@cleocode/core 2026.10.27 → 2026.11.1-canary.3

package/dist/release/authorization.js

@@ -0,0 +1,460 @@
+/**
+ * Standing release authorization (T14141 · owner decisions D11212, D11215).
+ *
+ * `cleo release cut --yes` tags when the person at the terminal types the
+ * version, or when the owner stored a standing authorization covering it (an
+ * agent). A grant is created only through the owner check of
+ * `cleo config owner set` (T13787): not a restricted agent role, a TTY, and the
+ * owner-auth password typed now. It is signed with the enrolled owner key
+ * (`ownerKey`), so an agent cannot forge or widen one without the password.
+ *
+ * ## Storage, anchored twice
+ *
+ * The grant lives in `.cleo/release-authorizations.json` (untracked) AND in
+ * `<cleoHome>/release-authorizations.json` under the project's key. It counts
+ * only when both copies are identical, the signature verifies against the
+ * enrolled key, and the enrollment itself judges `ok`.
+ *
+ * ## Revocation, signed and counted (fail closed)
+ *
+ * Revoking is owner-only like granting (the password signs it). It removes the
+ * grant from both files and appends a signed revocation entry to both, and the
+ * revocation count is sealed in the git-tracked `.cleo/owner-settings.json`.
+ * Every grant also signs the count at issue. If the two revocation lists
+ * differ, an entry is not signed, the list is shorter than the sealed count or
+ * than any grant's count at issue, or the count's seal fails, EVERY grant is
+ * treated as tampered. Restoring old copies of both grant files therefore does
+ * not revive a revoked grant: the sealed count still names the revocation, and
+ * rolling that back too shows in `git status`. As with the override cap, an
+ * agent running as the same OS user can still edit these files: tampering is
+ * detectable (refused, audited, shown by `cleo doctor`), not preventable.
+ *
+ * ## Scope, expiry, uses (D11215)
+ *
+ * Scope `canary`, `prerelease`, `stable` or one exact version; `cut`'s own
+ * version gates (CalVer, above the newest tag) still apply. Expiry is required,
+ * at most 30 days. `uses` is an optional cap; without it the count is only
+ * reported. Uses are counted from the cut audit rows and from the tags whose
+ * message names the grant (`Authorized-by: <id>`), whichever is higher.
+ *
+ * @task T14141
+ * @task T14102
+ */
+import { execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { getCleoHome } from '../paths.js';
+import { judgeOwnerState, ownerCheck, ownerKey, projectKey, provenance, readSealedOwnerSetting, writeSealedOwnerSetting, } from '../security/override-cap-setting.js';
+import { atomicWriteJson } from '../store/atomic.js';
+/** The longest a grant may run (D11215). */
+export const RELEASE_AUTHORIZATION_MAX_DAYS = 30;
+/** Grant/revoke/refusal audit log, relative to the project root. */
+export const RELEASE_AUTHORIZATION_AUDIT_FILE = '.cleo/audit/release-authorizations.jsonl';
+/** The tag-message trailer that names the grant a cut used. */
+export const AUTHORIZED_BY_TRAILER = 'Authorized-by';
+/** The owner-settings key sealing how many grants were ever revoked. */
+export const REVOCATION_COUNT_SETTING = 'release.authorizationRevocations';
+const PROJECT_FILE = join('.cleo', 'release-authorizations.json');
+const CUT_AUDIT_FILE = '.cleo/audit/release-cut.jsonl';
+function globalPath() {
+    return join(getCleoHome(), 'release-authorizations.json');
+}
+function readJson(path, fallback) {
+    try {
+        return existsSync(path) ? JSON.parse(readFileSync(path, 'utf-8')) : fallback;
+    }
+    catch {
+        return fallback;
+    }
+}
+function readProject(projectRoot) {
+    const file = readJson(join(projectRoot, PROJECT_FILE), {});
+    return { schemaVersion: 1, grants: file.grants ?? [], revoked: file.revoked ?? [] };
+}
+function readGlobalAll() {
+    return readJson(globalPath(), {}).projects ?? {};
+}
+function readGlobal(projectRoot) {
+    const record = readGlobalAll()[projectKey(projectRoot)];
+    return { grants: record?.grants ?? [], revoked: record?.revoked ?? [] };
+}
+async function writeGlobal(projectRoot, record) {
+    const all = readGlobalAll();
+    all[projectKey(projectRoot)] = record;
+    await atomicWriteJson(globalPath(), { schemaVersion: 1, projects: all });
+}
+/** The exact bytes a grant's signature covers. */
+function grantPayload(projectRoot, g) {
+    return JSON.stringify({
+        kind: 'release-authorization',
+        project: projectKey(projectRoot),
+        id: g.id,
+        scope: g.scope,
+        reason: g.reason,
+        issuedAt: g.issuedAt,
+        expiresAt: g.expiresAt,
+        uses: g.uses,
+        decisionId: g.decisionId,
+        revocationsAtIssue: g.revocationsAtIssue,
+        ownerPubkey: g.ownerPubkey,
+    });
+}
+/** The exact bytes a revocation's signature covers. */
+function revocationPayload(projectRoot, r, ownerPubkey) {
+    return JSON.stringify({
+        kind: 'release-authorization-revocation',
+        project: projectKey(projectRoot),
+        id: r.id,
+        revokedAt: r.revokedAt,
+        ownerPubkey,
+    });
+}
+/**
+ * Why the revocation record cannot be trusted, or null. Any answer other than
+ * null makes every grant tampered (fail closed).
