sept-agent 0.0.0-stage → 0.1.0

package/dist/src/cli/options.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Parses the installed CLI's argv boundary. It owns command/option syntax only and passes bounded
+ * strings toward command composition without interpreting runtime or credential semantics.
+ */
+declare const OPTION_KEYS: {
+    readonly worker: readonly ["hands", "agent-dir", "host", "port", "state-dir", "workspace-root"];
+    readonly run: readonly ["hands", "agent-dir", "resume", "message", "max-epochs", "max-invocations", "model", "provider", "role", "state-dir", "task", "thinking", "timeout", "workspace"];
+    readonly doctor: readonly ["agent-dir", "provider"];
+    readonly health: readonly ["url"];
+    readonly models: readonly ["agent-dir", "model", "provider"];
+    readonly permissions: readonly ["agent-dir", "state-dir", "hands", "policy", "mode", "revision", "request", "digest", "expires"];
+    readonly auth: readonly ["agent-dir", "method", "provider"];
+};
+/** Installed CLI commands accepted before any mechanism is constructed. */
+export type CliCommand = keyof typeof OPTION_KEYS;
+/** Parsed command syntax; command handlers remain responsible for semantic validation. */
+export interface CliInvocation {
+    command: CliCommand;
+    action?: string;
+    options: Record<string, string>;
+}
+/** Parse argv without admitting unknown commands, positional values, or duplicate options. */
+export declare function parseCliInvocation(argv: string[]): CliInvocation | undefined;
+export {};

package/dist/src/cli/options.js

@@ -0,0 +1,76 @@
+/**
+ * Parses the installed CLI's argv boundary. It owns command/option syntax only and passes bounded
+ * strings toward command composition without interpreting runtime or credential semantics.
+ */
+import { CliError } from "./errors.js";
+const OPTION_KEYS = {
+    worker: ["hands", "agent-dir", "host", "port", "state-dir", "workspace-root"],
+    run: [
+        "hands",
+        "agent-dir",
+        "resume",
+        "message",
+        "max-epochs",
+        "max-invocations",
+        "model",
+        "provider",
+        "role",
+        "state-dir",
+        "task",
+        "thinking",
+        "timeout",
+        "workspace",
+    ],
+    doctor: ["agent-dir", "provider"],
+    health: ["url"],
+    models: ["agent-dir", "model", "provider"],
+    permissions: [
+        "agent-dir",
+        "state-dir",
+        "hands",
+        "policy",
+        "mode",
+        "revision",
+        "request",
+        "digest",
+        "expires",
+    ],
+    auth: ["agent-dir", "method", "provider"],
+};
+function isCommand(value) {
+    return value !== undefined && Object.hasOwn(OPTION_KEYS, value);
+}
+function parseOptions(values, allowed) {
+    const result = {};
+    for (let index = 0; index < values.length; index += 2) {
+        const argument = values[index];
+        if (!argument?.startsWith("--")) {
+            throw new CliError("Unexpected positional argument");
+        }
+        const key = argument.slice(2);
+        if (!allowed.includes(key)) {
+            throw new CliError(`Unknown option --${key}`);
+        }
+        if (key in result) {
+            throw new CliError(`Duplicate option --${key}`);
+        }
+        const value = values[index + 1];
+        if (value === undefined || value.startsWith("--")) {
+            throw new CliError(`Missing value for --${key}`);
+        }
+        result[key] = value;
+    }
+    return result;
+}
+/** Parse argv without admitting unknown commands, positional values, or duplicate options. */
+export function parseCliInvocation(argv) {
+    const command = argv[2];
+    if (!isCommand(command)) {
+        return undefined;
+    }
+    const hasAction = command === "models" || command === "auth" || command === "permissions";
+    const action = hasAction ? argv[3] : undefined;
+    const options = parseOptions(argv.slice(hasAction ? 4 : 3), OPTION_KEYS[command]);
+    return action === undefined ? { command, options } : { command, action, options };
+}
+//# sourceMappingURL=options.js.map

