@adammcarter/use-cases 0.1.0

package/packages/core/dist/markers/cli/prove.js

@@ -0,0 +1,381 @@
+import { ROW_HASH_ID, SPAN_CANON_ID, BINDING_SET_HASH_ID } from "../constants.js";
+import { UCM_VERSION } from "../../version.js";
+import { computeRowHash } from "../rowHash.js";
+import { computeApprovalPolicyHash, computeVerificationPolicyHash } from "../policyHash.js";
+import { computeBindingSetHash } from "../bindingSetHash.js";
+import { VERIFICATION_CONTEXT_HASH_ID, computeRowVerificationContextHash } from "../verificationContextHash.js";
+import { GENESIS_ENTRY_HASH, TRUSTED_CI_PRODUCER_KIND, computeLedgerEntryHash, readEvidenceJsonl } from "../evidenceLedger.js";
+import { signEvent } from "../proofSignature.js";
+import { appendJsonlLine, nodeMarkerFs } from "./io.js";
+import { prepareScan } from "./scan.js";
+import { registeredBindingsForRow } from "./shared.js";
+// The env var that must equal "1" for the dangerous unsafe-assume seam to be
+// honoured. Absent/any-other value -> the seam is silently ignored.
+export const ALLOW_UNSAFE_VERIFICATION_ENV = "UCM_ALLOW_UNSAFE_VERIFICATION";
+function commandResult(partial) {
+    return {
+        command: "prove",
+        ok: partial.exit_code === 0,
+        trusted: partial.trusted ?? false,
+        rows: partial.rows ?? [],
+        proof_events_appended: partial.proof_events_appended ?? 0,
+        errors: partial.errors ?? [],
+        ...partial
+    };
+}
+function rowResult(rowId, status, extra = {}) {
+    return {
+        row_id: rowId,
+        status,
+        reason: extra.reason ?? null,
+        message: extra.message ?? null,
+        proof_event_appended: extra.proof_event_appended ?? false,
+        event_id: extra.event_id ?? null,
+        row_hash: extra.row_hash ?? null,
+        binding_set_hash: extra.binding_set_hash ?? null
+    };
+}
+export function runProveCommand(options) {
+    const fs = options.fs ?? nodeMarkerFs;
+    const trusted = options.trustedCi === true;
+    const dryRun = options.dryRun === true;
+    const contextRoot = options.repoCwd ?? options.productRoot;
+    const allowUnsafe = process.env[ALLOW_UNSAFE_VERIFICATION_ENV] === "1";
+    // Untrusted explicit append attempt is the highest-priority refusal (spec 8.3).
+    if (options.append && !trusted) {
+        return commandResult({
+            exit_code: 6,
+            errors: [
+                { code: "UNTRUSTED_APPEND", message: "an append was requested without trusted-CI credentials" }
+            ]
+        });
+    }
+    if (!options.all && !options.rowId) {
+        return commandResult({
+            exit_code: 2,
+            trusted,
+            errors: [{ code: "NO_TARGET", message: "prove requires --all or --row <slug>" }]
+        });
+    }
+    // Run scan first (spec 8.3 step 1): registry/evidence validation + per-row state.
+    const prepared = prepareScan({
+        context: options.context,
+        productRoot: options.productRoot,
+        bindingsPath: options.bindingsPath,
+        evidencePath: options.evidencePath,
+        policyMode: "feature",
+        publicKeyResolver: options.publicKeyResolver,
+        generatedAt: options.generatedAt,
+        fs,
+        commentConfig: options.commentConfig,
+        baseRef: options.baseRef,
+        gitRunner: options.gitRunner,
+        repoCwd: options.repoCwd
+    });
+    if (prepared.registryErrors.length > 0 || prepared.evidenceErrors.length > 0) {
+        return commandResult({
+            exit_code: 4,
+            trusted,
+            errors: [{ code: "LEDGER_INVALID", message: "registry or evidence ledger failed validation" }]
+        });
+    }
+    // A trusted, non-dry-run prove will append signed proofs, which requires a key.
