limen-ai 1.0.0

package/dist/api/enforcement/rate_guard.js

@@ -0,0 +1,79 @@
+/**
+ * Rate limit enforcement guard for the API surface.
+ * S ref: §36 (rate limiting), SD-14 (RBAC -> Rate Limit -> Execute ordering),
+ *        FM-02 (cost explosion defense)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: SDD §7 build order item 4
+ *
+ * After RBAC passes (FPD-5), rate limiting checks the token-bucket
+ * before allowing the operation to proceed. The kernel's RateLimiter
+ * handles the token-bucket state in SQLite.
+ *
+ * Three bucket types per §36:
+ *   - api_calls: General API call rate (default 100/min)
+ *   - emit_event: Event emission rate (default 10/min)
+ *   - propose_rejections: Rejection tracking
+ *
+ * Invariants enforced: I-13 (enforcement ordering via SD-14)
+ * Failure modes defended: FM-02 (cost explosion via call frequency capping)
+ */
+import { LimenError } from '../errors/limen_error.js';
+/**
+ * §36, SD-14: Require rate limit allowance for the current operation.
+ *
+ * This function MUST be called AFTER RBAC check (FPD-5) and BEFORE
+ * delegation to orchestration.
+ *
+ * The kernel's RateLimiter.checkAndConsume() atomically checks and
+ * consumes a token from the specified bucket. If no tokens remain,
+ * this function throws RATE_LIMITED with cooldownMs indicating when
+ * the bucket will refill.
+ *
+ * @param rateLimiter - The kernel's RateLimiter instance
+ * @param conn - Database connection for atomic token-bucket operations
+ * @param ctx - The operation context (scopes the bucket to tenant/agent)
+ * @param bucketType - Which rate limit bucket to check
+ * @throws LimenError with code RATE_LIMITED if bucket is exhausted
+ */
+export function requireRateLimit(rateLimiter, conn, ctx, bucketType) {
+    const result = rateLimiter.checkAndConsume(conn, ctx, bucketType);
+    if (!result.ok) {
+        // Internal rate limiter error. This is an infrastructure issue, not a rate limit.
+        // Map to ENGINE_UNHEALTHY to avoid leaking internal errors.
+        throw new LimenError('ENGINE_UNHEALTHY', 'Rate limiting subsystem error.');
+    }
+    if (!result.value) {
+        // Token bucket exhausted. Get status for cooldown information.
+        const statusResult = rateLimiter.getStatus(conn, ctx, bucketType);
+        let cooldownMs;
+        if (statusResult.ok) {
+            // Calculate approximate time until next token refill
+            const { refillRate, maxTokens, currentTokens } = statusResult.value;
+            if (refillRate > 0 && currentTokens < maxTokens) {
+                // Time for 1 token to refill: 1000ms / refillRate
+                cooldownMs = Math.ceil(1000 / refillRate);
+            }
+        }
+        throw new LimenError('RATE_LIMITED', 'Request rate limit exceeded.', 
+        // exactOptionalPropertyTypes: only include cooldownMs when it has a value
+        cooldownMs !== undefined ? { cooldownMs } : undefined);
+    }
+}
+/**
+ * §36: Check concurrent stream count against per-tenant limit.
+ *
+ * S36 specifies a default of 50 concurrent streams per tenant.
+ * This is separate from the token-bucket rate limiter -- it tracks
+ * active stream count in memory (not in SQLite).
+ *
+ * @param activeStreamCount - Current number of active streams for this tenant
+ * @param maxConcurrentStreams - Configured maximum (default 50 per S36)
+ * @throws LimenError with code RATE_LIMITED if stream limit reached
+ */
+export function requireStreamCapacity(activeStreamCount, maxConcurrentStreams) {
+    if (activeStreamCount >= maxConcurrentStreams) {
+        throw new LimenError('RATE_LIMITED', 'Maximum concurrent stream limit reached.', { cooldownMs: 1000 });
+    }
+}
+//# sourceMappingURL=rate_guard.js.map

package/dist/api/enforcement/rate_guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate_guard.js","sourceRoot":"","sources":["../../../src/api/enforcement/rate_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAwB,EACxB,IAAwB,EACxB,GAAqB,EACrB,UAAsB;IAEtB,MAAM,MAAM,GAAG,WAAW,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,kFAAkF;QAClF,4DAA4D;QAC5D,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,+DAA+D;QAC/D,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAElE,IAAI,UAA8B,CAAC;QACnC,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,qDAAqD;YACrD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;YACpE,IAAI,UAAU,GAAG,CAAC,IAAI,aAAa,GAAG,SAAS,EAAE,CAAC;gBAChD,kDAAkD;gBAClD,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,8BAA8B;QAC9B,0EAA0E;QAC1E,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,iBAAyB,EACzB,oBAA4B;IAE5B,IAAI,iBAAiB,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,0CAA0C,EAC1C,EAAE,UAAU,EAAE,IAAI,EAAE,CACrB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/api/enforcement/rbac_guard.d.ts

@@ -0,0 +1,55 @@
+/**
+ * RBAC enforcement guard for the API surface.
