@apexops/kernel 0.10.0-next.5 → 0.11.0-next.1

package/dist/repeat-guard.js

@@ -0,0 +1,462 @@
+import { CONTRACT_VERSION, RepeatGuardRecordsV1Schema, contractMetadata, registerContractFormats, } from "@apexops/contracts";
+import { Value } from "@sinclair/typebox/value";
+import { constants } from "node:fs";
+import { lstat, mkdir, open } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { sha256Json, sha256Text } from "./canonical.js";
+import { DirectoryLock, DirectoryLockShareCloseError } from "./directory-lock.js";
+import { EventJournal } from "./event-journal.js";
+import { atomicWriteJson, withWriteFence, WriteFence } from "./files.js";
+import { repeatFilesHeld, snapshotRepeatFiles, } from "./repeat-files.js";
+import { canonicalWorktreePath } from "./run-repository.js";
+/** Run-scoped file holding the bounded set of calls that may still be answered from their original result. */
+export const REPEAT_GUARD_FILE = ".repeat-guard.json";
+/** Run-scoped, hash-chained audit journal of answered repeats. Separate from the run journal, whose head it keeps. */
+export const REPEAT_JOURNAL_DIRECTORY = "repeats";
+export const REPEAT_EVENT_TYPE = "call.repeated";
+/**
+ * Workspace-scoped directory lock serializing guarded calls across processes from record lookup through record
+ * publication. It does not depend on the selected run, so calls that change the selection are serialized too.
+ */
+export const REPEAT_LOCK_FILE = ".repeat-guard.lock";
+export const DEFAULT_REPEAT_LOCK_WAIT_MS = 30_000;
+const REPEAT_LOCK_TTL_MS = 30_000;
+// Poll interval of a read waiting for the workspace lock or for a share window to open.
+const READ_LOCK_RETRY_MS = 20;
+export const DEFAULT_REPEAT_WINDOW_MS = 10 * 60 * 1000;
+export const MAX_REPEAT_RECORDS = 16;
+export const MAX_REPEAT_RESULT_BYTES = 64 * 1024;
+const MAX_REPEAT_GUARD_FILE_BYTES = contractMetadata[RepeatGuardRecordsV1Schema.$id].maxBytes;
+const OPERATION = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/u;
+const AUDIT_APPEND_ATTEMPTS = 3;
+/** Another guarded call in the workspace is still running; the caller should refresh state and retry later. */
+/** The caller cancelled the call before it started; nothing was looked up, executed or recorded. */
+export class RepeatGuardCancelledError extends Error {
+    constructor() {
+        super("The state-changing call was cancelled before it started");
+        this.name = "RepeatGuardCancelledError";
+    }
+}
+export class RepeatGuardBusyError extends Error {
+    constructor() {
+        super("Another state-changing call in this workspace is still in progress");
+        this.name = "RepeatGuardBusyError";
+    }
+}
+/**
+ * The workspace changed while its lock holder waited without the lock, so a decision taken during the wait would apply
+ * to state it was not taken against. Nothing after the wait ran; the caller should refresh state and run again.
+ */
+export class RepeatGuardStaleError extends Error {
+    constructor() {
+        super("Workspace state changed while the command waited without the workspace lock");
+        this.name = "RepeatGuardStaleError";
+    }
+}
+/**
+ * A snapshot read reached a step that needs the workspace lock, such as finishing a pending recovery. Nothing was
+ * written; {@link withRepeatGuardReadLock} discards the attempt and waits for the lock instead.
+ */
+export class RepeatGuardSnapshotUnavailableError extends Error {
+    constructor() {
+        super("The read needs the workspace lock");
+        this.name = "RepeatGuardSnapshotUnavailableError";
+    }
+}
+/**
+ * A holder's share window could not be closed, so snapshot readers might still trust it. Every later atomic write and
+ * share in the holder's operation fails with this error, and so does the operation itself, even if it handled the
+ * error; releasing the lock then closes the window. The caller should run the operation again.
+ */
+export class RepeatGuardShareCloseError extends Error {
+    constructor(cause) {
+        super("The workspace lock could not be closed to readers; nothing more was written", { cause });
+        this.name = "RepeatGuardShareCloseError";
+    }
+}
+function normalizedArguments(value) {
+    if (value === undefined)
+        return null;
+    const serialized = JSON.stringify(value);
+    if (serialized === undefined)
+        throw new TypeError("Repeat call arguments must be JSON");
+    return JSON.parse(serialized);
+}
+/** Identifies a call independent of state: operation, canonical worktree and canonical arguments. */
+export function repeatCallHash(call) {
+    if (!OPERATION.test(call.operation))
+        throw new TypeError("Repeat call operation is invalid");
+    return sha256Json({
+        version: 1,
+        operation: call.operation,
+        workspace: canonicalWorktreePath(call.workspace),
+        arguments: normalizedArguments(call.arguments),
+    });
+}
+/** Fingerprint of a call against the run state it applies to. */
+export function repeatFingerprint(callHash, state) {
+    return sha256Json({ version: 1, callHash, state });
+}
+/**
+ * State token for the repeat window. It changes whenever the selection, the project set, the selected run document,
+ * its journal head, its writer lease holder or the content of its mutable files changes; lease expiry renewals do not
+ * change it.
