pi-daddy 0.28.0 → 0.32.1

package/dist/governance/ledger.js

@@ -0,0 +1,201 @@
+/**
+ * Append-only grant ledger.
+ *
+ * Exists because pi-fabric's persisted execution trace records `args: {}` — it captures *that* a child
+ * ran, not *what it was authorised to do* (probe `pi-fabric-eval` probe 5). Without this record
+ * you cannot answer "what was this sub-agent permitted to do?" after the fact, which is the whole
+ * point of a governance layer.
+ *
+ * `denied` is the field that earns the file: an agent repeatedly requesting capabilities it does not
+ * hold is an escalation attempt, and it is invisible without a record.
+ *
+ * PRIVACY: capability ids, counts, and identifiers only. Never prompts, tool arguments, or results.
+ *
+ * ADR-0018 makes the boundary explicit rather than leaving it to be inferred, because a record now carries
+ * something about the child's instructions. **`definitionDigest` is an identifier**: a SHA-256 of an
+ * operator-authored file already committed to a repository, which names a version without reproducing it.
+ * **The task is not recorded, anywhere, ever** — it is assembled by the model from the parent's context and
+ * can carry anything the parent could see, so a ledger holding it would be a secrets sink. That half of
+ * "what was this child told to do?" is out of the ledger by decision, not by omission.
+ */
+import { readFile } from "node:fs/promises";
+import { DELEGATE_SUBJECT } from "../kernel/approval.js";
+import { assertExecutionId } from "../kernel/execution-id.js";
+import { assertLedgerV3Wire } from "./ledger-v3-validation.js";
+export const LEDGER_VERSION = 3;
+export const LEDGER_EVENT_KINDS = ["capability_decision", "workspace_lease", "child_lifecycle"];
+export const LEDGER_GATE_OUTCOMES = ["declined", "dismissed", "no-ui", "error"];
+export function buildRecord(args) {
+    if (args.taskDigest !== undefined) {
+        if (!/^[a-f0-9]{64}$/i.test(args.taskDigest))
+            throw new TypeError("taskDigest must be a SHA-256 hex digest");
+        assertExecutionId(args.executionId);
+        if (args.parentExecutionId !== null)
+            assertExecutionId(args.parentExecutionId, "parentExecutionId");
+        if (args.parentExecutionId === args.executionId)
+            throw new TypeError("an execution cannot be its own parent");
+        if (args.taskFromExecutionId !== undefined)
+            assertExecutionId(args.taskFromExecutionId, "taskFromExecutionId");
+    }
+    if (args.definitionDigest && !/^[a-f0-9]{64}$/i.test(args.definitionDigest.sha256)) {
+        throw new TypeError("definitionDigest.sha256 must be a SHA-256 hex digest");
+    }
+    // R-46: the scalar is a SUMMARY, emitted only when it cannot mislead. `buildRecord` derives it rather
+    // than accepting it, so a call site cannot supply one that disagrees with the map beside it.
+    const sources = args.approvalSources ?? {};
+    const distinct = [...new Set(Object.values(sources))];
+    const scopes = args.approvalScopes ?? {};
+    const distinctScopes = [...new Set(Object.values(scopes))];
+    const record = {
+        // A trusted task digest is what distinguishes a v3 capability event from the legacy construction API.
+        // Production delegation always supplies it; old TypeScript callers remain able to append legacy lines.
