pi-daddy 0.28.0 → 0.32.0

package/dist/kernel/fanout.js

@@ -0,0 +1,93 @@
+/**
+ * Bounded synchronous fan-out — ADR-0015's option A′, and the cardinality bound ADR-0008 never had.
+ *
+ * **The gap this closes.** ADR-0008 bounds what each child may *hold* and says nothing about how many
+ * children exist. `resolve()` is a set operation; nowhere in `src/` was there a count. Blocking `delegate`
+ * bounded cardinality to one *by accident of being blocking*, so the invariant was never tested. Fan-out
+ * removes that accident: with `maxDepth: 2` and five children per call, five delegators each spawning five
+ * is thirty concurrent model sessions — **every ledger line individually correct and narrow, the aggregate
+ * a machine DoS and an uncapped bill.** The critic's verdict on this was that silence is itself a finding.
+ *
+ * **Why a budget rather than a per-call limit.** A per-call cap of K with depth D still permits K^D
+ * descendants, which is the same exponential wearing a smaller number. A *budget* is subtractive and
+ * therefore total: a session holding budget B may create at most B descendants in its whole subtree,
+ * because it spends from B to spawn and hands each child a share of what is left. That composes across
+ * process boundaries with **no shared state** — the same property that makes depth work — so it needs no
+ * registry, no lock and no counter file.
+ *
+ * It is deliberately NOT a concurrency limit. How many run at once is a resource question for the executor;
+ * how many may exist at all is a governance question, and this is the governance answer.
+ */
+import { parseBound } from "./propagation.js";
+/** Total descendants a session may create across its entire subtree, when nothing is configured. */
+export const DEFAULT_FANOUT_BUDGET = 8;
+/**
+ * Hard ceiling on children in a single call, independent of budget.
+ *
+ * A budget alone would let one call spend all of it at once, and a hundred simultaneous `pi` processes is
+ * a different failure from a hundred spread over a session. This is the blast-radius bound; the budget is
+ * the total bound. Both are needed because they answer different questions.
+ */
+export const MAX_CHILDREN_PER_CALL = 8;
+/**
+ * Steps a single `delegate_chain` may contain — ADR-0033.
+ *
+ * **Derived from `MAX_CHILDREN_PER_CALL` so the two cannot drift.** A chain is not concurrent, so the blast-radius
+ * argument for that constant does not apply directly; what does apply is that one tool call should not be able to
+ * create an unbounded number of descendants, and eight is already a long pipeline. Sharing the number also means an
+ * operator learns one bound rather than two.
+ */
+export const MAX_CHAIN_STEPS = MAX_CHILDREN_PER_CALL;
+/** Read the budget from the environment, failing to the default on absent *or* malformed input. */
+export function budgetFromEnv(raw) {
+    const parsed = parseBound(raw);
+    // Malformed and zero both fall back rather than disabling fan-out silently — G7's rule. A budget that a
+    // typo can switch off is the A-S4 defect wearing different clothes. To genuinely forbid delegation an
+    // operator sets `maxDepth: 0`, which says what it means.
+    return parsed === undefined || parsed === null || parsed === 0 ? DEFAULT_FANOUT_BUDGET : parsed;
+}
+/**
+ * Spend `count` from a budget and divide the remainder among the children.
+ *
+ * The parent pays one unit per child it creates *before* sharing what is left, so a subtree can never
+ * exceed the budget it started with: spawning is itself an expenditure, not a free act that only its
+ * descendants pay for. `Math.floor` on the division means rounding always loses budget rather than
+ * inventing it — the safe direction, and the reason a deep tree converges to zero instead of oscillating.
+ */
+export function splitBudget(budget, count) {
+    if (count <= 0)
+        return { ok: false, reason: "a fan-out needs at least one child", perChild: 0 };
+    if (count > MAX_CHILDREN_PER_CALL) {
+        return {
+            ok: false,
+            reason: `${count} children exceeds the per-call limit of ${MAX_CHILDREN_PER_CALL}`,
+            perChild: 0,
+        };
+    }
+    if (budget < count) {
+        return {
+            ok: false,
+            reason: `fan-out budget exhausted: ${count} children requested, ${budget} remaining in this subtree ` +
+                `(raise PI_DADDY_FANOUT at the root, or delegate fewer at a time)`,
+            perChild: 0,
+        };
+    }
+    return { ok: true, perChild: Math.floor((budget - count) / count) };
+}
+/**
+ * A ledger id that distinguishes siblings.
+ *
+ * **Review finding F8.** Every child was recorded as `delegate@d1`, so four concurrent children produced
+ * four lines identical except `ts` — and two landing in the same millisecond were indistinguishable.
+ * ADR-0008 names `parent_id`/`child_id` as the correlation keys, but they were depth *labels* wearing id
+ * names, which made the ledger unjoinable to the returned result, to the OS process, or to the child's own
+ * lines one level down.
+ *
+ * The id is hierarchical and derived, not random: a child of `d0` is `d0.1`, its own second child `d0.1.2`.
+ * That means a line's ancestry is readable from the id alone with no join at all, and it is reproducible —
+ * two runs of the same fan-out produce the same ids, which is what makes a ledger diffable.
+ */
+export function childSpawnId(parentId, index) {
+    return `${parentId}.${index + 1}`;
+}
+//# sourceMappingURL=fanout.js.map