+ * S ref: §34 (RBAC), I-13 (authorization completeness), SD-14 (RBAC before rate limit),
+ *        FPD-5 (RBAC -> Rate Limit -> Execute ordering)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: SDD §7 build order item 3
+ *
+ * Every public method on the Limen object calls requirePermission() before
+ * delegating to orchestration. In single-user mode (RBAC dormant per §3.7),
+ * all checks pass immediately. In multi-tenant mode, the kernel's RbacEngine
+ * validates the permission against the OperationContext.
+ *
+ * Invariants enforced: I-13 (authorization completeness)
+ * Failure modes defended: FM-10 (tenant data leakage via unauthorized access)
+ */
+import type { OperationContext, Permission, RbacEngine } from '../../kernel/interfaces/index.js';
+/**
+ * I-13, §34: Require a specific permission for the current operation.
+ *
+ * This function MUST be called before every delegation to orchestration.
+ * It enforces the RBAC boundary at the API surface.
+ *
+ * In single-user mode (RBAC dormant), the kernel's RbacEngine.checkPermission()
+ * always returns true, so this function passes through immediately.
+ *
+ * FPD-5: This runs BEFORE rate limiting. Unauthorized callers must not
+ * consume rate limit tokens.
+ *
+ * @param rbac - The kernel's RbacEngine instance
+ * @param ctx - The operation context with identity and permissions
+ * @param required - The permission required for this operation
+ * @throws LimenError with code UNAUTHORIZED if permission is denied
+ */
+export declare function requirePermission(rbac: RbacEngine, ctx: OperationContext, required: Permission): void;
+/**
+ * I-13, §34: Build an OperationContext from session state.
+ *
+ * This is the standard way to construct the identity context that flows
+ * through the kernel and orchestration layers. Every API call needs one.
+ *
+ * In single-user mode: tenantId is null, userId is null, permissions is the
+ * full set (RBAC dormant per §3.7).
+ *
+ * In multi-tenant mode: tenantId and userId come from the session,
+ * permissions come from the RBAC engine's role resolution.
+ *
+ * @param tenantId - Tenant identifier (null in single-user mode)
+ * @param userId - User identifier (null for system operations)
+ * @param agentId - Agent identifier (null if no agent context)
+ * @param permissions - Resolved permission set for this principal
+ * @param sessionId - Session identifier (optional)
+ */
+export declare function buildOperationContext(tenantId: import('../../kernel/interfaces/index.js').TenantId | null, userId: import('../../kernel/interfaces/index.js').UserId | null, agentId: import('../../kernel/interfaces/index.js').AgentId | null, permissions: ReadonlySet<Permission>, sessionId?: import('../../kernel/interfaces/index.js').SessionId): OperationContext;
+//# sourceMappingURL=rbac_guard.d.ts.map

package/dist/api/enforcement/rbac_guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac_guard.d.ts","sourceRoot":"","sources":["../../../src/api/enforcement/rbac_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAAE,UAAU,EAAE,UAAU,EACzC,MAAM,kCAAkC,CAAC;AAG1C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,gBAAgB,EACrB,QAAQ,EAAE,UAAU,GACnB,IAAI,CAYN;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,kCAAkC,EAAE,QAAQ,GAAG,IAAI,EACpE,MAAM,EAAE,OAAO,kCAAkC,EAAE,MAAM,GAAG,IAAI,EAChE,OAAO,EAAE,OAAO,kCAAkC,EAAE,OAAO,GAAG,IAAI,EAClE,WAAW,EAAE,WAAW,CAAC,UAAU,CAAC,EACpC,SAAS,CAAC,EAAE,OAAO,kCAAkC,EAAE,SAAS,GAC/D,gBAAgB,CAclB"}

package/dist/api/enforcement/rbac_guard.js

@@ -0,0 +1,77 @@
+/**
+ * RBAC enforcement guard for the API surface.
+ * S ref: §34 (RBAC), I-13 (authorization completeness), SD-14 (RBAC before rate limit),
+ *        FPD-5 (RBAC -> Rate Limit -> Execute ordering)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: SDD §7 build order item 3
+ *
+ * Every public method on the Limen object calls requirePermission() before
+ * delegating to orchestration. In single-user mode (RBAC dormant per §3.7),
+ * all checks pass immediately. In multi-tenant mode, the kernel's RbacEngine
+ * validates the permission against the OperationContext.
+ *
+ * Invariants enforced: I-13 (authorization completeness)
+ * Failure modes defended: FM-10 (tenant data leakage via unauthorized access)
+ */
+import { LimenError } from '../errors/limen_error.js';
+/**
+ * I-13, §34: Require a specific permission for the current operation.
+ *
+ * This function MUST be called before every delegation to orchestration.
+ * It enforces the RBAC boundary at the API surface.
+ *
+ * In single-user mode (RBAC dormant), the kernel's RbacEngine.checkPermission()
+ * always returns true, so this function passes through immediately.
+ *
+ * FPD-5: This runs BEFORE rate limiting. Unauthorized callers must not
+ * consume rate limit tokens.
+ *
+ * @param rbac - The kernel's RbacEngine instance
+ * @param ctx - The operation context with identity and permissions
+ * @param required - The permission required for this operation
+ * @throws LimenError with code UNAUTHORIZED if permission is denied
+ */
+export function requirePermission(rbac, ctx, required) {
+    const result = rbac.checkPermission(ctx, required);
+    if (!result.ok) {
+        // S39 IP-4: Internal RBAC errors map to UNAUTHORIZED
+        // Do not expose why the check failed (could leak permission structure)
+        throw new LimenError('UNAUTHORIZED', 'Insufficient permissions for this operation.');
+    }
+    if (!result.value) {
+        throw new LimenError('UNAUTHORIZED', 'Insufficient permissions for this operation.');
+    }
+}
+/**
+ * I-13, §34: Build an OperationContext from session state.
