openplanr 1.16.2 → 1.18.0

package/dist/services/operate/mission-dispatch.d.ts

@@ -0,0 +1,193 @@
+import { type OperatingEvidenceIndexItem, type OperatingRoleId, type OperatingSensitivity } from './types.js';
+/**
+ * Bounded, read-only native mission dispatch (FR2 / E-002).
+ *
+ * This module owns the two enforcement guarantees the pack path never needed:
+ *
+ *  1. A native advisory lens receives EXACTLY the Protocol v1.3 read-only tool
+ *     grant — glob, file read, content search, and read-only git history —
+ *     confined to its declared, sensitivity-ceiling-narrowed roots. No write,
+ *     execute, network, or environment capability exists on the surface at all,
+ *     so a mission agent physically cannot mutate, shell out, egress, or read
+ *     ambient process state.
+ *  2. The sensitivity ceiling is enforced at READ time: even inside a granted
+ *     root, a file above the role's ceiling is refused. This preserves the
+ *     pack-era filter-before-handoff guarantee under agent-driven reads.
+ *
+ * It also owns the per-role dispatch-mode resolution (FR4 / E-004): the derived
+ * registry default (`mission`), the per-project `dispatchModeOverrides`, and the
+ * FR2-vs-FR4 reconciliation that routes non-enforcing runtimes to the structured
+ * provider path. The new mission honeytoken suite exercises every refusal here;
+ * the SPEC-002 empty-tool suite continues to govern the pack path unchanged.
+ */
+export type OperatingDispatchMode = 'pack' | 'mission';
+/**
+ * The effective isolation a role's dispatch resolves to. Mirrors the isolation
+ * vocabulary the pipeline's v1.3 adapter handoff emits so OpenPlanr and the
+ * published contract cannot drift:
+ *  - `enforced-empty-tools`         — the v1.2 pack path (empty-tool brief);
+ *  - `enforced-read-only-bounded`   — a native mission lens with the bounded
+ *                                     read-only grant, on a runtime that
+ *                                     natively enforces tool isolation;
+ *  - `fail-closed-structured-provider` — mission requested but the runtime
+ *                                     cannot enforce the boundary, so the role
+ *                                     falls back to the structured provider.
+ */
+export type OperatingDispatchIsolation = 'enforced-empty-tools' | 'enforced-read-only-bounded' | 'fail-closed-structured-provider';
+export interface OperatingDispatchModeResolution {
+    roleId: OperatingRoleId;
+    /** The configured mode: registry default, overridden by dispatchModeOverrides. */
+    mode: OperatingDispatchMode;
+    /** The effective isolation after the FR2/FR4 reconciliation. */
+    isolation: OperatingDispatchIsolation;
+    /** True only when a native, bounded read-only lens is actually dispatched. */
+    native: boolean;
+    /** Audit note explaining why this isolation was chosen (recorded in provenance). */
+    reconciliation: string;
+}
+/**
+ * The bounded read-only capability set for a mission-mode lens. Kept in lockstep
+ * with the pipeline's `MISSION_READ_ONLY_TOOLS`: no write, execute, network, or
+ * environment tool is present, so a grant assembled from it can never authorize
+ * a mutating or escaping action.
+ */
+export declare const MISSION_READ_ONLY_TOOLS: readonly ["file-read", "glob", "content-search", "git-log", "git-show", "git-diff", "git-blame"];
+export type MissionReadOnlyTool = (typeof MISSION_READ_ONLY_TOOLS)[number];
+/**
+ * The registry default dispatch mode for a role. The v1.3 role registry carries
+ * a `dispatchMode` field; while it is still published without one every role
+ * defaults to `mission`, and only a role explicitly marked `pack` opts out —
+ * exactly the pipeline's own `role?.dispatchMode ?? 'mission'` convention.
+ */
+export declare function operatingRegistryDispatchMode(role: {
+    dispatchMode?: unknown;
+}): OperatingDispatchMode;
+/**
+ * Whether the given runtime natively enforces the mission read-only boundary.
+ * `claude-code` enforces; `codex` and `cursor` are advisory and do not.
+ */
+export declare function operatingRuntimeEnforcesBoundedReadOnly(runtime: string | undefined): Promise<boolean>;
+/**
+ * Resolve one role's effective dispatch isolation.
