@ashlr/hub 2.2.0

package/dist/core/knowledge/graph.js

@@ -0,0 +1,564 @@
+/**
+ * graph.ts — Knowledge Graph + Impact analysis for enrolled repos.
+ *
+ * INVARIANTS (docs/contracts/CONTRACT-M25.md):
+ *  1. READ-ONLY: never modifies any enrolled repo; analysis only.
+ *  2. ENROLLMENT-SCOPED: default repos = listEnrolled() (DEFAULT EMPTY => empty graph).
+ *  3. BOUNDED: caps file walk depth, file count, and skips node_modules/.git/dist/binaries.
+ *  4. NEVER THROWS: all functions catch internally; callers get empty structures on error.
+ *  5. LOCAL-ONLY: no network calls; pure filesystem analysis.
+ *  6. NO SECRETS: skips .env/key files; does not emit secret-shaped content.
+ *
+ * buildGraph(repos?): construct KnowledgeGraph from persisted index + package.json manifests
+ *   + import/require statements. Nodes: repos, key modules, shared deps.
+ *   Edges: imports/depends/shared-dep. CrossRepo: same dep across repos, duplicated modules.
+ *
+ * impact(target, repos?): find all references to a file path or symbol across enrolled repos
+ *   via the persisted index + grep-style scan. Returns ImpactResult with references + dependents.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { listEnrolled, isEnrolled } from '../sandbox/policy.js';
+import { SECRET_PATTERNS, scrubSecrets as scrubSecretsParity } from './index.js';
+// ---------------------------------------------------------------------------
+// Constants — bounds
+// ---------------------------------------------------------------------------
+/** Max files to scan per repo during import analysis. */
+const MAX_FILES_PER_REPO = 2000;
+/** Max bytes to read from a single file for import extraction. */
+const MAX_FILE_BYTES = 256 * 1024; // 256 KB
+/** Max recursion depth during directory walk. */
+const MAX_WALK_DEPTH = 10;
+/** Max references to collect for an impact query (keeps output bounded). */
+const MAX_REFERENCES = 500;
+/** Directories to skip unconditionally. */
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', '.next', '.turbo', 'coverage',
+    '__pycache__', 'build', 'out', '.cache', '.parcel-cache', 'vendor',
+    '.venv', 'venv', 'target', '.idea', '.vscode',
+]);
+/** File extensions considered source code (import-bearing). */
+const SOURCE_EXTS = new Set([
+    '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+    '.py', '.rb', '.go', '.rs', '.java', '.kt',
+]);
+/** Binary / compiled extensions to skip entirely. */
+const BINARY_EXTS = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg', '.ico',
+    '.woff', '.woff2', '.ttf', '.eot',
+    '.mp3', '.mp4', '.wav', '.ogg',
+    '.zip', '.tar', '.gz', '.bz2', '.rar',
+    '.bin', '.exe', '.dll', '.so', '.dylib',
+    '.lock', '.map',
+]);
+/** Secret-adjacent filenames to skip when reading. */
+const SECRET_FILES = new Set([
+    '.env', '.env.local', '.env.production', '.env.development', '.env.test',
+    '.env.staging', '.envrc',
+    'credentials.json', 'secrets.json', 'secret.json',
+    'id_rsa', 'id_ed25519', 'id_ecdsa', 'id_dsa',
+    '.npmrc', '.netrc',
+    'service-account.json', 'serviceaccount.json',
+]);
+// ---------------------------------------------------------------------------
+// Path helpers
+// ---------------------------------------------------------------------------
+/** Derive a stable short ID from an absolute path (basename). */
+function repoId(absPath) {
+    return `repo:${path.basename(absPath)}`;
+}
+/** Returns true if the file should be skipped entirely (binary, secret, skip-dir). */
+function shouldSkipFile(filePath) {
+    const base = path.basename(filePath);
+    if (SECRET_FILES.has(base))
+        return true;
+    const ext = path.extname(filePath).toLowerCase();
+    if (BINARY_EXTS.has(ext))
+        return true;
+    return false;
+}
+/** Returns true if the directory entry should not be descended into. */
+function shouldSkipDir(name) {
+    return SKIP_DIRS.has(name) || name.startsWith('.');
+}
+// ---------------------------------------------------------------------------
+// Filesystem helpers — always safe, never throw
+// ---------------------------------------------------------------------------
+function safeReadFile(filePath) {
+    try {
+        if (shouldSkipFile(filePath))
+            return null;
+        const stat = fs.statSync(filePath);
+        if (!stat.isFile())
+            return null;
+        if (stat.size > MAX_FILE_BYTES)
+            return null;
+        return fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function safeReaddir(dir) {
+    try {
+        return fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+}
+// ---------------------------------------------------------------------------
+// Directory walker — bounded, read-only, never throws
+// ---------------------------------------------------------------------------
+/**
+ * Walk a repo directory and collect all source file paths up to MAX_FILES_PER_REPO.
