@ashlr/hub 2.2.0

package/dist/core/quality/fixes.js

@@ -0,0 +1,209 @@
+/**
+ * fixes.ts — Deterministic advisory SAFE FIXES + PROPOSAL emission (M27).
+ *
+ * HARD SAFETY INVARIANTS (enforced throughout this file):
+ *  - PROPOSAL-ONLY: emitFixProposals routes each SafeFix to the M23 Approval
+ *    Inbox via createProposal() as a PENDING proposal (status 'pending', NEVER
+ *    auto-advanced/applied). The default proposal kind is 'note' (advisory, no
+ *    diff), origin 'manual'.
+ *  - READ-ONLY / NO MUTATION: deriveSafeFixes is a pure function of a
+ *    HealthScore. NEITHER function writes to a user repo, writes CONFIG, pushes,
+ *    opens a PR, or deploys. There is NO apply path here.
+ *  - OPTIONAL SANDBOX-PATCH (STRETCH, documented only): if a deterministic fix
+ *    diff is ever generated, it MUST be produced in an M21 sandbox worktree
+ *    (src/core/sandbox/*) and attached to a PENDING 'patch' proposal — NEVER
+ *    written to the real tree, NEVER pushed. The DEFAULT is advisory 'note's.
+ *  - Bounded: caps fixes emitted per run. Never throws (createProposal best-effort).
+ *  - No secrets: SafeFix / proposal fields are advisory metadata only.
+ */
+import { createProposal } from '../inbox/store.js';
+// ---------------------------------------------------------------------------
+// Bounds
+// ---------------------------------------------------------------------------
+/** Hard cap on advisory fixes derived per repo (bounds inbox noise). */
+const MAX_FIXES_PER_REPO = 10;
+/** Max worst-offenders to mine for fixes (defensive — worstOffenders is already capped upstream). */
+const MAX_OFFENDERS_SCANNED = 20;
+// ---------------------------------------------------------------------------
+// Convention probe -> advisory fix mapping
+// ---------------------------------------------------------------------------
+/**
+ * Deterministic mapping from a FAILED ConventionFinding.key to the advisory
+ * fix it implies. Each entry yields a stable SafeFix.key, the dimension the fix
+ * improves, and a short title. The rationale is composed from the probe's own
+ * (already secret-free) detail at derive time. Keys not present here are
+ * skipped — we only advise fixes we can phrase concretely.
+ */
+const CONVENTION_FIXES = {
+    license: { key: 'docs.add-license', dimension: 'docs', title: 'Add a LICENSE file' },
+    readme: { key: 'docs.add-readme', dimension: 'docs', title: 'Add or expand the README' },
+    gitignore: {
+        key: 'conventions.add-gitignore',
+        dimension: 'conventions',
+        title: 'Add a .gitignore',
+    },
+    lockfile: {
+        key: 'conventions.add-lockfile',
+        dimension: 'conventions',
+        title: 'Commit a dependency lockfile',
+    },
+    ci: { key: 'conventions.add-ci', dimension: 'conventions', title: 'Add a CI workflow' },
+    testdir: { key: 'tests.add-test', dimension: 'tests', title: 'Add a test suite' },
+};
+// ---------------------------------------------------------------------------
+// WorkItem (worst-offender) -> advisory fix mapping
+// ---------------------------------------------------------------------------
+/** Deterministic, key-safe slug of an arbitrary title (bounded length). */
+function slug(s) {
+    return s
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48);
+}
+/**
+ * Map a worst-offender WorkItem onto a SafeFix when it represents an actionable,
+ * concretely-phraseable gap (vulnerable/stale dep, missing test, high TODO debt).
+ * Returns null for sources we cannot phrase a safe deterministic advisory for
+ * (e.g. open issues, security findings — surfaced in the report, not auto-noted).
+ *
+ * Deterministic; the per-item `key` is namespaced by source so distinct findings
+ * dedupe independently (e.g. one fix per vulnerable dependency).
+ */
+function fixFromOffender(item) {
+    switch (item.source) {
+        case 'dep':
+            return {
+                repo: item.repo,
+                dimension: 'deps',
+                key: `deps.upgrade:${slug(item.title)}`,
+                title: `Update dependency: ${item.title}`,
+                rationale: `A dependency finding is dragging the deps score down: ${item.detail}`,
+                proposalKind: 'note',
+            };
+        case 'test':
+            return {
+                repo: item.repo,
+                dimension: 'tests',
+                key: `tests.add-test:${slug(item.title)}`,
+                title: `Add test coverage: ${item.title}`,
+                rationale: `A test gap is lowering the tests score: ${item.detail}`,
+                proposalKind: 'note',
+            };
+        case 'todo':
+            return {
+                repo: item.repo,
+                dimension: 'codeDebt',
+                key: `codeDebt.resolve:${slug(item.title)}`,
+                title: `Resolve code-debt marker: ${item.title}`,
+                rationale: `An accumulating TODO/FIXME marker is adding code debt: ${item.detail}`,
+                proposalKind: 'note',
+            };
+        default:
+            // issue / doc / security offenders are reported but not auto-noted as fixes
+            // here — they map onto convention probes (docs) or are advisory-only signals.