+ *
+ * FR4 states Codex SHOULD dispatch natively, but FR2's fail-closed rule
+ * overrides it: a runtime whose tool isolation is only advisory (`codex`,
+ * `cursor`) cannot guarantee the bounded read-only boundary, so it routes to the
+ * structured provider path until its isolation is enforceable. Only a runtime
+ * that natively enforces tool isolation (`toolIsolation === 'enforced'`, i.e.
+ * `claude-code`) hosting a native-isolated adapter receives a native mission
+ * lens; every other combination fails closed here. This is the exact FR2/FR4
+ * reconciliation the spec calls out, recorded in the returned `reconciliation`
+ * so it appears in the dispatch provenance.
+ */
+export declare function resolveOperatingDispatchMode(input: {
+    roleId: OperatingRoleId;
+    registryDefault: OperatingDispatchMode;
+    override?: OperatingDispatchMode;
+    runtimeEnforcesBoundedReadOnly: boolean;
+    adapterNativeCapable: boolean;
+}): OperatingDispatchModeResolution;
+/**
+ * Narrow a role's declared read roots by DENY-LISTING any root that contains an
+ * evidence item above the role's sensitivity ceiling, so no above-ceiling file
+ * is readable even inside a granted root. Pass the FULL (pre-ceiling-filter)
+ * evidence index: the narrowing needs to see the above-ceiling items the packet
+ * index itself excludes. Combined with the read-time ceiling check on the
+ * bounded reader, this is the belt-and-suspenders that preserves the pack-era
+ * filter-before-handoff guarantee under agent-driven reads.
+ */
+export declare function narrowMissionRootsToCeiling(input: {
+    declaredRoots: readonly string[];
+    evidenceIndex: readonly OperatingEvidenceIndexItem[];
+    ceiling: OperatingSensitivity;
+}): string[];
+export interface MissionReadBoundary {
+    /**
+     * Absolute, resolved read roots (already sensitivity-ceiling-narrowed). A read
+     * target must resolve inside one of these or it is refused as a root escape.
+     */
+    roots: readonly string[];
+    /** The role's sensitivity ceiling, enforced at read time. */
+    ceiling: OperatingSensitivity;
+    /**
+     * The sensitivity of a resolved absolute path. In production this is built
+     * from the ceiling-filtered evidence index; an in-root path with no explicit
+     * classification falls back to `defaultSensitivity`.
+     */
+    sensitivityByPath?: ReadonlyMap<string, OperatingSensitivity>;
+    /**
+     * Sensitivity assumed for an in-root path with no explicit classification.
+     * Defaults to the ceiling itself (readable) because the ceiling-filtered index
+     * and root narrowing already exclude above-ceiling material; individual
+     * above-ceiling files are still refused by the read-time check below.
+     */
+    defaultSensitivity?: OperatingSensitivity;
+    /** Repository root for read-only git tools. Defaults to the first read root. */
+    repositoryRoot?: string;
+}
+export type MissionToolRequest = {
+    tool: 'file-read';
+    path: string;
+} | {
+    tool: 'glob';
+    pattern?: string;
+    root?: string;
+} | {
+    tool: 'content-search';
+    query: string;
+    root?: string;
+} | {
+    tool: 'git-log' | 'git-show' | 'git-diff' | 'git-blame';
+    args?: string[];
+    path?: string;
+} | {
+    tool: string;
+    [key: string]: unknown;
+};
+export type MissionToolResult = {
+    tool: 'file-read';
+    path: string;
+    content: string;
+} | {
+    tool: 'glob';
+    matches: string[];
+} | {
+    tool: 'content-search';
+    matches: Array<{
+        path: string;
+        line: number;
+        text: string;
+    }>;
+} | {
+    tool: 'git-log' | 'git-show' | 'git-diff' | 'git-blame';
+    output: string;
+};
+/**
+ * The single audited entry point for a mission lens's tool use. Every request is
+ * checked against the bounded read-only grant BEFORE any filesystem or git
+ * access: a tool outside the grant (write, execute, network, environment, or any
+ * unknown surface) is refused, a target outside the declared roots is refused as
+ * a path escape, and a target above the sensitivity ceiling is refused at read
+ * time. There is deliberately no write/execute/network/environment tool to
+ * invoke — those channels do not exist on this surface at all.
