@aligndottech/cli 0.50.0 → 0.51.0

package/dist/detector/resolve-pair.js

@@ -0,0 +1,345 @@
+/**
+ * TypeScript port of the brain's pure pair resolver, `resolve_incompatible_pair` in align-stack
+ * `services/brain/app/relationship_type_rules.py` (ALI-625, ALI-1042, ALI-1050).
+ *
+ * The model reports only that two decisions are INCOMPATIBLE, plus which side's own text replaces
+ * the other. Whether that is a supersession or a conflict is a question about dates, authorship
+ * and status, so it is computed here and never taken from the model. Every ambiguous case
+ * resolves to the non-destructive `conflicts_with`.
+ *
+ * Checked against resolver-vectors.json, generated by running the brain's REAL function
+ * (scripts/gen-resolver-vectors.py). Change the brain first, regenerate, then port.
+ *
+ * Pure: no I/O, no clock, no network.
+ */
+/** Within this window two decisions are concurrent and a supersession is refused. */
+export const CONCURRENT_WINDOW_HOURS = 24;
+// A Map, not an object literal: `__proto__` or `toString` must read as unknown (0), as dict.get does.
+const STANDING_RANK = new Map([['human', 3], ['ratified_agent', 2], ['unratified_agent', 1]]);
+const AUTHOR_SENTINELS = new Set(['unknown']);
+const RETIRED_STATUSES = new Set(['superseded', 'archived', 'corrected']);
+// ---- A port of CPython 3.14's C datetime.fromisoformat (Modules/_datetimemodule.c) -------------
+// Python's parse_decided_at is `_as_utc(fromisoformat(value.replace("Z", "+00:00")))`, naive read
+// as UTC, and a ValueError is MISSING. The C implementation is what runs, and it differs from the
+// pure-Python _pydatetime in ways that matter here: it works on the UTF-8 BYTES, reads exactly two
+// digits per field, needs a time after any separator character, tolerates one stray character
+// right before a UTC offset, and parses a fraction with no '.' in the compact form. Ported
+// structurally, with C's NUL terminator modelled as byte 0 past the end, and checked against
+// date-fuzz-corpus.json (4,000 strings with Python 3.14's own verdict) and resolver-vectors.json.
+// No trimming: Python does not trim.
+/** A NUL-terminated byte view: reads past the end return 0, as C's string does. */
+class Bytes {
+    b;
+    constructor(b) {
+        this.b = b;
+    }
+    at(i) { return i >= 0 && i < this.b.length ? this.b[i] : 0; }
+}
+const isDigitByte = (c) => c >= 0x30 && c <= 0x39;
+/** Exactly `n` ASCII digits at `p`, or null. */
+function readDigits(s, p, n) {
+    let v = 0;
+    for (let k = 0; k < n; k++) {
+        const c = s.at(p + k);
+        if (!isDigitByte(c))
+            return null;
+        v = v * 10 + (c - 0x30);
+    }
+    return { v, p: p + n };
+}
+function isLeap(y) { return y % 4 === 0 && (y % 100 !== 0 || y % 400 === 0); }
+const DAYS_IN_MONTH = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function daysInMonth(y, m) { return m === 2 && isLeap(y) ? 29 : DAYS_IN_MONTH[m] ?? 0; }
+function daysBeforeYear(y) { const p = y - 1; return p * 365 + Math.floor(p / 4) - Math.floor(p / 100) + Math.floor(p / 400); }
+/** Proleptic Gregorian ordinal, 0001-01-01 = 1 (Python's _ymd2ord). */
+function ymd2ord(y, m, d) {
+    let before = 0;
+    for (let k = 1; k < m; k++)
+        before += daysInMonth(y, k);
+    return daysBeforeYear(y) + before + d;
+}
+function ord2ymd(n) {
+    let y = Math.max(1, Math.floor(n / 365.2425) - 1);
+    while (daysBeforeYear(y + 1) < n)
+        y++;
+    while (daysBeforeYear(y) >= n)
+        y--;
+    let rest = n - daysBeforeYear(y);
+    let m = 1;
+    while (rest > daysInMonth(y, m)) {
+        rest -= daysInMonth(y, m);
+        m++;
+    }
+    return [y, m, rest];
+}
+/** _find_isoformat_datetime_separator, on bytes; -1 is invalid. */
+function separatorAt(s, len) {
+    if (len === 7)
+        return 7;
+    if (s.at(4) === 0x2d) {
+        if (s.at(5) === 0x57) {
+            if (len < 8)
+                return -1;
+            if (len > 8 && s.at(8) === 0x2d) {
+                if (len === 9)
+                    return -1;
+                if (len > 10 && isDigitByte(s.at(10)))
+                    return 8;
+                return 10;
+            }
+            return 8;
+        }
+        return 10;
+    }
+    if (s.at(4) === 0x57) {
+        let idx = 7;
+        while (idx < len && isDigitByte(s.at(idx)))
+            idx++;
+        if (idx < 9)
+            return idx;
