harnery 0.12.2 → 0.13.0

package/README.md

@@ -21,7 +21,7 @@
 
 - **Multi-agent coordination:** per-agent heartbeats in `.harnery/active/`, claim-time and commit-time guards, the canonical event stream, councils, a decision docket, per-agent scratchpads, and harness adapters for Claude Code / Cursor / Codex.
 - **Cross-machine presence:** sessions on every machine that shares a repo see each other, labeled by machine. Zero-config over the repo's own git remote (presence refs), with an optional live-socket upgrade via an end-to-end-encrypted relay — the public `relay.harnery.com`, or self-host with `harn relay serve` / the bundled Cloudflare Worker (`relay/worker/`). The relay sees only ciphertext in opaquely-named rooms.
-- **Coordination-aware workflows:** `harn workflow run <script>` executes bounded, schema-gated multi-subagent workflow scripts — plain JS stages fanning out to headless harness-CLI subagents that are born coordination-registered (heartbeats, events, claim guards), with deterministic code deciding the routing between stages. An optional host-owned policy gates dispatch and declared external mutations with fail-closed `ALLOW`, `ASK`, and `DENY` decisions recorded in the run proof.
+- **Coordination-aware workflows:** `harn workflow run <script>` executes bounded, schema-gated multi-subagent workflow scripts — plain JS stages fanning out to headless harness-CLI subagents that are born coordination-registered (heartbeats, events, claim guards), with deterministic code deciding the routing between stages. An optional host-owned policy gates dispatch and declared external mutations with `ALLOW`, `ASK`, and `DENY`; CLI `ASK` requests park durably for an explicit approve/deny and same-run resume, while library callers remain fail-closed by default.
 - **Standalone web UI:** `harn web up` boots a local Next.js dashboard for the coord layer, councils, per-project state, and a local coding-agent status view (Claude Code / Codex / Cursor usage, backed by `harn devtools`). Ships with the git clone, not the npm package (see [Install](#install)).
 - **Backup + sync:** `harn backup` snapshots `.harnery/` via [restic](https://restic.net/); `harn sync` keeps a curated subset live across machines via [rclone](https://rclone.org/) (Google Drive or any rclone remote).
 

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAkCnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAuKjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAgDnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2XjF"}