+ */
+export declare function invokeMissionTool(boundary: MissionReadBoundary, request: MissionToolRequest): Promise<MissionToolResult>;
+/**
+ * The concrete callable tool surface handed to an in-process native harness:
+ * exactly the read-only tools, each bound to this boundary. There is no write,
+ * execute, network, or environment callable on the returned object, so a harness
+ * that walks it can never reach a mutating or escaping capability.
+ */
+export declare function createMissionToolset(boundary: MissionReadBoundary): Record<MissionReadOnlyTool, (request: Omit<MissionToolRequest, 'tool'>) => Promise<MissionToolResult>>;
+/**
+ * Fan a per-item dispatch out in parallel where the adapter reports
+ * `parallelDispatch: true`, sequentially otherwise. Results are always returned
+ * in the SAME order as `items`, so the caller can restore registry order and the
+ * reduced events are byte-identical across parallel and sequential dispatch.
+ */
+export declare function runMissionDispatchFanOut<Item, Result>(input: {
+    items: readonly Item[];
+    parallel: boolean;
+    run: (item: Item) => Promise<Result>;
+}): Promise<Result[]>;
+//# sourceMappingURL=mission-dispatch.d.ts.map

package/dist/services/operate/mission-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-dispatch.d.ts","sourceRoot":"","sources":["../../../src/services/operate/mission-dispatch.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,0BAA0B,GAClC,sBAAsB,GACtB,4BAA4B,GAC5B,iCAAiC,CAAC;AAEtC,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,eAAe,CAAC;IACxB,kFAAkF;IAClF,IAAI,EAAE,qBAAqB,CAAC;IAC5B,gEAAgE;IAChE,SAAS,EAAE,0BAA0B,CAAC;IACtC,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAC;IAChB,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,kGAQzB,CAAC;AAEZ,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAU3E;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE;IAClD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,qBAAqB,CAExB;AA+CD;;;GAGG;AACH,wBAAsB,uCAAuC,CAC3D,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,MAAM,EAAE,eAAe,CAAC;IACxB,eAAe,EAAE,qBAAqB,CAAC;IACvC,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,oBAAoB,EAAE,OAAO,CAAC;CAC/B,GAAG,+BAA+B,CAiClC;AAeD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IACjD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACrD,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,MAAM,EAAE,CASX;AAMD,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,6DAA6D;IAC7D,OAAO,EAAE,oBAAoB,CAAC;IAC9B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC9D;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3F;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAE7C,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACxF;IAAE,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAsQhF;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CAoC5B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,mBAAmB,GAC5B,MAAM,CACP,mBAAmB,EACnB,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAC1E,CAUA;AAMD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IAClE,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CASpB"}

package/dist/services/operate/mission-dispatch.js

@@ -0,0 +1,444 @@
+import { readdir, readFile, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { resolveOperatingPipelineRoot } from './protocol.js';
+import { executeGitReadOnly } from './read-only-providers.js';
+import { compareSensitivity } from './redaction.js';
+import { OperateError, } from './types.js';
+/**
+ * The bounded read-only capability set for a mission-mode lens. Kept in lockstep
+ * with the pipeline's `MISSION_READ_ONLY_TOOLS`: no write, execute, network, or
+ * environment tool is present, so a grant assembled from it can never authorize
+ * a mutating or escaping action.
+ */
+export const MISSION_READ_ONLY_TOOLS = Object.freeze([
+    'file-read',
+    'glob',
+    'content-search',
+    'git-log',
+    'git-show',
+    'git-diff',
+    'git-blame',
+]);
+function isReadOnlyTool(tool) {
+    return MISSION_READ_ONLY_TOOLS.includes(tool);
+}
+// ---------------------------------------------------------------------------
+// Dispatch-mode resolution (FR4 / E-004) + runtime enforceability (FR2)
+// ---------------------------------------------------------------------------
+/**
+ * The registry default dispatch mode for a role. The v1.3 role registry carries
+ * a `dispatchMode` field; while it is still published without one every role
+ * defaults to `mission`, and only a role explicitly marked `pack` opts out —
+ * exactly the pipeline's own `role?.dispatchMode ?? 'mission'` convention.
+ */
+export function operatingRegistryDispatchMode(role) {
+    return role?.dispatchMode === 'pack' ? 'pack' : 'mission';
+}
+let cachedRuntimeEnforcement = null;
+/**
+ * Load the pipeline's runtime registry and derive, per runtime, whether it
+ * natively enforces the bounded read-only boundary. The classification is the
+ * published `capabilities.toolIsolation === 'enforced'` bit — the same one the
+ * pipeline's adapter handoff uses — so it stays a single source of truth rather
+ * than a field the registry schema cannot carry.
