@allocator-one/rcl 4.4.19

package/dist/telemetry/reviewer-delivery.js

@@ -0,0 +1,279 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { z } from 'zod';
+import { isReviewerArtifact } from '../report/reviewer-artifact.js';
+import { withRecoveryLock, syncDirectory, writeExclusiveBytes } from '../evidence/original-run/journal.js';
+import { prepareLockRoot, inspectRecoveryDirectory } from '../evidence/original-run/lock-path.js';
+import { platformPath, readStable, sha256 } from './recovery/files.js';
+import { normalizeUrl } from './credentials.js';
+import { MAX_ARTIFACT_BYTES, MAX_ENVELOPE_BYTES, validateRunEnvelope } from './envelope-validation.js';
+export const REVIEWER_OUTBOX_DIR = 'reviewer-outbox';
+const uuid = z.string().regex(/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}(?![\s\S])/i);
+const digest = z.string().regex(/^[0-9a-f]{64}(?![\s\S])/);
+const reference = z.object({ sha256: digest, bytes: z.number().int().min(0).max(MAX_ARTIFACT_BYTES) }).strict();
+const manifestSchema = z.object({ version: z.literal(1), runId: uuid, host: z.string(), credentialKind: z.enum(['login', 'env']),
+    envelope: reference, report_json: reference, report_md: reference.optional(), reviewer: reference }).strict();
+const files = { report_json: 'report.json', report_md: 'report.md' };
+const ref = (text) => ({ sha256: sha256(text), bytes: Buffer.byteLength(text) });
+function fail(reason) { throw new Error(`reviewer_delivery_${reason}`); }
+function safeFailure(error) {
+    return error instanceof Error && /^reviewer_delivery_[a-z_]+$/.test(error.message) ? error.message : 'reviewer_delivery_local_refusal';
+}
+function accepted(outcome) {
+    if (outcome.kind !== 'ok')
+        fail(outcome.kind === 'unavailable' ? 'unavailable' : 'refused');
+    return outcome.value;
+}
+async function privateRead(path, limit) {
+    const check = async () => { const stat = await lstat(path); if (!stat.isFile() || stat.nlink !== 1 || stat.uid !== process.geteuid?.() || (stat.mode & 0o777) !== 0o600)
+        fail('unsafe_file'); };
+    await check();
+    const raw = await readStable(path, limit);
+    await check();
+    // readStable's UTF-8 decoder may normalize BOM; private payload bytes may not.
+    if (!Buffer.from(raw.text).equals(raw.raw))
+        fail('nonexact_bytes');
+    return raw.text;
+}
+async function publish(path, bytes) {
+    try {
+        await writeExclusiveBytes(path, Buffer.from(bytes));
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        if (await privateRead(path, MAX_ARTIFACT_BYTES) !== bytes)
+            fail('immutable_conflict');
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await syncDirectory(join(path, '..'));
+    }
+}
+function validate(entry) {
+    const { manifest: m, envelope, artifacts, privateBytes } = entry;
+    if (normalizeUrl(m.host) !== m.host || m.envelope.bytes > MAX_ENVELOPE_BYTES || envelope.run.id !== m.runId ||
+        validateRunEnvelope(envelope, artifacts).length || !isDeepStrictEqual(ref(entry.envelopeBytes), m.envelope) ||
+        !isDeepStrictEqual(ref(artifacts.report_json), m.report_json) || !isDeepStrictEqual(ref(privateBytes), m.reviewer) ||
+        (m.report_md === undefined ? artifacts.report_md !== undefined : !isDeepStrictEqual(ref(artifacts.report_md), m.report_md)))
+        fail('invalid_entry');
+    const declaration = envelope.reviewer_recovery;
+    if (!declaration || declaration.sha256 !== m.reviewer.sha256 || declaration.bytes !== m.reviewer.bytes)
+        fail('declaration_mismatch');
+    const wire = JSON.parse(privateBytes), report = JSON.parse(artifacts.report_json);
+    if (wire.report?.bytes !== artifacts.report_json || wire.report?.sha256 !== m.report_json.sha256 ||
+        wire.assembly?.run?.id !== m.runId || report.run?.id !== m.runId ||
+        !isDeepStrictEqual(report.run?.reviewer_evidence, declaration.descriptor))
+        fail('report_binding');
+}
+function budget(options) {
+    const duration = options.deadlineMs ?? 120_000;
+    if (!Number.isFinite(duration) || duration < 0)
+        fail('invalid_deadline');
+    const bounded = Math.min(duration, 120_000), end = performance.now() + bounded;
+    const deadline = AbortSignal.timeout(Math.max(1, Math.ceil(bounded)));
+    const signal = options.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+    return () => { const left = end - performance.now(); if (left <= 0 || signal.aborted)
+        fail('deadline'); return { timeoutMs: left, signal }; };
+}
+/**
+ * Immutable private delivery copies. No token or token fingerprint is retained.