+ *
+ * This is the standard way to construct the identity context that flows
+ * through the kernel and orchestration layers. Every API call needs one.
+ *
+ * In single-user mode: tenantId is null, userId is null, permissions is the
+ * full set (RBAC dormant per §3.7).
+ *
+ * In multi-tenant mode: tenantId and userId come from the session,
+ * permissions come from the RBAC engine's role resolution.
+ *
+ * @param tenantId - Tenant identifier (null in single-user mode)
+ * @param userId - User identifier (null for system operations)
+ * @param agentId - Agent identifier (null if no agent context)
+ * @param permissions - Resolved permission set for this principal
+ * @param sessionId - Session identifier (optional)
+ */
+export function buildOperationContext(tenantId, userId, agentId, permissions, sessionId) {
+    const ctx = {
+        tenantId,
+        userId,
+        agentId,
+        permissions,
+    };
+    // OperationContext.sessionId is optional per the interface
+    if (sessionId !== undefined) {
+        return { ...ctx, sessionId };
+    }
+    return ctx;
+}
+//# sourceMappingURL=rbac_guard.js.map

package/dist/api/enforcement/rbac_guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac_guard.js","sourceRoot":"","sources":["../../../src/api/enforcement/rbac_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAgB,EAChB,GAAqB,EACrB,QAAoB;IAEpB,MAAM,MAAM,GAAoB,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,qDAAqD;QACrD,uEAAuE;QACvE,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,8CAA8C,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,8CAA8C,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAoE,EACpE,MAAgE,EAChE,OAAkE,EAClE,WAAoC,EACpC,SAAgE;IAEhE,MAAM,GAAG,GAAqB;QAC5B,QAAQ;QACR,MAAM;QACN,OAAO;QACP,WAAW;KACZ,CAAC;IAEF,2DAA2D;IAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/api/errors/limen_error.d.ts

@@ -0,0 +1,81 @@
+/**
+ * LimenError: Public API error class and error mapping utilities.
+ * S ref: S39 IP-4 (error redaction), SD-02 (exception model), §6.13 (error codes)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: §6.13 of the Synthesized SDD
+ *
+ * Design decisions:
+ *   SD-02: All public methods throw LimenError (exception model).
+ *          Internal Result<T> from kernel/substrate/orchestration is mapped at the boundary.
+ *   FPD-3: Error redaction happens at the API boundary, not per-layer.
+ *          Internal KernelError details (SQL, stack traces, file paths) are NEVER exposed.
+ *
+ * Invariants enforced: I-13 (authorization completeness -- UNAUTHORIZED errors)
+ * Failure modes defended: FM-10 (tenant data leakage -- no internal state in errors)
+ */
+import type { KernelError, Result, LimenViolation } from '../../kernel/interfaces/index.js';
+import type { LimenErrorCode } from '../interfaces/api.js';
+/**
+ * S39 IP-4, SD-02: Public API error.
+ * Extends Error for standard catch semantics.
+ * Internal details (stack traces, SQL errors, file paths) are NEVER exposed.
+ *
+ * All public API methods throw this type. Internal Result<T> errors are mapped
+ * to LimenError at the API boundary (FPD-3).
+ *
+ * S ref: §6.13, S39 IP-4, SD-02
+ */
+export declare class LimenError extends Error {
+    readonly code: LimenErrorCode;
+    readonly retryable: boolean;
+    readonly cooldownMs?: number;
+    readonly suggestion?: string;
+    /** Phase 0A: Governance violations that triggered this error (BC-080) */
+    readonly violations?: readonly LimenViolation[];
+    constructor(code: LimenErrorCode, message: string, options?: {
+        readonly cooldownMs?: number;
+        readonly suggestion?: string;
+        readonly violations?: readonly LimenViolation[];
+    });
+}
+/**
+ * S39 IP-4, FPD-3: Map a kernel/orchestration Result<T> error to a LimenError.
+ *
+ * This is the API boundary error transformation.
+ * Internal KernelError details are redacted. Only the machine-readable code
+ * and a sanitized message are exposed to consumers.
+ *
+ * @param error - The internal KernelError from L1/L1.5/L2
+ * @returns LimenError ready to throw to consumers
+ */
+export declare function mapKernelError(error: KernelError): LimenError;
+/**
+ * S39 IP-4, SD-02: Unwrap a Result<T> or throw LimenError.
+ *
+ * Convenience function for the common pattern:
+ *   const result = await orchestration.someCall(ctx, input);
+ *   const value = unwrapResult(result);
+ *
+ * If the Result is ok, returns the value.
+ * If the Result is not ok, maps the KernelError and throws LimenError.
+ *
+ * @param result - The internal Result<T> from L1/L1.5/L2
+ * @returns The unwrapped value of type T
+ * @throws LimenError if result.ok is false
+ */
+export declare function unwrapResult<T>(result: Result<T>): T;
+/**
+ * S39 IP-4: Guard function that ensures any thrown error is a LimenError.
+ *
+ * If the caught error is already a LimenError, re-throw as-is.