package/dist/commands/workflow.js

@@ -2,6 +2,7 @@ import { workflowSubscriptionOnly } from "../core/config.js";
 import { createBuiltinHarnessRegistry } from "../core/harnesses/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
+import { WorkflowParkedError } from "../core/workflow/engine.js";
 export function registerWorkflowCommand(program, emit) {
     const registry = createBuiltinHarnessRegistry();
     const harnesses = registry.ids();
@@ -23,6 +24,7 @@ export function registerWorkflowCommand(program, emit) {
         "without this the engine refuses that silent-override state")
         .option("--policy <file>", "Host policy JSON/JSONC applied before dispatch and external mutation")
         .option("--isolation <mode>", "Host-created execution boundary: shared | worktree | sandbox | remote (default shared)")
+        .option("--approval-to <address>", "Address durable ASK requests (default: operator)")
         .option("--json", "Emit the full RunReport as JSON")
         .action(async (script, opts) => {
         const coordRoot = findCoordRoot();
@@ -77,6 +79,8 @@ export function registerWorkflowCommand(program, emit) {
                     { toolEvidence: adapter.profile.capabilities.toolEvidence },
                 ])),
                 policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
+                approvalMode: "park",
+                approvalAddressee: opts.approvalTo,
                 isolation: opts.isolation,
                 // CLI harness subprocesses inherit the host network. A policy that
                 // forbids network must therefore deny dispatch unless a future host
@@ -101,6 +105,23 @@ export function registerWorkflowCommand(program, emit) {
                 `result: ${typeof report.result === "string" ? report.result : JSON.stringify(report.result, null, 2)}\n`);
         }
         catch (err) {
+            if (err instanceof WorkflowParkedError) {
+                if (opts.json) {
+                    emit.config({ format: "json" });
+                    emit.data({
+                        status: "parked",
+                        runId: err.runId,
+                        approvalId: err.approvalId,
+                        journalPath: err.journalPath,
+                    });
+                }
+                else {
+                    emit.text(`run ${err.runId} parked\napproval: ${err.approvalId}\n` +
+                        `journal: ${err.journalPath}\n` +
+                        `resume after resolution: harn workflow resume ${err.runId}\n`);
+                }
+                return;
+            }
             const proofPath = typeof err === "object" && err !== null && "proofPath" in err
                 ? String(err.proofPath)
                 : undefined;
@@ -111,6 +132,178 @@ export function registerWorkflowCommand(program, emit) {
             process.exit(1);
         }
     });
+    workflow
+        .command("resume <run-id>")
+        .description("Resume a parked workflow after its durable approval has been resolved.")
+        .option("--json", "Emit the full RunReport or parked result as JSON")
+        .action(async (runId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({
+                code: "no_coord_root",
+                message: "no .harnery/ coordination root found; run `init` first",
+            });
+            process.exit(1);
+        }
+        try {
+            const { assertWorkflowRunResumable, runWorkflow } = await import("../core/workflow/index.js");
+            const { manifest } = assertWorkflowRunResumable(coordRoot, runId);
+            const report = await runWorkflow(manifest.script.path, {
+                coordRoot,
+                spawners: registry.spawners(),
+                resumeRunId: runId,
+                harnessEvidence: Object.fromEntries(registry
+                    .list()
+                    .map((adapter) => [
+                    adapter.profile.id,
+                    { toolEvidence: adapter.profile.capabilities.toolEvidence },
+                ])),
+            });
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(report);
+                return;
+            }
+            const cachedPart = report.agentsCached > 0 ? ` (+${report.agentsCached} cached)` : "";
+            emit.text(`run ${report.runId} (${report.name}) finished: ${report.agentsSpawned} agent(s)${cachedPart}, ` +
+                `$${report.costUsd.toFixed(4)}, ${Math.round(report.durationMs / 1000)}s\n` +
+                `acceptance: ${report.acceptance.satisfied} satisfied, ${report.acceptance.unsatisfied} unsatisfied, ` +
+                `${report.acceptance.unknown} unknown\n` +
+                `journal: ${report.journalPath}\nproof: ${report.proofPath}\n` +
+                `result: ${typeof report.result === "string" ? report.result : JSON.stringify(report.result, null, 2)}\n`);
+        }
+        catch (err) {
+            if (err instanceof WorkflowParkedError) {
+                if (opts.json) {
+                    emit.config({ format: "json" });
+                    emit.data({
+                        status: "parked",
+                        runId: err.runId,
+                        approvalId: err.approvalId,
+                        journalPath: err.journalPath,
+                    });
+                }
+                else {
