wicked-crew 0.5.0 → 0.7.0

package/dist/api/auth.js

@@ -0,0 +1,515 @@
+/**
+ * The daemon's identity/actor seam (task #88, locked decision #6).
+ *
+ * LOCAL IS SACRED: the default deployment stays exactly what it was — a
+ * 127.0.0.1-bound daemon with loopback CORS and NO auth, where every request
+ * implicitly acts as the full-trust local operator. Nothing in this module
+ * runs a verifier, reads a token file, or changes a response in that mode; it
+ * only pins ONE actor shape onto the request so downstream code (audit trail,
+ * bus events, gate decisions) never branches on "was there auth".
+ *
+ * TEAM/HOSTED REQUIRES AUTH: `WICKED_RUNTIME=team` or `WICKED_CREW_AUTH=required`
+ * arms a bearer-token check on `/api/v1/*` and the `/ws` upgrade paths.
+ * Verification is pluggable behind {@link TokenVerifier}; v1 ships the static
+ * workload-token verifier (hashed-at-rest file, {@link loadTokenFile}) and the
+ * OIDC verifier SEAM ({@link OidcConfig} + {@link createOidcVerifier}), whose
+ * implementation is a named follow-up — configuring OIDC today fails the boot
+ * LOUDLY rather than pretending an IdP was consulted.
+ *
+ * Deny semantics: missing/unknown token in required mode → 401 (with
+ * `WWW-Authenticate: Bearer`); an authenticated actor below a route's rung on
+ * the trust ladder → 403. The ladder is {@link requiredTrust} — minimal and
+ * documented (docs/auth.md), not a per-route registry.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { constants, createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { API_PREFIX } from './api-prefix.js';
+/**
+ * The implicit full-trust local operator. `admin` is the ladder's top rung —
+ * the local single-operator deployment has exactly one human and no boundary
+ * to enforce between that human and the daemon, so "full trust" and "admin"
+ * are the same fact spelled once.
+ */
+export const LOCAL_ACTOR = Object.freeze({
+    id: 'local',
+    kind: 'human',
+    trust: 'admin',
+});
+const TRUST_RANK = { observer: 0, operator: 1, admin: 2 };
+const KINDS = new Set(['human', 'agent', 'system']);
+const TRUSTS = new Set(['observer', 'operator', 'admin']);
+/** True when `actor` sits at or above `min` on the ladder. */
+export function trustAtLeast(actor, min) {
+    return TRUST_RANK[actor.trust] >= TRUST_RANK[min];
+}
+/**
+ * Resolve the daemon's auth mode. DENY-DOMINANT: `WICKED_RUNTIME=team` forces
+ * `required` and nothing can talk it back down — a team runtime with auth
+ * switched off is exactly the silently-ungoverned state this seam exists to
+ * prevent. Outside team runtime, `WICKED_CREW_AUTH` (`required`|`off`) is
+ * explicit; unset means the local default, off.
+ */
+export function resolveAuthMode(env = process.env) {
+    if (env['WICKED_RUNTIME']?.trim().toLowerCase() === 'team')
+        return 'required';
+    const explicit = env['WICKED_CREW_AUTH']?.trim().toLowerCase();
+    if (explicit === undefined || explicit === '' || explicit === 'off')
+        return 'off';
+    if (explicit === 'required')
+        return 'required';
+    // An unknown value fails LOUD rather than defaulting to off: a typo'd
+    // `WICKED_CREW_AUTH=reqired` silently running unauthenticated is the worst
+    // possible reading of an operator's stated intent to authenticate.
+    throw new Error(`WICKED_CREW_AUTH must be 'required' or 'off' (got '${explicit}')`);
+}
+/** Where the workload-token file lives unless overridden. */
+export function defaultTokensPath(env = process.env) {
+    return env['WICKED_CREW_TOKENS'] ?? join(homedir(), '.config', 'wicked-crew', 'tokens.json');
+}
+/** `sha256` hex of a presented token — the only form the daemon stores or compares. */
+export function tokenHash(token) {
+    return createHash('sha256').update(token, 'utf8').digest('hex');
+}
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * Parse a tokens.json payload into a hash→actor map. FAILS CLOSED on any
+ * malformed entry: a typo'd trust level that silently skipped its entry would
+ * lock an operator out (or, worse, a hand-edit that half-parsed would demote
+ * someone) with nothing saying so. The error names the entry index and field.