+ * Current server authorization, not this local directory, determines ownership.
+ * Unknown-run restart refuses: a replacement principal cannot recreate a run.
+ */
+export class ReviewerDeliveryQueue {
+    root;
+    constructor(dataDir) { this.root = join(platformPath(dataDir), REVIEWER_OUTBOX_DIR); }
+    /** Retain exact already-validated local bytes; never admit deserialized brands. */
+    async retain(input) {
+        const entry = this.snapshot(input);
+        await this.lock(entry.manifest.runId, async () => { await this.save(entry); });
+    }
+    /** Initial delivery is the only path allowed to create an as-yet unknown run. */
+    async deliver(input, options = {}) {
+        const entry = this.snapshot(input), request = budget(options);
+        await this.lock(entry.manifest.runId, async () => {
+            request();
+            await this.save(entry);
+            // An existing manifest might belong to an earlier process/principal.
+            // Only this invocation's first publication can use the creation path.
+            await this.transfer(await this.load(entry.manifest.runId), input.sink, request, entryWasNew.delete(entry));
+        });
+    }
+    /** Explicit/current-credential retry; no provider calls or changed run identity. */
+    async flush(sink, options = {}, authorizeTransfer) {
+        const summary = { delivered: [], remaining: [], failed: [], dropped: [] };
+        const request = budget({ deadlineMs: options.deadlineMs });
+        let names;
+        try {
+            names = await readdir(this.root);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return summary;
+            throw error;
+        }
+        if (options.runId !== undefined && !uuid.safeParse(options.runId).success)
+            fail('invalid_run');
+        const selected = names.filter(name => uuid.safeParse(name).success && (!options.runId || name === options.runId.toLowerCase())).sort();
+        for (const [index, id] of selected.entries()) {
+            try {
+                request();
+                await this.lock(id, async () => {
+                    const entry = await this.load(id);
+                    if (await this.acknowledged(entry))
+                        return;
+                    await authorizeTransfer?.();
+                    request();
+                    await this.transfer(entry, sink, request, false);
+                    summary.delivered.push(entry.manifest.runId);
+                });
+            }
+            catch (error) {
+                const reason = safeFailure(error);
+                summary.remaining.push(id);
+                summary.failed.push({ id, reason });
+                if (reason === 'reviewer_delivery_deadline')
+                    summary.stopped = 'deadline';
+                else if (reason === 'reviewer_delivery_unavailable')
+                    summary.stopped = 'unavailable';
+                if (summary.stopped) {
+                    summary.remaining.push(...selected.slice(index + 1));
+                    break;
+                }
+            }
+        }
+        return summary;
+    }
+    /** Local retention only; never a server acknowledgment. */
+    async isRetained(runId) {
+        if (!uuid.safeParse(runId).success)
+            return false;
+        try {
+            await this.lock(runId, async () => { await this.load(runId); });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    snapshot(input) {
+        if (!isReviewerArtifact(input.artifact))
+            fail('unvalidated_artifact');
+        if (input.sink.credentialSource === 'attest')
+            fail('attested_replay_unsupported');
+        const envelopeBytes = JSON.stringify(input.envelope), envelope = JSON.parse(envelopeBytes);
+        const artifacts = { ...input.artifacts }, privateBytes = input.artifact.bytes;
+        const manifest = manifestSchema.parse({ version: 1, runId: envelope.run.id, host: input.sink.baseUrl, credentialKind: input.sink.credentialSource,
+            envelope: ref(envelopeBytes), report_json: ref(artifacts.report_json), ...(artifacts.report_md === undefined ? {} : { report_md: ref(artifacts.report_md) }), reviewer: ref(privateBytes) });
+        const entry = { manifest, envelope, envelopeBytes, artifacts, privateBytes, directory: join(this.root, manifest.runId.toLowerCase()) };
+        validate(entry);
+        return entry;
+    }
+    async lock(runId, work) {
+        return withRecoveryLock(join(this.root, 'locks'), runId.toLowerCase(), work);
+    }
+    async save(entry) {
+        await prepareLockRoot(this.root);
+        try {
+            await mkdir(entry.directory, { mode: 0o700 });
+            await syncDirectory(this.root);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        await inspectRecoveryDirectory(entry.directory, true);
+        const existing = await readdir(entry.directory);
+        if (existing.length === 0)
+            entryWasNew.add(entry);
+        await publish(join(entry.directory, 'envelope.json'), entry.envelopeBytes);
+        await publish(join(entry.directory, 'reviewer-artifact.json'), entry.privateBytes);
+        for (const kind of ['report_json', 'report_md'])
+            if (entry.artifacts[kind] !== undefined)
+                await publish(join(entry.directory, files[kind]), entry.artifacts[kind]);
+        // Publish manifest last; a crash before it leaves evidence, never an uploadable partial entry.
