reflectt-node 0.1.0

package/dist/routing-override.d.ts

@@ -0,0 +1,94 @@
+export type OverrideStatus = 'active' | 'override_expired' | 'mismatch_blocked';
+export interface RoutingOverride {
+    id: string;
+    /** Agent or role the override applies to */
+    target: string;
+    /** Target type: 'agent' or 'role' */
+    target_type: 'agent' | 'role';
+    /** Original routing channel */
+    original_channel: string;
+    /** Override routing channel */
+    override_channel: string;
+    /** Reason for the override */
+    reason: string;
+    /** Who created the override */
+    created_by: string;
+    /** Override status lifecycle */
+    status: OverrideStatus;
+    /** When override expires (must be > recheck_at) */
+    override_expires_at: number;
+    /** When to recheck override validity */
+    override_recheck_at: number;
+    /** Policy version at creation time */
+    policy_version: string;
+    /** Request ID for traceability */
+    request_id: string;
+    /** Correlation ID for grouping related overrides */
+    correlation_id: string;
+    /** Audit event IDs for lifecycle transitions */
+    audit_event_ids: string[];
+    /** Optional metadata */
+    metadata?: Record<string, unknown>;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateOverrideInput {
+    target: string;
+    target_type: 'agent' | 'role';
+    original_channel: string;
+    override_channel: string;
+    reason: string;
+    created_by: string;
+    override_expires_at: number;
+    override_recheck_at: number;
+    request_id?: string;
+    correlation_id?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface OverrideValidation {
+    valid: boolean;
+    errors: string[];
+}
+export interface OverrideTransitionResult {
+    override_id: string;
+    previous_status: OverrideStatus;
+    new_status: OverrideStatus;
+    audit_event_id: string;
+    timestamp: number;
+}
+export declare function ensureOverrideTable(): void;
+/**
+ * Validate override creation input.
+ * Key rule: override_recheck_at must be strictly less than override_expires_at
+ */
+export declare function validateOverrideInput(input: CreateOverrideInput): OverrideValidation;
+/**
+ * Create a routing override with full audit trail.
+ */
+export declare function createOverride(input: CreateOverrideInput): RoutingOverride;
+export declare function getOverride(id: string): RoutingOverride | null;
+export declare function listOverrides(opts?: {
+    target?: string;
+    target_type?: string;
+    status?: OverrideStatus;
+    limit?: number;
+}): RoutingOverride[];
+/**
+ * Find active override for a target (agent or role).
+ */
+export declare function findActiveOverride(target: string, targetType: 'agent' | 'role'): RoutingOverride | null;
+/**
+ * Tick all active overrides: expire those past their expiry time.
+ *
+ * Lifecycle:
+ *   active → override_expired (when now >= override_expires_at)
+ *   override_expired → mismatch_blocked (deterministic second transition)
+ *
+ * Each transition generates a unique audit event ID.
