pi-daddy 0.13.0

package/dist/approval.js

@@ -0,0 +1,244 @@
+/**
+ * Approval model for gated capabilities — pure, so it is exhaustively testable without pi.
+ *
+ * `resolve()` computes `gatedBlocked`: capabilities a session legitimately holds but which may not enter
+ * a child's grant without a human saying so. This module decides WHAT a yes means — how far it reaches,
+ * how long it lasts, and what it is keyed to. It never performs I/O and never prompts; see
+ * `approval-store.ts` and `approval-prompt.ts` for those.
+ *
+ * ADR-0010 records the four decisions encoded here.
+ */
+import { WILDCARD } from "./pi-tools.js";
+/**
+ * Subject used for delegate-path approvals.
+ *
+ * The delegate tool has no human-authored subject: the only things naming a child are the task string and
+ * the tool list, both chosen by the model. A key the model controls is not a key, so delegate approvals
+ * use this fixed literal — "allow write for delegations this session" — and are never persisted.
+ * Angle brackets cannot appear in an agent-type name (`parseAgentType` reads an identifier), so this can
+ * never collide with a real type.
+ */
+export const DELEGATE_SUBJECT = "<delegate>";
+/**
+ * Lifetime of a persisted approval.
+ *
+ * Deliberately a constant rather than an environment variable: a knob that silently extends every gate is
+ * the first thing an impatient operator would reach for.
+ */
+export const APPROVAL_TTL_DAYS = 30;
+const DAY_MS = 86_400_000;
+/** `tool:write` + `docs-writer` -> `tool:write@docs-writer`. */
+export function approvalKey(capability, subject) {
+    return `${capability}@${subject}`;
+}
+/**
+ * May this resolution raise an approval dialog?
+ *
+ * `resolve()` computes `denied` and `gatedBlocked` INDEPENDENTLY (deliberately — each rejection reason is
+ * reported rather than masked by whichever filter ran first), and both `decideSpawn` and `planDelegation`
+ * refuse outright on `denied` while still attaching the full result. So a request mixing a gated capability
+ * with one the session does not hold at all would otherwise prompt a human about the gated one and then be
+ * refused anyway for the other.
+ *
+ * That is not merely noise. A *session* yes is recorded and republished to children, and an *always* yes is
+ * written to disk for 30 days — both banked against a spawn that never happened, and both reachable by a
+ * model that appends one unheld capability to an otherwise ordinary request. A person is therefore only
+ * asked about a spawn that would actually proceed if they said yes.
+ *
+ * `clipped` is deliberately NOT a bar: it does not refuse a spawn, it just drops those capabilities from
+ * the child's grant, so the spawn does proceed and the question is real.
+ */
+export function shouldSeekApproval(result) {
+    if (!result)
+        return false;
+    if (result.denied.length > 0)
+        return false;
+    // ADR-0011. A grant retaining a universal capability is refused by `assertNarrowing` no matter what
+    // a human says, so asking is worse than useless: the dialog cannot change the outcome, and a
+    // `session`- or `always`-scoped yes given there is banked and reused for later spawns that DO
+    // proceed. Same harm the `denied` guard above exists to prevent.
+    if (result.universal.length > 0)
+        return false;
+    return result.gatedBlocked.length > 0;
+}
+/**
+ * Scopes a given call site may offer. `always` requires a **human-authored subject**.
+ *
+ * ADR-0019. The rule is unchanged; which paths satisfy it is not. `"interceptor"` used to be the only one
+ * and ADR-0016 deleted it, leaving `always` offerable from nowhere — 220 lines of persistence no live path
+ * could write to. `"definition"` is `delegate({agent})`, where ADR-0017 makes the subject an
+ * operator-authored file the session must hold `agent:<name>` to name at all. `"delegate"` is the `tools:`
+ * form, where the original reasoning stands untouched: the only things naming that child are the task and
+ * the tool list, both model-chosen, and a key the model controls is not a key.
+ */
+export function offeredScopes(path) {
+    return path === "definition" ? ["once", "session", "always"] : ["once", "session"];
+}
+/**
+ * What a child may inherit, as `capability@subject` keys.