+        await publish(join(entry.directory, 'manifest.json'), JSON.stringify(entry.manifest));
+    }
+    async load(id) {
+        const directory = join(this.root, id.toLowerCase());
+        await inspectRecoveryDirectory(directory, true);
+        const manifest = manifestSchema.parse(JSON.parse(await privateRead(join(directory, 'manifest.json'), 4096)));
+        if (manifest.runId.toLowerCase() !== id.toLowerCase())
+            fail('invalid_run');
+        const allowed = ['manifest.json', 'envelope.json', 'reviewer-artifact.json', 'report.json', 'acknowledged.json', ...(manifest.report_md ? ['report.md'] : [])];
+        if ((await readdir(directory)).some(name => !allowed.includes(name)))
+            fail('unknown_file');
+        const envelopeBytes = await privateRead(join(directory, 'envelope.json'), MAX_ENVELOPE_BYTES);
+        const entry = { manifest, directory, envelopeBytes, envelope: JSON.parse(envelopeBytes), privateBytes: await privateRead(join(directory, 'reviewer-artifact.json'), MAX_ARTIFACT_BYTES),
+            artifacts: { report_json: await privateRead(join(directory, 'report.json'), MAX_ARTIFACT_BYTES), ...(manifest.report_md ? { report_md: await privateRead(join(directory, 'report.md'), MAX_ARTIFACT_BYTES) } : {}) } };
+        validate(entry);
+        return entry;
+    }
+    ack(entry) { return JSON.stringify({ version: 1, runId: entry.manifest.runId, manifestSha256: sha256(JSON.stringify(entry.manifest)) }); }
+    async acknowledged(entry) {
+        try {
+            if (await privateRead(join(entry.directory, 'acknowledged.json'), 4096) !== this.ack(entry))
+                fail('invalid_ack');
+            return true;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+    }
+    async transfer(entry, sink, request, initial) {
+        const m = entry.manifest;
+        if (sink.baseUrl !== m.host || sink.credentialSource !== m.credentialKind)
+            fail('credential_mismatch');
+        accepted(await sink.checkReviewerRecovery(request()));
+        let read = initial ? undefined : await sink.getReviewerArtifact(m.runId, m.reviewer, request());
+        if (read && read.kind !== 'ok' && read.kind !== 'pending')
+            accepted(read);
+        // A matching private read is the server's completed admission proof: it
+        // validates the retained ordinary/private pair, so replaying the ordinary
+        // uploads would only repeat already acknowledged work after a lost local ACK.
+        if (read?.kind === 'ok') {
+            if (!read.value.bytes.equals(Buffer.from(entry.privateBytes)))
+                fail('private_mismatch');
+            await publish(join(entry.directory, 'acknowledged.json'), this.ack(entry));
+            return;
+        }
+        accepted(await sink.postRun(entry.envelope, request(), entry.envelopeBytes));
+        read ??= await sink.getReviewerArtifact(m.runId, m.reviewer, request());
+        if (read.kind !== 'ok' && read.kind !== 'pending')
+            accepted(read);
+        if (read.kind === 'ok' && !read.value.bytes.equals(Buffer.from(entry.privateBytes)))
+            fail('private_mismatch');
+        // Private admission validates the stored ordinary/private pair. Ordinary
+        // reports must be present and read back before the private PUT.
+        for (const kind of ['report_json', 'report_md']) {
+            const bytes = entry.artifacts[kind];
+            if (bytes === undefined)
+                continue;
+            accepted(await sink.putArtifact(m.runId, kind, bytes, request()));
+            const raw = accepted(await sink.getArtifact(m.runId, kind, Buffer.byteLength(bytes), request()));
+            if (!raw.bytes.equals(Buffer.from(bytes)))
+                fail('ordinary_mismatch');
+        }
+        if (read.kind === 'pending') {
+            accepted(await sink.putReviewerArtifact(m.runId, entry.privateBytes, m.reviewer, request()));
+            read = await sink.getReviewerArtifact(m.runId, m.reviewer, request());
+        }
+        if (read.kind === 'pending')
+            fail('unavailable');
+        if (!accepted(read).bytes.equals(Buffer.from(entry.privateBytes)))
+            fail('private_mismatch');
+        await publish(join(entry.directory, 'acknowledged.json'), this.ack(entry));
+    }
+}
+// Ephemeral creation authority is never persisted or reconstructed from a manifest.
