pi-daddy 0.17.0 → 0.18.0

package/dist/delegate.js

@@ -1,43 +1,43 @@
 /**
- * Governed delegation — provisioning, not merely enforcement.
- *
- * The `tool_call` interceptor can only *permit or refuse* a `pi-subagents` spawn, because that package's
- * `Agent` tool has no `tools` parameter. When we do the spawning ourselves the grant becomes an argument,
- * which is what "give them some tools but not others" actually requires.
- *
- * Two properties fall out of owning the spawn:
- *
- *  1. **No propagation race at all.** Each child receives its own explicit `env` object, so nothing is
- *     written to the shared `process.env`. The interceptor's constraint (only parent-level facts may be
- *     pushed, because the channel is global) does not apply here.
- *  2. **Depth control by capability.** `tool:delegate` is itself a capability. Grant it and the child can
- *     sub-delegate; withhold it and the child is a leaf. No separate depth mechanism is required, though
- *     `maxDepth` remains as a cheap backstop.
+ * Governed delegation planning. Owning the spawn makes the grant an argument; each child receives its own
+ * environment, and `tool:delegate` determines whether it is a delegator or a leaf.
  */
 import { planSpawn } from "./spawn.js";
 import { ceilingForDefinition, digestDefinition } from "./definitions.js";
-import { resolve, assertNarrowing } from "./resolve.js";
-import { AGENT_WILDCARD } from "./resolve.js";
+import { assertNarrowing } from "./resolve.js";
 import { DELEGATE_CAPABILITY, agentCapability, maySpawnDefinition, normaliseCapability } from "./capabilities.js";
 // Re-exported so the split stays internal: `delegate.ts` has been the import site for these since 0.6.0 and
 // four modules plus the test suite name it. Moving the definitions without moving the door would be churn
 // charged to every caller for a line count they did not cause.
 export { DELEGATE_CAPABILITY, agentCapability, maySpawnDefinition, normaliseCapability } from "./capabilities.js";
 import { ENV_APPROVED, ENV_DEPTH, ENV_FANOUT, ENV_GATED, ENV_GRANT, ENV_LEDGER, ENV_MAX_DEPTH, ENV_PARENT_ID } from "./propagation.js";
-import { DELEGATE_SUBJECT, inheritApprovals } from "./approval.js";
+import { inheritApprovals } from "./approval.js";
 import { suggestForUnknown, unknownCapabilities } from "./catalog.js";
-/**
- * Plan a governed delegation. Pure: returns argv and env, spawns nothing.
- *
- * Fails closed on depth, on any requested capability the delegator does not hold, on gated capabilities
- * without approval, and on a grant that cannot narrow (a universal capability slipping through).
- */
+import { GovernanceRefusal, refusal } from "./refusals.js";
+import { digestTask, normaliseCorrelation, } from "./correlation.js";
+import { resolveDelegationApproval } from "./delegation-approval.js";
 export function planDelegation(request, ctx) {
     const childDepth = ctx.depth + 1;
+    const denied = (plan, code) => plan.reason ? { ...plan, refusal: refusal(code, plan.reason) } : plan;
     // G6 / B-I3: every refusal carries a result, including the four below that return before `resolve()`
     // is ever called. The extension guarded its ledger write with `if (ledgerPath && plan.result)`, so
     // those four governance decisions — disabled, too deep, no task, unknown capability — were never
     // audited at all. An empty result is the honest record: nothing was resolved, and that is the fact.
+    // Bounded/whitelisted correlation is a REFUSAL, not an exception escaping the planner. It is reachable
+    // from a model-facing tool parameter on all three delegation tools, and throwing from here produced a
+    // governed refusal with no code and no ledger line at all — the ledger file was never even created
+    // (R-112). Caught here so it becomes an ordinary recorded decision.
+    let correlation;
+    let correlationRefused;
+    try {
+        correlation = normaliseCorrelation(request.correlation);
+    }
+    catch (error) {
+        correlationRefused = error instanceof GovernanceRefusal
+            ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
+            : refusal("CORRELATION_INVALID", String(error instanceof Error ? error.message : error));
+    }
+    const taskDigest = digestTask(request.task ?? "");
     const empty = {
         ok: false,
         args: [],
@@ -45,15 +45,21 @@ export function planDelegation(request, ctx) {
         effective: [],
         childDepth,
         requested: [],
+        taskDigest,
+        ...(correlation ? { correlation } : {}),
         result: { effective: [], denied: [], clipped: [], gatedBlocked: [], universal: [], subsumedBy: [] },
     };
-    if (ctx.maxDepth <= 0)
-        return { ...empty, reason: "delegation is disabled (maxDepth 0)" };
+    if (correlationRefused) {
+        return { ...empty, reason: correlationRefused.message, refusal: correlationRefused };
+    }
+    if (ctx.maxDepth <= 0) {
+        return denied({ ...empty, reason: "delegation is disabled (maxDepth 0)" }, "DEPTH_EXCEEDED");
+    }
     if (childDepth > ctx.maxDepth) {
-        return { ...empty, reason: `delegation depth limit reached (${ctx.maxDepth})` };
+        return denied({ ...empty, reason: `delegation depth limit reached (${ctx.maxDepth})` }, "DEPTH_EXCEEDED");
     }
     if (!request.task?.trim())
-        return { ...empty, reason: "a delegation needs a task" };
+        return denied({ ...empty, reason: "a delegation needs a task" }, "TASK_MISSING");
     // ADR-0016. A named definition replaces the model's tool list with an operator-authored ceiling.
     let requested;
     let systemPrompt;
@@ -68,11 +74,11 @@ export function planDelegation(request, ctx) {
         // here is simply an error.
         if (!definition) {
             const known = [...(ctx.definitions?.keys() ?? [])].sort();
-            return {
+            return denied({
                 ...empty,
                 reason: `unknown agent "${request.agent}"` +
                     (known.length > 0 ? ` — known definitions: ${known.join(", ")}` : " — no definitions were found"),
-            };
+            }, "UNKNOWN_DEFINITION");
         }
         // ADR-0017: authorisation comes BEFORE anything is said about the file. Which definitions this
         // session may spawn is a governance question about the SESSION; whether the file declares its tools
@@ -85,7 +91,7 @@ export function planDelegation(request, ctx) {
         if (!maySpawnDefinition(ctx.ownGrant, definition.name)) {
             const authorising = agentCapability(definition.name);
             const held = ctx.ownGrant.filter((c) => c.startsWith("agent:")).sort();
-            return {
+            return denied({
                 ...empty,
                 requested: [authorising],
                 result: { ...empty.result, denied: [authorising] },
@@ -94,7 +100,7 @@ export function planDelegation(request, ctx) {
                     (held.length > 0
                         ? `It may spawn: ${held.join(", ")}.`
                         : `It may spawn no definitions at all; add ${authorising} to its grant to allow this one.`),
-            };
+            }, "DEFINITION_NOT_AUTHORIZED");
         }
         // ADR-0018. Recorded from here on — after authorisation, because the digest is a fact about a file
