@allocator-one/rcl 4.4.19

package/dist/roles/loader.js

@@ -0,0 +1,104 @@
+import { access } from 'fs/promises';
+import { join } from 'path';
+import { BUILTIN_ROLES, getRoleByName } from './builtin.js';
+const PROJECT_RULES_FILES = [
+    'AGENTS.md',
+    'CLAUDE.md',
+    'CONTRIBUTING.md',
+    '.github/CONTRIBUTING.md',
+    'DEVELOPMENT.md',
+    'docs/CONTRIBUTING.md',
+];
+export async function findProjectRulesFile(cwd = process.cwd()) {
+    for (const filename of PROJECT_RULES_FILES) {
+        const fullPath = join(cwd, filename);
+        try {
+            await access(fullPath);
+            return fullPath;
+        }
+        catch {
+            // not found, try next
+        }
+    }
+    return null;
+}
+export function buildCustomRole(config) {
+    // If it extends a builtin, start from that base. Dispatch-relevant fields
+    // inherit from the base: forcing isSpecialized on an override of `general`
+    // would silently remove the baseline pass from all primary models. Matched
+    // case-insensitively so "Security-Auditor" overrides the builtin rather
+    // than coexisting with it as a duplicate reviewer.
+    const base = getRoleByName(config.name) ?? getRoleByName(config.name.toLowerCase());
+    return {
+        // Canonical builtin name when overriding, so the override replaces the
+        // builtin under one map key instead of coexisting as a duplicate.
+        name: base?.name ?? config.name,
+        description: base?.description ?? `Custom role: ${config.name}`,
+        isSpecialized: base?.isSpecialized ?? true,
+        focus: config.focus ?? base?.focus ?? ['best-practices'],
+        severityBias: config.severityBias ?? base?.severityBias,
+        systemPrompt: config.systemPrompt ??
+            base?.systemPrompt ??
+            `You are a code reviewer with focus on: ${config.focus?.join(', ') ?? 'general quality'}.`,
+    };
+}
+export async function resolveRoles(config, requestedRoles, specContent) {
+    const roles = new Map();
+    // Add all builtin roles
+    for (const role of BUILTIN_ROLES) {
+        roles.set(role.name, role);
+    }
+    // Add custom roles from config (override builtins of the same name,
+    // case-insensitively — key by the built role's canonical name)
+    if (config.customRoles) {
+        for (const customConfig of config.customRoles) {
+            const role = buildCustomRole(customConfig);
+            roles.set(role.name, role);
+        }
+    }
+    // Augment spec-compliance role with actual spec content
+    if (specContent) {
+        const specRole = roles.get('spec-compliance');
+        roles.set('spec-compliance', {
+            ...specRole,
+            systemPrompt: specRole.systemPrompt +
+                '\n\n## Specification Content\n\n' +
+                specContent,
+        });
+    }
+    // Content-dependent roles without their content burn a model call and
+    // invite hallucinated "violations" against imagined rules. They are
+    // dropped from default/'all' expansion and kept (with a warning) only
+    // when requested by name.
+    const missingContent = new Set();
+    if (!specContent)
+        missingContent.add('spec-compliance');
+    // Determine which roles to use
+    const requested = requestedRoles ?? config.roles;
+    if (requested && requested.length > 0) {
+        const hasAll = requested.some((r) => r.toLowerCase() === 'all');
+        if (hasAll) {
+            if (requested.length > 1) {
+                throw new Error(`'all' cannot be combined with other roles. Got: ${requested.join(', ')}`);
+            }
+            return Array.from(roles.values()).filter((r) => !missingContent.has(r.name));
+        }
+        const result = [];
+        for (const name of requested) {
+            const role = roles.get(name) ?? roles.get(name.toLowerCase());
+            if (!role) {
+                console.warn(`Warning: unknown role "${name}", skipping`);
+                continue;
+            }
+            if (missingContent.has(role.name)) {
+                console.warn(`Warning: role "${role.name}" was requested but no spec file was found — it will run without that content`);
+            }
+            result.push(role);
+        }
+        return result;
+    }
+    // Default: general + all specialized (minus content-dependent roles
+    // whose content is absent)