+ */
+export function repeatStateToken(input) {
+    return sha256Json({
+        version: 2,
+        selection: { projectId: input.selection.projectId, runId: input.selection.runId },
+        projects: [...input.projects].sort(),
+        runHash: input.runHash,
+        journalHead: input.journalHead,
+        writer: input.writer,
+        files: input.files ?? null,
+    });
+}
+function validRecords(value) {
+    registerContractFormats();
+    return (Value.Check(RepeatGuardRecordsV1Schema, value) &&
+        value.records.length <= MAX_REPEAT_RECORDS &&
+        value.records.every((record) => Number.isFinite(Date.parse(record.recordedAt)) &&
+            Number.isFinite(Date.parse(record.expiresAt)) &&
+            Buffer.byteLength(record.result) <= MAX_REPEAT_RESULT_BYTES));
+}
+/**
+ * Reads the run's repeat records. An absent, unsafe or malformed file yields no records: losing a record only makes a
+ * repeat a new request that normal kernel checks decide, so corruption cannot replay a forged result.
+ */
+export async function readRepeatRecords(runDirectory) {
+    const path = join(runDirectory, REPEAT_GUARD_FILE);
+    try {
+        const before = await lstat(path);
+        if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_REPEAT_GUARD_FILE_BYTES)
+            return [];
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let bytes;
+        try {
+            bytes = await handle.readFile();
+        }
+        finally {
+            await handle.close();
+        }
+        if (bytes.byteLength > MAX_REPEAT_GUARD_FILE_BYTES)
+            return [];
+        const parsed = JSON.parse(bytes.toString("utf8"));
+        return validRecords(parsed) ? parsed.records : [];
+    }
+    catch {
+        return [];
+    }
+}
+export async function readRepeatEvents(runDirectory) {
+    return new EventJournal(join(runDirectory, REPEAT_JOURNAL_DIRECTORY)).replay();
+}
+function replayable(record) {
+    try {
+        const value = JSON.parse(record.result);
+        return value !== null && typeof value === "object" && !Array.isArray(value)
+            ? value
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function appendRepeatEvent(scope, record, call, fingerprint, now, idSource) {
+    const journal = new EventJournal(join(scope.runDirectory, REPEAT_JOURNAL_DIRECTORY));
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            await journal.append({
+                eventId: idSource(),
+                projectId: scope.projectId,
+                runId: scope.runId,
+                type: REPEAT_EVENT_TYPE,
+                timestamp: now.toISOString(),
+                ownerEpoch: scope.ownerEpoch,
+                expectedHead: await journal.head(),
+                payload: {
+                    operation: record.operation,
+                    // Record the worktree as the caller sees it; the case-folded comparison key belongs only in callHash.
+                    workspace: resolve(call.workspace),
+                    callHash: record.callHash,
+                    fingerprint,
+                    originalFingerprint: record.fingerprint,
+                    state: scope.state,
+                    originalRecordedAt: record.recordedAt,
+                    resultHash: sha256Text(record.result),
+                },
+            });
+            return;
+        }
+        catch (error) {
+            if (attempt >= AUDIT_APPEND_ATTEMPTS || !error.message.startsWith("Stale journal head"))
+                throw error;
+        }
+    }
+}
+async function storeRepeatRecord(scope, candidate, callHash, now, maxRecords) {
+    // A record is answerable only while the run state equals its post-call state, so any record whose state differs
+    // from the current state, or that expired, is dropped. The newest bounded set of same-state calls remains.
+    const live = (await readRepeatRecords(scope.runDirectory)).filter((record) => record.stateAfter === scope.state && Date.parse(record.expiresAt) > now.getTime() && record.callHash !== callHash);
+    const records = [...live, ...(candidate === undefined ? [] : [candidate])].slice(-maxRecords);
+    const file = { schemaVersion: CONTRACT_VERSION, records };
+    if (!validRecords(file))
+        throw new Error("Repeat records do not satisfy repeat-guard-records-v1");
+    await atomicWriteJson(join(scope.runDirectory, REPEAT_GUARD_FILE), file);
+}
+/**
+ * Executes a state-changing call at most once per run state. An identical call (same operation, worktree and
+ * arguments) made while the selected run is unchanged since the original succeeded, and within the window, returns the
+ * original serialized result and appends a `call.repeated` audit event instead of executing again. Any intervening
+ * state change, an expired window, a failed original call or a missing record makes the call a new request. A result
+ * is stored only if the files the scope binds kept their content from the start of the call, changed only by the
+ * call's own writes, so a later repeat is never answered from a result computed on other content. Guarded
+ * calls in one workspace are serialized across processes from record lookup through record publication, including
+ * calls that create or change the selected run.
