@ashlr/hub 2.2.0 → 3.0.0

package/dist/core/fleet/status.d.ts

@@ -0,0 +1,54 @@
+/**
+ * M49: fleet control plane + observability — read-only aggregation.
+ *
+ * `buildFleetStatus(cfg)` is a single READ-ONLY snapshot of the whole fleet:
+ * the daemon's liveness + today's spend, per-backend recent dispatch counts and
+ * quota status, the backlog queue size, the inbox proposal counts (pending /
+ * frontier-pending / applied), recent auto-merges, and whether the global kill
+ * switch is engaged.
+ *
+ * SAFETY: this NEVER mutates anything and NEVER throws. Every underlying source
+ * is wrapped in its own try/catch with a sane fallback, so a single broken
+ * source (corrupt daemon state, absent backlog, etc.) degrades only its own
+ * slice — the rest of the snapshot still resolves. It adds NO capability: it
+ * only reads what the daemon/quota/inbox/backlog modules already persist.
+ */
+import type { AshlrConfig, EngineId } from '../types.js';
+/** A single backend's recent activity + quota standing. */
+export interface FleetBackendStatus {
+    /** The backend id (e.g. 'builtin', 'claude', 'codex'). */
+    backend: EngineId;
+    /** Dispatches recorded for this backend in the recent window (last 24h). */
+    dispatchesRecent: number;
+    /** Quota standing: 'unlimited' when no rate limit is configured. */
+    quota: 'ok' | 'warn' | 'over' | 'unlimited';
+}
+/** One whole-fleet read-only snapshot. */
+export interface FleetStatus {
+    /** ISO timestamp this snapshot was generated. */
+    generatedAt: string;
+    daemon: {
+        running: boolean;
+        lastTickAt: string | null;
+        todaySpentUsd: number;
+    };
+    backends: FleetBackendStatus[];
+    queue: {
+        backlogItems: number;
+    };
+    proposals: {
+        pending: number;
+        frontierPending: number;
+        applied: number;
+    };
+    merges: {
+        recent: number;
+    };
+    /** True when the global kill switch is engaged (fleet paused). */
+    killed: boolean;
+}
+/**
+ * Build a read-only snapshot of the fleet. Async because the backlog scan is
+ * async. NEVER throws — each source is independently guarded.
+ */
+export declare function buildFleetStatus(cfg: AshlrConfig): Promise<FleetStatus>;

