@adammcarter/use-cases 0.1.0

package/packages/core/dist/markers/evidenceLedger.js

@@ -0,0 +1,391 @@
+// Evidence ledger validation (spec section 5; Phase 5).
+//
+// The evidence ledger (`.use-cases/proofs.jsonl`) is an append-only log of
+// signed, trusted-CI proof events (spec 5.1, amendment 3). This module turns the
+// JSONL text into validated proof events and reports precise error codes for
+// every way the ledger can be invalid:
+//   - JSONL parse errors (with 1-based line numbers)
+//   - proof-event schema failures (reuses the Phase 1 validator)
+//   - producer / verification-result policy violations (spec 5.3 rules 4/5)
+//   - signature failures (unsigned / unknown key / bad signature; spec 5.3)
+//   - internal binding_set_hash inconsistency (spec 5.4 -> INVALID)
+//   - non-append-only edits/deletes relative to a base ref (reuses Phase 3)
+//
+// Deliberately NOT done here (spec 5.4): comparing an event's embedded
+// span_sha256 to the CURRENT scanned code. That drift is SUSPECT, not INVALID,
+// and belongs to the Phase 6 freshness machine — never to validate-ledger.
+//
+// The core `validateEvidenceLedger` is pure (text in, result out). The only
+// impure helper is a thin git base-ref read that reuses Phase 3's `readBaseRefFile`.
+import { computeBindingSetHash } from "./bindingSetHash.js";
+import { canonicalJsonSha256 } from "./canonicalJson.js";
+import { validateProofEvent } from "./validators.js";
+import { appendOnly, splitJsonlLines, readBaseRefFile } from "./appendOnly.js";
+import { verifyEvent } from "./proofSignature.js";
+// Genesis sentinel for `previous_entry_hash` on the first ledger entry. It is a
+// well-formed "sha256:<hex>" string (64 zeros) so it satisfies the proof-event
+// schema's hash pattern while being unmistakably the chain's root.
+export const GENESIS_ENTRY_HASH = `sha256:${"0".repeat(64)}`;
+// The canonical entry hash for the tamper-evident chain: sha256(canonicalJson)
+// over the FULL signed proof event (signature and chain fields included). The
+// next entry embeds this as its `previous_entry_hash`, so any edit to a prior
+// entry — including its signature — invalidates every following link.
+export function computeLedgerEntryHash(entry) {
+    return canonicalJsonSha256(entry);
+}
+// --- tamper-evident hash chain verification (v1) -----------------------------
+//
+// Stable `UCM_*` diagnostic codes for the chain tamper classes. These are
+// declared as plain string literals here (not imported from the error registry)
+// so evidenceLedger has NO dependency on the registry — the registry already
+// imports `EvidenceErrorCode` from this module, and a back-import would be a
+// cycle. The same literals are registered in `errors/registry.ts`.
+export const LedgerChainErrorCode = Object.freeze({
+    CHAIN_BROKEN: "UCM_LEDGER_CHAIN_BROKEN",
+    INDEX_GAP: "UCM_LEDGER_INDEX_GAP",
+    DUPLICATE_INDEX: "UCM_LEDGER_DUPLICATE_INDEX"
+});
+// Does this parsed entry carry the (optional) tamper-evident chain fields? An
+// entry "carries the chain" if EITHER field is present; a legacy entry has
+// neither. A half-present entry counts as chained and is reported as broken.
+function carriesChainFields(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const record = value;
+    return record.entry_index !== undefined || record.previous_entry_hash !== undefined;
+}
+function readEntryIndex(value) {
+    const raw = value?.entry_index;
+    return typeof raw === "number" && Number.isInteger(raw) ? raw : undefined;
+}
+function readPreviousEntryHash(value) {
+    const raw = value?.previous_entry_hash;
+    return typeof raw === "string" ? raw : undefined;
+}
+// Verify the tamper-evident hash chain over the CONTIGUOUS CHAINED SUFFIX of a
+// parsed evidence ledger, tolerating and reporting a leading legacy un-chained
+// prefix (spec: v1 tamper-evident ledger, Piece 2).