+                    emit.text(`run ${err.runId} parked again\napproval: ${err.approvalId}\n` +
+                        `journal: ${err.journalPath}\n`);
+                }
+                return;
+            }
+            const proofPath = typeof err === "object" && err !== null && "proofPath" in err
+                ? String(err.proofPath)
+                : undefined;
+            emit.error({
+                code: "workflow_resume_failed",
+                message: `${err.message}${proofPath ? `\nproof: ${proofPath}` : ""}`,
+            });
+            process.exit(1);
+        }
+    });
+    const approvals = workflow
+        .command("approvals")
+        .description("Inspect and resolve durable workflow policy approvals.");
+    approvals
+        .command("list")
+        .description("List durable workflow approvals.")
+        .option("--status <status>", "Filter: pending | approved | denied")
+        .option("--json", "Emit approval records as JSON")
+        .action(async (opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({ code: "no_coord_root", message: "no .harnery/ coordination root found" });
+            process.exit(1);
+        }
+        if (opts.status && !["pending", "approved", "denied"].includes(opts.status)) {
+            emit.error({
+                code: "bad_approval_status",
+                message: `unknown approval status ${JSON.stringify(opts.status)}`,
+            });
+            process.exit(1);
+        }
+        const { listWorkflowApprovals } = await import("../core/workflow/approvals.js");
+        const records = listWorkflowApprovals(coordRoot, { status: opts.status });
+        if (opts.json) {
+            emit.config({ format: "json" });
+            emit.data(records);
+            return;
+        }
+        if (records.length === 0) {
+            emit.text("no workflow approvals\n");
+            return;
+        }
+        emit.text(`${records
+            .map(({ request, status }) => `${request.id}  ${status.padEnd(8)}  ${request.run_id}  ${request.request.phase}  ${request.request.action}  -> ${request.addressed_to}`)
+            .join("\n")}\n`);
+    });
+    approvals
+        .command("show <approval-id>")
+        .description("Show one durable workflow approval.")
+        .option("--json", "Emit the approval record as JSON")
+        .action(async (approvalId, opts) => {
+        const coordRoot = findCoordRoot();
+        if (!coordRoot) {
+            emit.error({ code: "no_coord_root", message: "no .harnery/ coordination root found" });
+            process.exit(1);
+        }
+        try {
+            const { readWorkflowApproval, renderWorkflowApproval } = await import("../core/workflow/approvals.js");
+            const approval = readWorkflowApproval(coordRoot, approvalId);
+            if (opts.json) {
+                emit.config({ format: "json" });
+                emit.data(approval);
+            }
+            else {
+                emit.text(renderWorkflowApproval(approval));
+            }
+        }
+        catch (err) {
+            emit.error({ code: "workflow_approval_read_failed", message: err.message });
+            process.exit(1);
+        }
+    });
+    const registerApprovalDecision = (command, verdict) => {
+        approvals
+            .command(`${command} <approval-id>`)
+            .description(`${command === "approve" ? "Approve" : "Deny"} a pending workflow approval.`)
+            .option("--actor <name>", "Decision actor recorded in the receipt")
+            .option("--reason <text>", "Bounded decision reason")
+            .option("--json", "Emit the resolved approval as JSON")
+            .action(async (approvalId, opts) => {
+            const coordRoot = findCoordRoot();
+            if (!coordRoot) {
+                emit.error({ code: "no_coord_root", message: "no .harnery/ coordination root found" });
+                process.exit(1);
+            }
+            try {
+                const { resolveWorkflowApproval, renderWorkflowApproval } = await import("../core/workflow/approvals.js");
+                const resolved = resolveWorkflowApproval({
+                    coordRoot,
+                    approvalId,
+                    verdict,
+                    actor: opts.actor ?? process.env.USER ?? process.env.USERNAME ?? "operator",
+                    reason: opts.reason,
+                });
+                if (opts.json) {
+                    emit.config({ format: "json" });
+                    emit.data(resolved);
+                }
+                else {
+                    emit.text(`${renderWorkflowApproval(resolved.approval)}` +
+                        `${resolved.applied ? "decision recorded" : "decision already recorded"}\n` +
+                        `resume: harn workflow resume ${resolved.approval.request.run_id}\n`);
+                }
+            }
+            catch (err) {
+                emit.error({
+                    code: "workflow_approval_resolution_failed",
+                    message: err.message,
+                });
+                process.exit(1);
+            }
+        });
+    };
+    registerApprovalDecision("approve", "allow");
+    registerApprovalDecision("deny", "deny");
     workflow
         .command("proof <run-id>")
         .description("Show the bounded proof packet for a completed workflow run.")