+    return Array.from(roles.values()).filter((r) => !missingContent.has(r.name));
+}
+//# sourceMappingURL=loader.js.map

package/dist/roles/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/roles/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI5D,MAAM,mBAAmB,GAAG;IAC1B,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,yBAAyB;IACzB,gBAAgB;IAChB,sBAAsB;CACvB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACpE,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAK/B;IACC,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAEpF,OAAO;QACL,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,IAAI;QAC/B,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,gBAAgB,MAAM,CAAC,IAAI,EAAE;QAC/D,aAAa,EAAE,IAAI,EAAE,aAAa,IAAI,IAAI;QAC1C,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,gBAAgB,CAAC;QACxD,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,YAAY;QACvD,YAAY,EACV,MAAM,CAAC,YAAY;YACnB,IAAI,EAAE,YAAY;YAClB,0CAA0C,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,GAAG;KAC7F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,cAAyB,EACzB,WAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEtC,wBAAwB;IACxB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,oEAAoE;IACpE,+DAA+D;IAC/D,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC;QAC/C,KAAK,CAAC,GAAG,CAAC,iBAAiB,EAAE;YAC3B,GAAG,QAAQ;YACX,YAAY,EACV,QAAQ,CAAC,YAAY;gBACrB,kCAAkC;gBAClC,WAAW;SACd,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,0BAA0B;IAC1B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAExD,+BAA+B;IAC/B,MAAM,SAAS,GAAG,cAAc,IAAK,MAAM,CAAC,KAA8B,CAAC;IAC3E,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACb,mDAAmD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,MAAM,GAAW,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,0BAA0B,IAAI,aAAa,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO,CAAC,IAAI,CACV,kBAAkB,IAAI,CAAC,IAAI,+EAA+E,CAC3G,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,2BAA2B;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/roles/types.d.ts

@@ -0,0 +1,13 @@
+export interface Role {
+    name: string;
+    systemPrompt: string;
+    focus: string[];
+    severityBias?: Record<string, number>;
+    description: string;
+    isSpecialized: boolean;
+}
+export interface ReviewAssignment {
+    model: string;
+    role: Role;
+    provider: string;
+}

package/dist/roles/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/roles/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/roles/types.ts"],"names":[],"mappings":""}

package/dist/telemetry/abort-signal.d.ts

@@ -0,0 +1,13 @@
+/** A composed signal plus the cleanup required when its operation settles. */
+export interface AbortSignalLease {
+    signal: AbortSignal;
+    dispose: () => void;
+}
+/**
+ * Bound one operation by an optional parent cancellation and a timeout.
+ *
+ * Node 18.0–18.16 does not provide `AbortSignal.any`. Owning the controller
+ * here also lets callers remove the parent listener and timer when a request
+ * completes before either boundary fires.
+ */
+export declare function abortSignalWithTimeout(parent: AbortSignal | undefined, timeoutMs: number): AbortSignalLease;

package/dist/telemetry/abort-signal.js

@@ -0,0 +1,40 @@
+/**
+ * Bound one operation by an optional parent cancellation and a timeout.
+ *
+ * Node 18.0–18.16 does not provide `AbortSignal.any`. Owning the controller
+ * here also lets callers remove the parent listener and timer when a request
+ * completes before either boundary fires.
+ */
+export function abortSignalWithTimeout(parent, timeoutMs) {
+    const controller = new AbortController();
+    let timer;
+    let disposed = false;
+    const abortFromParent = () => controller.abort(parent?.reason);
+    const dispose = () => {
+        if (disposed)
+            return;
+        disposed = true;
+        if (timer !== undefined)
+            clearTimeout(timer);
+        parent?.removeEventListener('abort', abortFromParent);
+    };
+    controller.signal.addEventListener('abort', dispose, { once: true });
+    if (parent?.aborted) {
+        controller.abort(parent.reason);
+        return { signal: controller.signal, dispose };
+    }
+    parent?.addEventListener('abort', abortFromParent, { once: true });
+    // Node turns an overflowing delay into one millisecond. Keep long operation
+    // deadlines intact by waking in supported intervals on the monotonic clock.