+ */
+export declare function tickOverrideLifecycle(now?: number): {
+    expired: OverrideTransitionResult[];
+    blocked: OverrideTransitionResult[];
+};
+export declare function _clearOverrides(): void;
+//# sourceMappingURL=routing-override.d.ts.map

package/dist/routing-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-override.d.ts","sourceRoot":"","sources":["../src/routing-override.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,kBAAkB,GAAG,kBAAkB,CAAA;AAE/E,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAA;IACd,qCAAqC;IACrC,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;IAC7B,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAA;IACxB,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAA;IACxB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,MAAM,EAAE,cAAc,CAAA;IACtB,mDAAmD;IACnD,mBAAmB,EAAE,MAAM,CAAA;IAC3B,wCAAwC;IACxC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAA;IACtB,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAA;IACtB,gDAAgD;IAChD,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,OAAO,GAAG,MAAM,CAAA;IAC7B,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,cAAc,CAAA;IAC/B,UAAU,EAAE,cAAc,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,wBAAgB,mBAAmB,IAAI,IAAI,CA0B1C;AA+BD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,kBAAkB,CAuBpF;AAID;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,CA+D1E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAK9D;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;CACV,GAAG,eAAe,EAAE,CAkBzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,eAAe,GAAG,IAAI,CAOvG;AAID;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,SAAa,GAAG;IACvD,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACnC,OAAO,EAAE,wBAAwB,EAAE,CAAA;CACpC,CA8BA;AAyED,wBAAgB,eAAe,IAAI,IAAI,CAOtC"}

package/dist/routing-override.js

@@ -0,0 +1,290 @@
+// SPDX-License-Identifier: Apache-2.0
+// Routing Override Lifecycle — role-aware routing hardening
+//
+// Manages temporary routing overrides with strict lifecycle:
+//   active → override_expired → mismatch_blocked
+//
+// Each override has:
+//   - An explicit expiry time (override_expires_at)
+//   - A recheck time (override_recheck_at < override_expires_at)
+//   - Policy version + request/correlation IDs for auditability
+//   - Deterministic state transitions with audit event IDs
+import { getDb, safeJsonStringify, safeJsonParse } from './db.js';
+import { eventBus } from './events.js';
+import { policyManager } from './policy.js';
+// ── Table ──
+export function ensureOverrideTable() {
+    const db = getDb();
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS routing_overrides (
+      id TEXT PRIMARY KEY,
+      target TEXT NOT NULL,
+      target_type TEXT NOT NULL CHECK(target_type IN ('agent', 'role')),
+      original_channel TEXT NOT NULL,
+      override_channel TEXT NOT NULL,
+      reason TEXT NOT NULL,
+      created_by TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'override_expired', 'mismatch_blocked')),
+      override_expires_at INTEGER NOT NULL,
+      override_recheck_at INTEGER NOT NULL,
+      policy_version TEXT NOT NULL,
+      request_id TEXT NOT NULL,
+      correlation_id TEXT NOT NULL,
+      audit_event_ids TEXT NOT NULL DEFAULT '[]',
+      metadata TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS idx_routing_overrides_target ON routing_overrides(target, target_type);
+    CREATE INDEX IF NOT EXISTS idx_routing_overrides_status ON routing_overrides(status);
+    CREATE INDEX IF NOT EXISTS idx_routing_overrides_expires ON routing_overrides(override_expires_at);
+  `);
+}
+// ── Helpers ──
+function generateId() {
+    return `rovr-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+}
+function generateEventId() {
+    return `revt-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+}
+function generateRequestId() {
+    return `rreq-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+}
+function generateCorrelationId() {
+    return `rcor-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
+}
+function getPolicyVersion() {
+    try {
+        const policy = policyManager.get();
+        return policy.version || policy.policyVersion || `v-${Date.now()}`;
+    }
+    catch {
+        return `v-${Date.now()}`;
+    }
+}
+// ── Validation ──
+/**
+ * Validate override creation input.
+ * Key rule: override_recheck_at must be strictly less than override_expires_at
+ */
+export function validateOverrideInput(input) {
+    const errors = [];
+    if (!input.target?.trim())
+        errors.push('target is required');
+    if (!['agent', 'role'].includes(input.target_type))
+        errors.push('target_type must be "agent" or "role"');
+    if (!input.original_channel?.trim())
+        errors.push('original_channel is required');
+    if (!input.override_channel?.trim())
+        errors.push('override_channel is required');
+    if (!input.reason?.trim())
+        errors.push('reason is required');
+    if (!input.created_by?.trim())
+        errors.push('created_by is required');
+    if (typeof input.override_expires_at !== 'number' || input.override_expires_at <= Date.now()) {
+        errors.push('override_expires_at must be a future timestamp');
+    }
+    if (typeof input.override_recheck_at !== 'number' || input.override_recheck_at <= Date.now()) {
+        errors.push('override_recheck_at must be a future timestamp');
+    }
+    // Critical validation: recheck must be before expiry
+    if (input.override_recheck_at >= input.override_expires_at) {
+        errors.push('override_recheck_at must be strictly less than override_expires_at');
+    }
+    return { valid: errors.length === 0, errors };
+}
+// ── CRUD ──
+/**
+ * Create a routing override with full audit trail.