+ */
+export function parseTokenFile(json, source) {
+    let raw;
+    try {
+        raw = JSON.parse(json);
+    }
+    catch (err) {
+        throw new Error(`${source}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+    }
+    const file = raw;
+    if (typeof file !== 'object' || file === null || !Array.isArray(file.tokens)) {
+        throw new Error(`${source}: expected { "version": 1, "tokens": [...] }`);
+    }
+    if (file.version !== undefined && file.version !== 1) {
+        throw new Error(`${source}: unsupported version ${JSON.stringify(file.version)} (this build reads version 1)`);
+    }
+    const map = new Map();
+    file.tokens.forEach((entry, i) => {
+        const e = entry;
+        const at = `${source}: tokens[${i}]`;
+        if (typeof e?.sha256 !== 'string' || !SHA256_HEX.test(e.sha256)) {
+            throw new Error(`${at}: 'sha256' must be 64 lowercase hex chars (sha256 of the token)`);
+        }
+        const a = e.actor;
+        if (typeof a?.id !== 'string' || a.id.length === 0 || a.id.length > 128) {
+            throw new Error(`${at}: 'actor.id' must be a non-empty string (≤128 chars)`);
+        }
+        if (typeof a.kind !== 'string' || !KINDS.has(a.kind)) {
+            throw new Error(`${at}: 'actor.kind' must be 'human' | 'agent' | 'system'`);
+        }
+        if (typeof a.trust !== 'string' || !TRUSTS.has(a.trust)) {
+            throw new Error(`${at}: 'actor.trust' must be 'observer' | 'operator' | 'admin'`);
+        }
+        if (map.has(e.sha256)) {
+            throw new Error(`${at}: duplicate token hash (also used by an earlier entry)`);
+        }
+        map.set(e.sha256, Object.freeze({ id: a.id, kind: a.kind, trust: a.trust }));
+    });
+    return map;
+}
+/**
+ * Load `tokens.json` from disk into a static verifier. A MISSING file is a
+ * loud warning, not a boot failure: the daemon still starts and every request
+ * 401s, which is the honest fail-closed posture (an unreachable daemon tells
+ * the operator less than one that answers "no tokens are registered").
+ * A PRESENT-but-malformed file fails the boot — see {@link parseTokenFile}.
+ */
+export function loadTokenFile(path, warn) {
+    let json;
+    try {
+        json = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            warn(`[auth] required mode with NO token file at ${path} — every /api/v1 and /ws request will 401 ` +
+                `until tokens are registered (docs/auth.md § "Workload tokens")`);
+            return new Map();
+        }
+        throw new Error(`[auth] cannot read token file ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // Hashes, not tokens, live in this file — but its actor/trust mappings are
+    // still authorization state, so a group/world-writable file is worth a shout.
+    if (process.platform !== 'win32') {
+        try {
+            const mode = statSync(path).mode & 0o077;
+            if (mode !== 0) {
+                warn(`[auth] ${path} is group/world-accessible (mode ${(statSync(path).mode & 0o777).toString(8)}) — chmod 600 recommended`);
+            }
+        }
+        catch {
+            /* stat raced a delete; the read above already succeeded */
+        }
+    }
+    return parseTokenFile(json, path);
+}
+/** The static workload-token verifier: sha256 the presented token, look it up. */
+export function createStaticVerifier(entries) {
+    return {
+        name: 'static-tokens',
+        verify: (token) => Promise.resolve(entries.get(tokenHash(token)) ?? null),
+    };
+}
+/** Where the auth config (OIDC seam) lives unless overridden. */
+export function defaultAuthConfigPath(env = process.env) {
+    return env['WICKED_CREW_AUTH_CONFIG'] ?? join(homedir(), '.config', 'wicked-crew', 'auth.json');
+}
+/** Per-issuer JWKS cache: keys indexed by kid (or by alg when kid is absent). */
+const JWKS_CACHE = new Map();
+const JWKS_TTL_MS = 5 * 60 * 1000; // 5-min TTL; synchronous re-fetch on stale or unknown kid
+function base64urlDecode(s) {
+    const pad = (4 - (s.length % 4)) % 4;
+    return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(pad), 'base64');
+}
+async function fetchJson(url) {
+    const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} fetching ${url}`);
+    return res.json();
+}
+async function fetchJwks(jwksUri) {
+    const doc = await fetchJson(jwksUri);
+    const map = new Map();
+    for (const key of doc.keys ?? []) {
+        if (key.use !== undefined && key.use !== 'sig')
+            continue;
+        // Index by kid; fall back to alg when kid is absent.