+ *
+ * ADR-0014 changed this in two ways, and both were cases of a human's explicit choice being discarded
+ * one hop down:
+ *
+ *  - **`once` is dropped** (A-S1). The scope chosen was not carried, so a `once` approval was written
+ *    into the child's `PI_GRANTS_APPROVED` and republished onward — the most conservative answer a human
+ *    can give produced the least conservative outcome, across an entire descendant subtree.
+ *  - **The subject is kept** (A-S6). Bare capabilities were published, so a `<delegate>`-subject approval
+ *    matched *any* subject below. `approvalKey`'s own doc argues at length that a model-controlled name
+ *    is not a key; erasing the subject made that argument moot exactly where it mattered.
+ *
+ * The clamp to `grant` is unchanged and still load-bearing: **approval cannot conjure a capability**, so
+ * an inherited yes is only ever honoured for something the child independently holds.
+ */
+export function inheritApprovals(approved, grant) {
+    const held = new Set(grant);
+    return [
+        ...new Set(approved
+            .filter((a) => a.scope !== "once" && a.capability !== WILDCARD && held.has(a.capability))
+            // A definition subject MUST carry a pin to cross a boundary (ADR-0022, hardened after F1).
+            //
+            // `verifyInherited` honours an unpinned entry by decision — `<delegate>` names no file and a
+            // pre-0.11 parent sends none — so an unpinned entry for a subject that *does* name a file is an
+            // approval exempt from the digest check. Enforcing it at the point of PUBLICATION rather than
+            // trusting each caller to attach a digest is what makes it structural: two call sites build these
+            // entries, one of them forgot, and every fresh approval crossed unpinned as a result. A caller that
+            // cannot produce a digest (the definition is not on disk here) now publishes nothing, which is the
+            // fail-closed direction.
+            .filter((a) => a.subject === DELEGATE_SUBJECT || Boolean(a.bodySha256))
+            .map((a) => approvalKey(a.capability, a.subject) + (a.bodySha256 ? `#${a.bodySha256}` : ""))),
+    ].sort();
+}
+/**
+ * Read the inherited set back on the child side.
+ *
+ * Anything that is not a well-formed `capability@subject` pair is dropped rather than guessed at. An
+ * unparseable entry granting nothing is a missing prompt; an unparseable entry granting *something* is a
+ * silent escalation, so the direction of the failure is not a matter of taste.
+ */
+export function parseInherited(raw) {
+    const out = new Map();
+    for (const item of (raw ?? "").split(",")) {
+        const trimmed = item.trim();
+        // ADR-0022 appends `#<sha256>`. Split it off FIRST: a `#` cannot appear in a capability id or in a
+        // definition name (identity comes from a path component), so this is unambiguous.
+        const hash = trimmed.indexOf("#");
+        const key = hash === -1 ? trimmed : trimmed.slice(0, hash);
+        const digest = hash === -1 ? undefined : trimmed.slice(hash + 1);
+        const at = key.indexOf("@");
+        if (at <= 0 || at === key.length - 1)
+            continue;
+        if (hash !== -1 && !digest)
+            continue; // `key#` promises a pin and carries none — drop it, do not guess
+        out.set(key, digest);
+    }
+    return out;
+}
+/**
+ * Drop inherited approvals that were given for different instructions (ADR-0022).
+ *
+ * The hole this closes: `resolveApprovals` checks `inherited` FIRST and none of it had ever been through
+ * `entryVerdict`, so ADR-0019's headline property — an approval is void once the instructions change — held
+ * on the one path that persists and neither of the two that do not. A child is a fresh process: it re-reads
+ * the definition from disk, so a `git pull` between the parent's approval and the child's spawn meant the
+ * child ran a rewritten body under a yes given about the old one, recording `approvalSource: "inherited"`.
+ *
+ * An entry with **no** digest is honoured, and that is not a hole: `<delegate>` legitimately has none, and
+ * neither does a pre-0.11 parent. It is the same trade `entryVerdict` refuses to make for a *persisted*
+ * entry — but that entry is 30 days old and read off disk, whereas this one was handed over by a live parent
+ * process in the same tree, which is a much shorter chain to trust.