         // this caller was allowed to read, and before every remaining outcome, because a spawn refused for a
@@ -108,19 +114,19 @@ export function planDelegation(request, ctx) {
         Object.assign(empty, { definitionDigest });
         const ceiling = ceilingForDefinition(definition);
         if (ceiling.undeclared) {
-            return {
+            return denied({
                 ...empty,
                 reason: `agent "${definition.name}" declares no \`allowed-tools\`, so it cannot be spawned — add one ` +
                     `to ${definition.source}. An undeclared capability set is treated as NONE, never as everything.`,
-            };
+            }, "UNDECLARED_TOOLS");
         }
         if (ceiling.patterns.length > 0) {
-            return {
+            return denied({
                 ...empty,
                 reason: `agent "${definition.name}" restricts a tool with a pattern (${ceiling.patterns.join(", ")}), ` +
                     `which pi's --tools cannot express — it matches whole tool names only. Granting the bare tool ` +
                     `would widen the declaration and dropping it would silently narrow, so neither is done.`,
-            };
+            }, "CEILING_PATTERNS_UNRESOLVED");
         }
         requested = ceiling.capabilities;
         systemPrompt = definition.body;
@@ -144,55 +150,38 @@ export function planDelegation(request, ctx) {
                 return s === null ? null : `${c} → did you mean ${s}?`;
             })
                 .filter((h) => h !== null);
-            return {
+            return denied({
                 ...empty,
                 requested,
                 reason: `unknown capabilit${unknown.length === 1 ? "y" : "ies"}: ${unknown.join(", ")} — not present in ` +
                     `this session's catalog (typo, or an uninstalled package?)` +
                     (hints.length > 0 ? ` — ${hints.join("; ")}` : ""),
-            };
+            }, "UNKNOWN_TOOL");
         }
     }
-    // ADR-0014's A-S6 — an approval for one subject cannot satisfy another — enforced HERE, not only in
-    // `resolveApprovals`. **Not a no-op elsewhere**: the re-plan passes `republishable(session)` with every subject
-    // unfiltered, so a human's "no" for one definition was overridden by a yes for another. Measured; R-83.
-    const subject = request.agent ?? DELEGATE_SUBJECT;
-    const approvedCapabilities = (ctx.approved ?? []).filter((a) => a.subject === subject).map((a) => a.capability);
-    const result = resolve({
+    const { result, approvalBinding, bindingMismatch } = resolveDelegationApproval({
+        task: request.task,
+        agent: request.agent,
+        boundWorkspaceId: request.boundWorkspaceId,
+        boundContextId: request.boundContextId,
         requested,
         parentGrant: ctx.ownGrant,
         gated: ctx.gated,
-        approved: approvedCapabilities,
+        approved: ctx.approved,
+        spawned,
+        definitionDigest,
+        correlation,
+        parentId: ctx.spawnId ?? `d${ctx.depth}`,
     });
-    /**
-     * ADR-0024: gating `agent:<name>` asks a human before that definition runs.
-     *
-     * `gatedBlocked` is a filter over `requested`, and for a definition spawn `requested` is the definition's
-     * CEILING — so the id that authorises it was never a candidate, and `PI_GRANTS_GATED=agent:deploy` did
-     * nothing at all on the path an operator writing it means. It half-worked when some *other* definition
-     * passed the id down in its own `allowed-tools`, which is worse than not working (R-47, R-25's shape).
-     *
-     * Evaluated here rather than by adding the id to `requested`, and that is the load-bearing part: a
-     * capability in `requested` flows to `effective`, which becomes the CHILD's grant — so the child would
-     * hold `agent:deploy` and could spawn `deploy` itself without anyone being asked. This is the parent's
-     * authority to run the definition *now*, not something the child receives.
-     *
-     * `agent:*` in the gate covers every definition, so "ask me before any definition runs" is one variable.
-     */
-    if (spawned) {
-        const authorising = agentCapability(spawned.name);
-        const gatedHere = ctx.gated.includes(authorising) || ctx.gated.includes(AGENT_WILDCARD);
-        if (gatedHere && !approvedCapabilities.includes(authorising)) {
-            result.gatedBlocked = [...result.gatedBlocked, authorising];
-        }
-    }
+    if (approvalBinding)
+        Object.assign(empty, { approvalBinding });
     if (result.denied.length > 0) {
-        return {
+        return denied({
             ...empty,
             requested,
             result,
             reason: `cannot grant ${result.denied.join(", ")} — this session does not hold it (capability escalation blocked)`,
-        };
+        }, "CAPABILITY_ESCALATION");
     }
     // ADR-0011: narrowing is checked BEFORE the gate, and the order is load-bearing rather than
     // stylistic. `assertNarrowing` refuses regardless of approval, so with the old order this returned
@@ -203,10 +192,14 @@ export function planDelegation(request, ctx) {
         assertNarrowing(result);
     }
     catch (error) {
-        return { ...empty, requested, result, reason: String(error instanceof Error ? error.message : error) };
+        // ADR-0011's narrowing invariant is the hardest rule this package enforces, and it was the one
+        // refusal an external controller could not identify by code (R-109).
+        return denied({ ...empty, requested, result, reason: String(error instanceof Error ? error.message : error) }, "NARROWING_VIOLATED");
     }
     if (result.gatedBlocked.length > 0) {
-        return { ...empty, requested, result, reason: `${result.gatedBlocked.join(", ")} requires explicit approval` };
+        const code = bindingMismatch ? "APPROVAL_SCOPE_MISMATCH" : "GATED_UNAPPROVED";
+        const suffix = bindingMismatch ? " (an approval exists, but its task/workspace/context scope does not match)" : "";
+        return denied({ ...empty, requested, result, reason: `${result.gatedBlocked.join(", ")} requires explicit approval${suffix}` }, code);
     }
     const canSubDelegate = result.effective.includes(DELEGATE_CAPABILITY);
     const plan = planSpawn({
@@ -226,13 +219,13 @@ export function planDelegation(request, ctx) {
     // not contain. `unknownCapabilities` above catches names absent from the catalog entirely; this
     // catches one that is known but whose path we could not resolve, which is a different fault.
     if (plan.unresolvedSkills.length > 0) {
-        return {
+        return denied({
             ...empty,
             requested,
             result,
             reason: `cannot locate ${plan.unresolvedSkills.join(", ")} on disk — granted but unresolvable, so the ` +
                 `child would silently lack it`,
-        };
+        }, "DEFINITION_UNREADABLE");
     }
     // A child may only delegate further if it was granted the capability AND has the extension to do it.
     const args = [...plan.args];
@@ -271,6 +264,9 @@ export function planDelegation(request, ctx) {
         childDepth,
         requested,
         childId: ctx.childSpawnId,
+        taskDigest,
+        ...(correlation ? { correlation } : {}),
+        ...(approvalBinding ? { approvalBinding } : {}),
         ...(definitionDigest ? { definitionDigest } : {}),
     };
 }