package/dist/core/fleet/status.js

@@ -0,0 +1,157 @@
+/**
+ * M49: fleet control plane + observability — read-only aggregation.
+ *
+ * `buildFleetStatus(cfg)` is a single READ-ONLY snapshot of the whole fleet:
+ * the daemon's liveness + today's spend, per-backend recent dispatch counts and
+ * quota status, the backlog queue size, the inbox proposal counts (pending /
+ * frontier-pending / applied), recent auto-merges, and whether the global kill
+ * switch is engaged.
+ *
+ * SAFETY: this NEVER mutates anything and NEVER throws. Every underlying source
+ * is wrapped in its own try/catch with a sane fallback, so a single broken
+ * source (corrupt daemon state, absent backlog, etc.) degrades only its own
+ * slice — the rest of the snapshot still resolves. It adds NO capability: it
+ * only reads what the daemon/quota/inbox/backlog modules already persist.
+ */
+/** Recent window for dispatch + merge counting: the last 24 hours. */
+const RECENT_WINDOW_MS = 24 * 60 * 60 * 1000;
+/**
+ * Build a read-only snapshot of the fleet. Async because the backlog scan is
+ * async. NEVER throws — each source is independently guarded.
+ */
+export async function buildFleetStatus(cfg) {
+    const generatedAt = new Date().toISOString();
+    // ── daemon ────────────────────────────────────────────────────────────────
+    let daemon = {
+        running: false,
+        lastTickAt: null,
+        todaySpentUsd: 0,
+    };
+    // Recent ticks are reused for merge counting below.
+    let recentTicks = [];
+    try {
+        const { loadDaemonState } = await import('../daemon/state.js');
+        const ds = loadDaemonState();
+        daemon = {
+            running: ds.running === true,
+            lastTickAt: ds.lastTickAt ?? null,
+            todaySpentUsd: typeof ds.todaySpentUsd === 'number' ? ds.todaySpentUsd : 0,
+        };
+        recentTicks = Array.isArray(ds.ticks) ? ds.ticks : [];
+    }
+    catch {
+        // leave fallback
+    }
+    // ── backends ────────────────────────────────────────────────────────────────
+    const allowed = cfg.foundry?.allowedBackends ?? ['builtin'];
+    const backends = [];
+    for (const backend of allowed) {
+        let dispatchesRecent = 0;
+        let quota = 'unlimited';
+        try {
+            const { usesInWindow, evalQuota } = await import('./quota.js');
+            // Prefer the quota ledger (authoritative for rate-limit accounting).
+            dispatchesRecent = usesInWindow(backend, RECENT_WINDOW_MS);
+            // Quota standing: 'unlimited' when no limit is configured for this backend.
+            const limit = cfg.foundry?.limits?.[backend];
+            quota = limit ? evalQuota(backend, cfg) : 'unlimited';
+        }
+        catch {
+            // Ledger unavailable — fall back to summing recent tick.backends counts.
+            try {
+                dispatchesRecent = sumRecentBackend(recentTicks, backend);
+            }
+            catch {
+                dispatchesRecent = 0;
+            }
+            quota = 'unlimited';
+        }
+        backends.push({ backend, dispatchesRecent, quota });
+    }
+    // ── queue (backlog size) ──────────────────────────────────────────────────
+    let backlogItems = 0;
+    try {
+        const { buildBacklog } = await import('../portfolio/backlog.js');
+        const backlog = await buildBacklog();
+        backlogItems = Array.isArray(backlog.items) ? backlog.items.length : 0;
+    }
+    catch {
+        backlogItems = 0;
+    }
+    // ── proposals (pending / frontier-pending / applied) ──────────────────────
+    let pending = 0;
+    let frontierPending = 0;
+    let applied = 0;
+    try {
+        const { listProposals } = await import('../inbox/store.js');
+        const all = listProposals();
+        for (const p of all) {
+            if (p.status === 'pending') {
+                pending++;
+                if (p.engineTier === 'frontier')
+                    frontierPending++;
+            }
+            else if (p.status === 'applied') {
+                applied++;
+            }
+        }
+    }
+    catch {
+        pending = 0;
+        frontierPending = 0;
+        applied = 0;
+    }
+    // ── merges (recent auto-merges across recent ticks) ───────────────────────
+    let mergesRecent = 0;
+    try {
+        const cutoff = Date.now() - RECENT_WINDOW_MS;
+        for (const t of recentTicks) {
+            if (typeof t.merged !== 'number' || t.merged <= 0)
+                continue;
+            const ts = t.ts ? Date.parse(t.ts) : NaN;
+            // Count when within the recent window, or when the tick has no parseable
+            // timestamp (be inclusive rather than silently drop a real merge).
+            if (Number.isNaN(ts) || ts >= cutoff)
+                mergesRecent += t.merged;
+        }
+    }
+    catch {
+        mergesRecent = 0;
+    }
+    // ── kill switch ───────────────────────────────────────────────────────────
+    let killed = false;
+    try {
+        const { killSwitchOn } = await import('../sandbox/policy.js');
+        killed = killSwitchOn() === true;
+    }
+    catch {
+        killed = false;
+    }
+    return {
+        generatedAt,
+        daemon,
+        backends,
+        queue: { backlogItems },
+        proposals: { pending, frontierPending, applied },
+        merges: { recent: mergesRecent },
+        killed,
+    };
+}
+/**
+ * Sum `tick.backends[backend]` across recent ticks (within RECENT_WINDOW_MS).
+ * Pure fallback for when the quota ledger is unavailable.
+ */
+function sumRecentBackend(ticks, backend) {
+    const cutoff = Date.now() - RECENT_WINDOW_MS;
+    let sum = 0;
+    for (const t of ticks) {
+        const n = t.backends?.[backend];
+        if (typeof n !== 'number' || n <= 0)
+            continue;
+        const ts = t.ts ? Date.parse(t.ts) : NaN;
+        if (Number.isNaN(ts) || ts >= cutoff)
+            sum += n;
+    }
+    return sum;
+}
+//# sourceMappingURL=status.js.map