+            return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// deriveSafeFixes — pure, deterministic
+// ---------------------------------------------------------------------------
+/**
+ * Derive deterministic, advisory SafeFix[] from a per-repo HealthScore.
+ *
+ * Walks the score's failed convention probes (ok === false) and worst offenders,
+ * mapping each actionable, concretely-phraseable gap into an advisory SafeFix:
+ *  - missing LICENSE      -> { dimension:'docs',        key:'docs.add-license' }
+ *  - missing README       -> { dimension:'docs',        key:'docs.add-readme' }
+ *  - missing .gitignore   -> { dimension:'conventions', key:'conventions.add-gitignore' }
+ *  - missing lockfile/CI  -> { dimension:'conventions', key:'conventions.add-{lockfile,ci}' }
+ *  - vulnerable/stale dep  -> { dimension:'deps',        key:'deps.upgrade:<pkg>' }
+ *  - missing test          -> { dimension:'tests',       key:'tests.add-test[:…]' }
+ *  - high TODO debt        -> { dimension:'codeDebt',    key:'codeDebt.resolve:…' }
+ *
+ * Pure function (no I/O), deterministic ordering, deduped by `key`, bounded to
+ * MAX_FIXES_PER_REPO. Every SafeFix defaults to proposalKind 'note' (advisory).
+ * NEVER mutates anything.
+ */
+export function deriveSafeFixes(score) {
+    const repo = score.repo;
+    // Insertion-ordered dedupe by key. Convention fixes are collected first
+    // (highest-leverage, lowest-effort gaps), then offender-derived fixes.
+    const byKey = new Map();
+    // 1) Failed convention probes -> known advisory fixes.
+    for (const finding of score.conventions) {
+        if (finding.ok)
+            continue;
+        const mapped = CONVENTION_FIXES[finding.key];
+        if (mapped === undefined)
+            continue;
+        if (byKey.has(mapped.key))
+            continue;
+        byKey.set(mapped.key, {
+            repo,
+            dimension: mapped.dimension,
+            key: mapped.key,
+            title: mapped.title,
+            rationale: finding.detail || `${finding.label} convention is not satisfied.`,
+            proposalKind: 'note',
+        });
+    }
+    // 2) Worst-offender WorkItems -> per-finding advisory fixes.
+    const offenders = score.worstOffenders.slice(0, MAX_OFFENDERS_SCANNED);
+    for (const item of offenders) {
+        const fix = fixFromOffender(item);
+        if (fix === null)
+            continue;
+        if (byKey.has(fix.key))
+            continue;
+        byKey.set(fix.key, fix);
+    }
+    // Deterministic ordering: convention fixes lead (insertion order); offender
+    // fixes preserve the upstream worst-first ordering of worstOffenders.
+    return [...byKey.values()].slice(0, MAX_FIXES_PER_REPO);
+}
+// ---------------------------------------------------------------------------
+// emitFixProposals — PENDING inbox proposals (PROPOSAL-ONLY)
+// ---------------------------------------------------------------------------
+/**
+ * Emit each SafeFix as a PENDING M23 Approval Inbox proposal.
+ *
+ * For each fix: createProposal({ repo, origin: 'manual', kind: 'note', title,
+ * summary }) — status is assigned 'pending' BY THE STORE and NEVER auto-advanced.
+ * Default kind is 'note' (advisory, no diff). M27 does NOT apply patches and does
+ * NOT mutate working trees here; this module advances no proposal status, pushes
+ * nothing, opens no PR, and deploys nothing — createProposal() is its ONLY effect.
+ *
+ * (STRETCH, NOT wired by default) A fix with proposalKind 'patch' would require
+ * generating its diff in an M21 sandbox worktree and attaching it as a PENDING
+ * 'patch' proposal with the sandboxId — never written to the real tree. This
+ * build emits NOTES ONLY; any 'patch'-kind SafeFix is downgraded to a 'note'
+ * proposal here (no diff is produced), keeping the inbox advisory.
