pi-daddy 0.28.0 → 0.32.1

package/dist/executors/run-herdr.js

@@ -0,0 +1,341 @@
+/**
+ * Run a governed child in a herdr pane — ADR-0016 point 6.
+ *
+ * The second executor for the same plan. `runChild` spawns `pi` directly and captures its stdout;
+ * `runHerdrPane` asks herdr to launch it in a visible, attachable terminal pane. `planSpawn` produces the
+ * argv either way, so the grant is identical and only the *place it runs* differs.
+ *
+ * **Why go through herdr's CLI rather than the third-party `pi-herdr` extension.** That extension exposes
+ * `agentArgs` and `env` as MODEL-facing tool parameters (R-30), which hands a model an argv array and the
+ * environment variable the grant travels on. Here the model chooses a definition and a task; this package
+ * builds the argv. Measured facts this relies on (probe `g16-herdr`):
+ *
+ *  - `herdr agent start … -- <args>` delivers argv **verbatim**, echoed back in the reply.
+ *  - `--tools` is enforced inside a pane exactly as it is for a direct spawn; `--no-tools` yields none.
+ *  - `herdr agent start` has **no `--env`**, but `tab create` / `pane split` do, and a pane's environment
+ *    reaches the shell that launches the agent — verified by reading `$PI_DADDY_GRANT` back out of a
+ *    pane created with it. That is how the grant, depth and ledger path propagate on this path.
+ *
+ * **What a pane is not: a boundary.** It is a terminal. `--tools` remains the enforcement point, ADR-0012's
+ * `bash` escape is unchanged, and a pane is *attachable by design*, so a human can type into a governed
+ * child. Humans are not this project's threat model, but nothing here should be read as containing one.
+ */
+import { rm } from "node:fs/promises";
+import { runWithFinalizers } from "../governance/finalization.js";
+import { DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_TIMEOUT_MS } from "../kernel/run-child.js";
+import { MAX_OPEN_PANES, markPaneSettled, trackPane, trimOpenPanes, untrackPane } from "./pane-reaper.js";
+import { defaultExec, parseReply } from "./herdr-cli.js";
+import { FRESH_LIFECYCLE_TIMEOUT_MS, readPane, waitForLifecycleBaseline, waitForSettled, observeHerdrSession, } from "./herdr-poll.js";
+import { stageSystemPrompt } from "./herdr-stage.js";
+import { uniqueAgentName } from "./herdr-name.js";
+import { bundledHerdrPiLifecycleExtension } from "./herdr-pi-lifecycle.js";
+import { startHerdrAgent } from "./herdr-start.js";
+/**
+ * Re-exported so importers of the executor still reach the protocol at the name they always used.
+ *
+ * Deliberate rather than lazy: `test/run-herdr.test.ts` imports `HerdrExec` from here and must pass
+ * **unmodified** across this extraction — that is the only available proof the move changed no behaviour.
+ */
+export { parseReply } from "./herdr-cli.js";
+/** Re-exported: `splitSystemPrompt` moved to `./herdr-stage.ts` under the ceiling, its tests import it here. */
+export { splitSystemPrompt, stageSystemPrompt } from "./herdr-stage.js";
+/** Re-exported: the name rules moved to `./herdr-name.ts` under the ceiling; tests import them here. */
+export { uniqueAgentName } from "./herdr-name.js";
+/** Re-exported after startup retry extraction; existing executor importers keep this public constant. */
+export { PANE_READY_POLL_MS } from "./herdr-start.js";
+/**
+ * Re-exported so `test/run-herdr.test.ts` and any importer keep reaching these where they always were.
+ *
+ * `POLL_INTERVAL_MS` and `newSuffix` moved to `./herdr-poll.ts` under the 400-line ceiling; the names are part
+ * of this module's surface and moving a file should not move an export.
+ */
+export { DEFAULT_SNAPSHOT_LINES, POLL_INTERVAL_MS, readPane, tailLines, waitForLifecycleBaseline, waitForSettled, } from "./herdr-poll.js";
+export class HerdrWriterCloseError extends Error {
+    constructor(tabId) {
+        super(`herdr writer tab ${tabId} could not be closed; retaining its workspace lease`);
+        this.name = "HerdrWriterCloseError";
+    }
+}
+/**
+ * Run one governed child in a pane and return its output.
+ *
+ * Deliberately returns `ChildRunResult` — the same shape as `runChild` — so the extension can choose an
+ * executor without knowing which one it got.
+ */
+export async function runHerdrPane(request) {
+    const exec = request.exec ?? defaultExec;
+    const timeoutMs = request.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const maxOutputBytes = request.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    const deadline = Date.now() + timeoutMs;
+    const empty = { code: null, text: "", truncated: false, timedOut: false, aborted: false };
+    // A-R3's rule, kept on this path too: checked BEFORE anything is created. An `AbortSignal` does not
+    // replay, so a check after the first `await` cannot see an abort that already happened — and we would
+    // have left a pane behind for a run that was never wanted.
