@allocator-one/rcl 4.4.19

package/dist/evidence/claim-recovery/validation/occurrence-source.js

@@ -0,0 +1,208 @@
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { decodeRecoveryOriginal as decodeOriginalReport } from './recovery-json.js';
+import { claimDescriptorSchema } from './claims.js';
+import { instant, object, uuidSchema } from './primitives.js';
+import { isEventReceiptScope, isStoredEventReceipt } from './receipts.js';
+import { validSightingBinding } from './sighting.js';
+export const hash = (raw) => createHash('sha256').update(raw).digest('hex');
+export const key = (v) => typeof v === 'string' && /^[a-f0-9]{16}$/.test(v);
+export const counter = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+const positive = (v) => counter(v) && v > 0 && v <= 2_147_483_647;
+export function requireSource(valid) { if (!valid)
+    throw new Error('occurrence_source_conflict'); }
+export function requireReason(value) {
+    requireSource(typeof value === 'string' && value.length <= 4000 && value.trim().length > 0 && [...value].length <= 2000 &&
+        !/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value) && !/[\uD800-\uDFFF]/u.test(value));
+}
+/** Selected receipt content, not authentication or proof of inventory completeness. */
+export function receiptFor(receipt, source) {
+    requireSource(isStoredEventReceipt(receipt, source.input.scope) && receipt.converge_target === source.target &&
+        receipt.round === source.round);
+    const converge = source.input.storedRun.converge;
+    if (receipt.attempt !== null)
+        requireSource(receipt.attempt === converge.attempt);
+}
+/** Sequence is per run; timestamps retain microseconds and never use client occurred_at for acceptance order. */
+export function before(first, last) {
+    requireSource(first.run_id === last.run_id && first.sequence < last.sequence &&
+        BigInt(instant(first.received_at)) <= BigInt(instant(last.received_at)));
+}
+/**
+ * Bind supplied original bytes to every stored positional finding and selected
+ * classification. Unsupported headerless/reversed-range sources refuse; this
+ * helper neither normalizes their history nor claims to fetch/authenticate it.
+ */
+export function validateOccurrenceSource(input) {
+    requireSource(isEventReceiptScope(input.scope) && input.scope.repo.length <= 200 && positive(input.scope.pr_number) &&
+        typeof input.reportJson === 'string' && Buffer.byteLength(input.reportJson) <= 64 * 1024 * 1024);
+    const decoded = decodeOriginalReport(input.reportJson, { exactNumbers: true, originalProse: 'control-code-units-v1' });
+    requireSource(object(decoded.value));
+    const report = decoded.value;
+    const run = report.run;
+    const stored = input.storedRun;
+    requireSource(object(run) && object(stored) && run.id === input.scope.run_id && stored.id === run.id &&
+        object(run.target) && object(stored.target) && object(run.converge) && object(stored.converge));
+    const target = run.target;
+    const storedTarget = stored.target;
+    const converge = run.converge;
+    const storedConverge = stored.converge;
+    requireSource(['pr', 'patch'].includes(run.target.kind) && run.target.repo === input.scope.repo &&
+        run.target.pr_number === input.scope.pr_number && typeof run.target.head_sha === 'string' &&
+        /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(run.target.head_sha) && !/^0+$/.test(run.target.head_sha) &&
+        ['kind', 'repo', 'pr_number', 'head_sha', 'base_sha', 'diff_sha256'].every(field => isDeepStrictEqual(target[field] ?? null, storedTarget[field] ?? null)) &&
+        ['rcl_version', 'command'].every(field => typeof run[field] === 'string' && run[field] === stored[field]));
+    requireSource(typeof run.converge.target === 'string' && run.converge.target.trim() === run.converge.target &&
+        run.converge.target.length > 0 && run.converge.target.length <= 500 && positive(run.converge.round) &&
+        ['target', 'round', 'attempt'].every(field => isDeepStrictEqual(converge[field] ?? null, storedConverge[field] ?? null)));
+    const digest = hash(input.reportJson);
+    requireSource(Array.isArray(stored.artifacts));
+    const originals = stored.artifacts.filter(a => object(a) && a.kind === 'report_json');
+    requireSource(originals.length === 1 && originals[0].declared_sha256 === digest && originals[0].stored === true &&
+        originals[0].declared_bytes === Buffer.byteLength(input.reportJson));
+    requireSource(Array.isArray(report.findings) && (report.belowThresholdFindings === undefined || Array.isArray(report.belowThresholdFindings)));
+    const kept = report.findings;
+    const below = report.belowThresholdFindings ?? [];
+    requireSource(kept.length + below.length <= 2000);
+    const all = [...kept, ...below];
+    requireSource(Array.isArray(stored.findings) && stored.findings.length === all.length);
+    const storedMembers = new Map();
+    for (const member of stored.findings) {
+        requireSource(object(member) && typeof member.ref === 'string' && !storedMembers.has(member.ref));
+        storedMembers.set(member.ref, member);