+ * If it's a standard Error, map to ENGINE_UNHEALTHY with redacted message.
+ * If it's something else entirely, map to ENGINE_UNHEALTHY with generic message.
+ *
+ * Usage:
+ *   try { ... } catch (e) { throw ensureLimenError(e); }
+ *
+ * This guarantees SD-02: all public methods throw LimenError, never raw errors.
+ */
+export declare function ensureLimenError(error: unknown): LimenError;
+//# sourceMappingURL=limen_error.d.ts.map

package/dist/api/errors/limen_error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limen_error.d.ts","sourceRoot":"","sources":["../../../src/api/errors/limen_error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAC5F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgJ3D;;;;;;;;;GASG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;gBAG9C,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;KACjD;CA2BJ;AAoFD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAK7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAKpD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAW3D"}

package/dist/api/errors/limen_error.js

@@ -0,0 +1,324 @@
+/**
+ * LimenError: Public API error class and error mapping utilities.
+ * S ref: S39 IP-4 (error redaction), SD-02 (exception model), §6.13 (error codes)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: §6.13 of the Synthesized SDD
+ *
+ * Design decisions:
+ *   SD-02: All public methods throw LimenError (exception model).
+ *          Internal Result<T> from kernel/substrate/orchestration is mapped at the boundary.
+ *   FPD-3: Error redaction happens at the API boundary, not per-layer.
+ *          Internal KernelError details (SQL, stack traces, file paths) are NEVER exposed.
+ *
+ * Invariants enforced: I-13 (authorization completeness -- UNAUTHORIZED errors)
+ * Failure modes defended: FM-10 (tenant data leakage -- no internal state in errors)
+ */
+// ============================================================================
+// Redaction Patterns (S39 IP-4)
+// ============================================================================
+/**
+ * Patterns that indicate internal state leakage.
+ * Any message matching these is replaced with a sanitized version.
+ * S ref: S39 IP-4 (no internal state in public errors)
+ */
+const REDACTION_PATTERNS = [
+    /(?:SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|PRAGMA)\s/i, // SQL statements
+    /\/[a-zA-Z0-9_/.]+\.[a-z]{1,4}/i, // File paths (CF-030: case-insensitive for .TS/.JS)
+    /at\s+\S+\s+\(.+:\d+:\d+\)/, // Stack trace frames
+    /Error:\s+[A-Za-z_]+\s+at\s+/, // Stack trace headers (CF-030: mixed-case error names)
+    /\b(?:api[_-]?key|token|secret|password|credential)\b/i, // Sensitive tokens
+    /sqlite3?_/i, // SQLite internals
+    /SQLITE_/i, // SQLite error codes (CF-030: case-insensitive)
+    /better-sqlite3/i, // Dependency internals
+    /node_modules/i, // Node internals (CF-030: case-insensitive)
+];
+/**
+ * S39 IP-4: Check whether a message contains internal implementation details.
+ * Returns true if the message should be redacted.
+ */
+function containsInternalDetails(message) {
+    for (const pattern of REDACTION_PATTERNS) {
+        if (pattern.test(message)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * S39 IP-4: Sanitize a message by removing internal details.
+ * Returns a generic message if internal state is detected.
+ */
+function sanitizeMessage(code, message) {
+    if (containsInternalDetails(message)) {
+        return GENERIC_MESSAGES[code] ?? 'An internal error occurred.';
+    }
+    return message;
+}
+// ============================================================================
+// Generic Messages (one per error code)
+// ============================================================================
+/**
+ * Safe, generic messages per error code.
+ * Used when the original message contains internal implementation details.
+ */
+const GENERIC_MESSAGES = {
+    // API surface errors
+    RATE_LIMITED: 'Request rate limit exceeded.',
+    TIMEOUT: 'The operation timed out.',
+    CANCELLED: 'The operation was cancelled.',
+    UNAUTHORIZED: 'Insufficient permissions for this operation.',
+    PROVIDER_UNAVAILABLE: 'No LLM provider is currently available.',
+    SCHEMA_VALIDATION_FAILED: 'Output did not match the expected schema.',
+    ENGINE_UNHEALTHY: 'The engine is in an unhealthy state.',
+    SESSION_NOT_FOUND: 'The specified session was not found.',
+    INVALID_CONFIG: 'The engine configuration is invalid.',
+    INVALID_INPUT: 'The provided input is invalid.',
+    // SC-1 through SC-10 pass-through error codes
+    BUDGET_EXCEEDED: 'Token budget has been exceeded.',
+    DEPTH_EXCEEDED: 'Mission tree depth limit exceeded.',
+    CHILDREN_EXCEEDED: 'Maximum child missions exceeded.',
+    TREE_SIZE_EXCEEDED: 'Mission tree size limit exceeded.',
+    CAPABILITY_VIOLATION: 'Agent capability does not include the required permission.',
+    AGENT_NOT_FOUND: 'The specified agent was not found.',
+    DEADLINE_EXCEEDED: 'The mission deadline has passed.',