+    const willAppend = trusted && !dryRun;
+    if (willAppend && !options.signingKey) {
+        return commandResult({
+            exit_code: 2,
+            trusted,
+            errors: [{ code: "SIGNING_KEY_MISSING", message: "trusted-CI prove requires a signing key" }]
+        });
+    }
+    // Resolve the target row ids. A single --row that does not exist is a hard error.
+    let targetRowIds;
+    if (options.rowId) {
+        const statusRow = prepared.status.rows.find((row) => row.row_id === options.rowId);
+        const loadedRow = prepared.loaded.rows.find((row) => row.row_id === options.rowId);
+        if (!statusRow || !loadedRow) {
+            return commandResult({
+                exit_code: 2,
+                trusted,
+                errors: [{ code: "ROW_NOT_FOUND", message: `row ${options.rowId} is not a known use-case row` }]
+            });
+        }
+        targetRowIds = [options.rowId];
+    }
+    else {
+        targetRowIds = prepared.status.rows
+            .map((row) => row.row_id)
+            .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+    }
+    const idFactory = options.idFactory ?? generateEventId;
+    const rows = [];
+    let appended = 0;
+    for (const rowId of targetRowIds) {
+        const evaluation = proveOneRow({
+            rowId,
+            options,
+            prepared,
+            fs,
+            contextRoot,
+            trusted,
+            dryRun,
+            allowUnsafe,
+            idFactory
+        });
+        rows.push(evaluation);
+        if (evaluation.proof_event_appended) {
+            appended += 1;
+        }
+    }
+    // Non-atomic: passing rows are already appended above; the command exits nonzero
+    // iff any targeted row failed.
+    const anyFailed = rows.some((row) => row.status === "failed");
+    return commandResult({
+        exit_code: anyFailed ? 5 : 0,
+        trusted,
+        rows,
+        proof_events_appended: appended
+    });
+}
+function proveOneRow(args) {
+    const { rowId, options, prepared, fs, contextRoot, trusted, dryRun, allowUnsafe, idFactory } = args;
+    const statusRow = prepared.status.rows.find((row) => row.row_id === rowId);
+    const loadedRow = prepared.loaded.rows.find((row) => row.row_id === rowId);
+    if (!statusRow || !loadedRow) {
+        return rowResult(rowId, "failed", {
+            reason: "ROW_NOT_FOUND",
+            message: `row ${rowId} is not a known use-case row`
+        });
+    }
+    // UNBOUND -> skip (not a failure); INVALID -> refuse (failure).
+    if (statusRow.status === "UNBOUND") {
+        return rowResult(rowId, "skipped_unbound", { message: "no binding; nothing to prove" });
+    }
+    if (statusRow.status === "INVALID") {
+        return rowResult(rowId, "failed", {
+            reason: "ROW_INVALID",
+            message: `row ${rowId} has binding integrity errors; cannot prove`
+        });
+    }
+    // Recompute every hash from scratch (never trust the record's hashes blindly).
+    const registeredSlugs = new Set(statusRow.known_binding_slugs);
+    const bindings = registeredBindingsForRow(prepared.scan.bindings, rowId, registeredSlugs);
+    const rowHash = computeRowHash(loadedRow);
+    const verificationPolicyHash = computeVerificationPolicyHash(loadedRow.verification_policy);
+    const approvalPolicyHash = computeApprovalPolicyHash(loadedRow.approval_policy);
+    const bindingSetHash = computeBindingSetHash(rowId, bindings.map((binding) => ({
+        binding_slug: binding.binding_slug,
+        row_id: binding.row_id,
+        file_path: binding.file_path,
+        extent_kind: binding.extent_kind,
+        recognizer_id: binding.recognizer_id,
+        span_canon_id: binding.span_canon_id,
+        span_sha256: binding.span.sha256
+    })));
+    const spanHashes = bindings
+        .map((binding) => binding.span.sha256)
+        .sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+    const contextHash = computeRowVerificationContextHash({
+        slug: rowId,
+        verificationPolicy: loadedRow.verification_policy,
+        rootDir: contextRoot,
+        fs,
+        workspaceVerifiers: options.context.verifiers
+    });
+    const hashes = { row_hash: rowHash, binding_set_hash: bindingSetHash };
+    // Already FRESH -> skip unless an explicit refresh was requested.