+ * Skips SKIP_DIRS, hidden dirs, binaries, and secret files.
+ */
+function walkSourceFiles(repoPath) {
+    const results = [];
+    function walk(dir, depth) {
+        if (depth > MAX_WALK_DEPTH)
+            return;
+        if (results.length >= MAX_FILES_PER_REPO)
+            return;
+        for (const dirent of safeReaddir(dir)) {
+            if (results.length >= MAX_FILES_PER_REPO)
+                return;
+            // Skip symlinks (files + dirs) so the walk cannot escape the repo boundary.
+            if (dirent.isSymbolicLink())
+                continue;
+            if (dirent.isDirectory()) {
+                if (shouldSkipDir(dirent.name))
+                    continue;
+                walk(path.join(dir, dirent.name), depth + 1);
+            }
+            else if (dirent.isFile()) {
+                const filePath = path.join(dir, dirent.name);
+                if (shouldSkipFile(filePath))
+                    continue;
+                const ext = path.extname(dirent.name).toLowerCase();
+                if (SOURCE_EXTS.has(ext)) {
+                    results.push(filePath);
+                }
+            }
+        }
+    }
+    try {
+        walk(repoPath, 0);
+    }
+    catch {
+        // bounded walk never propagates errors
+    }
+    return results;
+}
+function readPackageJson(repoPath) {
+    try {
+        const pkgPath = path.join(repoPath, 'package.json');
+        const raw = safeReadFile(pkgPath);
+        if (!raw)
+            return null;
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/** Collect all dependency names from a package.json. */
+function collectDeps(pkg) {
+    return [
+        ...Object.keys(pkg.dependencies ?? {}),
+        ...Object.keys(pkg.devDependencies ?? {}),
+        ...Object.keys(pkg.peerDependencies ?? {}),
+    ];
+}
+// ---------------------------------------------------------------------------
+// Import/require extraction — regex-based, fast, bounded
+// ---------------------------------------------------------------------------
+/**
+ * Extract import/require targets from a source file's text.
+ * Returns both external package names and relative path imports.
+ * Never throws.
+ */
+function extractImports(source) {
+    const imports = [];
+    try {
+        // ES module: import ... from 'target'  /  import 'target'
+        const esImportRe = /\bimport\s+(?:[^'"]*\s+from\s+)?['"]([^'"]+)['"]/g;
+        let m;
+        while ((m = esImportRe.exec(source)) !== null) {
+            if (m[1])
+                imports.push(m[1]);
+        }
+        // CommonJS: require('target')
+        const cjsRe = /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+        while ((m = cjsRe.exec(source)) !== null) {
+            if (m[1])
+                imports.push(m[1]);
+        }
+        // Dynamic import: import('target')
+        const dynRe = /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+        while ((m = dynRe.exec(source)) !== null) {
+            if (m[1])
+                imports.push(m[1]);
+        }
+        // Python: from target import  /  import target
+        const pyFromRe = /^from\s+([\w.]+)\s+import/gm;
+        while ((m = pyFromRe.exec(source)) !== null) {
+            if (m[1])
+                imports.push(m[1]);
+        }
+        const pyImportRe = /^import\s+([\w.,\s]+)/gm;
+        while ((m = pyImportRe.exec(source)) !== null) {
+            if (m[1]) {
+                for (const part of m[1].split(',')) {