+//
+// For each chained entry at actual position `pos`:
+//   - `entry_index` MUST equal `pos` (monotonic, no gaps). A mismatch is an
+//     INDEX_GAP (gap / reorder / truncation) or a DUPLICATE_INDEX when the index
+//     was already seen.
+//   - `previous_entry_hash` MUST equal `computeLedgerEntryHash` of the
+//     immediately preceding entry — which may itself be the last LEGACY entry
+//     (the chain can start mid-ledger) — or the genesis sentinel at position 0.
+//     A mismatch is a CHAIN_BROKEN (an in-place edit of a prior entry breaks the
+//     NEXT entry's link; a truncation breaks the following entry's link).
+//
+// Pure: parsed lines in, result out. Does NOT verify signatures or schema (those
+// are the existing per-event rules) — it only checks chain integrity.
+export function verifyLedgerChain(lines) {
+    const errors = [];
+    // The legacy prefix: leading entries with NO chain fields. The chain starts at
+    // the first entry that carries chain fields.
+    let legacyPrefixCount = 0;
+    while (legacyPrefixCount < lines.length &&
+        !carriesChainFields(lines[legacyPrefixCount].value)) {
+        legacyPrefixCount += 1;
+    }
+    let verifiedEntries = 0;
+    const seenIndices = new Set();
+    for (let pos = legacyPrefixCount; pos < lines.length; pos += 1) {
+        const { line, value } = lines[pos];
+        const entryErrors = [];
+        const idx = readEntryIndex(value);
+        const prevHash = readPreviousEntryHash(value);
+        // An entry inside the chained suffix must carry BOTH fields.
+        if (idx === undefined || prevHash === undefined) {
+            entryErrors.push({
+                code: LedgerChainErrorCode.CHAIN_BROKEN,
+                line,
+                message: `chained ledger entry at position ${pos} is missing a chain field (entry_index/previous_entry_hash)`
+            });
+        }
+        else {
+            // entry_index must equal the entry's actual position.
+            if (idx !== pos) {
+                if (seenIndices.has(idx)) {
+                    entryErrors.push({
+                        code: LedgerChainErrorCode.DUPLICATE_INDEX,
+                        line,
+                        entry_index: idx,
+                        message: `duplicate entry_index ${idx} at ledger position ${pos}`
+                    });
+                }
+                else {
+                    entryErrors.push({
+                        code: LedgerChainErrorCode.INDEX_GAP,
+                        line,
+                        entry_index: idx,
+                        message: `entry_index ${idx} does not match its ledger position ${pos} (gap, reorder, or truncation)`
+                    });
+                }
+            }
+            else if (seenIndices.has(idx)) {
+                entryErrors.push({
+                    code: LedgerChainErrorCode.DUPLICATE_INDEX,
+                    line,
+                    entry_index: idx,
+                    message: `duplicate entry_index ${idx} at ledger position ${pos}`
+                });
+            }
+            seenIndices.add(idx);
+            // previous_entry_hash must match the hash of the immediately preceding
+            // entry (or the genesis sentinel at the very first ledger position).
+            const expectedPrev = pos === 0 ? GENESIS_ENTRY_HASH : computeLedgerEntryHash(lines[pos - 1].value);
+            if (prevHash !== expectedPrev) {
+                entryErrors.push({
+                    code: LedgerChainErrorCode.CHAIN_BROKEN,
+                    line,
+                    entry_index: idx,
+                    message: `previous_entry_hash does not match the preceding entry (chain broken at position ${pos})`
+                });
+            }
+        }
+        if (entryErrors.length === 0) {
+            verifiedEntries += 1;
+        }
+        else {
+            errors.push(...entryErrors);
+        }
+    }
+    return {
+        ok: errors.length === 0,
+        verified_entries: verifiedEntries,
+        legacy_prefix_count: legacyPrefixCount,
+        errors
+    };
+}
+// The trusted producer kind (spec 5.3 rule 4).