package/dist/kernel/fanout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fanout.js","sourceRoot":"","sources":["../../src/kernel/fanout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAErD,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAAC,GAAuB;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/B,wGAAwG;IACxG,sGAAsG;IACtG,yDAAyD;IACzD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;AAClG,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACvD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAChG,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,KAAK,2CAA2C,qBAAqB,EAAE;YAClF,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,6BAA6B,KAAK,wBAAwB,MAAM,6BAA6B;gBAC7F,kEAAkE;YACpE,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa;IAC1D,OAAO,GAAG,QAAQ,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;AACpC,CAAC"}

package/dist/kernel/grant-env.d.ts

@@ -0,0 +1,118 @@
+/**
+ * The reviewable project record (`settings.json` since ADR-0076 PR 3c) — and what `init` refuses to put in it.
+ *
+ * Split out of `init.ts` when ADR-0029's grant-width rule pushed that file past the 400-line ceiling and
+ * `test/file-size.test.ts` refused it. The seam is the natural one: `init.ts` decides *what is true about
+ * the installed packages*, this file decides *how that is presented to a human for review*.
+ *
+ * **ADR-0029.** `init` used to emit the union of every declared ceiling as a live grant. A critic's reading
+ * killed it in one sentence: the handoff's safety argument for a third party authoring `allowed-tools` is
+ * that *"the operator's `PI_DADDY_GRANT` still bounds it"* — and a generated union makes the bound and the
+ * bounded have the same author, who is not the operator. So capabilities that can change a machine are
+ * emitted **commented**, with the definitions that need them named. `init` + `source` yields a working
+ * read-only setup; the wide ones cost one deliberate uncomment.
+ *
+ * That is a decision about the **starting grant**, which is a stronger act than choosing a ceiling and is
+ * why it needed its own ADR rather than a paragraph in ADR-0028.
+ */
+import { type Capability } from "./resolve.ts";
+/**
+ * Capabilities `init` will never put LIVE in a generated grant.
+ *
+ * **This list is a judgement, and it is written down in one place so it can be argued with** — which is the
+ * whole reason ADR-0029 exists. The rule behind it: a capability that can *change the machine* or *execute*
+ * does not become live because a package asked for it. Everything else (reading, searching, listing) does.
+ *
+ *  - `DEFAULT_GATED` — whatever a governed session already asks a human about. Today `tool:bash`, and taking
+ *    it from there rather than restating it means the two cannot drift apart.
+ *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree, and **are not gated by default**,
+ *    so a source-and-go operator would hand them to a child with no dialog at all. That gap is exactly what
+ *    made "the union is mitigated by gating" untrue (R-76).
+ *  - `UNIVERSAL_CAPABILITIES` — confer the whole catalog by measurement (`docs/probes/pi-fabric-eval`).
+ *    `assertNarrowing` refuses a grant containing one anyway; leaving it out of the file keeps the operator
+ *    from ever holding it by accident.
+ */
+export declare const WITHHELD_BY_DEFAULT: readonly Capability[];
+/** Would `init` put this capability in the live grant? */
+export declare function isLiveByDefault(capability: Capability): boolean;
+export declare class UnsafeGrantError extends Error {
+}
+/** Throw rather than write a grant string that could mean something to a shell. */
+export declare function assertGrantIsWritable(grant: Capability[]): void;
+/** One definition's declared ceiling, as far as the grant file is concerned. */
+export interface GrantEnvSkill {
+    name: string;
+    ceiling: Capability[];
+    /** Present when the definition cannot be spawned at all; the string is why, for the reader. */
+    unspawnable?: string;
+}
+export interface GrantEnvInput {
+    skills: GrantEnvSkill[];
+    /** Capabilities emitted live. */
+    live: Capability[];
+    /** Withheld capability → the definitions that declared it. Emitted commented, for a deliberate uncomment. */
+    withheld: Map<Capability, string[]>;
+    /** Definitions whose `agent:` id is withheld because they need a withheld capability. */
+    withheldDefinitions: string[];
+    /** `workspace:<id>` ids this project could route to (ADR-0035). Rendered commented, never granted. */
+    routableWorkspaces?: Capability[];
+    /** `agent:<name>` ids a ceiling names that `init` did not write here. Reported, never granted. */
+    crossReferences: {
+        from: string;
+        capability: Capability;
+    }[];
+    cautions: string[];
+}
+/**
+ * Render the file.
+ *
+ * Every capability is annotated with the definition it came from, because the whole claim of this feature is
+ * that the capability decision is visible and diffable. A grant nobody can read is a grant nobody reviews.
+ */
+/**
+ * Render `.pi/pi-daddy/settings.json`, the reviewable, committable record of a project's ceiling (ADR-0076 PR 3c).
+ *
+ * It replaced `.pi/grants.env`, which was never machine-read: the root grant comes from the user-level grant
+ * store (ADR-0037), and the shell file existed so a human could read and diff the capability decision. That
+ * purpose is kept as data: every capability is annotated with the definition it came from, withheld
+ * capabilities and definitions are listed with their reasons, and nothing here is advice dressed as a value.
+ * `/grants` renders it; PR 6 adds the advisor toggles beside it.
+ */
+export interface ProjectSettings {
+    version: 1;
+    writtenBy: "pi-daddy init";
+    /** How to read this file, for the human who opens it in a diff. */
+    review: string;
+    /** The live grant: what `pi-daddy init` found declared and did not withhold. Delete an id to withhold it. */
+    grant: Capability[];
+    definitions: {
+        name: string;
+        declares: Capability[];
+        spawnable: boolean;
+        reason?: string;
+    }[];
+    /** Withheld by default (ADR-0029) → the definitions that declared each. Never granted by init. */
+    withheld: {
+        capability: Capability;
+        declaredBy: string[];
+    }[];
+    /** Definitions whose `agent:` id is withheld because they need a withheld capability. */
+    withheldDefinitions: string[];
+    /** `workspace:<id>` ids this project could route to (ADR-0035). Listed, never granted. */
+    routableWorkspaces: Capability[];
+    /** `agent:<name>` ids a ceiling names that init did not write here. Reported, never granted. */
+    crossReferences: {
+        from: string;
+        capability: Capability;
+    }[];
+    cautions: string[];
+    /** The project ledger file name under `.pi/pi-daddy/`; init enables it (ADR-0037). */
+    ledger: string;
+    /** Gated by default (ADR-0012): closed under subsumption, so gating tool:write also gates tool:bash. */
+    gatedByDefault: Capability[];
+}
+export declare function buildProjectSettings(input: GrantEnvInput): ProjectSettings;
+export declare function renderProjectSettings(input: GrantEnvInput): string;
+/** The capability that must always be live, or the generated file is inert (S-5). */
+export declare const ALWAYS_LIVE: Capability;
+//# sourceMappingURL=grant-env.d.ts.map