+ */
+export function verifyInherited(parsed, snapshotOf) {
+    const out = new Set();
+    for (const [key, digest] of parsed) {
+        if (digest === undefined) {
+            out.add(key);
+            continue;
+        }
+        const current = snapshotOf(key.slice(key.indexOf("@") + 1));
+        if (current && current.bodySha256 === digest)
+            out.add(key);
+    }
+    return out;
+}
+/** When an approval granted now stops being valid. Computed once at write time and stored, so an entry's
+ *  lifetime is visible in the file rather than implied by whichever version of the code reads it. */
+export function expiryFor(approvedAt) {
+    return new Date(approvedAt.getTime() + APPROVAL_TTL_DAYS * DAY_MS).toISOString();
+}
+/**
+ * Decide whether a persisted approval still means what the human meant.
+ *
+ * Four ways it can stop meaning that, and each is reported distinctly so `/grants approvals` can explain
+ * itself rather than silently showing fewer rows:
+ *
+ *  - `foreign-cwd`  — the file was copied or committed and opened somewhere else. Nobody in THIS checkout
+ *                     was asked, so it authorises nothing here (R-27).
+ *  - `expired`      — a gate opened during one project must not still be open next quarter.
+ *  - `type-changed` — the confused deputy. The key names a file whose contents can change after approval:
+ *                     approve `tool:write@docs-writer` when it declares `read, write`, and later that file
+ *                     gains `bash`. The entry would still match the key while describing something the
+ *                     human never saw.
+ *  - `instructions-changed` — the same confused deputy, one level deeper. The tools are untouched but the
+ *                     BODY was rewritten, so the child would now be told to do something the human never
+ *                     saw. Only checkable since ADR-0018 gave the body a digest; an entry carrying no body
+ *                     pin lands here too, because unverifiable is not the same as unchanged.
+ *  - `type-missing` — the type was deleted or renamed; a new file could later claim the same name.
+ */
+export function entryVerdict(input) {
+    if (input.entry.cwd !== input.cwd)
+        return "foreign-cwd";
+    const expiresAt = new Date(input.entry.expiresAt).getTime();
+    // NaN <= x is false in JS, so an unparseable date would otherwise fail OPEN. A cache we cannot
+    // read the expiry of is a cache we do not trust — treat it as expired, per the spec's rule that a
+    // broken cache grants nothing.
+    if (!Number.isFinite(expiresAt) || expiresAt <= input.now.getTime())
+        return "expired";
+    if (input.current === null)
+        return "type-missing";
+    // Compare as sorted lists: reformatting or reordering a `tools:` line is not a change; adding,
+    // removing, or renaming a capability is.
+    const approved = [...input.entry.grantAtApproval].sort().join(",");
+    const current = [...input.current.ceiling].sort().join(",");
+    if (approved !== current)
+        return "type-changed";
+    // Fail closed on an unpinned entry: it was written before bodies were digested, so "unchanged" is not
+    // something this code can assert about it. One re-approval is the honest cost.
+    if (input.entry.bodyAtApproval !== input.current.bodySha256)
+        return "instructions-changed";
+    return "valid";
+}
+/**
+ * Satisfy as much of `gated` as possible without asking anyone.
+ *
+ * Precedence is inherited -> session -> persisted -> prompt. Order matters only for what gets REPORTED
+ * (the ledger's `approvalSource`); any hit satisfies equally. Checking all three before prompting is what
+ * stops an orchestrator's tenth delegation from raising a tenth identical dialog.
+ */
+export function resolveApprovals(input) {
+    // ADR-0014: these are `capability@subject` keys now, not bare capabilities, so an approval given for
+    // one subject can no longer satisfy another.