+    if (request.signal?.aborted)
+        return { ...empty, aborted: true };
+    // `--print` makes pi process the prompt and exit, so it never reaches the interactive readiness that
+    // `herdr agent start` waits for — the agent is simply never detected. Found by the first end-to-end run,
+    // which failed inside herdr with an empty reply. Caught here instead, naming the flag, because a
+    // mismatch between a plan and its executor is a caller bug and should read like one.
+    if (request.args.includes("--print") || request.args.includes("-p")) {
+        return {
+            ...empty,
+            spawnError: "herdr needs an INTERACTIVE agent, but the plan contains --print, which makes pi exit immediately " +
+                "and never be detected. Build the plan with `print: false` for this executor.",
+        };
+    }
+    // A multi-line system prompt becomes a file; see `stageSystemPrompt`. Removed on every path that does not
+    // end up tracking a pane, because only a tracked pane's dir is reachable by a sweep.
+    const staged = await stageSystemPrompt(request.args);
+    if (staged.error)
+        return { ...empty, spawnError: staged.error };
+    const promptDir = staged.promptDir;
+    let lifecycleExtension;
+    try {
+        lifecycleExtension = bundledHerdrPiLifecycleExtension();
+    }
+    catch (error) {
+        if (promptDir)
+            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
+        return { ...empty, spawnError: String(error) };
+    }
+    // Pi's `--no-extensions` disables discovery, not this explicit, package-pinned lifecycle reporter. It
+    // registers no tools; pi's existing `--tools` allowlist remains the governed child surface.
+    const effectiveArgs = [...staged.args, "-e", lifecycleExtension];
+    const create = ["tab", "create", "--label", request.name, "--cwd", request.cwd];
+    if (request.workspace)
+        create.push("--workspace", request.workspace);
+    for (const [key, value] of Object.entries(request.env))
+        create.push("--env", `${key}=${value}`);
+    // The name herdr will actually know this agent by. Every later command in this function uses `agentName`,
+    // never `request.name`, which is only a base.
+    const agentName = uniqueAgentName(request.name);
+    const created = parseReply(await exec(create));
+    if (created.error) {
+        // **The staged prompt is removed here too.** This path returned without touching it, and nothing tracked it,
+        // so neither sweep could ever reach it — a permanent `/tmp/grants-herdr-*` per failed `tab create`. Measured
+        // by a reviewer, who also found leftovers from earlier runs already sitting in `/tmp`. It is the most likely
+        // failure on a machine where herdr is not running, i.e. the common case.
+        if (promptDir)
+            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
+        return { ...empty, spawnError: `herdr tab create failed: ${created.error}` };
+    }
+    const rootPane = (created.result?.root_pane ?? {});
+    const paneId = rootPane.pane_id;
+    const tabId = rootPane.tab_id;
+    if (tabId) {
+        try {
+            request.onNativeTab?.(tabId);
+        }
+        catch {
+            /* observation only */
+        }
+    }
+    // **Tracked BEFORE the pane-id check, not after.** A tab can exist from the moment this reply is parsed,
+    // so registering later leaves a window — one herdr round-trip wide — in which a killed process orphans a
+    // tab nothing would reap. The normal path had no such window and the error path did, which is backwards:
+    // the error path is the one more likely to be taken while something is already going wrong.
+    if (tabId && request.keepPane && promptDir) {
+        // `keepPane` keeps the PANE, and the staged prompt with it — a human inspecting the pane may want to see
+        // what the child was told. Registered `settled` so the trim never touches it, but registered nonetheless so
+        // the `exit` sweep can remove the temp dir rather than leaving one per kept pane forever. Measured: this
+        // path leaked a `/tmp/grants-herdr-*` that neither sweep could reach.
+        trackPane({ tab: tabId, name: agentName, promptDir, settled: true, keepTab: true });
+    }
+    if (tabId && !request.keepPane)
+        trackPane({ tab: tabId, name: agentName, promptDir });
+    // Attach before the first post-create await. If the parent dies after this point, the independent lock
+    // helper closes the tab before releasing the writer lease.
+    if (request.onTab) {
+        try {
+            if (!tabId)
+                throw new Error("herdr returned no tab id for writer-lease attachment");
+            request.onTab(tabId);
+        }
+        catch (error) {
+            if (tabId && !request.keepPane) {
+                const closed = await exec(["tab", "close", tabId]).catch(() => undefined);
+                if (closed === undefined || parseReply(closed).error)
+                    throw new HerdrWriterCloseError(tabId);
+            }
+            return { ...empty, spawnError: `workspace writer lease could not attach to herdr tab (${String(error)})` };
+        }
+    }
+    if (tabId && !request.keepPane) {
+        // ADR-0032: panes now live until `agent_settled`, so they accumulate across one agent run — and a plain
+        // blocking `delegate` spends nothing from the fan-out budget, so the count is otherwise unbounded. Trimmed
+        // here rather than at settle time so the bound holds DURING a long run, not only after it.