package/dist/core/fleet/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/core/fleet/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuCH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAgB;IACrD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE7C,6EAA6E;IAC7E,IAAI,MAAM,GAA0B;QAClC,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,oDAAoD;IACpD,IAAI,WAAW,GAA+E,EAAE,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;QAC7B,MAAM,GAAG;YACP,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI;YAC5B,UAAU,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI;YACjC,aAAa,EAAE,OAAO,EAAE,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SAC3E,CAAC;QACF,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,+EAA+E;IAC/E,MAAM,OAAO,GAAe,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,GAAgC,WAAW,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;YAC/D,qEAAqE;YACrE,gBAAgB,GAAG,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAC3D,4EAA4E;YAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;YAC7C,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,IAAI,CAAC;gBACH,gBAAgB,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,GAAG,WAAW,CAAC;QACtB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,6EAA6E;IAC7E,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;QACrC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;oBAAE,eAAe,EAAE,CAAC;YACrD,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,CAAC;QACZ,eAAe,GAAG,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC;gBAAE,SAAS;YAC5D,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACzC,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,MAAM;gBAAE,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC;QACjE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC9D,MAAM,GAAG,YAAY,EAAE,KAAK,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;IACjB,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM;QACN,QAAQ;QACR,KAAK,EAAE,EAAE,YAAY,EAAE;QACvB,SAAS,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE;QAChD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;QAChC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CACvB,KAAgE,EAChE,OAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;IAC7C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9C,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,MAAM;YAAE,GAAG,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/foundry/provenance.d.ts