+export const TRUSTED_CI_PRODUCER_KIND = "trusted-ci-prover";
+// The only accepted verification result on an appended proof (spec 5.3 rule 5).
+export const PROOF_PASS_RESULT = "pass";
+// Stable error codes for every way the evidence ledger can be invalid
+// (spec 5.3 / 5.4 / 7.1 and the section 11.4 evidence-laundering mutations).
+export const EvidenceErrorCode = Object.freeze({
+    JSON_PARSE_ERROR: "JSON_PARSE_ERROR",
+    EVIDENCE_SCHEMA_INVALID: "EVIDENCE_SCHEMA_INVALID",
+    SIGNATURE_MISSING: "SIGNATURE_MISSING",
+    SIGNATURE_ALG_UNSUPPORTED: "SIGNATURE_ALG_UNSUPPORTED",
+    UNKNOWN_KEY_ID: "UNKNOWN_KEY_ID",
+    BAD_SIGNATURE: "BAD_SIGNATURE",
+    PRODUCER_NOT_TRUSTED: "PRODUCER_NOT_TRUSTED",
+    VERIFICATION_NOT_PASS: "VERIFICATION_NOT_PASS",
+    BINDING_SET_HASH_MISMATCH: "BINDING_SET_HASH_MISMATCH",
+    EVIDENCE_ROW_MISSING: "EVIDENCE_ROW_MISSING",
+    APPEND_ONLY_VIOLATION: "APPEND_ONLY_VIOLATION"
+});
+// Read evidence JSONL text into one parsed value per line (spec 5.4 step "parse").
+//
+// A trailing newline is tolerated; whitespace-only lines are skipped so an empty
+// or newline-terminated file reads cleanly. Any line that fails JSON.parse is
+// reported as a JSON_PARSE_ERROR carrying its 1-based line number; remaining
+// lines are still read.
+export function readEvidenceJsonl(text) {
+    const lines = [];
+    const errors = [];
+    const rawLines = text.split("\n");
+    for (let i = 0; i < rawLines.length; i += 1) {
+        const raw = rawLines[i];
+        if (raw.trim() === "") {
+            continue; // tolerate trailing newline / blank separators
+        }
+        const lineNo = i + 1;
+        try {
+            lines.push({ line: lineNo, value: JSON.parse(raw) });
+        }
+        catch (error) {
+            errors.push({
+                code: EvidenceErrorCode.JSON_PARSE_ERROR,
+                line: lineNo,
+                message: `line ${lineNo} is not valid JSON: ${error.message}`
+            });
+        }
+    }
+    return { lines, errors };
+}
+// Safe path read of producer.kind / verification.result / event_id / row_id from
+// an arbitrary parsed value, so policy checks can emit precise codes even when the
+// shape is only partially correct.
+function readPath(value, keys) {
+    let cursor = value;
+    for (const key of keys) {
+        if (typeof cursor !== "object" || cursor === null) {
+            return undefined;
+        }
+        cursor = cursor[key];
+    }
+    return cursor;
+}
+// Validate a single parsed proof-event value against every Phase 5 rule.
+//
+// Order: schema (structural gate) -> signature -> producer/result policy ->
+// internal binding_set_hash recompute -> optional row existence. The signature,
+// policy, and hash checks are defensive (guarded by path reads) so a precise code
+// is still emitted even when the schema also rejects the value.
+export function validateProofEventValue(value, line, options) {
+    const errors = [];
+    const eventId = readPath(value, ["event_id"]);
+    const eventIdStr = typeof eventId === "string" ? eventId : undefined;
+    const rowId = readPath(value, ["row", "row_id"]);
+    const rowIdStr = typeof rowId === "string" ? rowId : undefined;
+    // Structural gate: the Phase 1 proof-event schema (spec 5.2). The schema's
+    // consts also enforce producer.kind and verification.result, but we still run
+    // the dedicated policy checks below for precise, spec-named error codes.