+        return idx % 2 === 0 ? 7 : 8;
+    }
+    return 8;
+}
+/** parse_isoformat_date: [y, m, d] or null. Reads past `len` exactly as C does. */
+function parseDate(s, len) {
+    const y = readDigits(s, 0, 4);
+    if (!y)
+        return null;
+    let p = y.p;
+    const usesSep = s.at(p) === 0x2d;
+    if (usesSep)
+        p++;
+    if (s.at(p) === 0x57) {
+        p++;
+        const w = readDigits(s, p, 2);
+        if (!w)
+            return null;
+        p = w.p;
+        let day = 1;
+        if (p < len) {
+            if (usesSep) {
+                if (s.at(p) !== 0x2d)
+                    return null;
+                p++;
+            }
+            const d = readDigits(s, p, 1);
+            if (!d)
+                return null;
+            day = d.v;
+        }
+        const year = y.v;
+        if (year < 1 || year > 9999)
+            return null;
+        if (!(w.v > 0 && w.v < 53)) {
+            const firstWeekday = ymd2ord(year, 1, 1) % 7;
+            if (!(w.v === 53 && (firstWeekday === 4 || (firstWeekday === 3 && isLeap(year)))))
+                return null;
+        }
+        if (!(day > 0 && day < 8))
+            return null;
+        const first = ymd2ord(year, 1, 1);
+        const firstWd = (first + 6) % 7;
+        let week1Monday = first - firstWd;
+        if (firstWd > 3)
+            week1Monday += 7;
+        return ord2ymd(week1Monday + (w.v - 1) * 7 + (day - 1));
+    }
+    const m = readDigits(s, p, 2);
+    if (!m)
+        return null;
+    p = m.p;
+    if (usesSep) {
+        if (s.at(p) !== 0x2d)
+            return null;
+        p++;
+    }
+    const d = readDigits(s, p, 2);
+    if (!d)
+        return null;
+    return [y.v, m.v, d.v];
+}
+/** parse_hh_mm_ss_ff over [p, end): -1 on error, else 0 (clean end) or 1 (something follows). */
+function parseHms(s, p, end, out) {
+    out[0] = out[1] = out[2] = out[3] = 0;
+    let hasSep = true;
+    let fraction = false;
+    for (let i = 0; i < 3; i++) {
+        const r = readDigits(s, p, 2);
+        if (!r)
+            return -1;
+        out[i] = r.v;
+        p = r.p;
+        const c = s.at(p);
+        p++;
+        if (i === 0)
+            hasSep = c === 0x3a;
+        // A decimal mark with nothing after it is an error even right before an offset (checked on 3.14).
+        if ((c === 0x2e || c === 0x2c) && p >= end)
+            return -1;
+        if (p >= end)
+            return c !== 0 ? 1 : 0;
+        if (hasSep && c === 0x3a) {
+            if (i === 2)
+                return -1;
+            continue;
+        }
+        if (c === 0x2e || c === 0x2c) {
+            if (i < 2)
+                return -1;
+            fraction = true;
+            break;
+        }
+        if (!hasSep) {
+            p--;
+            if (i === 2)
+                fraction = true;
+            continue;
+        }
+        return -1;
+    }
+    if (!fraction)
+        return s.at(p) !== 0 ? 1 : 0;
+    const remains = end - p;
+    const toParse = remains >= 6 ? 6 : remains;
+    const f = readDigits(s, p, toParse);
+    if (!f)
+        return -1;
+    out[3] = toParse < 6 ? f.v * [100000, 10000, 1000, 100, 10][toParse - 1] : f.v;
+    p = f.p;
+    while (isDigitByte(s.at(p)))
+        p++;
+    return s.at(p) !== 0 ? 1 : 0;
+}
+const MIN_US = -62135596800000000n; // 0001-01-01T00:00:00Z
+const MAX_US = 253402300799999999n; // 9999-12-31T23:59:59.999999Z
+/** Microseconds since 1970-01-01T00:00:00Z, or null where Python's parse_decided_at gives None (or raises). */
+export function parseDecidedAt(value) {
+    if (typeof value !== 'string')
+        return null;
+    const replaced = value.replaceAll('Z', '+00:00');
+    if (replaced.length < 7)
+        return null;
+    if (/[\uD800-\uDFFF]/.test(replaced))
+        return null; // a lone surrogate cannot be UTF-8 encoded
+    const s = new Bytes(new TextEncoder().encode(replaced));
+    const len = s.b.length;
+    const sep = separatorAt(s, len);
+    if (sep < 0)
+        return null;
+    const date = parseDate(s, sep);
+    if (!date)
+        return null;
+    let [y, m, d] = date;
+    const t = [0, 0, 0, 0];
+    let offsetUs = 0n;
+    if (len > sep) {
+        const lead = s.at(sep);
+        let p = sep + ((lead & 0x80) === 0 ? 1 : (lead & 0xf0) === 0xe0 ? 3 : (lead & 0xf0) === 0xf0 ? 4 : 2);
+        const end = len;
+        let tz = p;
+        do {