+    const inherited = input.inherited ?? new Set();
+    const approved = [];
+    const needsPrompt = [];
+    const sources = {};
+    for (const capability of [...new Set(input.gated)].sort()) {
+        const key = approvalKey(capability, input.subject);
+        if (inherited.has(key)) {
+            approved.push(capability);
+            sources[capability] = "inherited";
+        }
+        else if (input.sessionApprovals.has(key)) {
+            approved.push(capability);
+            sources[capability] = "session";
+        }
+        else if (input.persisted.has(key)) {
+            approved.push(capability);
+            sources[capability] = "persisted";
+        }
+        else {
+            needsPrompt.push(capability);
+        }
+    }
+    return { approved, needsPrompt, sources };
+}
+//# sourceMappingURL=approval.js.map

package/dist/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../src/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAYzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,UAAsB,EAAE,OAAe;IACjE,OAAO,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAiC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,oGAAoG;IACpG,6FAA6F;IAC7F,8FAA8F;IAC9F,iEAAiE;IACjE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB;IAC9C,OAAO,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AACrF,CAAC;AAyBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA+B,EAAE,KAAmB;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO;QACL,GAAG,IAAI,GAAG,CACR,QAAQ;aACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACzF,2FAA2F;YAC3F,EAAE;YACF,6FAA6F;YAC7F,gGAAgG;YAChG,8FAA8F;YAC9F,kGAAkG;YAClG,oGAAoG;YACpG,mGAAmG;YACnG,yBAAyB;aACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,gBAAgB,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;aACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC/F;KACF,CAAC,IAAI,EAAE,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,mGAAmG;QACnG,kFAAkF;QAClF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/C,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,iEAAiE;QACvG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA+C,EAC/C,UAAuD;IAEvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;qGACqG;AACrG,MAAM,UAAU,SAAS,CAAC,UAAgB;IACxC,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC;AA2DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,+FAA+F;IAC/F,kGAAkG;IAClG,+BAA+B;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,cAAc,CAAC;IAClD,+FAA+F;IAC/F,yCAAyC;IACzC,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IAChD,sGAAsG;IACtG,+EAA+E;IAC/E,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,OAAO,CAAC,UAAU;QAAE,OAAO,sBAAsB,CAAC;IAC3F,OAAO,OAAO,CAAC;AACjB,CAAC;AA2BD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B;IAC3D,qGAAqG;IACrG,6CAA6C;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,GAAG,EAAU,CAAC;IACvD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAuC,EAAE,CAAC;IAEvD,KAAK,MAAM,UAAU,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;QACpC,CAAC;aAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;QAClC,CAAC;aAAM,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,WAAW,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC"}

package/dist/capabilities.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Capability ids: their grammar, and the two authority predicates over them.
+ *
+ * Split out of `delegate.ts` when ADR-0024 pushed that file past the 400-line ceiling and
+ * `test/file-size.test.ts` refused it — for the second time, and answered the same way as the first: split
+ * the file the way the failure message says rather than raise the cap on the guard.
+ *
+ * The seam is not arbitrary. Three modules outside `delegate.ts` already imported these
+ * (`extensions/session.ts` for `DELEGATE_CAPABILITY`, `extensions/delegation.ts` and
+ * `extensions/run-delegation.ts` for `maySpawnDefinition`), which is the evidence that they were a separate
+ * concern living in the wrong file: *what an id means and who may use it* is a different question from
+ * *what one delegation does*.
+ */
+import { type Capability } from "./resolve.ts";
+/** The capability that authorises spawning a definition (ADR-0017). `tool:*` satisfies any of them. */
+export declare const agentCapability: (name: string) => Capability;
+/**
+ * May this grant spawn that definition? (ADR-0017.)
+ *
+ * `resolve()` is exact-match plus subsumption and has no wildcard rule — a wildcard session works only
+ * because `deriveOwnGrant` *enumerates* its observed tools alongside `tool:*`. Definitions are not tools,
+ * so nothing enumerates them, and the wildcard has to be honoured here explicitly. Without that an
+ * UNGOVERNED session would stop being able to spawn, and "governance is opt-in" is the one rule this
+ * package must never break by accident.
+ */
+export declare function maySpawnDefinition(ownGrant: Capability[], name: string): boolean;
+/** The tool name that confers the ability to delegate further. */
+export declare const DELEGATE_CAPABILITY: Capability;
+/** Accept `read` or `tool:read` or `ext:pkg/tool` and normalise to a capability id. */
+export declare function normaliseCapability(raw: string): Capability;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/D,uGAAuG;AACvG,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,UAA6B,CAAC;AAE7E;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,kEAAkE;AAClE,eAAO,MAAM,mBAAmB,EAAE,UAA4B,CAAC;AAE/D,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAM3D"}

package/dist/capabilities.js

@@ -0,0 +1,45 @@
+/**
+ * Capability ids: their grammar, and the two authority predicates over them.
+ *
+ * Split out of `delegate.ts` when ADR-0024 pushed that file past the 400-line ceiling and
+ * `test/file-size.test.ts` refused it — for the second time, and answered the same way as the first: split
+ * the file the way the failure message says rather than raise the cap on the guard.