package/dist/src/cli/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../src/cli/options.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,CAAC;IAC7E,GAAG,EAAE;QACH,OAAO;QACP,WAAW;QACX,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,iBAAiB;QACjB,OAAO;QACP,UAAU;QACV,MAAM;QACN,WAAW;QACX,MAAM;QACN,UAAU;QACV,SAAS;QACT,WAAW;KACZ;IACD,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,MAAM,EAAE,CAAC,KAAK,CAAC;IACf,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC;IAC1C,WAAW,EAAE;QACX,WAAW;QACX,WAAW;QACX,OAAO;QACP,QAAQ;QACR,MAAM;QACN,UAAU;QACV,SAAS;QACT,QAAQ;QACR,SAAS;KACV;IACD,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC;CACjC,CAAC;AAYX,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,MAAgB,EAAE,OAA0B;IAChE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,QAAQ,CAAC,gCAAgC,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,QAAQ,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,QAAQ,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,aAAa,CAAC;IAC1F,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACpF,CAAC"}

package/dist/src/cli/permission-decisions.d.ts

@@ -0,0 +1,8 @@
+import { CapabilityPolicyStore, RunStore, type CapabilityPolicy } from "../durable/index.js";
+import type { CliInvocation } from "./options.js";
+/** Local installed decision interaction; HTTP and task text have no policy writer. */
+export declare function permissionDecision(invocation: CliInvocation, root: string, agentDir: string, policy: CapabilityPolicyStore, previous: CapabilityPolicy | undefined): Promise<unknown>;
+/** Installed direct explicit retry shares accepted input/wake and never resets original limits. */
+export declare function resumePermissionRun(context: CliInvocation, root: string, agentDir: string): Promise<RunStore | undefined>;
+/** Local direct admission keeps drained state and every other resident run outside the selected retry. */
+export declare function assertLocalRunSlot(root: string, selectedRunId?: string): void;