+const entryWasNew = new WeakSet();
+//# sourceMappingURL=reviewer-delivery.js.map

package/dist/telemetry/reviewer-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-delivery.js","sourceRoot":"","sources":["../../src/telemetry/reviewer-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAyB,MAAM,gCAAgC,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC3G,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAClG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAIvG,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;AACzF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;AAC3D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAChH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9H,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAKhH,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAW,CAAC;AAC9E,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACzF,SAAS,IAAI,CAAC,MAAc,IAAW,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AACxF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,CAAC;AACzI,CAAC;AACD,SAAS,QAAQ,CAAI,OAAuB;IAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI;QAAE,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;QAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAChM,MAAM,KAAK,EAAE,CAAC;IAAC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,MAAM,KAAK,EAAE,CAAC;IACxE,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,CAAC;QAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;IAC5D,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,IAAI,MAAM,WAAW,CAAC,IAAI,EAAE,kBAAkB,CAAC,KAAK,KAAK;YAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC9D,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AACD,SAAS,QAAQ,CAAC,KAAY;IAC5B,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACjE,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,GAAG,kBAAkB,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK;QACvG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC3G,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;QAClH,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACxJ,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAC;IAC/C,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACrI,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM;QAC5F,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK;QAChE,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,WAAW,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;AACxG,CAAC;AACD,SAAS,MAAM,CAAC,OAAgC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IAC/E,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvF,OAAO,GAAG,EAAE,GAAG,MAAM,IAAI,GAAG,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAChJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACvB,IAAI,CAAS;IACtB,YAAY,OAAe,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAE9F,mFAAmF;IACnF,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,OAAO,CAAC,KAA4B,EAAE,UAAmC,EAAE;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;YAC/C,OAAO,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7G,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,KAAK,CACT,IAAiB,EACjB,UAAwB,EAAE,EAC1B,iBAAuC;QAEvC,MAAM,OAAO,GAAiB,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACxF,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3D,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACzC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QACtG,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvI,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;oBAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAClC,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;wBAAE,OAAO;oBAC3C,MAAM,iBAAiB,EAAE,EAAE,CAAC;oBAC5B,OAAO,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;oBAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC5G,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnG,IAAI,MAAM,KAAK,4BAA4B;oBAAE,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC;qBACrE,IAAI,MAAM,KAAK,+BAA+B;oBAAE,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC;gBACrF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YACvF,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,UAAU,CAAC,KAAa;QAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACjD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACrF,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;IACzB,CAAC;IAEO,QAAQ,CAAC,KAA4B;QAC3C,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,QAAQ;YAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAC1G,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB;YAC/I,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC/L,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACvI,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAChC,CAAC;IACO,KAAK,CAAC,IAAI,CAAI,KAAa,EAAE,IAAsB;QACzD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,KAAY;QAC7B,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACtF,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;QACtF,MAAM,wBAAwB,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,WAAW,CAAU;YAAE,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS;gBAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAE,CAAC,CAAC;QAC7K,+FAA+F;QAC/F,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxF,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,EAAU;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAAC,MAAM,wBAAwB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,wBAAwB,EAAE,aAAa,EAAE,mBAAmB,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/J,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3F,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,EAAE,kBAAkB,CAAC;YAC5L,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzN,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO,KAAK,CAAC;IAChC,CAAC;IACO,GAAG,CAAC,KAAY,IAAY,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzJ,KAAK,CAAC,YAAY,CAAC,KAAY;QACrC,IAAI,CAAC;YAAC,IAAI,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACtI,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACtG,CAAC;IACO,KAAK,CAAC,QAAQ,CAAC,KAAY,EAAE,IAAiB,EAAE,OAA6B,EAAE,OAAgB;QACrG,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,CAAC,CAAC,cAAc;YAAE,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACvG,QAAQ,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAChG,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,8EAA8E;QAC9E,IAAI,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACxF,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAC7E,IAAI,KAAK,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC9G,yEAAyE;QACzE,gEAAgE;QAChE,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,WAAW,CAAU,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YACvE,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,IAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACjG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7F,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5F,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF;AACD,oFAAoF;AACpF,MAAM,WAAW,GAAG,IAAI,OAAO,EAAS,CAAC"}

package/dist/telemetry/reviewer-preflight.d.ts

@@ -0,0 +1,13 @@
+import type { ReviewerRecoveryPreflight } from '../evidence/reviewer-recovery.js';
+import type { HarnessSink, RequestOptions } from './sink.js';
+/** Exact local source references only; this does not establish ancestry or server authority. */
+export declare function assertReviewerRecoveryReference(request: ReviewerRecoveryPreflight): void;
+/** Check the exact parent report embedded in an already digest-checked private response. */
+export declare function assertReviewerRecoverySource(request: ReviewerRecoveryPreflight, bytes: Uint8Array): void;
+/**
+ * Server support and private immediate-parent availability under the CURRENT
+ * credential, before the executor reserves a native/provider intent. This is
+ * not source ancestry, native-attempt or protected-producer authority. Signed
+ * exact-parent grants require a separate attested coordinator and fail closed.