+ *
+ * Returns the created Proposal[] (pending). Never throws (createProposal is
+ * best-effort and returns the in-memory proposal even on persistence failure).
+ */
+export function emitFixProposals(fixes) {
+    const proposals = [];
+    for (const fix of fixes) {
+        try {
+            const proposal = createProposal({
+                repo: fix.repo,
+                origin: 'manual',
+                // NOTES-ONLY in this build: never attach a diff, never request 'patch'
+                // application. A 'patch' SafeFix is recorded as an advisory note here.
+                kind: 'note',
+                title: `[health] ${fix.title}`,
+                summary: `${fix.rationale}\n\n` +
+                    `Dimension: ${fix.dimension} · fix-key: ${fix.key} · repo: ${fix.repo}\n` +
+                    `Advisory only — review and apply manually. This proposal mutates nothing.`,
+            });
+            proposals.push(proposal);
+        }
+        catch {
+            // Best-effort: a single createProposal failure must not abort the batch.
+        }
+    }
+    return proposals;
+}
+//# sourceMappingURL=fixes.js.map

package/dist/core/quality/fixes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixes.js","sourceRoot":"","sources":["../../../src/core/quality/fixes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,qGAAqG;AACrG,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,gBAAgB,GAGlB;IACF,OAAO,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACpF,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACxF,SAAS,EAAE;QACT,GAAG,EAAE,2BAA2B;QAChC,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,kBAAkB;KAC1B;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,0BAA0B;QAC/B,SAAS,EAAE,aAAa;QACxB,KAAK,EAAE,8BAA8B;KACtC;IACD,EAAE,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACvF,OAAO,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE;CAClF,CAAC;AAEF,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,2EAA2E;AAC3E,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC;SACL,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,IAAc;IACrC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,MAAM;gBACjB,GAAG,EAAE,gBAAgB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBACvC,KAAK,EAAE,sBAAsB,IAAI,CAAC,KAAK,EAAE;gBACzC,SAAS,EAAE,yDAAyD,IAAI,CAAC,MAAM,EAAE;gBACjF,YAAY,EAAE,MAAM;aACrB,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,OAAO;gBAClB,GAAG,EAAE,kBAAkB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBACzC,KAAK,EAAE,sBAAsB,IAAI,CAAC,KAAK,EAAE;gBACzC,SAAS,EAAE,2CAA2C,IAAI,CAAC,MAAM,EAAE;gBACnE,YAAY,EAAE,MAAM;aACrB,CAAC;QACJ,KAAK,MAAM;YACT,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,UAAU;gBACrB,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;gBAC3C,KAAK,EAAE,6BAA6B,IAAI,CAAC,KAAK,EAAE;gBAChD,SAAS,EAAE,0DAA0D,IAAI,CAAC,MAAM,EAAE;gBAClF,YAAY,EAAE,MAAM;aACrB,CAAC;QACJ;YACE,4EAA4E;YAC5E,8EAA8E;YAC9E,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEzC,uDAAuD;IACvD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,EAAE;YAAE,SAAS;QACzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;YACpB,IAAI;YACJ,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,+BAA+B;YAC5E,YAAY,EAAE,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACvE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgB;IAC/C,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,cAAc,CAAC;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,QAAQ;gBAChB,uEAAuE;gBACvE,uEAAuE;gBACvE,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,YAAY,GAAG,CAAC,KAAK,EAAE;gBAC9B,OAAO,EACL,GAAG,GAAG,CAAC,SAAS,MAAM;oBACtB,cAAc,GAAG,CAAC,SAAS,eAAe,GAAG,CAAC,GAAG,YAAY,GAAG,CAAC,IAAI,IAAI;oBACzE,2EAA2E;aAC9E,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/core/quality/health.d.ts

@@ -0,0 +1,69 @@
+/**
+ * health.ts — Deterministic per-repo + portfolio HEALTH SCORING (M27).
+ *
+ * HARD SAFETY INVARIANTS (enforced throughout this file):
+ *  - READ-ONLY: composes the six M22 read-only scanners (SCANNERS) + the
+ *    read-only convention probes. WRITES NOTHING here (the quality store owns
+ *    ~/.ashlr/quality snapshots; the CLI owns proposals). NEVER mutates a repo.
+ *  - ENROLLMENT-SCOPED: computeReport defaults its repo set to listEnrolled()
+ *    (DEFAULT EMPTY => empty report, no disk scan). When an explicit `repos`
+ *    list is supplied, EACH entry is filtered through isEnrolled() (resolve()
+ *    first) and a non-enrolled path HARD-ERRORS. This closes the exact gap the
+ *    M25 review caught — enforced at the CORE layer here AND again at the CLI.