+    if (statusRow.status === "FRESH" && options.refresh !== true) {
+        return rowResult(rowId, "skipped_fresh", { ...hashes, message: "already FRESH" });
+    }
+    // Decide acceptance. The unsafe seam (env-gated) short-circuits the results
+    // lookup; otherwise prove consumes the latest matching verification-result.
+    let verification;
+    if (options.unsafeAssumeVerificationResult === "pass" && allowUnsafe) {
+        verification = {
+            command_id: `acceptance.${rowId}`,
+            started_at: options.generatedAt,
+            completed_at: options.generatedAt,
+            artifacts: []
+        };
+    }
+    else {
+        const record = latestResultFor(rowId, options.verificationResults);
+        if (!record) {
+            return rowResult(rowId, "failed", {
+                ...hashes,
+                reason: "NO_PASSING_RESULT",
+                message: `no verification result for row ${rowId}; run \`uc verify --row ${rowId} --out <path>\` first`
+            });
+        }
+        if (record.status === "blocked") {
+            return rowResult(rowId, "failed", {
+                ...hashes,
+                reason: "RESULT_BLOCKED",
+                message: `verification for ${rowId} is blocked (verifier could not be resolved)`
+            });
+        }
+        if (record.status !== "pass") {
+            return rowResult(rowId, "failed", {
+                ...hashes,
+                reason: "RESULT_FAILED",
+                message: `verification for ${rowId} did not pass`
+            });
+        }
+        // status:pass -> prove's own hashes must EQUAL the record's. Refuse a mismatch.
+        const mismatches = [];
+        if (record.row_hash !== rowHash)
+            mismatches.push("row_hash");
+        if (record.binding_set_hash !== bindingSetHash)
+            mismatches.push("binding_set_hash");
+        if (!stringArraysEqual(record.span_sha256s, spanHashes))
+            mismatches.push("span_sha256s");
+        if (record.verification_context_hash !== contextHash)
+            mismatches.push("verification_context_hash");
+        if (mismatches.length > 0) {
+            return rowResult(rowId, "failed", {
+                ...hashes,
+                reason: "HASH_MISMATCH",
+                message: `verification result for ${rowId} is stale; recomputed hashes differ (${mismatches.join(", ")})`
+            });
+        }
+        verification = {
+            command_id: record.verifier_id ?? `acceptance.${rowId}`,
+            started_at: record.created_at,
+            completed_at: record.created_at,
+            artifacts: []
+        };
+    }
+    // Accepted. Candidate-only when not trusted or explicitly dry-run (never appends).
+    if (!trusted || dryRun) {
+        return rowResult(rowId, "candidate", { ...hashes, message: "verification accepted; not appended" });
+    }
+    // Trusted append (signingKey guaranteed present by the pre-flight check).
+    const signingKey = options.signingKey;
+    // Tamper-evident chain: read the CURRENT ledger tail so the new entry's
+    // entry_index / previous_entry_hash chain onto whatever is already appended.
+    // Re-reading here (not caching) keeps a multi-row `--all` run correct: each
+    // earlier append in the SAME run is on disk by the time the next row chains.