+                    const trimmed = part.trim().split(' ')[0];
+                    if (trimmed)
+                        imports.push(trimmed);
+                }
+            }
+        }
+    }
+    catch {
+        // regex errors are non-fatal
+    }
+    return imports;
+}
+/**
+ * Classify an import string:
+ * - 'relative': starts with ./ or ../
+ * - 'package': external npm/pip package name
+ */
+function importKind(imp) {
+    return imp.startsWith('.') ? 'relative' : 'package';
+}
+/** Extract just the package name (before any slash for scoped/sub-path). */
+function packageName(imp) {
+    if (imp.startsWith('@')) {
+        // scoped: @scope/name/sub => @scope/name
+        const parts = imp.split('/');
+        return parts.slice(0, 2).join('/');
+    }
+    return imp.split('/')[0] ?? imp;
+}
+// ---------------------------------------------------------------------------
+// Secret-scrubbing helper (for display; not stored in graph)
+// ---------------------------------------------------------------------------
+// H6 (PART B.1 — scrub PARITY): graph.ts delegates to index.ts's full
+// SECRET_PATTERNS set so the two scrubs are at PARITY. Previously this was the
+// WEAKER scrub (H4 §6.8 FINDING) — ONE assignment-style regex that missed bare
+// JWT / AKIA / base64 / hex blobs. graph.ts imports { SECRET_PATTERNS,
+// scrubSecrets } from './index.js' and uses index's scrubSecrets at the
+// `detail:` emit site, so graph.ts and index.ts redact the SAME shapes
+// (JWT / AKIA / base64 / hex / Stripe sk_live_) — see
+// docs/contracts/CONTRACT-H6.md §B.1. This flips the pinned H4 §6.8 assertions
+// DELIBERATELY (§B.4): they now assert the bare blobs ARE redacted.
+//
+// PARITY DIRECTION (H6 review finding, §B.1): "parity" means graph.ts adopts
+// index.ts's SUPERSET of high-entropy shapes (bare JWT / AKIA / base64 / hex /
+// sk_live_). The OLD graph regex additionally matched bare LOW-entropy
+// assignments like `token=abc123` / `auth=xyz`; index.ts's compound-name +
+// high-entropy patterns intentionally do NOT, so those narrow shapes are
+// dropped in this direction. This is safe because the ONLY string graph.ts
+// scrubs is the structurally-constrained `detail` string
+// `${dep} shared across N repos: basename@version` (dep names + repo@version,
+// never free-form text), so a bare `token=…` literal cannot occur there.
+//
+// SECRET_PATTERNS is LOAD-BEARING here (not decorative): scrubSecrets() asserts
+// the imported parity array is non-empty before delegating, so a wiped/empty
+// upstream pattern set surfaces as a throw at the graph.ts call site rather than
+// a silent no-op. `ashlr verify-safety` CHECK 4 pins the real `./index.js`
+// parity import (scrubSecrets + SECRET_PATTERNS) — live code, not a vestigial
+// assignment-regex string — see verify-safety.ts CHECK 4 + docs/contracts/CONTRACT-H6.md §B.1.
+/** Parity scrub: delegates to index.ts's exported scrubSecrets over the shared
+ *  SECRET_PATTERNS so graph.ts redacts the identical pattern set. The explicit
+ *  SECRET_PATTERNS length guard makes the shared array load-bearing: an empty
+ *  upstream pattern set throws here instead of silently passing raw text. */
+function scrubSecrets(text) {
+    // Defense-in-depth: the shared pattern set must be non-empty for parity to
+    // hold. A zero-length array would mean index.ts's scrub silently became a
+    // no-op; refuse to emit an unscrubbed detail string in that case.