+    DELEGATION_CYCLE: 'A delegation cycle was detected in the mission tree.',
+    CYCLE_DETECTED: 'A dependency cycle was detected in the task graph.',
+    TASK_LIMIT_EXCEEDED: 'Maximum task count exceeded.',
+    INVALID_DEPENDENCY: 'Invalid task dependency specified.',
+    MISSION_NOT_ACTIVE: 'The mission is not in an active state.',
+    PLAN_REVISION_LIMIT: 'Maximum plan revision count exceeded.',
+    DEPENDENCIES_UNMET: 'Task dependencies have not been satisfied.',
+    CAPABILITY_DENIED: 'Capability request was denied.',
+    WORKER_UNAVAILABLE: 'No worker is available for task execution.',
+    TASK_NOT_PENDING: 'The task is not in a pending state.',
+    STORAGE_EXCEEDED: 'Storage limit exceeded.',
+    ARTIFACT_LIMIT_EXCEEDED: 'Artifact count limit exceeded.',
+    NOT_FOUND: 'The requested resource was not found.',
+    ARCHIVED: 'The requested resource has been archived.',
+    INVALID_TYPE: 'Invalid event type.',
+    MISSION_NOT_FOUND: 'The specified mission was not found.',
+    SANDBOX_VIOLATION: 'Capability execution violated sandbox constraints.',
+    PARENT_INSUFFICIENT: 'Parent mission has insufficient budget.',
+    HUMAN_APPROVAL_REQUIRED: 'Human approval is required for this budget request.',
+    JUSTIFICATION_REQUIRED: 'A justification is required for this budget request.',
+    TASKS_INCOMPLETE: 'Cannot submit result: tasks are incomplete.',
+    NO_ARTIFACTS: 'Cannot submit result: no artifacts produced.',
+    CHECKPOINT_EXPIRED: 'The checkpoint has expired.',
+    INVALID_PLAN: 'The plan revision is invalid.',
+    // Phase 0A governance error codes
+    LIFECYCLE_INVALID_TRANSITION: 'Invalid lifecycle state transition.',
+    SUSPENSION_ACTIVE: 'Operation is blocked by an active suspension.',
+    SUSPENSION_NOT_FOUND: 'The referenced suspension record was not found.',
+    AUTHORITY_INSUFFICIENT: 'Insufficient authority for this operation.',
+    AUTHORITY_SCOPE_EXCEEDED: 'Action exceeds the caller\'s authority scope.',
+    HARD_POLICY_VIOLATION: 'A hard policy constraint was violated.',
+    SOFT_POLICY_VIOLATION: 'A soft policy constraint was violated.',
+    DECISION_CONFLICT: 'A conflicting supervisor decision exists.',
+    CONTRACT_UNSATISFIED: 'Mission contract criteria have not been met.',
+    HANDOFF_REJECTED: 'The handoff was rejected by the delegate.',
+    ATTEMPT_EXHAUSTED: 'Maximum retry attempts have been exhausted.',
+    TRACE_EMISSION_FAILED: 'Trace event emission failed.',
+    EVAL_GATE_FAILED: 'Evaluation gate blocked completion.',
+    MANIFEST_TRUST_VIOLATION: 'Capability manifest trust tier violation.',
+    RESUME_TOKEN_INVALID: 'The resume token is invalid or has been consumed.',
+    RESUME_TOKEN_EXPIRED: 'The resume token has expired.',
+    IDEMPOTENCY_CONFLICT: 'Same idempotency key with different payload.',
+};
+// ============================================================================
+// Retryability Classification
+// ============================================================================
+/**
+ * Error codes that indicate the operation may succeed on retry.
+ * Derived from the nature of each error per spec sections.
+ *
+ * S36: RATE_LIMITED is retryable after cooldown.
+ * S27: TIMEOUT is retryable (transient).
+ * FM-06: PROVIDER_UNAVAILABLE is retryable (provider may recover).
+ * S17: WORKER_UNAVAILABLE is retryable (worker may become free).
+ */
+const RETRYABLE_CODES = new Set([
+    'RATE_LIMITED',
+    'TIMEOUT',
+    'PROVIDER_UNAVAILABLE',
+    'WORKER_UNAVAILABLE',
+]);
+// ============================================================================
+// LimenError Class
+// ============================================================================
+/**
+ * S39 IP-4, SD-02: Public API error.
+ * Extends Error for standard catch semantics.
+ * Internal details (stack traces, SQL errors, file paths) are NEVER exposed.
+ *
+ * All public API methods throw this type. Internal Result<T> errors are mapped
+ * to LimenError at the API boundary (FPD-3).
+ *
+ * S ref: §6.13, S39 IP-4, SD-02
+ */
+export class LimenError extends Error {
+    code;
+    retryable;
+    cooldownMs;
+    suggestion;
+    /** Phase 0A: Governance violations that triggered this error (BC-080) */
+    violations;
+    constructor(code, message, options) {
+        // S39 IP-4: Sanitize message to remove any internal details
+        const safeMessage = sanitizeMessage(code, message);
+        super(safeMessage);
+        this.name = 'LimenError';
+        this.code = code;
+        this.message = safeMessage;
+        this.retryable = RETRYABLE_CODES.has(code);
+        if (options?.cooldownMs !== undefined) {
+            this.cooldownMs = options.cooldownMs;
+        }
+        if (options?.suggestion !== undefined) {
+            this.suggestion = options.suggestion;
+        }
+        if (options?.violations !== undefined) {
+            this.violations = options.violations;
+        }
+        // S39 IP-4: Redact the stack trace. Internal file paths must never leak.
+        // Replace with a minimal, non-revealing stack.