+    const maximumTimerMs = 2 ** 31 - 1;
+    const deadline = performance.now() + timeoutMs;
+    const schedule = (remainingMs) => {
+        const duration = Math.max(1, Math.floor(remainingMs));
+        timer = setTimeout(duration > maximumTimerMs
+            ? () => schedule(deadline - performance.now())
+            : () => controller.abort(new DOMException('The operation was aborted due to timeout', 'TimeoutError')), Math.min(duration, maximumTimerMs));
+    };
+    schedule(timeoutMs);
+    return { signal: controller.signal, dispose };
+}
+//# sourceMappingURL=abort-signal.js.map

package/dist/telemetry/abort-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abort-signal.js","sourceRoot":"","sources":["../../src/telemetry/abort-signal.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA+B,EAAE,SAAiB;IACvF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,eAAe,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACxD,CAAC,CAAC;IAEF,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACpB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAQ,EAAE;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACtD,KAAK,GAAG,UAAU,CAChB,QAAQ,GAAG,cAAc;YACvB,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9C,CAAC,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,0CAA0C,EAAE,cAAc,CAAC,CAAC,EACxG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CACnC,CAAC;IACJ,CAAC,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEpB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/dist/telemetry/attest.d.ts

@@ -0,0 +1,98 @@
+import { type HarnessCredential } from './credentials.js';
+import type { ReviewerRecoverySource } from './envelope.js';
+/**
+ * `rcl review --attest` (epic IO-12475, sections 4.1 and 8.5; RCL-40): inside
+ * the organization's gate workflow on GitHub Actions, the job's OIDC token —
+ * requested from the runner with the Harness origin as audience — is
+ * exchanged at `POST /api/v1/reviews/attest` for a run-bound credential:
+ * good for one rcl run id, thirty minutes, while the Actions run is in
+ * progress. Every request of that run — the envelope, its artifacts, the
+ * model keys and the model stats — then travels under it, and the server
+ * stamps the run `attested`, the tier the enforced gate reads.
+ *
+ * Rules this module must never break:
+ * - It fails loudly. Outside Actions (the runner sets
+ *   `ACTIONS_ID_TOKEN_REQUEST_URL` and `_TOKEN` only for a job that grants
+ *   `id-token: write`), without `HARNESS_API_URL`, or when the exchange is
+ *   refused, the review does not start. There is no fallback to
+ *   `HARNESS_API_TOKEN` or the stored login: a review asked to be attested
+ *   is attested or it does not run.
+ * - The runner's request token goes to the runner's URL only, the OIDC
+ *   token to the Harness origin only, both over TLS; neither is logged.
+ * - The credential never outlives the workflow run, so nothing recorded
+ *   under it is ever spooled for a later flush.
+ * - A review may outlast the credential (thirty minutes): before delivery
+ *   it is minted again for the same run id — allowed while the run is not
+ *   yet recorded — when little of it remains (`renewAttestation`).
+ */
+/** One request's bound; the exchange reads GitHub twice (installation, run). */
+export declare const ATTEST_TIMEOUT_MS = 10000;
+/** Retries of the exchange when Harness or GitHub behind it is unavailable. */
+export declare const ATTEST_RETRIES = 2;
+/** Renew the credential before delivery when less than this remains of it. */
+export declare const RENEW_BEFORE_MS: number;
+export type AttestErrorCode = 'not_in_actions' | 'missing_host' | 'oidc_request_failed' | 'invalid_attestation' | 'attestation_refused' | 'run_exists' | 'harness_unavailable' | 'malformed_response' | 'attest_failed';
+export declare class AttestError extends Error {
+    readonly code: AttestErrorCode;
+    constructor(code: AttestErrorCode, message: string);
+}
+export interface AttestOptions {
+    /** The rcl run id this review will record — minted before the review, bound by the credential. */
+    runId: string;
+    rclVersion: string;
+    /** Exact immediate parent requested from the server; never an ancestor list or client authority. */
+    reviewerRecovery?: ReviewerAttestationRequest;
+    env?: Record<string, string | undefined>;
+    fetchImpl?: typeof fetch;
+    /** Injected by tests; the pause between exchange retries. */
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface Attestation {
+    /** The run-bound credential (`rbc_…`), its Harness base URL, `source: 'attest'`. */
+    credential: HarnessCredential;
+    runId: string;
+    /** ISO 8601, as the server states it. */
+    expiresAt: string;
+    /** The OIDC audience requested: the Harness origin. */
+    audience: string;
+    /** The immutable request binding; the opaque credential carries the server's authorization. */
+    reviewerRecovery?: ReviewerAttestationRequest;
+}
+export interface ReviewerAttestationRequest {
+    readonly version: 1;
+    readonly source: Readonly<ReviewerRecoverySource>;
+}
+/** Validate and snapshot only the exact-parent request, without asserting a signed grant. */
+export declare function snapshotReviewerAttestation(runId: string, value: ReviewerAttestationRequest): ReviewerAttestationRequest;
+/** One ephemeral first-delivery permission from an unchanged actual exchange, never restorable from disk. */
+export declare function consumeFreshAttestation(value: Attestation): boolean;
+/**
+ * Request the job's OIDC token for the Harness origin and exchange it for
+ * the run-bound credential of `runId`. Throws an `AttestError` — the review
+ * must not start — on every failure; an unavailable Harness (or GitHub
+ * behind it) is retried a bounded number of times first.