+ *
+ * The seam is not arbitrary. Three modules outside `delegate.ts` already imported these
+ * (`extensions/session.ts` for `DELEGATE_CAPABILITY`, `extensions/delegation.ts` and
+ * `extensions/run-delegation.ts` for `maySpawnDefinition`), which is the evidence that they were a separate
+ * concern living in the wrong file: *what an id means and who may use it* is a different question from
+ * *what one delegation does*.
+ */
+import { AGENT_WILDCARD } from "./resolve.js";
+import { WILDCARD } from "./pi-tools.js";
+/** The capability that authorises spawning a definition (ADR-0017). `tool:*` satisfies any of them. */
+export const agentCapability = (name) => `agent:${name}`;
+/**
+ * May this grant spawn that definition? (ADR-0017.)
+ *
+ * `resolve()` is exact-match plus subsumption and has no wildcard rule — a wildcard session works only
+ * because `deriveOwnGrant` *enumerates* its observed tools alongside `tool:*`. Definitions are not tools,
+ * so nothing enumerates them, and the wildcard has to be honoured here explicitly. Without that an
+ * UNGOVERNED session would stop being able to spawn, and "governance is opt-in" is the one rule this
+ * package must never break by accident.
+ */
+export function maySpawnDefinition(ownGrant, name) {
+    // ADR-0023 adds the middle case. `tool:*` is authority to grant every tool and satisfies this too;
+    // `agent:*` is authority to spawn any definition and grants no tools at all, which is the configuration
+    // an operator wanting "any of our definitions, narrow tools" previously had to fake with `tool:*`.
+    return (ownGrant.includes(WILDCARD) ||
+        ownGrant.includes(AGENT_WILDCARD) ||
+        ownGrant.includes(agentCapability(name)));
+}
+/** The tool name that confers the ability to delegate further. */
+export const DELEGATE_CAPABILITY = "tool:delegate";
+/** Accept `read` or `tool:read` or `ext:pkg/tool` and normalise to a capability id. */
+export function normaliseCapability(raw) {
+    const value = raw.trim();
+    if (value.startsWith("tool:") || value.startsWith("ext:") || value.startsWith("skill:") || value.startsWith("agent:")) {
+        return value;
+    }
+    return `tool:${value}`;
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;AAE7E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAsB,EAAE,IAAY;IACrE,mGAAmG;IACnG,wGAAwG;IACxG,mGAAmG;IACnG,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC;QACjC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAe,eAAe,CAAC;AAE/D,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/catalog.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Live capability catalog — what *can* be granted, enumerated at runtime.
+ *
+ * Until now grants were checked against agent-type files alone, which covers `tool:` capabilities and
+ * nothing else. That leaves two gaps: extension tools are invisible (so `ext:` grants cannot be
+ * validated), and **skills were ungovernable** despite "skills and tools" being half the requirement.
+ *
+ * Sources, and why each is trusted:
+ *  - **tools** — the `tools` array of a live provider request. Authoritative: it is exactly what pi sent
+ *    the model, so it includes extension-registered tools and reflects any `--tools` allowlist already in
+ *    force. Nothing else can see the real surface.
+ *  - **skills** — `SKILL.md` directories and top-level `.md` files under pi's skill roots.
+ *  - **definitions** — spawnable `SKILL.md` agents (ADR-0016), as `agent:<name>`.
+ *
+ * Provenance note: a provider payload gives tool NAMES, not owning packages, so extension tools cannot be
+ * qualified as `ext:<pkg>/<tool>` from that source alone. They are catalogued as `tool:<name>` — which is
+ * also how pi's `--tools` matches — and marked `kind: "extension"` for display. `ext:` ids remain
+ * supported for hand-authored grants; `deriveOwnGrant` already matches them by bare name.