+        ...(args.taskDigest !== undefined
+            ? {
+                ledgerVersion: LEDGER_VERSION,
+                event: "capability_decision",
+                executionId: args.executionId,
+                parentExecutionId: args.parentExecutionId,
+            }
+            : {}),
+        ts: args.now.toISOString(),
+        parentId: args.parentId,
+        childId: args.childId,
+        depth: args.depth,
+        agentType: args.agentType,
+        executor: args.executor,
+        ...(args.taskFrom ? { taskFrom: args.taskFrom } : {}),
+        ...(args.taskFromExecutionId ? { taskFromExecutionId: args.taskFromExecutionId } : {}),
+        ...(args.taskDigest !== undefined ? { taskDigest: args.taskDigest } : {}),
+        ...(args.correlation ? { correlation: structuredClone(args.correlation) } : {}),
+        ...(args.refusal ? { refusal: structuredClone(args.refusal) } : {}),
+        requested: args.requested,
+        parentGrant: args.parentGrant,
+        effective: args.result.effective,
+        denied: args.result.denied,
+        clipped: args.result.clipped,
+        gatedBlocked: args.result.gatedBlocked,
+        blocked: args.blocked,
+        reason: args.reason,
+        ...(args.approved && args.approved.length > 0 ? { approved: args.approved } : {}),
+        ...(distinct.length === 1 ? { approvalSource: distinct[0] } : {}),
+        ...(Object.keys(sources).length > 0 ? { approvalSources: sources } : {}),
+        ...(distinctScopes.length === 1 ? { approvalScope: distinctScopes[0] } : {}),
+        ...(Object.keys(scopes).length > 0 ? { approvalScopes: scopes } : {}),
+        ...(args.approvalExpiresAt && Object.keys(args.approvalExpiresAt).length > 0
+            ? { approvalExpiresAt: args.approvalExpiresAt }
+            : {}),
+        ...(args.approvalUses && Object.keys(args.approvalUses).length > 0 ? { approvalUses: args.approvalUses } : {}),
+        ...(args.humanDenied ? { humanDenied: true } : {}),
+        // Written whenever a gate was reached and not satisfied by a yes. `granted` is omitted deliberately —
+        // an approved spawn already says so through `approvalSources`, and a field that appears on every record
+        // stops being a signal.
+        ...(args.gateOutcome && args.gateOutcome !== "granted" ? { gateOutcome: args.gateOutcome } : {}),
+        ...(args.definitionDigest ? { definitionDigest: args.definitionDigest } : {}),
+    };
+    if (args.taskDigest !== undefined)
+        assertLedgerV3Wire(record);
+    return record;
+}
+// R-49: the lock moved to `src/governance/file-lock.ts` so the approvals store could use the SAME one rather than
+// grow a second copy. Re-exported because `./ledger` is a published subpath and these were part of it.
+export { LOCK_TIMEOUT_MS, STALE_LOCK_MS } from "./file-lock.js";
+// The reading half, split out under the file-size guard and re-exported so `./ledger` is unchanged for
+// anyone importing it. See `ledger-report.ts` for why the seam is where it is.
+export { verifyLedger } from "./ledger-report.js";
+/**
+ * Serialise appends across processes.
+ *
+ * **Why the ledger needs it.** For most of this package's life cardinality was bounded to one by `delegate`
+ * being blocking, so there was never a second writer. Fan-out removes that: `ENV_LEDGER` propagates to
+ * children, so a subtree can have many processes appending to one file.
+ *
+ * A ledger write that cannot take the lock **fails the delegation closed** — see `appendRecord`'s `strict`
+ * — because a child running with granted capabilities and no audit line is what the ledger exists to
+ * prevent. That is the opposite of what the approvals store does with the same lock, and deliberately so.
+ */
+/** The envelope kind for a governance event. Every LedgerEventKind maps; an unknown event shape is a `fact`. */
+export function recordKindForEvent(event) {
+    switch (event.event) {
+        case "capability_decision":
+            return "capability";
+        case "child_lifecycle":
+            return "lifecycle";
+        case "workspace_lease":
+            return "lease";
+        case "check_receipt": // retired kind, still imported from pre-format ledgers
+            return "check";
+        case "workflow_fact": // retired kind, still imported from pre-format ledgers
+            return "fact";
+        default:
+            return "capability"; // legacy unversioned GrantRecord values are capability decisions
+    }
+}
+export async function appendLedgerEvent(options, event) {
+    // Serialise first: a value JSON cannot represent is a caller TypeError before any filesystem effect, exactly
+    // as the pre-envelope writer behaved (a directory or lock must not appear for an event that cannot be written).
+    JSON.stringify(event);
+    try {
+        // ADR-0076 PR 3d: every event rides in the shared record envelope; the event stays the body unchanged.
+        // The envelope `at` is the writer's clock; the body keeps its own `ts`. An event with a malformed `ts` is a
+        // corrupt BODY the report names, not a damaged envelope that stops the read.
+        await appendEnvelopeRecord(options.path, recordKindForEvent(event), event);
+    }
+    catch (error) {
+        if (options.strict ?? true) {
+            // A damaged ledger is a refusal with a stable code, not a generic write failure (operator decision).
+            if (error instanceof GovernanceRefusal)
+                throw error;
+            throw new Error(`grant ledger write failed (failing closed): ${String(error)}`);
+        }
+        // A non-strict append is a deliberate choice not to fail closed. It is NOT a choice to be silent:
+        // a silent safe-mode is as confusing as a silent unsafe one, so the caller is always told.