+    if (SECRET_PATTERNS.length === 0) {
+        throw new Error('graph.ts scrub parity broken: shared SECRET_PATTERNS is empty');
+    }
+    return scrubSecretsParity(text);
+}
+function analyseRepo(repoPath) {
+    const label = path.basename(repoPath);
+    const pkg = readPackageJson(repoPath);
+    const deps = pkg ? collectDeps(pkg) : [];
+    const moduleImports = new Map();
+    const sourceFiles = walkSourceFiles(repoPath);
+    for (const filePath of sourceFiles) {
+        const src = safeReadFile(filePath);
+        if (!src)
+            continue;
+        const relPath = path.relative(repoPath, filePath);
+        const pkgImports = new Set();
+        for (const imp of extractImports(src)) {
+            if (importKind(imp) === 'package') {
+                pkgImports.add(packageName(imp));
+            }
+        }
+        if (pkgImports.size > 0) {
+            moduleImports.set(relPath, pkgImports);
+        }
+    }
+    return {
+        repoPath,
+        repoLabel: label,
+        packageName: pkg?.name ?? null,
+        deps,
+        moduleImports,
+        sourceFiles,
+    };
+}
+// ---------------------------------------------------------------------------
+// buildGraph — public API
+// ---------------------------------------------------------------------------
+/**
+ * Build a KnowledgeGraph from enrolled repos (or the provided list).
+ *
+ * Nodes:
+ *   - kind:'repo'    — each enrolled repo
+ *   - kind:'module'  — key source files within a repo (those that import packages)
+ *   - kind:'dep'     — external dependencies (package names)
+ *
+ * Edges:
+ *   - kind:'depends'   — repo -> dep (from package.json)
+ *   - kind:'imports'   — module -> dep (from import statements)
+ *   - kind:'shared-dep' — dep -> dep node (already in graph; used for cross-repo detection)
+ *
+ * CrossRepo:
+ *   - kind:'shared-dep' when a dep appears in 2+ repos
+ *   - kind:'duplicate-module' when the same relative module path exists in 2+ repos
+ *
+ * BOUNDED, READ-ONLY, NEVER THROWS.
+ */
+export function buildGraph(repos) {
+    const graph = { nodes: [], edges: [], crossRepo: [] };
+    try {
+        const targetRepos = repos ?? listEnrolled();
+        if (targetRepos.length === 0)
+            return graph;
+        const nodeIds = new Set();
+        const edgeKeys = new Set();
+        function addNode(id, kind, label) {
+            if (!nodeIds.has(id)) {
+                nodeIds.add(id);
+                graph.nodes.push({ id, kind, label });
+            }
+        }
+        function addEdge(from, to, kind) {
+            const key = `${from}||${to}||${kind}`;
+            if (!edgeKeys.has(key)) {
+                edgeKeys.add(key);
+                graph.edges.push({ from, to, kind });
+            }
+        }
+        // Analyse all repos
+        const analyses = [];
+        for (const repoPath of targetRepos) {
+            try {
+                // ENROLLMENT-SCOPED (docs/contracts/CONTRACT-M25.md invariant 3): only ever walk enrolled
+                // repos — an explicit repos list from the CLI (--repo / positional) is
+                // validated here so a non-enrolled directory is never read.
+                if (!isEnrolled(repoPath))
+                    continue;
+                if (!fs.existsSync(repoPath))
+                    continue;
+                const analysis = analyseRepo(repoPath);
+                analyses.push(analysis);
+            }
+            catch {
+                // one bad repo must not crash the whole graph
+            }
+        }
+        // dep name -> set of repo ids that declare it
+        const depToRepos = new Map();
+        // module relPath -> set of repo ids that have it
+        const moduleToRepos = new Map();
+        for (const analysis of analyses) {
+            const rId = repoId(analysis.repoPath);
+            addNode(rId, 'repo', analysis.repoLabel);
+            // Edges: repo -> declared dep (from package.json)
+            for (const dep of analysis.deps) {
+                const depId = `dep:${dep}`;
+                addNode(depId, 'dep', dep);
+                addEdge(rId, depId, 'depends');
+                if (!depToRepos.has(dep))
+                    depToRepos.set(dep, new Set());
+                depToRepos.get(dep).add(rId);
+            }
+            // Edges: module -> imported package dep
+            for (const [relPath, pkgImports] of analysis.moduleImports) {
+                const moduleId = `module:${analysis.repoLabel}/${relPath}`;
+                addNode(moduleId, 'module', relPath);
+                addEdge(rId, moduleId, 'contains');
+                for (const imp of pkgImports) {
+                    const depId = `dep:${imp}`;
+                    addNode(depId, 'dep', imp);
+                    addEdge(moduleId, depId, 'imports');
+                    // Also track dep->repo for cross-repo detection
+                    if (!depToRepos.has(imp))
+                        depToRepos.set(imp, new Set());
+                    depToRepos.get(imp).add(rId);
+                }
+                if (!moduleToRepos.has(relPath))
+                    moduleToRepos.set(relPath, new Set());
+                moduleToRepos.get(relPath).add(rId);
+            }
+        }
+        // Cross-repo: shared deps (appear in 2+ repos)
+        for (const [dep, repoSet] of depToRepos) {
+            if (repoSet.size >= 2) {
+                // Find the version strings for detail
+                const repoVersions = [];
+                for (const analysis of analyses) {
+                    if (repoSet.has(repoId(analysis.repoPath))) {
+                        const pkg = readPackageJson(analysis.repoPath);
+                        const version = pkg?.dependencies?.[dep] ??