+            const c = s.at(tz);
+            if (c === 0x5a || c === 0x2b || c === 0x2d)
+                break;
+        } while (++tz < end);
+        const rv = parseHms(s, p, tz, t);
+        if (rv < 0)
+            return null;
+        if (tz >= end) {
+            if (rv === 1)
+                return null;
+        }
+        else if (s.at(tz) === 0x5a) {
+            if (s.at(tz + 1) !== 0)
+                return null;
+        }
+        else {
+            const sign = s.at(tz) === 0x2d ? -1n : 1n;
+            p = tz + 1;
+            const tzc = [0, 0, 0, 0];
+            if (parseHms(s, p, end, tzc) !== 0)
+                return null;
+            offsetUs = sign * (BigInt(tzc[0]) * 3600000000n + BigInt(tzc[1]) * 60000000n + BigInt(tzc[2]) * 1000000n + BigInt(tzc[3]));
+            if (offsetUs >= 86400000000n || offsetUs <= -86400000000n)
+                return null;
+        }
+    }
+    const [h0, mi, se, us] = t;
+    let h = h0;
+    if (h === 24 && m <= 12 && d <= daysInMonth(y, m)) {
+        if (mi !== 0 || se !== 0 || us !== 0)
+            return null;
+        h = 0;
+        d += 1;
+        if (d > daysInMonth(y, m)) {
+            d = 1;
+            m += 1;
+            if (m > 12) {
+                m = 1;
+                y += 1;
+            }
+        }
+    }
+    if (y < 1 || y > 9999 || m < 1 || m > 12 || d < 1 || d > daysInMonth(y, m))
+        return null;
+    if (h > 23 || mi > 59 || se > 59 || us > 999999)
+        return null;
+    const EPOCH_ORD = 719163; // ymd2ord(1970, 1, 1)
+    const local = BigInt(ymd2ord(y, m, d) - EPOCH_ORD) * 86400000000n + BigInt(h) * 3600000000n + BigInt(mi) * 60000000n + BigInt(se) * 1000000n + BigInt(us);
+    const utc = local - offsetUs;
+    // _as_utc's astimezone raises OverflowError past the datetime range: the brain gets no date.
+    if (offsetUs !== 0n && (utc < MIN_US || utc > MAX_US))
+        return null;
+    return utc;
+}
+/** Python's str.isspace set, so strip() here removes exactly what Python's does (JS trim also strips U+FEFF). */
+const PY_WHITESPACE = new Set([0x9, 0xa, 0xb, 0xc, 0xd, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x85, 0xa0, 0x1680, 0x2000, 0x2001, 0x2002, 0x2003,
+    0x2004, 0x2005, 0x2006, 0x2007, 0x2008, 0x2009, 0x200a, 0x2028, 0x2029, 0x202f, 0x205f, 0x3000]);
+export function pyStrip(s) {
+    let a = 0;
+    let b = s.length;
+    while (a < b && PY_WHITESPACE.has(s.charCodeAt(a)))
+        a++;
+    while (b > a && PY_WHITESPACE.has(s.charCodeAt(b - 1)))
+        b--;
+    return s.slice(a, b);
+}
+export function normalizeAuthor(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = pyStrip(value).toLowerCase();
+    if (!normalized || AUTHOR_SENTINELS.has(normalized))
+        return null;
+    return normalized;
+}
+export function isRetired(status) {
+    return status !== null && status !== undefined && RETIRED_STATUSES.has(status);
+}
+const rank = (standing) => (typeof standing === 'string' ? STANDING_RANK.get(standing) ?? 0 : 0);
+const conflict = (a, b) => ({ type: 'conflicts_with', fromId: a.id, toId: b.id });
+/** The edge for an incompatible pair, or null for no edge at all. */
+export function resolveIncompatiblePair(a, b, explicitReplacementBy = null) {
+    if (isRetired(a.status) || isRetired(b.status))
+        return null;
+    if ((b.exceptedBy ?? []).includes(a.id) || (a.exceptedBy ?? []).includes(b.id))
+        return null;
+    const aAt = parseDecidedAt(a.decidedAt);
+    const bAt = parseDecidedAt(b.decidedAt);
+    if (aAt === null || bAt === null)
+        return conflict(a, b);
+    // Python's sorted() is stable, so on a tie `a` stays first.
+    const [first, second, firstAt, secondAt] = bAt < aAt ? [b, a, bAt, aAt] : [a, b, aAt, bAt];
+    if (secondAt - firstAt <= BigInt(CONCURRENT_WINDOW_HOURS) * 3600000000n)
+        return conflict(a, b);
+    const aAuthor = normalizeAuthor(a.author);
+    const sameAuthor = aAuthor !== null && aAuthor === normalizeAuthor(b.author);
+    const claimAgreesWithClock = explicitReplacementBy !== null && pyStrip(explicitReplacementBy) === second.id;
+    if (sameAuthor || claimAgreesWithClock) {
+        if (rank(second.standing) < rank(first.standing))
+            return conflict(a, b);
+        return { type: 'supersedes', fromId: second.id, toId: first.id };
+    }
+    return conflict(a, b);
+}
+//# sourceMappingURL=resolve-pair.js.map