+ */
+export declare function attestRun(options: AttestOptions): Promise<Attestation>;
+export interface RenewOptions extends Omit<AttestOptions, 'runId'> {
+    /** Injected by tests: the clock the remaining lifetime is measured against. */
+    now?: () => number;
+}
+export interface Renewal {
+    attestation: Attestation;
+    renewed: boolean;
+    /** Why a renewal that was due did not happen; the credential in hand is kept. */
+    failure?: string;
+}
+/**
+ * The credential to deliver with: the one in hand while more than
+ * `RENEW_BEFORE_MS` of it remains, else a fresh one for the same run id (the
+ * server mints again for a run not yet recorded). A failed renewal keeps the
+ * credential in hand — the delivery then reports what the server says.
+ */
+export declare function renewAttestation(current: Attestation, options: RenewOptions): Promise<Renewal>;
+/**
+ * Decode a bounded internal transfer, never new mint authority. The resulting
+ * unbranded session requires scoped server preflight/own-run readback; it cannot
+ * create an unknown run on restart or authorize a new deadline.
+ */
+export declare function parseTransferredAttestation(bytes: string, runId: string, expectedSource?: ReviewerAttestationRequest): Attestation;

package/dist/telemetry/attest.js

@@ -0,0 +1,331 @@
+import { normalizeUrl } from './credentials.js';
+import { isDeepStrictEqual } from 'node:util';
+import { z } from 'zod';
+import { parseAttestedExpiry } from './attested-retry.js';
+import { scrubText } from './scrub.js';
+import { readBounded } from './sink.js';
+/**
+ * `rcl review --attest` (epic IO-12475, sections 4.1 and 8.5; RCL-40): inside
+ * the organization's gate workflow on GitHub Actions, the job's OIDC token —
+ * requested from the runner with the Harness origin as audience — is
+ * exchanged at `POST /api/v1/reviews/attest` for a run-bound credential:
+ * good for one rcl run id, thirty minutes, while the Actions run is in
+ * progress. Every request of that run — the envelope, its artifacts, the
+ * model keys and the model stats — then travels under it, and the server
+ * stamps the run `attested`, the tier the enforced gate reads.
+ *
+ * Rules this module must never break:
+ * - It fails loudly. Outside Actions (the runner sets
+ *   `ACTIONS_ID_TOKEN_REQUEST_URL` and `_TOKEN` only for a job that grants
+ *   `id-token: write`), without `HARNESS_API_URL`, or when the exchange is
+ *   refused, the review does not start. There is no fallback to
+ *   `HARNESS_API_TOKEN` or the stored login: a review asked to be attested
+ *   is attested or it does not run.
+ * - The runner's request token goes to the runner's URL only, the OIDC
+ *   token to the Harness origin only, both over TLS; neither is logged.
+ * - The credential never outlives the workflow run, so nothing recorded
+ *   under it is ever spooled for a later flush.
+ * - A review may outlast the credential (thirty minutes): before delivery
+ *   it is minted again for the same run id — allowed while the run is not
+ *   yet recorded — when little of it remains (`renewAttestation`).
+ */
+/** One request's bound; the exchange reads GitHub twice (installation, run). */
+export const ATTEST_TIMEOUT_MS = 10_000;
+/** Retries of the exchange when Harness or GitHub behind it is unavailable. */
+export const ATTEST_RETRIES = 2;
+const RETRY_PAUSE_MS = 2_000;
+/** A credential answer is a few hundred bytes; anything past this is not one. */
+const MAX_RESPONSE_BYTES = 64 * 1024;
+/** Renew the credential before delivery when less than this remains of it. */
+export const RENEW_BEFORE_MS = 10 * 60_000;
+export class AttestError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'AttestError';
+        this.code = code;
+    }
+}
+const reviewerRequestSchema = z.object({ version: z.literal(1), source: z.object({
+        run_id: z.string().regex(/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}(?![\s\S])/i),
+        report_sha256: z.string().regex(/^[0-9a-f]{64}(?![\s\S])/),
+        reviewer_artifact_sha256: z.string().regex(/^[0-9a-f]{64}(?![\s\S])/),
+    }).strict() }).strict();
+const freshAttestations = new WeakMap();
+/** Validate and snapshot only the exact-parent request, without asserting a signed grant. */
+export function snapshotReviewerAttestation(runId, value) {
+    const result = reviewerRequestSchema.safeParse(value);