+        this.stack = `LimenError [${code}]: ${safeMessage}`;
+    }
+}
+// ============================================================================
+// Error Mapping Utilities
+// ============================================================================
+/**
+ * S39 IP-4: Known kernel error codes mapped to public LimenErrorCode.
+ * L1/L1.5/L2 use KernelError with string codes.
+ * At the API boundary, we map to the LimenErrorCode union.
+ *
+ * Mapping strategy:
+ *   - Exact match: kernel code IS a LimenErrorCode -> pass through
+ *   - Common internal patterns -> map to closest LimenErrorCode
+ *   - Unknown -> ENGINE_UNHEALTHY (safe catch-all, never exposes internals)
+ */
+const KERNEL_CODE_MAP = {
+    // Direct matches (kernel codes that ARE LimenErrorCodes)
+    BUDGET_EXCEEDED: 'BUDGET_EXCEEDED',
+    DEPTH_EXCEEDED: 'DEPTH_EXCEEDED',
+    CHILDREN_EXCEEDED: 'CHILDREN_EXCEEDED',
+    TREE_SIZE_EXCEEDED: 'TREE_SIZE_EXCEEDED',
+    CAPABILITY_VIOLATION: 'CAPABILITY_VIOLATION',
+    AGENT_NOT_FOUND: 'AGENT_NOT_FOUND',
+    DEADLINE_EXCEEDED: 'DEADLINE_EXCEEDED',
+    DELEGATION_CYCLE: 'DELEGATION_CYCLE',
+    CYCLE_DETECTED: 'CYCLE_DETECTED',
+    TASK_LIMIT_EXCEEDED: 'TASK_LIMIT_EXCEEDED',
+    INVALID_DEPENDENCY: 'INVALID_DEPENDENCY',
+    MISSION_NOT_ACTIVE: 'MISSION_NOT_ACTIVE',
+    PLAN_REVISION_LIMIT: 'PLAN_REVISION_LIMIT',
+    DEPENDENCIES_UNMET: 'DEPENDENCIES_UNMET',
+    CAPABILITY_DENIED: 'CAPABILITY_DENIED',
+    WORKER_UNAVAILABLE: 'WORKER_UNAVAILABLE',
+    TASK_NOT_PENDING: 'TASK_NOT_PENDING',
+    STORAGE_EXCEEDED: 'STORAGE_EXCEEDED',
+    ARTIFACT_LIMIT_EXCEEDED: 'ARTIFACT_LIMIT_EXCEEDED',
+    NOT_FOUND: 'NOT_FOUND',
+    ARCHIVED: 'ARCHIVED',
+    INVALID_TYPE: 'INVALID_TYPE',
+    MISSION_NOT_FOUND: 'MISSION_NOT_FOUND',
+    SANDBOX_VIOLATION: 'SANDBOX_VIOLATION',
+    PARENT_INSUFFICIENT: 'PARENT_INSUFFICIENT',
+    HUMAN_APPROVAL_REQUIRED: 'HUMAN_APPROVAL_REQUIRED',
+    JUSTIFICATION_REQUIRED: 'JUSTIFICATION_REQUIRED',
+    TASKS_INCOMPLETE: 'TASKS_INCOMPLETE',
+    NO_ARTIFACTS: 'NO_ARTIFACTS',
+    CHECKPOINT_EXPIRED: 'CHECKPOINT_EXPIRED',
+    INVALID_PLAN: 'INVALID_PLAN',
+    // Kernel-specific codes mapped to API equivalents
+    UNAUTHORIZED: 'UNAUTHORIZED',
+    PERMISSION_DENIED: 'UNAUTHORIZED',
+    RBAC_DENIED: 'UNAUTHORIZED',
+    RATE_LIMITED: 'RATE_LIMITED',
+    RATE_LIMIT_EXCEEDED: 'RATE_LIMITED',
+    PROVIDER_UNAVAILABLE: 'PROVIDER_UNAVAILABLE',
+    PROVIDER_ERROR: 'PROVIDER_UNAVAILABLE',
+    PROVIDER_TIMEOUT: 'TIMEOUT',
+    SESSION_NOT_FOUND: 'SESSION_NOT_FOUND',
+    SESSION_EXPIRED: 'SESSION_NOT_FOUND',
+    INVALID_CONFIG: 'INVALID_CONFIG',
+    INVALID_INPUT: 'INVALID_INPUT',
+    SCHEMA_VALIDATION_FAILED: 'SCHEMA_VALIDATION_FAILED',
+    // Phase 0A governance code mappings
+    LIFECYCLE_INVALID_TRANSITION: 'LIFECYCLE_INVALID_TRANSITION',
+    SUSPENSION_ACTIVE: 'SUSPENSION_ACTIVE',
+    SUSPENSION_NOT_FOUND: 'SUSPENSION_NOT_FOUND',
+    AUTHORITY_INSUFFICIENT: 'AUTHORITY_INSUFFICIENT',
+    AUTHORITY_SCOPE_EXCEEDED: 'AUTHORITY_SCOPE_EXCEEDED',
+    HARD_POLICY_VIOLATION: 'HARD_POLICY_VIOLATION',
+    SOFT_POLICY_VIOLATION: 'SOFT_POLICY_VIOLATION',
+    DECISION_CONFLICT: 'DECISION_CONFLICT',
+    CONTRACT_UNSATISFIED: 'CONTRACT_UNSATISFIED',
+    HANDOFF_REJECTED: 'HANDOFF_REJECTED',
+    ATTEMPT_EXHAUSTED: 'ATTEMPT_EXHAUSTED',
+    TRACE_EMISSION_FAILED: 'TRACE_EMISSION_FAILED',
+    EVAL_GATE_FAILED: 'EVAL_GATE_FAILED',
+    MANIFEST_TRUST_VIOLATION: 'MANIFEST_TRUST_VIOLATION',
+    RESUME_TOKEN_INVALID: 'RESUME_TOKEN_INVALID',
+    RESUME_TOKEN_EXPIRED: 'RESUME_TOKEN_EXPIRED',
+    IDEMPOTENCY_CONFLICT: 'IDEMPOTENCY_CONFLICT',
+};
+/**
+ * S39 IP-4, FPD-3: Map a kernel/orchestration Result<T> error to a LimenError.