package/dist/detector/resolve-pair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-pair.js","sourceRoot":"","sources":["../../src/detector/resolve-pair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,qFAAqF;AACrF,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,sGAAsG;AACtG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9G,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC9C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAmB1E,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,mGAAmG;AACnG,8FAA8F;AAC9F,2FAA2F;AAC3F,6FAA6F;AAC7F,kGAAkG;AAClG,qCAAqC;AAErC,mFAAmF;AACnF,MAAM,KAAK;IACY;IAArB,YAAqB,CAAa;QAAb,MAAC,GAAD,CAAC,CAAY;IAAG,CAAC;IACtC,EAAE,CAAC,CAAS,IAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/E;AACD,MAAM,WAAW,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC;AACnE,gDAAgD;AAChD,SAAS,UAAU,CAAC,CAAQ,EAAE,CAAS,EAAE,CAAS;IAChD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,IAAa,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1E,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS,IAAY,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAChH,SAAS,cAAc,CAAC,CAAS,IAAY,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/I,uEAAuE;AACvE,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC9C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AACxC,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,OAAO,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;QAAE,CAAC,EAAE,CAAC;IACtC,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,CAAC,EAAE,CAAC;IACnC,IAAI,IAAI,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,IAAI,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAAC,IAAI,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IACpE,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAAC,CAAQ,EAAE,GAAW;IACxC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACvB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChC,IAAI,GAAG,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC,CAAC;gBACzB,IAAI,GAAG,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;oBAAE,OAAO,CAAC,CAAC;gBAChD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,OAAO,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,EAAE,CAAC;QAClD,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACxB,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,CAAQ,EAAE,GAAW;IACtC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IACjC,IAAI,OAAO;QAAE,CAAC,EAAE,CAAC;IACjB,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC,EAAE,CAAC;QACJ,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACR,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YACZ,IAAI,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YACxD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC;QAClC,IAAI,OAAO,GAAG,CAAC;YAAE,WAAW,IAAI,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACR,IAAI,OAAO,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IACxD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,iGAAiG;AACjG,SAAS,QAAQ,CAAC,CAAQ,EAAE,CAAS,EAAE,GAAW,EAAE,GAAa;IAC/D,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC;QAClB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACR,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,CAAC;QACJ,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,GAAG,CAAC,KAAK,IAAI,CAAC;QACjC,kGAAkG;QAClG,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3C,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IAClB,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACR,OAAO,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,kBAAkB,CAAC,CAAC,uBAAuB;AAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,8BAA8B;AAElE,+GAA+G;AAC/G,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC9F,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACvB,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtG,MAAM,GAAG,GAAG,GAAG,CAAC;QAChB,IAAI,EAAE,GAAG,CAAC,CAAC;QACX,GAAG,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACnB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM;QACpD,CAAC,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE;QACrB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACzB,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChD,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,WAAc,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,SAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,QAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;YACtI,IAAI,QAAQ,IAAI,YAAe,IAAI,QAAQ,IAAI,CAAC,YAAe;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAqC,CAAC;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,CAAC,GAAG,CAAC,CAAC;QACN,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,sBAAsB;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,YAAe,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,WAAc,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,SAAW,GAAG,MAAM,CAAC,EAAE,CAAC,GAAG,QAAU,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACpK,MAAM,GAAG,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC7B,6FAA6F;IAC7F,IAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iHAAiH;AACjH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACnG,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IAC5D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAiC;IACzD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,QAAmC,EAAU,EAAE,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpI,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAE,CAAW,EAAc,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAElH,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,CAAW,EAAE,CAAW,EAAE,wBAAuC,IAAI;IAC3G,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5F,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAExD,4DAA4D;IAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3F,IAAI,QAAQ,GAAG,OAAO,IAAI,MAAM,CAAC,uBAAuB,CAAC,GAAG,WAAc;QAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAElG,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7E,MAAM,oBAAoB,GAAG,qBAAqB,KAAK,IAAI,IAAI,OAAO,CAAC,qBAAqB,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;IAC5G,IAAI,UAAU,IAAI,oBAAoB,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/detector/similar-item.d.ts