package/dist/src/cli/permission-decisions.js

@@ -0,0 +1,168 @@
+/** Local bounded operator decisions, separate from worker scheduling and the policy effect owner. */
+import { join } from "node:path";
+import { CapabilityPolicyStore, CapabilityRequestStore, RunStore, listRuns, WorkerLifecycleStore, SeptError, } from "../durable/index.js";
+import { loadHandsConfiguration, validateDockerConfiguration, capabilityBinding, assertHandsRunProfile, } from "../execution/index.js";
+import { assertCapabilityExpansion } from "./permissions.js";
+import { wakeRunForOperator } from "../runtime/index.js";
+import { CliError } from "./errors.js";
+function permissionRequest(invocation, requests) {
+    const selected = requests.read().find((entry) => entry.id === invocation.options.request);
+    if (selected === undefined) {
+        throw new SeptError("Exact permission request is absent");
+    }
+    if (invocation.options.digest !== selected.digest) {
+        throw new SeptError("Permission decision requires the exact inspected --digest");
+    }
+    return selected;
+}
+/** Local installed decision interaction; HTTP and task text have no policy writer. */
+export async function permissionDecision(invocation, root, agentDir, policy, previous) {
+    const requests = new CapabilityRequestStore(root);
+    const inspection = inspectPermissions(invocation, requests);
+    if (inspection !== undefined) {
+        return inspection;
+    }
+    const selected = permissionRequest(invocation, requests);
+    const run = new RunStore(join(root, selected.runId));
+    assertHandsRunProfile(run);
+    if (run.snapshot().status !== "waiting") {
+        throw new SeptError("Permission decisions require the still-waiting original run");
+    }
+    if (previous === undefined ||
+        previous.denied ||
+        previous.revision !== Number(invocation.options.revision)) {
+        throw new SeptError("Permission decision revision is stale or revoked");
+    }
+    return applyPermissionDecision(invocation, root, agentDir, policy, previous, requests, selected, run);
+}
+function inspectPermissions(invocation, requests) {
+    if (invocation.action === "requests") {
+        return requests.read().map((entry) => ({
+            id: entry.id,
+            runId: entry.runId,
+            operation: entry.operation,
+            digest: entry.digest,
+            revision: entry.revision,
+            binding: entry.binding,
+            expiresAt: entry.expiresAt,
+            decision: entry.decision,
+        }));
+    }
+    if (invocation.action === "inspect") {
+        const selected = requests.read().find((entry) => entry.id === invocation.options.request);
+        if (selected === undefined) {
+            throw new SeptError("Exact permission request is absent");
+        }
+        return selected;
+    }
+    return undefined;
+}
+async function applyPermissionDecision(invocation, root, agentDir, policy, previous, requests, selected, run) {
+    if (invocation.action === "deny") {
+        // Old records stay inspectable; incompatible runtime configuration cannot rewrite a decision.
+        loadHandsConfiguration(invocation.options.hands ?? process.env.SEPT_HANDS_CONFIGURATION);
+        return requests.decide(selected.id, selected.digest, {
+            status: "denied",
+            revision: previous.revision,
+            binding: previous.binding,
+            expiresAt: selected.expiresAt,
+        });
+    }
+    return approvePermission(invocation, root, agentDir, policy, previous, requests, selected, run);
+}
+async function approvePermission(invocation, root, agentDir, policy, previous, requests, selected, run) {
+    const seconds = approvalSeconds(invocation.options.expires);
+    const configuration = loadHandsConfiguration(invocation.options.hands ?? process.env.SEPT_HANDS_CONFIGURATION);
+    await validateDockerConfiguration(configuration, [agentDir, root], run.manifest().workspace, undefined, { policyPath: policy.path, initialize: false });
+    const binding = capabilityBinding(configuration);
+    if (duplicateApproval(selected, previous, binding)) {
+        return selected;
+    }
+    await assertCapabilityExpansion(previous, previous, true, root, binding, configuration);
+    // Policy activation first: a crash before the exact decision leaves no usable grant.
+    if (run.snapshot().status !== "waiting") {
+        throw new SeptError("Original request was cancelled before approval activation");
+    }
+    const activated = policy.activate(previous, binding, previous.revision);
+    if (run.snapshot().status !== "waiting") {
+        throw new SeptError("Original request was cancelled before its decision became active");
+    }
+    return requests.decide(selected.id, selected.digest, {
+        status: "approved",
+        revision: activated.revision,
+        binding: activated.binding,
+        expiresAt: Math.min(selected.expiresAt, Date.now() + seconds * 1000),
+    });
+}
+function approvalSeconds(value) {
+    const seconds = Number(value ?? "300");
+    if (!Number.isInteger(seconds) || seconds < 1 || seconds > 3600) {
+        throw new SeptError("Approval expiry must be between 1 and 3600 seconds");
+    }
+    return seconds;
+}
+function duplicateApproval(selected, previous, binding) {
+    if (selected.decision !== undefined) {
+        if (selected.decision.status !== "approved" ||
+            JSON.stringify(selected.decision.binding) !== JSON.stringify(binding) ||
+            selected.decision.revision !== previous.revision) {
+            throw new SeptError("Permission decision conflicts with its durable predecessor");
+        }
+        return true;
+    }
+    if (previous.mode !== "request_approval" ||
+        previous.revision !== selected.revision ||
+        JSON.stringify(previous.binding) !== JSON.stringify(selected.binding)) {
+        throw new SeptError("Permission source namespace or revision changed; request again");
+    }
+    return false;
+}
+/** Installed direct explicit retry shares accepted input/wake and never resets original limits. */
+export async function resumePermissionRun(context, root, agentDir) {
+    const id = context.options.resume;
+    if (id === undefined) {
+        return undefined;
+    }
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(id) || context.options.message === undefined) {
+        throw new CliError("run --resume requires an exact run identity and --message");
+    }
+    const allowed = ["resume", "message", "state-dir", "agent-dir", "hands"];
+    if (Object.keys(context.options).some((key) => !allowed.includes(key))) {
+        throw new CliError("Resuming preserves the original task, model and limits");
+    }
+    const store = new RunStore(join(root, id));
+    assertHandsRunProfile(store);
+    if (store.snapshot().status !== "waiting" || store.snapshot().permissionRequestId === undefined) {
+        throw new CliError("Explicit local permission retry requires its still-waiting original run");
+    }
+    await validateRetryConfiguration(context, root, agentDir, store);
+    const message = store.enqueueMessage(context.options.message);
+    wakeRunForOperator(store, message.id);
+    return store;
+}
+async function validateRetryConfiguration(context, root, agentDir, store) {
+    const configuration = loadHandsConfiguration(context.options.hands ?? process.env.SEPT_HANDS_CONFIGURATION);
+    const policy = new CapabilityPolicyStore(root);
+    await validateDockerConfiguration(configuration, [agentDir, root], store.manifest().workspace, undefined, { policyPath: policy.path, initialize: false });
+    const current = policy.read();
+    if (current === undefined ||
+        current.denied ||
+        JSON.stringify(current.binding) !== JSON.stringify(capabilityBinding(configuration))) {
+        throw new CliError("Explicit retry requires its current validated capability binding");
+    }
+}
+/** Local direct admission keeps drained state and every other resident run outside the selected retry. */
+export function assertLocalRunSlot(root, selectedRunId) {
+    if (new WorkerLifecycleStore(root).read().readiness !== "accepting") {
+        throw new SeptError("worker state root is drained and not accepting new work");
+    }
+    const busy = listRuns(root).some((store) => {
+        const status = store.snapshot().status;
+        return (store.runId !== selectedRunId &&
+            (status === "active" || status === "waiting" || status === "cancelling"));
+    });
+    if (busy) {
+        throw new SeptError("single worker slot is busy");
+    }
+}
+//# sourceMappingURL=permission-decisions.js.map