+ */
+async function revocationProblem(projectRoot, project, global, ownerPubkey) {
+    if (JSON.stringify(project.revoked) !== JSON.stringify(global.revoked))
+        return 'the project and global revocation lists differ';
+    const sealed = await readSealedOwnerSetting(projectRoot, REVOCATION_COUNT_SETTING);
+    if (sealed === 'tampered')
+        return `${REVOCATION_COUNT_SETTING} is not sealed by the enrolled owner key`;
+    const count = sealed ?? 0;
+    if (global.revoked.length !== count)
+        return `the revocation list holds ${global.revoked.length} entries, but the owner sealed ${count} in .cleo/owner-settings.json`;
+    const atIssue = Math.max(0, ...[...project.grants, ...global.grants].map((g) => g.revocationsAtIssue ?? 0));
+    if (atIssue > global.revoked.length)
+        return `a grant was issued after ${atIssue} revocations, but only ${global.revoked.length} are listed`;
+    const { verifyAuditLine } = await import('../identity/cleo-identity.js');
+    for (const r of global.revoked) {
+        if (!(await verifyAuditLine(revocationPayload(projectRoot, r, ownerPubkey), r.sig, ownerPubkey)))
+            return `revocation ${r.id} is not signed by the enrolled owner key`;
+    }
+    return null;
+}
+function audit(projectRoot, row) {
+    try {
+        const path = join(projectRoot, RELEASE_AUTHORIZATION_AUDIT_FILE);
+        mkdirSync(dirname(path), { recursive: true });
+        const who = provenance(process.env['CLEO_SESSION_ID'] ?? null);
+        appendFileSync(path, `${JSON.stringify({ at: new Date().toISOString(), ...row, tty: who.tty, parent: who.parent, pid: process.pid })}\n`, 'utf-8');
+    }
+    catch {
+        // non-fatal: the signed grant files are the record
+    }
+}
+/**
+ * Parse a scope argument.
+ *
+ * @param raw - `canary`, `prerelease`, `stable`, or a version (`2026.10.28`, `v2026.10.28-canary.1`).
+ * @returns The scope, or null when it is none of those.
+ */
+export function parseReleaseAuthorizationScope(raw) {
+    if (raw === 'canary' || raw === 'prerelease' || raw === 'stable')
+        return raw;
+    const v = raw.startsWith('v') ? raw : `v${raw}`;
+    return /^v\d{4}\.\d{1,2}\.\d+(-[0-9A-Za-z.-]+)?$/.test(v) ? v : null;
+}
+/**
+ * Whether `scope` covers `version` (`v`-prefixed).
+ *
+ * @param scope - The grant scope.
+ * @param version - The version being cut.
+ * @returns True when the grant applies.
+ */
+export function scopeCovers(scope, version) {
+    if (scope === 'canary')
+        return /-canary\.\d+$/.test(version);
+    if (scope === 'prerelease')
+        return version.includes('-');
+    if (scope === 'stable')
+        return !version.includes('-');
+    return scope === version;
+}
+/** Parse `30m`, `24h` or `7d` into milliseconds; null when malformed or over 30 days. */
+function parseExpiry(raw) {
+    const m = /^(\d+)([mhd])$/.exec(raw.trim());
+    if (!m)
+        return null;
+    const ms = Number(m[1]) * { m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2]];
+    return ms > 0 && ms <= RELEASE_AUTHORIZATION_MAX_DAYS * 86_400_000 ? ms : null;
+}
+/** Cuts a grant has allowed: audit rows or tags naming it, whichever is higher. */
+function usesOf(projectRoot, id, gitRoot) {
+    let rows = 0;
+    try {
+        for (const line of readFileSync(join(projectRoot, CUT_AUDIT_FILE), 'utf-8').split('\n')) {
+            if (line.includes(`"allowedBy":"authorization:${id}"`) && line.includes('"outcome":"tagged"'))
+                rows++;
+        }
+    }
+    catch {
+        rows = 0;
+    }
+    let tags = 0;
+    try {
+        tags = execFileSync('git', ['for-each-ref', '--format=%(contents)', 'refs/tags/v*'], {
+            cwd: gitRoot,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        })
+            .split('\n')
+            .filter((l) => l.trim() === `${AUTHORIZED_BY_TRAILER}: ${id}`).length;
+    }
+    catch {
+        tags = 0;
+    }
+    return Math.max(rows, tags);
+}
+/**
+ * Every grant the project knows of, with its state: active, expired, used up,
+ * revoked, or tampered (not identical in both files, unsigned, or the owner
+ * enrollment itself is not `ok`).