+        options.onFailure?.(error);
+    }
+}
+export async function appendRecord(options, record) {
+    return appendLedgerEvent(options, record);
+}
+/** True when this record shows an agent asking for more than it holds. */
+export function isEscalationAttempt(record) {
+    return record.denied.length > 0;
+}
+export { CHILD_LIFECYCLE_STATES, CHILD_PROCESS_SIGNALS, WORKSPACE_ACCESSES, WORKSPACE_LEASE_OUTCOMES, WORKSPACE_RECOVERY_VALUES, buildChildLifecycleEvent, buildWorkspaceLeaseEvent, } from "./ledger-events.js";
+import { appendRecord as appendEnvelopeRecord } from "./record.js";
+import { GovernanceRefusal } from "../kernel/refusals.js";
+/**
+ * One-time import of a pre-format ledger (`.pi/grants.jsonl` written before ADR-0076 PR 3d) into a record
+ * envelope file. Each intact line becomes one record with an `imported` marker naming the source and line;
+ * the source is never modified. Import stops at the first unparsable source line and reports it, so a torn
+ * legacy tail is visible rather than silently dropped. Returns what happened; a target that already exists
+ * is left alone (`skipped: "target-exists"`).
+ */
+export async function importLegacyLedger(sourcePath, targetPath) {
+    const { existsSync } = await import("node:fs");
+    const { readFile } = await import("node:fs/promises");
+    if (existsSync(targetPath))
+        return { imported: 0, stoppedAt: null, skipped: "target-exists" };
+    if (!existsSync(sourcePath))
+        return { imported: 0, stoppedAt: null, skipped: "source-missing" };
+    const lines = (await readFile(sourcePath, "utf8")).split("\n");
+    let imported = 0;
+    for (const [index, raw] of lines.entries()) {
+        if (raw.trim().length === 0)
+            continue;
+        let event;
+        try {
+            const parsed = JSON.parse(raw);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("not an object");
+            event = parsed;
+        }
+        catch {
+            return { imported, stoppedAt: index + 1, skipped: null };
+        }
+        await appendEnvelopeRecord(targetPath, recordKindForEvent(event), event, {
+            imported: { path: sourcePath, line: index + 1 },
+        });
+        imported += 1;
+    }
+    return { imported, stoppedAt: null, skipped: null };
+}
+//# sourceMappingURL=ledger.js.map

package/dist/governance/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/governance/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAOzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAU,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,iBAAiB,CAAU,CAAC;AAEzG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AA4JzF,MAAM,UAAU,WAAW,CAAC,IAgC3B;IACC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC7G,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;YAAE,iBAAiB,CAAC,IAAI,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC9G,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS;YAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,IAAI,CAAC,gBAAgB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,sGAAsG;IACtG,6FAA6F;IAC7F,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAgB;QAC1B,sGAAsG;QACtG,uGAAuG;QACvG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,aAAa,EAAE,cAAc;gBAC7B,KAAK,EAAE,qBAA8B;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;aAC1C;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;QAChC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;QAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;QACtC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1E,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;YAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,sGAAsG;QACtG,wGAAwG;QACxG,wBAAwB;QACxB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;IACF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kHAAkH;AAClH,uGAAuG;AACvG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEhE,uGAAuG;AACvG,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAErE;;;;;;;;;;GAUG;AACH,gHAAgH;AAChH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,qBAAqB;YACxB,OAAO,YAAY,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,WAAW,CAAC;QACrB,KAAK,iBAAiB;YACpB,OAAO,OAAO,CAAC;QACjB,KAAK,eAAe,EAAE,uDAAuD;YAC3E,OAAO,OAAO,CAAC;QACjB,KAAK,eAAe,EAAE,uDAAuD;YAC3E,OAAO,MAAM,CAAC;QAChB;YACE,OAAO,YAAY,CAAC,CAAC,iEAAiE;IAC1F,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAsB,EACtB,KAAuC;IAEvC,6GAA6G;IAC7G,gHAAgH;IAChH,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,uGAAuG;QACvG,4GAA4G;QAC5G,6EAA6E;QAC7E,MAAM,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;YAC3B,qGAAqG;YACrG,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,KAAK,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,+CAA+C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,kGAAkG;QAClG,2FAA2F;QAC3F,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAsB,EAAE,MAAmB;IAC5E,OAAO,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GAUzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,IAAI,oBAAoB,EAAmB,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,UAAkB;IAElB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAC9F,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAChG,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACtC,IAAI,KAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACrG,KAAK,GAAG,MAAyC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE;YACvE,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;SAChD,CAAC,CAAC;QACH,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/governance/native-session.d.ts