package/dist/src/cli/permission-decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-decisions.js","sourceRoot":"","sources":["../../../src/cli/permission-decisions.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,QAAQ,EACR,QAAQ,EACR,oBAAoB,EACpB,SAAS,GAEV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,SAAS,iBAAiB,CAAC,UAAyB,EAAE,QAAgC;IACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AACD,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAyB,EACzB,IAAY,EACZ,QAAgB,EAChB,MAA6B,EAC7B,QAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IACD,IACE,QAAQ,KAAK,SAAS;QACtB,QAAQ,CAAC,MAAM;QACf,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,uBAAuB,CAC5B,UAAU,EACV,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,GAAG,CACJ,CAAC;AACJ,CAAC;AACD,SAAS,kBAAkB,CAAC,UAAyB,EAAE,QAAgC;IACrF,IAAI,UAAU,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,KAAK,UAAU,uBAAuB,CACpC,UAAyB,EACzB,IAAY,EACZ,QAAgB,EAChB,MAA6B,EAC7B,QAA0B,EAC1B,QAAgC,EAChC,QAAyD,EACzD,GAAa;IAEb,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,8FAA8F;QAC9F,sBAAsB,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE;YACnD,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;AAClG,CAAC;AACD,KAAK,UAAU,iBAAiB,CAC9B,UAAyB,EACzB,IAAY,EACZ,QAAgB,EAChB,MAA6B,EAC7B,QAA0B,EAC1B,QAAgC,EAChC,QAAyD,EACzD,GAAa;IAEb,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,sBAAsB,CAC1C,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACjE,CAAC;IACF,MAAM,2BAA2B,CAC/B,aAAa,EACb,CAAC,QAAQ,EAAE,IAAI,CAAC,EAChB,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EACxB,SAAS,EACT,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAC/C,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACnD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACxF,qFAAqF;IACrF,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CAAC,kEAAkE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE;QACnD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC;KACrE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAyB;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,SAAS,iBAAiB,CACxB,QAAyD,EACzD,QAA0B,EAC1B,OAAwD;IAExD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,IACE,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU;YACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YACrE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ,EAChD,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,QAAQ,CAAC,IAAI,KAAK,kBAAkB;QACpC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;QACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAsB,EACtB,IAAY,EACZ,QAAgB;IAEhB,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,QAAQ,CAAC,2DAA2D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,QAAQ,CAAC,wDAAwD,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3C,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,0BAA0B,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,OAAsB,EACtB,IAAY,EACZ,QAAgB,EAChB,KAAe;IAEf,MAAM,aAAa,GAAG,sBAAsB,CAC1C,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAC9D,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,2BAA2B,CAC/B,aAAa,EACb,CAAC,QAAQ,EAAE,IAAI,CAAC,EAChB,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,EAC1B,SAAS,EACT,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAC/C,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,OAAO,KAAK,SAAS;QACrB,OAAO,CAAC,MAAM;QACd,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,EACpF,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,kEAAkE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,aAAsB;IACrE,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,KAAK,WAAW,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;QACvC,OAAO,CACL,KAAK,CAAC,KAAK,KAAK,aAAa;YAC7B,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,YAAY,CAAC,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/src/cli/permissions.d.ts