+ */
+export async function executeRepeatSafe(call, hooks, options = {}) {
+    const clock = options.clock ?? (() => new Date());
+    const idSource = options.idSource ?? (() => crypto.randomUUID());
+    const windowMs = options.windowMs ?? DEFAULT_REPEAT_WINDOW_MS;
+    const maxRecords = options.maxRecords ?? MAX_REPEAT_RECORDS;
+    if (!Number.isSafeInteger(windowMs) || windowMs < 1)
+        throw new RangeError("Repeat window must be positive");
+    if (!Number.isSafeInteger(maxRecords) || maxRecords < 1 || maxRecords > MAX_REPEAT_RECORDS)
+        throw new RangeError(`Repeat records must be an integer from 1 to ${MAX_REPEAT_RECORDS}`);
+    const lockWaitMs = options.lockWaitMs ?? DEFAULT_REPEAT_LOCK_WAIT_MS;
+    const callHash = repeatCallHash(call);
+    return withRepeatGuardLock(hooks.lockDirectory, () => guardedCall(call, callHash, hooks, clock, idSource, windowMs, maxRecords), { lockWaitMs, ...(options.signal === undefined ? {} : { signal: options.signal }) });
+}
+/**
+ * Runs `operation` while holding the workspace repeat lock in `lockDirectory`. Guarded calls take it, and so must every
+ * other writer of the same workspace (such as state-changing CLI commands), so that no write lands between a guarded
+ * call's state reads, execution and record publication. While the parent of `lockDirectory` does not exist there is no
+ * workspace state yet, and `operation` runs unserialized. The lock is not reentrant. `operation` may give the lock up
+ * while it waits, for example for interactive input, through {@link WorkspaceLockHold.suspend}; guarded calls never do.
+ */
+export async function withRepeatGuardLock(lockDirectory, operation, options = {}) {
+    const lockWaitMs = options.lockWaitMs ?? DEFAULT_REPEAT_LOCK_WAIT_MS;
+    if (!Number.isSafeInteger(lockWaitMs) || lockWaitMs < 0)
+        throw new RangeError("Repeat lock wait must not be negative");
+    const { signal } = options;
+    const cancelled = () => signal?.aborted === true;
+    if (cancelled())
+        throw new RepeatGuardCancelledError();
+    let held = await acquireRepeatGuardLock(lockDirectory, lockWaitMs, signal);
+    let suspended = false;
+    const fence = new WriteFence();
+    const hold = {
+        suspend: async (wait, state) => {
+            if (suspended)
+                throw new Error("The workspace lock is already suspended");
+            suspended = true;
+            try {
+                // Without a readable state token there is no way to prove the state unchanged afterwards, so keep the lock.
+                const before = await state().then((token) => ({ token }), () => undefined);
+                if (before === undefined)
+                    return await wait();
+                const releasing = held;
+                held = undefined;
+                await releasing?.release();
+                const value = await wait();
+                held = await acquireRepeatGuardLock(lockDirectory, lockWaitMs, signal);
+                if (cancelled())
+                    throw new RepeatGuardCancelledError();
+                if ((await state().catch(() => undefined)) !== before.token)
+                    throw new RepeatGuardStaleError();
+                return value;
+            }
+            finally {
+                suspended = false;
+            }
+        },
+        share: async (operation) => {
+            if (fence.error !== undefined)
+                throw fence.error;
+            const sharing = held;
+            if (sharing === undefined)
+                return operation();
+            try {
+                // No write of this operation lands while the window is open, even from a flow other than `operation`.
+                return await fence.quiet(() => sharing.share(operation));
+            }
+            catch (error) {
+                if (!(error instanceof DirectoryLockShareCloseError))
+                    throw error;
+                // A reader may still trust the open window, so nothing in this operation may write again before release.
+                fence.error ??= new RepeatGuardShareCloseError(error);
+                throw fence.error;
+            }
+        },
+    };
+    try {
+        // Cancellation while waiting for the lock is reported by the lock; once it is held, nothing has started yet.
+        if (cancelled())
+            throw new RepeatGuardCancelledError();
+        const value = await withWriteFence(fence, () => operation(hold));
+        if (fence.error !== undefined)
+            throw fence.error;
+        return value;
+    }
+    catch (error) {
+        // An operation that handled the share failure, or failed on a fenced write, still fails with it.