+ */
+export declare function createReviewerRecoveryPreflight(sink: HarnessSink, options?: RequestOptions): (request: ReviewerRecoveryPreflight) => Promise<void>;

package/dist/telemetry/reviewer-preflight.js

@@ -0,0 +1,56 @@
+import { isDeepStrictEqual } from 'node:util';
+import { abortSignalWithTimeout } from './abort-signal.js';
+import { sha256 } from './recovery/files.js';
+/** Exact local source references only; this does not establish ancestry or server authority. */
+export function assertReviewerRecoveryReference(request) {
+    if (!request.lineage.length || request.lineage.length > 32 ||
+        !isDeepStrictEqual(request.lineage.at(-1), request.source))
+        throw new Error('reviewer_recovery_source_unavailable');
+}
+/** Check the exact parent report embedded in an already digest-checked private response. */
+export function assertReviewerRecoverySource(request, bytes) {
+    assertReviewerRecoveryReference(request);
+    const source = request.source;
+    try {
+        const wire = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        if (wire.report?.sha256 !== source.reportSha256 || typeof wire.report?.bytes !== 'string' || sha256(wire.report.bytes) !== source.reportSha256 ||
+            wire.assembly?.run?.id !== source.runId || wire.assembly?.run?.target?.headSha !== request.headSha)
+            throw new Error('mismatch');
+    }
+    catch {
+        throw new Error('reviewer_recovery_source_unavailable');
+    }
+}
+/**
+ * Server support and private immediate-parent availability under the CURRENT
+ * credential, before the executor reserves a native/provider intent. This is
+ * not source ancestry, native-attempt or protected-producer authority. Signed
+ * exact-parent grants require a separate attested coordinator and fail closed.
+ */
+export function createReviewerRecoveryPreflight(sink, options = {}) {
+    const settings = { ...options };
+    return async (original) => {
+        const request = structuredClone(original);
+        const timeoutMs = Math.min(settings.timeoutMs ?? 120_000, 120_000);
+        if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+            throw new Error('reviewer_recovery_capability_unavailable');
+        const cancellation = abortSignalWithTimeout(settings.signal, timeoutMs);
+        const options = { ...settings, signal: cancellation.signal };
+        try {
+            if (sink.credentialSource === 'attest')
+                throw new Error('reviewer_recovery_attested_preflight_unsupported');
+            if ((await sink.checkReviewerRecovery(options)).kind !== 'ok')
+                throw new Error('reviewer_recovery_capability_unavailable');
+            const source = request.source;
+            assertReviewerRecoveryReference(request);
+            const read = await sink.getReviewerArtifact(source.runId, { sha256: source.reviewerArtifactSha256 }, options);
+            if (read.kind !== 'ok')
+                throw new Error('reviewer_recovery_source_unavailable');
+            assertReviewerRecoverySource(request, read.value.bytes);
+        }
+        finally {
+            cancellation.dispose();
+        }
+    };
+}
+//# sourceMappingURL=reviewer-preflight.js.map

package/dist/telemetry/reviewer-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reviewer-preflight.js","sourceRoot":"","sources":["../../src/telemetry/reviewer-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,gGAAgG;AAChG,MAAM,UAAU,+BAA+B,CAAC,OAAkC;IAChF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;QACxD,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;AACxH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,OAAkC,EAAE,KAAiB;IAChG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,YAAY;YAC5I,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;IACpI,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAiB,EAAE,UAA0B,EAAE;IAC7F,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAChC,OAAO,KAAK,EAAC,QAAQ,EAAC,EAAE;QACtB,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,OAAO,EAAE,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC/G,MAAM,YAAY,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAC5G,IAAI,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC3H,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAC9B,+BAA+B,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,CAAC,CAAC;YAC9G,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAChF,4BAA4B,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC"}

package/dist/telemetry/scrub.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Free text that leaves the process — reviewer errors and warnings, runner
+ * claims, finding prose, consensus excerpts — is truncated and scrubbed for
+ * anything shaped like a credential before it is sent (epic IO-12475,
+ * section 5.5 "Never sent"). Hex digests survive (a commit id is evidence);
+ * opaque mixed-class tokens do not.