+                            pkg?.devDependencies?.[dep] ??
+                            pkg?.peerDependencies?.[dep] ??
+                            '*';
+                        repoVersions.push(`${path.basename(analysis.repoPath)}@${version}`);
+                    }
+                }
+                graph.crossRepo.push({
+                    kind: 'shared-dep',
+                    detail: scrubSecrets(`${dep} shared across ${repoSet.size} repos: ${repoVersions.join(', ')}`),
+                    repos: Array.from(repoSet),
+                });
+            }
+        }
+        // Cross-repo: duplicate module paths (same relPath in 2+ repos)
+        for (const [relPath, repoSet] of moduleToRepos) {
+            if (repoSet.size >= 2) {
+                graph.crossRepo.push({
+                    kind: 'duplicate-module',
+                    detail: `Module path "${relPath}" exists in ${repoSet.size} repos`,
+                    repos: Array.from(repoSet),
+                });
+            }
+        }
+    }
+    catch {
+        // top-level safety net: always return a valid (possibly partial) graph
+    }
+    return graph;
+}
+// ---------------------------------------------------------------------------
+// impact — public API
+// ---------------------------------------------------------------------------
+/**
+ * Find all references to a file path or symbol across enrolled repos.
+ *
+ * For a file target: searches for import/require of that file (by basename and
+ * relative paths) and any text occurrence of the path.
+ * For a symbol target (no path separators, no extension): searches for usage
+ * occurrences in source files via text scan.
+ *
+ * Returns references (repo/file:line) and a list of dependent module names.
+ * BOUNDED (MAX_REFERENCES cap). READ-ONLY. NEVER THROWS.
+ */
+export function impact(target, repos) {
+    const result = { target, references: [], dependents: [] };
+    try {
+        if (!target || target.trim().length === 0)
+            return result;
+        const targetRepos = repos ?? listEnrolled();
+        if (targetRepos.length === 0)
+            return result;
+        const cleanTarget = target.trim();
+        // A target is a FILE PATH only when it has a path separator OR ends with a
+        // real file extension (.ts/.tsx/.js/.py/…). A bare dotted symbol like
+        // `React.useState` or `obj.method` has no path separator and no trailing
+        // file extension, so it falls through to word-boundary SYMBOL matching.
+        const FILE_EXT_RE = /\.[a-z0-9]{1,5}$/i;
+        const isFilePath = cleanTarget.includes('/') || cleanTarget.includes('\\') ||
+            FILE_EXT_RE.test(cleanTarget);
+        const targetBasename = path.basename(cleanTarget);
+        // For searching: strip extension for module-name matching
+        const targetNoExt = targetBasename.replace(/\.[^.]+$/, '');
+        const dependentSet = new Set();
+        for (const repoPath of targetRepos) {
+            try {
+                // ENROLLMENT-SCOPED (docs/contracts/CONTRACT-M25.md invariant 3): never walk a directory
+                // that is not enrolled, even if passed explicitly via --repo.
