pi-daddy 0.14.0 → 0.16.0

package/dist/grant-store.js

@@ -0,0 +1,142 @@
+/**
+ * The grant for a directory, stored **outside** it.
+ *
+ * `PI_GRANTS_GRANT` is the propagation channel to children and stays exactly as it was — a parent writes
+ * it once per session and every child inherits it. What this adds is a second *source* for the root
+ * session's own grant, so an operator does not have to `source` a file and restart pi to be governed.
+ *
+ * **Outside the workspace, and that is the whole design.** A grant is a ceiling; a ceiling a governed child
+ * can rewrite is not a ceiling. `<cwd>/.pi/grants.env` is writable by any child holding `tool:write`, so
+ * storing the live grant there would let a child widen the *next* session's ceiling — ADR-0014's
+ * self-defeating case verbatim, which is why persisted approvals were moved out of the workspace in the
+ * first place. This reuses that pattern exactly: `$PI_CODING_AGENT_DIR/grants/<slug>-<hash>.json`, keyed by
+ * the directory, unwritable by a narrowed child because a narrowed child holds no write access to `$HOME`.
+ *
+ * **It does not defend against a child holding `bash`** (ADR-0012). Nothing here does.
+ *
+ * `.pi/grants.env` is still written by `init` and is still worth committing — it is the *reviewable record*
+ * of the decision, diffable in a PR. It is simply no longer the thing the enforcer reads.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { mkdir, readFile, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { withFileLock, LockTimeoutError } from "./file-lock.js";
+/** `$PI_CODING_AGENT_DIR`, or pi's default. Same resolution as the approval store. */
+function agentDir() {
+    return process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+}
+/**
+ * Where this directory's grant lives.
+ *
+ * Slug plus a 64-bit hash, exactly as `approvalsPath` does it and for the same two reasons: the basename
+ * keeps the directory legible to a human reading it, and the hash is what makes it unambiguous, since two
+ * checkouts can share a basename.
+ */
+export function grantStorePath(cwd) {
+    const slug = (basename(cwd) || "root").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
+    const hash = createHash("sha256").update(cwd, "utf8").digest("hex").slice(0, 16);
+    return join(agentDir(), "grants", `${slug}-${hash}.json`);
+}
+/**
+ * Parse a store file's text into a grant, or null.
+ *
+ * Split out from the readers so the **one** validation lives in one place: both the sync and async paths
+ * must agree, and two parsers is how they come to disagree.
+ *
+ * Fails closed on every doubt — a malformed file grants nothing rather than something. The `cwd` check is
+ * R-27's: a file copied to another machine or another checkout describes a directory that is not this one,
+ * and honouring it would let a grant travel somewhere nobody authorised it for.
+ */
+export function parseGrantFile(text, cwd) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.version !== 1)
+            return null;
+        if (parsed.cwd !== cwd)
+            return null;
+        if (!Array.isArray(parsed.grant))
+            return null;
+        if (!parsed.grant.every((c) => typeof c === "string" && c.length > 0))
+            return null;
+        return parsed.grant;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read this directory's stored grant, synchronously.
+ *
+ * **Sync on purpose, and this is the constraint that shapes the feature.** Whether `delegate` is registered
+ * at all is decided when the extension factory runs (S-5: a session without `tool:delegate` must not be
+ * offered the tool), and that is before any `await` is possible. An async read would resolve after the
+ * decision it exists to inform, so the store would silently fail to grant delegation — the exact class of
+ * defect R-38 and R-39 were.
+ */
+export function loadGrantSync(cwd) {
+    try {
+        return parseGrantFile(readFileSync(grantStorePath(cwd), "utf8"), cwd);
+    }
+    catch {
+        return null;
+    }
+}
+/** Async twin, for callers that already have one. Same parser, so they cannot disagree. */
+export async function loadGrant(cwd) {
+    try {
+        return parseGrantFile(await readFile(grantStorePath(cwd), "utf8"), cwd);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write this directory's grant.