+        const index = key.kid ?? key.alg ?? key.kty;
+        map.set(index, key);
+    }
+    return map;
+}
+async function resolveJwksUri(config) {
+    if (config.jwksUri)
+        return config.jwksUri;
+    const discovery = await fetchJson(`${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`);
+    return discovery.jwks_uri;
+}
+async function getJwk(config, kid, allowRefresh) {
+    const cached = JWKS_CACHE.get(config.issuer);
+    const stale = !cached || Date.now() - cached.fetchedAt > JWKS_TTL_MS;
+    if (cached && !stale) {
+        const hit = cached.keys.get(kid);
+        if (hit)
+            return hit;
+        if (!allowRefresh)
+            return null;
+    }
+    // Fetch (or re-fetch on stale/miss).
+    const uri = await resolveJwksUri(config);
+    const keys = await fetchJwks(uri);
+    JWKS_CACHE.set(config.issuer, { keys, fetchedAt: Date.now() });
+    return keys.get(kid) ?? null;
+}
+// Supported algorithm → hash algorithm pairs.
+const ALG_HASH = {
+    RS256: 'SHA256', RS384: 'SHA384', RS512: 'SHA512',
+    ES256: 'SHA256', ES384: 'SHA384', ES512: 'SHA512',
+    PS256: 'SHA256', PS384: 'SHA384', PS512: 'SHA512',
+};
+function verifySignature(headerPayload, sig, jwk, alg) {
+    const hashAlg = ALG_HASH[alg];
+    if (!hashAlg)
+        return false;
+    try {
+        const key = createPublicKey({ key: jwk, format: 'jwk' });
+        const opts = alg.startsWith('PS')
+            ? { padding: constants.RSA_PKCS1_PSS_PADDING, saltLength: constants.RSA_PSS_SALTLEN_DIGEST }
+            : alg.startsWith('ES')
+                ? { dsaEncoding: 'ieee-p1363' }
+                : {};
+        return cryptoVerify(hashAlg, Buffer.from(headerPayload), { key, ...opts }, sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify a raw JWT string against the issuer's JWKS. Returns the decoded
+ * payload on success or throws a descriptive error on failure.
+ */
+async function verifyJwt(token, config) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        throw new Error('malformed JWT: expected 3 dot-separated parts');
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(base64urlDecode(parts[0]).toString('utf8'));
+        payload = JSON.parse(base64urlDecode(parts[1]).toString('utf8'));
+    }
+    catch {
+        throw new Error('malformed JWT: header or payload is not valid base64url JSON');
+    }
+    const alg = header.alg ?? '';
+    if (!ALG_HASH[alg])
+        throw new Error(`unsupported JWT algorithm: ${alg}`);
+    const kid = header.kid ?? alg;
+    const sig = base64urlDecode(parts[2]);
+    const headerPayload = `${parts[0]}.${parts[1]}`;
+    // Try cached key first; re-fetch once on unknown kid.
+    const jwk = await getJwk(config, kid, true);
+    if (!jwk)
+        throw new Error(`no JWKS key found for kid=${JSON.stringify(kid)}`);
+    if (!verifySignature(headerPayload, sig, jwk, alg)) {
+        throw new Error('JWT signature verification failed');
+    }
+    // Claim validation.