+    const tail = readLedgerTail(fs, options.evidencePath);
+    const unsigned = buildProofEvent({
+        eventId: idFactory(),
+        createdAt: options.generatedAt,
+        rowId,
+        rowHash,
+        verificationPolicyHash,
+        approvalPolicyHash,
+        bindingSetHash,
+        contextHash,
+        bindings,
+        verification,
+        producer: options.producer,
+        authority: options.authority,
+        entryIndex: tail.count,
+        previousEntryHash: tail.lastEntry
+            ? computeLedgerEntryHash(tail.lastEntry)
+            : GENESIS_ENTRY_HASH
+    });
+    // The chain fields live INSIDE the event before signing, so the signature
+    // covers them and they cannot be forged or reordered after the fact.
+    const signed = signEvent(unsigned, signingKey.privateKey, signingKey.keyId);
+    appendJsonlLine(fs, options.evidencePath, JSON.stringify(signed));
+    return rowResult(rowId, "signed", {
+        ...hashes,
+        proof_event_appended: true,
+        event_id: signed.event_id
+    });
+}
+// The current ledger tail for the tamper-evident chain: the entry count (the
+// next entry's absolute index) and the last parsed entry (to hash as the next
+// entry's previous_entry_hash). A missing/empty ledger yields count 0 / null.
+function readLedgerTail(fs, path) {
+    const read = readEvidenceJsonl(fs.readText(path) ?? "");
+    const count = read.lines.length;
+    const lastEntry = count > 0 ? read.lines[count - 1].value : null;
+    return { count, lastEntry };
+}
+// The latest (last-written) verification-result record for a row, or undefined.
+function latestResultFor(rowId, records) {
+    if (!records) {
+        return undefined;
+    }
+    let latest;
+    for (const record of records) {
+        if (record.row_id === rowId) {
+            latest = record;
+        }
+    }
+    return latest;
+}
+function stringArraysEqual(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    return left.every((value, index) => value === right[index]);
+}
+// 26-char Crockford-base32 ULID-shaped id. Deterministic ids are injectable via
+// `idFactory` for tests that assert on event ids; here uniqueness is what matters.
+function generateEventId() {
+    const alphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+    let out = "";
+    for (let i = 0; i < 26; i += 1) {
+        out += alphabet[Math.floor(Math.random() * alphabet.length)];
+    }
+    return out;
+}
+// Build the unsigned proof event. producer.kind is ALWAYS forced to the trusted
+// constant — an agent can never set it (spec 8.3 must-not 5).
+function buildProofEvent(args) {
+    return {
+        schema: "ucase-proof-event-v1",
+        event_type: "row_proof_passed",
+        event_id: args.eventId,
+        created_at: args.createdAt,
+        producer: {
+            kind: TRUSTED_CI_PRODUCER_KIND,
+            id: args.producer?.id ?? "ci/use-cases-prover",
+            version: args.producer?.version ?? UCM_VERSION,
+            ci_run_id: args.producer?.ci_run_id ?? "local",
+            repo: args.producer?.repo ?? "unknown/unknown",
+            commit: args.producer?.commit ?? "0".repeat(40)
+        },
+        row: {
+            row_id: args.rowId,
+            row_hash_id: ROW_HASH_ID,
+            row_hash: args.rowHash,
+            verification_policy_hash: args.verificationPolicyHash,
+            approval_policy_hash: args.approvalPolicyHash
+        },
+        bindings: {
+            binding_set_hash_id: BINDING_SET_HASH_ID,
+            binding_set_hash: args.bindingSetHash,
+            span_canon_id: SPAN_CANON_ID,
+            items: args.bindings.map((binding) => ({
+                binding_slug: binding.binding_slug,
+                row_id: binding.row_id,
+                file_path: binding.file_path,
+                extent_kind: binding.extent_kind,
+                recognizer_id: binding.recognizer_id,
+                span_canon_id: binding.span_canon_id,
+                span_sha256: binding.span.sha256,
+                span_start_line: binding.span.start_line,
+                span_end_line: binding.span.end_line
+            }))
+        },
+        verification: {
+            command_id: args.verification.command_id,
+            result: "pass",
+            started_at: args.verification.started_at,
+            completed_at: args.verification.completed_at,
+            artifacts: args.verification.artifacts,
+            context_hash_id: VERIFICATION_CONTEXT_HASH_ID,
+            context_hash: args.contextHash
+        },
+        entry_index: args.entryIndex,
+        previous_entry_hash: args.previousEntryHash,
+        // OPTIONAL: only embed the CI-neutral authority when one was supplied, so
+        // proofs minted without it remain byte-for-byte as before (and legacy proofs
+        // without it still validate + stay FRESH).