package/dist/core/policy/types.d.ts

@@ -73,7 +73,7 @@ export interface PolicyDecision {
     phase: PolicyPhase;
     initial_verdict: PolicyVerdict;
     verdict: "allow" | "deny";
-    resolved_by: "policy" | "host" | "fail_closed";
+    resolved_by: "policy" | "host" | "approval" | "fail_closed";
     reason: string;
     rule_codes: string[];
     request: PolicyRequestSummary;

package/dist/core/policy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/policy/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAEhD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,cAAc,CAAC,EAAE,OAAO,qBAAqB,CAAC;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,aAAa,CAAC;IAChC,iBAAiB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EACvC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC,KACnC,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,eAAe,EAAE,aAAa,CAAC;IAC/B,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,WAAW,EAAE,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/policy/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAEhD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,cAAc,CAAC,EAAE,OAAO,qBAAqB,CAAC;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,aAAa,CAAC;IAChC,iBAAiB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EACvC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC,KACnC,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,eAAe,EAAE,aAAa,CAAC;IAC/B,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,WAAW,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC"}

package/dist/core/workflow/approvals.d.ts

@@ -0,0 +1,71 @@
+import type { PolicyEvaluation, PolicyRequestSummary, PolicyVerdict } from "../policy/index.js";
+export declare const WORKFLOW_APPROVAL_SCHEMA_VERSION: 1;
+export type WorkflowApprovalStatus = "pending" | "approved" | "denied";
+export interface WorkflowApprovalRequest {
+    schema_version: typeof WORKFLOW_APPROVAL_SCHEMA_VERSION;
+    id: string;
+    run_id: string;
+    decision_id: string;
+    requested_at: string;
+    addressed_to: string;
+    policy: {
+        name: string;
+        sha256: string;
+    };
+    initial_verdict: Extract<PolicyVerdict, "ask">;
+    request: PolicyRequestSummary;
+    evaluation: PolicyEvaluation;
+    request_sha256: string;
+}
+export interface WorkflowApprovalDecision {
+    schema_version: typeof WORKFLOW_APPROVAL_SCHEMA_VERSION;
+    approval_id: string;
+    run_id: string;
+    verdict: "allow" | "deny";
+    actor: string;
+    reason?: string;
+    decided_at: string;
+}
+export interface WorkflowApproval {
+    request: WorkflowApprovalRequest;
+    decision?: WorkflowApprovalDecision;
+    status: WorkflowApprovalStatus;
+}
+export interface CreateWorkflowApprovalInput {
+    coordRoot: string;
+    runId: string;
+    decisionId: string;
+    addressedTo?: string;
+    policy: {
+        name: string;
+        sha256: string;
+    };
+    request: PolicyRequestSummary;
+    evaluation: PolicyEvaluation;
+    now?: () => string;
+}
+export interface ResolveWorkflowApprovalInput {
+    coordRoot: string;
+    approvalId: string;
+    verdict: "allow" | "deny";
+    actor: string;
+    reason?: string;
+    now?: () => string;
+}
+export declare function workflowApprovalId(runId: string, decisionId: string): string;
+export declare function createWorkflowApproval(input: CreateWorkflowApprovalInput): {
+    approval: WorkflowApproval;
+    created: boolean;
+};
+export declare function resolveWorkflowApproval(input: ResolveWorkflowApprovalInput): {
+    approval: WorkflowApproval;
+    applied: boolean;
+};
+export declare function readWorkflowApproval(coordRoot: string, approvalId: string): WorkflowApproval;
+export declare function listWorkflowApprovals(coordRoot: string, options?: {
+    status?: WorkflowApprovalStatus;
+    runId?: string;
+}): WorkflowApproval[];
+export declare function renderWorkflowApproval(approval: WorkflowApproval): string;
+export declare function assertWorkflowRunId(runId: string): void;
+//# sourceMappingURL=approvals.d.ts.map

package/dist/core/workflow/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/approvals.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEhG,eAAO,MAAM,gCAAgC,EAAG,CAAU,CAAC;AAU3D,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,OAAO,gCAAgC,CAAC;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IACpC,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAM5E;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG;IAC1E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB,CAkCA;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG;IAC5E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB,CAwBA;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,gBAAgB,CAe5F;AAED,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,gBAAgB,EAAE,CAkBpB;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAgBzE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEvD"}