+    const now = Math.floor(Date.now() / 1000);
+    if (typeof payload.iss !== 'string' || payload.iss !== config.issuer) {
+        throw new Error(`JWT issuer mismatch: expected ${config.issuer}, got ${JSON.stringify(payload.iss)}`);
+    }
+    const audList = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (!audList.includes(config.audience)) {
+        throw new Error(`JWT audience mismatch: expected ${config.audience}, got ${JSON.stringify(payload.aud)}`);
+    }
+    if (typeof payload.exp !== 'number') {
+        throw new Error('JWT is missing required exp claim');
+    }
+    if (payload.exp <= now) {
+        throw new Error('JWT has expired (exp)');
+    }
+    if (typeof payload.nbf === 'number' && payload.nbf > now) {
+        throw new Error('JWT is not yet valid (nbf)');
+    }
+    return payload;
+}
+function mapOidcActor(payload, config) {
+    const idClaim = config.claims?.id ?? 'sub';
+    const rawId = payload[idClaim];
+    const id = typeof rawId === 'string' && rawId.length > 0 ? rawId : payload.sub ?? '';
+    if (!id)
+        throw new Error(`JWT has no value for id claim '${idClaim}' or 'sub'`);
+    const trustClaim = config.claims?.trust;
+    const rawTrust = trustClaim ? payload[trustClaim] : undefined;
+    const defaultTrust = config.defaultTrust ?? 'observer';
+    const rawTrustStr = String(rawTrust);
+    const trust = TRUSTS.has(rawTrustStr) ? rawTrustStr : defaultTrust;
+    return Object.freeze({ id, kind: 'human', trust });
+}
+/**
+ * Create an OIDC verifier that validates JWTs against the issuer's JWKS.
+ * Supports RS256/384/512, ES256/384/512, PS256/384/512. JWKS keys are cached
+ * per issuer with a 5-minute TTL and auto-refreshed on unknown kid.
+ */
+export function createOidcVerifier(config) {
+    // Validate config at creation time — a misconfigured issuer URL is caught
+    // immediately at boot rather than silently during the first verification.
+    if (!config.issuer || !config.issuer.startsWith('https://')) {
+        throw new Error(`[auth] OIDC config: 'issuer' must be an https:// URL (got ${JSON.stringify(config.issuer)})`);
+    }
+    if (config.defaultTrust !== undefined && !TRUSTS.has(config.defaultTrust)) {
+        throw new Error(`[auth] OIDC config: 'defaultTrust' must be observer|operator|admin (got ${JSON.stringify(config.defaultTrust)})`);
+    }
+    if (!config.audience) {
+        throw new Error(`[auth] OIDC config: 'audience' is required`);
+    }
+    return {
+        name: 'oidc',
+        async verify(token) {
+            // A JWT has exactly 3 base64url segments separated by dots. Static
+            // workload tokens are opaque strings and won't have this shape — the
+            // verifier chain tries static-tokens first, so if we get called the
+            // token isn't a known workload token. But don't assume it's a JWT either.
+            if (!token.includes('.'))
+                return null; // clearly not a JWT; pass through
+            try {
+                const payload = await verifyJwt(token, config);
+                return mapOidcActor(payload, config);
+            }
+            catch {
+                // Any verification failure → null so the chain can try the next
+                // verifier (or 401 if none match). The deny-401 path logs the failure.
+                return null;
+            }
+        },
+    };
+}
+/** Resolve mode + verifier chain. Reads files ONLY in required mode. */
+export function resolveAuth(options, warn) {
+    const mode = options?.mode ?? resolveAuthMode();
+    const originsEnv = process.env['WICKED_CREW_ALLOWED_ORIGINS'];
+    const allowedOrigins = options?.allowedOrigins ??
+        (originsEnv !== undefined && originsEnv.trim() !== ''
+            ? originsEnv.split(',').map((o) => o.trim()).filter(Boolean)
+            : null);
+    if (mode === 'off') {
+        // Local default: no verifier exists, no file is read, no request is denied.
+        return { mode, verifiers: [], allowedOrigins };
+    }
+    if (options?.verifiers !== undefined) {
+        return { mode, verifiers: options.verifiers, allowedOrigins };
+    }
+    const verifiers = [
+        createStaticVerifier(loadTokenFile(options?.tokensPath ?? defaultTokensPath(), warn)),
+    ];
+    // The OIDC seam: configuring it today is a LOUD boot failure, never a silent skip.
+    const configPath = options?.configPath ?? defaultAuthConfigPath();
+    let configJson = null;
+    try {
+        configJson = readFileSync(configPath, 'utf8');
+    }
+    catch (err) {
+        // ONLY a missing file is the ordinary case. An unreadable-but-present
+        // auth.json (EACCES, EISDIR, …) silently skipping a configured OIDC block
+        // would be exactly the quiet misconfiguration this seam refuses to be
+        // (Copilot, #250) — so anything else fails the boot, named.