+                if (!isEnrolled(repoPath))
+                    continue;
+                if (!fs.existsSync(repoPath))
+                    continue;
+                const sourceFiles = walkSourceFiles(repoPath);
+                for (const filePath of sourceFiles) {
+                    if (result.references.length >= MAX_REFERENCES)
+                        break;
+                    // Skip the target file itself if it's a file path
+                    if (isFilePath) {
+                        const absTarget = path.isAbsolute(cleanTarget)
+                            ? cleanTarget
+                            : path.join(repoPath, cleanTarget);
+                        if (filePath === absTarget)
+                            continue;
+                    }
+                    const src = safeReadFile(filePath);
+                    if (!src)
+                        continue;
+                    const lines = src.split('\n');
+                    for (let i = 0; i < lines.length; i++) {
+                        if (result.references.length >= MAX_REFERENCES)
+                            break;
+                        const line = lines[i];
+                        if (!line)
+                            continue;
+                        let matched = false;
+                        if (isFilePath) {
+                            // File path target: look for imports that reference this file
+                            // Match by basename (without ext) in import strings
+                            if (line.includes(targetBasename) ||
+                                (targetNoExt && line.includes(targetNoExt) &&
+                                    (line.includes('import') || line.includes('require') || line.includes('from')))) {
+                                matched = true;
+                            }
+                        }
+                        else {
+                            // Symbol target: look for usage of the symbol name in source
+                            // Use word-boundary-style matching to avoid partial matches
+                            const symbolRe = new RegExp(`\\b${escapeRegex(cleanTarget)}\\b`);
+                            if (symbolRe.test(line)) {
+                                matched = true;
+                            }
+                        }
+                        if (matched) {
+                            const relFile = path.relative(repoPath, filePath);
+                            const repo = path.basename(repoPath);
+                            result.references.push({
+                                repo,
+                                file: relFile,
+                                line: i + 1,
+                            });
+                            // Track this file as a dependent module
+                            const modName = relFile.replace(/\.[^.]+$/, '');
+                            dependentSet.add(`${repo}/${modName}`);
+                        }
+                    }
+                }
+            }
+            catch {
+                // one bad repo must not crash the whole impact
+            }
+        }
+        result.dependents = Array.from(dependentSet);
+    }
+    catch {
+        // top-level safety net
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Internal utility
+// ---------------------------------------------------------------------------
+/** Escape a string for use in a RegExp. */
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=graph.js.map

package/dist/core/knowledge/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../../src/core/knowledge/graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGjF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,kEAAkE;AAClE,MAAM,cAAc,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,SAAS;AAE5C,iDAAiD;AACjD,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,4EAA4E;AAC5E,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,2CAA2C;AAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU;IAC7D,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ;IAClE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;CAC9C,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC5C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;CAC3C,CAAC,CAAC;AAEH,qDAAqD;AACrD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;IACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;IACjC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IACrC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ;IACvC,OAAO,EAAE,MAAM;CAChB,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW;IACxE,cAAc,EAAE,QAAQ;IACxB,kBAAkB,EAAE,cAAc,EAAE,aAAa;IACjD,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ;IAC5C,QAAQ,EAAE,QAAQ;IAClB,sBAAsB,EAAE,qBAAqB;CAC9C,CAAC,CAAC;AAEH,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E,iEAAiE;AACjE,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,IAAI,cAAc,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,SAAS,IAAI,CAAC,GAAW,EAAE,KAAa;QACtC,IAAI,KAAK,GAAG,cAAc;YAAE,OAAO;QACnC,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB;YAAE,OAAO;QAEjD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,IAAI,kBAAkB;gBAAE,OAAO;YAEjD,4EAA4E;YAC5E,IAAI,MAAM,CAAC,cAAc,EAAE;gBAAE,SAAS;YAEtC,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC;oBAAE,SAAS;gBACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,cAAc,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBACpD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,GAAgB;IACnC,OAAO;QACL,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QACtC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACzC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,0DAA0D;QAC1D,MAAM,UAAU,GAAG,mDAAmD,CAAC;QACvE,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,8BAA8B;QAC9B,MAAM,KAAK,GAAG,yCAAyC,CAAC;QACxD,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,mCAAmC;QACnC,MAAM,KAAK,GAAG,wCAAwC,CAAC;QACvD,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,6BAA6B,CAAC;QAC/C,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,UAAU,GAAG,yBAAyB,CAAC;QAC7C,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACT,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,IAAI,OAAO;wBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,yCAAyC;QACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E