+ */
+export function createOverride(input) {
+    ensureOverrideTable();
+    const db = getDb();
+    const now = Date.now();
+    const id = generateId();
+    const eventId = generateEventId();
+    const requestId = input.request_id || generateRequestId();
+    const correlationId = input.correlation_id || generateCorrelationId();
+    const policyVersion = getPolicyVersion();
+    const override = {
+        id,
+        target: input.target.trim(),
+        target_type: input.target_type,
+        original_channel: input.original_channel.trim(),
+        override_channel: input.override_channel.trim(),
+        reason: input.reason.trim(),
+        created_by: input.created_by.trim(),
+        status: 'active',
+        override_expires_at: input.override_expires_at,
+        override_recheck_at: input.override_recheck_at,
+        policy_version: policyVersion,
+        request_id: requestId,
+        correlation_id: correlationId,
+        audit_event_ids: [eventId],
+        metadata: input.metadata,
+        created_at: now,
+        updated_at: now,
+    };
+    db.prepare(`
+    INSERT INTO routing_overrides (
+      id, target, target_type, original_channel, override_channel,
+      reason, created_by, status, override_expires_at, override_recheck_at,
+      policy_version, request_id, correlation_id, audit_event_ids,
+      metadata, created_at, updated_at
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(id, override.target, override.target_type, override.original_channel, override.override_channel, override.reason, override.created_by, override.status, override.override_expires_at, override.override_recheck_at, policyVersion, requestId, correlationId, safeJsonStringify(override.audit_event_ids), safeJsonStringify(override.metadata), now, now);
+    eventBus.emit({
+        id: eventId,
+        type: 'task_created',
+        timestamp: now,
+        data: {
+            kind: 'routing_override:created',
+            override_id: id,
+            target: override.target,
+            policy_version: policyVersion,
+            request_id: requestId,
+            correlation_id: correlationId,
+        },
+    });
+    return override;
+}
+export function getOverride(id) {
+    ensureOverrideTable();
+    const db = getDb();
+    const row = db.prepare('SELECT * FROM routing_overrides WHERE id = ?').get(id);
+    return row ? rowToOverride(row) : null;
+}
+export function listOverrides(opts = {}) {
+    ensureOverrideTable();
+    const db = getDb();
+    const where = [];
+    const params = [];
+    if (opts.target) {
+        where.push('target = ?');
+        params.push(opts.target);
+    }
+    if (opts.target_type) {
+        where.push('target_type = ?');
+        params.push(opts.target_type);
+    }
+    if (opts.status) {
+        where.push('status = ?');
+        params.push(opts.status);
+    }
+    const whereClause = where.length > 0 ? `WHERE ${where.join(' AND ')}` : '';
+    const limit = Math.min(opts.limit ?? 50, 200);
+    const rows = db.prepare(`SELECT * FROM routing_overrides ${whereClause} ORDER BY created_at DESC LIMIT ?`).all(...params, limit);
+    return rows.map(rowToOverride);
+}
+/**
+ * Find active override for a target (agent or role).
+ */
+export function findActiveOverride(target, targetType) {
+    ensureOverrideTable();
+    const db = getDb();
+    const row = db.prepare(`SELECT * FROM routing_overrides WHERE target = ? AND target_type = ? AND status = 'active' ORDER BY created_at DESC LIMIT 1`).get(target, targetType);
+    return row ? rowToOverride(row) : null;
+}
+// ── Lifecycle Transitions ──
+/**
+ * Tick all active overrides: expire those past their expiry time.