+    const schemaResult = validateProofEvent(value);
+    const schemaOk = schemaResult.ok;
+    if (!schemaOk) {
+        errors.push({
+            code: EvidenceErrorCode.EVIDENCE_SCHEMA_INVALID,
+            line,
+            message: `proof event failed schema: ${schemaResult.errors
+                .map((e) => `${e.instance_path} ${e.message}`.trim())
+                .join("; ")}`,
+            event_id: eventIdStr,
+            row_id: rowIdStr
+        });
+    }
+    // Signature (spec 5.3 rules 1-3). verifyEvent reports the precise reason.
+    const verifyResult = verifyEvent(value, options.publicKeyResolver);
+    if (!verifyResult.ok) {
+        errors.push({
+            code: verifyResult.code,
+            line,
+            message: verifyResult.message,
+            event_id: eventIdStr,
+            row_id: rowIdStr
+        });
+    }
+    // Producer must be trusted (spec 5.3 rule 4). Only emit the dedicated code when
+    // the field is present-but-wrong; an absent producer is covered by the schema.
+    const producerKind = readPath(value, ["producer", "kind"]);
+    if (producerKind !== undefined && producerKind !== TRUSTED_CI_PRODUCER_KIND) {
+        errors.push({
+            code: EvidenceErrorCode.PRODUCER_NOT_TRUSTED,
+            line,
+            message: `producer.kind is ${String(producerKind)}; only ${TRUSTED_CI_PRODUCER_KIND} may mint proof events`,
+            event_id: eventIdStr,
+            row_id: rowIdStr
+        });
+    }
+    // Verification result must be pass (spec 5.3 rules 5/6).
+    const verificationResult = readPath(value, ["verification", "result"]);
+    if (verificationResult !== undefined && verificationResult !== PROOF_PASS_RESULT) {
+        errors.push({
+            code: EvidenceErrorCode.VERIFICATION_NOT_PASS,
+            line,
+            message: `verification.result is ${String(verificationResult)}; only "${PROOF_PASS_RESULT}" proofs may be appended`,
+            event_id: eventIdStr,
+            row_id: rowIdStr
+        });
+    }
+    // Internal binding_set_hash recompute (spec 5.4). The embedded
+    // bindings.binding_set_hash must equal hash(bindings.items) for the row. A
+    // mismatch is INVALID (internally inconsistent), distinct from SUSPECT drift.
+    // Guarded by the schema so we only recompute over a well-formed bindings block.
+    if (schemaOk) {
+        const event = value;
+        // computeBindingSetHash whitelists hashed fields (spec 4.5), so the extra
+        // diagnostic fields on each item (line numbers) are ignored. The cast adds
+        // the index signature its input type expects.
+        const recomputed = computeBindingSetHash(event.row.row_id, event.bindings.items);
+        if (recomputed !== event.bindings.binding_set_hash) {
+            errors.push({
+                code: EvidenceErrorCode.BINDING_SET_HASH_MISMATCH,
+                line,
+                message: `binding_set_hash ${event.bindings.binding_set_hash} does not recompute from items (got ${recomputed})`,
+                event_id: eventIdStr,
+                row_id: rowIdStr
+            });
+        }
+        // Optional: proof event row id must exist (spec 5.4 validate-ledger step 10).
+        if (options.yamlRowIds && !options.yamlRowIds.has(event.row.row_id)) {
+            errors.push({
+                code: EvidenceErrorCode.EVIDENCE_ROW_MISSING,
+                line,
+                message: `proof event row_id ${event.row.row_id} is not a known YAML row`,
+                event_id: eventIdStr,
+                row_id: event.row.row_id
+            });
+        }
+    }
+    const ok = errors.length === 0;
+    return { ok, errors, event: ok ? value : null };
+}
+// Validate a full evidence ledger: JSONL parse, proof-event schema, signature,
+// producer/result policy, internal binding_set_hash recompute, optional row
+// existence, and (when a base ref is supplied) append-only discipline.
+//
+// Pure: pass the current ledger text and the old base-ref text. Returns precise
+// error codes plus a count summary. Does NOT compare embedded span hashes to
+// current code (spec 5.4 "must not" — that is SUSPECT and Phase 6's job).