+ *
+ * Locked with the same lock the ledger and the approval store use, for the same reason: two sessions in one
+ * directory running `/grants init` concurrently must not interleave. A lock this cannot take yields `busy`
+ * and changes nothing — the caller reports it and the operator retries, which is the honest outcome for a
+ * write that never looked at the file (R-68).
+ *
+ * `wx` on the temp file refuses to follow a pre-existing symlink, and `rename` is atomic within a
+ * filesystem, so a reader never sees a half-written grant. Both copied from `writeFileSafely`, deliberately
+ * — a second, subtly different atomic-write is how the two come to disagree about what "safe" meant.
+ */
+export async function saveGrant(cwd, grant) {
+    const path = grantStorePath(cwd);
+    const file = { version: 1, cwd, grant: [...grant].sort(), writtenAt: new Date().toISOString() };
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        return await withFileLock(path, "grant store", async () => {
+            const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+            try {
+                await writeFile(temp, `${JSON.stringify(file, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+                await rename(temp, path);
+                return "saved";
+            }
+            catch {
+                await unlink(temp).catch(() => undefined);
+                return "failed";
+            }
+        });
+    }
+    catch (error) {
+        return error instanceof LockTimeoutError ? "busy" : "failed";
+    }
+}
+/** Remove this directory's stored grant. True when a file was there to remove. */
+export async function clearGrant(cwd) {
+    const path = grantStorePath(cwd);
+    try {
+        await readFile(path, "utf8");
+    }
+    catch {
+        return false;
+    }
+    await rm(path, { force: true }).catch(() => undefined);
+    return true;
+}
+//# sourceMappingURL=grant-store.js.map

package/dist/grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../src/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAYhE,sFAAsF;AACtF,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO,MAAM,CAAC,KAAqB,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAmB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3G,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzB,OAAO,OAAgB,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,QAAiB,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/herdr-cli.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Talking to herdr: one command, one JSON envelope, plus the two questions ADR-0031 needs answered.
+ *
+ * Lifted out of `src/run-herdr.ts`, which was at 357 of the 400-line ceiling and gains output polling under
+ * ADR-0032. But the split is not only about lines: **the probe is not an executor concern**. It runs at session
+ * start, before any delegation exists, to decide *which* executor a session will use — so leaving it inside the
+ * herdr executor would mean the session imported the thing it was deciding whether to use.
+ *
+ * Every rule here is tested against an injected `exec`, so the suite stays fast, pi-free and herdr-free. The
+ * facts the fakes reproduce were measured against real herdr 0.7.5 (`docs/probes/g16-herdr`).
+ */
+/** One herdr CLI invocation. Injectable so every rule below is testable without herdr installed. */
+export type HerdrExec = (args: string[]) => Promise<{
+    code: number | null;
+    stdout: string;
+    stderr: string;
+}>;
+export declare const defaultExec: HerdrExec;
+/**
+ * Parse herdr's JSON envelope. Every command replies `{id, result}` or `{id, error:{code,message}}`.
+ *
+ * `stderr` is folded into the message because the first end-to-end run failed with an EMPTY stdout and the
+ * real reason on stderr, producing the useless diagnostic "unparseable herdr reply: ". A wrapper that
+ * hides the substrate's own error message costs more time than it saves.
+ */
+export declare function parseReply(reply: {
+    stdout: string;
+    stderr: string;
+}): {
+    result?: Record<string, unknown>;
+    error?: string;
+};
+/** Bound on the session-start probe. Short: it sits in front of the operator's first prompt. */
+export declare const PROBE_TIMEOUT_MS = 2000;
+export interface HerdrProbe {
+    ok: boolean;
+    /** herdr's own words when it is not reachable. Carried so the disclosure line can name the reason. */
+    error?: string;
+}
+/**
+ * Is there a herdr server that will answer right now? — ADR-0031's selection input.