@@ -0,0 +1,59 @@
+export { ENV_NATIVE_SESSION_ROOT } from "../kernel/env-names.ts";
+export declare const MAX_NATIVE_SESSION_BYTES: number;
+export type NativeSessionSource = "herdr-id" | "herdr-path" | "pi-session-file" | "pi-session-manager";
+export interface NativeSessionObservation {
+    source: NativeSessionSource | null;
+    status: "missing" | "verified" | "invalid" | "changed" | "truncated" | "unsupported";
+    sessionId: string | null;
+    sessionPath: string | null;
+    parentSessionPath: string | null;
+    branchLeafId: string | null;
+    branchState: "unknown" | "observed";
+    lastPersistedEntryId: string | null;
+    sha256: string | null;
+    reason: string | null;
+}
+export interface NativeSessionCapture {
+    observation: NativeSessionObservation;
+    bytes?: Buffer;
+    fileIdentity?: {
+        device: string;
+        inode: string;
+    };
+}
+/** Read-only methods of pi 0.84.2's public SessionManager; no runtime/session creation or model work. */
+export interface NativeSessionManager {
+    getSessionFile(): string | undefined;
+    getSessionId(): string;
+    getLeafId(): string | null;
+}
+export declare const missingNativeSession: () => NativeSessionObservation;
+/** Parse the retained native v3 bytes, never load/migrate/rewrite a session via SessionManager.open(). */
+export declare function parseNativeSessionBytes(bytes: Uint8Array, input: {
+    source: NativeSessionSource;
+    path: string;
+    expectedSessionId?: string;
+    truncated?: boolean;
+    liveLeaf?: {
+        sessionId: string;
+        leafId: string | null;
+    };
+}): NativeSessionCapture;
+/** Private allowlisted files only, bounded non-following descriptor reads, no scan of session/auth dirs. */
+export declare function readNativeSession(input: {
+    path: string;
+    source: NativeSessionSource;
+    expectedSessionId?: string;
+    allowedRoot?: string;
+    manager?: NativeSessionManager;
+    expectedFile?: {
+        device: string;
+        inode: string;
+    };
+}): Promise<NativeSessionCapture>;
+/** Herdr 0.8.2 protocol 20 AgentInfo.agent_session; never scrape terminal text, PID or names. */
+export declare function herdrSessionReference(value: unknown, expectedPane: string): {
+    source: "herdr-id" | "herdr-path";
+    value: string;
+} | null;
+//# sourceMappingURL=native-session.d.ts.map

package/dist/governance/native-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-session.d.ts","sourceRoot":"","sources":["../../src/governance/native-session.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,eAAO,MAAM,wBAAwB,QAAc,CAAC;AACpD,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,YAAY,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AACvG,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,CAAC;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,SAAS,GAAG,UAAU,CAAC;IACpC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AACD,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,wBAAwB,CAAC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD;AACD,yGAAyG;AACzG,MAAM,WAAW,oBAAoB;IACnC,cAAc,IAAI,MAAM,GAAG,SAAS,CAAC;IACrC,YAAY,IAAI,MAAM,CAAC;IACvB,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;CAC5B;AACD,eAAO,MAAM,oBAAoB,QAAO,wBAWtC,CAAC;AAQH,0GAA0G;AAC1G,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE;IACL,MAAM,EAAE,mBAAmB,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACzD,GACA,oBAAoB,CAiFtB;AAED,4GAA4G;AAC5G,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,mBAAmB,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,oBAAoB,CAAC;IAC/B,YAAY,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAClD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAiGhC;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,MAAM,GACnB;IAAE,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAO7D"}

package/dist/governance/native-session.js

@@ -0,0 +1,208 @@
+import { constants } from "node:fs";
+import { open, lstat, realpath } from "node:fs/promises";
+import { isAbsolute, relative, sep } from "node:path";
+import { createHash } from "node:crypto";
+import { parseRetentionJson } from "./retention-json.js";
