,GAA4B;QAC9C,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,4EAA4E;QAC5E,0EAA0E;QAC1E,oDAAoD;QACpD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;KACxF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa;QAAE,cAAc,CAAC,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC;SACtF,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,cAAc,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;;QACpG,cAAc,CAAC,SAAS,GAAG,uBAAuB,CAAC;IACxD,OAAO,yBAAyB,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC"}

package/dist/admission/server.d.ts

@@ -11,7 +11,7 @@ import type { Delegator } from "../agent-authority/delegator.js";
 import type { AuthorizedExecution } from "../authorized-execution.js";
 import { type RepositoryIdentity } from "../github/effect-authorizer.js";
 import type { LocalAdmissionConfig } from "../local-control/config.js";
-import type { LocalExecutorEvidenceRequest } from "../local-control/executor-http.js";
+import { type LocalExecutorBranchPolicyRequest, type LocalExecutorEvidenceRequest, type LocalExecutorGovernedContractRequest } from "../local-control/executor-http.js";
 import { type LocalRuntimeEndpoint } from "../local-control/runtime-discovery.js";
 import { type LocalMtlsIdentity } from "../local-control/transport-security.js";
 export declare const LOCAL_ADMISSION_STATUS_PATH: "/status";
@@ -20,6 +20,9 @@ export declare const LOCAL_ADMISSION_HEALTH_PATH: "/health";
 export declare const LOCAL_ADMISSION_SESSIONS_PATH: "/v1/sessions";
 export declare const LOCAL_ADMISSION_REPOSITORY_PATH: "/v1/repository";
 export declare const LOCAL_ADMISSION_EXECUTIONS_PATH: "/v1/executions";
+export declare const LOCAL_ADMISSION_READINESS_PATH: "/v1/readiness";
+export declare const LOCAL_ADMISSION_BRANCH_POLICY_PATH: "/v1/branch-policy";
+export declare const LOCAL_ADMISSION_PULL_REQUEST_CONTEXT_PATH: "/v1/pull-request-context";
 export declare const LOCAL_ADMISSION_SESSION_ID_HEADER: "x-inari-session-id";
 export declare const MAX_LOCAL_ADMISSION_BODY_BYTES = 1048576;
 /**
@@ -31,6 +34,8 @@ export interface AdmissionExecutorClient {
     verifyReady(): Promise<unknown>;
     resolveRepository?(repositoryNameWithOwner: string): Promise<RepositoryIdentity>;
     readEvidence(request: LocalExecutorEvidenceRequest): Promise<unknown>;
+    readBranchPolicy?(request: LocalExecutorBranchPolicyRequest): Promise<unknown>;
+    readGovernedContract?(request: LocalExecutorGovernedContractRequest): Promise<unknown>;
     execute(execution: AuthorizedExecution): Promise<unknown>;
 }
 export declare function createLocalAdmissionHttpServer(config: LocalAdmissionConfig, version: string, runtimeAuthority: Delegator, executor: AdmissionExecutorClient, options?: {