+ *
+ * **`tab list`, not `which herdr`.** ADR-0031 rejects `PATH` detection as option C by name: a binary on `PATH`
+ * with no server behind it would make every delegation fail at `tab create`, on a path the operator never
+ * chose, and the diagnostic would arrive at the first delegation rather than at startup. Only a parsed
+ * `result` envelope counts as reachable; an `error` envelope, a non-JSON reply, a timeout and a throwing
+ * `exec` are all "not reachable" with the reason preserved.
+ *
+ * **Zero tabs is a successful answer**, deliberately: a fresh herdr with nothing open is reachable.
+ *
+ * Never throws. A probe that threw out of `session_start` would cancel every control after it, which is
+ * R-60's shape exactly — and this one runs *before* the line that discloses what it decided.
+ */
+export declare function probeHerdr(options?: {
+    exec?: HerdrExec;
+    timeoutMs?: number;
+}): Promise<HerdrProbe>;
+/** herdr's own variable, set in every pane it creates. Measured 2026-08-17; documented nowhere. */
+export declare const ENV_PARENT_WORKSPACE = "HERDR_WORKSPACE_ID";
+/** The operator's explicit override. Defined here because this is the only module that reads it. */
+export declare const ENV_HERDR_WORKSPACE = "PI_GRANTS_HERDR_WORKSPACE";
+/**
+ * Which herdr workspace a governed child's pane belongs in.
+ *
+ * **Defaults to the parent's own workspace.** herdr tells a pane which workspace it is in
+ * (`HERDR_WORKSPACE_ID`, alongside `HERDR_TAB_ID` and `HERDR_PANE_ID`), and a child placed in a *different*
+ * workspace from the pi session that spawned it turns "switch between them" into a workspace hop — which is
+ * the entire feature ADR-0032 exists to deliver. The previous behaviour was "omitted lets herdr choose",
+ * which is that failure by default on any machine with more than one workspace.
+ *
+ * `PI_GRANTS_HERDR_WORKSPACE` still wins: it is the operator saying so explicitly, and an explicit answer
+ * beating an inference is this package's standing rule (ADR-0030 says it about the grant itself).
+ *
+ * Blank is treated as absent rather than passed through — `--workspace ""` is not a workspace, and it would
+ * fail `tab create` on a path nobody chose.
+ */
+export declare function resolveWorkspace(env: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=herdr-cli.d.ts.map

package/dist/herdr-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-cli.d.ts","sourceRoot":"","sources":["../src/herdr-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,oGAAoG;AACpG,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE7G,eAAO,MAAM,WAAW,EAAE,SAatB,CAAC;AAEL;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAW1H;AAED,gGAAgG;AAChG,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,sGAAsG;IACtG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAsB5G;AAED,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,uBAAuB,CAAC;AAEzD,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAI3E"}

package/dist/herdr-cli.js

@@ -0,0 +1,113 @@
+/**
+ * Talking to herdr: one command, one JSON envelope, plus the two questions ADR-0031 needs answered.
+ *
+ * Lifted out of `src/run-herdr.ts`, which was at 357 of the 400-line ceiling and gains output polling under
+ * ADR-0032. But the split is not only about lines: **the probe is not an executor concern**. It runs at session
+ * start, before any delegation exists, to decide *which* executor a session will use — so leaving it inside the
+ * herdr executor would mean the session imported the thing it was deciding whether to use.
+ *
+ * Every rule here is tested against an injected `exec`, so the suite stays fast, pi-free and herdr-free. The
+ * facts the fakes reproduce were measured against real herdr 0.7.5 (`docs/probes/g16-herdr`).