package/dist/delegate.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAA+C,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAuC,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAElH,4GAA4G;AAC5G,0GAA0G;AAC1G,+DAA+D;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACvI,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAgB,MAAM,cAAc,CAAC;AA6GpF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAA0B,EAAE,GAAsB;IAC/E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IACjC,qGAAqG;IACrG,mGAAmG;IACnG,iGAAiG;IACjG,oGAAoG;IACpG,MAAM,KAAK,GAAe;QACxB,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,EAAE;QACR,GAAG,EAAE,EAAE;QACP,SAAS,EAAE,EAAE;QACb,UAAU;QACV,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;KACpG,CAAC;IAEF,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IAC1F,IAAI,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,mCAAmC,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAEpF,iGAAiG;IACjG,IAAI,SAAuB,CAAC;IAC5B,IAAI,YAAgC,CAAC;IACrC,IAAI,gBAA8C,CAAC;IACnD,sGAAsG;IACtG,IAAI,OAAoC,CAAC;IAEzC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,GAAG,UAAU,CAAC;QACrB,+FAA+F;QAC/F,iGAAiG;QACjG,2BAA2B;QAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,OAAO;gBACL,GAAG,KAAK;gBACR,MAAM,EACJ,kBAAkB,OAAO,CAAC,KAAK,GAAG;oBAClC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC;aACpG,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,oGAAoG;QACpG,mGAAmG;QACnG,iFAAiF;QACjF,EAAE;QACF,mGAAmG;QACnG,oGAAoG;QACpG,+FAA+F;QAC/F,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvE,OAAO;gBACL,GAAG,KAAK;gBACR,SAAS,EAAE,CAAC,WAAW,CAAC;gBACxB,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;gBAClD,MAAM,EACJ,iBAAiB,UAAU,CAAC,IAAI,kCAAkC,WAAW,GAAG;oBAChF,4BAA4B,UAAU,CAAC,MAAM,KAAK;oBAClD,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;wBACd,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACrC,CAAC,CAAC,2CAA2C,WAAW,kCAAkC,CAAC;aAChG,CAAC;QACJ,CAAC;QAED,mGAAmG;QACnG,qGAAqG;QACrG,4EAA4E;QAC5E,EAAE;QACF,qGAAqG;QACrG,kGAAkG;QAClG,oGAAoG;QACpG,6DAA6D;QAC7D,gBAAgB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,GAAG,KAAK;gBACR,MAAM,EACJ,UAAU,UAAU,CAAC,IAAI,qEAAqE;oBAC9F,MAAM,UAAU,CAAC,MAAM,yEAAyE;aACnG,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO;gBACL,GAAG,KAAK;gBACR,MAAM,EACJ,UAAU,UAAU,CAAC,IAAI,sCAAsC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBAC/F,+FAA+F;oBAC/F,wFAAwF;aAC3F,CAAC;QACJ,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACjC,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED,oGAAoG;IACpG,2FAA2F;IAC3F,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,+FAA+F;YAC/F,gGAAgG;YAChG,kGAAkG;YAClG,iGAAiG;YACjG,uFAAuF;YACvF,MAAM,KAAK,GAAG,OAAO;iBAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,OAAQ,CAAC,CAAC;gBAC7C,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC;YACzD,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1C,OAAO;gBACL,GAAG,KAAK;gBACR,SAAS;gBACT,MAAM,EACJ,oBAAoB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;oBACjG,2DAA2D;oBAC3D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,gHAAgH;IAChH,wGAAwG;IACxG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAClD,MAAM,oBAAoB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAChH,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,SAAS;QACT,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,oBAAoB;KAC/B,CAAC,CAAC;IAEH;;;;;;;;;;;;;;OAcG;IACH,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACxF,IAAI,SAAS,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,KAAK;YACR,SAAS;YACT,MAAM;YACN,MAAM,EAAE,gBAAgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kEAAkE;SACnH,CAAC;IACJ,CAAC;IACD,4FAA4F;IAC5F,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,+FAA+F;IAC/F,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,EAAE,CAAC;IACjH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY;QACZ,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,mGAAmG;IACnG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,GAAG,KAAK;YACR,SAAS;YACT,MAAM;YACN,MAAM,EACJ,iBAAiB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C;gBAC/F,8BAA8B;SACjC,CAAC;IACJ,CAAC;IAED,qGAAqG;IACrG,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,cAAc,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACxC,4FAA4F;QAC5F,uDAAuD;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QACvC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;QAC/B,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;KACtC,CAAC;IACF,uGAAuG;IACvG,kGAAkG;IAClG,2CAA2C;IAC3C,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/E,IAAI,GAAG,CAAC,YAAY;QAAE,GAAG,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC5D,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,+FAA+F;IAC/F,qGAAqG;IACrG,mGAAmG;IACnG,oFAAoF;IACpF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IAErD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAA+C,MAAM,kBAAkB,CAAC;AACvH,OAAO,EAAE,eAAe,EAAuC,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAElH,4GAA4G;AAC5G,0GAA0G;AAC1G,+DAA+D;AAC/D,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACvI,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAgB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAA4C,MAAM,eAAe,CAAC;AACrG,OAAO,EACL,UAAU,EACV,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAIrE,MAAM,UAAU,cAAc,CAAC,OAA0B,EAAE,GAAsB;IAC/E,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,CAAC,IAAgB,EAAE,IAAiB,EAAc,EAAE,CACjE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,qGAAqG;IACrG,mGAAmG;IACnG,iGAAiG;IACjG,oGAAoG;IACpG,uGAAuG;IACvG,sGAAsG;IACtG,mGAAmG;IACnG,oEAAoE;IACpE,