@@ -0,0 +1,7 @@
+import { type CapabilityConfiguration, type CapabilityPolicy } from "../durable/index.js";
+import { type DockerHandsConfiguration } from "../execution/index.js";
+import type { CliInvocation } from "./options.js";
+/** Validate exclusive old ownership and a truly fresh target before expanding or rebinding authority. */
+export declare function assertCapabilityExpansion(previous: CapabilityPolicy, effective: CapabilityConfiguration, changed: boolean, root: string, next: import("../durable/index.js").CapabilityBinding, configuration: DockerHandsConfiguration): Promise<void>;
+/** Installed operator writer: validate first, persist narrow/deny, then stop and verify old effects. */
+export declare function runPermissions(invocation: CliInvocation, root: string, agentDir: string): Promise<unknown>;

package/dist/src/cli/permissions.js

@@ -0,0 +1,140 @@
+/** Local operator policy commands never enter the ordinary HTTP/task/model control surface. */
+import { mkdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { CapabilityPolicyStore, acquireStateRootLease, parseCapabilityConfiguration, SeptError, } from "../durable/index.js";
+import { capabilityBinding, capabilityGrants, defaultCapabilities, validateDockerConfiguration, revokeDockerBinding, reconcileDockerBinding, loadHandsConfiguration, validateCapabilities, } from "../execution/index.js";
+import { permissionDecision } from "./permission-decisions.js";
+function localConfiguration(path) {
+    if (path === undefined || statSync(path).size > 16 * 1024) {
+        throw new SeptError("permissions set requires bounded --policy input");
+    }
+    try {
+        const value = JSON.parse(readFileSync(path, "utf8"));
+        return parseCapabilityConfiguration(value);
+    }
+    catch (error) {
+        throw new SeptError("Capability configuration is malformed", { cause: error });
+    }
+}
+function expands(previous, next) {
+    if (previous.denied ||
+        (next.execute && !previous.execute) ||
+        (next.network && !previous.network)) {
+        return true;
+    }
+    const grants = capabilityGrants(previous);
+    return capabilityGrants(next).some((entry) => {
+        const before = grants.find((grant) => grant.root === entry.root);
+        return (entry.read && before?.read !== true) || (entry.write && before?.write !== true);
+    });
+}
+function revision(options) {
+    const value = Number(options.revision);
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new SeptError("permissions mutation requires --revision from permissions show");
+    }
+    return value;
+}
+function inputConfiguration(invocation, configuration) {
+    if (invocation.options.policy !== undefined) {
+        if (invocation.options.mode !== undefined) {
+            throw new SeptError("Choose --policy or --mode, not both");
+        }
+        return localConfiguration(invocation.options.policy);
+    }
+    if (invocation.options.mode === "request_approval") {
+        return { ...defaultCapabilities(), mode: "request_approval" };
+    }
+    if (invocation.options.mode === "scoped") {
+        return defaultCapabilities();
+    }
+    if (invocation.options.mode === "full_access") {
+        return { ...defaultCapabilities(), mode: "full_access", execute: configuration.shell };
+    }
+    return localConfiguration(undefined);
+}
+/** Validate exclusive old ownership and a truly fresh target before expanding or rebinding authority. */
+export async function assertCapabilityExpansion(previous, effective, changed, root, next, configuration) {
+    if (!changed && !expands(previous, effective)) {
+        return;
+    }
+    const leaseRoot = join(root, ".hands-leases", previous.binding.containerId);
+    const fresh = previous.binding.containerId !== next.containerId ||
+        previous.binding.generation !== next.generation;
+    if (!fresh) {
+        throw new SeptError("Expansion requires quiescence and a fresh validated backend generation");
+    }
+    const release = acquireStateRootLease(leaseRoot);
+    try {
+        await reconcileDockerBinding(previous.binding, configuration, {
+            policyPath: join(root, "capability-policy.json"),
+        });
+    }
+    finally {
+        release();
+    }
+}
+async function setPermissions(invocation, root, agentDir, store, previous) {
+    const configuration = loadHandsConfiguration(invocation.options.hands ?? process.env.SEPT_HANDS_CONFIGURATION);
+    const effective = validateCapabilities(inputConfiguration(invocation, configuration), configuration);
+    await validateDockerConfiguration(configuration, [agentDir, root], undefined, undefined, {
+        policyPath: store.path,
+        initialize: previous === undefined,
+    });
+    const binding = capabilityBinding(configuration);
+    const changed = previous !== undefined && JSON.stringify(previous.binding) !== JSON.stringify(binding);
+    if (previous !== undefined) {
+        await assertCapabilityExpansion(previous, effective, changed, root, binding, configuration);
+    }
+    const activated = store.activate(effective, binding, revision(invocation.options));
+    if (previous !== undefined && !changed) {
+        await revokeDockerBinding(previous.binding, configuration, { policyPath: store.path });
+    }
+    return {
+        revision: activated.revision,
+        denied: false,
+        mode: activated.mode,
+        freshBackendRequired: previous !== undefined && !changed,
+    };
+}
+/** Installed operator writer: validate first, persist narrow/deny, then stop and verify old effects. */
+export async function runPermissions(invocation, root, agentDir) {
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const store = new CapabilityPolicyStore(root);
+    const previous = store.read();
+    if (["requests", "inspect", "approve", "deny"].includes(invocation.action ?? "")) {
+        return permissionDecision(invocation, root, agentDir, store, previous);
+    }
+    if (invocation.action === "show") {
+        return (previous ?? {
+            version: 1,
+            revision: 0,
+            denied: true,
+            reason: "operator configuration required",
+        });
+    }
+    const expected = revision(invocation.options);
+    if ((previous?.revision ?? 0) !== expected) {
+        throw new SeptError("Capability revision changed; inspect and retry");
+    }
+    if (invocation.action === "revoke") {
+        return revokePermissions(invocation, store, expected);
+    }
+    if (invocation.action !== "set") {
+        throw new SeptError("Usage: sept permissions show|set|revoke --state-dir <path>");
+    }
+    return setPermissions(invocation, root, agentDir, store, previous);
+}
+async function revokePermissions(invocation, store, expected) {
+    const configuration = loadHandsConfiguration(invocation.options.hands ?? process.env.SEPT_HANDS_CONFIGURATION);
+    const previous = store.read();
+    if (previous === undefined ||
+        JSON.stringify(previous.binding) !== JSON.stringify(capabilityBinding(configuration))) {
+        throw new SeptError("Revocation configuration does not match persisted capability authority");
+    }
+    // Incompatible cold configuration cannot mutate records; valid revocation still denies before stop.
+    const denied = store.revoke(expected);
+    await revokeDockerBinding(denied.binding, configuration, { policyPath: store.path });
+    return { revision: denied.revision, denied: true, stopped: true };
+}
+//# sourceMappingURL=permissions.js.map