+        throw fence.error ?? error;
+    }
+    finally {
+        await held?.release();
+    }
+}
+/**
+ * Runs a read that may need the workspace lock, for example to finish a pending recovery. It takes the lock like
+ * {@link withRepeatGuardLock} when the lock is free. While another process holds the lock but shares it through
+ * {@link WorkspaceLockHold.share}, `operation` runs in `snapshot` mode without the lock instead, and its outcome counts
+ * only if the holder kept the same share window open throughout, so the holder wrote nothing meanwhile. In `snapshot`
+ * mode `operation` must not write workspace state; it throws {@link RepeatGuardSnapshotUnavailableError} instead, and
+ * the read waits for the lock. Fails with {@link RepeatGuardBusyError} after `lockWaitMs` without either.
+ */
+export async function withRepeatGuardReadLock(lockDirectory, operation, options = {}) {
+    const lockWaitMs = options.lockWaitMs ?? DEFAULT_REPEAT_LOCK_WAIT_MS;
+    if (!Number.isSafeInteger(lockWaitMs) || lockWaitMs < 0)
+        throw new RangeError("Repeat lock wait must not be negative");
+    const { signal } = options;
+    const cancelled = () => signal?.aborted === true;
+    const deadline = Date.now() + lockWaitMs;
+    // Only a lock holder can finish a pending recovery, so once a snapshot needed one the read just waits for the lock.
+    let snapshots = true;
+    for (;;) {
+        if (cancelled())
+            throw new RepeatGuardCancelledError();
+        let held;
+        try {
+            held = await acquireRepeatGuardLock(lockDirectory, 0, signal);
+        }
+        catch (error) {
+            if (!(error instanceof RepeatGuardBusyError))
+                throw error;
+            const snapshot = !snapshots
+                ? undefined
+                : await repeatGuardLock(lockDirectory)
+                    .readShared(() => operation("snapshot"))
+                    .catch((readError) => {
+                    if (!(readError instanceof RepeatGuardSnapshotUnavailableError))
+                        throw readError;
+                    snapshots = false;
+                    return undefined;
+                });
+            if (snapshot !== undefined)
+                return snapshot.value;
+            if (Date.now() >= deadline)
+                throw error;
+            await new Promise((done) => setTimeout(done, READ_LOCK_RETRY_MS));
+            continue;
+        }
+        try {
+            if (cancelled())
+                throw new RepeatGuardCancelledError();
+            return await operation("locked");
+        }
+        finally {
+            await held?.release();
+        }
+    }
+}
+function repeatGuardLock(lockDirectory) {
+    return new DirectoryLock(join(lockDirectory, REPEAT_LOCK_FILE), {
+        label: "Repeat guard lock",
+        clock: () => new Date(),
+        idSource: () => crypto.randomUUID(),
+        ttlMs: REPEAT_LOCK_TTL_MS,
+        platform: process.platform,
+        busyError: () => new RepeatGuardBusyError(),
+    });
+}
+/** Acquires the workspace repeat lock, or returns undefined while the workspace has no state to serialize yet. */
+async function acquireRepeatGuardLock(lockDirectory, lockWaitMs, signal) {
+    const cancelled = () => (signal?.aborted === true ? new RepeatGuardCancelledError() : undefined);
+    try {
+        await lstat(dirname(lockDirectory));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    await mkdir(lockDirectory, { recursive: true });
+    const directory = await lstat(lockDirectory);
+    if (!directory.isDirectory() || directory.isSymbolicLink())
+        throw new Error("Repeat guard lock directory is not a regular directory");
+    return repeatGuardLock(lockDirectory).acquire({ waitMs: lockWaitMs, onContention: async () => cancelled() });
+}
+async function guardedCall(call, callHash, hooks, clock, idSource, windowMs, maxRecords) {
+    // A start state that could not be read cannot bind a result, so such a call is never stored.
+    let startRead = true;
+    const before = await hooks.scope().catch(() => {
+        startRead = false;
+        return undefined;
+    });
+    const fingerprint = repeatFingerprint(callHash, before?.state ?? null);
+    if (before !== undefined) {
+        const now = clock();
+        const records = await readRepeatRecords(before.runDirectory);
+        const record = records.findLast((candidate) => candidate.callHash === callHash &&
+            candidate.stateAfter === before.state &&
+            Date.parse(candidate.expiresAt) > now.getTime());
+        const original = record === undefined ? undefined : replayable(record);
+        // A bound file that changed since the call identity was taken makes the stored result stale; execute instead.
+        // The state is read again so that an edit that bypasses the workspace lock while the record was checked cannot be
+        // answered from the stored result; the replay is then current as of that second read.
+        if (record !== undefined &&
+            original !== undefined &&
+            (hooks.identityStable === undefined || (await hooks.identityStable())) &&
+            (await hooks.scope().catch(() => undefined))?.state === before.state) {
+            await hooks.assertReplayAllowed(before);
+            await appendRepeatEvent(before, record, call, fingerprint, now, idSource);
+            return { value: original, repeated: true, fingerprint };
+        }
+    }
+    const value = await hooks.execute();
+    try {
+        if (!startRead)
+            return { value, repeated: false, fingerprint };
+        if (hooks.identityStable !== undefined && !(await hooks.identityStable()))
+            return { value, repeated: false, fingerprint };
+        const after = await hooks.scope();
+        if (after === undefined)
+            return { value, repeated: false, fingerprint };
+        // A bound file changed by anything but the operation itself while it ran, for example by an editor that bypasses
+        // the workspace lock, would bind this result to content the operation may not have seen.