+ *
+ * Fails CLOSED: if the mission-capable pipeline root or its runtime module
+ * cannot be resolved, nothing is treated as enforcing, so a runtime whose
+ * isolation cannot be verified never receives a native lens (DoD).
+ */
+async function loadRuntimeEnforcement() {
+    cachedRuntimeEnforcement ??= (async () => {
+        try {
+            const root = resolveOperatingPipelineRoot({ requireMission: true });
+            if (!root)
+                return () => false;
+            const module = (await import(pathToFileURL(path.join(root, 'lib', 'pipeline', 'runtime.mjs')).href));
+            const adapters = module.listRuntimeAdapters();
+            return (runtime) => {
+                if (!runtime || runtime === 'auto')
+                    return false;
+                let id;
+                try {
+                    id = module.normalizeRuntime(runtime);
+                }
+                catch {
+                    return false;
+                }
+                const adapter = adapters.find((entry) => entry.id === id);
+                return adapter?.capabilities?.toolIsolation === 'enforced';
+            };
+        }
+        catch {
+            return () => false;
+        }
+    })();
+    return cachedRuntimeEnforcement;
+}
+/**
+ * Whether the given runtime natively enforces the mission read-only boundary.
+ * `claude-code` enforces; `codex` and `cursor` are advisory and do not.
+ */
+export async function operatingRuntimeEnforcesBoundedReadOnly(runtime) {
+    return (await loadRuntimeEnforcement())(runtime);
+}
+/**
+ * Resolve one role's effective dispatch isolation.
+ *
+ * FR4 states Codex SHOULD dispatch natively, but FR2's fail-closed rule
+ * overrides it: a runtime whose tool isolation is only advisory (`codex`,
+ * `cursor`) cannot guarantee the bounded read-only boundary, so it routes to the
+ * structured provider path until its isolation is enforceable. Only a runtime
+ * that natively enforces tool isolation (`toolIsolation === 'enforced'`, i.e.
+ * `claude-code`) hosting a native-isolated adapter receives a native mission
+ * lens; every other combination fails closed here. This is the exact FR2/FR4
+ * reconciliation the spec calls out, recorded in the returned `reconciliation`
+ * so it appears in the dispatch provenance.
+ */
+export function resolveOperatingDispatchMode(input) {
+    const mode = input.override ?? input.registryDefault;
+    if (mode === 'pack') {
+        return {
+            roleId: input.roleId,
+            mode,
+            isolation: 'enforced-empty-tools',
+            native: false,
+            reconciliation: input.override === 'pack'
+                ? 'dispatchModeOverrides rolled this role back to the v1.2 empty-tool pack path'
+                : 'registry default selects the v1.2 empty-tool pack path',
+        };
+    }
+    if (input.runtimeEnforcesBoundedReadOnly && input.adapterNativeCapable) {
+        return {
+            roleId: input.roleId,
+            mode,
+            isolation: 'enforced-read-only-bounded',
+            native: true,
+            reconciliation: 'runtime natively enforces tool isolation; a bounded read-only mission lens is dispatched',
+        };
+    }
+    return {
+        roleId: input.roleId,
+        mode,
+        isolation: 'fail-closed-structured-provider',
+        native: false,
+        reconciliation: input.runtimeEnforcesBoundedReadOnly
+            ? 'adapter cannot host a bounded native lens; falling back to the structured provider path'
+            : 'runtime tool isolation is advisory or unverifiable (FR2 fail-closed overrides FR4); routing to the structured provider path',
+    };
+}
+// ---------------------------------------------------------------------------
+// Sensitivity-ceiling root narrowing (FR2)
+// ---------------------------------------------------------------------------
+/**
+ * The top-level path segment a declared read root is derived from. Mission roots
+ * are single top-level directory segments (see `deriveOperatingDeclaredRoots`).
+ */
+function topSegment(relativePath) {
+    const [top] = relativePath.split('/');
+    return top && top.length > 0 ? top : null;
+}
+/**
+ * Narrow a role's declared read roots by DENY-LISTING any root that contains an
+ * evidence item above the role's sensitivity ceiling, so no above-ceiling file
+ * is readable even inside a granted root. Pass the FULL (pre-ceiling-filter)
+ * evidence index: the narrowing needs to see the above-ceiling items the packet
+ * index itself excludes. Combined with the read-time ceiling check on the
+ * bounded reader, this is the belt-and-suspenders that preserves the pack-era
+ * filter-before-handoff guarantee under agent-driven reads.