+    }
+    const out = { input, digest, head: run.target.head_sha,
+        target: run.converge.target, round: run.converge.round, members: [] };
+    receiptFor(input.classification, out);
+    requireSource(input.classification.kind === 'round_processed' && Array.isArray(input.classification.payload.identities));
+    const payload = input.classification.payload;
+    const rows = payload.identities;
+    requireSource(rows.length <= 2000);
+    const declared = Object.hasOwn(payload, 'classification_version') || Object.hasOwn(payload, 'legacy_pending_identities');
+    if (Object.hasOwn(payload, 'report_json_sha256'))
+        requireSource(payload.report_json_sha256 === digest);
+    if (declared)
+        requireSource(payload.classification_version === 1 && payload.report_json_sha256 === digest && rows.length === all.length);
+    if (Object.hasOwn(payload, 'legacy_pending_identities')) {
+        const ids = payload.legacy_pending_identities;
+        requireSource(Array.isArray(ids) && ids.length > 0 && ids.length <= 2000 && ids.every(key) &&
+            isDeepStrictEqual(ids, [...new Set(ids)].sort()));
+    }
+    const occurrenceCounts = new Map();
+    for (const raw of all) {
+        requireSource(object(raw) && typeof raw.identity === 'string');
+        occurrenceCounts.set(raw.identity, (occurrenceCounts.get(raw.identity) ?? 0) + 1);
+    }
+    const boundMappings = new Map();
+    const unboundMappings = new Map();
+    for (const [order, row] of rows.entries()) {
+        requireSource(object(row) && typeof row.identity_key === 'string' && key(row.matched_identity) &&
+            ['new', 'repeat', 'suppressed', 'regating'].includes(row.status) &&
+            occurrenceCounts.has(row.identity_key));
+        const bound = declared || ['version', 'finding_ref', 'report_json_sha256'].some(field => Object.hasOwn(row, field));
+        if (bound) {
+            requireSource(validSightingBinding(row) && Object.hasOwn(row, 'pending_round') &&
+                (row.pending_round === null || positive(row.pending_round) && row.pending_round <= out.round));
+            const ref = row.finding_ref;
+            const index = Number(ref.slice(1)) - 1;
+            requireSource(Number.isSafeInteger(index) && ref === `f${String(index + 1).padStart(3, '0')}` && !boundMappings.has(ref) &&
+                object(all[index]) && row.identity_key === all[index].identity && row.report_json_sha256 === digest &&
+                isDeepStrictEqual(row.claim_descriptor, all[index].claimDescriptor));
+            boundMappings.set(ref, { row, order });
+        }
+        else {
+            const group = unboundMappings.get(row.identity_key);
+            if (group) {
+                if (group.identity !== row.matched_identity)
+                    group.identity = undefined;
+                group.hasDescriptor ||= row.claim_descriptor !== undefined;
+                group.descriptorsAgree &&= isDeepStrictEqual(group.row.claim_descriptor, row.claim_descriptor);
+                group.statusesAgree &&= group.row.status === row.status;
+            }
+            else {
+                unboundMappings.set(row.identity_key, { row, order, identity: row.matched_identity,
+                    hasDescriptor: row.claim_descriptor !== undefined, descriptorsAgree: true, statusesAgree: true });
+            }
+        }
+    }
+    for (const [index, raw] of all.entries()) {
+        const ref = `f${String(index + 1).padStart(3, '0')}`;
+        const member = storedMembers.get(ref);
+        requireSource(object(raw) && member && typeof raw.identity === 'string' && raw.identity.length > 0 && raw.identity.length <= 64 &&
+            typeof raw.file === 'string' && typeof raw.category === 'string' && counter(raw.startLine) && counter(raw.endLine) && raw.startLine <= raw.endLine &&
+            ['critical', 'important', 'minor', 'nitpick'].includes(raw.severity) &&
+            (raw.gating === undefined || object(raw.gating) && typeof raw.gating.reason === 'string'));
+        const gating = object(raw.gating) ? raw.gating : {};
+        requireSource(member.identity_key === raw.identity && member.file === raw.file && member.category === raw.category &&
+            member.start_line === raw.startLine && member.end_line === raw.endLine && member.severity === raw.severity &&
+            member.below_threshold === (index >= kept.length) && member.gating_reason === (gating.reason ?? 'none') &&
+            member.verification_verdict === (object(gating.verification) ? gating.verification.verdict ?? null : null) &&
+            Object.hasOwn(member, 'claim_descriptor') && isDeepStrictEqual(member.claim_descriptor, raw.claimDescriptor ?? null));
+        if (raw.claimDescriptor !== undefined)
+            requireSource(claimDescriptorSchema.safeParse(raw.claimDescriptor).success);
+        const bound = boundMappings.get(ref);
+        const unbound = unboundMappings.get(raw.identity);
+        // Preserve the first receipt row while summarizing duplicate unbound rows
+        // once, so shared report identities do not require repeated receipt scans.