+import { ENV_NATIVE_SESSION_ROOT } from "../kernel/env-names.js";
+export { ENV_NATIVE_SESSION_ROOT } from "../kernel/env-names.js";
+export const MAX_NATIVE_SESSION_BYTES = 1024 * 1024;
+export const missingNativeSession = () => ({
+    source: null,
+    status: "missing",
+    sessionId: null,
+    sessionPath: null,
+    parentSessionPath: null,
+    branchLeafId: null,
+    branchState: "unknown",
+    lastPersistedEntryId: null,
+    sha256: null,
+    reason: "native-session-unavailable",
+});
+const id = (x) => typeof x === "string" && /^[a-zA-Z0-9_-]{1,128}$/.test(x);
+const uuid = (x) => typeof x === "string" && /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(x);
+const obj = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
+const filePath = (x) => typeof x === "string" && x.length <= 4096 && isAbsolute(x) && !x.includes("\0");
+/** Parse the retained native v3 bytes, never load/migrate/rewrite a session via SessionManager.open(). */
+export function parseNativeSessionBytes(bytes, input) {
+    const observation = { ...missingNativeSession(), source: input.source, sessionPath: input.path };
+    const result = { observation };
+    const fail = (status, reason) => {
+        observation.status = status;
+        observation.reason = reason;
+        observation.branchLeafId = null;
+        observation.branchState = "unknown";
+        return result;
+    };
+    if (bytes.length > MAX_NATIVE_SESSION_BYTES)
+        return fail("truncated", "native-session-size-limit");
+    const raw = Buffer.from(bytes), newline = raw.indexOf(10);
+    let header;
+    try {
+        header = parseRetentionJson(new TextDecoder("utf-8", { fatal: true }).decode(raw.subarray(0, newline < 0 ? raw.length : newline)), MAX_NATIVE_SESSION_BYTES);
+    }
+    catch {
+        return fail("invalid", "native-session-header-invalid");
+    }
+    if (!obj(header) ||
+        header.type !== "session" ||
+        header.version !== 3 ||
+        !uuid(header.id) ||
+        !filePath(header.cwd) ||
+        typeof header.timestamp !== "string" ||
+        !Number.isFinite(Date.parse(header.timestamp)) ||
+        (header.parentSession !== undefined && !filePath(header.parentSession)))
+        return fail("invalid", "native-session-header-invalid");
+    if (input.expectedSessionId !== undefined && header.id !== input.expectedSessionId)
+        return fail("changed", "native-session-id-changed");
+    // Only validated session headers admit transcript bytes; arbitrary files are never archived here.
+    result.bytes = Buffer.from(bytes);
+    observation.sessionId = header.id;
+    observation.parentSessionPath = header.parentSession ?? null;
+    observation.sha256 = createHash("sha256").update(bytes).digest("hex");
+    if (input.truncated || raw.at(-1) !== 10)
+        return fail("truncated", "native-session-incomplete-bytes");
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(raw);
+    }
+    catch {
+        return fail("invalid", "native-session-utf8-invalid");
+    }
+    const lines = text.split("\n");
+    const ids = new Set();
+    if (lines.length > 10002)
+        return fail("invalid", "native-session-entry-limit");
+    for (const line of lines.slice(1, -1)) {
+        let entry;
+        try {
+            entry = parseRetentionJson(line, MAX_NATIVE_SESSION_BYTES);
+        }
+        catch {
+            return fail("invalid", "native-session-entry-invalid");
+        }
+        if (!obj(entry) ||
+            typeof entry.type !== "string" ||
+            entry.type === "session" ||
+            !id(entry.id) ||
+            ids.has(entry.id) ||
+            !(entry.parentId === null || (id(entry.parentId) && ids.has(entry.parentId))) ||
+            typeof entry.timestamp !== "string" ||
+            !Number.isFinite(Date.parse(entry.timestamp)))
+            return fail("invalid", "native-session-parent-link-invalid");
+        ids.add(entry.id);
+        observation.lastPersistedEntryId = entry.id;
+    }
+    if (input.liveLeaf) {
+        if (input.liveLeaf.sessionId !== header.id || (input.liveLeaf.leafId !== null && !ids.has(input.liveLeaf.leafId))) {
+            return fail("changed", "native-session-live-leaf-mismatch");
+        }
+        observation.branchLeafId = input.liveLeaf.leafId;
+        observation.branchState = "observed";
+    }
+    observation.status = "verified";
+    observation.reason = observation.branchState === "unknown" ? "active-branch-unknown" : null;
+    return result;
+}
+/** Private allowlisted files only, bounded non-following descriptor reads, no scan of session/auth dirs. */
+export async function readNativeSession(input) {
+    const gap = (status, reason) => ({
+        observation: {
+            ...missingNativeSession(),
+            source: input.source,
+            status,
+            reason,
+            sessionPath: filePath(input.path) ? input.path : null,