+ */
+export declare const MAX_FREE_TEXT = 2000;
+export declare const REDACTED = "[redacted]";
+/**
+ * Normalize only strings rendered for people. Stored and wire values remain
+ * untouched; ZWJ/ZWNJ are intentionally retained for language and emoji text.
+ */
+export declare function sanitizePresentation(value: string, { multiline }: {
+    multiline: boolean;
+}): string;
+/** Normalize newly produced human text before report hashing, never retained originals. */
+export declare function normalizeGeneratedText(value: string): string;
+/** Escape display controls in JSON source without changing parsed semantic values. */
+export declare function escapeDisplayControls(value: string): string;
+/** Replace every credential-shaped substring with `[redacted]`. */
+export declare function scrubSecrets(text: string): string;
+/**
+ * Scrub, then cap at `max` Unicode code points with an ellipsis. Preliminary
+ * truncation keeps only through a real whitespace boundary inside the bounded
+ * UTF-16 prefix, so no split credential fragment can survive later redaction.
+ */
+export declare function scrubText(text: string, max?: number): string;
+/**
+ * Identifiers that come from configuration rather than prose — model ids,
+ * roles, providers: key-shaped substrings go, but a long mixed-case id such as
+ * `anthropic/Claude-Sonnet-4-5-20250929` is not an opaque token and stays.
+ */
+export declare function scrubIdentifier(text: string, max?: number): string;
+export declare function scrubOptional(text: string | undefined, max?: number): string | undefined;
+/**
+ * Scrub every string nested inside a JSON-like value — keys included. The
+ * structure survives: two keys that scrub to the same name stay distinct
+ * (`[redacted]`, `[redacted]#2`, …), and the keys that would reach into the
+ * object's prototype are dropped rather than assigned.
+ */
+export declare function scrubDeep<T>(value: T): T;
+/**
+ * Drop fenced code blocks — a malformed model answer can echo the prompt,
+ * and the prompt contains the diff. A run of three or more backticks or
+ * tildes opens a block wherever it stands (models often open one mid-line,
+ * "here is the JSON: ```json"). It closes, as in CommonMark, only at a line
+ * start: up to three spaces, a run of the same character at least as long,
+ * then nothing but spaces to the end of the line. A same-length run inside
+ * the block's own lines therefore never ends it early, and an unclosed
+ * block runs to the end of the text.
+ */
+export declare function stripFencedCode(text: string): string;

package/dist/telemetry/scrub.js

@@ -0,0 +1,205 @@
+/**
+ * Free text that leaves the process — reviewer errors and warnings, runner
+ * claims, finding prose, consensus excerpts — is truncated and scrubbed for
+ * anything shaped like a credential before it is sent (epic IO-12475,
+ * section 5.5 "Never sent"). Hex digests survive (a commit id is evidence);
+ * opaque mixed-class tokens do not.
+ */
+export const MAX_FREE_TEXT = 2_000;
+export const REDACTED = '[redacted]';
+const DISPLAY_MARKS = /[\u061c\u180e\u200b\u200e\u200f\u202a-\u202e\u2060\u2066-\u2069\ufeff]/g;
+const DISPLAY_LINE_SEPARATORS = /\r\n|[\r\u0085\u2028\u2029]/g;
+/**
+ * Normalize only strings rendered for people. Stored and wire values remain
+ * untouched; ZWJ/ZWNJ are intentionally retained for language and emoji text.