+        const mapping = !bound ? unbound?.row : !unbound || bound.order < unbound.order ? bound.row : unbound.row;
+        const ambiguous = unbound && (occurrenceCounts.get(raw.identity) > 1 || unbound.identity === undefined ||
+            bound && bound.row.matched_identity !== unbound.identity);
+        // A single association cannot inherit whichever contradictory status was
+        // listed first. An identity-only correction cannot settle that conflict.
+        if (unbound && !ambiguous)
+            requireSource(unbound.statusesAgree &&
+                (!bound || bound.row.status === unbound.row.status));
+        const unresolvedReason = mapping === undefined ? 'classification-unavailable' :
+            ambiguous ? 'classification-ambiguous' : undefined;
+        // Released unmarked classifications may cover kept findings only. Preserve
+        // every original appendix member without inventing its native association.
+        // Declared snapshots, in contrast, promise complete positional membership.
+        requireSource(!declared || unresolvedReason === undefined);
+        if (unbound?.hasDescriptor || bound?.row.claim_descriptor !== undefined)
+            requireSource((!unbound || unbound.descriptorsAgree && isDeepStrictEqual(unbound.row.claim_descriptor, raw.claimDescriptor)) &&
+                (!bound || isDeepStrictEqual(bound.row.claim_descriptor, raw.claimDescriptor)));
+        const statusesAgree = !unbound || unbound.statusesAgree && (!bound || bound.row.status === unbound.row.status);
+        const classificationStanding = statusesAgree && !ambiguous && mapping ?
+            { kind: 'known', status: mapping.status } :
+            statusesAgree && unbound ? { kind: 'known', status: unbound.row.status } :
+                { kind: 'unknown' };
+        out.members.push({ ref, raw, stored: member, classificationStanding,
+            ...(unresolvedReason ? { unresolvedReason } : { mapping: mapping, identity: mapping.matched_identity }),
+            severity: raw.severity, gating: index >= kept.length ? 'none' : (gating.reason ??
+                (['critical', 'important'].includes(raw.severity) ? 'legacy-blocking' : 'none')) });
+    }
+    requireSource(Array.isArray(input.corrections) && input.corrections.length <= all.length);
+    const corrected = new Set();
+    const ids = new Set([input.classification.id]);
+    for (const receipt of input.corrections) {
+        receiptFor(receipt, out);
+        before(input.classification, receipt);
+        const p = receipt.payload;
+        const member = out.members.find(m => m.ref === p.finding_ref);
+        requireSource(receipt.kind === 'finding_identity_corrected' && uuidSchema.safeParse(receipt.actor_user_id).success &&
+            !ids.has(receipt.id) && member && !corrected.has(member.ref) && p.report_json_sha256 === digest &&
+            p.identity_key === member.raw.identity && key(p.matched_identity));
+        for (const [field, expected] of Object.entries({ org_id: input.scope.org_id, repo: input.scope.repo,
+            pr_number: input.scope.pr_number, head_sha: out.head })) {
+            requireSource(p[field] === expected);
+        }
+        member.identity = p.matched_identity;
+        member.correction = receipt;
+        delete member.unresolvedReason;
+        corrected.add(member.ref);
+        ids.add(receipt.id);
+    }
+    return out;
+}
+export function contextFor(context, source, actor) {
+    requireSource(isDeepStrictEqual(context.scope, source.input.scope) && context.target === source.target && context.round === source.round &&
+        context.headSha === source.head && context.reportSha256 === source.digest && counter(context.eventSequence) &&
+        uuidSchema.safeParse(actor).success && context.actorUserId === actor);
+    for (const receipt of [source.input.classification, ...source.input.corrections])
+        requireSource(receipt.sequence <= context.eventSequence);
+}
+export function sameTarget(a, b) {
+    requireSource(a.input.scope.base_url === b.input.scope.base_url && a.input.scope.org_id === b.input.scope.org_id &&
+        a.input.scope.repo.toLowerCase() === b.input.scope.repo.toLowerCase() && a.input.scope.pr_number === b.input.scope.pr_number && a.target === b.target);
+}
+//# sourceMappingURL=occurrence-source.js.map

package/dist/evidence/claim-recovery/validation/occurrence-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"occurrence-source.js","sourceRoot":"","sources":["../../../../src/evidence/claim-recovery/validation/occurrence-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,sBAAsB,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAA2B,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/G,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC;AACxF,MAAM,UAAU,aAAa,CAAC,KAAc,IAAmB,IAAI,CAAC,KAAK;IAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC;AAC3H,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,aAAa,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,IAAI,IAAI;QACrH,CAAC,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACtG,CAAC;AAmCD,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,OAA2B,EAAE,MAAiC;IACvF,aAAa,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,MAAM;QAC1G,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAmC,CAAC;IAC5E,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,aAAa,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,CAAC,CAAC;AACpF,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,MAAM,CAAC,KAAyB,EAAE,IAAwB;IACxE,aAAa,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ;QAC1E,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAuB;IAC9D,aAAa,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QACjH,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACvH,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAAC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IAAC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;IACrF,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE;QAClG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAAC,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;IACtE,aAAa,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI;QACvG,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACzF,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CACjF,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;QACxE,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7G,aAAa,CAAC,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM;QACzG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC;IACtF,aAAa,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,KAAK,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI;QAC7G,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC/I,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAAC,MAAM,KAAK,GAAG,MAAM,CAAC,sBAA+C,IAAI,EAAE,CAAC;IACzG,aAAa,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC;IAChC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACvF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAmC,CAAC;IACjE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,GAAG,GAA8B,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;QAC/E,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxE,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACtC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACzH,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAuB,CAAC;IAC7C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IACzH,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,oBAAoB,CAAC;QAAE,aAAa,CAAC,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC;IACvG,IAAI,QAAQ;QAAE,aAAa,CAAC,OAAO,CAAC,sBAAsB,KAAK,CAAC,IAAI,OAAO,CAAC,kBAAkB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC;IACzI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,2BAA2B,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,yBAAyB,CAAC;QAC9C,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;YACxF,iBAAiB,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAC/D,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC3D,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC5F,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAgB,CAAC;YAC1E,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACpH,IAAI,KAAK,EAAE,CAAC;YACV,aAAa,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC;gBAC5E,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACjG,MAAM,GAAG,GAAG,GAAG,CAAC,WAAqB,CAAC;YAAC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9E,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;gBACtH,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,kBAAkB,KAAK,MAAM;gBACnG,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YACvE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,gBAAgB;oBAAE,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;gBACxE,KAAK,CAAC,aAAa,KAAK,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC;gBAC3D,KAAK,CAAC,gBAAgB,KAAK,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC/F,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,gBAAgB;oBAChF,aAAa,EAAE,GAAG,CAAC,gBAAgB,KAAK,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAAC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5F,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE;YAC7H,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO;YAClJ,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAkB,CAAC;YAC9E,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,aAAa,CAAC,MAAM,CAAC,YAAY,KAAK,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAChH,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAC1G,MAAM,CAAC,eAAe,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;YACvG,MAAM,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1G,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,gBAAgB,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC;QACxH,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;YAAE,aAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC;QACnH,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxF,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAC1G,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAE,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS;YACrG,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,OAAO,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,aAAa;gBAC5D,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;YAC7E,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC;QACrD,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,aAAa,CAAC,CAAC,QAAQ,IAAI,gBAAgB,KAAK,SAAS,CAAC,CAAC;QAC3D,IAAI,OAAO,EAAE,aAAa,IAAI,KAAK,EAAE,GAAG,CAAC,gBAAgB,KAAK,SAAS;YAAE,aAAa,CACpF,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC9G,CAAC,CAAC,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/G,MAAM,sBAAsB,GAAG,aAAa,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAC;YACrE,EAAE,IAAI,EAAE,OAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,MAAsD,EAAE,CAAC,CAAC;YACpG,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAsD,EAAE,CAAC,CAAC;gBACjI,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC;QACjC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB;YACjE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAQ,EAAE,QAAQ,EAAE,OAAQ,CAAC,gBAA0B,EAAE,CAAC;YACnH,QAAQ,EAAE,GAAG,CAAC,QAAyB,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAA4B;gBACnH,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACpF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACxC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;QAAC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC;QACzF,aAAa,CAAC,OAAO,CAAC,IAAI,KAAK,4BAA4B,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO;YAChH,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,kBAAkB,KAAK,MAAM;YAC/F,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACrE,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YACjG,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1D,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,gBAAgB,CAAC;QAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC;QAClE,OAAO,MAAM,CAAC,gBAAgB,CAAC;QAC/B,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAA0B,EAAE,MAAiC,EAAE,KAAa;IACrG,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;QACtI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3G,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC;IACxE,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;AAC7I,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAA4B,EAAE,CAA4B;IACnF,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;QAC9G,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3J,CAAC"}

package/dist/evidence/claim-recovery/validation/occurrence-types.d.ts

@@ -0,0 +1,101 @@
+import type { ClaimSplitInput } from './claim-split.js';
+import type { RetainedNativeEvidence } from './native-state.js';
+import type { EventReceiptScope, StoredEventReceipt } from './receipts.js';
+/** Supplied read results; content validation does not authenticate their transport. */
+export interface OccurrenceSource {
+    scope: EventReceiptScope;
+    reportJson: string;
+    storedRun: Record<string, unknown>;
+    classification: StoredEventReceipt;
+    corrections: StoredEventReceipt[];
+}
+/** Pin the selection alongside the result of a fresh current-actor/context read. */
+export interface OccurrenceContext {
+    scope: EventReceiptScope;
+    target: string;
+    round: number;
+    headSha: string;
+    reportSha256: string;
+    actorUserId: string;
+    eventSequence: number;
+}
+export interface AcceptedSplitEvidence {
+    selection: ClaimSplitInput;
+    receipt: StoredEventReceipt;
+    actorUserId: string;
+    native: RetainedNativeEvidence;
+    source: OccurrenceSource;
+}
+interface Preparation {
+    eventId: string;
+    occurredAt: string;
+    /** Pinned current operator, distinct from historical classification/split actors. */
+    actorUserId: string;
+    split: AcceptedSplitEvidence;
+    sourceContext: OccurrenceContext;
+}
+export interface ObligationTransferInput extends Preparation {
+    carrier: OccurrenceSource;
+    carrierContext: OccurrenceContext;
+    carrierKind: 'classified_group' | 'legacy_pending';
+    carrierIdentity: string;
+    reason: string;
+}
+export type ClaimSeverity = 'critical' | 'important' | 'minor' | 'nitpick';
+export interface ClaimDispositionInput extends Preparation {
+    mode: 'fresh' | 'preserved';
+    verdict: 'fixed' | 'dismissed';
+    severity: ClaimSeverity;
+    reason: string;
+    /** A server CAS precondition; this supplied view cannot prove no newer decision exists. */
+    previousDispositionEventId: string | null;
+    previousDisposition?: StoredEventReceipt;
+    /** Exact later classified batches; never an asserted effective severity alone.