+ */
+import { execFile } from "node:child_process";
+export const defaultExec = (args) => new Promise((settle) => {
+    execFile("herdr", args, { maxBuffer: 32 * 1024 * 1024 }, (error, stdout, stderr) => {
+        const raw = error?.code;
+        const code = typeof raw === "number" ? raw : error ? 1 : 0;
+        // **A string `code` is a spawn failure, and it used to be thrown away.** `ENOENT` — herdr not installed —
+        // arrives as `code: "ENOENT"`, so the numeric test failed, the message was dropped, and an operator with
+        // `PI_GRANTS_HERDR=1` on a machine without herdr was told *"herdr is not answering (unparseable herdr
+        // reply: (no output))"* rather than that the binary is missing. Rule 8 wants the loud version, and this is
+        // the first diagnostic such an operator meets.
+        const spawnFailure = typeof raw === "string" ? `herdr could not be run (${raw}): ${error?.message ?? ""}` : "";
+        settle({ code, stdout: String(stdout), stderr: spawnFailure || String(stderr) });
+    });
+});
+/**
+ * Parse herdr's JSON envelope. Every command replies `{id, result}` or `{id, error:{code,message}}`.
+ *
+ * `stderr` is folded into the message because the first end-to-end run failed with an EMPTY stdout and the
+ * real reason on stderr, producing the useless diagnostic "unparseable herdr reply: ". A wrapper that
+ * hides the substrate's own error message costs more time than it saves.
+ */
+export function parseReply(reply) {
+    try {
+        const parsed = JSON.parse(reply.stdout);
+        if (parsed.error)
+            return { error: parsed.error.message ?? parsed.error.code ?? "herdr reported an error" };
+        return { result: parsed.result };
+    }
+    catch {
+        // A non-JSON reply is a herdr-version or PATH problem, not a governance decision. Surfaced as a spawn
+        // error so the caller reports "could not start" rather than "the child produced nothing".
+        const detail = [reply.stdout.trim(), reply.stderr.trim()].filter((t) => t.length > 0).join(" | ");
+        return { error: `unparseable herdr reply: ${detail.slice(0, 300) || "(no output)"}` };
+    }
+}
+/** Bound on the session-start probe. Short: it sits in front of the operator's first prompt. */
+export const PROBE_TIMEOUT_MS = 2000;
+/**
+ * Is there a herdr server that will answer right now? — ADR-0031's selection input.
+ *
+ * **`tab list`, not `which herdr`.** ADR-0031 rejects `PATH` detection as option C by name: a binary on `PATH`
+ * with no server behind it would make every delegation fail at `tab create`, on a path the operator never
+ * chose, and the diagnostic would arrive at the first delegation rather than at startup. Only a parsed
+ * `result` envelope counts as reachable; an `error` envelope, a non-JSON reply, a timeout and a throwing
+ * `exec` are all "not reachable" with the reason preserved.
+ *
+ * **Zero tabs is a successful answer**, deliberately: a fresh herdr with nothing open is reachable.
+ *
+ * Never throws. A probe that threw out of `session_start` would cancel every control after it, which is
+ * R-60's shape exactly — and this one runs *before* the line that discloses what it decided.
+ */
+export async function probeHerdr(options = {}) {
+    const exec = options.exec ?? defaultExec;
+    const timeoutMs = options.timeoutMs ?? PROBE_TIMEOUT_MS;
+    let timer;
+    try {
+        return await Promise.race([
+            exec(["tab", "list"]).then((reply) => {
+                const parsed = parseReply(reply);
+                return parsed.error ? { ok: false, error: parsed.error } : { ok: true };
+            }),
+            new Promise((settle) => {
+                timer = setTimeout(() => settle({ ok: false, error: `probe timed out after ${timeoutMs}ms` }), timeoutMs);
+            }),
+        ]);
+    }
+    catch (error) {
+        return { ok: false, error: String(error) };
+    }
+    finally {
+        // Cleared whichever branch won, so a fast probe does not hold the event loop open for the timeout's
+        // remainder — which would add up to two seconds to every `node --test` run of this file.