IAAI,WAA4C,CAAC;IACjD,IAAI,kBAAiD,CAAC;IACtD,IAAI,CAAC;QACH,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,GAAG,KAAK,YAAY,iBAAiB;YACrD,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACpG,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAe;QACxB,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,EAAE;QACR,GAAG,EAAE,EAAE;QACP,SAAS,EAAE,EAAE;QACb,UAAU;QACV,SAAS,EAAE,EAAE;QACb,UAAU;QACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;KACpG,CAAC;IAEF,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,mCAAmC,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,EAAE,cAAc,CAAC,CAAC;IAE5G,iGAAiG;IACjG,IAAI,SAAuB,CAAC;IAC5B,IAAI,YAAgC,CAAC;IACrC,IAAI,gBAA8C,CAAC;IACnD,sGAAsG;IACtG,IAAI,OAAoC,CAAC;IAEzC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,GAAG,UAAU,CAAC;QACrB,+FAA+F;QAC/F,iGAAiG;QACjG,2BAA2B;QAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,OAAO,MAAM,CAAC;gBACZ,GAAG,KAAK;gBACR,MAAM,EACJ,kBAAkB,OAAO,CAAC,KAAK,GAAG;oBAClC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,8BAA8B,CAAC;aACpG,EAAE,oBAAoB,CAAC,CAAC;QAC3B,CAAC;QAED,+FAA+F;QAC/F,oGAAoG;QACpG,mGAAmG;QACnG,iFAAiF;QACjF,EAAE;QACF,mGAAmG;QACnG,oGAAoG;QACpG,+FAA+F;QAC/F,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC;gBACZ,GAAG,KAAK;gBACR,SAAS,EAAE,CAAC,WAAW,CAAC;gBACxB,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;gBAClD,MAAM,EACJ,iBAAiB,UAAU,CAAC,IAAI,kCAAkC,WAAW,GAAG;oBAChF,4BAA4B,UAAU,CAAC,MAAM,KAAK;oBAClD,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;wBACd,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACrC,CAAC,CAAC,2CAA2C,WAAW,kCAAkC,CAAC;aAChG,EAAE,2BAA2B,CAAC,CAAC;QAClC,CAAC;QAED,mGAAmG;QACnG,qGAAqG;QACrG,4EAA4E;QAC5E,EAAE;QACF,qGAAqG;QACrG,kGAAkG;QAClG,oGAAoG;QACpG,6DAA6D;QAC7D,gBAAgB,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAE3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;gBACZ,GAAG,KAAK;gBACR,MAAM,EACJ,UAAU,UAAU,CAAC,IAAI,qEAAqE;oBAC9F,MAAM,UAAU,CAAC,MAAM,yEAAyE;aACnG,EAAE,kBAAkB,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC;gBACZ,GAAG,KAAK;gBACR,MAAM,EACJ,UAAU,UAAU,CAAC,IAAI,sCAAsC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;oBAC/F,+FAA+F;oBAC/F,wFAAwF;aAC3F,EAAE,6BAA6B,CAAC,CAAC;QACpC,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;QACjC,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED,oGAAoG;IACpG,2FAA2F;IAC3F,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,+FAA+F;YAC/F,gGAAgG;YAChG,kGAAkG;YAClG,iGAAiG;YACjG,uFAAuF;YACvF,MAAM,KAAK,GAAG,OAAO;iBAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,OAAQ,CAAC,CAAC;gBAC7C,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC;YACzD,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;gBACZ,GAAG,KAAK;gBACR,SAAS;gBACT,MAAM,EACJ,oBAAoB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;oBACjG,2DAA2D;oBAC3D,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,EAAE,cAAc,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,GAAG,yBAAyB,CAAC;QAC7E,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS;QACT,WAAW,EAAE,GAAG,CAAC,QAAQ;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,OAAO;QACP,gBAAgB;QAChB,WAAW;QACX,QAAQ,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE;KACzC,CAAC,CAAC;IACH,IAAI,eAAe;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAE/D,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC;YACZ,GAAG,KAAK;YACR,SAAS;YACT,MAAM;YACN,MAAM,EAAE,gBAAgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kEAAkE;SACnH,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IACD,4FAA4F;IAC5F,mGAAmG;IACnG,oGAAoG;IACpG,kGAAkG;IAClG,+FAA+F;IAC/F,IAAI,CAAC;QACH,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+FAA+F;QAC/F,qEAAqE;QACrE,OAAO,MAAM,CACX,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAC/F,oBAAoB,CACrB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,4EAA4E,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,OAAO,MAAM,CACX,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,MAAM,EAAE,EAAE,EAChH,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,OAAO,CAAC,IAAI;QACpB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY;QACZ,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KAC3C,CAAC,CAAC;IAEH,mGAAmG;IACnG,kGAAkG;IAClG,oGAAoG;IACpG,gGAAgG;IAChG,6FAA6F;IAC7F,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC;YACZ,GAAG,KAAK;YACR,SAAS;YACT,MAAM;YACN,MAAM,EACJ,iBAAiB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,8CAA8C;gBAC/F,8BAA8B;SACjC,EAAE,uBAAuB,CAAC,CAAC;IAC9B,CAAC;IAED,qGAAqG;IACrG,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,cAAc,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACxC,4FAA4F;QAC5F,uDAAuD;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAA2B;QAClC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QACvC,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;QAC/B,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;KACtC,CAAC;IACF,uGAAuG;IACvG,kGAAkG;IAClG,2CAA2C;IAC3C,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/E,IAAI,GAAG,CAAC,YAAY;QAAE,GAAG,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC;IAC5D,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,+FAA+F;IAC/F,qGAAqG;IACrG,mGAAmG;IACnG,oFAAoF;IACpF,GAAG,CAAC,YAAY,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrF,IAAI,GAAG,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC;IAErD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,GAAG;QACH,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM;QACN,UAAU;QACV,SAAS;QACT,OAAO,EAAE,GAAG,CAAC,YAAY;QACzB,UAAU;QACV,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/delegation-approval.d.ts