package/dist/src/cli/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/cli/permissions.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,4BAA4B,EAC5B,SAAS,GAGV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,GAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAG/D,SAAS,kBAAkB,CAAC,IAAwB;IAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9D,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AACD,SAAS,OAAO,CAAC,QAA0B,EAAE,IAA6B;IACxE,IACE,QAAQ,CAAC,MAAM;QACf,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnC,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AACD,SAAS,QAAQ,CAAC,OAA+B;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,kBAAkB,CACzB,UAAyB,EACzB,aAAuC;IAEvC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACnD,OAAO,EAAE,GAAG,mBAAmB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC9C,OAAO,EAAE,GAAG,mBAAmB,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAA0B,EAC1B,SAAkC,EAClC,OAAgB,EAChB,IAAY,EACZ,IAAqD,EACrD,aAAuC;IAEvC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,KAAK,GACT,QAAQ,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACjD,QAAQ,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE;YAC5D,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,UAAyB,EACzB,IAAY,EACZ,QAAgB,EAChB,KAA4B,EAC5B,QAAsC;IAEtC,MAAM,aAAa,GAAG,sBAAsB,CAC1C,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACjE,CAAC;IACF,MAAM,SAAS,GAAG,oBAAoB,CACpC,kBAAkB,CAAC,UAAU,EAAE,aAAa,CAAC,EAC7C,aAAa,CACd,CAAC;IACF,MAAM,2BAA2B,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;QACvF,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,UAAU,EAAE,QAAQ,KAAK,SAAS;KACnC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,OAAO,GACX,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,yBAAyB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,oBAAoB,EAAE,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO;KACzD,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAyB,EACzB,IAAY,EACZ,QAAgB;IAEhB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACjF,OAAO,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,CACL,QAAQ,IAAI;YACV,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,iCAAiC;SAC1C,CACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,UAAyB,EACzB,KAA4B,EAC5B,QAAgB;IAEhB,MAAM,aAAa,GAAG,sBAAsB,CAC1C,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CACjE,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9B,IACE,QAAQ,KAAK,SAAS;QACtB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,EACrF,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,wEAAwE,CAAC,CAAC;IAChG,CAAC;IACD,oGAAoG;IACpG,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpE,CAAC"}