+     * The authoritative backend still checks history not present in this selection. */
+    laterSources?: OccurrenceSource[];
+    originalVerdict?: StoredEventReceipt;
+    originalVerdictActorUserId?: string;
+}
+export interface RecoveryOccurrenceEvent {
+    id: string;
+    kind: 'finding_obligation_transferred' | 'finding_claim_disposition';
+    run_id: string;
+    converge_target: string;
+    round: number;
+    occurred_at: string;
+    payload: Record<string, unknown>;
+}
+export interface ReceiptAttribution {
+    eventId: string;
+    actorUserId: string | null;
+    occurredAt: string;
+    receivedAt: string;
+    sequence: number;
+}
+export interface PreparedOccurrenceEvent {
+    event: RecoveryOccurrenceEvent;
+    qualification: 'content-only';
+    assertingActorUserId: string;
+    splitAttribution: ReceiptAttribution;
+    originalVerdictAttribution?: ReceiptAttribution;
+    /** Fresh assertion time cannot exist until the server accepts the event. */
+    assertionReceipt: {
+        kind: 'pending-server-receipt';
+    } | {
+        kind: 'preserved';
+        receipt: ReceiptAttribution;
+    };
+    /** Only the selected occurrence is transferred; this is never key retirement. */
+    coverage: 'one-occurrence';
+    /** Unknown mappings stay explicit. Unselected known members are also untouched;
+     * this is not a complete carrier residual inventory or a closure assertion. */
+    unresolvedMembers: Array<{
+        runId: string;
+        target: string;
+        reportSha256: string;
+        findingRef: string;
+        reportKey: string;
+        reason: 'classification-unavailable' | 'classification-ambiguous';
+    }>;
+}
+export {};

package/dist/evidence/claim-recovery/validation/occurrence-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=occurrence-types.js.map

package/dist/evidence/claim-recovery/validation/occurrence-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"occurrence-types.js","sourceRoot":"","sources":["../../../../src/evidence/claim-recovery/validation/occurrence-types.ts"],"names":[],"mappings":""}

package/dist/evidence/claim-recovery/validation/occurrence.d.ts

@@ -0,0 +1,30 @@
+import { type StoredEventReceipt } from './receipts.js';
+import { type OccurrenceMember, type ValidatedOccurrenceSource } from './occurrence-source.js';
+import type { ClaimDispositionInput, ObligationTransferInput, PreparedOccurrenceEvent } from './occurrence-types.js';
+/**
+ * Prepare one immutable occurrence transfer. Selected read authenticity, fresh
+ * context, source inventory completeness, server CAS/selector uniqueness and
+ * physical filesystem qualification remain outer obligations. No prefix
+ * closure, key retirement, gate standing or delivery is asserted here.
+ */
+export declare function prepareObligationTransfer(input: ObligationTransferInput): PreparedOccurrenceEvent;
+/**
+ * Prepare an attributed decision without fabricating its future server receipt.
+ * Preserved mode additionally proves exact descriptor equality for the entire
+ * original co-key family; bare keys and fuzzy paraphrases are insufficient.
+ * This does not confirm a fixed claim or project any native/server obligation.
+ */
+export declare function prepareClaimDisposition(input: ClaimDispositionInput): PreparedOccurrenceEvent;
+/** Prove the retained original decision's full subject before any recovery POST.