+    if (!result.success || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}(?![\s\S])/i.test(runId) ||
+        result.data.source.run_id.toLowerCase() === runId.toLowerCase()) {
+        throw new AttestError('invalid_attestation', 'Invalid reviewer recovery attestation request');
+    }
+    return Object.freeze({ version: 1, source: Object.freeze(result.data.source) });
+}
+/** One ephemeral first-delivery permission from an unchanged actual exchange, never restorable from disk. */
+export function consumeFreshAttestation(value) {
+    const original = freshAttestations.get(value);
+    freshAttestations.delete(value);
+    return original !== undefined && isDeepStrictEqual(value, original);
+}
+/** What Harness says when it refuses, worded for the workflow log. */
+const REFUSAL_HINTS = {
+    repository_not_installed: 'the Harness GitHub App is not installed on this repository',
+    ambiguous_installation: 'more than one Harness organization claims this repository',
+    reviews_disabled: 'Review Council evidence is not enabled for the organization',
+    wrong_event: 'the gate workflow must run on workflow_dispatch',
+    workflow_not_allowed: 'this workflow file is not on the organization allow-list of gate workflows at its default branch',
+    run_not_in_progress: 'GitHub does not report this workflow run (attempt) as in progress',
+    actions_permission_missing: 'the Harness GitHub App lacks the actions: read permission on this installation',
+};
+/** Server and runner text, bounded and scrubbed, with this run's own tokens blanked wherever they appear. */
+function bounded(text, secrets, max = 200) {
+    let out = text;
+    for (const secret of secrets) {
+        if (secret !== '')
+            out = out.split(secret).join('[redacted]');
+    }
+    return scrubText(out, max);
+}
+/** The runner's token endpoint and request token, present only under `id-token: write`. */
+function actionsOidcRequest(env) {
+    const url = (env['ACTIONS_ID_TOKEN_REQUEST_URL'] ?? '').trim();
+    const token = (env['ACTIONS_ID_TOKEN_REQUEST_TOKEN'] ?? '').trim();
+    const secure = url !== '' && isHttps(url);
+    if (!secure || token === '') {
+        throw new AttestError('not_in_actions', '--attest needs GitHub Actions with `id-token: write`: ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN are not set (or the URL is not https). Grant the permission in the gate workflow, or run without --attest.');
+    }
+    return { url, token };
+}
+function isHttps(raw) {
+    try {
+        return new URL(raw).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/** The Harness base URL: `HARNESS_API_URL`, TLS-only. Never the stored login. */
+function harnessBase(env) {
+    const raw = (env['HARNESS_API_URL'] ?? '').trim();
+    if (raw === '') {
+        throw new AttestError('missing_host', '--attest needs HARNESS_API_URL (the Harness host the workflow attests to). The OIDC token is the credential — HARNESS_API_TOKEN and the stored login are not used.');
+    }
+    const url = normalizeUrl(raw);
+    if (url === null || !isHttps(url)) {
+        throw new AttestError('missing_host', '--attest needs HARNESS_API_URL to be an absolute https URL without user-info, query or fragment.');
+    }
+    return url;
+}
+/** The JSON body, read up to the answer limit; an oversized or non-JSON body reads as a `malformed_response` error body. */
+async function readJson(response) {
+    const text = await readBounded(response, MAX_RESPONSE_BYTES);
+    if (text === null)
+        return { error: 'malformed_response', message: 'response larger than the answer limit' };
+    if (text === '')
+        return null;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { error: 'malformed_response', message: 'response is not JSON' };
+    }
+}
+async function requestOidcToken(request, audience, fetchImpl) {
+    const secrets = [request.token];
+    const separator = request.url.includes('?') ? '&' : '?';
+    let response;
+    try {
+        response = await fetchImpl(`${request.url}${separator}audience=${encodeURIComponent(audience)}`, {
+            method: 'GET',
+            headers: { authorization: `bearer ${request.token}`, accept: 'application/json' },
+            signal: AbortSignal.timeout(ATTEST_TIMEOUT_MS),
+            // The request token travels to the runner's URL and nowhere else.