,sEAAsE;AACtE,+EAA+E;AAC/E,+EAA+E;AAC/E,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,sDAAsD;AACtD,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,yDAAyD;AACzD,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AACjF,2EAA2E;AAC3E,8EAA8E;AAC9E,+FAA+F;AAE/F;;;6EAG6E;AAC7E,SAAS,YAAY,CAAC,IAAY;IAChC,2EAA2E;IAC3E,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAiBD,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;IACrD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAE9C,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxB,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,GAAG,EAAE,IAAI,IAAI,IAAI;QAC9B,IAAI;QACJ,aAAa;QACb,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAEtE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,KAAK,IAAI,YAAY,EAAE,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QAEnC,SAAS,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;YACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,SAAS,OAAO,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;YACrD,MAAM,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,MAAM,QAAQ,GAAmB,EAAE,CAAC;QACpC,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,0FAA0F;gBAC1F,uEAAuE;gBACvE,4DAA4D;gBAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QAED,8CAA8C;QAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;QAClD,iDAAiD;QACjD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuB,CAAC;QAErD,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;YAEzC,kDAAkD;YAClD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM,KAAK,GAAG,OAAO,GAAG,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC3B,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;gBAE/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACzD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;YAED,wCAAwC;YACxC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,UAAU,QAAQ,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC;gBAC3D,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACrC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAEnC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,OAAO,GAAG,EAAE,CAAC;oBAC3B,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC3B,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;oBAEpC,gDAAgD;oBAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;oBACzD,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,CAAC;gBAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACvE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBACtB,sCAAsC;gBACtC,MAAM,YAAY,GAAa,EAAE,CAAC;gBAClC,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;oBAChC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBAC3C,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;wBAC/C,MAAM,OAAO,GACX,GAAG,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC;4BACxB,GAAG,EAAE,eAAe,EAAE,CAAC,GAAG,CAAC;4BAC3B,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG,CAAC;4BAC5B,GAAG,CAAC;wBACN,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;oBACtE,CAAC;gBACH,CAAC;gBACD,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,YAAY,CAClB,GAAG,GAAG,kBAAkB,OAAO,CAAC,IAAI,WAAW,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE;oBACD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,aAAa,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;oBACnB,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB,OAAO,eAAe,OAAO,CAAC,IAAI,QAAQ;oBAClE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,KAAgB;IACrD,MAAM,MAAM,GAAiB,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAExE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEzD,MAAM,WAAW,GAAG,KAAK,IAAI,YAAY,EAAE,CAAC;QAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAE5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,WAAW,GAAG,mBAAmB,CAAC;QACxC,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,0DAA0D;QAC1D,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAE3D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QAEvC,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,yFAAyF;gBACzF,8DAA8D;gBAC9D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACpC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAEvC,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAE9C,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;oBACnC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,cAAc;wBAAE,MAAM;oBAEtD,kDAAkD;oBAClD,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;4BAC5C,CAAC,CAAC,WAAW;4BACb,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;wBACrC,IAAI,QAAQ,KAAK,SAAS;4BAAE,SAAS;oBACvC,CAAC;oBAED,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;oBACnC,IAAI,CAAC,GAAG;wBAAE,SAAS;oBAEnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBACtC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,cAAc;4BAAE,MAAM;wBAEtD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;wBACtB,IAAI,CAAC,IAAI;4BAAE,SAAS;wBAEpB,IAAI,OAAO,GAAG,KAAK,CAAC;wBAEpB,IAAI,UAAU,EAAE,CAAC;4BACf,8DAA8D;4BAC9D,oDAAoD;4BACpD,IACE,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;gCAC7B,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oCACxC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EACjF,CAAC;gCACD,OAAO,GAAG,IAAI,CAAC;4BACjB,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,6DAA6D;4BAC7D,4DAA4D;4BAC5D,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;4BACjE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gCACxB,OAAO,GAAG,IAAI,CAAC;4BACjB,CAAC;wBACH,CAAC;wBAED,IAAI,OAAO,EAAE,CAAC;4BACZ,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;4BAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;4BACrC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gCACrB,IAAI;gCACJ,IAAI,EAAE,OAAO;gCACb,IAAI,EAAE,CAAC,GAAG,CAAC;6BACZ,CAAC,CAAC;4BAEH,wCAAwC;4BACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;4BAChD,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;wBACzC,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,+CAA+C;YACjD,CAAC;QACH,CAAC;QAED,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,2CAA2C;AAC3C,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/core/knowledge/index.d.ts

@@ -0,0 +1,74 @@
+/**
+ * knowledge/index.ts — Portfolio Knowledge Index (M25)
+ *
+ * INVARIANTS (non-negotiable):
+ *  1. LOCAL-ONLY: embeddings run against local Ollama only. Never send chunks
+ *     to a cloud endpoint — this file has no allowCloud path at all.