+ * This does not fabricate or predict a split receipt or authorize delivery. */
+export declare function validatePreservedDispositionSubject(input: {
+    source: ValidatedOccurrenceSource;
+    member: OccurrenceMember;
+    descriptor: unknown;
+    eventId: string;
+    verdict: string;
+    severity: string;
+    reason: string;
+    originalVerdict?: StoredEventReceipt;
+    originalVerdictActorUserId?: string;
+}): void;

package/dist/evidence/claim-recovery/validation/occurrence.js

@@ -0,0 +1,227 @@
+import { prepareClaimSplit } from './claim-split.js';
+import { isDeepStrictEqual } from 'node:util';
+import { matchesPreparedEventReceipt } from './receipts.js';
+import { claimDescriptorSchema } from './claims.js';
+import { validateRetainedNativeEvidence } from './native-state.js';
+import { instant, object, uuidSchema } from './primitives.js';
+import { scrubDeep } from '../../../telemetry/scrub.js';
+import { before, contextFor, counter, key, receiptFor, requireReason, requireSource, sameTarget, validateOccurrenceSource } from './occurrence-source.js';
+function attribution(receipt) {
+    return { eventId: receipt.id, actorUserId: receipt.actor_user_id, occurredAt: receipt.occurred_at,
+        receivedAt: receipt.received_at, sequence: receipt.sequence };
+}
+function split(input) {
+    requireSource(uuidSchema.safeParse(input.eventId).success && uuidSchema.safeParse(input.actorUserId).success);
+    instant(input.occurredAt);
+    requireReason(input.reason);
+    const source = validateOccurrenceSource(input.split.source);
+    contextFor(input.sourceContext, source, input.actorUserId);
+    const selection = input.split.selection;
+    requireSource(isDeepStrictEqual(source.input.scope, selection.scope) && source.input.reportJson === selection.reportJson &&
+        selection.target === source.target && selection.classificationId === source.input.classification.id &&
+        input.split.native.sourceJson === selection.nativeJson && input.split.native.target === selection.target &&
+        isDeepStrictEqual(input.split.native.nativeSourceJsons ?? [], selection.nativeSourceJsons ?? []) &&
+        isDeepStrictEqual(input.split.native.recoveryMaterials ?? [], selection.recoveryMaterials ?? []));
+    validateRetainedNativeEvidence(input.split.native);
+    const prepared = prepareClaimSplit(input.split.selection);
+    const member = source.members.find(m => m.ref === selection.findingRef);
+    requireSource(member && !member.unresolvedReason && member.identity === selection.previousIdentity &&
+        (member.correction?.id ?? null) === (selection.correctionId ?? null));
+    const receipts = [source.input.classification, ...(member.correction ? [member.correction] : [])];
+    requireSource(isDeepStrictEqual(selection.sourceReceipts, receipts));
+    receiptFor(input.split.receipt, source);
+    requireSource(matchesPreparedEventReceipt(input.split.receipt, JSON.stringify(prepared.event), selection.scope, input.split.actorUserId) && input.split.receipt.sequence > selection.expectedEventSequence &&
+        input.split.receipt.sequence <= input.sourceContext.eventSequence);
+    for (const receipt of receipts) {
+        requireSource(receipt.sequence <= selection.expectedEventSequence);
+        before(receipt, input.split.receipt);
+    }
+    requireSource(![...source.input.corrections, source.input.classification, input.split.receipt].some(r => r.id === input.eventId));
+    return { prepared, source, member };
+}
+function result(input, event, sources) {
+    requireSource(isDeepStrictEqual(scrubDeep(event), event));
+    const unknown = sources.flatMap(source => source.members.flatMap(member => {
+        const reason = member.unresolvedReason ??
+            (member.classificationStanding.kind === 'unknown' ? 'classification-ambiguous' : undefined);
+        return reason ? [{
+                runId: source.input.scope.run_id, target: source.target, reportSha256: source.digest, findingRef: member.ref,
+                reportKey: member.raw.identity, reason,
+            }] : [];
+    }));
+    return structuredClone({ event, qualification: 'content-only', coverage: 'one-occurrence', assertingActorUserId: input.actorUserId,
+        splitAttribution: attribution(input.split.receipt), assertionReceipt: { kind: 'pending-server-receipt' },
+        unresolvedMembers: [...new Map(unknown.map(member => [JSON.stringify(member), member])).values()] });
+}
+/**
+ * Prepare one immutable occurrence transfer. Selected read authenticity, fresh
+ * context, source inventory completeness, server CAS/selector uniqueness and
+ * physical filesystem qualification remain outer obligations. No prefix
+ * closure, key retirement, gate standing or delivery is asserted here.