+ *  - LOCAL-FIRST / NO LLM: scoring is deterministic and uses NO model. M27
+ *    ships no LLM narrative path, so this module makes zero connections beyond
+ *    what the M22 scanners already do.
+ *  - BOUNDED: reuses the scanners' built-in bounds; caps repos per run
+ *    (maxRepos) and worst-offenders per repo. No unbounded loops.
+ *  - Never throws on a per-repo basis: a scanner failure yields [] (scanner
+ *    contract); computeHealth additionally guards each scanner so a single
+ *    rejection degrades that dimension to a neutral/penalized state with a
+ *    note rather than crashing the whole report. computeReport surfaces an
+ *    enrollment violation as a hard error (the only intentional throw).
+ */
+import type { HealthOptions, HealthReport, HealthScore } from '../types.js';
+/**
+ * Map a 0..100 score to a letter grade: A>=90, B>=80, C>=70, D>=60, else F.
+ * Exported so the report layer derives the average grade with the same rule.
+ */
+export declare function gradeFor(score: number): HealthScore['grade'];
+/**
+ * Compute the per-repo HealthScore for `repo` (an absolute path).
+ *
+ * Runs all six SCANNERS (in parallel; each individually bounded + never throws)
+ * plus probeConventions(repo), maps their outputs onto the HealthDimensions,
+ * scores each dimension 0..100, rolls them up into a weighted overall 0..100 +
+ * letter grade, and records the worst offenders (highest WorkItem.score),
+ * bounded to MAX_WORST_OFFENDERS.
+ *
+ * Deterministic, READ-ONLY, NO LLM. Never mutates `repo`. Never throws on a
+ * scanner/probe failure (it degrades to a neutral/penalized dimension with a
+ * note); the ONLY intentional throw is the enrollment guard below.
+ *
+ * ENROLLMENT-SCOPED (CORE layer, invariant #2): this per-repo entry point
+ * self-defends — `repo` is resolve()'d and filtered through isEnrolled(), and a
+ * NON-ENROLLED path HARD-ERRORS before any disk scan. This is defense-in-depth
+ * matching computeReport: the CLI already gates the positional --repo, and
+ * computeReport already filters via isEnrolled before calling here, so enrolled
+ * callers pass through unaffected. The guard closes the single-layer gap class
+ * the M25 review caught (the M27 contract requires enrollment at BOTH layers).
+ */
+export declare function computeHealth(repo: string): Promise<HealthScore>;
+/**
+ * Compute the portfolio-wide HealthReport over enrolled repos.
+ *
+ * Repo selection:
+ *  - opts.repos omitted   => listEnrolled() (DEFAULT EMPTY => empty report; NO
+ *                            disk scan when nothing is enrolled).
+ *  - opts.repos provided  => EACH entry is resolve()'d and filtered through
+ *                            isEnrolled(); a NON-ENROLLED path HARD-ERRORS
+ *                            (throws) — never silently scanned. (M25 lesson.)
+ *
+ * Bounded by opts.maxRepos (default DEFAULT_MAX_REPOS). Scores each selected
+ * repo via computeHealth (sequentially, mirroring buildBacklog to avoid a
+ * gh/npm thundering-herd), ranks worst-first, computes averageScore/grade, and
+ * leaves `delta` for the store/CLI layer to fill from loadPreviousReport().
+ *
+ * Deterministic, READ-ONLY, NO LLM. Never mutates any repo.
+ */
+export declare function computeReport(opts?: HealthOptions): Promise<HealthReport>;

package/dist/core/quality/health.js

@@ -0,0 +1,350 @@
+/**
+ * health.ts — Deterministic per-repo + portfolio HEALTH SCORING (M27).
+ *
+ * HARD SAFETY INVARIANTS (enforced throughout this file):
+ *  - READ-ONLY: composes the six M22 read-only scanners (SCANNERS) + the
+ *    read-only convention probes. WRITES NOTHING here (the quality store owns
+ *    ~/.ashlr/quality snapshots; the CLI owns proposals). NEVER mutates a repo.
+ *  - ENROLLMENT-SCOPED: computeReport defaults its repo set to listEnrolled()
+ *    (DEFAULT EMPTY => empty report, no disk scan). When an explicit `repos`
+ *    list is supplied, EACH entry is filtered through isEnrolled() (resolve()
+ *    first) and a non-enrolled path HARD-ERRORS. This closes the exact gap the
+ *    M25 review caught — enforced at the CORE layer here AND again at the CLI.