+ */
+export function narrowMissionRootsToCeiling(input) {
+    const denied = new Set();
+    for (const item of input.evidenceIndex) {
+        if (!item.path)
+            continue;
+        if (compareSensitivity(item.sensitivity, input.ceiling) <= 0)
+            continue;
+        const top = topSegment(item.path);
+        if (top)
+            denied.add(top);
+    }
+    return input.declaredRoots.filter((root) => !denied.has(root)).sort();
+}
+const MAX_MISSION_READ_BYTES = 256 * 1024;
+const MAX_MISSION_WALK_ENTRIES = 5_000;
+function refuseCapability(tool) {
+    throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Mission tool "${tool}" is not in the bounded read-only grant; write, execute, ` +
+        'network, and environment access are refused.', { tool, allowed: [...MISSION_READ_ONLY_TOOLS] });
+}
+function resolvedRoots(boundary) {
+    return boundary.roots.map((root) => path.resolve(root));
+}
+function isContained(roots, absolute) {
+    return roots.some((root) => absolute === root || absolute.startsWith(`${root}${path.sep}`));
+}
+function resolveWithinRoots(boundary, requestPath) {
+    if (typeof requestPath !== 'string' || requestPath.length === 0) {
+        throw new OperateError('E_OPERATE_PATH_ESCAPE', 'Mission read requires a non-empty path.');
+    }
+    const roots = resolvedRoots(boundary);
+    const candidates = path.isAbsolute(requestPath)
+        ? [path.resolve(requestPath)]
+        : roots.map((root) => path.resolve(root, requestPath));
+    for (const candidate of candidates) {
+        if (isContained(roots, candidate))
+            return candidate;
+    }
+    throw new OperateError('E_OPERATE_PATH_ESCAPE', `Mission read target "${requestPath}" resolves outside the declared read roots.`, { roots: [...boundary.roots] });
+}
+/**
+ * Defeat symlink escapes: after path-based containment, resolve the real target
+ * and re-check it against the real roots. Both sides are realpath-resolved so a
+ * platform-level symlink on the temp namespace (e.g. macOS `/var`→`/private/var`)
+ * does not produce a false escape.
+ */
+async function assertNoSymlinkEscape(boundary, absolute) {
+    let real;
+    try {
+        real = await realpath(absolute);
+    }
+    catch {
+        // Target does not exist yet; the caller's read/stat surfaces the real error.
+        return;
+    }
+    const realRoots = await Promise.all(resolvedRoots(boundary).map((root) => realpath(root).catch(() => root)));
+    if (!isContained(realRoots, real)) {
+        throw new OperateError('E_OPERATE_PATH_ESCAPE', `Mission read target "${absolute}" escapes the declared read roots through a symlink.`);
+    }
+}
+function classify(boundary, absolute) {
+    return (boundary.sensitivityByPath?.get(absolute) ?? boundary.defaultSensitivity ?? boundary.ceiling);
+}
+function assertBelowCeiling(boundary, absolute) {
+    const sensitivity = classify(boundary, absolute);
+    if (compareSensitivity(sensitivity, boundary.ceiling) > 0) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Mission read of "${absolute}" is ${sensitivity}, above the ${boundary.ceiling} ceiling.`, { sensitivity, ceiling: boundary.ceiling });
+    }
+}
+async function readBoundedFile(boundary, requestPath) {
+    const absolute = resolveWithinRoots(boundary, requestPath);
+    await assertNoSymlinkEscape(boundary, absolute);
+    assertBelowCeiling(boundary, absolute);
+    const info = await stat(absolute);
+    if (!info.isFile()) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Mission read target "${absolute}" is not a file.`);
+    }
+    if (info.size > MAX_MISSION_READ_BYTES) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Mission read target "${absolute}" exceeds the ${MAX_MISSION_READ_BYTES}-byte read bound.`);
+    }
+    return readFile(absolute, 'utf8');
+}
+async function* walkRoot(root) {
+    let visited = 0;
+    const stack = [root];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        const entries = await readdir(current, { withFileTypes: true }).catch(() => null);
+        if (!entries)
+            continue;
+        for (const entry of entries) {
+            if (entry.name === '.git' || entry.name === 'node_modules')
+                continue;
+            const child = path.join(current, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(child);
+            }
+            else if (entry.isFile()) {
+                visited += 1;
+                if (visited > MAX_MISSION_WALK_ENTRIES)
+                    return;
+                yield child;
+            }
+        }
+    }
+}
+/**
+ * Render a filesystem path with forward-slash separators so a glob pattern —
+ * always authored with `/` — matches identically on every platform. `path.join`
+ * yields `\` separators on Windows, which the pattern's `/` can never match, so
+ * a recursive `.ts` glob would otherwise return nothing on Windows. Normalizing
+ * only the candidate fed to the matcher (never the stored/returned path) keeps
+ * the emitted matches in native form for the caller's own containment checks. On
+ * POSIX `path.sep` is `/`, so this is a no-op.