@@ -0,0 +1,36 @@
+import { type InheritableApproval } from "./approval.ts";
+import { type ApprovalBinding, type CorrelationMetadata } from "./correlation.ts";
+import type { DefinitionDigest, SkillDefinition } from "./definitions.ts";
+import { type Capability, type ResolveResult } from "./resolve.ts";
+/**
+ * Resolve the approval half of one delegation after its requested capability set is known.
+ *
+ * Kept as one function because the ordering is security-relevant: compute the unapproved and potential
+ * effective sets first, derive the exact binding from those trusted values, then decide which approvals
+ * match. An approval must never define the scope against which it is checked.
+ */
+export declare function resolveDelegationApproval(input: {
+    task: string;
+    agent?: string;
+    requested: Capability[];
+    parentGrant: Capability[];
+    gated: Capability[];
+    approved?: InheritableApproval[];
+    spawned?: SkillDefinition;
+    definitionDigest?: DefinitionDigest;
+    /**
+     * Present iff this call is task-bound. Its VALUES never enter the binding — only its presence selects
+     * the exact-bound regime over the legacy subject-scoped one.
+     */
+    correlation?: CorrelationMetadata;
+    /** Trusted: an id that was resolved against the operator registry and leased. Never a caller claim. */
+    boundWorkspaceId?: string;
+    /** Caller-declared label. Narrows the binding only; asserts nothing about enforcement. */
+    boundContextId?: string;
+    parentId: string;
+}): {
+    result: ResolveResult;
+    approvalBinding?: ApprovalBinding;
+    bindingMismatch: boolean;
+};
+//# sourceMappingURL=delegation-approval.d.ts.map