package/dist/kernel/grant-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-env.d.ts","sourceRoot":"","sources":["../../src/kernel/grant-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAGvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,UAAU,EAEpD,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAQ/D;AAaD,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAU/D;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,+FAA+F;IAC/F,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,iCAAiC;IACjC,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,6GAA6G;IAC7G,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,UAAU,EAAE,CAAC;IAClC,kGAAkG;IAClG,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,eAAe,CAAC;IAC3B,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7F,kGAAkG;IAClG,QAAQ,EAAE;QAAE,UAAU,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IAC7D,yFAAyF;IACzF,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,0FAA0F;IAC1F,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,gGAAgG;IAChG,eAAe,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,UAAU,CAAA;KAAE,EAAE,CAAC;IAC5D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,cAAc,EAAE,UAAU,EAAE,CAAC;CAC9B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAyB1E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAElE;AAED,qFAAqF;AACrF,eAAO,MAAM,WAAW,EAAE,UAAgC,CAAC"}

package/dist/kernel/grant-env.js

@@ -0,0 +1,104 @@
+/**
+ * The reviewable project record (`settings.json` since ADR-0076 PR 3c) — and what `init` refuses to put in it.
+ *
+ * Split out of `init.ts` when ADR-0029's grant-width rule pushed that file past the 400-line ceiling and
+ * `test/file-size.test.ts` refused it. The seam is the natural one: `init.ts` decides *what is true about
+ * the installed packages*, this file decides *how that is presented to a human for review*.
+ *
+ * **ADR-0029.** `init` used to emit the union of every declared ceiling as a live grant. A critic's reading
+ * killed it in one sentence: the handoff's safety argument for a third party authoring `allowed-tools` is
+ * that *"the operator's `PI_DADDY_GRANT` still bounds it"* — and a generated union makes the bound and the
+ * bounded have the same author, who is not the operator. So capabilities that can change a machine are
+ * emitted **commented**, with the definitions that need them named. `init` + `source` yields a working
+ * read-only setup; the wide ones cost one deliberate uncomment.
+ *
+ * That is a decision about the **starting grant**, which is a stronger act than choosing a ceiling and is
+ * why it needed its own ADR rather than a paragraph in ADR-0028.
+ */
+import { DELEGATE_CAPABILITY } from "./capabilities.js";
+import { DEFAULT_GATED } from "./propagation.js";
+import { UNIVERSAL_CAPABILITIES } from "./resolve.js";
+import { PROJECT_FILES } from "./project-paths.js";
+/**
+ * Capabilities `init` will never put LIVE in a generated grant.
+ *
+ * **This list is a judgement, and it is written down in one place so it can be argued with** — which is the
+ * whole reason ADR-0029 exists. The rule behind it: a capability that can *change the machine* or *execute*
+ * does not become live because a package asked for it. Everything else (reading, searching, listing) does.
+ *
+ *  - `DEFAULT_GATED` — whatever a governed session already asks a human about. Today `tool:bash`, and taking
+ *    it from there rather than restating it means the two cannot drift apart.
+ *  - `tool:write`, `tool:edit`, `tool:edit-diff` — mutate the working tree, and **are not gated by default**,
+ *    so a source-and-go operator would hand them to a child with no dialog at all. That gap is exactly what
+ *    made "the union is mitigated by gating" untrue (R-76).
+ *  - `UNIVERSAL_CAPABILITIES` — confer the whole catalog by measurement (`docs/probes/pi-fabric-eval`).