+ *
+ * Lifecycle:
+ *   active → override_expired (when now >= override_expires_at)
+ *   override_expired → mismatch_blocked (deterministic second transition)
+ *
+ * Each transition generates a unique audit event ID.
+ */
+export function tickOverrideLifecycle(now = Date.now()) {
+    ensureOverrideTable();
+    const db = getDb();
+    const expired = [];
+    const blocked = [];
+    // Phase 1: active → override_expired
+    const activeRows = db.prepare(`SELECT * FROM routing_overrides WHERE status = 'active' AND override_expires_at <= ?`).all(now);
+    for (const row of activeRows) {
+        const override = rowToOverride(row);
+        const result = transitionOverride(override, 'override_expired', now);
+        if (result)
+            expired.push(result);
+    }
+    // Phase 2: override_expired → mismatch_blocked (deterministic)
+    // All expired overrides immediately transition to mismatch_blocked
+    const expiredRows = db.prepare(`SELECT * FROM routing_overrides WHERE status = 'override_expired'`).all();
+    for (const row of expiredRows) {
+        const override = rowToOverride(row);
+        const result = transitionOverride(override, 'mismatch_blocked', now);
+        if (result)
+            blocked.push(result);
+    }
+    return { expired, blocked };
+}
+/**
+ * Transition an override to a new status with audit trail.
+ */
+function transitionOverride(override, newStatus, now) {
+    const db = getDb();
+    const eventId = generateEventId();
+    const previousStatus = override.status;
+    const updatedEventIds = [...override.audit_event_ids, eventId];
+    db.prepare(`
+    UPDATE routing_overrides SET
+      status = ?, audit_event_ids = ?, updated_at = ?
+    WHERE id = ?
+  `).run(newStatus, safeJsonStringify(updatedEventIds), now, override.id);
+    eventBus.emit({
+        id: eventId,
+        type: 'task_updated',
+        timestamp: now,
+        data: {
+            kind: `routing_override:${newStatus}`,
+            override_id: override.id,
+            previous_status: previousStatus,
+            new_status: newStatus,
+            target: override.target,
+            policy_version: override.policy_version,
+            request_id: override.request_id,
+            correlation_id: override.correlation_id,
+        },
+    });
+    return {
+        override_id: override.id,
+        previous_status: previousStatus,
+        new_status: newStatus,
+        audit_event_id: eventId,
+        timestamp: now,
+    };
+}
+// ── Row mapping ──
+function rowToOverride(row) {
+    return {
+        id: row.id,
+        target: row.target,
+        target_type: row.target_type,
+        original_channel: row.original_channel,
+        override_channel: row.override_channel,
+        reason: row.reason,
+        created_by: row.created_by,
+        status: row.status,
+        override_expires_at: row.override_expires_at,
+        override_recheck_at: row.override_recheck_at,
+        policy_version: row.policy_version,
+        request_id: row.request_id,
+        correlation_id: row.correlation_id,
+        audit_event_ids: safeJsonParse(row.audit_event_ids) ?? [],
+        metadata: safeJsonParse(row.metadata),
+        created_at: row.created_at,
+        updated_at: row.updated_at,
+    };
+}
+// ── Test helpers ──
+export function _clearOverrides() {
+    try {
+        const db = getDb();
+        db.prepare('DELETE FROM routing_overrides').run();
+    }
+    catch {
+        // Table may not exist
+    }
+}
+//# sourceMappingURL=routing-override.js.map

package/dist/routing-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing-override.js","sourceRoot":"","sources":["../src/routing-override.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,4DAA4D;AAC5D,EAAE;AACF,6DAA6D;AAC7D,iDAAiD;AACjD,EAAE;AACF,qBAAqB;AACrB,oDAAoD;AACpD,iEAAiE;AACjE,gEAAgE;AAChE,2DAA2D;AAE3D,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAmE3C,cAAc;AAEd,MAAM,UAAU,mBAAmB;IACjC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;GAuBP,CAAC,CAAA;AACJ,CAAC;AAED,gBAAgB;AAEhB,SAAS,UAAU;IACjB,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAA;QAClC,OAAQ,MAAc,CAAC,OAAO,IAAK,MAAc,CAAC,aAAa,IAAI,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IAC1B,CAAC;AACH,CAAC;AAED,mBAAmB;AAEnB;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA0B;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC5D,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAA;IACxG,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAChF,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAChF,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;IAEpE,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,IAAI,KAAK,CAAC,mBAAmB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ,IAAI,KAAK,CAAC,mBAAmB,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAA;IAC/D,CAAC;IAED,qDAAqD;IACrD,IAAI,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAA;IACnF,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC/C,CAAC;AAED,aAAa;AAEb;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,mBAAmB,EAAE,CAAA;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IACvB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAA;IACzD,MAAM,aAAa,GAAG,KAAK,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAA;IACrE,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAA;IAExC,MAAM,QAAQ,GAAoB;QAChC,EAAE;QACF,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC/C,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;QACnC,MAAM,EAAE,QAAQ;QAChB,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,aAAa;QAC7B,eAAe,EAAE,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,GAAG;QACf,UAAU,EAAE,GAAG;KAChB,CAAA;IAED,EAAE,CAAC,OAAO,CAAC;;;;;;;GAOV,CAAC,CAAC,GAAG,CACJ,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,EACzC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EACpD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,EACrD,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,EAC1D,aAAa,EAAE,SAAS,EAAE,aAAa,EACvC,iBAAiB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC3C,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACpC,GAAG,EAAE,GAAG,CACT,CAAA;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,cAAuB;QAC7B,SAAS,EAAE,GAAG;QACd,IAAI,EAAE;YACJ,IAAI,EAAE,0BAA0B;YAChC,WAAW,EAAE,EAAE;YACf,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,cAAc,EAAE,aAAa;YAC7B,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,aAAa;SAC9B;KACF,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,mBAAmB,EAAE,CAAA;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAQ,CAAA;IACrF,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAK1B,EAAE;IACJ,mBAAmB,EAAE,CAAA;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,MAAM,GAAc,EAAE,CAAA;IAE5B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;IACvE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAAC,CAAC;IACtF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;IAEvE,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;IAE7C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,mCAAmC,WAAW,mCAAmC,CAClF,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,CAAU,CAAA;IAEhC,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,UAA4B;IAC7E,mBAAmB,EAAE,CAAA;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,6HAA6H,CAC9H,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAQ,CAAA;IAChC,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACxC,CAAC;AAED,8BAA8B;AAE9B;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAIpD,mBAAmB,EAAE,CAAA;IACrB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAA+B,EAAE,CAAA;IAC9C,MAAM,OAAO,GAA+B,EAAE,CAAA;IAE9C,qCAAqC;IACrC,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAC3B,sFAAsF,CACvF,CAAC,GAAG,CAAC,GAAG,CAAU,CAAA;IAEnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAA;QACpE,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED,+DAA+D;IAC/D,mEAAmE;IACnE,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAC5B,mEAAmE,CACpE,CAAC,GAAG,EAAW,CAAA;IAEhB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAA;QACpE,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,QAAyB,EACzB,SAAyB,EACzB,GAAW;IAEX,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAA;IAEtC,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAE9D,EAAE,CAAC,OAAO,CAAC;;;;GAIV,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,iBAAiB,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;IAEvE,QAAQ,CAAC,IAAI,CAAC;QACZ,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,cAAuB;QAC7B,SAAS,EAAE,GAAG;QACd,IAAI,EAAE;YACJ,IAAI,EAAE,oBAAoB,SAAS,EAAE;YACrC,WAAW,EAAE,QAAQ,CAAC,EAAE;YACxB,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC;KACF,CAAC,CAAA;IAEF,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,EAAE;QACxB,eAAe,EAAE,cAAc;QAC/B,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,OAAO;QACvB,SAAS,EAAE,GAAG;KACf,CAAA;AACH,CAAC;AAED,oBAAoB;AAEpB,SAAS,aAAa,CAAC,GAAQ;IAC7B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAwB;QACpC,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;QAC5C,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,eAAe,EAAE,aAAa,CAAW,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE;QACnE,QAAQ,EAAE,aAAa,CAA0B,GAAG,CAAC,QAAQ,CAAC;QAC9D,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAA;AACH,CAAC;AAED,qBAAqB;AAErB,MAAM,UAAU,eAAe;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;QAClB,EAAE,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,GAAG,EAAE,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,sBAAsB;IACxB,CAAC;AACH,CAAC"}

package/dist/scope-routing.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Deterministic channel → scope mapping.