package/dist/core/workflow/approvals.js

@@ -0,0 +1,288 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, linkSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+export const WORKFLOW_APPROVAL_SCHEMA_VERSION = 1;
+const RECORD_LIMIT_BYTES = 128 * 1024;
+const RUN_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
+const APPROVAL_ID = /^apr-[a-f0-9]{20}$/;
+const DECISION_ID = /^p[1-9][0-9]{0,4}$/;
+const MAX_ACTOR = 200;
+const MAX_REASON = 2_000;
+const MAX_ADDRESSEE = 200;
+export function workflowApprovalId(runId, decisionId) {
+    assertRunId(runId);
+    if (!DECISION_ID.test(decisionId)) {
+        throw new Error(`invalid workflow policy decision id ${JSON.stringify(decisionId)}`);
+    }
+    return `apr-${createHash("sha256").update(`${runId}\0${decisionId}`).digest("hex").slice(0, 20)}`;
+}
+export function createWorkflowApproval(input) {
+    const id = workflowApprovalId(input.runId, input.decisionId);
+    const addressedTo = bounded(input.addressedTo ?? "operator", "approval addressee", MAX_ADDRESSEE);
+    const requestSha256 = approvalRequestDigest(input.policy.sha256, input.request, input.evaluation);
+    const record = {
+        schema_version: WORKFLOW_APPROVAL_SCHEMA_VERSION,
+        id,
+        run_id: input.runId,
+        decision_id: input.decisionId,
+        requested_at: (input.now ?? (() => new Date().toISOString()))(),
+        addressed_to: addressedTo,
+        policy: {
+            name: bounded(input.policy.name, "approval policy name", MAX_ACTOR),
+            sha256: sha256(input.policy.sha256, "approval policy sha256"),
+        },
+        initial_verdict: "ask",
+        request: input.request,
+        evaluation: input.evaluation,
+        request_sha256: requestSha256,
+    };
+    const dir = approvalDir(input.coordRoot, id);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const created = writeExclusiveJson(join(dir, "request.json"), record);
+    const approval = readWorkflowApproval(input.coordRoot, id);
+    if (approval.request.run_id !== record.run_id ||
+        approval.request.decision_id !== record.decision_id ||
+        approval.request.request_sha256 !== record.request_sha256 ||
+        approval.request.policy.sha256 !== record.policy.sha256) {
+        throw new Error(`approval ${id} already exists for a different policy request`);
+    }
+    return { approval, created };
+}
+export function resolveWorkflowApproval(input) {
+    const approval = readWorkflowApproval(input.coordRoot, input.approvalId);
+    const decision = {
+        schema_version: WORKFLOW_APPROVAL_SCHEMA_VERSION,
+        approval_id: approval.request.id,
+        run_id: approval.request.run_id,
+        verdict: input.verdict,
+        actor: bounded(input.actor, "approval actor", MAX_ACTOR),
+        reason: input.reason === undefined ? undefined : bounded(input.reason, "approval reason", MAX_REASON),
+        decided_at: (input.now ?? (() => new Date().toISOString()))(),
+    };
+    const applied = writeExclusiveJson(join(approvalDir(input.coordRoot, input.approvalId), "decision.json"), decision);
+    const resolved = readWorkflowApproval(input.coordRoot, input.approvalId);
+    if (resolved.decision?.verdict !== input.verdict) {
+        throw new Error(`approval ${input.approvalId} is already ${resolved.status}; conflicting ${input.verdict === "allow" ? "approval" : "denial"} refused`);
+    }
+    if (applied)
+        appendResolutionJournal(input.coordRoot, resolved);
+    return { approval: resolved, applied };
+}
+export function readWorkflowApproval(coordRoot, approvalId) {
+    assertApprovalId(approvalId);
+    const dir = approvalDir(coordRoot, approvalId);
+    const request = readJsonRecord(join(dir, "request.json"));
+    validateRequest(request, approvalId);
+    const decisionPath = join(dir, "decision.json");
+    const decision = existsSync(decisionPath)
+        ? readJsonRecord(decisionPath)
+        : undefined;
+    if (decision)
+        validateDecision(decision, request);
+    return {
+        request,
+        decision,
+        status: decision?.verdict === "allow" ? "approved" : decision ? "denied" : "pending",
+    };
+}
+export function listWorkflowApprovals(coordRoot, options = {}) {
+    if (options.runId)
+        assertRunId(options.runId);
+    const root = approvalsRoot(coordRoot);
+    if (!existsSync(root))
+        return [];
+    const records = [];
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !APPROVAL_ID.test(entry.name))