+ *    `assertNarrowing` refuses a grant containing one anyway; leaving it out of the file keeps the operator
+ *    from ever holding it by accident.
+ */
+export const WITHHELD_BY_DEFAULT = [
+    ...new Set([...DEFAULT_GATED, "tool:write", "tool:edit", "tool:edit-diff", ...UNIVERSAL_CAPABILITIES]),
+];
+/** Would `init` put this capability in the live grant? */
+export function isLiveByDefault(capability) {
+    // No `workspace:<id>` is ever live by default (ADR-0035), and this is the same rule the list above states
+    // rather than a new one: authority "does not become live because a package asked for it". A registry id is
+    // a *choice of where a child runs*, which is the operator's to make and cannot be inferred from a
+    // declaration — ADR-0028's whole position. Enumerated ids are unbounded, so this is a namespace test and
+    // not a list membership.
+    if (capability.startsWith("workspace:"))
+        return false;
+    return !WITHHELD_BY_DEFAULT.includes(capability);
+}
+/**
+ * Every character allowed in a generated `PI_DADDY_GRANT` value.
+ *
+ * **A structural backstop, not the main defence** (R-78). The per-entry whitelist in `skill-packages.ts` is
+ * what refuses a hostile capability id; this refuses to write the FILE AT ALL if anything unexpected reached
+ * the string regardless. R-77 and R-78 were the same defect found twice, on two channels into one
+ * interpolation, so the third channel — whatever it turns out to be — should cost a refusal rather than an
+ * injection. A guard that depends on my enumeration being complete is not a guard.
+ */
+const GRANT_VALUE = /^[A-Za-z0-9:@,._/-]*$/;
+export class UnsafeGrantError extends Error {
+}
+/** Throw rather than write a grant string that could mean something to a shell. */
+export function assertGrantIsWritable(grant) {
+    const value = grant.join(",");
+    if (!GRANT_VALUE.test(value)) {
+        throw new UnsafeGrantError(`refusing to write the grant: the assembled grant contains characters that are not part of a ` +
+            `capability id (${JSON.stringify(value)}). The grant is handed to children through their environment, so it is ` +
+            `not written at all rather than written unsafely. Report this — a declared capability reached the ` +
+            `grant that should have been refused at discovery.`);
+    }
+}
+export function buildProjectSettings(input) {
+    return {
+        version: 1,
+        writtenBy: "pi-daddy init",
+        review: "Every capability below was read from a SKILL.md's own allowed-tools; pi-daddy chose none of them. " +
+            "Review and commit this file. Delete an agent: id from `grant` to withhold that definition, a tool: id to " +
+            "withhold that tool from every child. A child never receives more than this grant ∩ its definition.",
+        grant: [...input.live],
+        definitions: input.skills.map((s) => ({
+            name: s.name,
+            declares: [...s.ceiling],
+            spawnable: !s.unspawnable,
+            ...(s.unspawnable ? { reason: s.unspawnable } : {}),
+        })),
+        withheld: [...input.withheld.entries()]
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([capability, declaredBy]) => ({ capability, declaredBy: [...declaredBy] })),
+        withheldDefinitions: [...input.withheldDefinitions],
+        routableWorkspaces: [...(input.routableWorkspaces ?? [])],
+        crossReferences: input.crossReferences.map((c) => ({ ...c })),
+        cautions: [...input.cautions],
+        ledger: PROJECT_FILES.ledger,
+        gatedByDefault: ["tool:bash"],
+    };
+}
+export function renderProjectSettings(input) {
+    return JSON.stringify(buildProjectSettings(input), null, 2) + "\n";
+}
+/** The capability that must always be live, or the generated file is inert (S-5). */
+export const ALWAYS_LIVE = DELEGATE_CAPABILITY;
+//# sourceMappingURL=grant-env.js.map