+ *
+ * This is the API boundary error transformation.
+ * Internal KernelError details are redacted. Only the machine-readable code
+ * and a sanitized message are exposed to consumers.
+ *
+ * @param error - The internal KernelError from L1/L1.5/L2
+ * @returns LimenError ready to throw to consumers
+ */
+export function mapKernelError(error) {
+    const code = KERNEL_CODE_MAP[error.code] ?? 'ENGINE_UNHEALTHY';
+    const message = sanitizeMessage(code, error.message);
+    return new LimenError(code, message);
+}
+/**
+ * S39 IP-4, SD-02: Unwrap a Result<T> or throw LimenError.
+ *
+ * Convenience function for the common pattern:
+ *   const result = await orchestration.someCall(ctx, input);
+ *   const value = unwrapResult(result);
+ *
+ * If the Result is ok, returns the value.
+ * If the Result is not ok, maps the KernelError and throws LimenError.
+ *
+ * @param result - The internal Result<T> from L1/L1.5/L2
+ * @returns The unwrapped value of type T
+ * @throws LimenError if result.ok is false
+ */
+export function unwrapResult(result) {
+    if (result.ok) {
+        return result.value;
+    }
+    throw mapKernelError(result.error);
+}
+/**
+ * S39 IP-4: Guard function that ensures any thrown error is a LimenError.
+ *
+ * If the caught error is already a LimenError, re-throw as-is.
+ * If it's a standard Error, map to ENGINE_UNHEALTHY with redacted message.
+ * If it's something else entirely, map to ENGINE_UNHEALTHY with generic message.
+ *
+ * Usage:
+ *   try { ... } catch (e) { throw ensureLimenError(e); }
+ *
+ * This guarantees SD-02: all public methods throw LimenError, never raw errors.
+ */
+export function ensureLimenError(error) {
+    if (error instanceof LimenError) {
+        return error;
+    }
+    if (error instanceof Error) {
+        // S39 IP-4: Do not expose the original error message -- it may contain internals
+        return new LimenError('ENGINE_UNHEALTHY', 'An internal error occurred.');
+    }
+    return new LimenError('ENGINE_UNHEALTHY', 'An internal error occurred.');
+}
+//# sourceMappingURL=limen_error.js.map

package/dist/api/errors/limen_error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limen_error.js","sourceRoot":"","sources":["../../../src/api/errors/limen_error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,+EAA+E;AAC/E,gCAAgC;AAChC,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,6DAA6D,EAAI,iBAAiB;IAClF,gCAAgC,EAAgC,oDAAoD;IACpH,2BAA2B,EAAqC,qBAAqB;IACrF,6BAA6B,EAAmC,uDAAuD;IACvH,uDAAuD,EAAS,mBAAmB;IACnF,YAAY,EAAqD,mBAAmB;IACpF,UAAU,EAAuD,gDAAgD;IACjH,iBAAiB,EAAgD,uBAAuB;IACxF,eAAe,EAAkD,4CAA4C;CAC9G,CAAC;AAEF;;;GAGG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAoB,EAAE,OAAe;IAC5D,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,6BAA6B,CAAC;IACjE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,gBAAgB,GAA6C;IACjE,qBAAqB;IACrB,YAAY,EAAE,8BAA8B;IAC5C,OAAO,EAAE,0BAA0B;IACnC,SAAS,EAAE,8BAA8B;IACzC,YAAY,EAAE,8CAA8C;IAC5D,oBAAoB,EAAE,yCAAyC;IAC/D,wBAAwB,EAAE,2CAA2C;IACrE,gBAAgB,EAAE,sCAAsC;IACxD,iBAAiB,EAAE,sCAAsC;IACzD,cAAc,EAAE,sCAAsC;IACtD,aAAa,EAAE,gCAAgC;IAE/C,8CAA8C;IAC9C,eAAe,EAAE,iCAAiC;IAClD,cAAc,EAAE,oCAAoC;IACpD,iBAAiB,EAAE,kCAAkC;IACrD,kBAAkB,EAAE,mCAAmC;IACvD,oBAAoB,EAAE,4DAA4D;IAClF,eAAe,EAAE,oCAAoC;IACrD,iBAAiB,EAAE,kCAAkC;IACrD,gBAAgB,EAAE,sDAAsD;IACxE,cAAc,EAAE,oDAAoD;IACpE,mBAAmB,EAAE,8BAA8B;IACnD,kBAAkB,EAAE,oCAAoC;