+ *  - LOCAL-FIRST / NO LLM: scoring is deterministic and uses NO model. M27
+ *    ships no LLM narrative path, so this module makes zero connections beyond
+ *    what the M22 scanners already do.
+ *  - BOUNDED: reuses the scanners' built-in bounds; caps repos per run
+ *    (maxRepos) and worst-offenders per repo. No unbounded loops.
+ *  - Never throws on a per-repo basis: a scanner failure yields [] (scanner
+ *    contract); computeHealth additionally guards each scanner so a single
+ *    rejection degrades that dimension to a neutral/penalized state with a
+ *    note rather than crashing the whole report. computeReport surfaces an
+ *    enrollment violation as a hard error (the only intentional throw).
+ */
+import { resolve } from 'node:path';
+import { SCANNERS } from '../portfolio/scanners.js';
+import { isEnrolled, listEnrolled } from '../sandbox/policy.js';
+import { probeConventions } from './conventions.js';
+// ---------------------------------------------------------------------------
+// Bounds / weights
+// ---------------------------------------------------------------------------
+/** Hard cap on repos scored per run (bounds work). */
+const DEFAULT_MAX_REPOS = 100;
+/** Cap on worst-offender WorkItems retained per repo. */
+const MAX_WORST_OFFENDERS = 5;
+/**
+ * Relative weights for the overall 0..100 roll-up. Deterministic; sums are
+ * normalized at compute time so they need not total 100 here.
+ */
+const DIMENSION_WEIGHTS = {
+    tests: 20,
+    docs: 10,
+    deps: 15,
+    security: 25,
+    codeDebt: 10,
+    issuesCi: 10,
+    conventions: 10,
+};
+/** Stable, deterministic order the dimensions are reported in. */
+const DIMENSION_ORDER = [
+    'tests',
+    'docs',
+    'deps',
+    'security',
+    'codeDebt',
+    'issuesCi',
+    'conventions',
+];
+/**
+ * Maps each scanner's WorkSource onto the HealthDimension it feeds.
+ *   issue    -> issuesCi   (open GitHub issues + CI signal)
+ *   todo     -> codeDebt   (TODO/FIXME/HACK/XXX markers)
+ *   test     -> tests      (test-script presence + CI state)
+ *   dep      -> deps       (freshness + npm-audit vulnerabilities)
+ *   doc      -> docs       (README/LICENSE/CONTRIBUTING presence + thinness)
+ *   security -> security   (binshield findings)
+ * The seventh dimension, `conventions`, is fed by probeConventions (not a
+ * WorkSource), so it is intentionally absent from this map.
+ */
+const SOURCE_TO_DIMENSION = {
+    issue: 'issuesCi',
+    todo: 'codeDebt',
+    test: 'tests',
+    dep: 'deps',
+    doc: 'docs',
+    security: 'security',
+    plugin: 'codeDebt', // M33: plugin items map to codeDebt dimension (best-fit)
+};
+/**
+ * Per-finding penalty applied to a dimension's 0..100 score. A WorkItem's
+ * `value` field is a 1..5 severity proxy (5 = critical); we map it to a point
+ * penalty so more/severe findings drive the dimension score down deterministically.
+ */
+function findingPenalty(item) {
+    // value 1..5 (clamped by the scanners). Penalty grows with severity:
+    // 1->6, 2->12, 3->18, 4->24, 5->30 points. Deterministic.
+    const v = Math.max(1, Math.min(5, Math.round(item.value)));
+    return v * 6;
+}
+/**
+ * Penalty for a FAILED convention probe (ok=false), weighted 1..5. A higher
+ * `weight` means a more important miss. Mirrors findingPenalty's scale.
+ */
+function conventionPenalty(weight) {
+    const w = Math.max(1, Math.min(5, Math.round(weight)));
+    return w * 6;
+}
+// ---------------------------------------------------------------------------
+// Grade derivation (deterministic)
+// ---------------------------------------------------------------------------
+/**
+ * Map a 0..100 score to a letter grade: A>=90, B>=80, C>=70, D>=60, else F.
+ * Exported so the report layer derives the average grade with the same rule.
+ */
+export function gradeFor(score) {
+    if (score >= 90)
+        return 'A';
+    if (score >= 80)
+        return 'B';
+    if (score >= 70)
+        return 'C';
+    if (score >= 60)
+        return 'D';
+    return 'F';
+}
+// ---------------------------------------------------------------------------
+// Scanner orchestration (bounded, never-throws-per-scanner)
+// ---------------------------------------------------------------------------
+/**
+ * Run all six SCANNERS over `repo` in parallel. Each scanner is bounded and
+ * never-throws by the M22 contract, but we additionally guard each one so a
+ * single rejection degrades to [] rather than crashing the whole report.