@@ -0,0 +1,20 @@
+/**
+ * One `similar[]` entry -> the edge to write, ported from the brain's
+ * `resolve_similar_relationships` (verdict_resolution.py, ALI-637) for a single entry.
+ *
+ * A non-verdict type passes through. `incompatible` goes through resolveIncompatiblePair with the
+ * new decision as side A; the model's `replaced` side becomes the replacing id. A `supersedes` the
+ * resolver orients candidate -> new cannot be written on a new-vs-candidate edge, so it degrades
+ * to `conflicts_with` with the same reason the brain appends.
+ */
+import type { ParsedRelationshipItem } from './relationship-contract.js';
+import { type PairSide } from './resolve-pair.js';
+export declare const NEW_DECISION_REF = "__new_decision__";
+export declare const DIRECTION_FALLBACK_REASON = "existing decision is more recent; supersession toward the new decision is not expressible on this path";
+export interface ResolvedItem {
+    type: string;
+    confidence: number;
+    reason: string;
+}
+export declare function resolveSimilarItem(item: ParsedRelationshipItem, newSide: PairSide, candidate: PairSide): ResolvedItem | null;
+//# sourceMappingURL=similar-item.d.ts.map

package/dist/detector/similar-item.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"similar-item.d.ts","sourceRoot":"","sources":["../../src/detector/similar-item.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,KAAK,QAAQ,EAA2B,MAAM,mBAAmB,CAAC;AAE3E,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,yBAAyB,2GACoE,CAAC;AAE3G,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAS5H"}

package/dist/detector/similar-item.js

@@ -0,0 +1,16 @@
+import { resolveIncompatiblePair } from './resolve-pair.js';
+export const NEW_DECISION_REF = '__new_decision__';
+export const DIRECTION_FALLBACK_REASON = 'existing decision is more recent; supersession toward the new decision is not expressible on this path';
+export function resolveSimilarItem(item, newSide, candidate) {
+    if (item.type !== 'incompatible')
+        return { type: item.type, confidence: item.confidence, reason: item.reason };
+    const replacingId = item.replaced === 'new' ? newSide.id : item.replaced === 'existing' ? candidate.id : null;
+    const resolution = resolveIncompatiblePair(newSide, candidate, replacingId);
+    if (resolution === null)
+        return null;
+    if (resolution.type === 'supersedes' && resolution.fromId !== newSide.id) {
+        return { type: 'conflicts_with', confidence: item.confidence, reason: item.reason ? `${item.reason}; ${DIRECTION_FALLBACK_REASON}` : DIRECTION_FALLBACK_REASON };
+    }
+    return { type: resolution.type, confidence: item.confidence, reason: item.reason };
+}
+//# sourceMappingURL=similar-item.js.map