+        },
+    });
+    const root = input.allowedRoot ?? process.env[ENV_NATIVE_SESSION_ROOT];
+    if (!filePath(input.path) || !input.path.endsWith(".jsonl") || !root || !filePath(root))
+        return gap("unsupported", "native-session-private-root-required");
+    const within = (base, candidate) => {
+        const p = relative(base, candidate);
+        return p !== "" && p !== ".." && !p.startsWith(`..${sep}`) && !isAbsolute(p);
+    };
+    if (!within(root, input.path))
+        return gap("unsupported", "native-session-outside-private-root");
+    let handle;
+    try {
+        const canonicalRoot = await realpath(root), canonicalFile = await realpath(input.path);
+        const rootStat = await lstat(canonicalRoot);
+        if (!rootStat.isDirectory() ||
+            (rootStat.mode & 0o077) !== 0 ||
+            (typeof process.getuid === "function" && rootStat.uid !== process.getuid()))
+            return gap("unsupported", "native-session-root-not-private");
+        if (!within(canonicalRoot, canonicalFile) || (await lstat(input.path)).isSymbolicLink())
+            return gap("unsupported", "native-session-path-alias");
+        handle = await open(input.path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const before = await handle.stat();
+        if (!before.isFile() ||
+            before.nlink !== 1 ||
+            (typeof process.getuid === "function" && before.uid !== process.getuid())) {
+            return gap("unsupported", "native-session-not-private-regular-file");
+        }
+        const fileIdentity = { device: String(before.dev), inode: String(before.ino) };
+        if (input.expectedFile &&
+            (input.expectedFile.device !== fileIdentity.device || input.expectedFile.inode !== fileIdentity.inode))
+            return gap("changed", "native-session-file-replaced");
+        const live = input.manager
+            ? {
+                sessionId: input.manager.getSessionId(),
+                leafId: input.manager.getLeafId(),
+                path: input.manager.getSessionFile(),
+            }
+            : undefined;
+        if (live && live.path !== input.path)
+            return gap("changed", "native-session-manager-path-changed");
+        const bytes = Buffer.alloc(Math.min(before.size, MAX_NATIVE_SESSION_BYTES));
+        let offset = 0;
+        while (offset < bytes.length) {
+            const read = await handle.read(bytes, offset, bytes.length - offset, offset);
+            if (!read.bytesRead)
+                break;
+            offset += read.bytesRead;
+        }
+        const after = await handle.stat(), location = await lstat(input.path);
+        if (before.dev !== location.dev ||
+            before.ino !== location.ino ||
+            before.size !== after.size ||
+            before.mtimeMs !== after.mtimeMs ||
+            before.ctimeMs !== after.ctimeMs ||
+            location.isSymbolicLink() ||
+            after.size !== location.size)
+            return gap("changed", "native-session-file-changed");
+        if (live &&
+            (input.manager.getSessionId() !== live.sessionId ||
+                input.manager.getLeafId() !== live.leafId ||
+                input.manager.getSessionFile() !== live.path)) {
+            return gap("changed", "native-session-live-state-changed");
+        }
+        return {
+            ...parseNativeSessionBytes(bytes.subarray(0, offset), {
+                ...input,
+                liveLeaf: live,
+                truncated: before.size > MAX_NATIVE_SESSION_BYTES || offset !== before.size,
+            }),
+            fileIdentity,
+        };
+    }
+    catch (error) {
+        return gap(error.code === "ENOENT" ? "missing" : "invalid", "native-session-read-failed");
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+/** Herdr 0.8.2 protocol 20 AgentInfo.agent_session; never scrape terminal text, PID or names. */
+export function herdrSessionReference(value, expectedPane) {
+    if (!obj(value) || value.pane_id !== expectedPane || value.agent !== "pi" || !obj(value.agent_session))
+        return null;
+    const s = value.agent_session;
+    if (s.agent !== "pi" || typeof s.source !== "string" || s.source.length > 128)
+        return null;
+    if (s.kind === "id" && uuid(s.value))
+        return { source: "herdr-id", value: s.value };
+    if (s.kind === "path" && filePath(s.value))
+        return { source: "herdr-path", value: s.value };
+    return null;
+}
+//# sourceMappingURL=native-session.js.map