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** herdr's own variable, set in every pane it creates. Measured 2026-08-17; documented nowhere. */
+export const ENV_PARENT_WORKSPACE = "HERDR_WORKSPACE_ID";
+/** The operator's explicit override. Defined here because this is the only module that reads it. */
+export const ENV_HERDR_WORKSPACE = "PI_GRANTS_HERDR_WORKSPACE";
+/**
+ * Which herdr workspace a governed child's pane belongs in.
+ *
+ * **Defaults to the parent's own workspace.** herdr tells a pane which workspace it is in
+ * (`HERDR_WORKSPACE_ID`, alongside `HERDR_TAB_ID` and `HERDR_PANE_ID`), and a child placed in a *different*
+ * workspace from the pi session that spawned it turns "switch between them" into a workspace hop — which is
+ * the entire feature ADR-0032 exists to deliver. The previous behaviour was "omitted lets herdr choose",
+ * which is that failure by default on any machine with more than one workspace.
+ *
+ * `PI_GRANTS_HERDR_WORKSPACE` still wins: it is the operator saying so explicitly, and an explicit answer
+ * beating an inference is this package's standing rule (ADR-0030 says it about the grant itself).
+ *
+ * Blank is treated as absent rather than passed through — `--workspace ""` is not a workspace, and it would
+ * fail `tab create` on a path nobody chose.
+ */
+export function resolveWorkspace(env) {
+    const explicit = env[ENV_HERDR_WORKSPACE]?.trim();
+    if (explicit)
+        return explicit;
+    return env[ENV_PARENT_WORKSPACE]?.trim() || undefined;
+}
+//# sourceMappingURL=herdr-cli.js.map

package/dist/herdr-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-cli.js","sourceRoot":"","sources":["../src/herdr-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAK9C,MAAM,CAAC,MAAM,WAAW,GAAc,CAAC,IAAI,EAAE,EAAE,CAC7C,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IACrB,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACjF,MAAM,GAAG,GAAI,KAAmC,EAAE,IAAI,CAAC;QACvD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,0GAA0G;QAC1G,yGAAyG;QACzG,sGAAsG;QACtG,2GAA2G;QAC3G,+CAA+C;QAC/C,MAAM,YAAY,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,2BAA2B,GAAG,MAAM,KAAK,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAyC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAsF,CAAC;QAC7H,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;QAC3G,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,sGAAsG;QACtG,0FAA0F;QAC1F,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClG,OAAO,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAQrC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAoD,EAAE;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,IAAI,KAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAa;YACpC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBACjC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1E,CAAC,CAAC;YACF,IAAI,OAAO,CAAa,CAAC,MAAM,EAAE,EAAE;gBACjC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,SAAS,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC5G,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,oGAAoG;QACpG,yFAAyF;QACzF,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAEzD,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAE/D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACxD,CAAC"}

package/dist/herdr-name.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Naming a herdr agent: the grammar herdr enforces, and uniqueness it does not.
+ *
+ * Split out of `src/run-herdr.ts` at the 400-line ceiling, and a real seam: both rules below come from **herdr's
+ * own validation and lifecycle**, not from anything this package decides. Two shipping defects lived here, and
+ * both were invisible to every test because the unit fake accepts whatever name it is handed and the integration
+ * suite never reaches a real herdr spawn. They surfaced from two real spawns against the live daemon.
+ */
+/**
+ * Make a herdr agent name that is **valid** and cannot collide with a live one.
+ *
+ * **Validity is a separate, PRE-EXISTING defect, and it is the more serious half.** Callers build a name as
+ * `${definition}-${childId}`, and a ledger child id is hierarchical — `d0.1`, `d0.1.2` (ADR-0008/F8). Those dots
+ * are **not in herdr's grammar**, so `agent start review-d0.1 …` is rejected with `invalid_agent_name`. Every
+ * `delegate({agent})` on the herdr path has therefore failed at `agent start` since the executor was written.
+ *
+ * Nothing could see it. The unit fake accepts any name it is handed, and the integration suite never reaches a
+ * real herdr spawn — so both were green while the feature could not work. It surfaced only by running two real
+ * spawns against the live daemon, which is the argument for doing that at all.