+            continue;
+        try {
+            const approval = readWorkflowApproval(coordRoot, entry.name);
+            if (options.status && approval.status !== options.status)
+                continue;
+            if (options.runId && approval.request.run_id !== options.runId)
+                continue;
+            records.push(approval);
+        }
+        catch {
+            // A malformed record fails closed when addressed directly, but one bad
+            // directory must not hide the rest of the operator's inbox.
+        }
+    }
+    return records.sort((a, b) => b.request.requested_at.localeCompare(a.request.requested_at));
+}
+export function renderWorkflowApproval(approval) {
+    const lines = [
+        `${approval.request.id}: ${approval.status}`,
+        `run: ${approval.request.run_id}`,
+        `addressed to: ${approval.request.addressed_to}`,
+        `requested: ${approval.request.requested_at}`,
+        `policy: ${approval.request.policy.name}`,
+        `phase: ${approval.request.request.phase}`,
+        `action: ${approval.request.request.action}`,
+        `reason: ${approval.request.evaluation.reason}`,
+    ];
+    if (approval.decision) {
+        lines.push(`decided: ${approval.decision.decided_at} by ${approval.decision.actor}`);
+        if (approval.decision.reason)
+            lines.push(`decision reason: ${approval.decision.reason}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function assertWorkflowRunId(runId) {
+    assertRunId(runId);
+}
+function appendResolutionJournal(coordRoot, approval) {
+    const journalPath = join(coordRoot, ".harnery", "workflows", approval.request.run_id, "journal.jsonl");
+    if (!existsSync(journalPath) || !approval.decision)
+        return;
+    const event = {
+        schema_version: 1,
+        run_id: approval.request.run_id,
+        ts: approval.decision.decided_at,
+        event: "approval.resolved",
+        stage: "",
+        approval_id: approval.request.id,
+        decision_id: approval.request.decision_id,
+        verdict: approval.decision.verdict,
+        actor: approval.decision.actor,
+        reason: approval.decision.reason ?? null,
+    };
+    writeFileSync(journalPath, `${JSON.stringify(event)}\n`, { encoding: "utf8", flag: "a" });
+}
+function approvalRequestDigest(policySha256, request, evaluation) {
+    return createHash("sha256")
+        .update(JSON.stringify({ policy_sha256: policySha256, request, evaluation }))
+        .digest("hex");
+}
+function writeExclusiveJson(path, value) {
+    const body = `${JSON.stringify(value, null, 2)}\n`;
+    if (Buffer.byteLength(body) > RECORD_LIMIT_BYTES) {
+        throw new Error(`approval record exceeds ${RECORD_LIMIT_BYTES} bytes`);
+    }
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+    try {
+        writeFileSync(temporary, body, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        try {
+            linkSync(temporary, path);
+        }
+        catch (error) {
+            if (error.code === "EEXIST")
+                return false;
+            throw error;
+        }
+        chmodSync(path, 0o600);
+        return true;
+    }
+    finally {
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+    }
+}
+function readJsonRecord(path) {
+    if (!existsSync(path))
+        throw new Error(`approval record not found at ${path}`);
+    const bytes = statSync(path).size;
+    if (bytes <= 0 || bytes > RECORD_LIMIT_BYTES) {
+        throw new Error(`approval record at ${path} has invalid size ${bytes}`);
+    }
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`cannot parse approval record at ${path}: ${error.message}`);
+    }
+}
+function validateRequest(request, approvalId) {
+    if (request.schema_version !== WORKFLOW_APPROVAL_SCHEMA_VERSION ||
+        request.id !== approvalId ||
+        !RUN_ID.test(request.run_id) ||
+        !DECISION_ID.test(request.decision_id) ||
+        workflowApprovalId(request.run_id, request.decision_id) !== approvalId ||
+        !validTimestamp(request.requested_at) ||
+        bounded(request.addressed_to, "approval addressee", MAX_ADDRESSEE) !== request.addressed_to ||
+        bounded(request.policy?.name, "approval policy name", MAX_ACTOR) !== request.policy.name ||
+        request.initial_verdict !== "ask" ||
+        !/^[a-f0-9]{64}$/.test(request.request_sha256) ||
+        !/^[a-f0-9]{64}$/.test(request.policy?.sha256) ||