+        if (before?.files !== undefined) {
+            const start = before.files;
+            const end = after.files !== undefined && start.roots.every((root) => after.files.roots.includes(root))
+                ? after.files
+                : await snapshotRepeatFiles(start.roots);
+            if (!repeatFilesHeld(start, end, hooks.writes))
+                return { value, repeated: false, fingerprint };
+        }
+        const now = clock();
+        const result = JSON.stringify(value);
+        const limit = hooks.validUntil?.(value);
+        const expiresAt = Math.min(now.getTime() + windowMs, limit === undefined || !Number.isFinite(Date.parse(limit)) ? Number.POSITIVE_INFINITY : Date.parse(limit));
+        const storable = typeof result === "string" &&
+            Buffer.byteLength(result) <= MAX_REPEAT_RESULT_BYTES &&
+            replayable({ result }) !== undefined &&
+            expiresAt > now.getTime();
+        await storeRepeatRecord(after, storable
+            ? {
+                fingerprint,
+                callHash,
+                operation: call.operation,
+                stateBefore: before?.state ?? null,
+                stateAfter: after.state,
+                recordedAt: now.toISOString(),
+                expiresAt: new Date(expiresAt).toISOString(),
+                result,
+            }
+            : undefined, callHash, now, maxRecords);
+    }
+    catch {
+        // The call has committed. Without a stored record a repeat is a new request decided by normal kernel checks.
+    }
+    return { value, repeated: false, fingerprint };
+}
+//# sourceMappingURL=repeat-guard.js.map

package/dist/repeat-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeat-guard.js","sourceRoot":"","sources":["../src/repeat-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,EAChB,uBAAuB,GAMxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,4BAA4B,EAA0B,MAAM,qBAAqB,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EACL,eAAe,EACf,mBAAmB,GAGpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD,sHAAsH;AACtH,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,wFAAwF;AACxF,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,MAAM,2BAA2B,GAAG,gBAAgB,CAAC,0BAA0B,CAAC,GAAI,CAAE,CAAC,QAAQ,CAAC;AAChG,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,qBAAqB,GAAG,CAAC,CAAC;AA4EhC,+GAA+G;AAC/G,oGAAoG;AACpG,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD;QACE,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C;QACE,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,mCAAoC,SAAQ,KAAK;IAC5D;QACE,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,KAAc;QACxB,KAAK,CAAC,6EAA6E,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAkCD,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;AAC3C,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC7C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC7F,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;QAChD,SAAS,EAAE,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC;KAC/C,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,KAAoB;IACtE,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,OAAO,UAAU,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE;QACjF,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,uBAAuB,EAAE,CAAC;IAC1B,OAAO,CACL,KAAK,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC;QAC9C,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,kBAAkB;QAC1C,KAAK,CAAC,OAAO,CAAC,KAAK,CACjB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAC9D,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,IAAI,GAAG,2BAA2B;YAAE,OAAO,EAAE,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,GAAG,2BAA2B;YAAE,OAAO,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC7D,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,YAAoB;IACzD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,UAAU,CAAC,MAAoB;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAY,CAAC;QACnD,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzE,CAAC,CAAE,KAAiC;YACpC,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAkB,EAClB,MAAoB,EACpB,IAAgB,EAChB,WAAmB,EACnB,GAAS,EACT,QAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACrF,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,QAAQ,EAAE;gBACnB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE;gBAClC,OAAO,EAAE;oBACP,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,sGAAsG;oBACtG,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;oBAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,WAAW;oBACX,mBAAmB,EAAE,MAAM,CAAC,WAAW;oBACvC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,kBAAkB,EAAE,MAAM,CAAC,UAAU;oBACrC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC;iBACtC;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,IAAI,qBAAqB,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;gBAAE,MAAM,KAAK,CAAC;QAClH,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAkB,EAClB,SAAmC,EACnC,QAAgB,EAChB,GAAS,EACT,UAAkB;IAElB,gHAAgH;IAChH,2GAA2G;IAC3G,MAAM,IAAI,GAAG,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAC/D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CACpH,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAyB,EAAE,aAAa,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAChF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAClG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAgB,EAChB,KAAyB,EACzB,OAAO,GAAsB,EAAE;IAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,gCAAgC,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,kBAAkB;QACxF,MAAM,IAAI,UAAU,CAAC,+CAA+C,kBAAkB,EAAE,CAAC,CAAC;IAC5F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC;IACrE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,mBAAmB,CACxB,KAAK,CAAC,aAAa,EACnB,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC/E,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CACpF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,SAAkD,EAClD,OAAO,GAAkD,EAAE;IAE3D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,IAAI,SAAS,EAAE;QAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;IACvD,IAAI,IAAI,