+ *
+ * We attribute a rejection to the dimension it would have fed (by scanner
+ * position in SCANNERS) so that dimension can be conservatively penalized +
+ * annotated rather than appearing falsely healthy. Returns the flattened
+ * WorkItem[] plus the set of WorkSources whose scanner failed outright.
+ */
+async function runScanners(repo) {
+    const settled = await Promise.allSettled(SCANNERS.map((s) => s(repo)));
+    const items = [];
+    const failedSources = new Set();
+    // SCANNERS order is fixed (M22): [issues, todos, tests, deps, docs, security].
+    const ORDER = ['issue', 'todo', 'test', 'dep', 'doc', 'security'];
+    settled.forEach((result, idx) => {
+        if (result.status === 'fulfilled' && Array.isArray(result.value)) {
+            for (const it of result.value)
+                items.push(it);
+        }
+        else if (result.status === 'rejected') {
+            const src = ORDER[idx];
+            if (src !== undefined)
+                failedSources.add(src);
+        }
+    });
+    return { items, failedSources };
+}
+// ---------------------------------------------------------------------------
+// Dimension scoring (deterministic)
+// ---------------------------------------------------------------------------
+/**
+ * Score one dimension 0..100 from its feeding WorkItems (and, for the
+ * `conventions` dimension, its failed convention probes). The dimension starts
+ * perfect (100) and is reduced by a deterministic penalty per finding, floored
+ * at 0. Deterministic and pure.
+ */
+function scoreDimension(dimension, items, conventionPenaltyTotal, failed, conventionGapCount) {
+    const weight = DIMENSION_WEIGHTS[dimension];
+    let penalty = conventionPenaltyTotal;
+    for (const it of items)
+        penalty += findingPenalty(it);
+    // A scanner that failed outright is treated as a small fixed penalty + note,
+    // not a perfect score (we can't prove the dimension is clean).
+    if (failed)
+        penalty += 10;
+    const score = Math.max(0, Math.min(100, 100 - penalty));
+    // The `conventions` dimension is fed by probeConventions (not WorkItems), so
+    // its finding count is the failed-probe count, not items.length (which is 0).
+    const findingCount = dimension === 'conventions' ? conventionGapCount : items.length;
+    let summary;
+    if (failed) {
+        summary = `scanner unavailable — scored conservatively (${score}/100)`;
+    }
+    else if (findingCount === 0 && conventionPenaltyTotal === 0) {
+        summary = 'no findings — healthy';
+    }
+    else if (dimension === 'conventions') {
+        summary = `${findingCount} convention gap(s) — ${score}/100`;
+    }
+    else {
+        summary = `${findingCount} finding(s) — ${score}/100`;
+    }
+    return { dimension, score, weight, findingCount, summary };
+}
+// ---------------------------------------------------------------------------
+// computeHealth — per-repo
+// ---------------------------------------------------------------------------
+/**
+ * Compute the per-repo HealthScore for `repo` (an absolute path).
+ *
+ * Runs all six SCANNERS (in parallel; each individually bounded + never throws)
+ * plus probeConventions(repo), maps their outputs onto the HealthDimensions,
+ * scores each dimension 0..100, rolls them up into a weighted overall 0..100 +
+ * letter grade, and records the worst offenders (highest WorkItem.score),
+ * bounded to MAX_WORST_OFFENDERS.
+ *
+ * Deterministic, READ-ONLY, NO LLM. Never mutates `repo`. Never throws on a
+ * scanner/probe failure (it degrades to a neutral/penalized dimension with a
+ * note); the ONLY intentional throw is the enrollment guard below.
+ *
+ * ENROLLMENT-SCOPED (CORE layer, invariant #2): this per-repo entry point
+ * self-defends — `repo` is resolve()'d and filtered through isEnrolled(), and a
+ * NON-ENROLLED path HARD-ERRORS before any disk scan. This is defense-in-depth
+ * matching computeReport: the CLI already gates the positional --repo, and
+ * computeReport already filters via isEnrolled before calling here, so enrolled
+ * callers pass through unaffected. The guard closes the single-layer gap class
+ * the M25 review caught (the M27 contract requires enrollment at BOTH layers).
+ */
+export async function computeHealth(repo) {
+    const abs = resolve(repo);
+    // CORE-layer enrollment guard (invariant #2): never disk-scan a non-enrolled
+    // path, no matter which caller reaches here. HARD-ERROR before any scanner runs.