package/dist/src/cli.d.ts

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+/**
+ * Installed SEPT CLI entry point. It owns process arguments, package metadata, top-level telemetry,
+ * and exit presentation while delegating every command to public mechanism boundaries.
+ */
+export {};

package/dist/src/cli.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+/**
+ * Installed SEPT CLI entry point. It owns process arguments, package metadata, top-level telemetry,
+ * and exit presentation while delegating every command to public mechanism boundaries.
+ */
+import { executeCommand, resolveAgentDirectory } from "./cli/commands.js";
+import { parseCliInvocation } from "./cli/options.js";
+import { classifyError, createTelemetry, NOOP_TELEMETRY } from "./observability/index.js";
+import { packageMetadata } from "./package-metadata.js";
+let telemetry = NOOP_TELEMETRY;
+async function main() {
+    const invocation = parseCliInvocation(process.argv);
+    if (invocation === undefined) {
+        process.stderr.write("Usage: sept worker|run|doctor|health|models|auth|permissions [action] [options]\n");
+        process.exitCode = 2;
+        return;
+    }
+    const metadata = packageMetadata();
+    if (invocation.command === "worker" || invocation.command === "run") {
+        telemetry = createTelemetry({
+            serviceVersion: metadata.septVersion,
+            command: invocation.command,
+        });
+    }
+    process.title = `SEPT ${invocation.command}`;
+    await executeCommand({
+        ...invocation,
+        ...metadata,
+        agentDir: resolveAgentDirectory(invocation.options),
+        telemetry,
+    });
+}
+await main().catch(async (error) => {
+    telemetry.log("process.failed", { "sept.outcome": "failure", "error.type": classifyError(error) }, "error");
+    await telemetry.shutdown();
+    process.stderr.write(`sept: ${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/src/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,IAAI,SAAS,GAAG,cAAc,CAAC;AAE/B,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mFAAmF,CACpF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QACpE,SAAS,GAAG,eAAe,CAAC;YAC1B,cAAc,EAAE,QAAQ,CAAC,WAAW;YACpC,OAAO,EAAE,UAAU,CAAC,OAAO;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,QAAQ,UAAU,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,cAAc,CAAC;QACnB,GAAG,UAAU;QACb,GAAG,QAAQ;QACX,QAAQ,EAAE,qBAAqB,CAAC,UAAU,CAAC,OAAO,CAAC;QACnD,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAC1C,SAAS,CAAC,GAAG,CACX,gBAAgB,EAChB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,EACjE,OAAO,CACR,CAAC;IACF,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;IAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/src/client/client.d.ts

@@ -0,0 +1,5 @@
+/** Five-method facade over existing stable-ID webhooks and authoritative task HTTP routes. */
+import type { TaskClient, TaskClientOptions } from "./contracts.js";
+/** Create an import-safe HTTP client with explicit worker authority and no retry/polling state. */
+export declare function createTaskClient(options: TaskClientOptions): TaskClient;
+export { TaskClientError } from "./errors.js";