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAsB;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YAC7B,IAAI,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC1E,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,CAAC;gBACH,4GAA4G;gBAC5G,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,IAAI,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EACtB,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;gBACF,IAAI,MAAM,KAAK,SAAS;oBAAE,OAAO,MAAM,IAAI,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,IAAI,CAAC;gBACvB,IAAI,GAAG,SAAS,CAAC;gBACjB,MAAM,SAAS,EAAE,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;gBAC3B,IAAI,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACvE,IAAI,SAAS,EAAE;oBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK;oBAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;gBAC/F,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACzB,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,KAAK,CAAC,KAAK,CAAC;YACjD,MAAM,OAAO,GAAG,IAAI,CAAC;YACrB,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,sGAAsG;gBACtG,OAAO,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,4BAA4B,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAClE,yGAAyG;gBACzG,KAAK,CAAC,KAAK,KAAK,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC;gBACtD,MAAM,KAAK,CAAC,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;KACF,CAAC;IACF,IAAI,CAAC;QACH,6GAA6G;QAC7G,IAAI,SAAS,EAAE;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,KAAK,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iGAAiG;QACjG,MAAM,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;IAC7B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,EAAE,OAAO,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,aAAqB,EACrB,SAAoD,EACpD,OAAO,GAAkD,EAAE;IAE3D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,2BAA2B,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,uCAAuC,CAAC,CAAC;IAChE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;IACzC,oHAAoH;IACpH,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC;QACR,IAAI,SAAS,EAAE;YAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACvD,IAAI,IAAmC,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,oBAAoB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC1D,MAAM,QAAQ,GAAG,CAAC,SAAS;gBACzB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,eAAe,CAAC,aAAa,CAAC;qBACjC,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;qBACvC,KAAK,CAAC,CAAC,SAAkB,EAAE,EAAE;oBAC5B,IAAI,CAAC,CAAC,SAAS,YAAY,mCAAmC,CAAC;wBAAE,MAAM,SAAS,CAAC;oBACjF,SAAS,GAAG,KAAK,CAAC;oBAClB,OAAO,SAAS,CAAC;gBACnB,CAAC,CAAC,CAAC;YACT,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACxC,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,IAAI,SAAS,EAAE;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAC;YACvD,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,EAAE,OAAO,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,aAAqB;IAC5C,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;QAC9D,KAAK,EAAE,mBAAmB;QAC1B,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;QACnC,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,oBAAoB,EAAE;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,kHAAkH;AAClH,KAAK,UAAU,sBAAsB,CACnC,aAAqB,EACrB,UAAkB,EAClB,MAA+B;IAE/B,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,yBAAyB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE;QACxD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,OAAO,eAAe,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/G,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAgB,EAChB,QAAgB,EAChB,KAAyB,EACzB,KAAiB,EACjB,QAAsB,EACtB,QAAgB,EAChB,UAAkB;IAElB,6FAA6F;IAC7F,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QAC5C,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAC7B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAC/B,SAAS,CAAC,UAAU,KAAK,MAAM,CAAC,KAAK;YACrC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAClD,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACvE,8GAA8G;QAC9G,kHAAkH;QAClH,sFAAsF;QACtF,IACE,MAAM,KAAK,SAAS;YACpB,QAAQ,KAAK,SAAS;YACtB,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACtE,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,KAAK,MAAM,CAAC,KAAK,EACpE,CAAC;YACD,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YAC1E,OAAO,EAAE,KAAK,EAAE,QAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC/D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;YACvE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACxE,iHAAiH;QACjH,yFAAyF;QACzF,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,GAAG,GACP,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzF,CAAC,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACjG,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,GAAG,CAAC,OAAO,EAAE,GAAG,QAAQ,EACxB,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAC1G,CAAC;QACF,MAAM,QAAQ,GACZ,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,uBAAuB;YACpD,UAAU,CAAC,EAAE,MAAM,EAAkB,CAAC,KAAK,SAAS;YACpD,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,iBAAiB,CACrB,KAAK,EACL,QAAQ;YACN,CAAC,CAAC;gBACE,WAAW;gBACX,QAAQ;gBACR,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;gBAClC,UAAU,EAAE,KAAK,CAAC,KAAK;gBACvB,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE;gBAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC5C,MAAM;aACP;YACH,CAAC,CAAC,SAAS,EACb,QAAQ,EACR,GAAG,EACH,UAAU,CACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,6GAA6G;IAC/G,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AACjD,CAAC"}

package/dist/review-capture.d.ts

@@ -0,0 +1,170 @@
+import { type ReviewCaptureV1 } from "@apexops/contracts";
+/**
+ * Captured rubber-duck reviews (DECISION-031). The kernel issues a review request with a single-use nonce and a prompt;
+ * the APEX agent passes the prompt unchanged to the built-in `rubber-duck` agent; the managed `postToolUse` hook saves
+ * the prompt and rubber-duck's exact output in a signed capture record outside the workspace. The kernel verifies the
+ * record, binds it to the issued prompt and the reviewed artifact, and derives findings only from the captured output.