package/dist/kernel/grant-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-env.js","sourceRoot":"","sources":["../../src/kernel/grant-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAmB,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,sBAAsB,CAAC,CAAC;CACvG,CAAC;AAEF,0DAA0D;AAC1D,MAAM,UAAU,eAAe,CAAC,UAAsB;IACpD,0GAA0G;IAC1G,2GAA2G;IAC3G,kGAAkG;IAClG,yGAAyG;IACzG,yBAAyB;IACzB,IAAI,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,KAAmB;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,8FAA8F;YAC5F,kBAAkB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,yEAAyE;YAChH,mGAAmG;YACnG,mDAAmD,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AA+DD,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACvD,OAAO;QACL,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,eAAe;QAC1B,MAAM,EACJ,oGAAoG;YACpG,2GAA2G;YAC3G,oGAAoG;QACtG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;QACtB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACxB,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW;YACzB,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;QACnF,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACnD,kBAAkB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACzD,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,cAAc,EAAE,CAAC,WAAW,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACrE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAe,mBAAmB,CAAC"}

package/dist/kernel/ledger-identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-identifiers.d.ts","sourceRoot":"","sources":["../../src/kernel/ledger-identifiers.ts"],"names":[],"mappings":"AAKA,2GAA2G;AAC3G,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEzE;AAED,8FAA8F;AAC9F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7E;AAED,0GAA0G;AAC1G,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAI5E"}

package/dist/kernel/ledger-identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-identifiers.js","sourceRoot":"","sources":["../../src/kernel/ledger-identifiers.ts"],"names":[],"mappings":"AAAA,MAAM,kBAAkB,GAAG,0CAA0C,CAAC;AACtE,MAAM,sBAAsB,GAAG,0CAA0C,CAAC;AAC1E,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAClE,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAU,CAAC;AAEzF,2GAA2G;AAC3G,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC"}

package/dist/kernel/model-preflight.d.ts

@@ -0,0 +1,13 @@
+import { type StructuredRefusal } from "./refusals.ts";
+export { ENV_ALLOW_UNRESOLVED_MODELS } from "./env-names.ts";
+/** Pi's resolved catalogue carries provider support in thinkingLevelMap. Never silently clamp a user's choice. */
+export declare function supportedModelEfforts(model: {
+    reasoning: boolean;
+    thinkingLevelMap?: Partial<Record<string, string | null>>;
+}): ("off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max")[];
+export interface ModelCatalogue {
+    find(provider: string, modelId: string): unknown;
+}
+/** Resolve an explicit provider/id against pi's own session catalogue without probing credentials or network. */
+export declare function preflightModel(model: string | undefined, catalogue: ModelCatalogue, cache: Map<string, boolean>, allowUnresolved: boolean): StructuredRefusal | undefined;
+//# sourceMappingURL=model-preflight.d.ts.map

package/dist/kernel/model-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-preflight.d.ts","sourceRoot":"","sources":["../../src/kernel/model-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,kHAAkH;AAClH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;CAC3D,GAAG,CAAC,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC,EAAE,CAMtE;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;CAClD;AAED,iHAAiH;AACjH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,SAAS,EAAE,cAAc,EACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3B,eAAe,EAAE,OAAO,GACvB,iBAAiB,GAAG,SAAS,CAiB/B"}

package/dist/kernel/model-preflight.js

@@ -0,0 +1,30 @@
+import { refusal } from "./refusals.js";
+import { ENV_ALLOW_UNRESOLVED_MODELS } from "./env-names.js";
+export { ENV_ALLOW_UNRESOLVED_MODELS } from "./env-names.js";
+/** Pi's resolved catalogue carries provider support in thinkingLevelMap. Never silently clamp a user's choice. */
+export function supportedModelEfforts(model) {
+    if (!model.reasoning)
+        return ["off"];
+    return ["off", "minimal", "low", "medium", "high", "xhigh", "max"].filter((level) => {
+        const mapped = model.thinkingLevelMap?.[level];
+        return mapped !== null && ((level !== "xhigh" && level !== "max") || mapped !== undefined);
+    });
+}
+/** Resolve an explicit provider/id against pi's own session catalogue without probing credentials or network. */
+export function preflightModel(model, catalogue, cache, allowUnresolved) {
+    if (model === undefined || allowUnresolved)
+        return undefined;
+    const slash = model.indexOf("/");
+    const provider = slash > 0 ? model.slice(0, slash) : "";
+    const id = slash > 0 ? model.slice(slash + 1) : "";
+    let resolved = cache.get(model);
+    if (resolved === undefined) {
+        resolved = provider.length > 0 && id.length > 0 && catalogue.find(provider, id) !== undefined;
+        cache.set(model, resolved);
+    }
+    if (resolved)
+        return undefined;
+    return refusal("MODEL_UNRESOLVED", `grants: model ${model || "(empty)"} is not in pi's session catalogue; use provider/id from /model, ` +
+        `or set ${ENV_ALLOW_UNRESOLVED_MODELS}=1 to let pi attempt custom resolution`, { model: model || "(empty)" });
+}
+//# sourceMappingURL=model-preflight.js.map