package/dist/delegation-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-approval.d.ts","sourceRoot":"","sources":["../src/delegation-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAE3E,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAA2B,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAE5F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAAC,eAAe,EAAE,OAAO,CAAA;CAAE,CA6DzF"}

package/dist/delegation-approval.js

@@ -0,0 +1,67 @@
+import { DELEGATE_SUBJECT } from "./approval.js";
+import { agentCapability } from "./capabilities.js";
+import { approvalBindingsEqual, buildApprovalBinding, } from "./correlation.js";
+import { AGENT_WILDCARD, resolve } from "./resolve.js";
+/**
+ * Resolve the approval half of one delegation after its requested capability set is known.
+ *
+ * Kept as one function because the ordering is security-relevant: compute the unapproved and potential
+ * effective sets first, derive the exact binding from those trusted values, then decide which approvals
+ * match. An approval must never define the scope against which it is checked.
+ */
+export function resolveDelegationApproval(input) {
+    const subject = input.agent ?? DELEGATE_SUBJECT;
+    const unapproved = resolve({
+        requested: input.requested,
+        parentGrant: input.parentGrant,
+        gated: input.gated,
+        approved: [],
+    });
+    // ADR-0024: a definition's authorising id is gated as the PARENT's authority to run it now. It never
+    // joins requested/effective, because that would hand the child authority to recursively spawn itself.
+    let authorisingCapability;
+    if (input.spawned) {
+        const authorising = agentCapability(input.spawned.name);
+        if (input.gated.includes(authorising) || input.gated.includes(AGENT_WILDCARD)) {
+            authorisingCapability = authorising;
+            unapproved.gatedBlocked = [...unapproved.gatedBlocked, authorising];
+        }
+    }
+    const potential = resolve({
+        requested: input.requested,
+        parentGrant: input.parentGrant,
+        gated: input.gated,
+        // If the definition also declares its own authorising `agent:<name>`, the same approval unblocks
+        // that requested child capability too; excluding it here would bind a smaller set than we provision.
+        approved: unapproved.gatedBlocked,
+    });
+    const approvalBinding = input.correlation
+        ? buildApprovalBinding({
+            task: input.task,
+            requested: input.requested,
+            effective: potential.effective,
+            definitionSha256: input.definitionDigest?.sha256,
+            parentId: input.parentId,
+            workspaceId: input.boundWorkspaceId,
+            contextId: input.boundContextId,
+        })
+        : undefined;
+    const forSubject = (input.approved ?? []).filter((approval) => approval.subject === subject);
+    const approvedCapabilities = forSubject
+        .filter((approval) => approvalBinding
+        ? approvalBindingsEqual(approval.binding, approvalBinding)
+        : approval.binding === undefined)
+        .map((approval) => approval.capability);
+    const bindingMismatch = approvalBinding !== undefined && forSubject.some((approval) => approval.binding !== undefined && !approvalBindingsEqual(approval.binding, approvalBinding));
+    const result = resolve({
+        requested: input.requested,
+        parentGrant: input.parentGrant,
+        gated: input.gated,
+        approved: approvedCapabilities,
+    });
+    if (authorisingCapability && !approvedCapabilities.includes(authorisingCapability)) {
+        result.gatedBlocked = [...result.gatedBlocked, authorisingCapability];
+    }
+    return { result, ...(approvalBinding ? { approvalBinding } : {}), bindingMismatch };
+}
+//# sourceMappingURL=delegation-approval.js.map

package/dist/delegation-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-approval.js","sourceRoot":"","sources":["../src/delegation-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA4B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAGrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,OAAO,EAAuC,MAAM,cAAc,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAmBzC;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,gBAAgB,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC;QACzB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IAEH,qGAAqG;IACrG,sGAAsG;IACtG,IAAI,qBAA6C,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9E,qBAAqB,GAAG,WAAW,CAAC;YACpC,UAAU,CAAC,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iGAAiG;QACjG,qGAAqG;QACrG,QAAQ,EAAE,UAAU,CAAC,YAAY;KAClC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,KAAK,CAAC,WAAW;QACvC,CAAC,CAAC,oBAAoB,CAAC;YACnB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,MAAM;YAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,WAAW,EAAE,KAAK,CAAC,gBAAgB;YACnC,SAAS,EAAE,KAAK,CAAC,cAAc;SAChC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC7F,MAAM,oBAAoB,GAAG,UAAU;SACpC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnB,eAAe;QACb,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;QAC1D,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,CACnC;SACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,eAAe,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CACtE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAC1G,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC;QACrB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,oBAAoB;KAC/B,CAAC,CAAC;IACH,IAAI,qBAAqB,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC;AACtF,CAAC"}

package/dist/git-identity.d.ts

@@ -0,0 +1,13 @@
+import type { ValidatedWorkspace } from "./workspace.ts";
+export interface GitCandidateIdentity {
+    headSha: string;
+    treeSha: string;
+}
+/** Compute HEAD plus NON-IGNORED tracked/untracked candidate content without changing the real index.
+ *
+ * NOT the exact working tree: `git add -A` honours `.gitignore`, `core.excludesFile` and
+ * `$GIT_DIR/info/exclude`, and records only a gitlink for a submodule. And it is not read-only — it writes
+ * blob objects into the real `.git/objects`. `docs/SPEC.md` retracted the word "exact"; this comment said
+ * it for one more round. */
+export declare function computeGitCandidateIdentity(workspace: ValidatedWorkspace): Promise<GitCandidateIdentity>;
+//# sourceMappingURL=git-identity.d.ts.map

package/dist/git-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.d.ts","sourceRoot":"","sources":["../src/git-identity.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIzD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;4BAK4B;AAC5B,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA8B9G"}