+ */
+import { type SkillDefinition } from "./definitions.ts";
+import { type Capability } from "./resolve.ts";
+export type CapabilityKind = "builtin" | "extension" | "skill" | "agentType";
+export interface CatalogEntry {
+    capability: Capability;
+    kind: CapabilityKind;
+    /** Where it was found, for display and debugging. */
+    source?: string;
+}
+export interface Catalog {
+    entries: CatalogEntry[];
+    /** Every capability id in the catalog. */
+    all: Capability[];
+    byKind(kind: CapabilityKind): Capability[];
+    has(capability: Capability): boolean;
+}
+/** Split observed tool names into pi built-ins and extension-provided tools. */
+export declare function classifyToolNames(observed: string[]): CatalogEntry[];
+/** Skill roots pi discovers, project first. */
+export declare function skillDirs(cwd: string): string[];
+/**
+ * Discover skills: a directory containing `SKILL.md` is one skill named after the directory; a top-level
+ * `.md` file is a skill named after the file. Mirrors pi's documented convention.
+ *
+ * Directories are not descended into beyond one level, matching pi's rule that a directory containing
+ * `SKILL.md` is a single skill rather than a tree to explore.
+ */
+export declare function loadSkills(cwd: string): Promise<CatalogEntry[]>;
+/**
+ * Spawnable definitions, as `agent:<name>` capabilities.
+ *
+ * A definition is BOTH a skill (loadable into a session) and an agent (spawnable as a child) — ADR-0016
+ * collapsed those into one file — so the same `SKILL.md` legitimately appears twice in the catalog under
+ * two capability ids. That is not duplication: `skill:review` means "may load these instructions" and
+ * `agent:review` means "may spawn a child running them", and a grant can hold either without the other.
+ */
+export declare function definitionEntries(definitions: Map<string, SkillDefinition>): CatalogEntry[];
+/** Assemble a catalog from parts. Pure, so it is testable without a filesystem. */
+export declare function makeCatalog(entries: CatalogEntry[]): Catalog;
+/** Build the live catalog. `observedTools` comes from a provider payload; null when not yet seen. */
+export declare function buildCatalog(input: {
+    cwd: string;
+    observedTools: string[] | null;
+}): Promise<Catalog>;
+/**
+ * Capabilities requested that the catalog does not contain.
+ *
+ * Reported separately from `denied` because the causes differ and so do the fixes: `denied` means the
+ * delegator lacks authority, `unknown` means the capability does not exist here — usually a typo or a
+ * stale grant referring to an uninstalled package. Silently treating unknown as denied hides that.
+ */
+export declare function unknownCapabilities(requested: Capability[], catalog: Catalog): Capability[];
+/**
+ * Skill name -> absolute path, for `planSpawn`'s `--skill` flags (R-32).
+ *
+ * Derived from the catalog's own `source` field rather than re-scanning, so what a child is handed
+ * cannot drift from what was discovered and offered. A skill entry without a source is omitted, which
+ * makes it *unresolvable* rather than silently absent — `planDelegation` refuses on that, because a
+ * grant naming a skill the child never receives is a ledger line that lies.
+ */
+export declare function skillPathsFromCatalog(catalog: Catalog): Record<string, string>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,GAAG,WAAW,CAAC;AAE7E,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,cAAc,CAAC;IACrB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,0CAA0C;IAC1C,GAAG,EAAE,UAAU,EAAE,CAAC;IAClB,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,EAAE,CAAC;IAC3C,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC;CACtC;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAMpE;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA+BrE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,YAAY,EAAE,CAM3F;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAY5D;AAED,qGAAqG;AACrG,wBAAsB,YAAY,CAAC,KAAK,EAAE;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAChC,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,EAAE,CAQ3F;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO9E"}

package/dist/catalog.js

@@ -0,0 +1,164 @@
+/**
+ * Live capability catalog — what *can* be granted, enumerated at runtime.
+ *
+ * Until now grants were checked against agent-type files alone, which covers `tool:` capabilities and
+ * nothing else. That leaves two gaps: extension tools are invisible (so `ext:` grants cannot be
+ * validated), and **skills were ungovernable** despite "skills and tools" being half the requirement.
+ *
+ * Sources, and why each is trusted:
+ *  - **tools** — the `tools` array of a live provider request. Authoritative: it is exactly what pi sent
+ *    the model, so it includes extension-registered tools and reflects any `--tools` allowlist already in
+ *    force. Nothing else can see the real surface.
+ *  - **skills** — `SKILL.md` directories and top-level `.md` files under pi's skill roots.
+ *  - **definitions** — spawnable `SKILL.md` agents (ADR-0016), as `agent:<name>`.