+ *
+ * **Measured, and a shipping defect without it.** herdr binds an agent name to its **tab**, and only closing
+ * the tab frees the name: a second `agent start` with a name still held returns
+ * `agent_name_taken: agent <name> is already used; … tab_id=…`. `herdr agent stop` does not exist (see
+ * `cleanup`), so nothing else releases it.
+ *
+ * Callers build a name from the definition and the ledger child id — and for a plain blocking `delegate` that
+ * id is **constant** (`d0.1`, index 0 of the session), so every delegation in a session asked for the same
+ * name. That was harmless while the pane closed at the end of each call. Once ADR-0032 kept panes alive to
+ * `agent_settled`, the **first** delegation of a turn worked and every later one failed with
+ * `agent_name_taken`, on the executor ADR-0031 had just made the default.
+ *
+ * Uniquified HERE rather than at the call site, so no caller can forget: the constraint belongs to herdr, and
+ * this module is the only thing that talks to herdr. The suffix is a counter rather than a random token so a
+ * pane label stays readable and reproducible within a run.
+ */
+export declare function uniqueAgentName(base: string): string;
+//# sourceMappingURL=herdr-name.d.ts.map

package/dist/herdr-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-name.d.ts","sourceRoot":"","sources":["../src/herdr-name.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAapD"}

package/dist/herdr-name.js

@@ -0,0 +1,59 @@
+/**
+ * Naming a herdr agent: the grammar herdr enforces, and uniqueness it does not.
+ *
+ * Split out of `src/run-herdr.ts` at the 400-line ceiling, and a real seam: both rules below come from **herdr's
+ * own validation and lifecycle**, not from anything this package decides. Two shipping defects lived here, and
+ * both were invisible to every test because the unit fake accepts whatever name it is handed and the integration
+ * suite never reaches a real herdr spawn. They surfaced from two real spawns against the live daemon.
+ */
+/** Monotonic within this process. See `uniqueAgentName`. */
+let spawnSeq = 0;
+/**
+ * herdr's agent-name grammar, measured from its own rejection message.
+ *
+ * `agent name must start with a lowercase letter and contain only lowercase letters, digits, '-' or '_'
+ * (1-32 characters)`.
+ */
+const AGENT_NAME_MAX = 32;
+/**
+ * Make a herdr agent name that is **valid** and cannot collide with a live one.
+ *
+ * **Validity is a separate, PRE-EXISTING defect, and it is the more serious half.** Callers build a name as
+ * `${definition}-${childId}`, and a ledger child id is hierarchical — `d0.1`, `d0.1.2` (ADR-0008/F8). Those dots
+ * are **not in herdr's grammar**, so `agent start review-d0.1 …` is rejected with `invalid_agent_name`. Every
+ * `delegate({agent})` on the herdr path has therefore failed at `agent start` since the executor was written.
+ *
+ * Nothing could see it. The unit fake accepts any name it is handed, and the integration suite never reaches a
+ * real herdr spawn — so both were green while the feature could not work. It surfaced only by running two real
+ * spawns against the live daemon, which is the argument for doing that at all.
+ *
+ * **Measured, and a shipping defect without it.** herdr binds an agent name to its **tab**, and only closing
+ * the tab frees the name: a second `agent start` with a name still held returns
+ * `agent_name_taken: agent <name> is already used; … tab_id=…`. `herdr agent stop` does not exist (see
+ * `cleanup`), so nothing else releases it.
+ *
+ * Callers build a name from the definition and the ledger child id — and for a plain blocking `delegate` that
+ * id is **constant** (`d0.1`, index 0 of the session), so every delegation in a session asked for the same
+ * name. That was harmless while the pane closed at the end of each call. Once ADR-0032 kept panes alive to
+ * `agent_settled`, the **first** delegation of a turn worked and every later one failed with
+ * `agent_name_taken`, on the executor ADR-0031 had just made the default.