+        const dropped = await trimOpenPanes(exec);
+        if (dropped.length > 0 && request.onSnapshot) {
+            try {
+                request.onSnapshot([
+                    `[grants] closed ${dropped.length} older pane(s) to stay within the ${MAX_OPEN_PANES}-pane limit: ` +
+                        dropped.join(", "),
+                ]);
+            }
+            catch {
+                /* display only */
+            }
+        }
+    }
+    if (!paneId) {
+        // The tab may exist even though the reply carried no pane id, and this return used to be BEFORE
+        // `cleanup` was defined — so the one path where herdr half-succeeded was the one that leaked a tab.
+        if (tabId && !request.keepPane) {
+            const reply = await exec(["tab", "close", tabId]).catch(() => undefined);
+            // Same rule as `cleanup`: untrack only what is provably gone, so a close herdr refused stays the
+            // reaper's problem rather than being dropped on the assumption that it worked.
+            if (reply === undefined || parseReply(reply).error) {
+                if (request.closeOnSettle)
+                    throw new HerdrWriterCloseError(tabId);
+            }
+            else {
+                untrackPane(tabId);
+            }
+        }
+        // There is no agent in this pane to ask, so the staged prompt has no reader — remove it. Kept only under
+        // `keepPane`, where the operator asked to inspect whatever exists.
+        if (promptDir && !request.keepPane)
+            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
+        return { ...empty, spawnError: "herdr tab create returned no pane id" };
+    }
+    /**
+     * End this call. **A child that did not settle has its tab closed, because that is the only way to stop it.**
+     *
+     * ADR-0032 keeps a pane alive past its tool call so a human can read it. The original version of that also
+     * called `herdr agent stop` and claimed *"the agent is still stopped here… what survives is a terminal, not a
+     * running descendant."* **`herdr agent stop` does not exist.** Measured against herdr 0.7.5: the `agent`
+     * subcommands are `list get read send-keys prompt rename focus wait attach start explain`, and `agent stop`
+     * prints the usage banner and exits 0 — which `defaultExec` reports as a success, so nothing ever noticed.
+     * probe `g16-herdr` asserted it worked, in a *How to rerun* block that was never run.
+     *
+     * So there is exactly one kill available: closing the tab. That forces the distinction below.
+     *
+     *  - **Settled cleanly** (`idle`/`done`/`blocked` with an advanced counter): the child has answered and is
+     *    sitting idle. Its pane stays, which is the whole feature, and the `agent_settled` sweep reaps it.
+     *  - **Anything else** — a timeout, an abort, a failed start, a failed prompt, an unreadable pane: the child
+     *    may still be **working, with its grant**, after its tool call has already returned a result. Leaving
+     *    that running is a governance failure, not an untidy workspace, so the tab is closed here and now.
+     *
+     * `keepPane` is the operator overriding the whole question, and it is honoured either way: nothing is tracked
+     * and nothing is closed, which is what "keep this pane for me to inspect" has to mean.
+     */
+    const cleanup = async (settledCleanly) => {
+        if (request.keepPane)
+            return;
+        if (settledCleanly && !request.closeOnSettle)
+            return;
+        if (!tabId)
+            return;
+        const reply = await exec(["tab", "close", tabId]).catch(() => undefined);
+        // Untracked only if provably closed — R-62's rule. A writer close failure must retain the lease;
+        // otherwise a still-promptable pane can overlap the successor admitted by a clean release.
+        if (reply === undefined || parseReply(reply).error) {
+            if (request.closeOnSettle)
+                throw new HerdrWriterCloseError(tabId);
+            return;
+        }
+        untrackPane(tabId);
+        if (promptDir)
+            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
+    };
+    // ADR-0032: the pane exists and has a name, so tell the caller NOW. A pane id that arrives with the result is
+    // useless — the point is switching to a child while it is still working. Guarded because a renderer must not
+    // be able to strand a pane we have already created.
+    if (request.onPane) {
+        try {
+            request.onPane(paneId, agentName);
+        }
+        catch {
+            /* display only */
+        }
+    }
+    // Set only on the one path where the child answered and stopped working. Everything else — including an
+    // early `return` from a failed start or prompt — leaves it false, so `cleanup` closes the tab.
+    let settledCleanly = false;
+    return runWithFinalizers(async () => {
+        const started = await startHerdrAgent(exec, agentName, paneId, effectiveArgs, deadline);
+        if (started.error)
+            return { ...empty, spawnError: `herdr agent start failed: ${started.error}` };
+        // The bundled reporter queues its initial idle state asynchronously. Establish its native-authority
+        // baseline before prompting, otherwise that initial report could advance the counter after prompt and
+        // be mistaken for settlement.
+        const baseline = await waitForLifecycleBaseline(exec, { ...request, name: agentName, nativePaneId: paneId }, Math.min(deadline, Date.now() + FRESH_LIFECYCLE_TIMEOUT_MS));
+        if (baseline.aborted)
+            return { ...empty, aborted: true };
+        if (baseline.spawnError || baseline.before === undefined)
+            return { ...empty, spawnError: baseline.spawnError ?? "Herdr lifecycle baseline is unavailable" };
+        observeHerdrSession(started.result?.agent, paneId, request.onSessionReference);
+        const prompted = parseReply(await exec(["agent", "prompt", agentName, request.prompt]));
+        if (prompted.error)
+            return { ...empty, spawnError: `herdr agent prompt failed: ${prompted.error}` };
+        if (request.onRunning) {
+            try {
+                request.onRunning(paneId, agentName);
+            }
+            catch {
+                /* display/observation only */
+            }
+        }
+        const settled = await waitForSettled(exec, { ...request, name: agentName, nativePaneId: paneId }, baseline.before, deadline, maxOutputBytes);
+        if (settled.aborted || settled.timedOut) {
+            // Still read: a timed-out child usually produced something, and a partial answer labelled partial is
+            // more useful than none. R-03's rule — a missing result must never look like an empty one.