package/dist/kernel/model-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-preflight.js","sourceRoot":"","sources":["../../src/kernel/model-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAA0B,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,kHAAkH;AAClH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,OAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7F,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;AACL,CAAC;AAMD,iHAAiH;AACjH,MAAM,UAAU,cAAc,CAC5B,KAAyB,EACzB,SAAyB,EACzB,KAA2B,EAC3B,eAAwB;IAExB,IAAI,KAAK,KAAK,SAAS,IAAI,eAAe;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC;QAC9F,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CACZ,kBAAkB,EAClB,iBAAiB,KAAK,IAAI,SAAS,kEAAkE;QACnG,UAAU,2BAA2B,wCAAwC,EAC/E,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,CAC9B,CAAC;AACJ,CAAC"}

package/dist/kernel/pi-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-tools.d.ts","sourceRoot":"","sources":["../../src/kernel/pi-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,EAAE,UAAqB,CAAC;AAE7C,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,2FAUnB,CAAC"}

package/dist/kernel/pi-tools.js

@@ -0,0 +1,29 @@
+/**
+ * Facts about pi itself: its built-in tool names, and the capability that means "all of them".
+ *
+ * These lived in `agent-types.ts` until ADR-0016 deleted that module along with the rest of the
+ * `@tintinweb/pi-subagents` port. They are not about agent types at all — `PI_BUILTIN_TOOLS` is how the
+ * catalog tells a built-in from an extension tool, and `WILDCARD` is a capability id — so they outlive
+ * the port and belong somewhere that does not name a package we no longer depend on.
+ *
+ * **`PI_BUILTIN_TOOLS` is a pinned observation, and it has already drifted once** (R-31): pi 0.84.1
+ * exposes a `parallel` tool that the 0.83.0 list did not contain, which made it classify as an
+ * *extension* capability. The list is used for classification only — never for enforcement, which is
+ * `--tools`' job — so drift misfiles a capability rather than granting one. Keep it current anyway; a
+ * misfiled capability is a confusing catalog.
+ */
+/** Capability held only by a delegator authorised to hand out everything. */
+export const WILDCARD = "tool:*";
+/** pi's built-in tools, observed against 0.84.1. `parallel` was added since 0.83.0 — see R-31. */
+export const PI_BUILTIN_TOOLS = [
+    "bash",
+    "edit",
+    "edit-diff",
+    "find",
+    "grep",
+    "ls",
+    "parallel",
+    "read",
+    "write",
+];
+//# sourceMappingURL=pi-tools.js.map

package/dist/kernel/pi-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-tools.js","sourceRoot":"","sources":["../../src/kernel/pi-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAe,QAAQ,CAAC;AAE7C,kGAAkG;AAClG,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM;IACN,MAAM;IACN,WAAW;IACX,MAAM;IACN,MAAM;IACN,IAAI;IACJ,UAAU;IACV,MAAM;IACN,OAAO;CACC,CAAC"}

package/dist/kernel/progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../src/kernel/progress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,+GAA+G;AAC/G,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,MAAM,CAAC;AAQlC,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEzE;;;;;;;;GAQG;AACH,MAAM,WAAW,IAAI;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wEAAwE;IACxE,IAAI,EAAE,OAAO,CAAC;CACf;AAED,eAAO,MAAM,SAAS,EAAE,IAAiC,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;CACZ;AAaD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAsB1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAEjD;AAmBD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,OAAO,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmBhH;AAED,gHAAgH;AAChH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,CA0BpG"}

package/dist/kernel/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","sourceRoot":"","sources":["../../src/kernel/progress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,gGAAgG;AAChG,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,CAAC,MAAM,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,OAAO,IAAI,CAAC,MAAM,GAAG,cAAc,SAAS,CAAC;AACtF,CAAC;AAmBD,MAAM,CAAC,MAAM,SAAS,GAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAe1D;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU,EAAE,KAAa;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAE9B,2EAA2E;IAC3E,EAAE;IACF,yGAAyG;IACzG,2GAA2G;IAC3G,2FAA2F;IAC3F,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;SAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAe;IACzC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC;AAED,2GAA2G;AAC3G,SAAS,OAAO,CAAC,KAAoB,EAAE,GAAW;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;IACzF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAyB,EAAE,YAAiC,EAAE,GAAW;IACtG,MAAM,KAAK,GAAG,YAAY,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,MAAM,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAEpG,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,4GAA4G;QAC5G,oFAAoF;QACpF,4GAA4G;QAC5G,qFAAqF;QACrF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,gHAAgH;AAChH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,EAAc,EAAE,UAAkB;IACzD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAiC,CAAC;IAEtC,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,EAAE;QACzB,IAAI,GAAG,EAAE,CAAC;QACV,KAAK,GAAG,SAAS,CAAC;QAClB,EAAE,EAAE,CAAC;IACP,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE;YACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9C,sGAAsG;YACtG,2EAA2E;YAC3E,IAAI,KAAK;gBAAE,OAAO;YAClB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,EAAW,CAAC;QAC1F,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,KAAK,GAAG,SAAS,CAAC;YAClB,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAClB,EAAE,EAAE,CAAC;QACP,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/kernel/project-paths.d.ts