package/dist/detector/similar-item.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"similar-item.js","sourceRoot":"","sources":["../../src/detector/similar-item.ts"],"names":[],"mappings":"AAUA,OAAO,EAAiB,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,CAAC,MAAM,yBAAyB,GACpC,wGAAwG,CAAC;AAQ3G,MAAM,UAAU,kBAAkB,CAAC,IAA4B,EAAE,OAAiB,EAAE,SAAmB;IACrG,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC/G,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5E,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACzE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC;IACnK,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC"}

package/dist/index.js

@@ -2,27 +2,35 @@
 import './lib/startup-env.js'; // FIRST: snapshot the shell's env before any module can change it
 import './lib/startup-xdg.js'; // SECOND: drop a relative XDG_* before anything computes a directory from it
 import './lib/startup-backfill-track.js'; // THIRD: if align_backfill started this process, record how it ends
+import { writeSync } from 'node:fs';
 import envPaths from 'env-paths';
 import { migrateConfigDirectory } from './lib/config.js';
-import { legacyLocalDbDir, migrateLocalDb } from './lib/local-mode.js';
+import { getLocalDbPath, legacyLocalDbDir, migrateLocalDb } from './lib/local-mode.js';
+import { excludeGraphFromBackups } from './lib/backup-exclusion.js';
 import { buildProgram } from './cli.js';
+import { resolveDetectorVersion } from './detector/detector-version.js';
+import { describeFatal } from './lib/fatal.js';
+import { printRedactionNotice } from './lib/redaction-notice.js';
 // Last-resort guard so no command ever dumps a raw Node stack trace at a user.
 // Individual commands still handle their own expected errors; this only catches
 // the unexpected (e.g. a native/db error escaping an async action).
 function handleFatal(err) {
-    const e = err instanceof Error ? err : new Error(String(err));
-    if (process.env['ALIGN_DEBUG']) {
-        console.error(e);
-    }
-    else {
-        console.error(`\nalign: ${e.message}\n`);
-        console.error('Run with ALIGN_DEBUG=1 for the full stack trace, or report it at');
-        console.error('https://github.com/aligndottech/align-cli/issues');
-    }
-    process.exit(1);
+    const r = describeFatal(err, Boolean(process.env['ALIGN_DEBUG']));
+    if (r.stack)
+        console.error(r.stack);
+    for (const line of r.lines)
+        console.error(line);
+    process.exit(r.code);
 }
 process.on('uncaughtException', handleFatal);
 process.on('unhandledRejection', handleFatal);
+// A command that exits before its postAction hook still tells the person how many secrets it kept
+// out of the local graph. Taking the notice resets it, so this never repeats one cli.ts printed.
+// A synchronous write: an asynchronous stderr pipe (macOS) is not flushed once 'exit' runs.
+process.on('exit', () => printRedactionNotice((line) => { try {
+    writeSync(2, `${line}\n`);
+}
+catch { /* stderr closed */ } }));
 // One-time directory migrations (ALI-819, Copilot review on #231), run exactly once at
 // real process startup - never inside createConfigStore()/getLocalDbPath() themselves,
 // which stay pure so tests that mock `conf` don't also need to mock the filesystem.
@@ -32,11 +40,21 @@ process.on('unhandledRejection', handleFatal);
 try {
     migrateConfigDirectory(envPaths('align-cli', { suffix: 'nodejs' }).config, envPaths('align-cli', { suffix: '' }).config);
     migrateLocalDb(legacyLocalDbDir(), envPaths('align-cli', { suffix: '' }).config);
+    // An existing local graph is excluded from Time Machine and cache-aware backups on its first run
+    // after an upgrade (once; a no-op without a graph). Best effort, never fatal (backup-exclusion.ts).
+    excludeGraphFromBackups(getLocalDbPath());
 }
 catch (e) {
     if (process.env['ALIGN_DEBUG'])
         console.error('align: startup migration failed (non-fatal):', e);
 }
+// An unknown ALIGN_DETECTOR is fatal before any command runs: a typo must never run the default silently.
+try {
+    resolveDetectorVersion();
+}
+catch (e) {
+    handleFatal(e);
+}
 // The command tree lives in cli.ts, built from src/commands/registry.ts (ALI-951), so the
 // help, the doc generator and the tests read the same list this entry point parses.
 buildProgram().parseAsync().catch(handleFatal);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,sBAAsB,CAAC,CAAC,kEAAkE;AACjG,OAAO,sBAAsB,CAAC,CAAC,6EAA6E;AAC5G,OAAO,iCAAiC,CAAC,CAAC,oEAAoE;AAC9G,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAClF,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;AAC7C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;AAE9C,uFAAuF;AACvF,uFAAuF;AACvF,oFAAoF;AACpF,+EAA+E;AAC/E,kFAAkF;AAClF,uFAAuF;AACvF,IAAI,CAAC;IACH,sBAAsB,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzH,cAAc,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AACnF,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACX,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,0FAA0F;AAC1F,oFAAoF;AACpF,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,sBAAsB,CAAC,CAAC,kEAAkE;AACjG,OAAO,sBAAsB,CAAC,CAAC,6EAA6E;AAC5G,OAAO,iCAAiC,CAAC,CAAC,oEAAoE;AAC9G,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,+EAA+E;AAC/E,gFAAgF;AAChF,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AACD,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;AAC7C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAC;AAC9C,kGAAkG;AAClG,iGAAiG;AACjG,4FAA4F;AAC5F,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/H,uFAAuF;AACvF,uFAAuF;AACvF,oFAAoF;AACpF,+EAA+E;AAC/E,kFAAkF;AAClF,uFAAuF;AACvF,IAAI,CAAC;IACH,sBAAsB,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzH,cAAc,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACjF,iGAAiG;IACjG,oGAAoG;IACpG,uBAAuB,CAAC,cAAc,EAAE,CAAC,CAAC;AAC5C,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACX,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,0GAA0G;AAC1G,IAAI,CAAC;IACH,sBAAsB,EAAE,CAAC;AAC3B,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IACX,WAAW,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,0FAA0F;AAC1F,oFAAoF;AACpF,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC"}