IACxD,kBAAkB,EAAE,wCAAwC;IAC5D,mBAAmB,EAAE,uCAAuC;IAC5D,kBAAkB,EAAE,4CAA4C;IAChE,iBAAiB,EAAE,gCAAgC;IACnD,kBAAkB,EAAE,4CAA4C;IAChE,gBAAgB,EAAE,qCAAqC;IACvD,gBAAgB,EAAE,yBAAyB;IAC3C,uBAAuB,EAAE,gCAAgC;IACzD,SAAS,EAAE,uCAAuC;IAClD,QAAQ,EAAE,2CAA2C;IACrD,YAAY,EAAE,qBAAqB;IACnC,iBAAiB,EAAE,sCAAsC;IACzD,iBAAiB,EAAE,oDAAoD;IACvE,mBAAmB,EAAE,yCAAyC;IAC9D,uBAAuB,EAAE,qDAAqD;IAC9E,sBAAsB,EAAE,sDAAsD;IAC9E,gBAAgB,EAAE,6CAA6C;IAC/D,YAAY,EAAE,8CAA8C;IAC5D,kBAAkB,EAAE,6BAA6B;IACjD,YAAY,EAAE,+BAA+B;IAC7C,kCAAkC;IAClC,4BAA4B,EAAE,qCAAqC;IACnE,iBAAiB,EAAE,+CAA+C;IAClE,oBAAoB,EAAE,iDAAiD;IACvE,sBAAsB,EAAE,4CAA4C;IACpE,wBAAwB,EAAE,+CAA+C;IACzE,qBAAqB,EAAE,wCAAwC;IAC/D,qBAAqB,EAAE,wCAAwC;IAC/D,iBAAiB,EAAE,2CAA2C;IAC9D,oBAAoB,EAAE,8CAA8C;IACpE,gBAAgB,EAAE,2CAA2C;IAC7D,iBAAiB,EAAE,6CAA6C;IAChE,qBAAqB,EAAE,8BAA8B;IACrD,gBAAgB,EAAE,qCAAqC;IACvD,wBAAwB,EAAE,2CAA2C;IACrE,oBAAoB,EAAE,mDAAmD;IACzE,oBAAoB,EAAE,+BAA+B;IACrD,oBAAoB,EAAE,8CAA8C;CACrE,CAAC;AAEF,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D,cAAc;IACd,SAAS;IACT,sBAAsB;IACtB,oBAAoB;CACrB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAiB;IACrB,SAAS,CAAU;IACnB,UAAU,CAAU;IACpB,UAAU,CAAU;IAC7B,yEAAyE;IAChE,UAAU,CAA6B;IAEhD,YACE,IAAoB,EACpB,OAAe,EACf,OAIC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,KAAK,CAAC,WAAW,CAAC,CAAC;QAEnB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE3C,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;QAED,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;QAED,yEAAyE;QACzE,+CAA+C;QAC/C,IAAI,CAAC,KAAK,GAAG,eAAe,IAAI,MAAM,WAAW,EAAE,CAAC;IACtD,CAAC;CACF;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,eAAe,GAA6C;IAChE,yDAAyD;IACzD,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,kBAAkB,EAAE,oBAAoB;IACxC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,mBAAmB;IACtC,gBAAgB,EAAE,kBAAkB;IACpC,cAAc,EAAE,gBAAgB;IAChC,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;IACtC,kBAAkB,EAAE,oBAAoB;IACxC,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,YAAY,EAAE,cAAc;IAC5B,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;IACtC,mBAAmB,EAAE,qBAAqB;IAC1C,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAChD,gBAAgB,EAAE,kBAAkB;IACpC,YAAY,EAAE,cAAc;IAC5B,kBAAkB,EAAE,oBAAoB;IACxC,YAAY,EAAE,cAAc;IAE5B,kDAAkD;IAClD,YAAY,EAAE,cAAc;IAC5B,iBAAiB,EAAE,cAAc;IACjC,WAAW,EAAE,cAAc;IAC3B,YAAY,EAAE,cAAc;IAC5B,mBAAmB,EAAE,cAAc;IACnC,oBAAoB,EAAE,sBAAsB;IAC5C,cAAc,EAAE,sBAAsB;IACtC,gBAAgB,EAAE,SAAS;IAC3B,iBAAiB,EAAE,mBAAmB;IACtC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,wBAAwB,EAAE,0BAA0B;IACpD,oCAAoC;IACpC,4BAA4B,EAAE,8BAA8B;IAC5D,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB,EAAE,wBAAwB;IAChD,wBAAwB,EAAE,0BAA0B;IACpD,qBAAqB,EAAE,uBAAuB;IAC9C,qBAAqB,EAAE,uBAAuB;IAC9C,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,gBAAgB,EAAE,kBAAkB;IACpC,iBAAiB,EAAE,mBAAmB;IACtC,qBAAqB,EAAE,uBAAuB;IAC9C,gBAAgB,EAAE,kBAAkB;IACpC,wBAAwB,EAAE,0BAA0B;IACpD,oBAAoB,EAAE,sBAAsB;IAC5C,oBAAoB,EAAE,sBAAsB;IAC5C,oBAAoB,EAAE,sBAAsB;CAC7C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,MAAM,IAAI,GAAmB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC;IAC/E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAErD,OAAO,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAI,MAAiB;IAC/C,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,iFAAiF;QACjF,OAAO,IAAI,UAAU,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAC3E,CAAC"}