+export function validateEvidenceLedger(text, options) {
+    const read = readEvidenceJsonl(text);
+    const errors = [...read.errors];
+    const events = [];
+    // Append-only discipline relative to the base ref (spec 5.4 step 4). Reuses the
+    // Phase 3 pure check; line-based so an edit or delete of any existing line is a
+    // violation.
+    let appendOnlyOk = true;
+    if (options.baseRefOldText !== undefined) {
+        const result = appendOnly(splitJsonlLines(options.baseRefOldText), splitJsonlLines(text));
+        if (!result.ok) {
+            appendOnlyOk = false;
+            errors.push({
+                code: EvidenceErrorCode.APPEND_ONLY_VIOLATION,
+                line: result.violation.index + 1,
+                message: result.violation.message
+            });
+        }
+    }
+    let validCount = 0;
+    for (const { line, value } of read.lines) {
+        const result = validateProofEventValue(value, line, {
+            publicKeyResolver: options.publicKeyResolver,
+            yamlRowIds: options.yamlRowIds
+        });
+        if (result.ok && result.event) {
+            events.push(result.event);
+            validCount += 1;
+        }
+        else {
+            errors.push(...result.errors);
+        }
+    }
+    const errorsByCode = {};
+    for (const error of errors) {
+        errorsByCode[error.code] = (errorsByCode[error.code] ?? 0) + 1;
+    }
+    const checked = read.lines.length;
+    const summary = {
+        proof_events_checked: checked,
+        proof_events_valid: validCount,
+        proof_events_invalid: checked - validCount,
+        append_only: appendOnlyOk,
+        errors_by_code: errorsByCode
+    };
+    return {
+        ok: errors.length === 0,
+        errors,
+        events,
+        append_only: appendOnlyOk,
+        summary
+    };
+}
+// Convenience: read the evidence file's base-ref version via git and validate the
+// current text against it. Thin and impure — reuses Phase 3's `readBaseRefFile`
+// (returns "" when the file is newly added at the base ref).
+export function validateEvidenceLedgerAgainstBaseRef(text, baseRef, path, options) {
+    const baseRefOldText = readBaseRefFile(baseRef, path, {
+        cwd: options.cwd,
+        runner: options.runner
+    });
+    return validateEvidenceLedger(text, {
+        publicKeyResolver: options.publicKeyResolver,
+        yamlRowIds: options.yamlRowIds,
+        baseRefOldText
+    });
+}
+//# sourceMappingURL=evidenceLedger.js.map

package/packages/core/dist/markers/evidenceLedger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidenceLedger.js","sourceRoot":"","sources":["../../src/markers/evidenceLedger.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,6EAA6E;AAC7E,uCAAuC;AACvC,qDAAqD;AACrD,iEAAiE;AACjE,4EAA4E;AAC5E,4EAA4E;AAC5E,oEAAoE;AACpE,4EAA4E;AAC5E,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,qFAAqF;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,UAAU,EACV,eAAe,EACf,eAAe,EAEhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAA0B,MAAM,qBAAqB,CAAC;AA8E1E,gFAAgF;AAChF,+EAA+E;AAC/E,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;AAE7D,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,YAAY,EAAE,yBAAyB;IACvC,SAAS,EAAE,sBAAsB;IACjC,eAAe,EAAE,4BAA4B;CACrC,CAAC,CAAC;AAuBZ,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,mBAAmB,KAAK,SAAS,CAAC;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,GAAG,GAAI,KAAwC,EAAE,WAAW,CAAC;IACnE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,GAAG,GAAI,KAAwC,EAAE,mBAAmB,CAAC;IAC3E,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,oDAAoD;AACpD,EAAE;AACF,mDAAmD;AACnD,4EAA4E;AAC5E,iFAAiF;AACjF,wBAAwB;AACxB,uEAAuE;AACvE,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,iFAAiF;AACjF,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,KAA8B;IAC9D,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,+EAA+E;IAC/E,6CAA6C;IAC7C,