+ *
+ * Provenance note: a provider payload gives tool NAMES, not owning packages, so extension tools cannot be
+ * qualified as `ext:<pkg>/<tool>` from that source alone. They are catalogued as `tool:<name>` — which is
+ * also how pi's `--tools` matches — and marked `kind: "extension"` for display. `ext:` ids remain
+ * supported for hand-authored grants; `deriveOwnGrant` already matches them by bare name.
+ */
+import { readdir, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadDefinitions } from "./definitions.js";
+import { PI_BUILTIN_TOOLS, WILDCARD } from "./pi-tools.js";
+import { AGENT_WILDCARD } from "./resolve.js";
+/** Split observed tool names into pi built-ins and extension-provided tools. */
+export function classifyToolNames(observed) {
+    const builtins = new Set(PI_BUILTIN_TOOLS);
+    return [...new Set(observed)].sort().map((name) => ({
+        capability: `tool:${name}`,
+        kind: builtins.has(name) ? "builtin" : "extension",
+    }));
+}
+/** Skill roots pi discovers, project first. */
+export function skillDirs(cwd) {
+    return [join(cwd, ".pi", "skills"), join(homedir(), ".pi", "agent", "skills")];
+}
+/**
+ * Discover skills: a directory containing `SKILL.md` is one skill named after the directory; a top-level
+ * `.md` file is a skill named after the file. Mirrors pi's documented convention.
+ *
+ * Directories are not descended into beyond one level, matching pi's rule that a directory containing
+ * `SKILL.md` is a single skill rather than a tree to explore.
+ */
+export async function loadSkills(cwd) {
+    const found = new Map();
+    for (const dir of skillDirs(cwd)) {
+        let names;
+        try {
+            names = await readdir(dir);
+        }
+        catch {
+            continue; // absent skill root is normal
+        }
+        for (const name of names.sort()) {
+            const path = join(dir, name);
+            try {
+                const info = await stat(path);
+                if (info.isDirectory()) {
+                    const inner = await readdir(path).catch(() => []);
+                    if (inner.includes("SKILL.md") && !found.has(name)) {
+                        found.set(name, { capability: `skill:${name}`, kind: "skill", source: path });
+                    }
+                }
+                else if (name.endsWith(".md")) {
+                    const skill = name.replace(/\.md$/, "");
+                    if (!found.has(skill)) {
+                        found.set(skill, { capability: `skill:${skill}`, kind: "skill", source: path });
+                    }
+                }
+            }
+            catch {
+                // An unreadable entry is simply not catalogued; it therefore cannot be granted, which is the
+                // fail-closed direction.
+            }
+        }
+    }
+    return [...found.values()];
+}
+/**
+ * Spawnable definitions, as `agent:<name>` capabilities.
+ *
+ * A definition is BOTH a skill (loadable into a session) and an agent (spawnable as a child) — ADR-0016
+ * collapsed those into one file — so the same `SKILL.md` legitimately appears twice in the catalog under
+ * two capability ids. That is not duplication: `skill:review` means "may load these instructions" and
+ * `agent:review` means "may spawn a child running them", and a grant can hold either without the other.
+ */
+export function definitionEntries(definitions) {
+    return [...definitions.values()].map((d) => ({
+        capability: `agent:${d.name}`,
+        kind: "agentType",
+        source: d.source,
+    }));
+}
+/** Assemble a catalog from parts. Pure, so it is testable without a filesystem. */
+export function makeCatalog(entries) {
+    const deduped = new Map();
+    for (const entry of entries)
+        if (!deduped.has(entry.capability))
+            deduped.set(entry.capability, entry);
+    const list = [...deduped.values()].sort((a, b) => a.capability.localeCompare(b.capability));
+    const ids = list.map((e) => e.capability);
+    const idSet = new Set(ids);
+    return {
+        entries: list,
+        all: ids,
+        byKind: (kind) => list.filter((e) => e.kind === kind).map((e) => e.capability),
+        has: (capability) => idSet.has(capability),
+    };
+}
+/** Build the live catalog. `observedTools` comes from a provider payload; null when not yet seen. */
+export async function buildCatalog(input) {
+    const [skills, definitions] = await Promise.all([loadSkills(input.cwd), loadDefinitions(input.cwd)]);
+    return makeCatalog([
+        // pi's built-ins are seeded unconditionally, because they are known statically and the catalog is
+        // consulted BEFORE any provider request has happened — `/grants` runs at that point. Without this,
+        // every capability looked "unknown" until the first model call, so the preview refused grants that
+        // enforcement would have allowed: R-28's failure shape (a diagnostic disagreeing with the enforcer)
+        // reappearing through a different door.