+    if (!isEnrolled(abs)) {
+        throw new Error(`repo not enrolled for health review: ${abs}`);
+    }
+    // Read-only scanner sweep + convention probe (both never-throw-guarded).
+    const { items, failedSources } = await runScanners(abs);
+    let conventions;
+    try {
+        conventions = probeConventions(abs);
+    }
+    catch {
+        conventions = [];
+    }
+    // Bucket WorkItems by their feeding dimension.
+    const byDimension = new Map();
+    for (const dim of DIMENSION_ORDER)
+        byDimension.set(dim, []);
+    for (const it of items) {
+        const dim = SOURCE_TO_DIMENSION[it.source];
+        // Unknown/foreign source -> ignore (defensive; the union is closed).
+        if (dim === undefined)
+            continue;
+        byDimension.get(dim).push(it);
+    }
+    // The `conventions` dimension penalty + gap count: derived from failed probes.
+    let conventionPenaltyTotal = 0;
+    let conventionGapCount = 0;
+    for (const finding of conventions) {
+        if (!finding.ok) {
+            conventionPenaltyTotal += conventionPenalty(finding.weight);
+            conventionGapCount += 1;
+        }
+    }
+    // Score every dimension (stable order).
+    const dimensions = DIMENSION_ORDER.map((dim) => {
+        const dimItems = byDimension.get(dim) ?? [];
+        const isConventions = dim === 'conventions';
+        return scoreDimension(dim, dimItems, isConventions ? conventionPenaltyTotal : 0, isConventions ? false : failedSources.has(dimensionToSource(dim)), isConventions ? conventionGapCount : 0);
+    });
+    // Weighted roll-up into the overall 0..100 (weights normalized at compute time).
+    const totalWeight = dimensions.reduce((acc, d) => acc + d.weight, 0);
+    const weightedSum = dimensions.reduce((acc, d) => acc + d.score * d.weight, 0);
+    const overall = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 0;
+    // Worst offenders: highest WorkItem.score first; deterministic tiebreak by id.
+    const worstOffenders = [...items]
+        .sort((a, b) => (b.score - a.score) || a.id.localeCompare(b.id))
+        .slice(0, MAX_WORST_OFFENDERS);
+    return {
+        repo: abs,
+        score: overall,
+        grade: gradeFor(overall),
+        dimensions,
+        conventions,
+        worstOffenders,
+        ts: new Date().toISOString(),
+    };
+}
+/**
+ * Inverse of SOURCE_TO_DIMENSION for the six WorkSource-backed dimensions.
+ * Only called for non-`conventions` dimensions (conventions has no backing
+ * WorkSource), so the default branch is unreachable in practice.
+ */
+function dimensionToSource(dimension) {
+    switch (dimension) {
+        case 'issuesCi':
+            return 'issue';
+        case 'codeDebt':
+            return 'todo';
+        case 'tests':
+            return 'test';
+        case 'deps':
+            return 'dep';
+        case 'docs':
+            return 'doc';
+        case 'security':
+        case 'conventions':
+        default:
+            return 'security';
+    }
+}
+// ---------------------------------------------------------------------------
+// computeReport — portfolio-wide
+// ---------------------------------------------------------------------------
+/**
+ * Compute the portfolio-wide HealthReport over enrolled repos.
+ *
+ * Repo selection:
+ *  - opts.repos omitted   => listEnrolled() (DEFAULT EMPTY => empty report; NO
+ *                            disk scan when nothing is enrolled).
+ *  - opts.repos provided  => EACH entry is resolve()'d and filtered through
+ *                            isEnrolled(); a NON-ENROLLED path HARD-ERRORS
+ *                            (throws) — never silently scanned. (M25 lesson.)
+ *
+ * Bounded by opts.maxRepos (default DEFAULT_MAX_REPOS). Scores each selected
+ * repo via computeHealth (sequentially, mirroring buildBacklog to avoid a
+ * gh/npm thundering-herd), ranks worst-first, computes averageScore/grade, and
+ * leaves `delta` for the store/CLI layer to fill from loadPreviousReport().
+ *
+ * Deterministic, READ-ONLY, NO LLM. Never mutates any repo.
+ */
+export async function computeReport(opts) {
+    const maxRepos = Math.max(0, opts?.maxRepos ?? DEFAULT_MAX_REPOS);
+    // Enrollment-scoped repo selection (CORE-layer enforcement of invariant #2).