@@ -0,0 +1,78 @@
+/**
+ * provenance.ts — M47.1: HMAC-signed provenance for inbox proposals (H3).
+ *
+ * ╔══════════════════════════════════════════════════════════════════════════╗
+ * ║ THREAT MODEL — forged frontier merge-authority on a disk record.           ║
+ * ║                                                                            ║
+ * ║ merge.ts Gate 4 (evaluateMergeAuthority) trusts proposal.engineTier /      ║
+ * ║ proposal.engineModel as read from ~/.ashlr/inbox/<id>.json. The agent MCP  ║
+ * ║ surface cannot set those fields (they are stamped server-side), but a      ║
+ * ║ LOCAL / in-process writer with filesystem access to the inbox COULD forge  ║
+ * ║ a record claiming `{engineTier:'frontier', engineModel:'codex:gpt-5.5'}`   ║
+ * ║ paired with an arbitrary diff, and slip it past the authority gate.        ║
+ * ║                                                                            ║
+ * ║ MITIGATION: the sandboxed producer (the ONLY legitimate origin of a        ║
+ * ║ frontier proposal) HMAC-signs `${engineModel}|${engineTier}|${diffHash}`   ║
+ * ║ with a host-local secret key (~/.ashlr/foundry/provenance.key, mode 0600)  ║
+ * ║ and stores the signature + diffHash on the record. The merge gate          ║
+ * ║ re-derives the HMAC and FAILS CLOSED on any mismatch. A forger who cannot  ║
+ * ║ read the key cannot mint a valid signature; binding the diff hash into the ║
+ * ║ MAC also prevents pairing a stolen signature with a swapped diff.          ║
+ * ║                                                                            ║
+ * ║ RESIDUAL: an attacker who can READ ~/.ashlr/foundry/provenance.key can     ║
+ * ║ sign arbitrary records — the key is only as strong as the filesystem       ║
+ * ║ permissions protecting it (0600). This raises the bar from "any local      ║
+ * ║ writer" to "an attacker who already owns the user's home dir secrets".     ║
+ * ║                                                                            ║
+ * ║ INVARIANTS: every exported fn NEVER throws (verify catches → fail-closed); ║
+ * ║ comparisons are constant-time; node:crypto only.                           ║
+ * ╚══════════════════════════════════════════════════════════════════════════╝
+ */
+/**
+ * Absolute path to the provenance HMAC key: ~/.ashlr/foundry/provenance.key.
+ * Re-resolved at call time so tests can relocate HOME between invocations.
+ */
+export declare function provenanceKeyPath(): string;
+/**
+ * Load the host-local provenance key, creating it on first use.
+ *
+ * - If the key file exists, read and return its bytes.
+ * - Else generate 32 random bytes, `mkdir -p ~/.ashlr/foundry`, and write the
+ *   key with mode 0600 via an atomic tmp-write + rename, then return it.
+ *
+ * NEVER throws. On any I/O failure it falls back to a process-lifetime
+ * ephemeral key. That fallback is degenerate by design: signatures made with it
+ * will not match a persistent key at verify time, so the merge gate fails
+ * closed rather than trusting an unverifiable provenance claim.
+ */
+export declare function loadOrCreateKey(): Buffer;
+/** SHA-256 hex digest of the diff string. Pure; never throws. */
+export declare function hashDiff(diff: string): string;
+/**
+ * HMAC-SHA256(key, `${engineModel}|${engineTier}|${diffHash}`) as hex.
+ * Binds the trust tuple to a concrete diff so a stolen signature cannot be
+ * re-paired with a different diff. Never throws.
+ */
+export declare function signProvenance(engineModel: string, engineTier: string, diffHash: string): string;
+export interface ProvenanceVerdict {
+    ok: boolean;
+    reason: string;
+}
+/**
+ * Verify a proposal's signed provenance. FAIL-CLOSED in every doubtful case.
+ *
+ * Rejects when:
+ *  - any of engineModel / engineTier / diff / diffHash / provenanceSig is missing;
+ *  - hashDiff(diff) !== diffHash (the stored diff was tampered after signing);
+ *  - the recomputed HMAC does not equal provenanceSig (constant-time compare;
+ *    a length mismatch counts as a non-match).
+ *
+ * ok:true ONLY when every check passes. NEVER throws (any error → fail-closed).
+ */
+export declare function verifyProvenance(p: {
+    engineModel?: string;
+    engineTier?: string;
+    diff?: string;
+    diffHash?: string;
+    provenanceSig?: string;
+}): ProvenanceVerdict;