+ *  2. READ-ONLY: never mutates any enrolled repo. Writes go to knowledgeDir()
+ *     only (~/.ashlr/knowledge/<repo-hash>/).
+ *  3. ENROLLMENT-SCOPED: default repo set is listEnrolled() (DEFAULT EMPTY →
+ *     returns {repos:0, chunks:0}; never scans arbitrary paths).
+ *  4. BOUNDED: caps file count, total bytes read, and wall-clock time per repo;
+ *     skips node_modules / .git / dist / build / binaries / lockfiles.
+ *  5. NO SECRETS: skips .env* / *.pem / *.key / *.p12 files outright; scrubs
+ *     secret-shaped tokens from chunk text before storing or embedding.
+ *  6. INCREMENTAL: re-indexes only files whose mtime > last index timestamp.
+ *     Never throws — all errors are silently swallowed per the contract.
+ */
+import type { KnowledgeChunk } from '../types.js';
+/**
+ * Patterns for secret-shaped tokens: API keys, JWTs, long hex/base64 strings.
+ * Applied to chunk text before storing or embedding.
+ *
+ * EXPORTED (read-only) so the `ashlr verify-safety` self-check (H4) can run the
+ * REAL pattern set against a synthesized secret rather than a drifting private
+ * copy. Treat as a frozen constant — callers must never mutate it.
+ */
+export declare const SECRET_PATTERNS: RegExp[];
+/**
+ * Scrub secret-shaped tokens from a chunk of text. Returns sanitized text.
+ *
+ * EXPORTED (pure, read-only) so the H4 `ashlr verify-safety` self-check can
+ * invoke the REAL redaction function — not a copy — against a synthesized
+ * secret, so any weakening of the function body (or its pattern set) is caught.
+ */
+export declare function scrubSecrets(text: string): string;
+/** Root on-disk directory for the knowledge index: ~/.ashlr/knowledge */
+export declare function knowledgeDir(): string;
+/**
+ * Load persisted knowledge chunks, optionally scoped to one repo (absolute path).
+ * Returns [] when nothing is indexed or on any read error.
+ * NEVER scans repo source — reads only the persisted index under knowledgeDir().
+ */
+export declare function loadChunks(repo?: string): KnowledgeChunk[];
+/**
+ * Build (or incrementally update) the knowledge index for enrolled repos.
+ *
+ * - `opts.repos`: explicit repo list; defaults to `listEnrolled()` (DEFAULT EMPTY).
+ * - `opts.allowCloud`: ignored here — this file is LOCAL-ONLY. Cloud flag is
+ *   only meaningful in ask.ts for synthesis; indexing is always local.
+ *
+ * Guarantees:
+ *  - Never mutates any enrolled repo (writes only to knowledgeDir()).
+ *  - Skips secret files; scrubs secret tokens from chunk text.
+ *  - Incremental: re-indexes only files changed since last run (by mtime).
+ *  - Bounded: file count, byte, and time caps per repo.
+ *  - Never throws.
+ */
+/** M32: per-repo progress event emitted by buildKnowledge (best-effort). */
+export interface KnowledgeProgress {
+    repo: string;
+    repoIndex: number;
+    repoCount: number;
+    newChunks: number;
+}
+export declare function buildKnowledge(opts?: {
+    repos?: string[];
+    allowCloud?: boolean;
+    /** M32: called after each repo finishes indexing. Wrapped — a throwing
+     * callback can never violate buildKnowledge's never-throws contract. */
+    onProgress?: (ev: KnowledgeProgress) => void;
+}): Promise<{
+    repos: number;
+    chunks: number;
+}>;