+ *
+ * Uniquified HERE rather than at the call site, so no caller can forget: the constraint belongs to herdr, and
+ * this module is the only thing that talks to herdr. The suffix is a counter rather than a random token so a
+ * pane label stays readable and reproducible within a run.
+ */
+export function uniqueAgentName(base) {
+    spawnSeq += 1;
+    const suffix = `-${spawnSeq}`;
+    const cleaned = base
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]+/g, "-") // dots from a child id, and anything else outside the grammar
+        .replace(/-{2,}/g, "-")
+        .replace(/^[^a-z]+/, ""); // must START with a lowercase letter, so a leading digit or dash goes
+    // Truncated so the whole name fits, and trimmed of a trailing separator so the join stays readable. The
+    // fallback covers a base that sanitises to nothing at all (a definition named entirely in non-Latin script).
+    const room = AGENT_NAME_MAX - suffix.length;
+    const head = cleaned.slice(0, room).replace(/[-_]+$/, "") || "agent";
+    return `${head}${suffix}`;
+}
+//# sourceMappingURL=herdr-name.js.map

package/dist/herdr-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-name.js","sourceRoot":"","sources":["../src/herdr-name.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4DAA4D;AAC5D,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB;;;;;GAKG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,QAAQ,IAAI,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI;SACjB,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,8DAA8D;SAC5F,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,sEAAsE;IAClG,wGAAwG;IACxG,6GAA6G;IAC7G,MAAM,IAAI,GAAG,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;IACrE,OAAO,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/herdr-poll.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Waiting for a herdr agent to settle, and reading what it printed on the way.
+ *
+ * Split out of `src/run-herdr.ts` when that file hit **404 of the 400-line ceiling** adding ADR-0032's output
+ * polling. The seam was named in the plan before it was needed, and it is a real one: this module is about
+ * *observing* an agent, `run-herdr.ts` is about *starting and cleaning up after* one. Nothing here creates or
+ * destroys anything.
+ *
+ * The two facts it is built on were measured against real herdr 0.7.5 (`docs/probes/g16-herdr`) and both are
+ * counter-intuitive enough to be worth the module comment: `agent wait --until idle` matches the state the
+ * agent was **already** in, and `agent read` is the one command that does **not** return a JSON envelope.
+ */
+import { type HerdrExec } from "./herdr-cli.ts";
+/**
+ * What `waitForSettled` needs from a run request.
+ *
+ * Declared here rather than importing `HerdrRunRequest`, which would make the two modules mutually dependent
+ * for no benefit. `HerdrRunRequest` satisfies it structurally, so the call site needs no adapter.
+ */
+export interface PollTarget {
+    /** herdr agent name. */
+    name: string;
+    signal?: AbortSignal;
+    /**
+     * The pane's last few lines, re-reported on every poll — a SNAPSHOT, not a stream (ADR-0032).
+     *
+     * The consumer must **replace** what it holds rather than append. `agent read` returns a snapshot of a
+     * bounded terminal, and treating it as append-only is what produced an 89,000× amplification; see
+     * `tailLines`.
+     */
+    onSnapshot?: (lines: string[]) => void;
+    /** How many lines the display wants. Bounds the per-poll cost regardless of how big the pane is. */
+    snapshotLines?: number;
+    /** Poll cadence override. Exists so tests do not wait `POLL_INTERVAL_MS` per state transition. */
+    pollIntervalMs?: number;
+}
+/** How often to poll `agent get` while waiting for the child to settle. */
+export declare const POLL_INTERVAL_MS = 750;
+/** Lines of pane tail reported per poll. Matches the status block's own tail, so nothing is fetched unused. */
+export declare const DEFAULT_SNAPSHOT_LINES = 3;
+/**
+ * Wait for the child to settle, without accepting the state it was already in.