+            const partial = await readPane(exec, agentName, maxOutputBytes);
+            if (!partial.readFailed) {
+                try {
+                    request.onObservation?.(Buffer.from(partial.text));
+                }
+                catch {
+                    /* observation only */
+                }
+            }
+            return { ...empty, ...settled, text: partial.readFailed ? "" : partial.text, truncated: partial.truncated };
+        }
+        if (settled.spawnError)
+            return { ...empty, spawnError: settled.spawnError };
+        const out = await readPane(exec, agentName, maxOutputBytes);
+        // **A failed read is a failed spawn, not an empty answer.** This branch used to return `readPane`'s own
+        // diagnostic as `text` with `code: 0`, so the orchestrator received
+        // `[grants] could not read the agent pane: …` **as the sub-agent's report** — R-03 exactly, and measured.
+        // The child may well have done its work; what we cannot do is claim to know what it said.
+        if (out.readFailed) {
+            return {
+                ...empty,
+                spawnError: `the child settled but its pane could not be read (${out.readFailed}), so its answer is unknown. ` +
+                    `The work may have been done — check pane ${paneId} if it is still open.`,
+            };
+        }
+        try {
+            request.onObservation?.(Buffer.from(out.text));
+        }
+        catch {
+            /* observation only */
+        }
+        settledCleanly = true;
+        // The trim may now reclaim this pane if the cap is exceeded. Until this point it must not: closing the tab
+        // kills the child, and the child was still working.
+        if (tabId)
+            markPaneSettled(tabId);
+        return {
+            code: settled.status === "blocked" ? 1 : 0,
+            // `truncated` is returned in the result too, but it was never SAID on this path, so a model received a
+            // tail with no indication that a head existed. The direct executor has always flagged it; a delegation
+            // that silently drops the first megabyte of an answer is the same defect wearing the other executor.
+            text: [
+                out.truncated ? `[grants] this pane exceeded the output cap; only its most recent output is below.\n` : "",
+                out.text,
+                settled.status === "blocked" ? `\n\n[grants] this agent is BLOCKED waiting for a human in pane ${paneId}.` : "",
+            ].join(""),
+            truncated: out.truncated,
+            timedOut: false,
+            aborted: false,
+        };
+    }, [
+        {
+            label: "herdr pane finalizer failed",
+            run: () => cleanup(settledCleanly),
+        },
+    ]);
+}
+//# sourceMappingURL=run-herdr.js.map

package/dist/executors/run-herdr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-herdr.js","sourceRoot":"","sources":["../../src/executors/run-herdr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,UAAU,EAAkB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,0BAA0B,EAC1B,QAAQ,EACR,wBAAwB,EACxB,cAAc,EACd,mBAAmB,GAEpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,OAAO,EAAkB,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5D,gHAAgH;AAChH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACxE,wGAAwG;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD;;;;;GAKG;AACH,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,wBAAwB,EACxB,cAAc,GAEf,MAAM,iBAAiB,CAAC;AAqEzB,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,KAAa;QACvB,KAAK,CAAC,oBAAoB,KAAK,qDAAqD,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1G,oGAAoG;IACpG,sGAAsG;IACtG,2DAA2D;IAC3D,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEhE,qGAAqG;IACrG,yGAAyG;IACzG,iGAAiG;IACjG,qFAAqF;IACrF,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,GAAG,KAAK;YACR,UAAU,EACR,mGAAmG;gBACnG,8EAA8E;SACjF,CAAC;IACJ,CAAC;IAED,0GAA0G;IAC1G,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,kBAAkB,GAAG,gCAAgC,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5F,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,sGAAsG;IACtG,4FAA4F;IAC5F,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAEhG,0GAA0G;IAC1G,8CAA8C;IAC9C,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,6GAA6G;QAC7G,6GAA6G;QAC7G,6GAA6G;QAC7G,yEAAyE;QACzE,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5F,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,4BAA4B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAA0C,CAAC;IAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,yGAAyG;IACzG,yGAAyG;IACzG,yGAAyG;IACzG,4FAA4F;IAC5F,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC3C,yGAAyG;QACzG,4GAA4G;QAC5G,yGAAyG;QACzG,sEAAsE;QACtE,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAEtF,uGAAuG;IACvG,2DAA2D;IAC3D,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACpF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK;oBAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,yDAAyD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/B,wGAAwG;QACxG,2GAA2G;QAC3G,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,OAAO,CAAC,UAAU,CAAC;oBACjB,mBAAmB,OAAO,CAAC,MAAM,qCAAqC,cAAc,eAAe;wBACjG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gGAAgG;QAChG,oGAAoG;QACpG,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzE,iGAAiG;YACjG,+EAA+E;YAC/E,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;gBACnD,IAAI,OAAO,CAAC,aAAa;oBAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,yGAAyG;QACzG,mEAAmE;QACnE,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjH,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,sCAAsC,EAAE,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,OAAO,GAAG,KAAK,EAAE,cAAuB,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO;QAC7B,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,aAAa;YAAE,OAAO;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,iGAAiG;QACjG,2FAA2F;QAC3F,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC,CAAC;IAEF,8GAA8G;IAC9G,6GAA6G;IAC7G,oDAAoD;IACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,wGAAwG;IACxG,+FAA+F;IAC/F,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,OAAO,iBAAiB,CAAC,KAAK,IAAI,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,6BAA6B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAEjG,oGAAoG;QACpG,sGAAsG;QACtG,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EACrD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC,CAC5D,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YACtD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,yCAAyC,EAAE,CAAC;QACpG,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAE/E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,8BAA8B,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAClC,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EACrD,QAAQ,CAAC,MAAM,EACf,QAAQ,EACR,cAAc,CACf,CAAC;QACF,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,qGAAqG;YACrG,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAE5E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC5D,wGAAwG;QACxG,oEAAoE;QACpE,0GAA0G;QAC1G,0FAA0F;QAC1F,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO;gBACL,GAAG,KAAK;gBACR,UAAU,EACR,qDAAqD,GAAG,CAAC,UAAU,+BAA+B;oBAClG,4CAA4C,MAAM,uBAAuB;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;QACD,cAAc,GAAG,IAAI,CAAC;QACtB,2GAA2G;QAC3G,oDAAoD;QACpD,IAAI,KAAK;YAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,uGAAuG;YACvG,uGAAuG;YACvG,qGAAqG;YACrG,IAAI,EAAE;gBACJ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;gBAC1G,GAAG,CAAC,IAAI;gBACR,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,kEAAkE,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;aAChH,CAAC,IAAI,CAAC,EAAE,CAAC;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC,EAAE;QACD;YACE,KAAK,EAAE,6BAA6B;YACpC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;SACnC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/executors/vendor/herdr-pi-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-pi-lifecycle.d.ts","sourceRoot":"","sources":["../../../src/executors/vendor/herdr-pi-lifecycle.ts"],"names":[],"mappings":"AA8KA,MAAM,CAAC,OAAO,WAAW,EAAE,KAAA,QAkF1B"}

package/dist/executors/vendor/herdr-pi-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"herdr-pi-lifecycle.js","sourceRoot":"","sources":["../../../src/executors/vendor/herdr-pi-lifecycle.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,mFAAmF;AACnF,mEAAmE;AACnE,0BAA0B;AAC1B,8BAA8B;AAC9B,cAAc;AAEd,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AACjD,MAAM,cAAc,GAClB,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AACzF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;AACzC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,SAAS,OAAO;IACd,OAAO,SAAS,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,SAAiB;IAC7D,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,OAAkD,CAAC;QACvD,MAAM,MAAM,GAAG,CAAC,SAAkB,EAAE,EAAE;YACpC,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,OAAO,EAAE,CAAC;gBACZ,YAAY,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,cAAe,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,IAAI,MAAM,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAUD,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,IAAI,qBAAyC,CAAC;AAC9C,IAAI,uBAA2C,CAAC;AAEhD,SAAS,aAAa;IACpB,SAAS,IAAI,CAAC,CAAC;IACf,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,cAAc,EAAE,cAAc,EAAE,EAAE,CAAC;QACrD,uBAAuB;YACrB,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB,GAAG,SAAS,CAAC;IACtC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,YAAY,EAAE,EAAE,CAAC;QACjD,qBAAqB,GAAG,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB,GAAG,SAAS,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,EAAE,GAAG,MAAM,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB;IACxB,IAAI,uBAAuB,EAAE,CAAC;QAC5B,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,kBAA2B;IAChD,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,WAAW,CAAC;QACjB,EAAE,EAAE,GAAG,MAAM,YAAY,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAC5E,MAAM,EAAE,2BAA2B;QACnC,MAAM,EAAE;YACN,OAAO,EAAE,MAAM;YACf,MAAM;YACN,KAAK,EAAE,IAAI;YACX,GAAG,EAAE,aAAa,EAAE;YACpB,oBAAoB,EAAE,kBAAkB;YACxC,GAAG,UAAU;SACd;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,OAAgB,EAAE,GAAG,GAAG,aAAa,EAAE;IAC3E,OAAO,WAAW,CAAC;QACjB,EAAE,EAAE,GAAG,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QACpE,MAAM,EAAE,mBAAmB;QAC3B,MAAM,EAAE,cAAc,CAAC;YACrB,OAAO,EAAE,MAAM;YACf,MAAM;YACN,KAAK,EAAE,IAAI;YACX,KAAK;YACL,OAAO;YACP,GAAG;SACJ,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,IAAI,YAAY,GAAG,KAAK,CAAC;AACzB,IAAI,WAAoC,CAAC;AAEzC,SAAS,UAAU,CAAC,KAAiB,EAAE,OAAgB;IACrD,WAAW,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,CAAC;IACvD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,KAAK,eAAe,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,WAAW,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,WAAW,CAAC;YACzB,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,GAAG,KAAK,CAAC;QACrB,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,WAAW,EAAE;IACzB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IAED,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,cAAkC,CAAC;IACvC,IAAI,SAAiC,CAAC;IACtC,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,SAAS,YAAY;QACnB,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,SAAkB,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAChE,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,SAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAe,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,SAAS,YAAY,CAAC,KAAK,GAAG,KAAK;QACjC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAClB,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;gBACvB,cAAc,GAAG,SAAS,CAAC;YAC7B,CAAC;YACD,YAAY,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC;QAC5B,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,0EAA0E;QAC1E,kEAAkE;QAClE,IAAI,GAAG,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;QACnB,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,oFAAoF;QACpF,WAAW,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC;QACxC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACnC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,KAAK,aAAa,EAAE,CAAC;QACrB,WAAW,GAAG,IAAI,CAAC;QACnB,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QACrC,IAAI,CAAC,WAAW,IAAI,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,WAAW,GAAG,KAAK,CAAC;QACpB,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/governance/approval-prompt.d.ts

@@ -0,0 +1,119 @@
+/**
+ * The approval dialog — the only place a human enters the capability-governance path.