package/dist/governance/native-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-session.js","sourceRoot":"","sources":["../../src/governance/native-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,IAAI,CAAC;AAyBpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAA6B,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,IAAI;IACvB,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,SAAS;IACtB,oBAAoB,EAAE,IAAI;IAC1B,MAAM,EAAE,IAAI;IACZ,MAAM,EAAE,4BAA4B;CACrC,CAAC,CAAC;AACH,MAAM,EAAE,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClG,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CACvC,OAAO,CAAC,KAAK,QAAQ,IAAI,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAC3C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAElF,0GAA0G;AAC1G,MAAM,UAAU,uBAAuB,CACrC,KAAiB,EACjB,KAMC;IAED,MAAM,WAAW,GAAG,EAAE,GAAG,oBAAoB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACjG,MAAM,MAAM,GAAyB,EAAE,WAAW,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,MAA0C,EAAE,MAAc,EAAE,EAAE;QAC1E,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;QAC5B,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;QAC5B,WAAW,CAAC,YAAY,GAAG,IAAI,CAAC;QAChC,WAAW,CAAC,WAAW,GAAG,SAAS,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB;QAAE,OAAO,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAC5B,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CACzB,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EACrG,wBAAwB,CACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC1D,CAAC;IACD,IACE,CAAC,GAAG,CAAC,MAAM,CAAC;QACZ,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,MAAM,CAAC,OAAO,KAAK,CAAC;QACpB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACrB,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,iBAAiB;QAChF,OAAO,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACtD,kGAAkG;IAClG,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,WAAW,CAAC,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC;IAClC,WAAW,CAAC,iBAAiB,GAAI,MAAM,CAAC,aAAoC,IAAI,IAAI,CAAC;IACrF,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;IACtG,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACzD,CAAC;QACD,IACE,CAAC,GAAG,CAAC,KAAK,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,KAAK,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE7C,OAAO,IAAI,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,WAAW,CAAC,oBAAoB,GAAG,KAAK,CAAC,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClH,OAAO,IAAI,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAC9D,CAAC;QACD,WAAW,CAAC,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjD,WAAW,CAAC,WAAW,GAAG,UAAU,CAAC;IACvC,CAAC;IACD,WAAW,CAAC,MAAM,GAAG,UAAU,CAAC;IAChC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAOvC;IACC,MAAM,GAAG,GAAG,CAAC,MAA0C,EAAE,MAAc,EAAwB,EAAE,CAAC,CAAC;QACjG,WAAW,EAAE;YACX,GAAG,oBAAoB,EAAE;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM;YACN,MAAM;YACN,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;SACtD;KACF,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrF,OAAO,GAAG,CAAC,aAAa,EAAE,sCAAsC,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,EAAE;QACjD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACpC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC,aAAa,EAAE,qCAAqC,CAAC,CAAC;IAChG,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,EACxC,aAAa,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC5C,IACE,CAAC,QAAQ,CAAC,WAAW,EAAE;YACvB,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAC7B,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YAE3E,OAAO,GAAG,CAAC,aAAa,EAAE,iCAAiC,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE;YACrF,OAAO,GAAG,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC;QACzD,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,MAAM,CAAC,KAAK,KAAK,CAAC;YAClB,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,EACzE,CAAC;YACD,OAAO,GAAG,CAAC,aAAa,EAAE,yCAAyC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,IACE,KAAK,CAAC,YAAY;YAClB,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,KAAK,KAAK,YAAY,CAAC,KAAK,CAAC;YAEtG,OAAO,GAAG,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO;YACxB,CAAC,CAAC;gBACE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;gBACvC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;gBACjC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE;aACrC;YACH,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM;YAC3B,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAC/B,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IACE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;YAC3B,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;YAC3B,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;YAChC,QAAQ,CAAC,cAAc,EAAE;YACzB,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAE5B,OAAO,GAAG,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QACvD,IACE,IAAI;YACJ,CAAC,KAAK,CAAC,OAAQ,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,SAAS;gBAC/C,KAAK,CAAC,OAAQ,CAAC,SAAS,EAAE,KAAK,IAAI,CAAC,MAAM;gBAC1C,KAAK,CAAC,OAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAChD,CAAC;YACD,OAAO,GAAG,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO;YACL,GAAG,uBAAuB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE;gBACpD,GAAG,KAAK;gBACR,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,MAAM,CAAC,IAAI,GAAG,wBAAwB,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI;aAC5E,CAAC;YACF,YAAY;SACb,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CACP,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAC1E,4BAA4B,CAC7B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,YAAoB;IAEpB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,YAAY,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpH,MAAM,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;IAC9B,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACpF,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/governance/record.d.ts