+ */
+export function prepareObligationTransfer(input) {
+    try {
+        return transfer(input);
+    }
+    catch {
+        throw new Error('occurrence_transfer_source_conflict');
+    }
+}
+function transfer(input) {
+    const { prepared, source: original } = split(input);
+    const source = prepared.source;
+    const scope = input.carrierContext.scope;
+    const carrier = validateOccurrenceSource(input.carrier);
+    contextFor(input.carrierContext, carrier, input.actorUserId);
+    sameTarget(carrier, original);
+    requireSource(key(input.carrierIdentity) && input.carrierIdentity === source.previousIdentity &&
+        input.eventId !== carrier.input.classification.id && !carrier.input.corrections.some(r => r.id === input.eventId));
+    if (scope.run_id === original.input.scope.run_id) {
+        requireSource(isDeepStrictEqual(input.carrierContext, input.sourceContext) && isDeepStrictEqual(input.carrier, input.split.source));
+    }
+    if (input.carrierKind === 'classified_group') {
+        requireSource(scope.run_id === source.runId && carrier.digest === source.reportSha256 &&
+            carrier.input.classification.id === input.split.selection.classificationId &&
+            carrier.members.some(m => m.ref === source.findingRef && m.identity === input.carrierIdentity));
+    }
+    else {
+        requireSource(input.carrierKind === 'legacy_pending' && carrier.round >= original.round &&
+            carrier.input.classification.payload.classification_version === 1 &&
+            Array.isArray(carrier.input.classification.payload.legacy_pending_identities) &&
+            carrier.input.classification.payload.legacy_pending_identities.includes(input.carrierIdentity));
+    }
+    const payload = { version: 1, org_id: scope.org_id, repo: scope.repo, pr_number: scope.pr_number,
+        head_sha: input.carrierContext.headSha, report_json_sha256: input.carrierContext.reportSha256,
+        expected_event_sequence: input.carrierContext.eventSequence,
+        carrier: { kind: input.carrierKind, classification_event_id: input.carrier.classification.id, identity_key: input.carrierIdentity },
+        source: { run_id: source.runId, round: source.round, head_sha: input.sourceContext.headSha,
+            report_json_sha256: source.reportSha256, classification_event_id: input.split.selection.classificationId,
+            correction_event_id: input.split.selection.correctionId ?? null, finding_ref: source.findingRef,
+            identity_key: source.reportKey, previous_identity: source.previousIdentity },
+        split_event_id: input.split.receipt.id, claim_identity: input.split.selection.identity,
+        expected_source_event_sequence: input.sourceContext.eventSequence,
+        native_evidence: prepared.event.payload.native_evidence, reason: input.reason };
+    return result(input, { id: input.eventId, kind: 'finding_obligation_transferred', run_id: scope.run_id,
+        converge_target: input.carrierContext.target, round: input.carrierContext.round, occurred_at: input.occurredAt, payload }, [original, carrier]);
+}
+/**
+ * Prepare an attributed decision without fabricating its future server receipt.
+ * Preserved mode additionally proves exact descriptor equality for the entire
+ * original co-key family; bare keys and fuzzy paraphrases are insufficient.
+ * This does not confirm a fixed claim or project any native/server obligation.
+ */
+export function prepareClaimDisposition(input) {
+    try {
+        return disposition(input);
+    }
+    catch {
+        throw new Error('occurrence_disposition_source_conflict');
+    }
+}
+function disposition(input) {
+    const { prepared, source: original, member } = split(input);
+    const source = prepared.source;
+    const scope = input.sourceContext.scope;
+    requireSource(['fresh', 'preserved'].includes(input.mode) && ['fixed', 'dismissed'].includes(input.verdict) &&
+        ['critical', 'important', 'minor', 'nitpick'].includes(input.severity));
+    const effectiveSeverity = severity(input, original, member);
+    requireSource(effectiveSeverity !== 'critical' || input.severity === 'critical');
+    previousDisposition(input, original);
+    if (input.mode === 'preserved')
+        preservedVerdict(input, original, member);
+    else
+        requireSource(input.originalVerdict === undefined && input.originalVerdictActorUserId === undefined);
+    const payload = { version: 1, org_id: scope.org_id, repo: scope.repo, pr_number: scope.pr_number,
+        head_sha: input.sourceContext.headSha, report_json_sha256: source.reportSha256, expected_event_sequence: input.sourceContext.eventSequence,
+        finding_ref: source.findingRef, identity_key: source.reportKey, split_event_id: input.split.receipt.id,
+        claim_identity: input.split.selection.identity, previous_disposition_event_id: input.previousDispositionEventId,
+        mode: input.mode, verdict: input.verdict, severity: input.severity, reason: input.reason,
+        ...(input.mode === 'preserved' ? { original_verdict: { run_id: source.runId, event_id: input.originalVerdict.id,
+                identity_key: source.previousIdentity, classification_event_id: input.split.selection.classificationId,
+                report_json_sha256: source.reportSha256, finding_ref: source.findingRef } } : {}) };
+    const out = result(input, { id: input.eventId, kind: 'finding_claim_disposition', run_id: scope.run_id,
+        converge_target: source.target, round: source.round, occurred_at: input.occurredAt, payload }, [original]);
+    if (input.mode === 'preserved') {