+    let repos;
+    if (opts?.repos !== undefined) {
+        repos = [];
+        for (const r of opts.repos) {
+            const abs = resolve(r);
+            if (!isEnrolled(abs)) {
+                // HARD-ERROR — never silently scan a non-enrolled path.
+                throw new Error(`repo not enrolled for health review: ${abs}`);
+            }
+            repos.push(abs);
+        }
+    }
+    else {
+        repos = listEnrolled();
+    }
+    // Bound work: never score more than maxRepos in a single run.
+    const scoped = repos.slice(0, maxRepos);
+    // Score sequentially (mirrors buildBacklog — avoids a gh/npm thundering-herd).
+    const scores = [];
+    for (const r of scoped) {
+        scores.push(await computeHealth(r));
+    }
+    // Rank worst-first (ascending overall score); deterministic tiebreak by path.
+    scores.sort((a, b) => (a.score - b.score) || a.repo.localeCompare(b.repo));
+    const averageScore = scores.length > 0
+        ? Math.round(scores.reduce((acc, s) => acc + s.score, 0) / scores.length)
+        : 0;
+    return {
+        generatedAt: new Date().toISOString(),
+        repos: scoped,
+        scores,
+        averageScore,
+        averageGrade: gradeFor(averageScore),
+        delta: {},
+    };
+}
+//# sourceMappingURL=health.js.map

package/dist/core/quality/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/core/quality/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;GAGG;AACH,MAAM,iBAAiB,GAAoC;IACzD,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAA+B;IAClD,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,aAAa;CACL,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAwC;IAC/D,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,OAAO;IACb,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,UAAU,EAAE,yDAAyD;CAC9E,CAAC;AAEF;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAc;IACpC,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,KAAK,UAAU,WAAW,CACxB,IAAY;IAEZ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAG,IAAI,GAAG,EAAc,CAAC;IAE5C,+EAA+E;IAC/E,MAAM,KAAK,GAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAEzF,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,GAAG,KAAK,SAAS;gBAAE,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;GAKG;AACH,SAAS,cAAc,CACrB,SAA0B,EAC1B,KAAiB,EACjB,sBAA8B,EAC9B,MAAe,EACf,kBAA0B;IAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,sBAAsB,CAAC;IACrC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,OAAO,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC;IAEtD,6EAA6E;IAC7E,+DAA+D;IAC/D,IAAI,MAAM;QAAE,OAAO,IAAI,EAAE,CAAC;IAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;IACxD,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IAErF,IAAI,OAAe,CAAC;IACpB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,GAAG,gDAAgD,KAAK,OAAO,CAAC;IACzE,CAAC;SAAM,IAAI,YAAY,KAAK,CAAC,IAAI,sBAAsB,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,GAAG,uBAAuB,CAAC;IACpC,CAAC;SAAM,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QACvC,OAAO,GAAG,GAAG,YAAY,wBAAwB,KAAK,MAAM,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,YAAY,iBAAiB,KAAK,MAAM,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,6EAA6E;IAC7E,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,yEAAyE;IACzE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IAExD,IAAI,WAAgC,CAAC;IACrC,IAAI,CAAC;QACH,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,+CAA+C;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA+B,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,eAAe;QAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5D,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,mBAAmB,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC3C,qEAAqE;QACrE,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,+EAA+E;IAC/E,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,IAAI,kBAAkB,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,sBAAsB,IAAI,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC5D,kBAAkB,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,UAAU,GAA2B,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,GAAG,KAAK,aAAa,CAAC;QAC5C,OAAO,cAAc,CACnB,GAAG,EACH,QAAQ,EACR,aAAa,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAC1C,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,EACjE,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iFAAiF;IACjF,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,+EAA+E;IAC/E,MAAM,cAAc,GAAe,CAAC,GAAG,KAAK,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC/D,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAEjC,OAAO;QACL,IAAI,EAAE,GAAG;QACT,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;QACxB,UAAU;QACV,WAAW;QACX,cAAc;QACd,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,SAA0B;IACnD,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,OAAO,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,MAAM,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB;YACE,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAoB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,iBAAiB,CAAC,CAAC;IAElE,6EAA6E;IAC7E,IAAI,KAAe,CAAC;IACpB,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,GAAG,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,wDAAwD;gBACxD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,YAAY,EAAE,CAAC;IACzB,CAAC;IAED,8DAA8D;IAC9D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAExC,+EAA+E;IAC/E,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE3E,MAAM,YAAY,GAChB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;QACzE,CAAC,CAAC,CAAC,CAAC;IAER,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK,EAAE,MAAM;QACb,MAAM;QACN,YAAY;QACZ,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC;QACpC,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC"}