package/dist/core/foundry/provenance.js

@@ -0,0 +1,172 @@
+/**
+ * provenance.ts — M47.1: HMAC-signed provenance for inbox proposals (H3).
+ *
+ * ╔══════════════════════════════════════════════════════════════════════════╗
+ * ║ THREAT MODEL — forged frontier merge-authority on a disk record.           ║
+ * ║                                                                            ║
+ * ║ merge.ts Gate 4 (evaluateMergeAuthority) trusts proposal.engineTier /      ║
+ * ║ proposal.engineModel as read from ~/.ashlr/inbox/<id>.json. The agent MCP  ║
+ * ║ surface cannot set those fields (they are stamped server-side), but a      ║
+ * ║ LOCAL / in-process writer with filesystem access to the inbox COULD forge  ║
+ * ║ a record claiming `{engineTier:'frontier', engineModel:'codex:gpt-5.5'}`   ║
+ * ║ paired with an arbitrary diff, and slip it past the authority gate.        ║
+ * ║                                                                            ║
+ * ║ MITIGATION: the sandboxed producer (the ONLY legitimate origin of a        ║
+ * ║ frontier proposal) HMAC-signs `${engineModel}|${engineTier}|${diffHash}`   ║
+ * ║ with a host-local secret key (~/.ashlr/foundry/provenance.key, mode 0600)  ║
+ * ║ and stores the signature + diffHash on the record. The merge gate          ║
+ * ║ re-derives the HMAC and FAILS CLOSED on any mismatch. A forger who cannot  ║
+ * ║ read the key cannot mint a valid signature; binding the diff hash into the ║
+ * ║ MAC also prevents pairing a stolen signature with a swapped diff.          ║
+ * ║                                                                            ║
+ * ║ RESIDUAL: an attacker who can READ ~/.ashlr/foundry/provenance.key can     ║
+ * ║ sign arbitrary records — the key is only as strong as the filesystem       ║
+ * ║ permissions protecting it (0600). This raises the bar from "any local      ║
+ * ║ writer" to "an attacker who already owns the user's home dir secrets".     ║
+ * ║                                                                            ║
+ * ║ INVARIANTS: every exported fn NEVER throws (verify catches → fail-closed); ║
+ * ║ comparisons are constant-time; node:crypto only.                           ║
+ * ╚══════════════════════════════════════════════════════════════════════════╝
+ */
+import { createHmac, createHash, randomBytes, timingSafeEqual, } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// ---------------------------------------------------------------------------
+// Key management
+// ---------------------------------------------------------------------------
+/**
+ * In-memory ephemeral key used ONLY as a last-resort fallback when the key file
+ * can neither be read nor created (e.g. a read-only home). A signature made with
+ * this key will not verify against a freshly-loaded persistent key, so the
+ * effect is fail-closed at the merge gate — exactly the safe outcome.
+ */
+let _ephemeralKey = null;
+/**
+ * Absolute path to the provenance HMAC key: ~/.ashlr/foundry/provenance.key.
+ * Re-resolved at call time so tests can relocate HOME between invocations.
+ */
+export function provenanceKeyPath() {
+    return join(homedir(), '.ashlr', 'foundry', 'provenance.key');
+}
+/**
+ * Load the host-local provenance key, creating it on first use.
+ *
+ * - If the key file exists, read and return its bytes.
+ * - Else generate 32 random bytes, `mkdir -p ~/.ashlr/foundry`, and write the
+ *   key with mode 0600 via an atomic tmp-write + rename, then return it.
+ *
+ * NEVER throws. On any I/O failure it falls back to a process-lifetime
+ * ephemeral key. That fallback is degenerate by design: signatures made with it
+ * will not match a persistent key at verify time, so the merge gate fails
+ * closed rather than trusting an unverifiable provenance claim.
+ */
+export function loadOrCreateKey() {
+    const keyPath = provenanceKeyPath();
+    try {
+        if (existsSync(keyPath)) {
+            const buf = readFileSync(keyPath);
+            if (buf.length > 0)
+                return buf;
+            // A truncated/empty key file is unusable — regenerate below.