+ *
+ * Kept out of `extensions/grants.ts` deliberately: that file is wiring only, and this holds decisions
+ * (what to offer, what a dismissal means, what happens with nobody watching) that must be testable
+ * without pi. `ApprovalUI` is the minimal slice of pi's `ExtensionUIContext` needed here, so a test can
+ * supply a plain object.
+ *
+ * Everything here denies on uncertainty. pi already agrees: in non-interactive modes it installs a
+ * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
+ */
+import { type ApprovalPath, type ApprovalScope } from "../kernel/approval.ts";
+import type { Capability } from "../kernel/resolve.ts";
+/** The slice of pi's `ExtensionUIContext` this module needs. */
+export interface ApprovalUI {
+    select(title: string, options: string[], opts?: {
+        timeout?: number;
+        signal?: AbortSignal;
+    }): Promise<string | undefined>;
+    notify(message: string, type?: "info" | "warning" | "error"): void;
+}
+export declare const DENY_LABEL = "Deny";
+export declare const SCOPE_LABELS: Record<ApprovalScope, string>;
+export interface PromptRequest {
+    capability: Capability;
+    /** Agent type name, or `DELEGATE_SUBJECT` on the delegate path. */
+    subject: string;
+    path: ApprovalPath;
+    /** Shown to the human for context. Never itself part of a key. */
+    task?: string;
+    /** Trusted exact-scope identity; bound requests single-flight only with an identical binding. */
+    bindingKey?: string;
+    signal?: AbortSignal;
+}
+/**
+ * Which of the five outcomes a request produced.
+ *
+ * `scope: null` alone conflates four different kinds of no — a caller that needs to know whether a
+ * PERSON actually declined (as opposed to nobody being there to ask, a dismissal, or the dialog itself
+ * breaking) cannot recover that from `scope` or from parsing `reason`. Only "declined" means a human said
+ * no; the other three are absence-of-signal, not a signal.
+ */
+export declare const PROMPT_OUTCOME_KINDS: readonly ["granted", "declined", "dismissed", "no-ui", "error"];
+export type PromptOutcomeKind = (typeof PROMPT_OUTCOME_KINDS)[number];
+export interface PromptOutcome {
+    /** The scope the human chose, or null for any form of no. */
+    scope: ApprovalScope | null;
+    /** Which of the five outcomes this was. Set on every return path. */
+    kind: PromptOutcomeKind;
+    /** Why, when the answer was no. */
+    reason?: string;
+    /**
+     * True when this caller RODE another caller's answer rather than being asked (R-66).
+     *
+     * The single-flight queue shares any non-`once` outcome, which is right — a human approving
+     * `tool:bash` *for this session* authorised the capability, not one child. What is not right is
+     * recording the riders as though each had faced a dialog: the ledger's whole job is answering "did a
+     * human authorise this?", and a fan-out of eight wrote eight lines claiming a prompt where there was
+     * one. The rider's honest source is `session`, and this flag is how the caller can tell.
+     */
+    joined?: boolean;
+}
+export interface ApprovalGateOptions {
+    ui: ApprovalUI;
+    /** pi's `ctx.hasUI` — false in print/json mode, and therefore in every governed child. */
+    hasUI: boolean;
+    /** pi's `ctx.mode`, quoted back in the refusal so an operator can see why. */
+    mode: string;
+    timeoutMs?: number;
+}
+export interface ApprovalGate {
+    request(request: PromptRequest): Promise<PromptOutcome>;
+}
+/**
+ * Read `PI_DADDY_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
+ *
+ * `0` or an unparseable value means no timeout: waiting forever denies nothing, so it is the safe
+ * interpretation of a value we do not understand.