+        //
+        // The trade-off, stated plainly: in a session started with `--tools read`, this still lists `bash`
+        // as an existing capability, so a delegation naming it passes the *unknown* check and is refused by
+        // the *grant* check instead ("this session does not hold it"). That is the better error anyway, and
+        // the grant check — not this catalog — is the authority. Nothing here grants anything.
+        ...PI_BUILTIN_TOOLS.map((name) => ({ capability: `tool:${name}`, kind: "builtin" })),
+        ...(input.observedTools ? classifyToolNames(input.observedTools) : []),
+        ...skills,
+        ...definitionEntries(definitions),
+    ]);
+}
+/**
+ * Capabilities requested that the catalog does not contain.
+ *
+ * Reported separately from `denied` because the causes differ and so do the fixes: `denied` means the
+ * delegator lacks authority, `unknown` means the capability does not exist here — usually a typo or a
+ * stale grant referring to an uninstalled package. Silently treating unknown as denied hides that.
+ */
+export function unknownCapabilities(requested, catalog) {
+    // Wildcards are GRAMMAR, not entries. Nothing enumerates them into the catalog — `definitionEntries`
+    // emits `agent:<name>` per discovered definition and `PI_BUILTIN_TOOLS` contains no `*` — so this check
+    // reported `agent:*` as *"not present in this session's catalog (typo, or an uninstalled package?)"* and
+    // refused it BEFORE `resolve` could apply ADR-0023's rule. That made the ADR's "a parent holding
+    // `agent:*` may hand down `agent:*`" false, and made a definition declaring `allowed-tools: agent:*`
+    // unspawnable from any grant. The wildcard is live only at the root without this.
+    return requested.filter((c) => c !== WILDCARD && c !== AGENT_WILDCARD && !catalog.has(c)).sort();
+}
+/**
+ * Skill name -> absolute path, for `planSpawn`'s `--skill` flags (R-32).
+ *
+ * Derived from the catalog's own `source` field rather than re-scanning, so what a child is handed
+ * cannot drift from what was discovered and offered. A skill entry without a source is omitted, which
+ * makes it *unresolvable* rather than silently absent — `planDelegation` refuses on that, because a
+ * grant naming a skill the child never receives is a ledger line that lies.
+ */
+export function skillPathsFromCatalog(catalog) {
+    const paths = {};
+    for (const entry of catalog.entries) {
+        if (entry.kind !== "skill" || !entry.source)
+            continue;
+        paths[entry.capability.slice("skill:".length)] = entry.source;
+    }
+    return paths;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../src/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAwB,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAmB/D,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClD,UAAU,EAAE,QAAQ,IAAI,EAAE;QAC1B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,SAAmB,CAAC,CAAC,CAAE,WAAqB;KACzE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,8BAA8B;QAC1C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAc,CAAC,CAAC;oBAC9D,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACnD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;qBAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;oBACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACtB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,SAAS,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClF,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6FAA6F;gBAC7F,yBAAyB;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAyC;IACzE,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,UAAU,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE;QAC7B,IAAI,EAAE,WAAoB;QAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO;QACL,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG;QACR,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QAC9E,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAGlC;IACC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO,WAAW,CAAC;QACjB,kGAAkG;QAClG,mGAAmG;QACnG,mGAAmG;QACnG,oGAAoG;QACpG,wCAAwC;QACxC,EAAE;QACF,mGAAmG;QACnG,oGAAoG;QACpG,oGAAoG;QACpG,uFAAuF;QACvF,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAW,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,MAAM;QACT,GAAG,iBAAiB,CAAC,WAAW,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAuB,EAAE,OAAgB;IAC3E,qGAAqG;IACrG,wGAAwG;IACxG,yGAAyG;IACzG,iGAAiG;IACjG,qGAAqG;IACrG,kFAAkF;IAClF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACnG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QACtD,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}