+        if (err.code !== 'ENOENT') {
+            throw new Error(`[auth] cannot read ${configPath}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        configJson = null; // no auth.json — the ordinary case
+    }
+    if (configJson !== null) {
+        let parsed;
+        try {
+            parsed = JSON.parse(configJson);
+        }
+        catch (err) {
+            throw new Error(`[auth] ${configPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (parsed.oidc !== undefined) {
+            verifiers.push(createOidcVerifier(parsed.oidc)); // throws — the declared seam
+        }
+    }
+    return { mode, verifiers, allowedOrigins };
+}
+// ── The trust ladder over routes ─────────────────────────────────────────────
+/** `PATCH /projects/:id` (exactly one segment after /projects) — see {@link requiredTrust}. */
+const PROJECT_DETAIL_PATH = new RegExp(`^${API_PREFIX}/projects/[^/]+$`);
+/**
+ * Minimum trust for a request. Minimal by design (the task's rule: no
+ * deny-by-default registry over unknown routes):
+ *
+ * - `/ws/terminals` and any sub-path → `operator` (write-capable WS channel;
+ *   inbound frames are raw PTY stdin regardless of the GET upgrade method)
+ * - reads (GET/HEAD) and the main `/ws` stream → `observer`
+ * - governance writes, settings writes, project archive/restore → `admin`
+ * - every other mutation (launch, gate, cancel, chats, terminals, repos,
+ *   workflows, project CRUD/membership) → `operator`
+ *
+ * `body` is consulted for exactly one rule: `PATCH /projects/:id` is an
+ * `operator` rename/describe unless the patch carries `status` (archive or
+ * restore), which changes what the whole team can attach work to — `admin`.
+ */
+export function requiredTrust(method, path, body) {
+    // /ws/terminals and any sub-path (e.g. /ws/terminals/:id) are write-capable WS
+    // channels — inbound frames are raw PTY stdin. The HTTP upgrade uses GET but the
+    // socket carries operator-level writes. Guard both with and without trailing slash.
+    if (path === '/ws/terminals' || path.startsWith('/ws/terminals/'))
+        return 'operator';
+    if (method === 'GET' || method === 'HEAD')
+        return 'observer';
+    if (path.startsWith(`${API_PREFIX}/governance/`))
+        return 'admin';
+    if (path === `${API_PREFIX}/settings`)
+        return 'admin';
+    if (method === 'PATCH' &&
+        PROJECT_DETAIL_PATH.test(path) &&
+        typeof body === 'object' &&
+        body !== null &&
+        'status' in body) {
+        return 'admin';
+    }
+    return 'operator';
+}
+/** Path without the query string. */
+function pathOf(req) {
+    const url = req.raw.url ?? req.url;
+    const q = url.indexOf('?');
+    return q >= 0 ? url.slice(0, q) : url;
+}
+/** True for the paths the auth boundary covers: the API and the WS upgrades. */
+export function isProtectedPath(path) {
+    return (path === API_PREFIX ||
+        path.startsWith(`${API_PREFIX}/`) ||
+        path === '/ws' ||
+        path.startsWith('/ws/'));
+}
+/**
+ * Extract the presented bearer token. `Authorization: Bearer <t>` everywhere;
+ * the `/ws` upgrade paths ALSO accept `?access_token=` (RFC 6750 §2.3),
+ * because the browser `WebSocket` constructor cannot set headers. Header wins
+ * when both are present.
+ */
+export function extractToken(req, path) {
+    const header = req.headers.authorization;
+    if (typeof header === 'string') {
+        const m = /^Bearer\s+(\S+)$/i.exec(header.trim());
+        if (m)
+            return m[1] ?? null;
+        return null; // a malformed Authorization header is not a token
+    }
+    if (path === '/ws' || path.startsWith('/ws/')) {
+        const raw = req.query?.access_token;
+        const first = Array.isArray(raw) ? raw[0] : raw;
+        if (typeof first === 'string' && first !== '')
+            return first;
+    }
+    return null;
+}
+async function deny401(reply, error) {
+    await reply
+        .code(401)
+        .header('WWW-Authenticate', 'Bearer realm="wicked-crew"')
+        .send({ error });
+}
+/**
+ * Install the identity (401) and trust (403) hooks.
+ *
+ * Identity runs at `onRequest` — before body parsing, and (per
+ * `@fastify/websocket`) before the upgrade completes, so a bad token is an
+ * HTTP 401 on the wire for REST and WS alike. Trust runs at `preHandler`,
+ * where the parsed body exists (the one body-dependent rule is the project
+ * archive). Both scope to {@link isProtectedPath}; the SPA shell and its
+ * assets stay public so a hosted skin can load and ASK for a token.