+ */
+export declare function timeoutMsFromEnv(raw: string | undefined): number | undefined;
+/**
+ * The single-flight queue: one dialog per approval key at a time.
+ *
+ * `delegate` sets no `executionMode`, so an orchestrator can fan out several children at once and two can
+ * hit the same gate simultaneously — otherwise two stacked dialogs asking the identical question.
+ *
+ * **R-29 — the key does two jobs, and only one of them may be shared.** `approvalKey` is
+ * `capability@subject`, and on the delegate path the subject is the constant `DELEGATE_SUBJECT`, which is
+ * deliberate: the only things naming a delegated child are the task and the tool list, both model-chosen,
+ * and a key the model controls is not a key (`approval.ts:24-32`). That reasoning governs *approval
+ * identity* — what a human said yes to, and what may be persisted — and it is right.
+ *
+ * It does **not** govern de-duplication. Sharing one dialog's outcome is correct for `session` and
+ * `always`, which are genuinely answers about the session or the project, and for a decline or an error,
+ * which answer everyone. It is **wrong for `once`**, which means *this spawn*. Measured before the fix:
+ * four concurrent delegations gating `tool:bash`, one dialog, one click of *Allow once* → four `granted`
+ * outcomes, with the human having seen only the first caller's task. That is a confused deputy, and it
+ * falsified ADR-0014's decided property that "`once` stops at the boundary".
+ */
+export type InFlightApprovals = Map<string, Promise<PromptOutcome>>;
+/**
+ * Build gates that SHARE one single-flight queue.
+ *
+ * This exists because of how the wiring actually calls in. The gate's options depend on the per-call
+ * `ExtensionContext` (`ui`, `hasUI`, `mode`), so the extension necessarily builds a gate per invocation —
+ * and a gate that owns its queue privately therefore de-duplicates nothing across invocations, which is
+ * exactly the case §6.1 exists for (two concurrent `delegate` calls are two separate invocations).
+ *
+ * The provider separates the two lifetimes: options stay per-call and fresh, the queue is created once and
+ * lives as long as the provider. Preferred over a module-level map because that would be shared by every
+ * gate in the process — including across tests — for no benefit.
+ */
+export declare function createApprovalGateProvider(): (options: ApprovalGateOptions) => ApprovalGate;
+/**
+ * @param inFlight optional shared single-flight queue — see `createApprovalGateProvider`. Defaults to one
+ * private to this gate, which only de-duplicates requests made through this same gate object.
+ */
+export declare function createApprovalGate(options: ApprovalGateOptions, inFlight?: InFlightApprovals): ApprovalGate;
+//# sourceMappingURL=approval-prompt.d.ts.map

package/dist/governance/approval-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-prompt.d.ts","sourceRoot":"","sources":["../../src/governance/approval-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAA8B,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EAAE,EACjB,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAChD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/B,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;CACpE;AAED,eAAO,MAAM,UAAU,SAAS,CAAC;AAEjC,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAItD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,iEAAkE,CAAC;AACpG,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,qEAAqE;IACrE,IAAI,EAAE,iBAAiB,CAAC;IACxB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,UAAU,CAAC;IACf,0FAA0F;IAC1F,KAAK,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAK5E;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,IAAI,CAAC,OAAO,EAAE,mBAAmB,KAAK,YAAY,CAG3F;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,GAAE,iBAA6B,GACtC,YAAY,CAwEd"}

package/dist/governance/approval-prompt.js

@@ -0,0 +1,133 @@
+/**
+ * The approval dialog — the only place a human enters the capability-governance path.
+ *
+ * Kept out of `extensions/grants.ts` deliberately: that file is wiring only, and this holds decisions
+ * (what to offer, what a dismissal means, what happens with nobody watching) that must be testable
+ * without pi. `ApprovalUI` is the minimal slice of pi's `ExtensionUIContext` needed here, so a test can
+ * supply a plain object.
+ *
+ * Everything here denies on uncertainty. pi already agrees: in non-interactive modes it installs a
+ * no-op UI context whose `select` resolves undefined, so even a missed `hasUI` check would deny.
+ */
+import { approvalKey, offeredScopes } from "../kernel/approval.js";
+export const DENY_LABEL = "Deny";
+export const SCOPE_LABELS = {
+    once: "Allow once",
+    session: "Allow for this session",
+    always: "Always allow in this project (30 days)",
+};
+/**
+ * Which of the five outcomes a request produced.
+ *
+ * `scope: null` alone conflates four different kinds of no — a caller that needs to know whether a
+ * PERSON actually declined (as opposed to nobody being there to ask, a dismissal, or the dialog itself
+ * breaking) cannot recover that from `scope` or from parsing `reason`. Only "declined" means a human said
+ * no; the other three are absence-of-signal, not a signal.
+ */
+export const PROMPT_OUTCOME_KINDS = ["granted", "declined", "dismissed", "no-ui", "error"];
+const DEFAULT_TIMEOUT_MS = 120_000;
+/**
+ * Read `PI_DADDY_APPROVAL_TIMEOUT`, in SECONDS, into the milliseconds pi expects.