+        ...(args.authority ? { authority: args.authority } : {})
+    };
+}
+//# sourceMappingURL=prove.js.map

package/packages/core/dist/markers/cli/prove.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prove.js","sourceRoot":"","sources":["../../../src/markers/cli/prove.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,EAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,iBAAiB,EAElB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,SAAS,EAGV,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAiB,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,WAAW,EAAwB,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAGvD,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAoF7E,SAAS,aAAa,CACpB,OAA4D;IAE5D,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,EAAE,EAAE,OAAO,CAAC,SAAS,KAAK,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK;QACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;QACxB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,CAAC;QACzD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,KAAa,EACb,MAAsB,EACtB,QAAiC,EAAE;IAEnC,OAAO;QACL,MAAM,EAAE,KAAK;QACb,MAAM;QACN,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,KAAK;QACzD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;KACjD,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,eAAe,CAAC,OAA4B;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,GAAG,CAAC;IAEvE,gFAAgF;IAChF,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC;YACnB,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,wDAAwD,EAAE;aAChG;SACF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,aAAa,CAAC;YACnB,SAAS,EAAE,CAAC;YACZ,OAAO;YACP,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;SACjF,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,UAAU,EAAE,SAAS;QACrB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,EAAE;QACF,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,aAAa,CAAC;YACnB,SAAS,EAAE,CAAC;YACZ,OAAO;YACP,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;SAC/F,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC;IACtC,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,aAAa,CAAC;YACnB,SAAS,EAAE,CAAC;YACZ,OAAO;YACP,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,IAAI,YAAsB,CAAC;IAC3B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC;gBACnB,SAAS,EAAE,CAAC;gBACZ,OAAO;gBACP,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,OAAO,CAAC,KAAK,8BAA8B,EAAE,CAAC;aACjG,CAAC,CAAC;QACL,CAAC;QACD,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI;aAChC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;aACxB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC;IACvD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,UAAU,GAAG,WAAW,CAAC;YAC7B,KAAK;YACL,OAAO;YACP,QAAQ;YACR,EAAE;YACF,WAAW;YACX,OAAO;YACP,MAAM;YACN,WAAW;YACX,SAAS;SACV,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,IAAI,UAAU,CAAC,oBAAoB,EAAE,CAAC;YACpC,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,+BAA+B;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IAC9D,OAAO,aAAa,CAAC;QACnB,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO;QACP,IAAI;QACJ,qBAAqB,EAAE,QAAQ;KAChC,CAAC,CAAC;AACL,CAAC;AAcD,SAAS,WAAW,CAAC,IAAqB;IACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACpG,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;YAChC,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,OAAO,KAAK,8BAA8B;SACpD,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;YAChC,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,OAAO,KAAK,6CAA6C;SACnE,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,sBAAsB,GAAG,6BAA6B,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IAC5F,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,qBAAqB,CAC1C,KAAK,EACL,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACzB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACjC,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,UAAU,GAAG,QAAQ;SACxB,