@@ -0,0 +1,43 @@
+/** pi's own per-project directory. Ours is a subdirectory of it. */
+export declare const PI_PROJECT_DIR = ".pi";
+export declare const PROJECT_STATE_DIRNAME = "pi-daddy";
+export declare function piProjectDir(cwd: string): string;
+/** `<cwd>/.pi/pi-daddy` — every project-scoped file this package writes. */
+export declare function projectStateDir(cwd: string): string;
+export declare const PROJECT_FILES: Readonly<{
+    settings: "settings.json";
+    gitignore: ".gitignore";
+    ledger: "grants.jsonl";
+    activityTimeline: "activity.jsonl";
+}>;
+export declare const projectSettingsPath: (cwd: string) => string;
+export declare const projectGitignorePath: (cwd: string) => string;
+export declare const projectLedgerPath: (cwd: string) => string;
+export declare const activityTimelinePath: (cwd: string) => string;
+/** The `.gitignore` init writes inside the project state directory: settings is committable, nothing else is. */
+export declare const PROJECT_GITIGNORE_CONTENT = "# Written by pi-daddy init. Only settings.json is meant to be committed; the rest is private runtime state.\n*\n!.gitignore\n!settings.json\n";
+/** Is this path inside pi's per-project directory of any project? The private controller journals refuse such paths. */
+export declare function isUnderPiProjectDir(path: string): boolean;
+/** `$PI_CODING_AGENT_DIR`, or pi's default `~/.pi/agent`. */
+export declare function agentDir(env?: NodeJS.ProcessEnv): string;
+/** `<agent dir>/pi-daddy` — every user-scoped file this package writes. */
+export declare function userStateDir(env?: NodeJS.ProcessEnv): string;
+export declare const USER_DIRS: Readonly<{
+    grants: "grants";
+    approvals: "approvals";
+    workspaceLeases: "workspace-leases";
+}>;
+/**
+ * `<slug>-<16 hex>.json`: the basename keeps the directory legible, the hash makes it unambiguous, since two
+ * checkouts can share a basename. 64 bits, not the 24 this once shipped with (R-41).
+ */
+export declare function projectFileName(cwd: string): string;
+export declare const grantStorePath: (cwd: string, env?: NodeJS.ProcessEnv) => string;
+export declare const approvalsPath: (cwd: string, env?: NodeJS.ProcessEnv) => string;
+export declare const workspaceLeasesDir: (env?: NodeJS.ProcessEnv) => string;
+/** Where the same stores lived before ADR-0076 PR 3c. Reported when found, never read (ADR-0020 precedent). */
+export declare const legacyUserGrantStorePath: (cwd: string, env?: NodeJS.ProcessEnv) => string;
+export declare const legacyUserApprovalsPath: (cwd: string, env?: NodeJS.ProcessEnv) => string;
+export declare const legacyProjectLedgerPath: (cwd: string) => string;
+export declare const legacyGrantEnvPath: (cwd: string) => string;
+//# sourceMappingURL=project-paths.d.ts.map

package/dist/kernel/project-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-paths.d.ts","sourceRoot":"","sources":["../../src/kernel/project-paths.ts"],"names":[],"mappings":"AAoBA,oEAAoE;AACpE,eAAO,MAAM,cAAc,QAAQ,CAAC;AACpC,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,eAAO,MAAM,aAAa;;;;;EAKxB,CAAC;AAEH,eAAO,MAAM,mBAAmB,GAAI,KAAK,MAAM,WAAuD,CAAC;AACvG,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAAwD,CAAC;AACzG,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,WAAqD,CAAC;AACnG,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAA+D,CAAC;AAEhH,iHAAiH;AACjH,eAAO,MAAM,yBAAyB,kJAIrC,CAAC;AAEF,wHAAwH;AACxH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,6DAA6D;AAC7D,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGrE;AAED,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAEzE;AAED,eAAO,MAAM,SAAS;;;;EAIpB,CAAC;AAEH;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAInD;AAED,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACF,CAAC;AAClE,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACE,CAAC;AACrE,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,CAAC,UAAU,WAAuD,CAAC;AAElH,+GAA+G;AAC/G,eAAO,MAAM,wBAAwB,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACxB,CAAC;AACtD,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,CAAC,UAAU,WACb,CAAC;AAChE,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,WAA4C,CAAC;AAChG,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,WAA0C,CAAC"}