+ */
+export function sanitizePresentation(value, { multiline }) {
+    const lineReplacement = multiline ? '\n' : ' ';
+    return value.replace(DISPLAY_LINE_SEPARATORS, lineReplacement)
+        .replace(multiline ? /[\u0000-\u0009\u000b-\u001f\u007f-\u009f]/g : /[\u0000-\u001f\u007f-\u009f]/g, ' ')
+        .replace(DISPLAY_MARKS, '');
+}
+/** Normalize newly produced human text before report hashing, never retained originals. */
+export function normalizeGeneratedText(value) {
+    return value.replace(/[\uD800-\uDFFF]/gu, '\uFFFD')
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, '');
+}
+/** Escape display controls in JSON source without changing parsed semantic values. */
+export function escapeDisplayControls(value) {
+    return value.replace(/[\u0085\u061c\u180e\u200b\u200e\u200f\u2028-\u202e\u2060\u2066-\u2069\ufeff]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, '0')}`);
+}
+const KEY_PATTERNS = [
+    // Authorization header values.
+    /\b(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{16,}/gi,
+    // JSON Web Tokens: three base64url segments.
+    /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+    // AWS access key ids, long-lived (AKIA) and temporary STS (ASIA).
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    // OpenAI, Anthropic (sk-ant-), OpenRouter (sk-or-), project keys (sk-proj-).
+    /\bsk-[A-Za-z0-9_-]{16,}/g,
+    // GitHub tokens, classic and fine-grained.
+    /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g,
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+    // Google API keys.
+    /\bAIza[0-9A-Za-z_-]{30,}/g,
+    // Harness API tokens and CLI logins.
+    /\b(?:aone|hcli)_[A-Za-z0-9]{16,}/g,
+    // Slack.
+    /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+    // Stripe secret and restricted keys.
+    /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+    // GitLab personal access tokens, npm access tokens, Hugging Face tokens.
+    /\bglpat-[A-Za-z0-9_-]{16,}/g,
+    /\bnpm_[A-Za-z0-9]{30,}/g,
+    /\bhf_[A-Za-z0-9]{30,}/g,
+];
+/**
+ * `api_key=…`, `token: "…"` and the like: the value goes, the name stays. A
+ * quoted value is consumed through its closing quote whatever it contains
+ * (spaces, commas, a short passphrase); an unquoted one is a run of eight or
+ * more non-delimiter characters — shorter unquoted runs are left alone so
+ * that prose such as `token: string` keeps its type name.
+ */
+// The key may be a compound (`client_secret`, `GITHUB_TOKEN`, `private_key`)
+// and may itself be quoted, as in JSON.
+const SENSITIVE_KEY = String.raw `(?<![A-Za-z0-9_-])["']?[A-Za-z0-9_-]*(?:api[_-]?key|access[_-]?token|refresh[_-]?token|secret|password|passwd|token|private[_-]?key)["']?`;
+// Non-overlapping alternatives consume escaped characters once, including a
+// terminal escape. Match through the closing quote or end of input, even when
+// pre-cut removed the closing quote or the supplied value spans real newlines.
+const ASSIGNMENT_QUOTED = new RegExp(String.raw `(${SENSITIVE_KEY}\s*[:=]\s*)(["'])(?:(?!\2)[^\\]|\\(?:[\s\S]|(?![\s\S])))*(?:\2|(?![\s\S]))`, 'gi');
+const ASSIGNMENT = new RegExp(String.raw `(${SENSITIVE_KEY}\s*[:=]\s*)([^\s"',;]{8,})`, 'gi');
+/**
+ * Any long opaque token mixing upper, lower and digits — never a pure hex
+ * digest (no upper-case letters) or a plain word. Matched with a simple
+ * bounded pattern and judged procedurally, so no backtracking blow-up.
+ */
+const OPAQUE_TOKEN = /\b[A-Za-z0-9+/=_-]{32,}\b/g;
+function opaqueToken(candidate) {
+    return /[A-Z]/.test(candidate) && /[a-z]/.test(candidate) && /[0-9]/.test(candidate);
+}
+/** Replace every credential-shaped substring with `[redacted]`. */
+export function scrubSecrets(text) {
+    let out = text.replace(ASSIGNMENT_QUOTED, redactQuoted);
+    for (const pattern of KEY_PATTERNS)
+        out = out.replace(pattern, REDACTED);
+    out = out.replace(ASSIGNMENT, (_match, prefix) => `${prefix}${REDACTED}`);
+    out = out.replace(OPAQUE_TOKEN, (candidate) => (opaqueToken(candidate) ? REDACTED : candidate));
+    return out;
+}
+/** `key="value"` → `key="[redacted]"`: the quotes stay so the text still reads as an assignment. */
+function redactQuoted(match, prefix) {
+    const quote = match.charAt(prefix.length);
+    return `${prefix}${quote}${REDACTED}${quote}`;
+}
+/**
+ * Scrub, then cap at `max` Unicode code points with an ellipsis. Preliminary
+ * truncation keeps only through a real whitespace boundary inside the bounded
+ * UTF-16 prefix, so no split credential fragment can survive later redaction.