package/dist/git-identity.js

@@ -0,0 +1,44 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { GovernanceRefusal, refusal } from "./refusals.js";
+const execFileAsync = promisify(execFile);
+/** Compute HEAD plus NON-IGNORED tracked/untracked candidate content without changing the real index.
+ *
+ * NOT the exact working tree: `git add -A` honours `.gitignore`, `core.excludesFile` and
+ * `$GIT_DIR/info/exclude`, and records only a gitlink for a submodule. And it is not read-only — it writes
+ * blob objects into the real `.git/objects`. `docs/SPEC.md` retracted the word "exact"; this comment said
+ * it for one more round. */
+export async function computeGitCandidateIdentity(workspace) {
+    const dir = await mkdtemp(join(tmpdir(), "pi-daddy-index-"));
+    const index = join(dir, "index");
+    const env = {
+        PATH: process.env.PATH,
+        HOME: process.env.HOME,
+        LANG: process.env.LANG,
+        LC_ALL: process.env.LC_ALL,
+        TMPDIR: process.env.TMPDIR,
+        GIT_INDEX_FILE: index,
+    };
+    const git = async (args) => (await execFileAsync("git", ["-C", workspace.root, ...args], {
+        env, encoding: "utf8", maxBuffer: 16 * 1024 * 1024,
+    })).stdout.trim();
+    try {
+        const headSha = await git(["rev-parse", "HEAD"]);
+        await git(["read-tree", "HEAD"]);
+        await git(["add", "-A"]);
+        const treeSha = await git(["write-tree"]);
+        if (!/^[a-f0-9]{40,64}$/i.test(headSha) || !/^[a-f0-9]{40,64}$/i.test(treeSha))
+            throw new Error("Git returned an invalid object id");
+        return { headSha, treeSha };
+    }
+    catch (error) {
+        throw new GovernanceRefusal(refusal("CHECK_IDENTITY_UNAVAILABLE", `could not compute exact Git head/candidate-tree identity for workspace ${workspace.workspaceId} (${String(error)})`, { workspace_id: workspace.workspaceId }));
+    }
+    finally {
+        await rm(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=git-identity.js.map

package/dist/git-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-identity.js","sourceRoot":"","sources":["../src/git-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG3D,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAO1C;;;;;4BAK4B;AAC5B,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAA6B;IAC7E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAsB;QAC7B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;QAC1B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM;QAC1B,cAAc,EAAE,KAAK;KACtB,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE;QACjG,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KACnD,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjD,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QACjC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACrI,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CAAC,OAAO,CACjC,4BAA4B,EAC5B,0EAA0E,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EACpH,EAAE,YAAY,EAAE,SAAS,CAAC,WAAW,EAAE,CACxC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,11 @@
 export { resolve, assertNarrowing, toPiToolsAllowlist, UNIVERSAL_CAPABILITIES, type Capability, type ResolveInput, type ResolveResult, } from "./resolve.ts";
-export { appendRecord, buildRecord, isEscalationAttempt, type GrantRecord, type LedgerOptions, } from "./ledger.ts";
+export { appendLedgerEvent, appendRecord, buildChildLifecycleEvent, buildRecord, buildWorkspaceLeaseEvent, isEscalationAttempt, LEDGER_VERSION, type CheckReceiptLedgerEvent, type ChildLifecycleEvent, type GrantRecord, type LedgerOptions, type RuntimeLedgerEvent, type WorkspaceLeaseEvent, type WorkspaceLeaseOutcome, } from "./ledger.ts";
 export { planSpawn, type SpawnPlan, type SpawnPlanInput } from "./spawn.ts";
 export { APPROVAL_TTL_DAYS, DELEGATE_SUBJECT, approvalKey, entryVerdict, expiryFor, inheritApprovals, offeredScopes, resolveApprovals, shouldSeekApproval, type ApprovalEntry, type ApprovalPath, type ApprovalScope, type ApprovalSource, type EntryVerdict, type SubjectSnapshot, } from "./approval.ts";
 export { approvalsPath, loadApprovals, revokeAll, revokeApproval, saveApproval, type DroppedApproval, type SubjectLookup, } from "./approval-store.ts";
+export { approvalBindingDigest, approvalBindingsEqual, buildApprovalBinding, digestCapabilities, digestTask, isApprovalBinding, normaliseCorrelation, type ApprovalBinding, type CorrelationMetadata, type JsonValue, } from "./correlation.ts";
+export { GovernanceRefusal, REFUSAL_CODES, refusal, type RefusalCode, type StructuredRefusal, } from "./refusals.ts";
+export { acquireWorkspaceLease, defaultWorkspaceLeaseDir, loadWorkspaceRegistry, resolveWorkspace, validateRegisteredWorkspace, type ValidatedWorkspace, type WorkspaceAccess, type WorkspaceLease, type WorkspaceRegistryFile, } from "./workspace.ts";
+export { buildCheckEnvironment, runNamedCheck, type CheckDefinition, type CheckReceipt, type CheckRegistry, } from "./check-runner.ts";
 export { createApprovalGate, createApprovalGateProvider, timeoutMsFromEnv, type ApprovalGate, type InFlightApprovals, type ApprovalUI, type PromptOutcome, type PromptOutcomeKind, type PromptRequest, } from "./approval-prompt.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACd,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,SAAS,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,OAAO,EACP,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -1,7 +1,11 @@
 export { resolve, assertNarrowing, toPiToolsAllowlist, UNIVERSAL_CAPABILITIES, } from "./resolve.js";
-export { appendRecord, buildRecord, isEscalationAttempt, } from "./ledger.js";
+export { appendLedgerEvent, appendRecord, buildChildLifecycleEvent, buildRecord, buildWorkspaceLeaseEvent, isEscalationAttempt, LEDGER_VERSION, } from "./ledger.js";
 export { planSpawn } from "./spawn.js";
 export { APPROVAL_TTL_DAYS, DELEGATE_SUBJECT, approvalKey, entryVerdict, expiryFor, inheritApprovals, offeredScopes, resolveApprovals, shouldSeekApproval, } from "./approval.js";
 export { approvalsPath, loadApprovals, revokeAll, revokeApproval, saveApproval, } from "./approval-store.js";
+export { approvalBindingDigest, approvalBindingsEqual, buildApprovalBinding, digestCapabilities, digestTask, isApprovalBinding, normaliseCorrelation, } from "./correlation.js";
+export { GovernanceRefusal, REFUSAL_CODES, refusal, } from "./refusals.js";
+export { acquireWorkspaceLease, defaultWorkspaceLeaseDir, loadWorkspaceRegistry, resolveWorkspace, validateRegisteredWorkspace, } from "./workspace.js";
+export { buildCheckEnvironment, runNamedCheck, } from "./check-runner.js";
 export { createApprovalGate, createApprovalGateProvider, timeoutMsFromEnv, } from "./approval-prompt.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GAIvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAuC,MAAM,YAAY,CAAC;AAE5E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GAOnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,GAGb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,GAOjB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EACP,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GAIvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,GAQf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAuC,MAAM,YAAY,CAAC;AAE5E,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GAOnB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,SAAS,EACT,cAAc,EACd,YAAY,GAGb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,UAAU,EACV,iBAAiB,EACjB,oBAAoB,GAIrB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,OAAO,GAGR,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,GAK5B,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,qBAAqB,EACrB,aAAa,GAId,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,gBAAgB,GAOjB,MAAM,sBAAsB,CAAC"}