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,OACE,iBAAiB,GAAG,KAAK,CAAC,MAAM;QAChC,CAAC,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EACnD,CAAC;QACD,iBAAiB,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,IAAI,GAAG,GAAG,iBAAiB,EAAE,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,WAAW,GAAuB,EAAE,CAAC;QAE3C,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAE9C,6DAA6D;QAC7D,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,oBAAoB,CAAC,YAAY;gBACvC,IAAI;gBACJ,OAAO,EAAE,oCAAoC,GAAG,6DAA6D;aAC9G,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,sDAAsD;YACtD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,WAAW,CAAC,IAAI,CAAC;wBACf,IAAI,EAAE,oBAAoB,CAAC,eAAe;wBAC1C,IAAI;wBACJ,WAAW,EAAE,GAAG;wBAChB,OAAO,EAAE,yBAAyB,GAAG,uBAAuB,GAAG,EAAE;qBAClE,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC;wBACf,IAAI,EAAE,oBAAoB,CAAC,SAAS;wBACpC,IAAI;wBACJ,WAAW,EAAE,GAAG;wBAChB,OAAO,EAAE,eAAe,GAAG,uCAAuC,GAAG,gCAAgC;qBACtG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,oBAAoB,CAAC,eAAe;oBAC1C,IAAI;oBACJ,WAAW,EAAE,GAAG;oBAChB,OAAO,EAAE,yBAAyB,GAAG,uBAAuB,GAAG,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAErB,uEAAuE;YACvE,qEAAqE;YACrE,MAAM,YAAY,GAChB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAChF,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC9B,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,oBAAoB,CAAC,YAAY;oBACvC,IAAI;oBACJ,WAAW,EAAE,GAAG;oBAChB,OAAO,EAAE,oFAAoF,GAAG,GAAG;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,eAAe,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,gBAAgB,EAAE,eAAe;QACjC,mBAAmB,EAAE,iBAAiB;QACtC,MAAM;KACP,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,MAAM,wBAAwB,GAAG,mBAAmB,CAAC;AAC5D,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,sEAAsE;AACtE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,gBAAgB,EAAE,kBAAkB;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,iBAAiB,EAAE,mBAAmB;IACtC,yBAAyB,EAAE,2BAA2B;IACtD,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAE,eAAe;IAC9B,oBAAoB,EAAE,sBAAsB;IAC5C,qBAAqB,EAAE,uBAAuB;IAC9C,yBAAyB,EAAE,2BAA2B;IACtD,oBAAoB,EAAE,sBAAsB;IAC5C,qBAAqB,EAAE,uBAAuB;CACtC,CAAC,CAAC;AAuBZ,mFAAmF;AACnF,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,6EAA6E;AAC7E,wBAAwB;AACxB,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtB,SAAS,CAAC,+CAA+C;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB,CAAC,gBAAgB;gBACxC,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,QAAQ,MAAM,uBAAwB,KAAe,CAAC,OAAO,EAAE;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,mFAAmF;AACnF,mCAAmC;AACnC,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAc;IAC9C,IAAI,MAAM,GAAY,KAAK,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD,yEAAyE;AACzE,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,kFAAkF;AAClF,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,IAAmB,EACnB,OAAkC;IAElC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/D,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB,CAAC,uBAAuB;YAC/C,IAAI;YACJ,OAAO,EAAE,8BAA8B,YAAY,CAAC,MAAM;iBACvD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;iBACpD,IAAI,CAAC,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,MAAM,YAAY,GAAG,WAAW,CAAC,KAAgC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9F,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,IAAI;YACJ,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,wBAAwB,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;YAC5C,IAAI;YACJ,OAAO,EAAE,oBAAoB,MAAM,CAAC,YAAY,CAAC,UAAU,wBAAwB,wBAAwB;YAC3G,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,yDAAyD;IACzD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;QACjF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;YAC7C,IAAI;YACJ,OAAO,EAAE,0BAA0B,MAAM,CAAC,kBAAkB,CAAC,WAAW,iBAAiB,0BAA0B;YACnH,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,2EAA2E;IAC3E,8EAA8E;IAC9E,gFAAgF;IAChF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,KAAmB,CAAC;QAClC