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;SACrC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,iCAAiC,CAAC;QACpD,IAAI,EAAE,KAAK;QACX,kBAAkB,EAAE,SAAS,CAAC,mBAAmB;QACjD,OAAO,EAAE,WAAW;QACpB,EAAE;QACF,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;KAC9C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;IAEvE,kEAAkE;IAClE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,YAA+B,CAAC;IACpC,IAAI,OAAO,CAAC,8BAA8B,KAAK,MAAM,IAAI,WAAW,EAAE,CAAC;QACrE,YAAY,GAAG;YACb,UAAU,EAAE,cAAc,KAAK,EAAE;YACjC,UAAU,EAAE,OAAO,CAAC,WAAW;YAC/B,YAAY,EAAE,OAAO,CAAC,WAAW;YACjC,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,mBAAmB;gBAC3B,OAAO,EAAE,kCAAkC,KAAK,2BAA2B,KAAK,uBAAuB;aACxG,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,oBAAoB,KAAK,8CAA8C;aACjF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,oBAAoB,KAAK,eAAe;aAClD,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,gBAAgB,KAAK,cAAc;YAAE,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACpF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,yBAAyB,KAAK,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAChC,GAAG,MAAM;gBACT,MAAM,EAAE,eAAe;gBACvB,OAAO,EAAE,2BAA2B,KAAK,wCAAwC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC1G,CAAC,CAAC;QACL,CAAC;QAED,YAAY,GAAG;YACb,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,cAAc,KAAK,EAAE;YACvD,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,UAAU;YAC/B,SAAS,EAAE,EAAE;SACd,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,UAA6B,CAAC;IACzD,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,OAAO,EAAE,SAAS,EAAE;QACpB,SAAS,EAAE,OAAO,CAAC,WAAW;QAC9B,KAAK;QACL,OAAO;QACP,sBAAsB;QACtB,kBAAkB;QAClB,cAAc;QACd,WAAW;QACX,QAAQ;QACR,YAAY;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,iBAAiB,EAAE,IAAI,CAAC,SAAS;YAC/B,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;YACxC,CAAC,CAAC,kBAAkB;KACvB,CAAC,CAAC;IACH,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5E,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAElE,OAAO,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE;QAChC,GAAG,MAAM;QACT,oBAAoB,EAAE,IAAI;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,SAAS,cAAc,CACrB,EAAY,EACZ,IAAY;IAEZ,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CACtB,KAAa,EACb,OAA+C;IAE/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAA4C,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,GAAG,MAAM,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc,EAAE,KAAe;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAChF,mFAAmF;AACnF,SAAS,eAAe;IACtB,MAAM,QAAQ,GAAG,kCAAkC,CAAC;IACpD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAsBD,gFAAgF;AAChF,8DAA8D;AAC9D,SAAS,eAAe,CAAC,IAAoB;IAC3C,OAAO;QACL,MAAM,EAAE,sBAAsB;QAC9B,UAAU,EAAE,kBAAkB;QAC9B,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,QAAQ,EAAE;YACR,IAAI,EAAE,wBAAwB;YAC9B,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,qBAAqB;YAC9C,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,WAAW;YAC9C,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,OAAO;YAC9C,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,iBAAiB;YAC9C,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SAChD;QACD,GAAG,EAAE;YACH,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,WAAW,EAAE,WAAW;YACxB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,wBAAwB,EAAE,IAAI,CAAC,sBAAsB;YACrD,oBAAoB,EAAE,IAAI,CAAC,kBAAkB;SAC9C;QACD,QAAQ,EAAE;YACR,mBAAmB,EAAE,mBAAmB;YACxC,gBAAgB,EAAE,IAAI,CAAC,cAAc;YACrC,aAAa,EAAE,aAAa;YAC5B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAChC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;gBACxC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;aACrC,CAAC,CAAC;SACJ;QACD,YAAY,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU;YACxC,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU;YACxC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY;YAC5C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS;YACtC,eAAe,EAAE,4BAA4B;YAC7C,YAAY,EAAE,IAAI,CAAC,WAAW;SAC/B;QACD,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;QAC3C,0EAA0E;QAC1E,6EAA6E;QAC7E,2CAA2C;QAC3C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/packages/core/dist/markers/cli/scan.d.ts