+ */
+export function registerAuthHooks(app, auth) {
+    app.decorateRequest('actor', null);
+    app.addHook('onRequest', async (req, reply) => {
+        const path = pathOf(req);
+        if (!isProtectedPath(path))
+            return;
+        if (auth.mode === 'off') {
+            req.actor = LOCAL_ACTOR;
+            return;
+        }
+        const token = extractToken(req, path);
+        if (token === null) {
+            return deny401(reply, 'Authentication required: send Authorization: Bearer <token>');
+        }
+        for (const verifier of auth.verifiers) {
+            const actor = await verifier.verify(token);
+            if (actor !== null) {
+                req.actor = actor;
+                return;
+            }
+        }
+        return deny401(reply, 'Invalid or unknown token');
+    });
+    app.addHook('preHandler', async (req, reply) => {
+        const path = pathOf(req);
+        if (!isProtectedPath(path))
+            return;
+        // `actor` is always set here: the onRequest hook either assigned it or
+        // already answered 401 (which skips the rest of the lifecycle).
+        const need = requiredTrust(req.method, path, req.body);
+        if (!trustAtLeast(req.actor, need)) {
+            // RETURN the reply — the idiomatic guarantee that the lifecycle stops
+            // here and the route handler is never reached (Copilot, #250).
+            return reply.code(403).send({
+                error: `Insufficient trust: this action requires '${need}' (you are '${req.actor.trust}')`,
+            });
+        }
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/api/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAG7F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAe7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAU,MAAM,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,OAAO;IACb,KAAK,EAAE,OAAO;CACf,CAAU,CAAC;AAEZ,MAAM,UAAU,GAA+B,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACtF,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpF,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAa,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3F,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,KAAY,EAAE,GAAe;IACxD,OAAO,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC9E,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAClF,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC/C,sEAAsE;IACtE,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,IAAI,CAAC,CAAC;AACtF,CAAC;AAiBD,6DAA6D;AAC7D,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,OAAO,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAC/F,CAAC;AAWD,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,GAA8C,CAAC;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,8CAA8C,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,CAAS,EAAE,EAAE;QAChD,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,MAAM,EAAE,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC;QACrC,IAAI,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAmC,CAAC;QAChD,IAAI,OAAO,CAAC,EAAE,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sDAAsD,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,qDAAqD,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAU,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAA2B;IACrE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,IAAI,CACF,8CAA8C,IAAI,4CAA4C;gBAC5F,gEAAgE,CACnE,CAAC;YACF,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;YACzC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,IAAI,oCAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAC/H,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;KAC1E,CAAC;AACJ,CAAC;AAyBD,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,OAAO,GAAG,CAAC,yBAAyB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAClG,CAAC;AAqBD,iFAAiF;AACjF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyD,CAAC;AACpF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,0DAA0D;AAE7F,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,SAAS,CAAI,GAAW;IACrC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAe,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAe,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;YAAE,SAAS;QACzD,qDAAqD;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAkB;IAC9C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,SAAS,CAC/B,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mCAAmC,CACvE,CAAC;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,MAAkB,EAClB,GAAW,EACX,YAAqB;IAErB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,WAAW,CAAC;IACrE,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;QACpB,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;IACjC,CAAC;IACD,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAClC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED,8CAA8C;AAC9C,MAAM,QAAQ,GAA2B;IACvC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;IACjD,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;IACjD,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ;CAClD,CAAC;AAEF,SAAS,eAAe,CAAC,aAAqB,EAAE,GAAW,EAAE,GAAQ,EAAE,GAAW;IAChF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/B,CAAC,CAAE,EAAE,OAAO,EAAE,SAAS,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,CAAC,sBAAsB,EAAa;YACxG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBACpB,CAAC,CAAE,EAAE,WAAW,EAAE,YAAY,EAAa;gBAC3C,CAAC,CAAE,EAAa,CAAC;QACrB,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD;;;GAGG;AACH,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,MAAkB;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAEzF,IAAI,MAAsC,CAAC;IAC3C,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAkB,CAAC;QAClF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhD,sDAAsD;IACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAE9E,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,oBAAoB;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,MAAM,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,QAAQ,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,OAAmB,EAAE,MAAkB;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IACrF,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,YAAY,CAAC,CAAC;IAEhF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