+ *
+ * The hook (plugin/hooks/apex-hook.mjs) is dependency-free, so it repeats the record format, canonical JSON, HMAC and
+ * location rules below; tools/tests/vnext/plugin-hooks.test.mjs keeps both sides aligned.
+ */
+export declare const REVIEW_CAPTURE_SCHEMA: "apex-review-capture-v1";
+export declare const REVIEW_REQUEST_HEADER = "APEX-REVIEW";
+export declare const REVIEW_ANSWER_FENCE = "apex-review";
+export declare const REVIEW_AGENT = "rubber-duck";
+export declare const REVIEW_MAX_ATTEMPTS = 2;
+export declare const REVIEW_HOME_ENV = "APEX_REVIEW_HOME";
+export declare const REVIEW_MAX_FINDINGS = 50;
+/**
+ * Budget for all finding titles and details together, measured as doubly JSON-escaped UTF-8 because an MCP result
+ * carries its JSON once as structured content and once as escaped text. nextTask returns every open finding in one
+ * result capped at 64 KiB, so the findings must fit there with their IDs and actions.
+ */
+export declare const REVIEW_MAX_FINDINGS_BYTES = 20480;
+declare const SEVERITIES: readonly ["critical", "high", "medium", "low", "info"];
+declare const PILLARS: readonly ["security", "reliability", "performance-efficiency", "cost-optimization", "operational-excellence"];
+declare const OUTCOMES: readonly ["pass", "finding", "not-applicable"];
+export type ReviewCaptureFailure = "missing" | "ambiguous" | "malformed" | "signature" | "not-rubber-duck" | "nonce-mismatch" | "prompt-mismatch" | "unparseable" | "inputs-changed";
+/** A capture problem. Every reason fails the review closed; only `missing` leaves the request reusable. */
+export declare class ReviewCaptureError extends Error {
+    readonly reason: ReviewCaptureFailure;
+    constructor(reason: ReviewCaptureFailure, message: string);
+}
+/**
+ * The review home (or a folder in it) is not private to this OS user: another user could replace the capture key or
+ * inject captures, so nothing in it can be trusted until its owner and mode are fixed.
+ */
+export declare class ReviewHomeError extends Error {
+    constructor(message: string);
+}
+export type ReviewSeverity = (typeof SEVERITIES)[number];
+export type ReviewPillar = (typeof PILLARS)[number];
+export type ReviewCaptureRecordV1 = ReviewCaptureV1;
+export interface ReviewAnswer {
+    findings: Array<{
+        id: string;
+        severity: ReviewSeverity;
+        title: string;
+        detail: string;
+    }>;
+    criteria?: Array<{
+        criterionId: ReviewPillar;
+        outcome: (typeof OUTCOMES)[number];
+        rationale: string;
+        findingIds: string[];
+    }>;
+}
+export interface ReviewPromptFile {
+    label: "instructions" | "subject" | "input";
+    kind: string;
+    path: string;
+    sha256: string;
+}
+export interface ReviewPromptRequest {
+    nonce: string;
+    gate: number;
+    subjectKind: string;
+    files: readonly ReviewPromptFile[];
+    wellArchitected: boolean;
+}
+/** A fresh nonce, or one derived from a unique seed (the service's ID source) so deterministic runs stay reproducible. */
+export declare function createReviewNonce(seed?: string): string;
+/** Line endings and trailing whitespace do not change a prompt's identity; every other byte does. */
+export declare function normalizeReviewPrompt(prompt: string): string;
+export declare function reviewPromptSha256(prompt: string): string;
+/** The nonce from the first non-empty prompt line `APEX-REVIEW: nonce=<32 hex>`, or undefined. */
+export declare function reviewNonceFromPrompt(prompt: string): string | undefined;
+export declare function buildReviewPrompt(request: ReviewPromptRequest): string;
+/** Reviewer guidance per subject, carried over from the retired APEX Reviewer. */
+export declare function buildReviewInstructions(subjectKind: string): string;
+/**
+ * Derives findings from rubber-duck's captured output: exactly one ```apex-review fenced JSON block, checked strictly.
+ * Text outside the block is ignored. Findings without an id get F-1, F-2, ... in answer order.