+            redirect: 'manual',
+        });
+    }
+    catch (err) {
+        throw new AttestError('oidc_request_failed', `The runner did not answer the OIDC token request: ${bounded(describeError(err), secrets)}`);
+    }
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new AttestError('oidc_request_failed', 'The runner redirected the OIDC token request; redirects are not followed with the request token.');
+    }
+    if (!response.ok) {
+        throw new AttestError('oidc_request_failed', `The runner refused the OIDC token request: HTTP ${response.status}.`);
+    }
+    let body;
+    try {
+        body = await readJson(response);
+    }
+    catch (err) {
+        throw new AttestError('oidc_request_failed', `The runner's OIDC token answer could not be read: ${bounded(describeError(err), secrets)}`);
+    }
+    const value = body?.value;
+    if (typeof value !== 'string' || value === '') {
+        throw new AttestError('oidc_request_failed', 'The runner answered the OIDC token request without a token.');
+    }
+    return value;
+}
+function describeError(err) {
+    if (err instanceof Error)
+        return err.name === 'TimeoutError' ? `no answer within ${ATTEST_TIMEOUT_MS} ms` : err.message;
+    return String(err);
+}
+async function exchangeOnce(base, oidcToken, runId, rclVersion, fetchImpl, secrets, reviewerRecovery) {
+    let response;
+    try {
+        response = await fetchImpl(`${base}/api/v1/reviews/attest`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${oidcToken}`,
+                'content-type': 'application/json',
+                accept: 'application/json',
+                'x-harness-client': 'rcl',
+                'x-harness-client-version': rclVersion,
+                'user-agent': `rcl/${rclVersion} node/${process.versions.node}`,
+            },
+            body: JSON.stringify({ run_id: runId, ...(reviewerRecovery === undefined ? {} : { reviewer_recovery: reviewerRecovery }) }),
+            signal: AbortSignal.timeout(ATTEST_TIMEOUT_MS),
+            redirect: 'manual',
+        });
+    }
+    catch (err) {
+        return { retry: bounded(describeError(err), secrets) };
+    }
+    if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400)) {
+        throw new AttestError('malformed_response', 'Harness redirected the attest request — check HARNESS_API_URL (redirects are not followed with a token).');
+    }
+    let body;
+    try {
+        body = await readJson(response);
+    }
+    catch (err) {
+        // The connection went away under the body: as retryable as a failed request.
+        return { retry: bounded(describeError(err), secrets) };
+    }
+    const status = response.status;
+    const error = typeof body?.error === 'string' ? body.error : '';
+    const reason = typeof body?.reason === 'string' ? body.reason : error;
+    const message = typeof body?.message === 'string' ? body.message : '';
+    if (status >= 200 && status < 300) {
+        if (error === 'malformed_response') {
+            throw new AttestError('malformed_response', `Harness answered the attest request with ${bounded(message, secrets) || 'an unreadable body'}.`);
+        }
+        const data = body?.data;
+        const credential = data?.['credential'];
+        const expiresAt = data?.['expires_at'];
+        if (typeof credential !== 'string' ||
+            !credential.startsWith('rbc_') ||
+            data?.['run_id'] !== runId ||
+            typeof expiresAt !== 'string' ||
+            !Number.isFinite(Date.parse(expiresAt))) {
+            throw new AttestError('malformed_response', 'Harness answered the attest request without a run-bound credential for this run (or without a readable expiry).');
+        }
+        return { credential, expiresAt };
+    }
+    if (status >= 500 || status === 429 || status === 408) {
+        return { retry: `HTTP ${status}${message ? ` ${bounded(message, secrets)}` : ''}` };
+    }
+    const detail = `${bounded(reason, secrets, 60) || `http_${status}`}${message ? `: ${bounded(message, secrets)}` : ''}`;
+    const hint = REFUSAL_HINTS[reason];
+    const explained = hint ? `${detail} — ${hint}` : detail;
+    if (status === 401)
+        throw new AttestError('invalid_attestation', `Harness did not accept the Actions OIDC token (${explained}).`);
+    if (status === 403)
+        throw new AttestError('attestation_refused', `Harness refused to attest this workflow run (${explained}).`);
+    if (status === 409) {
+        throw new AttestError('run_exists', `Harness already holds a run with this id (${explained}); a credential binds a run not yet delivered.`);
+    }
+    throw new AttestError('attest_failed', `Harness refused the attest request: HTTP ${status} (${explained}).`);
+}
+/**
+ * Request the job's OIDC token for the Harness origin and exchange it for
+ * the run-bound credential of `runId`. Throws an `AttestError` — the review
+ * must not start — on every failure; an unavailable Harness (or GitHub
+ * behind it) is retried a bounded number of times first.