+ */
+function toGlobMatchPath(target) {
+    return target.split(path.sep).join('/');
+}
+function simplePatternToRegExp(pattern) {
+    let out = '';
+    let index = 0;
+    while (index < pattern.length) {
+        const char = pattern[index];
+        if (char === '*') {
+            if (pattern[index + 1] === '*') {
+                out += '.*';
+                index += 2;
+            }
+            else {
+                out += '[^/]*';
+                index += 1;
+            }
+        }
+        else {
+            out += char.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+            index += 1;
+        }
+    }
+    return new RegExp(`${out}$`);
+}
+async function globWithinRoots(boundary, pattern, root) {
+    const roots = root ? [resolveWithinRoots(boundary, root)] : resolvedRoots(boundary);
+    const matcher = simplePatternToRegExp(pattern || '**/*');
+    const matches = [];
+    for (const searchRoot of roots) {
+        for await (const file of walkRoot(searchRoot)) {
+            if (!matcher.test(toGlobMatchPath(file)))
+                continue;
+            try {
+                assertBelowCeiling(boundary, file);
+            }
+            catch {
+                continue;
+            }
+            matches.push(file);
+        }
+    }
+    return [...new Set(matches)].sort();
+}
+async function contentSearchWithinRoots(boundary, query, root) {
+    if (typeof query !== 'string' || query.length === 0) {
+        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Mission content-search requires a query.');
+    }
+    const roots = root ? [resolveWithinRoots(boundary, root)] : resolvedRoots(boundary);
+    const hits = [];
+    for (const searchRoot of roots) {
+        for await (const file of walkRoot(searchRoot)) {
+            try {
+                assertBelowCeiling(boundary, file);
+            }
+            catch {
+                continue;
+            }
+            const info = await stat(file).catch(() => null);
+            if (!info?.isFile() || info.size > MAX_MISSION_READ_BYTES)
+                continue;
+            const content = await readFile(file, 'utf8').catch(() => null);
+            if (content === null)
+                continue;
+            content.split(/\r?\n/).forEach((text, index) => {
+                if (text.includes(query))
+                    hits.push({ path: file, line: index + 1, text: text.slice(0, 512) });
+            });
+        }
+    }
+    return hits;
+}
+function assertGitArgsBounded(args) {
+    for (const argument of args) {
+        if (typeof argument !== 'string') {
+            throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Mission git arguments must be strings.');
+        }
+        if (argument.startsWith('--output') || argument === '-o' || argument.includes('../..')) {
+            throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Mission git arguments cannot redirect output.');
+        }
+    }
+}
+async function runBoundedGit(boundary, subcommand, request) {
+    const repositoryRoot = boundary.repositoryRoot
+        ? path.resolve(boundary.repositoryRoot)
+        : resolvedRoots(boundary)[0];
+    if (!repositoryRoot) {
+        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Mission git tools require a repository root.');
+    }
+    const extra = request.args ?? [];
+    assertGitArgsBounded(extra);
+    const args = [subcommand, ...extra];
+    if (request.path) {
+        // Any path argument stays confined to the declared roots.
+        const confined = resolveWithinRoots(boundary, request.path);
+        args.push('--', path.relative(repositoryRoot, confined) || '.');
+    }
+    // `executeGitReadOnly` re-asserts the read-only git allowlist (no mutation,
+    // no repository/config overrides) as a second, independent gate.