,0EAA0E;QAC1E,2EAA2E;QAC3E,8CAA8C;QAC9C,MAAM,UAAU,GAAG,qBAAqB,CACtC,KAAK,CAAC,GAAG,CAAC,MAAM,EAChB,KAAK,CAAC,QAAQ,CAAC,KAAqE,CACrF,CAAC;QACF,IAAI,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB,CAAC,yBAAyB;gBACjD,IAAI;gBACJ,OAAO,EAAE,oBAAoB,KAAK,CAAC,QAAQ,CAAC,gBAAgB,uCAAuC,UAAU,GAAG;gBAChH,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;QACD,8EAA8E;QAC9E,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB,CAAC,oBAAoB;gBAC5C,IAAI;gBACJ,OAAO,EAAE,sBAAsB,KAAK,CAAC,GAAG,CAAC,MAAM,0BAA0B;gBACzE,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/B,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClE,CAAC;AA2BD,+EAA+E;AAC/E,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,OAAsC;IAEtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAoB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,gFAAgF;IAChF,gFAAgF;IAChF,aAAa;IACb,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CACvB,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,EACvC,eAAe,CAAC,IAAI,CAAC,CACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;gBAC7C,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC;gBAChC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAClC,MAAM,OAAO,GAA0B;QACrC,oBAAoB,EAAE,OAAO;QAC7B,kBAAkB,EAAE,UAAU;QAC9B,oBAAoB,EAAE,OAAO,GAAG,UAAU;QAC1C,WAAW,EAAE,YAAY;QACzB,cAAc,EAAE,YAAY;KAC7B,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,MAAM;QACN,MAAM;QACN,WAAW,EAAE,YAAY;QACzB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,6DAA6D;AAC7D,MAAM,UAAU,oCAAoC,CAClD,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,OAGsB;IAEtB,MAAM,cAAc,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE;QACpD,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,OAAO,sBAAsB,CAAC,IAAI,EAAE;QAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc;KACf,CAAC,CAAC;AACL,CAAC"}

package/packages/core/dist/markers/freshness.d.ts

@@ -0,0 +1,125 @@
+import { STATUS_SCHEMA_ID } from "./constants.js";
+import { type ProofEvent } from "./evidenceLedger.js";
+import type { MaterializedRegistry } from "./registry.js";
+import type { ScanResult } from "./scanner.js";
+export type RowStatus = "FRESH" | "SUSPECT" | "UNPROVEN" | "UNBOUND" | "INVALID";
+export type PolicyMode = "feature" | "release" | "custom";
+export type LocalStatus = "VERIFIED_LOCAL" | "STALE_LOCAL" | "UNVERIFIED_LOCAL";
+export interface LocalVerificationResult {
+    row_id: string;
+    context_hash: string;
+    binding_set_hash: string;
+    passed: boolean;
+}
+export interface FreshnessInputRow {
+    row_id: string;
+    verification_policy: unknown;
+    approval_policy: unknown;
+    [key: string]: unknown;
+}
+export interface PolicyDecisionContext {
+    row_id: string;
+    status: RowStatus;
+    required_for_release: boolean;
+    is_invalid: boolean;
+}
+export type CustomPolicyPredicate = (context: PolicyDecisionContext) => boolean;
+export interface ReleaseGatePolicy {
+    required_authority?: "ci";
+    require_protected_ref?: boolean;
+}
+export interface DeriveFreshnessInput {
+    rows: ReadonlyArray<FreshnessInputRow>;
+    registry: MaterializedRegistry;
+    scan: ScanResult;
+    evidence: ReadonlyArray<ProofEvent>;
+    policy_mode: PolicyMode;
+    custom_policy?: CustomPolicyPredicate;
+    release_gate?: ReleaseGatePolicy;
+    current_context_hashes?: ReadonlyMap<string, string>;
+    local_results?: ReadonlyArray<LocalVerificationResult>;
+    generated_at: string;
+    product_root?: string;
+    tool?: {
+        name: string;
+        version: string;
+    };
+    global_integrity_errors?: ReadonlyArray<Record<string, unknown>>;
+}
+export interface FreshnessReason {
+    code: string;
+    binding_slug?: string;
+    expected_span_sha256?: string;
+    actual_span_sha256?: string;
+    expected_file_path?: string;
+    actual_file_path?: string;
+    message?: string;
+}
+export interface ProofRef {
+    event_id: string;
+    created_at: string;
+    commit: string;