+        !validPolicyRequest(request.request) ||
+        !validPolicyEvaluation(request.evaluation) ||
+        approvalRequestDigest(request.policy.sha256, request.request, request.evaluation) !==
+            request.request_sha256) {
+        throw new Error(`approval ${approvalId} has an unsupported or mismatched request record`);
+    }
+}
+function validateDecision(decision, request) {
+    if (decision.schema_version !== WORKFLOW_APPROVAL_SCHEMA_VERSION ||
+        decision.approval_id !== request.id ||
+        decision.run_id !== request.run_id ||
+        (decision.verdict !== "allow" && decision.verdict !== "deny") ||
+        bounded(decision.actor, "approval actor", MAX_ACTOR) !== decision.actor ||
+        (decision.reason !== undefined &&
+            bounded(decision.reason, "approval reason", MAX_REASON) !== decision.reason) ||
+        !validTimestamp(decision.decided_at)) {
+        throw new Error(`approval ${request.id} has an unsupported or mismatched decision record`);
+    }
+}
+function validPolicyRequest(request) {
+    if (!request || typeof request !== "object")
+        return false;
+    return ((request.phase === "dispatch" || request.phase === "external_mutation") &&
+        typeof request.action === "string" &&
+        request.action.length > 0 &&
+        ["shared", "worktree", "sandbox", "remote"].includes(request.isolation) &&
+        ["enabled", "disabled", "unknown"].includes(request.network_access));
+}
+function validPolicyEvaluation(evaluation) {
+    if (!evaluation || typeof evaluation !== "object")
+        return false;
+    return (evaluation.verdict === "ask" &&
+        typeof evaluation.reason === "string" &&
+        evaluation.reason.length > 0 &&
+        Array.isArray(evaluation.rules) &&
+        evaluation.rules.every((rule) => rule &&
+            typeof rule.code === "string" &&
+            (rule.verdict === "allow" || rule.verdict === "ask" || rule.verdict === "deny") &&
+            typeof rule.reason === "string"));
+}
+function validTimestamp(value) {
+    return typeof value === "string" && value.length <= 40 && Number.isFinite(Date.parse(value));
+}
+function approvalsRoot(coordRoot) {
+    return join(coordRoot, ".harnery", "approvals");
+}
+function approvalDir(coordRoot, approvalId) {
+    assertApprovalId(approvalId);
+    return join(approvalsRoot(coordRoot), approvalId);
+}
+function assertApprovalId(approvalId) {
+    if (!APPROVAL_ID.test(approvalId)) {
+        throw new Error(`invalid workflow approval id ${JSON.stringify(approvalId)}`);
+    }
+}
+function assertRunId(runId) {
+    if (!RUN_ID.test(runId))
+        throw new Error(`invalid workflow run id ${JSON.stringify(runId)}`);
+}
+function sha256(value, field) {
+    if (!/^[a-f0-9]{64}$/.test(value))
+        throw new Error(`${field} must be a SHA-256 digest`);
+    return value;
+}
+function bounded(value, field, max) {
+    if (typeof value !== "string")
+        throw new Error(`${field} must be a string`);
+    const normalized = Array.from(value, (character) => {
+        const code = character.charCodeAt(0);
+        return code < 32 || code === 127 ? " " : character;
+    })
+        .join("")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (!normalized)
+        throw new Error(`${field} must not be empty`);
+    if (normalized.length > max)
+        throw new Error(`${field} exceeds ${max} characters`);
+    return normalized;
+}

package/dist/core/workflow/engine.d.ts

@@ -22,5 +22,11 @@ export declare class WorkflowRunError extends Error {
     readonly proofPath: string;
     constructor(message: string, runId: string, proofPath: string, cause?: unknown);
 }
+export declare class WorkflowParkedError extends Error {
+    readonly runId: string;
+    readonly approvalId: string;
+    readonly journalPath: string;
+    constructor(message: string, runId: string, approvalId: string, journalPath: string);
+}
 export declare function runWorkflow(scriptPath: string, opts: EngineOpts): Promise<RunReport>;
 //# sourceMappingURL=engine.d.ts.map

package/dist/core/workflow/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAuBH,OAAO,KAAK,EAEV,UAAU,EAEV,SAAS,EAOV,MAAM,YAAY,CAAC;AAYpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAsmB1F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAoCH,OAAO,KAAK,EAEV,UAAU,EAEV,SAAS,EAOV,MAAM,YAAY,CAAC;AAYpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAOpF;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CA2B1F"}