package/dist/kernel/project-paths.js

@@ -0,0 +1,81 @@
+/**
+ * Every filesystem location this package owns, in one place (ADR-0076 PR 3c).
+ *
+ * Project state lives under `<cwd>/.pi/pi-daddy/`; user state under `<agent dir>/pi-daddy/`. Before this
+ * module there were eight project locations under `.pi/` and three user directories under the agent dir,
+ * each spelled at its call site. `test/project-paths.test.ts` forces the rule: no shipped module outside
+ * this one may spell `.pi`.
+ *
+ * `settings.json` is the one committable file in the project directory: `pi-daddy init` writes it as the
+ * reviewable record of what a project's ceiling is and why. Everything else there is private runtime state,
+ * and init writes a `.gitignore` beside it that says so.
+ *
+ * The user-level stores moved here without migration (operator decision, 2026-09-21, following ADR-0020):
+ * a session that finds the old location and not the new one reports the old path and asks for `/grants init`
+ * or a fresh approval, rather than copying authority from one place to another.
+ */
+import { homedir } from "node:os";
+import { basename, join, resolve } from "node:path";
+import { createHash } from "node:crypto";
+/** pi's own per-project directory. Ours is a subdirectory of it. */
+export const PI_PROJECT_DIR = ".pi";
+export const PROJECT_STATE_DIRNAME = "pi-daddy";
+export function piProjectDir(cwd) {
+    return join(resolve(cwd), PI_PROJECT_DIR);
+}
+/** `<cwd>/.pi/pi-daddy` — every project-scoped file this package writes. */
+export function projectStateDir(cwd) {
+    return join(piProjectDir(cwd), PROJECT_STATE_DIRNAME);
+}
+export const PROJECT_FILES = Object.freeze({
+    settings: "settings.json",
+    gitignore: ".gitignore",
+    ledger: "grants.jsonl",
+    activityTimeline: "activity.jsonl",
+});
+export const projectSettingsPath = (cwd) => join(projectStateDir(cwd), PROJECT_FILES.settings);
+export const projectGitignorePath = (cwd) => join(projectStateDir(cwd), PROJECT_FILES.gitignore);
+export const projectLedgerPath = (cwd) => join(projectStateDir(cwd), PROJECT_FILES.ledger);
+export const activityTimelinePath = (cwd) => join(projectStateDir(cwd), PROJECT_FILES.activityTimeline);
+/** The `.gitignore` init writes inside the project state directory: settings is committable, nothing else is. */
+export const PROJECT_GITIGNORE_CONTENT = `# Written by pi-daddy init. Only settings.json is meant to be committed; the rest is private runtime state.
+*
+!.gitignore
+!settings.json
+`;
+/** Is this path inside pi's per-project directory of any project? The private controller journals refuse such paths. */
+export function isUnderPiProjectDir(path) {
+    return path.split(/[\\/]/).includes(PI_PROJECT_DIR);
+}
+/** `$PI_CODING_AGENT_DIR`, or pi's default `~/.pi/agent`. */
+export function agentDir(env = process.env) {
+    const explicit = env.PI_CODING_AGENT_DIR?.trim();
+    return explicit ? explicit : join(homedir(), PI_PROJECT_DIR, "agent");
+}
+/** `<agent dir>/pi-daddy` — every user-scoped file this package writes. */
+export function userStateDir(env = process.env) {
+    return join(agentDir(env), PROJECT_STATE_DIRNAME);
+}
+export const USER_DIRS = Object.freeze({
+    grants: "grants",
+    approvals: "approvals",
+    workspaceLeases: "workspace-leases",
+});
+/**
+ * `<slug>-<16 hex>.json`: the basename keeps the directory legible, the hash makes it unambiguous, since two
+ * checkouts can share a basename. 64 bits, not the 24 this once shipped with (R-41).
+ */
+export function projectFileName(cwd) {
+    const slug = (basename(cwd) || "root").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
+    const hash = createHash("sha256").update(cwd, "utf8").digest("hex").slice(0, 16);
+    return `${slug}-${hash}.json`;
+}
+export const grantStorePath = (cwd, env) => join(userStateDir(env), USER_DIRS.grants, projectFileName(cwd));
+export const approvalsPath = (cwd, env) => join(userStateDir(env), USER_DIRS.approvals, projectFileName(cwd));
+export const workspaceLeasesDir = (env) => join(userStateDir(env), USER_DIRS.workspaceLeases);
+/** Where the same stores lived before ADR-0076 PR 3c. Reported when found, never read (ADR-0020 precedent). */
+export const legacyUserGrantStorePath = (cwd, env) => join(agentDir(env), "grants", projectFileName(cwd));
+export const legacyUserApprovalsPath = (cwd, env) => join(agentDir(env), "grants-approvals", projectFileName(cwd));
+export const legacyProjectLedgerPath = (cwd) => join(piProjectDir(cwd), "grants.jsonl");
+export const legacyGrantEnvPath = (cwd) => join(piProjectDir(cwd), "grants.env");
+//# sourceMappingURL=project-paths.js.map

package/dist/kernel/project-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-paths.js","sourceRoot":"","sources":["../../src/kernel/project-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,YAAY;IACvB,MAAM,EAAE,cAAc;IACtB,gBAAgB,EAAE,gBAAgB;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;AACvG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;AACzG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;AAEhH,iHAAiH;AACjH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;CAIxC,CAAC;AAEF,wHAAwH;AACxH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,QAAQ,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,eAAe,EAAE,kBAAkB;CACpC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CACrE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CACpE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,eAAe,CAAC,CAAC;AAElH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,GAAuB,EAAE,EAAE,CAC9E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,kBAAkB,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC"}