+}
+export interface CurrentBindingOut {
+    binding_slug: string;
+    file_path: string;
+    extent_kind: "explicit" | "swift_func_inferred";
+    recognizer_id: string;
+    span_canon_id: string;
+    span_sha256: string;
+    span_start_line: number;
+    span_end_line: number;
+}
+export interface IntegrityErrorOut {
+    code: string;
+    row_id?: string;
+    binding_slug?: string;
+    file_path?: string;
+    line?: number;
+    message?: string;
+}
+export interface FreshnessRowOut {
+    row_id: string;
+    row_hash?: string;
+    verification_policy_hash?: string;
+    approval_policy_hash?: string;
+    status: RowStatus;
+    policy_block: boolean;
+    reasons: FreshnessReason[];
+    known_binding_slugs: string[];
+    current_binding_slugs: string[];
+    missing_registered_binding_slugs: string[];
+    unregistered_current_binding_slugs: string[];
+    current_binding_set_hash?: string;
+    current_bindings: CurrentBindingOut[];
+    matching_proof_event: ProofRef | null;
+    latest_trusted_proof_event: ProofRef | null;
+    required_action: string | null;
+    required_for_release?: boolean;
+    local_status?: LocalStatus | null;
+    local_reason?: string | null;
+}
+export interface FreshnessSummary {
+    fresh: number;
+    suspect: number;
+    unproven: number;
+    unbound: number;
+    invalid: number;
+    policy_blocked: number;
+}
+export interface FreshnessStatus {
+    schema: typeof STATUS_SCHEMA_ID;
+    generated_at: string;
+    tool: {
+        name: string;
+        version: string;
+    };
+    product_root: string;
+    policy_mode: PolicyMode;
+    guard_ok: boolean;
+    summary: FreshnessSummary;
+    integrity_errors: IntegrityErrorOut[];
+    rows: FreshnessRowOut[];
+}
+export declare function deriveFreshness(input: DeriveFreshnessInput): FreshnessStatus;
+//# sourceMappingURL=freshness.d.ts.map

package/packages/core/dist/markers/freshness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness.d.ts","sourceRoot":"","sources":["../../src/markers/freshness.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAiB,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAqC,UAAU,EAAE,MAAM,cAAc,CAAC;AAElF,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AACjF,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAY1D,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAMhF,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,OAAO,CAAC;CACjB;AAKD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,EAAE,OAAO,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAchF,MAAM,WAAW,iBAAiB;IAIhC,kBAAkB,CAAC,EAAE,IAAI,CAAC;IAI1B,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IAEnC,IAAI,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAEvC,QAAQ,EAAE,oBAAoB,CAAC;IAE/B,IAAI,EAAE,UAAU,CAAC;IAEjB,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACpC,WAAW,EAAE,UAAU,CAAC;IAExB,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAGtC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAQjC,sBAAsB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAKrD,aAAa,CAAC,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IAEvD,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAGzC,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,GAAG,qBAAqB,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,gCAAgC,EAAE,MAAM,EAAE,CAAC;IAC3C,kCAAkC,EAAE,MAAM,EAAE,CAAC;IAC7C,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,oBAAoB,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtC,0BAA0B,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC5C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAI/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAI/B,YAAY,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,gBAAgB,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,gBAAgB,EAAE,iBAAiB,EAAE,CAAC;IACtC,IAAI,EAAE,eAAe,EAAE,CAAC;CACzB;AAiUD,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CAuW5E"}