+ */
+export declare function parseReviewAnswer(response: string, options: {
+    wellArchitected: boolean;
+}): ReviewAnswer;
+/** Folder shared by the hook and the kernel: `$APEX_REVIEW_HOME`, else `~/.apex/reviews`. Outside every workspace. */
+export declare function reviewHome(env?: NodeJS.ProcessEnv): string;
+/** Captures older than this belong to requests that expired (tasks live 24 hours) and can never be ingested. */
+export declare const REVIEW_CAPTURE_RETENTION_MS: number;
+/**
+ * Removes captures whose request can no longer be ingested, so abandoned reviews do not keep model output in the
+ * shared review home forever: captures older than the retention, and captures whose nonce the caller knows was used
+ * (completed, rejected or cancelled) but whose removal failed earlier. Captures for live requests stay. Returns the
+ * count removed.
+ */
+export declare function sweepReviewCaptures(home?: string, now?: number, maxAgeMs?: number, consumedNonces?: ReadonlySet<string>): Promise<number>;
+/** The per-user HMAC key (32 random bytes, hex) shared with the hook; created with 0600 permissions when absent. */
+export declare function reviewCaptureKey(home?: string): Promise<Buffer>;
+type UnsignedCapture = Omit<ReviewCaptureRecordV1, "signature">;
+export declare function reviewCaptureSignature(record: UnsignedCapture, key: Buffer): string;
+/** Builds a signed record exactly as the hook does. Used by tests and the hook parity check. */
+export declare function signReviewCapture(input: {
+    prompt: string;
+    response: string;
+    sessionId?: string | null;
+    toolName?: string;
+    agentType?: string;
+    capturedAt: string;
+}, key: Buffer): ReviewCaptureRecordV1;
+export declare function reviewCaptureFileName(record: Pick<ReviewCaptureRecordV1, "nonce" | "responseSha256">): string;
+/** Checks one record's shape, signature, hashes and rubber-duck origin. Does not check the issued request. */
+export declare function verifyReviewCapture(value: unknown, key: Buffer): ReviewCaptureRecordV1;
+export interface ReviewCaptureFile {
+    path: string;
+    /** Parsed JSON, or undefined when the file is unreadable or not JSON. */
+    value: unknown;
+    /** The bounded raw file bytes, kept so even a malformed capture can be archived as evidence. */
+    bytes?: Buffer;
+}
+export declare const REJECTED_REVIEW_CAPTURE_SCHEMA = "apex.rejected-review-capture.v1";
+/**
+ * A rejected capture file as JSON audit evidence: the exact UTF-8 text with the hash and size of the original bytes.
+ * Run objects must stay JSON so state transfer can carry them and check them for secrets.
+ */
+export interface RejectedReviewCaptureV1 {
+    schema: typeof REJECTED_REVIEW_CAPTURE_SCHEMA;
+    sha256: string;
+    bytes: number;
+    content: string;
+}
+/** Wraps capture bytes for the object store, or returns undefined when they are not valid UTF-8 (quarantine those). */
+export declare function rejectedReviewCapture(bytes: Buffer): RejectedReviewCaptureV1 | undefined;
+/**
+ * Moves captures that could not be archived (oversized, unreadable, not UTF-8 or not regular files) into `quarantine/` in the
+ * review home, so the only copy of rejected evidence is kept for inspection rather than deleted.
+ */
+export declare function quarantineReviewCaptures(files: readonly ReviewCaptureFile[], home?: string): Promise<{
+    quarantined: Array<{
+        name: string;
+        path: string;
+    }>;
+    failed: string[];
+}>;
+/** Reads every capture file for a nonce. Unreadable or non-JSON files are returned as malformed values. */
+export declare function loadReviewCaptures(nonce: string, home?: string): Promise<ReviewCaptureFile[]>;
+/**
+ * Removes ingested, rejected or cancelled captures, retrying transient errors (a scanner or indexer holding the file on
+ * Windows). Returns the paths that still could not be removed; `sweepReviewCaptures` removes them on a later call.
+ */
+export declare function removeReviewCaptures(files: readonly ReviewCaptureFile[]): Promise<string[]>;
+/**
+ * Rehashes the files a review prompt lists. Rubber-duck reads these files, so a missing, replaced or edited file means
+ * its answer may not be about the issued request; that fails closed.
+ */
+export declare function verifyReviewFiles(files: readonly Pick<ReviewPromptFile, "path" | "sha256">[]): Promise<void>;
+export interface IssuedReviewRequest {
+    nonce: string;
+    promptSha256: string;
+}
+/** Missing and ambiguous checks, which need no key, so an unwritable review home still reports a missing capture. */
+export declare function assertSingleReviewCapture(files: readonly ReviewCaptureFile[]): void;
+/**
+ * Selects and verifies the capture for an issued request. Exactly one capture may exist for the nonce, and its prompt
+ * must be the issued prompt (line endings and trailing whitespace aside). Two captures mean rubber-duck ran twice for
+ * one request, so the agent could pick a favourable answer; that fails closed.
+ */
+export declare function verifyIssuedReviewCapture(request: IssuedReviewRequest, files: readonly ReviewCaptureFile[], key: Buffer): ReviewCaptureRecordV1;
+export {};
+//# sourceMappingURL=review-capture.d.ts.map