+        }
+    }
+    catch {
+        // fall through to create / ephemeral
+    }
+    try {
+        const dir = join(homedir(), '.ashlr', 'foundry');
+        if (!existsSync(dir)) {
+            mkdirSync(dir, { recursive: true });
+        }
+        const key = randomBytes(32);
+        const tmp = keyPath + '.tmp';
+        // mode 0600: owner read/write only — the file holds the signing secret.
+        writeFileSync(tmp, key, { mode: 0o600 });
+        renameSync(tmp, keyPath);
+        return key;
+    }
+    catch {
+        // Last resort: an ephemeral, process-local key. Persisted records signed
+        // with this will NOT verify after a fresh load → fail-closed at merge.
+        if (!_ephemeralKey)
+            _ephemeralKey = randomBytes(32);
+        return _ephemeralKey;
+    }
+}
+// ---------------------------------------------------------------------------
+// Hashing + signing
+// ---------------------------------------------------------------------------
+/** SHA-256 hex digest of the diff string. Pure; never throws. */
+export function hashDiff(diff) {
+    return createHash('sha256').update(diff, 'utf8').digest('hex');
+}
+/**
+ * HMAC-SHA256(key, `${engineModel}|${engineTier}|${diffHash}`) as hex.
+ * Binds the trust tuple to a concrete diff so a stolen signature cannot be
+ * re-paired with a different diff. Never throws.
+ */
+export function signProvenance(engineModel, engineTier, diffHash) {
+    const key = loadOrCreateKey();
+    const payload = `${engineModel}|${engineTier}|${diffHash}`;
+    return createHmac('sha256', key).update(payload, 'utf8').digest('hex');
+}
+/** Constant-time string compare over equal-length hex; false if lengths differ. */
+function constantTimeEqual(a, b) {
+    const ab = Buffer.from(a, 'utf8');
+    const bb = Buffer.from(b, 'utf8');
+    // timingSafeEqual requires equal-length buffers — a length mismatch is itself
+    // a non-match, so short-circuit (without leaking timing on the bytes).
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
+/**
+ * Verify a proposal's signed provenance. FAIL-CLOSED in every doubtful case.
+ *
+ * Rejects when:
+ *  - any of engineModel / engineTier / diff / diffHash / provenanceSig is missing;
+ *  - hashDiff(diff) !== diffHash (the stored diff was tampered after signing);
+ *  - the recomputed HMAC does not equal provenanceSig (constant-time compare;
+ *    a length mismatch counts as a non-match).
+ *
+ * ok:true ONLY when every check passes. NEVER throws (any error → fail-closed).
+ */
+export function verifyProvenance(p) {
+    try {
+        if (!p.engineModel) {
+            return { ok: false, reason: 'missing engineModel' };
+        }
+        if (!p.engineTier) {
+            return { ok: false, reason: 'missing engineTier' };
+        }
+        if (p.diff === undefined || p.diff === null) {
+            return { ok: false, reason: 'missing diff' };
+        }
+        if (!p.diffHash) {
+            return { ok: false, reason: 'missing diffHash' };
+        }
+        if (!p.provenanceSig) {
+            return { ok: false, reason: 'missing provenanceSig' };
+        }
+        // The stored diff must hash to the recorded diffHash — otherwise the diff
+        // was swapped after signing (the signature binds the tuple to diffHash, not
+        // to the diff bytes directly).
+        const recomputedHash = hashDiff(p.diff);
+        if (!constantTimeEqual(recomputedHash, p.diffHash)) {
+            return { ok: false, reason: 'diff hash mismatch (diff tampered after signing)' };
+        }
+        const expectedSig = signProvenance(p.engineModel, p.engineTier, p.diffHash);
+        if (!constantTimeEqual(expectedSig, p.provenanceSig)) {
+            return { ok: false, reason: 'provenance signature mismatch' };
+        }
+        return { ok: true, reason: 'provenance signature valid' };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            reason: `provenance verify error: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+//# sourceMappingURL=provenance.js.map