package/dist/lib/advisory-dedup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advisory-dedup.d.ts","sourceRoot":"","sources":["../../src/lib/advisory-dedup.ts"],"names":[],"mappings":"AAgCA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,GAAG,CAAC,MAAM,CAAC,CAEnF;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAUvF"}
+{"version":3,"file":"advisory-dedup.d.ts","sourceRoot":"","sources":["../../src/lib/advisory-dedup.ts"],"names":[],"mappings":"AAuCA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,GAAG,CAAC,MAAM,CAAC,CAEnF;AAID,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CASvF"}

package/dist/lib/advisory-dedup.js

@@ -1,19 +1,28 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
+import { writePrivateFile } from './private-files.js';
+import { privateTmpDir } from './advisory-verdict.js';
 // The pre- and post-edit advisory hooks both fire for a single edit. To avoid
 // showing the agent the same conflicting decisions twice, we remember which
 // decision ids were surfaced recently (per project dir) and filter them out on the
 // next run inside this window. Best-effort: dedup never blocks the hook.
 const DEDUP_TTL_MS = 20_000;
+// In the verified private temp folder (advisory-verdict.ts), never loose in the shared temp dir, where a
+// predictable name could be planted by another account. Null when that folder is not safe to use.
 function markerPath(cwd) {
+    const dir = privateTmpDir();
+    if (dir === null)
+        return null;
     const hash = createHash('sha1').update(cwd).digest('hex').slice(0, 16);
-    return path.join(tmpdir(), `align-advisory-${hash}.json`);
+    return path.join(dir, `advisory-${hash}.json`);
 }
 function readMarker(cwd, now) {
     try {
-        const m = JSON.parse(readFileSync(markerPath(cwd), 'utf8'));
+        const file = markerPath(cwd);
+        if (file === null)
+            return null;
+        const m = JSON.parse(readFileSync(file, 'utf8'));
         if (typeof m.ts !== 'number' || now - m.ts > DEDUP_TTL_MS)
             return null;
         return m;
@@ -32,10 +41,9 @@ export function markSurfaced(cwd, ids, now = Date.now()) {
     try {
         const merged = new Set([...(readMarker(cwd, now)?.ids ?? []), ...ids]);
         const file = markerPath(cwd);
-        const dir = path.dirname(file);
-        if (!existsSync(dir))
-            mkdirSync(dir, { recursive: true });
-        writeFileSync(file, JSON.stringify({ ts: now, ids: [...merged] }), 'utf8');
+        if (file === null)
+            return;
+        writePrivateFile(file, JSON.stringify({ ts: now, ids: [...merged] }));
     }
     catch {
         // Best-effort only - dedup is a nicety, never fail the hook on it.