+ */
+export async function attestRun(options) {
+    const runId = options.runId;
+    const reviewerRecovery = options.reviewerRecovery === undefined ? undefined : snapshotReviewerAttestation(runId, options.reviewerRecovery);
+    const env = options.env ?? process.env;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const oidc = actionsOidcRequest(env);
+    const base = harnessBase(env);
+    const audience = new URL(base).origin;
+    const oidcToken = await requestOidcToken(oidc, audience, fetchImpl);
+    const secrets = [oidc.token, oidcToken];
+    let lastRetry = '';
+    for (let attempt = 0; attempt <= ATTEST_RETRIES; attempt++) {
+        if (attempt > 0)
+            await sleep(RETRY_PAUSE_MS);
+        const result = await exchangeOnce(base, oidcToken, runId, options.rclVersion, fetchImpl, secrets, reviewerRecovery);
+        if ('retry' in result) {
+            lastRetry = result.retry;
+            continue;
+        }
+        const attestation = {
+            credential: { url: base, token: result.credential, source: 'attest' },
+            runId,
+            expiresAt: result.expiresAt,
+            audience,
+            ...(reviewerRecovery === undefined ? {} : { reviewerRecovery }),
+        };
+        freshAttestations.set(attestation, structuredClone(attestation));
+        return attestation;
+    }
+    throw new AttestError('harness_unavailable', `Harness could not attest this run after ${1 + ATTEST_RETRIES} attempts (${lastRetry}). The workflow may retry; nothing was recorded.`);
+}
+/**
+ * The credential to deliver with: the one in hand while more than
+ * `RENEW_BEFORE_MS` of it remains, else a fresh one for the same run id (the
+ * server mints again for a run not yet recorded). A failed renewal keeps the
+ * credential in hand — the delivery then reports what the server says.
+ */
+export async function renewAttestation(current, options) {
+    const now = (options.now ?? Date.now)();
+    // `expiresAt` was checked to parse at mint; a value that does not is treated as spent.
+    const expires = Date.parse(current.expiresAt);
+    if (Number.isFinite(expires) && expires - now > RENEW_BEFORE_MS)
+        return { attestation: current, renewed: false };
+    try {
+        const fresh = await attestRun({ ...options, runId: current.runId, reviewerRecovery: current.reviewerRecovery });
+        return { attestation: fresh, renewed: true };
+    }
+    catch (err) {
+        return { attestation: current, renewed: false, failure: err instanceof Error ? err.message : String(err) };
+    }
+}
+/**
+ * Decode a bounded internal transfer, never new mint authority. The resulting
+ * unbranded session requires scoped server preflight/own-run readback; it cannot
+ * create an unknown run on restart or authorize a new deadline.
+ */
+export function parseTransferredAttestation(bytes, runId, expectedSource) {
+    const fail = () => {
+        throw new AttestError('invalid_attestation', 'A valid still-live session for this exact retained run is required; preserve the artifacts and do not relaunch reviewers.');
+    };
+    if (typeof bytes !== 'string' || Buffer.byteLength(bytes) > 65_536)
+        return fail();
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes);
+    }
+    catch {
+        return fail();
+    }
+    const result = z.object({
+        credential: z.object({ url: z.string(), token: z.string().min(5).max(8192).regex(/^rbc_[^\s\x00-\x1f\x7f]+$/), source: z.literal('attest') }).strict(),
+        runId: z.string(), expiresAt: z.string(), audience: z.string(), reviewerRecovery: reviewerRequestSchema.optional(),
+    }).strict().safeParse(parsed);
+    if (!result.success)
+        return fail();
+    const session = result.data, url = normalizeUrl(session.credential.url), expiry = parseAttestedExpiry(session.expiresAt);
+    if (!url || url !== session.credential.url || new URL(url).origin !== session.audience ||
+        session.runId !== runId || !/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}(?![\s\S])/i.test(runId) ||
+        expiry === undefined || expiry <= Date.now() || !isDeepStrictEqual(session.reviewerRecovery, expectedSource))
+        return fail();
+    if (session.reviewerRecovery)
+        snapshotReviewerAttestation(runId, session.reviewerRecovery);
+    return session;
+}
+//# sourceMappingURL=attest.js.map

package/dist/telemetry/attest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attest.js","sourceRoot":"","sources":["../../src/telemetry/attest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0B,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACxC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAChC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AAa3C,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAkB;IAE/B,YAAY,IAAqB,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AA2BD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yDAAyD,CAAC;QACnF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;QAC1D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;KACtE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACxB,MAAM,iBAAiB,GAAG,IAAI,OAAO,EAA4B,CAAC;AAElE,6FAA6F;AAC7F,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,KAAiC;IAC1F,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,+CAA+C,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,uBAAuB,CAAC,KAAkB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9C,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,QAAQ,KAAK,SAAS,IAAI,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AACtE,CAAC;AAED,sEAAsE;AACtE,MAAM,aAAa,GAA2B;IAC5C,wBAAwB,EAAE,4DAA4D;IACtF,sBAAsB,EAAE,2DAA2D;IACnF,gBAAgB,EAAE,6DAA6D;IAC/E,WAAW,EAAE,iDAAiD;IAC9D,oBAAoB,EAAE,kGAAkG;IACxH,mBAAmB,EAAE,mEAAmE;IACxF,0BAA0B,EAAE,gFAAgF;CAC7G,CAAC;AAEF,6GAA6G;AAC7G,SAAS,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE,GAAG,GAAG,GAAG;IAClE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,EAAE;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAOD,2FAA2F;AAC3F,SAAS,kBAAkB,CAAC,GAAuC;IACjE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CACnB,gBAAgB,EAChB,kOAAkO,CACnO,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,WAAW,CAAC,GAAuC;IAC1D,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,cAAc,EACd,oKAAoK,CACrK,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,kGAAkG,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4HAA4H;AAC5H,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IAC5G,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAoB,EAAE,QAAgB,EAAE,SAAuB;IAC7F,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,CAAC,GAAG,GAAG,SAAS,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE;YAC/F,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACjF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC9C,kEAAkE;YAClE,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,qDAAqD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,kGAAkG,CAAC,CAAC;IACnJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,mDAAmD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,qDAAqD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,MAAM,KAAK,GAAI,IAAmC,EAAE,KAAK,CAAC;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,6DAA6D,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,KAAK;QAAE,OAAO,GAAG,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,oBAAoB,iBAAiB,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACxH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAID,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,SAAiB,EACjB,KAAa,EACb,UAAkB,EAClB,SAAuB,EACvB,OAA0B,EAC1B,gBAA6C;IAE7C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,wBAAwB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,SAAS,EAAE;gBACpC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;gBAC1B,kBAAkB,EAAE,KAAK;gBACzB,0BAA0B,EAAE,UAAU;gBACtC,YAAY,EAAE,OAAO,UAAU,SAAS,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE;aAChE;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;YAC3H,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC9C,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,WAAW,CACnB,oBAAoB,EACpB,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAQ,IAAmC,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAG,IAA0B,CAAC,KAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnI,MAAM,MAAM,GAAG,OAAQ,IAAoC,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAG,IAA2B,CAAC,MAAiB,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3I,MAAM,OAAO,GAAG,OAAQ,IAAqC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAG,IAA4B,CAAC,OAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7I,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,4CAA4C,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAChJ,CAAC;QACD,MAAM,IAAI,GAAI,IAAkD,EAAE,IAAI,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC;QACvC,IACE,OAAO,UAAU,KAAK,QAAQ;YAC9B,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;YAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK;YAC1B,OAAO,SAAS,KAAK,QAAQ;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EACvC,CAAC;YACD,MAAM,IAAI,WAAW,CACnB,oBAAoB,EACpB,iHAAiH,CAClH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,QAAQ,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvH,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,kDAAkD,SAAS,IAAI,CAAC,CAAC;IAClI,IAAI,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,gDAAgD,SAAS,IAAI,CAAC,CAAC;IAChI,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,6CAA6C,SAAS,gDAAgD,CAAC,CAAC;IAC9I,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,4CAA4C,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAsB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3I,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzG,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAEtC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAExC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACpH,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAgB;YAC/B,UAAU,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE;YACrE,KAAK;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ;YACR,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC;QACF,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;QACjE,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,2CAA2C,CAAC,GAAG,cAAc,cAAc,SAAS,kDAAkD,CACvI,CAAC;AACJ,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAoB,EAAE,OAAqB;IAChF,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,uFAAuF;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,GAAG,GAAG,eAAe;QAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7G,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,KAAa,EAAE,cAA2C;IACnH,MAAM,IAAI,GAAG,GAAU,EAAE;QAAG,MAAM,IAAI,WAAW,CAAC,qBAAqB,EACrE,2HAA2H,CAAC,CAAC;IAAC,CAAC,CAAC;IAClI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM;QAAE,OAAO,IAAI,EAAE,CAAC;IAClF,IAAI,MAAe,CAAC;IAAC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,EAAE,CAAC;IAAC,CAAC;IACjF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACtB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;QACtJ,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,QAAQ,EAAE;KACnH,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzH,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ;QACpF,OAAO,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC;QACjG,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAC9H,IAAI,OAAO,CAAC,gBAAgB;QAAE,2BAA2B,CAAC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3F,OAAO,OAAO,CAAC;AACjB,CAAC"}