,UAAU,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,GAAe,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,WAA0B,CAAC,CAAC,CAAC,YAAY,CAAC;IAE/F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAU,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB;IACnD,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,2EAA2E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,MAAM,CAAC,KAAa;YACxB,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,0EAA0E;YAC1E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;YACzE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC/C,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,uEAAuE;gBACvE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAkCD,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgC,EAAE,IAA2B;IACvF,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC;IAChD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,cAAc,GAClB,OAAO,EAAE,cAAc;QACvB,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;YACnD,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC,CAAC;IACZ,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,4EAA4E;QAC5E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAoB;QACjC,oBAAoB,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,EAAE,IAAI,CAAC,CAAC;KACtF,CAAC;IACF,mFAAmF;IACnF,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,qBAAqB,EAAE,CAAC;IAClE,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,0EAA0E;QAC1E,sEAAsE;QACtE,4DAA4D;QAC5D,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,sBAAsB,UAAU,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QACD,UAAU,GAAG,IAAI,CAAC,CAAC,mCAAmC;IACxD,CAAC;IACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAA0B,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,UAAU,UAAU,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,6BAA6B;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAEhF,+FAA+F;AAC/F,MAAM,mBAAmB,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,kBAAkB,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa;IACvE,+EAA+E;IAC/E,iFAAiF;IACjF,oFAAoF;IACpF,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,UAAU,CAAC;IACrF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,cAAc,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,IAAI,IAAI,KAAK,GAAG,UAAU,WAAW;QAAE,OAAO,OAAO,CAAC;IACtD,IACE,MAAM,KAAK,OAAO;QAClB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACb,QAAQ,IAAI,IAAI,EAChB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,qCAAqC;AACrC,SAAS,MAAM,CAAC,GAAmB;IACjC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;IACnC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,CACL,IAAI,KAAK,UAAU;QACnB,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;QACjC,IAAI,KAAK,KAAK;QACd,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CACxB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,IAAY;IAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC3B,OAAO,IAAI,CAAC,CAAC,kDAAkD;IACjE,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAI,GAAG,CAAC,KAA0D,EAAE,YAAY,CAAC;QAC1F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAAmB,EAAE,KAAa;IACvD,MAAM,KAAK;SACR,IAAI,CAAC,GAAG,CAAC;SACT,MAAM,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;SACxD,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,IAAkB;IACxE,GAAG,CAAC,eAAe,CAAC,OAAO,EAAE,IAAwB,CAAC,CAAC;IAEvD,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO;QACnC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,KAAK,EAAE,6DAA6D,CAAC,CAAC;QACvF,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;gBAClB,OAAO;YACT,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO;QACnC,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,sEAAsE;YACtE,+DAA+D;YAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,6CAA6C,IAAI,eAAe,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/gate-cache.d.ts

@@ -48,6 +48,14 @@ export declare class GateCache {
     rebuild(runId: string, events: CoreEvent[]): GateCacheEntry | undefined;
     /** The cached open gate for a run, if any. */
     get(runId: string): GateCacheEntry | undefined;
+    /**
+     * Adopt an entry hydrated from the DURABLE `interaction_requests` table (DES-PROJECT-001
+     * §5.3). With that table, this cache is finally what its own comments always claimed — a
+     * latency layer over durable truth: the route reads the table on a miss and parks the result
+     * here so the next poll is a map hit. `rebuild` (event-log replay) remains the fallback for
+     * engines predating the table.
+     */
+    adopt(runId: string, entry: GateCacheEntry): void;
     /** Drop cache entries whose run is no longer `awaiting_human` (self-healing on reconcile). */
     reconcile(views: SessionView[]): void;
 }

package/dist/api/gate-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-cache.d.ts","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;CACpB;AA+CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAI9B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,GAAG,SAAS;IAQvE,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C,8FAA8F;IAC9F,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}
+{"version":3,"file":"gate-cache.d.ts","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/D,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;IACZ,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;CACpB;AA+CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAI9B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,GAAG,SAAS;IAQvE,8CAA8C;IAC9C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI9C;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAIjD,8FAA8F;IAC9F,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,IAAI;CAQtC"}

package/dist/api/gate-cache.js

@@ -92,6 +92,16 @@ export class GateCache {
     get(runId) {
         return this.entries.get(runId);
     }
+    /**
+     * Adopt an entry hydrated from the DURABLE `interaction_requests` table (DES-PROJECT-001
+     * §5.3). With that table, this cache is finally what its own comments always claimed — a
+     * latency layer over durable truth: the route reads the table on a miss and parks the result
+     * here so the next poll is a map hit. `rebuild` (event-log replay) remains the fallback for
+     * engines predating the table.