package/dist/core/foundry/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../src/core/foundry/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EACL,UAAU,EACV,UAAU,EACV,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;GAKG;AACH,IAAI,aAAa,GAAkB,IAAI,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC;YAC/B,6DAA6D;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,GAAG,MAAM,CAAC;QAC7B,wEAAwE;QACxE,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,CAAC,aAAa;YAAE,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,UAAkB,EAClB,QAAgB;IAEhB,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,WAAW,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;IAC3D,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAWD,mFAAmF;AACnF,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAClC,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAMhC;IACC,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,+BAA+B;QAC/B,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;QACnF,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;QAChE,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/git.d.ts

@@ -19,6 +19,19 @@ export declare function isRepo(dir: string): boolean;
  * path is not a repo or git is unavailable.
  */
 export declare function getGitStatus(repoPath: string): GitStatus | null;
+/**
+ * Resolve the repository's default branch name (the integration target for an
+ * auto-merge). Resolution order:
+ *   1. `git symbolic-ref --short refs/remotes/origin/HEAD` → strip `origin/`.
+ *      This is the remote's authoritative default branch when a remote exists.
+ *   2. `git rev-parse --abbrev-ref HEAD` → the currently checked-out branch.
+ *   3. Final fallback: 'main'.
+ *
+ * Never throws (each git() call already swallows errors with a 5s timeout). A
+ * detached HEAD yields 'HEAD' from step 2, which we treat as unresolved and fall
+ * through to 'main'.
+ */
+export declare function defaultBranch(repoPath: string): string;
 /**
  * Parses the `origin` remote URL of the repo at `repoPath` and extracts the
  * GitHub org (or user) name. Returns `{ remote, org }` where either may be

package/dist/core/git.js

@@ -86,6 +86,32 @@ export function getGitStatus(repoPath) {
     const lastCommit = git(repoPath, ['log', '-1', '--format=%cI']) || null;
     return { branch, dirty, ahead, behind, lastCommit };
 }
+/**
+ * Resolve the repository's default branch name (the integration target for an
+ * auto-merge). Resolution order:
+ *   1. `git symbolic-ref --short refs/remotes/origin/HEAD` → strip `origin/`.
+ *      This is the remote's authoritative default branch when a remote exists.
+ *   2. `git rev-parse --abbrev-ref HEAD` → the currently checked-out branch.
+ *   3. Final fallback: 'main'.
+ *
+ * Never throws (each git() call already swallows errors with a 5s timeout). A
+ * detached HEAD yields 'HEAD' from step 2, which we treat as unresolved and fall
+ * through to 'main'.
+ */
+export function defaultBranch(repoPath) {
+    const sym = git(repoPath, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD']);
+    if (sym) {
+        // e.g. "origin/main" → "main"
+        const slash = sym.indexOf('/');
+        const name = slash >= 0 ? sym.slice(slash + 1) : sym;
+        if (name)
+            return name;
+    }
+    const cur = git(repoPath, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (cur && cur !== 'HEAD')
+        return cur;
+    return 'main';
+}
 /**
  * Parses the `origin` remote URL of the repo at `repoPath` and extracts the
  * GitHub org (or user) name. Returns `{ remote, org }` where either may be

package/dist/core/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/core/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK;AAEhC;;GAEG;AACH,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACpC,GAAG;YACH,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,wDAAwD;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,+BAA+B;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,iBAAiB;IACjB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IAC3E,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,6BAA6B;IAEjE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QACpC,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAEnD,kCAAkC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE;QAC7B,UAAU;QACV,cAAc;QACd,SAAS;QACT,aAAa;KACd,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,4DAA4D;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,wEAAwE;IAExE,oCAAoC;IACpC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC;IAExE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAI3C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAEhD,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAC7B,gDAAgD,CACjD,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/core/git.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK;AAEhC;;GAEG;AACH,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACpC,GAAG;YACH,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,wDAAwD;IACxD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,+BAA+B;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,iBAAiB;IACjB,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;IAC3E,MAAM,MAAM,GAAG,SAAS,IAAI,MAAM,CAAC,CAAC,6BAA6B;IAEjE,8DAA8D;IAC9D,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GACT,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QACpC,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAEnD,kCAAkC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE;QAC7B,UAAU;QACV,cAAc;QACd,SAAS;QACT,aAAa;KACd,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,4DAA4D;QAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5C,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,wEAAwE;IAExE,oCAAoC;IACpC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,IAAI,IAAI,CAAC;IAExE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG,EAAE,CAAC;QACR,8BAA8B;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,GAAG,CAAC;IAEtC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAI3C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAEhD,4CAA4C;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAC7B,gDAAgD,CACjD,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,gEAAgE;IAChE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC"}