@@ -0,0 +1,63 @@
+import type { ResolvedWorkspaceContext } from "../../roots.js";
+import type { CommentPrefixConfig } from "../commentPrefix.js";
+import { type ProofEvent, type EvidenceError } from "../evidenceLedger.js";
+import { type FreshnessStatus, type PolicyMode } from "../freshness.js";
+import type { PublicKeyResolver } from "../proofSignature.js";
+import { type MaterializedRegistry, type RegistryError } from "../registry.js";
+import { type ScanResult } from "../scanner.js";
+import { type GitRunner } from "../appendOnly.js";
+import { type MarkerFs } from "./io.js";
+import { type LoadedMarkerRows } from "./shared.js";
+export declare const DEFAULT_VERIFICATION_RESULTS_FILENAME = "verification-results.jsonl";
+export interface ScanCommandOptions {
+    context: ResolvedWorkspaceContext;
+    productRoot: string;
+    bindingsPath: string;
+    evidencePath: string;
+    policyMode: PolicyMode;
+    publicKeyResolver: PublicKeyResolver;
+    generatedAt: string;
+    fs?: MarkerFs;
+    commentConfig?: CommentPrefixConfig;
+    baseRef?: string;
+    gitRunner?: GitRunner;
+    repoCwd?: string;
+    resultsPath?: string;
+    gate?: boolean;
+}
+export interface ScanPreparation {
+    loaded: LoadedMarkerRows;
+    registry: MaterializedRegistry;
+    registryErrors: RegistryError[];
+    evidence: ProofEvent[];
+    evidenceErrors: EvidenceError[];
+    scan: ScanResult;
+    status: FreshnessStatus;
+}
+export declare function prepareScan(options: ScanCommandOptions): ScanPreparation;
+export interface ScanCommandResult {
+    exit_code: number;
+    ok: boolean;
+    status: FreshnessStatus;
+    registry_valid: boolean;
+    evidence_valid: boolean;
+    inferred_spans: string[];
+    registry_errors: RegistryError[];
+    evidence_errors: EvidenceError[];
+    gate?: ScanGateResult;
+}
+export declare function runScanCommand(options: ScanCommandOptions): ScanCommandResult;
+export interface ScanGateOffender {
+    row_id: string;
+    status: FreshnessStatus["rows"][number]["status"];
+    local_status: FreshnessStatus["rows"][number]["local_status"];
+}
+export interface ScanGateResult {
+    blocked: boolean;
+    policy_mode: PolicyMode;
+    required_bar: "FRESH" | "VERIFIED_LOCAL";
+    offending_rows: ScanGateOffender[];
+}
+export declare function evaluateScanGate(status: FreshnessStatus, policyMode: PolicyMode): ScanGateResult;
+export declare function scanExitCode(status: FreshnessStatus, registryValid: boolean, evidenceValid: boolean): number;
+//# sourceMappingURL=scan.d.ts.map

package/packages/core/dist/markers/cli/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../src/markers/cli/scan.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAC;AAMrB,eAAO,MAAM,qCAAqC,+BAA+B,CAAC;AA6ClF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,CAAC,EAAE,QAAQ,CAAC;IACd,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,SAAS,CAAC;IAEtB,OAAO,CAAC,EAAE,MAAM,CAAC;IAIjB,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;CACzB;AAGD,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,eAAe,CA2GxE;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,eAAe,EAAE,aAAa,EAAE,CAAC;IAIjC,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,GAAG,iBAAiB,CAoC7E;AAWD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,YAAY,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,UAAU,CAAC;IAGxB,YAAY,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACzC,cAAc,EAAE,gBAAgB,EAAE,CAAC;CACpC;AAmBD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,UAAU,GACrB,cAAc,CAoBhB;AAID,wBAAgB,YAAY,CAC1B,MAAM,EAAE,eAAe,EACvB,aAAa,EAAE,OAAO,EACtB,aAAa,EAAE,OAAO,GACrB,MAAM,CAcR"}