package/dist/src/client/client.js

@@ -0,0 +1,75 @@
+import { clientConfiguration, conversationQuery, encodeEnvelope, requestSignal, runIdentifier, } from "./request-codecs.js";
+import { cancelResult, conversationPage, messageAdmission, taskAdmission, taskProjection, } from "./response-codecs.js";
+import { requestJson } from "./transport.js";
+import { TaskClientError } from "./errors.js";
+function taskBody(input) {
+    try {
+        return encodeEnvelope(input, {
+            version: 1,
+            source: input.source,
+            eventId: input.eventId,
+            kind: "task",
+            task: input.task,
+        });
+    }
+    catch {
+        throw new TaskClientError("configuration");
+    }
+}
+function messageBody(input) {
+    try {
+        const runId = runIdentifier(input.runId);
+        const body = encodeEnvelope(input, {
+            version: 1,
+            source: input.source,
+            eventId: input.eventId,
+            kind: "operator_message",
+            runId,
+            message: input.message,
+        });
+        return { runId, body };
+    }
+    catch {
+        throw new TaskClientError("configuration");
+    }
+}
+async function createTask(configuration, input, options) {
+    const body = taskBody(input);
+    const response = await requestJson(configuration, "/v1/webhooks", "POST", body, requestSignal(options));
+    return taskAdmission(response.body, response.status);
+}
+async function sendMessage(configuration, input, options) {
+    const { runId, body } = messageBody(input);
+    const response = await requestJson(configuration, "/v1/webhooks", "POST", body, requestSignal(options));
+    return messageAdmission(response.body, response.status, runId);
+}
+async function getTask(configuration, input, options) {
+    const runId = runIdentifier(input);
+    const response = await requestJson(configuration, `/v1/tasks/${runId}`, "GET", undefined, requestSignal(options));
+    return taskProjection(response.body, response.status, runId);
+}
+async function getConversation(configuration, input, options) {
+    const runId = runIdentifier(input);
+    const { after, limit } = conversationQuery(options);
+    const path = `/v1/tasks/${runId}/conversation?after=${String(after)}&limit=${String(limit)}`;
+    const response = await requestJson(configuration, path, "GET", undefined, requestSignal(options), "conversation");
+    return conversationPage(response.body, response.status, after, limit);
+}
+async function cancel(configuration, input, options) {
+    const runId = runIdentifier(input);
+    const response = await requestJson(configuration, `/v1/tasks/${runId}/cancel`, "POST", undefined, requestSignal(options));
+    return cancelResult(response.body, response.status, runId);
+}
+/** Create an import-safe HTTP client with explicit worker authority and no retry/polling state. */
+export function createTaskClient(options) {
+    const configuration = clientConfiguration(options);
+    return {
+        createTask: (input, options) => createTask(configuration, input, options),
+        sendMessage: (input, options) => sendMessage(configuration, input, options),
+        getTask: (runId, options) => getTask(configuration, runId, options),
+        getConversation: (runId, options) => getConversation(configuration, runId, options),
+        cancel: (runId, options) => cancel(configuration, runId, options),
+    };
+}
+export { TaskClientError } from "./errors.js";
+//# sourceMappingURL=client.js.map

package/dist/src/client/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/client/client.ts"],"names":[],"mappings":"AAcA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,GAEd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,SAAS,QAAQ,CAAC,KAAsB;IACtC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,KAAK,EAAE;YAC3B,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAuB;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE;YACjC,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,kBAAkB;YACxB,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,aAAkC,EAClC,KAAsB,EACtB,OAAwB;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,aAAa,EACb,cAAc,EACd,MAAM,EACN,IAAI,EACJ,aAAa,CAAC,OAAO,CAAC,CACvB,CAAC;IACF,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,aAAkC,EAClC,KAAuB,EACvB,OAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,aAAa,EACb,cAAc,EACd,MAAM,EACN,IAAI,EACJ,aAAa,CAAC,OAAO,CAAC,CACvB,CAAC;IACF,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,aAAkC,EAClC,KAAa,EACb,OAAwB;IAExB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,aAAa,EACb,aAAa,KAAK,EAAE,EACpB,KAAK,EACL,SAAS,EACT,aAAa,CAAC,OAAO,CAAC,CACvB,CAAC;IACF,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAkC,EAClC,KAAa,EACb,OAA6B;IAE7B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,aAAa,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7F,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,aAAa,EACb,IAAI,EACJ,KAAK,EACL,SAAS,EACT,aAAa,CAAC,OAAO,CAAC,EACtB,cAAc,CACf,CAAC;IACF,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,aAAkC,EAClC,KAAa,EACb,OAAwB;IAExB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,aAAa,EACb,aAAa,KAAK,SAAS,EAC3B,MAAM,EACN,SAAS,EACT,aAAa,CAAC,OAAO,CAAC,CACvB,CAAC;IACF,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO;QACL,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;QACzE,WAAW,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;QAC3E,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;QACnE,eAAe,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;QACnF,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}