+ */
+export function scrubText(text, max = MAX_FREE_TEXT) {
+    const bounded = preCut(text, max * 4);
+    return truncateCodepoints(scrubSecrets(bounded), max, bounded !== text);
+}
+function truncateCodepoints(text, max, cut = false) {
+    const points = [];
+    let units = 0;
+    for (const point of text) {
+        if (points.length >= max)
+            break;
+        points.push(point);
+        units += point.length;
+    }
+    if (!cut && units === text.length)
+        return text;
+    return `${points.slice(0, Math.max(0, max - 1)).join('')}…`;
+}
+function preCut(text, at) {
+    if (text.length <= at)
+        return text;
+    // A half-surrogate at the boundary cannot be a whitespace boundary.
+    const prefix = text.slice(0, at);
+    const back = prefix.search(/\s\S*$/);
+    return back === -1 ? '' : prefix.slice(0, back);
+}
+/**
+ * Identifiers that come from configuration rather than prose — model ids,
+ * roles, providers: key-shaped substrings go, but a long mixed-case id such as
+ * `anthropic/Claude-Sonnet-4-5-20250929` is not an opaque token and stays.
+ */
+export function scrubIdentifier(text, max = 200) {
+    let out = text.replace(ASSIGNMENT_QUOTED, redactQuoted);
+    for (const pattern of KEY_PATTERNS)
+        out = out.replace(pattern, REDACTED);
+    out = out.replace(ASSIGNMENT, (_match, prefix) => `${prefix}${REDACTED}`);
+    return truncateCodepoints(out, max);
+}
+export function scrubOptional(text, max = MAX_FREE_TEXT) {
+    return text === undefined ? undefined : scrubText(text, max);
+}
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/**
+ * Scrub every string nested inside a JSON-like value — keys included. The
+ * structure survives: two keys that scrub to the same name stay distinct
+ * (`[redacted]`, `[redacted]#2`, …), and the keys that would reach into the
+ * object's prototype are dropped rather than assigned.
+ */
+export function scrubDeep(value) {
+    if (typeof value === 'string')
+        return scrubText(value);
+    if (Array.isArray(value))
+        return value.map((item) => scrubDeep(item));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (UNSAFE_KEYS.has(key))
+                continue;
+            const base = scrubSecrets(key);
+            let name = base;
+            for (let n = 2; Object.prototype.hasOwnProperty.call(out, name); n += 1)
+                name = `${base}#${n}`;
+            out[name] = scrubDeep(item);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Drop fenced code blocks — a malformed model answer can echo the prompt,
+ * and the prompt contains the diff. A run of three or more backticks or
+ * tildes opens a block wherever it stands (models often open one mid-line,
+ * "here is the JSON: ```json"). It closes, as in CommonMark, only at a line
+ * start: up to three spaces, a run of the same character at least as long,
+ * then nothing but spaces to the end of the line. A same-length run inside
+ * the block's own lines therefore never ends it early, and an unclosed
+ * block runs to the end of the text.
+ */
+export function stripFencedCode(text) {
+    const fence = /(`{3,}|~{3,})/g;
+    let out = '';
+    let cursor = 0;
+    let open;
+    let match;
+    while ((match = fence.exec(text)) !== null) {
+        const run = match[1];
+        if (!open) {
+            out += `${text.slice(cursor, match.index)}[code omitted]`;
+            open = { char: run[0], length: run.length };
+            cursor = match.index + run.length;
+        }
+        else if (run[0] === open.char && run.length >= open.length && closesAtLineStart(text, match.index, run.length)) {
+            open = undefined;
+            // The closing line is the fence's own; resume at its line break.
+            const lineEnd = text.indexOf('\n', match.index + run.length);
+            cursor = lineEnd === -1 ? text.length : lineEnd;
+        }
+    }
+    return open ? out : out + text.slice(cursor);
+}
+function closesAtLineStart(text, index, length) {
+    const lineStart = text.lastIndexOf('\n', index - 1) + 1;
+    if (!/^ {0,3}$/.test(text.slice(lineStart, index)))
+        return false;
+    const lineEnd = text.indexOf('\n', index + length);
+    return /^ *\r?$/.test(text.slice(index + length, lineEnd === -1 ? undefined : lineEnd));
+}
+//# sourceMappingURL=scrub.js.map