+ *
+ * Why: prevent agent state from forking unpredictably across channels by bucketing
+ * session-local context + overflow memos under a stable scope id.
+ */
+export interface ScopeRoutingInput {
+    /** Explicit override: if present, always used. */
+    scope_id?: string | null;
+    /** Channel name (e.g. general, ops, task-comments, dm:ryan). */
+    channel?: string | null;
+    /** Known task id for task-scoped contexts. */
+    task_id?: string | null;
+    /** DM peer identifier (gateway-dependent). */
+    peer?: string | null;
+}
+export declare function deriveScopeId(input: ScopeRoutingInput): string;
+//# sourceMappingURL=scope-routing.d.ts.map

package/dist/scope-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-routing.d.ts","sourceRoot":"","sources":["../src/scope-routing.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AAEH,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAEvB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CA2B9D"}

package/dist/scope-routing.js

@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) Reflectt AI
+export function deriveScopeId(input) {
+    const override = String(input.scope_id || '').trim();
+    if (override)
+        return override;
+    const ch = String(input.channel || 'general').trim().toLowerCase();
+    const taskId = String(input.task_id || '').trim();
+    const peer = String(input.peer || '').trim();
+    // 1) Team scope
+    if (ch === 'general' || ch === 'ops')
+        return 'team:default';
+    // 2) Task scope
+    // Keep this intentionally tight to avoid surprising channels like "taskforce".
+    if (ch === 'task-comments' || ch === 'task-notifications' || ch.startsWith('task-')) {
+        return taskId ? `task:${taskId}` : 'team:default';
+    }
+    // 3) User scope (DM)
+    if (ch.startsWith('dm:')) {
+        const suffix = ch.slice('dm:'.length).trim();
+        if (suffix)
+            return `user:${suffix}`;
+    }
+    if (peer)
+        return `user:${peer}`;
+    // Default
+    return 'team:default';
+}
+//# sourceMappingURL=scope-routing.js.map

package/dist/scope-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-routing.js","sourceRoot":"","sources":["../src/scope-routing.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,4BAA4B;AAuB5B,MAAM,UAAU,aAAa,CAAC,KAAwB;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C,gBAAgB;IAChB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAE3D,gBAAgB;IAChB,+EAA+E;IAC/E,IAAI,EAAE,KAAK,eAAe,IAAI,EAAE,KAAK,oBAAoB,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,cAAc,CAAA;IACnD,CAAC;IAED,qBAAqB;IACrB,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5C,IAAI,MAAM;YAAE,OAAO,QAAQ,MAAM,EAAE,CAAA;IACrC,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,QAAQ,IAAI,EAAE,CAAA;IAE/B,UAAU;IACV,OAAO,cAAc,CAAA;AACvB,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,77 @@
+export interface EncryptedPayload {
+    ciphertext: string;
+    iv: string;
+    authTag: string;
+}
+export interface EncryptedSecret {
+    name: string;
+    scope: 'host' | 'project' | 'agent';
+    encrypted_value: EncryptedPayload;
+    wrapped_dek: EncryptedPayload;
+    created_at: number;
+    rotated_at: number;
+    metadata?: Record<string, unknown>;
+}
+export interface SecretMetadata {
+    name: string;
+    scope: 'host' | 'project' | 'agent';
+    created_at: number;
+    rotated_at: number;