+ *
+ * **R-33, measured.** `herdr agent wait --until idle` called right after `agent prompt` returned
+ * *immediately*, matching the agent's **pre-existing** idle state with `state_change_seq` unchanged — a
+ * reply indistinguishable from a completed run. For fan-out that is not an inconvenience but a
+ * correctness bug: an orchestrator would "collect" N children that never ran and merge N empty results
+ * into a confident summary (R-03 with a new cause).
+ *
+ * So this polls `agent get` and requires **both** that the status is terminal **and** that
+ * `state_change_seq` has advanced past the value observed before prompting. `agent wait` is deliberately
+ * not used at all: its contract cannot express "settled *after* this point".
+ */
+export declare function waitForSettled(exec: HerdrExec, request: PollTarget, before: number, deadline: number, maxOutputBytes: number): Promise<{
+    status?: string;
+    timedOut?: boolean;
+    aborted?: boolean;
+    spawnError?: string;
+}>;
+/**
+ * The last `keep` non-blank lines of a pane snapshot — what the display actually needs.
+ *
+ * **This replaces a `newSuffix` diff, and the replacement is a correction rather than a tune-up.** The old
+ * design treated `agent read` as a *stream* and tried to report only what was new, by testing whether the new
+ * text extended the old. That is wrong about the substrate: `agent read` returns a **snapshot of a bounded
+ * terminal**, and a snapshot is not an append-only log. Two ordinary things break the prefix test forever —
+ * the pane **scrolling** (its top lines are gone, so the new text is not an extension of the old) and
+ * `readPane` **truncating to the tail** past `maxOutputBytes` (each read is a different window of a growing
+ * buffer). Once either happens, every poll reported the whole buffer.
+ *
+ * Measured before the fix: **51 MiB streamed for ~600 bytes of real output — 89,000× amplification** in 37
+ * seconds, per child, with a scrolling pane also delivering the same real lines three times each. The old
+ * docstring named that exact failure as the thing it prevented.
+ *
+ * So the herdr path now reports a **bounded snapshot** and the consumer *replaces* rather than appends. There
+ * is no diff to get wrong, the per-poll cost is `keep` lines regardless of buffer size, and a scrolling pane
+ * simply shows its current tail — which is what a human looking at that pane would see.
+ */
+export declare function tailLines(snapshot: string, keep: number): string[];
+/**
+ * Read the pane's contents.
+ *
+ * `agent read` is the ONE command that does not return herdr's JSON envelope — it writes the terminal's
+ * text straight to stdout. Running it through `parseReply` turned every successful read into
+ * "unparseable herdr reply", i.e. reported the child's actual answer as a failure to read it. Found by the
+ * end-to-end run; the unit fake had been written to the envelope shape and so agreed with the bug.
+ *
+ * A JSON envelope is still accepted first, because an `error` reply here IS JSON and must not be mistaken
+ * for terminal output.
+ *
+ * **`readFailed` is separate from `text`, and that separation is the fix for an R-03 defect.** A failed read
+ * used to return its own diagnostic *as* `text` — so `runHerdrPane` returned
+ * `[grants] could not read the agent pane: pane is gone` **as the child's answer, with `code: 0`**, and the
+ * orchestrator read a failure message as a completed sub-agent's report. Measured. It mattered little when this
+ * ran once per child; ADR-0032 made it run on every poll, up to 800 times for a ten-minute child, so a
+ * transient failure went from unlikely to expected. The caller must now decide, and it cannot do so by
+ * inspecting a string.
+ */
+export declare function readPane(exec: HerdrExec, name: string, maxOutputBytes: number): Promise<{
+    text: string;
+    truncated: boolean;
+    readFailed?: string;
+}>;
+//# sourceMappingURL=herdr-poll.d.ts.map

package/dist/herdr-poll.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-poll.d.ts","sourceRoot":"","sources":["../src/herdr-poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACvC,oGAAoG;IACpG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AACpC,+GAA+G;AAC/G,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,UAAU,EACnB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoC1F;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAalE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAuBpE"}