@@ -0,0 +1,65 @@
+export declare const RECORD_FORMAT: 1;
+export declare const RECORD_KINDS: readonly ["binding", "capability", "lifecycle", "approval", "lease", "check", "fact", "work", "control", "experiment", "activity", "advice"];
+export type RecordKind = (typeof RECORD_KINDS)[number];
+export declare const LEDGER_DAMAGED: "LEDGER_DAMAGED";
+export interface RecordEnvelope<B = unknown> {
+    v: typeof RECORD_FORMAT;
+    seq: number;
+    prev: string | null;
+    at: string;
+    kind: RecordKind;
+    id: string;
+    body: B;
+    /** Present when the record was copied from a pre-format store; the original is left untouched. */
+    imported?: {
+        path: string;
+        line: number;
+    };
+    digest: string;
+}
+export interface RecordDamage {
+    line: number;
+    reason: string;
+}
+export interface ReadRecords<B = unknown> {
+    records: RecordEnvelope<B>[];
+    damage: RecordDamage | null;
+}
+/** Deterministic JSON: sorted object keys at every level, arrays in order. No `undefined` survives. */
+export declare function canonicalJson(value: unknown): string;
+export declare function recordDigest(record: object): string;
+/** Damage reasons that mean "this is not a record file at all" rather than "a record file with a torn tail". */
+export declare const PRE_FORMAT_REASONS: ReadonlySet<string>;
+/** Read every intact record before the first damaged line. Never throws on content; damage is data. */
+export declare function readRecords<B = unknown>(text: string): ReadRecords<B>;
+export declare function readRecordsFile<B = unknown>(path: string): Promise<ReadRecords<B>>;
+export interface AppendOptions {
+    id?: string;
+    at?: string;
+    imported?: {
+        path: string;
+        line: number;
+    };
+}
+/** Append one record under the file lock. Refuses LEDGER_DAMAGED when the tail is torn or invalid. */
+export declare function appendRecord<B>(path: string, kind: RecordKind, body: B, options?: AppendOptions): Promise<RecordEnvelope<B>>;
+export interface RepairResult {
+    /** The raw lines that were (or would be) dropped, in file order. */
+    dropped: string[];
+    /** Where the intact prefix ends, 1-based line count. */
+    keptLines: number;
+    /** How many dropped lines still parse as JSON objects: a tampered middle, not a torn tail. */
+    droppedParseable: number;
+    /** True when the file is not a record file at all (a pre-format ledger); nothing is ever truncated then. */
+    preFormat: boolean;
+    /** True when there was no file. */
+    missing: boolean;
+}
+/**
+ * Drop everything from the first damaged line on. `apply: false` previews. The repair never rewrites an
+ * intact record and never invents one; it only truncates, and only after the caller decided to.
+ */
+export declare function repairLedger(path: string, options: {
+    apply: boolean;
+}): Promise<RepairResult>;
+//# sourceMappingURL=record.d.ts.map

package/dist/governance/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../src/governance/record.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,aAAa,EAAG,CAAU,CAAC;AACxC,eAAO,MAAM,YAAY,8IAaf,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAC;AAExD,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC,CAAC,EAAE,OAAO,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,CAAC,CAAC;IACR,kGAAkG;IAClG,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,OAAO;IACtC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;CAC7B;AAED,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOpD;AAID,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGnD;AAGD,gHAAgH;AAChH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAUjD,CAAC;AA0BH,uGAAuG;AACvG,wBAAgB,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAuBrE;AAED,wBAAsB,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAOxF;AAuCD,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,sGAAsG;AACtG,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAoC5B;AAED,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,gBAAgB,EAAE,MAAM,CAAC;IACzB,4GAA4G;IAC5G,SAAS,EAAE,OAAO,CAAC;IACnB,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAkCnG"}