+    return executeGitReadOnly(repositoryRoot, args);
+}
+/**
+ * The single audited entry point for a mission lens's tool use. Every request is
+ * checked against the bounded read-only grant BEFORE any filesystem or git
+ * access: a tool outside the grant (write, execute, network, environment, or any
+ * unknown surface) is refused, a target outside the declared roots is refused as
+ * a path escape, and a target above the sensitivity ceiling is refused at read
+ * time. There is deliberately no write/execute/network/environment tool to
+ * invoke — those channels do not exist on this surface at all.
+ */
+export async function invokeMissionTool(boundary, request) {
+    const tool = String(request.tool ?? '');
+    if (!isReadOnlyTool(tool))
+        refuseCapability(tool);
+    switch (tool) {
+        case 'file-read': {
+            const requestPath = String(request.path ?? '');
+            return {
+                tool: 'file-read',
+                path: requestPath,
+                content: await readBoundedFile(boundary, requestPath),
+            };
+        }
+        case 'glob': {
+            const pattern = request.pattern ?? '**/*';
+            const root = request.root;
+            return { tool: 'glob', matches: await globWithinRoots(boundary, pattern, root) };
+        }
+        case 'content-search': {
+            const query = String(request.query ?? '');
+            const root = request.root;
+            return {
+                tool: 'content-search',
+                matches: await contentSearchWithinRoots(boundary, query, root),
+            };
+        }
+        case 'git-log':
+        case 'git-show':
+        case 'git-diff':
+        case 'git-blame': {
+            const subcommand = tool.slice('git-'.length);
+            const typed = request;
+            return { tool, output: await runBoundedGit(boundary, subcommand, typed) };
+        }
+        default:
+            return refuseCapability(tool);
+    }
+}
+/**
+ * The concrete callable tool surface handed to an in-process native harness:
+ * exactly the read-only tools, each bound to this boundary. There is no write,
+ * execute, network, or environment callable on the returned object, so a harness
+ * that walks it can never reach a mutating or escaping capability.
+ */
+export function createMissionToolset(boundary) {
+    const toolset = {};
+    for (const tool of MISSION_READ_ONLY_TOOLS) {
+        toolset[tool] = (request) => invokeMissionTool(boundary, { ...request, tool });
+    }
+    return toolset;
+}
+// ---------------------------------------------------------------------------
+// Fan-out orchestration (FR2 parallel/sequential, FR4 determinism)
+// ---------------------------------------------------------------------------
+/**
+ * Fan a per-item dispatch out in parallel where the adapter reports
+ * `parallelDispatch: true`, sequentially otherwise. Results are always returned
+ * in the SAME order as `items`, so the caller can restore registry order and the
+ * reduced events are byte-identical across parallel and sequential dispatch.
+ */
+export async function runMissionDispatchFanOut(input) {
+    if (input.parallel) {
+        return Promise.all(input.items.map((item) => input.run(item)));
+    }
+    const results = [];
+    for (const item of input.items) {
+        results.push(await input.run(item));
+    }
+    return results;
+}
+//# sourceMappingURL=mission-dispatch.js.map

package/dist/services/operate/mission-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-dispatch.js","sourceRoot":"","sources":["../../../src/services/operate/mission-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,YAAY,GAIb,MAAM,YAAY,CAAC;AAuDpB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,WAAW;IACX,MAAM;IACN,gBAAgB;IAChB,SAAS;IACT,UAAU;IACV,UAAU;IACV,WAAW;CACH,CAAC,CAAC;AAIZ,SAAS,cAAc,CAAC,IAAY;IAClC,OAAQ,uBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAE7C;IACC,OAAO,IAAI,EAAE,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,IAAI,wBAAwB,GAA6D,IAAI,CAAC;AAO9F;;;;;;;;;;GAUG;AACH,KAAK,UAAU,sBAAsB;IACnC,wBAAwB,KAAK,CAAC,KAAK,IAAI,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,4BAA4B,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI;gBAAE,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAC1B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CACtE,CAAqC,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC9C,OAAO,CAAC,OAAO,EAAE,EAAE;gBACjB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACjD,IAAI,EAAU,CAAC;gBACf,IAAI,CAAC;oBACH,EAAE,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,OAAO,OAAO,EAAE,YAAY,EAAE,aAAa,KAAK,UAAU,CAAC;YAC7D,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC3D,OAA2B;IAE3B,OAAO,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAM5C;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,eAAe,CAAC;IACrD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI;YACJ,SAAS,EAAE,sBAAsB;YACjC,MAAM,EAAE,KAAK;YACb,cAAc,EACZ,KAAK,CAAC,QAAQ,KAAK,MAAM;gBACvB,CAAC,CAAC,8EAA8E;gBAChF,CAAC,CAAC,wDAAwD;SAC/D,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,8BAA8B,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QACvE,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI;YACJ,SAAS,EAAE,4BAA4B;YACvC,MAAM,EAAE,IAAI;YACZ,cAAc,EACZ,0FAA0F;SAC7F,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI;QACJ,SAAS,EAAE,iCAAiC;QAC5C,MAAM,EAAE,KAAK;QACb,cAAc,EAAE,KAAK,CAAC,8BAA8B;YAClD,CAAC,CAAC,yFAAyF;YAC3F,CAAC,CAAC,6HAA6H;KAClI,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,UAAU,CAAC,YAAoB;IACtC,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAI3C;IACC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,SAAS;QACzB,IAAI,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AA4CD,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC1C,MAAM,wBAAwB,GAAG,KAAK,CAAC;AAEvC,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,iBAAiB,IAAI,2DAA2D;QAC9E,8CAA8C,EAChD,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,uBAAuB,CAAC,EAAE,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAA6B;IAClD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB,EAAE,QAAgB;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6B,EAAE,WAAmB;IAC5E,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,YAAY,CAAC,uBAAuB,EAAE,yCAAyC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAC7C,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACtD,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,wBAAwB,WAAW,6CAA6C,EAChF,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAC/B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,qBAAqB,CAClC,QAA6B,EAC7B,QAAgB;IAEhB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,aAAa,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;IACF,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CACpB,uBAAuB,EACvB,wBAAwB,QAAQ,sDAAsD,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAA6B,EAAE,QAAgB;IAC/D,OAAO,CACL,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,OAAO,CAC7F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA6B,EAAE,QAAgB;IACzE,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,oBAAoB,QAAQ,QAAQ,WAAW,eAAe,QAAQ,CAAC,OAAO,WAAW,EACzF,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAA6B,EAC7B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC3D,MAAM,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,wBAAwB,QAAQ,kBAAkB,CACnD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,GAAG,sBAAsB,EAAE,CAAC;QACvC,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,wBAAwB,QAAQ,iBAAiB,sBAAsB,mBAAmB,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAY;IACnC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAY,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,OAAO,GAAG,wBAAwB;oBAAE,OAAO;gBAC/C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAW,CAAC;QACtC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,GAAG,IAAI,IAAI,CAAC;gBACZ,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,OAAO,CAAC;gBACf,KAAK,IAAI,CAAC,CAAC;YACb,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YACjD,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAA6B,EAC7B,OAAe,EACf,IAAa;IAEb,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACnD,IAAI,CAAC;gBACH,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,QAA6B,EAC7B,KAAa,EACb,IAAa;IAEb,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACpF,MAAM,IAAI,GAAwD,EAAE,CAAC;IACrE,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,sBAAsB;gBAAE,SAAS;YACpE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS;YAC/B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAC7C,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;oBACtB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,+CAA+C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAA6B,EAC7B,UAA6C,EAC7C,OAA2C;IAE3C,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc;QAC5C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QACvC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IACjC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,0DAA0D;QAC1D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;IACD,4EAA4E;IAC5E,iEAAiE;IACjE,OAAO,kBAAkB,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA6B,EAC7B,OAA2B;IAE3B,MAAM,IAAI,GAAG,MAAM,CAAE,OAA8B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;QAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,WAAW,GAAG,MAAM,CAAE,OAA8B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;YACvE,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,MAAM,eAAe,CAAC,QAAQ,EAAE,WAAW,CAAC;aACtD,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,OAAO,GAAI,OAAgC,CAAC,OAAO,IAAI,MAAM,CAAC;YACpE,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,MAAM,CAAE,OAA+B,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,GAAI,OAA6B,CAAC,IAAI,CAAC;YACjD,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,MAAM,wBAAwB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC;aAC/D,CAAC;QACJ,CAAC;QACD,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAsC,CAAC;YAClF,MAAM,KAAK,GAAG,OAA6C,CAAC;YAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD;YACE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA6B;IAK7B,MAAM,OAAO,GAAG,EAGf,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAC1B,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAI,OAAkB,EAAE,IAAI,EAAwB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAe,KAI5D;IACC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}