+    metadata?: Record<string, unknown>;
+}
+export interface AuditEntry {
+    timestamp: number;
+    secretName: string;
+    action: 'create' | 'read' | 'rotate' | 'delete' | 'export' | 'import';
+    actor: string;
+    hostId: string;
+    success: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface SecretExportBundle {
+    version: string;
+    exported_at: string;
+    host_id: string;
+    secrets: EncryptedSecret[];
+}
+export declare class SecretVault {
+    private hmk;
+    private secrets;
+    private secretsDir;
+    private keyPath;
+    private storePath;
+    private auditPath;
+    private hostId;
+    constructor(reflecttHome: string, hostId?: string);
+    /** Initialize vault — load or generate HMK, load stored secrets */
+    init(): void;
+    /** Create or update a secret */
+    create(name: string, plaintext: string, scope?: 'host' | 'project' | 'agent', actor?: string, metadata?: Record<string, unknown>): SecretMetadata;
+    /** Decrypt and return a secret value */
+    read(name: string, actor?: string): string | null;
+    /** List all secret metadata (no plaintext) */
+    list(): SecretMetadata[];
+    /** Delete a secret */
+    delete(name: string, actor?: string): boolean;
+    /** Rotate a secret's DEK (re-encrypt with new key) */
+    rotate(name: string, actor?: string): SecretMetadata | null;
+    /** Export all secrets as encrypted bundle */
+    export(actor?: string): SecretExportBundle;
+    /** Import secrets from bundle (re-wraps DEKs with current HMK) */
+    import(bundle: SecretExportBundle, sourceHmk: Buffer, actor?: string): number;
+    /** Get audit log entries */
+    getAuditLog(limit?: number): AuditEntry[];
+    /** Check if vault is initialized */
+    isInitialized(): boolean;
+    /** Get vault stats */
+    getStats(): {
+        initialized: boolean;
+        secretCount: number;
+        hostId: string;
+    };
+    private ensureInitialized;
+    private persist;
+    private audit;
+    private toMetadata;
+}
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;IACnC,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,gBAAgB,CAAA;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACrE,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,eAAe,EAAE,CAAA;CAC3B;AAsCD,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAAQ;IACvB,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,SAAS,CAAQ;IACzB,OAAO,CAAC,MAAM,CAAQ;gBAEV,YAAY,EAAE,MAAM,EAAE,MAAM,GAAE,MAAkB;IAQ5D,mEAAmE;IACnE,IAAI,IAAI,IAAI;IAoCZ,gCAAgC;IAChC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAM,GAAG,SAAS,GAAG,OAAgB,EAAE,KAAK,GAAE,MAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IA4BnK,wCAAwC;IACxC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAiB,GAAG,MAAM,GAAG,IAAI;IA4B3D,8CAA8C;IAC9C,IAAI,IAAI,cAAc,EAAE;IAIxB,sBAAsB;IACtB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAiB,GAAG,OAAO;IASvD,sDAAsD;IACtD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAiB,GAAG,cAAc,GAAG,IAAI;IAiCrE,6CAA6C;IAC7C,MAAM,CAAC,KAAK,GAAE,MAAiB,GAAG,kBAAkB;IAWpD,kEAAkE;IAClE,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAiB,GAAG,MAAM;IAgCvF,4BAA4B;IAC5B,WAAW,CAAC,KAAK,GAAE,MAAY,GAAG,UAAU,EAAE;IAW9C,oCAAoC;IACpC,aAAa,IAAI,OAAO;IAIxB,sBAAsB;IACtB,QAAQ,IAAI;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAUzE,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,KAAK;IAwBb,OAAO,CAAC,UAAU;CASnB"}