package/dist/lease-record.d.ts

@@ -0,0 +1,78 @@
+import type { ValidatedWorkspace, WorkspaceAccess } from "./workspace.ts";
+export interface LeaseMetadata {
+    version: 1;
+    state: "active" | "released";
+    token: string;
+    owner_id: string;
+    workspace_id: string;
+    root: string;
+    pid: number;
+    acquired_at: string;
+    released_at?: string;
+    release_reason?: string;
+}
+export interface WorkspaceLease {
+    workspace: ValidatedWorkspace;
+    access: WorkspaceAccess;
+    ownerId: string;
+    /**
+     * `true` only when the kernel lock was free but metadata said the prior owner never released.
+     * `"unknown"` when the prior owner's record could not be read at all — that is not evidence of a
+     * clean handover and must not be recorded as one (R-100).
+     */
+    recovered: boolean | "unknown";
+    /** Attach the governed resource so parent death cleans it before the kernel lock is released. */
+    attachProcess(pid: number): void;
+    attachHerdrTab(tabId: string): void;
+    /** Resolves only when the kernel-lock helper exits before explicit release. */
+    lost: Promise<Error>;
+    /**
+     * NEVER throws. A cleanup function that can throw destroys its caller's return value — a completed
+     * child's entire output was discarded this way (R-99) — so the outcome is a VALUE the caller records:
+     *   `"released"`            the kernel lock was handed back and the handover recorded;
+     *   `"released-unrecorded"` the lock was handed back but the record failed, so the NEXT owner will
+     *                           report a recovery that did not happen unless this is ledgered;
+     *   `"lost"`                the helper was already gone, so this owner never released anything.
+     */
+    release(reason?: string): Promise<LeaseReleaseOutcome>;
+    /**
+     * Record that this lease is being kept deliberately, WITHOUT releasing the kernel lock.
+     *
+     * Needed because a retained lease never calls `release()`, so the metadata stays `state: "active"` and
+     * whoever acquires next reports `recovered: true` — blaming a crash on a known-good path.
+     */
+    markRetained(reason?: string): Promise<void>;
+    /** Reads the give-up marker the helper leaves when it could not close a herdr writer tab. */
+    readCloseFailure(): Promise<{
+        reason: string;
+        herdr_tab?: string;
+    } | null>;
+}
+/**
+ * What a release actually did. Five members rather than three, because the first version conflated facts
+ * that call for different responses — and one of them is an alarm:
+ *   `released`             the lock went back and THIS owner wrote its own handover;
+ *   `released-unrecorded`  the lock went back and the record does not say so, so the next owner will report
+ *                          a recovery that never happened unless the caller ledgers this. **The alarm.**
+ *   `released-superseded`  the lock went back and a successor already owns the metadata, so we correctly
+ *                          declined to overwrite it. Healthy, and previously indistinguishable from the
+ *                          alarm above;
+ *   `not-held`             a read lease, which never took a kernel lock — recording it as `released`
+ *                          overstated how many handovers the kernel performed, which is R-105 on the
+ *                          release side of the same defect;
+ *   `lost`                 the helper was already gone; this owner released nothing.
+ */
+export type LeaseReleaseOutcome = "released" | "released-unrecorded" | "released-superseded" | "not-held" | "lost";
+export declare function leasePaths(leaseDir: string, root: string): {
+    lock: string;
+    metadata: string;
+    marker: string;
+};
+export declare function atomicMetadata(path: string, value: LeaseMetadata): Promise<void>;
+/**
+ * `null` means no prior owner was recorded. `"malformed"` means a record exists and cannot be read,
+ * which is strictly LESS evidence than a readable "active" one and must never read as a clean handover
+ * (R-100). Absent and unreadable are different facts; conflating them silently erases a real recovery.
+ */
+export declare function readMetadata(path: string): Promise<LeaseMetadata | null | "malformed">;
+//# sourceMappingURL=lease-record.d.ts.map

package/dist/lease-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-record.d.ts","sourceRoot":"","sources":["../src/lease-record.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,kBAAkB,CAAC;IAC9B,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,iGAAiG;IACjG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,+EAA+E;IAC/E,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvD;;;;;OAKG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6FAA6F;IAC7F,gBAAgB,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,qBAAqB,GACrB,qBAAqB,GACrB,UAAU,GACV,MAAM,CAAC;AAEX,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;EAQxD;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAItF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,GAAG,WAAW,CAAC,CAgB5F"}