package/dist/lib/advisory-dedup.js.map

@@ -1 +1 @@
-{"version":3,"file":"advisory-dedup.js","sourceRoot":"","sources":["../../src/lib/advisory-dedup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,8EAA8E;AAC9E,4EAA4E;AAC5E,mFAAmF;AACnF,yEAAyE;AACzE,MAAM,YAAY,GAAG,MAAM,CAAC;AAO5B,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,IAAI,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAW,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,YAAY;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACpE,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,EAAmB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC"}
+{"version":3,"file":"advisory-dedup.js","sourceRoot":"","sources":["../../src/lib/advisory-dedup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,8EAA8E;AAC9E,4EAA4E;AAC5E,mFAAmF;AACnF,yEAAyE;AACzE,MAAM,YAAY,GAAG,MAAM,CAAC;AAO5B,yGAAyG;AACzG,kGAAkG;AAClG,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAW,CAAC;QAC3D,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,YAAY;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACpE,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAa,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO;QAC1B,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,EAAmB,CAAC,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;AACH,CAAC"}

package/dist/lib/advisory-verdict.d.ts

@@ -56,6 +56,25 @@ export interface StoredVerdict {
     conflicts: VerdictConflict[];
 }
 export declare function contentHashOf(text: string): string;
+/**
+ * A 0700 directory of our own, rather than tmpdir() itself.
+ *
+ * macOS gives each user a private tmpdir, but on Linux `os.tmpdir()` falls back to /tmp
+ * (mode 1777) whenever TMPDIR is unset, and on a shared build host that means two things:
+ * the payload file holds the user's proposed source, and this store feeds the text the
+ * agent is shown as the reason its edit was refused. Neither belongs in a directory other
+ * uids can read or pre-plant symlinks in.
+ *
+ * Returns null when the directory cannot be established safely, and every caller then
+ * degrades to "no store" rather than erroring - fail-open, as everywhere else here.
+ *
+ * The mode bits are POSIX-only; Windows honours just the read-only flag and reports 0o666.
+ * That costs nothing, because the threat is a SHARED tmp directory and Windows already gives
+ * each user a private %LOCALAPPDATA%\Temp - which is also why the uid falls back to a
+ * constant there rather than trying to synthesise one.
+ */
+/** `<tmp>/align-<uid>`: created 0700, refused when it is a link or not ours. Also holds the advisory dedup markers. */
+export declare function privateTmpDir(): string | null;
 /** Where the adjudication payload for one change is handed to the detached child. */
 export declare function adjudicationPayloadPath(contentHash: string): string | null;
 /**

package/dist/lib/advisory-verdict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"advisory-verdict.d.ts","sourceRoot":"","sources":["../../src/lib/advisory-verdict.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,cAAc,QAAc,CAAC;AAC1C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAa,CAAC;AACzC,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAY9C;oFACoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAcD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AA+CD,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AA6GD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAmB,GACvB,aAAa,GAAG,IAAI,CAStB;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,GAAG,GAAE,MAAmB,GACvB,IAAI,CAWN;AAED,2FAA2F;AAC3F,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAMT;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAEpG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAmB,GACvB,IAAI,CAON"}
+{"version":3,"file":"advisory-verdict.d.ts","sourceRoot":"","sources":["../../src/lib/advisory-verdict.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,eAAO,MAAM,cAAc,QAAc,CAAC;AAC1C;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAa,CAAC;AACzC,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,KAAK,CAAC;AACtC;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAY9C;oFACoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,eAAe,EAAE,CAAC;CAC9B;AAcD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,uHAAuH;AACvH,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAe7C;AAcD,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI1E;AA6GD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,MAAmB,GACvB,aAAa,GAAG,IAAI,CAStB;AAED,8FAA8F;AAC9F,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,aAAa,EACtB,GAAG,GAAE,MAAmB,GACvB,IAAI,CAWN;AAED,2FAA2F;AAC3F,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAMT;AAED,mFAAmF;AACnF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAEpG;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,MAAmB,GACvB,IAAI,CAON"}