+     */
+    adopt(runId, entry) {
+        this.entries.set(runId, entry);
+    }
     /** Drop cache entries whose run is no longer `awaiting_human` (self-healing on reconcile). */
     reconcile(views) {
         const awaiting = new Set(views.filter((v) => v.session.status === 'awaiting_human').map((v) => v.session.id));

package/dist/api/gate-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"gate-cache.js","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAcA;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAAoC,EAAE,KAAgB;IAClE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM;oBACjB,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,SAAS;IACH,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAgB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAa,EAAE,MAAmB;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,SAAS,CAAC,KAAoB;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CACpF,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"gate-cache.js","sourceRoot":"","sources":["../../src/api/gate-cache.ts"],"names":[],"mappings":"AAcA;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,KAAgB;IAClC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,OAAoC,EAAE,KAAgB;IAClE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,eAAe;YAClB,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACtE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;oBACnB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,MAAM;oBACjB,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,MAAM;QACR,KAAK,SAAS,CAAC;QACf,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,SAAS;IACH,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,8CAA8C;IAC9C,MAAM,CAAC,KAAgB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAa,EAAE,MAAmB;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAa,EAAE,KAAqB;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,SAAS,CAAC,KAAoB;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CACpF,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF"}

package/dist/api/guidance-index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The run→operator-guidance index (DES-UX-002 §7.2, CREW-UX-7).
+ *
+ * NAMING NOTE: DES-UX-002 §7.2 labels this slice CREW-UX-4, but that id was already spent on an
+ * unrelated merged slice (crew#308) — this implementation is CREW-UX-7; the doc's §7.2 spec is
+ * what it implements.
+ *
+ * A durable pre-gate annotation: ONE operator guidance note per run, upserted via
+ * `PUT /runs/:id/guidance` and echoed as `AgentSession.guidance` on the run DTOs. The engine's
+ * run record carries no such field (wicked-core-ts 0.6.x), so — exactly like retry lineage
+ * (CREW-UX-3) and the actor trail (task #88) — the durable record is the audit trail: every
+ * write lands as a `guidance.set` entry whose `detail.text` is the full note (empty string =
+ * cleared), and this map is the read-side latency layer that lets the run DTOs echo it without
+ * a trail scan per request.
+ *
+ * Mirrors `RetryIndex`'s posture: hydrated once at server start (best-effort — a missing or
+ * unreadable trail leaves guidance blank, the pre-CREW-UX-7 behavior, not an error) and updated
+ * at the same post-commit point that writes the audit entry, so the map can only lag by a
+ * failed hydrate, never diverge silently.
+ */
+import type { AuditLog } from './audit.js';
+export declare class GuidanceIndex {
+    private readonly runToGuidance;
+    /**
+     * Load guidance from EVERY `guidance.set` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5, same defect as `RetryIndex.hydrate`: a durable note must not vanish
+     * because 1000+ newer writes landed on top of it). The trail answers newest first, so the
+     * FIRST entry seen per run is the current note — later (older) entries for the same run
+     * are superseded writes and are skipped, which is also what keeps a cleared note (newest
+     * entry has `text: ''`) from being resurrected by an older non-empty one. Still best-effort,
+     * like `RetryIndex.hydrate`; cost is one full-file scan at boot.
+     */
+    hydrate(audit: AuditLog, log?: (msg: string) => void): Promise<void>;
+    /** Upsert the note; the empty string CLEARS it (the DTO field goes back to absent). */
+    set(runId: string, text: string): void;
+    /** The note for this run, or `undefined` (the DTO spells that as an ABSENT field). */
+    guidanceFor(runId: string): string | undefined;
+}
+//# sourceMappingURL=guidance-index.d.ts.map

package/dist/api/guidance-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guidance-index.d.ts","sourceRoot":"","sources":["../../src/api/guidance-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAE3D;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1E,uFAAuF;IACvF,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKtC,sFAAsF;IACtF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG/C"}