+        out.originalVerdictAttribution = attribution(input.originalVerdict);
+        out.assertionReceipt = { kind: 'preserved', receipt: out.originalVerdictAttribution };
+    }
+    return out;
+}
+function severity(input, source, member) {
+    let effective = member.severity;
+    const batches = (input.laterSources ?? []).map(validateOccurrenceSource).sort((a, b) => a.round - b.round);
+    const rounds = new Set();
+    for (const batch of batches) {
+        sameTarget(source, batch);
+        requireSource(batch.round > source.round && !rounds.has(batch.round) &&
+            batch.input.scope.run_id !== source.input.scope.run_id && batch.input.classification.payload.classification_version === 1 &&
+            BigInt(instant(batch.input.classification.received_at)) >= BigInt(instant(input.split.receipt.received_at)));
+        rounds.add(batch.round);
+        const sightings = batch.members.filter(m => m.identity === input.split.selection.identity);
+        requireSource(sightings.length > 0 && sightings.every(m => isDeepStrictEqual(m.raw.claimDescriptor, input.split.selection.descriptor)));
+        const gated = sightings.filter(m => m.gating !== 'none');
+        if (gated.length)
+            effective = ['critical', 'important', 'minor', 'nitpick'].find(s => gated.some(m => m.severity === s));
+    }
+    return effective;
+}
+function previousDisposition(input, source) {
+    if (input.previousDispositionEventId === null) {
+        requireSource(input.previousDisposition === undefined);
+        return;
+    }
+    const receipt = input.previousDisposition;
+    requireSource(uuidSchema.safeParse(input.previousDispositionEventId).success && receipt &&
+        receipt.id === input.previousDispositionEventId && receipt.id !== input.eventId && uuidSchema.safeParse(receipt.actor_user_id).success);
+    receiptFor(receipt, source);
+    before(input.split.receipt, receipt);
+    const p = receipt.payload;
+    requireSource(receipt.sequence <= input.sourceContext.eventSequence && receipt.kind === 'finding_claim_disposition' &&
+        p.version === 1 && p.org_id === source.input.scope.org_id && p.repo === source.input.scope.repo &&
+        p.pr_number === source.input.scope.pr_number && p.head_sha === source.head && p.report_json_sha256 === source.digest &&
+        p.finding_ref === input.split.selection.findingRef && p.identity_key === input.split.receipt.payload.identity_key &&
+        p.split_event_id === input.split.receipt.id && p.claim_identity === input.split.selection.identity &&
+        ['fresh', 'preserved'].includes(p.mode) && ['fixed', 'dismissed'].includes(p.verdict) &&
+        ['critical', 'important', 'minor', 'nitpick'].includes(p.severity) && counter(p.expected_event_sequence) &&
+        p.expected_event_sequence < receipt.sequence);
+    requireReason(p.reason);
+}
+function preservedVerdict(input, source, member) {
+    requireSource(input.originalVerdict);
+    before(input.originalVerdict, input.split.receipt);
+    validatePreservedDispositionSubject({ source, member, descriptor: input.split.selection.descriptor, eventId: input.eventId,
+        verdict: input.verdict, severity: input.severity, reason: input.reason, originalVerdict: input.originalVerdict,
+        originalVerdictActorUserId: input.originalVerdictActorUserId });
+}
+/** Prove the retained original decision's full subject before any recovery POST.
+ * This does not fabricate or predict a split receipt or authorize delivery. */
+export function validatePreservedDispositionSubject(input) {
+    const { source, member } = input;
+    const receipt = input.originalVerdict;
+    requireSource(receipt && uuidSchema.safeParse(input.originalVerdictActorUserId).success &&
+        receipt.actor_user_id === input.originalVerdictActorUserId && receipt.id !== input.eventId);
+    receiptFor(receipt, source);
+    before(source.input.classification, receipt);
+    // A correction after the decision cannot retroactively establish its subject.
+    // Include every original co-key member even if a supplied later correction
+    // moved a sibling away. A narrowed current map cannot erase verdict history.
+    requireSource(source.members.every(m => !m.unresolvedReason));
+    const family = source.members.filter(m => m.identity === member.identity || m.mapping?.matched_identity === member.identity);
+    requireSource(family.length > 0);
+    for (const sibling of family) {
+        if (sibling.correction)
+            before(sibling.correction, receipt);
+        requireSource(claimDescriptorSchema.safeParse(sibling.raw.claimDescriptor).success &&
+            isDeepStrictEqual(sibling.raw.claimDescriptor, sibling.stored.claim_descriptor) &&
+            (!sibling.mapping || isDeepStrictEqual(sibling.raw.claimDescriptor, sibling.mapping.claim_descriptor)) &&
+            isDeepStrictEqual(sibling.raw.claimDescriptor, input.descriptor));
+    }
+    requireSource(receipt.kind === 'verdicts_recorded' && Array.isArray(receipt.payload.verdicts));
+    const entries = receipt.payload.verdicts;
+    requireSource(entries.every(e => object(e) && key(e.identity_key)) &&
+        new Set(entries.map(e => e.identity_key)).size === entries.length);
+    const verdicts = entries.filter(v => v.identity_key === member.identity);
+    requireSource(verdicts.length === 1 && verdicts[0].verdict === input.verdict && verdicts[0].severity === input.severity &&
+        verdicts[0].reason === input.reason && (family.every(m => m.gating === 'none' || m.severity !== 'critical') || input.severity === 'critical'));
+}
+//# sourceMappingURL=occurrence.js.map