+ *
+ * `0` or an unparseable value means no timeout: waiting forever denies nothing, so it is the safe
+ * interpretation of a value we do not understand.
+ */
+export function timeoutMsFromEnv(raw) {
+    if (raw === undefined)
+        return DEFAULT_TIMEOUT_MS;
+    const seconds = Number.parseInt(raw, 10);
+    if (!Number.isFinite(seconds) || seconds <= 0)
+        return undefined;
+    return seconds * 1000;
+}
+function labelToScope(label, scopes) {
+    return scopes.find((s) => SCOPE_LABELS[s] === label) ?? null;
+}
+/**
+ * Build gates that SHARE one single-flight queue.
+ *
+ * This exists because of how the wiring actually calls in. The gate's options depend on the per-call
+ * `ExtensionContext` (`ui`, `hasUI`, `mode`), so the extension necessarily builds a gate per invocation —
+ * and a gate that owns its queue privately therefore de-duplicates nothing across invocations, which is
+ * exactly the case §6.1 exists for (two concurrent `delegate` calls are two separate invocations).
+ *
+ * The provider separates the two lifetimes: options stay per-call and fresh, the queue is created once and
+ * lives as long as the provider. Preferred over a module-level map because that would be shared by every
+ * gate in the process — including across tests — for no benefit.
+ */
+export function createApprovalGateProvider() {
+    const inFlight = new Map();
+    return (options) => createApprovalGate(options, inFlight);
+}
+/**
+ * @param inFlight optional shared single-flight queue — see `createApprovalGateProvider`. Defaults to one
+ * private to this gate, which only de-duplicates requests made through this same gate object.
+ */
+export function createApprovalGate(options, inFlight = new Map()) {
+    const ask = async (request) => {
+        const scopes = offeredScopes(request.path);
+        const title = `grants: approve ${request.capability} for ${request.subject}?` +
+            (request.task ? `\n  task: ${request.task}` : "");
+        let chosen;
+        try {
+            chosen = await options.ui.select(title, [DENY_LABEL, ...scopes.map((s) => SCOPE_LABELS[s])], {
+                timeout: options.timeoutMs,
+                signal: request.signal,
+            });
+        }
+        catch (error) {
+            // A governance layer that errors must deny, not permit. This is a dialog malfunction, not a
+            // person's answer — `kind: "error"` keeps it out of "declined".
+            return { scope: null, kind: "error", reason: `approval dialog failed, denying (${String(error)})` };
+        }
+        // undefined covers dismissal, timeout, and abort. All are a no, but none is a person saying no.
+        if (chosen === undefined) {
+            return { scope: null, kind: "dismissed", reason: `approval for ${request.capability} was dismissed` };
+        }
+        if (chosen === DENY_LABEL) {
+            return { scope: null, kind: "declined", reason: `${request.capability} was denied by a human` };
+        }
+        const scope = labelToScope(chosen, scopes);
+        return scope === null
+            ? { scope: null, kind: "error", reason: `unrecognised approval choice ${JSON.stringify(chosen)}, denying` }
+            : { scope, kind: "granted" };
+    };
+    return {
+        async request(request) {
+            if (!options.hasUI) {
+                // Nobody was there to ask — distinct from a person declining, which is why this is its own kind
+                // rather than being folded into "declined" (see PromptOutcomeKind).
+                return {
+                    scope: null,
+                    kind: "no-ui",
+                    reason: `${request.capability} requires approval and this session has no interactive user ` +
+                        `(mode: ${options.mode}). Pre-approve it in an interactive session, or drop it from the request.`,
+                };
+            }
+            const key = `${approvalKey(request.capability, request.subject)}${request.bindingKey ? `#${request.bindingKey}` : ""}`;
+            // R-29. Join an in-flight dialog, but only *keep* its answer if that answer was about more than one
+            // spawn. A `once` belongs to whichever caller the human was actually looking at — the title shows
+            // that caller's task — so anyone else who joined must ask their own question rather than ride a yes
+            // given for somebody else's work. The loop (rather than a single retry) covers the case where a
+            // fellow waiter started its own dialog first: we join that one instead of opening a third.
+            for (;;) {
+                const existing = inFlight.get(key);
+                if (!existing)
+                    break;
+                const outcome = await existing;
+                // **`joined` marks the rider, and the ledger depends on it (R-66).** Sharing a non-`once` outcome
+                // is correct — the human authorised the capability for the session, not for one child — but the
+                // caller then stamped `approvalSource: "prompt"` on every one of them, so a fan-out of eight wrote
+                // eight lines each asserting a human was prompted when exactly one was. That is R-46's defect at
+                // the concurrency level, and `ledger.ts` calls over-claiming in this direction "the worst available
+                // failure". Confirmed by execution: one dialog, eight `granted/session` outcomes.
+                if (outcome.scope !== "once")
+                    return { ...outcome, joined: true };
+            }
+            const pending = ask(request).finally(() => inFlight.delete(key));
+            inFlight.set(key, pending);
+            return pending;
+        },
+    };
+}
+//# sourceMappingURL=approval-prompt.js.map