+ *
+ * @param projectRoot - Project root.
+ * @param now - Clock (tests).
+ * @param gitRoot - Checkout whose tags are counted (T14160: the invoking one); default `projectRoot`.
+ * @returns The grants, newest first.
+ *
+ * @example
+ * ```ts
+ * const active = (await listReleaseAuthorizations(root)).filter((g) => g.state === 'active');
+ * ```
+ *
+ * @task T14141
+ */
+export async function listReleaseAuthorizations(projectRoot, now = new Date(), gitRoot = projectRoot) {
+    const projectFile = readProject(projectRoot);
+    const project = projectFile.grants;
+    const global = readGlobal(projectRoot);
+    const owner = await judgeOwnerState(projectRoot);
+    const revocationWhy = owner.kind === 'ok'
+        ? await revocationProblem(projectRoot, projectFile, global, owner.file.ownerPubkey)
+        : null;
+    const { verifyAuditLine } = await import('../identity/cleo-identity.js');
+    const ids = [...new Set([...project, ...global.grants].map((g) => g.id))];
+    const out = [];
+    for (const id of ids) {
+        const p = project.find((g) => g.id === id);
+        const g = global.grants.find((x) => x.id === id);
+        const grant = (g ?? p);
+        const used = usesOf(projectRoot, id, gitRoot);
+        let state = 'active';
+        let why;
+        if (global.revoked.some((r) => r.id === id)) {
+            state = 'revoked';
+        }
+        else if (!p || !g || JSON.stringify(p) !== JSON.stringify(g)) {
+            state = 'tampered';
+            why = 'the project and global copies differ or one is missing';
+        }
+        else if (owner.kind !== 'ok') {
+            state = 'tampered';
+            why = owner.kind === 'tampered' ? owner.why : 'no owner is enrolled';
+        }
+        else if (revocationWhy !== null) {
+            state = 'tampered';
+            why = revocationWhy;
+        }
+        else if (grant.ownerPubkey !== owner.file.ownerPubkey ||
+            !(await verifyAuditLine(grantPayload(projectRoot, grant), grant.sig, grant.ownerPubkey))) {
+            state = 'tampered';
+            why = 'the grant is not signed by the enrolled owner key';
+        }
+        else if (Date.parse(grant.expiresAt) <= now.getTime()) {
+            state = 'expired';
+        }
+        else if (grant.uses !== null && used >= grant.uses) {
+            state = 'used-up';
+        }
+        out.push({ ...grant, state, used, ...(why ? { why } : {}) });
+    }
+    return out.sort((a, b) => b.issuedAt.localeCompare(a.issuedAt));
+}
+/**
+ * The active grant covering `version`, or null. This is the seam
+ * `cleo release cut --yes` consults before asking on the terminal (D11212).
+ *
+ * @param projectRoot - Project whose authorization is read.
+ * @param version - Version being cut (`v`-prefixed).
+ * @param gitRoot - Checkout whose tags are counted (the invoking one); default `projectRoot`.
+ * @returns The grant's id when an active, verified grant covers the cut.
+ *
+ * @example
+ * ```ts
+ * const auth = await releaseAuthorizationFor(projectRoot, 'v2026.10.28');
+ * ```
+ *
+ * @task T14141
+ */
+export async function releaseAuthorizationFor(projectRoot, version, gitRoot = projectRoot) {
+    const grants = await listReleaseAuthorizations(projectRoot, new Date(), gitRoot);
+    for (const g of grants.filter((x) => x.state === 'tampered' && scopeCovers(x.scope, version))) {
+        audit(projectRoot, {
+            action: 'tampered-ignored',
+            id: g.id,
+            version,
+            reason: g.why ?? 'tampered',
+        });
+    }
+    const hit = grants.find((g) => g.state === 'active' && scopeCovers(g.scope, version));
+    return hit ? { id: hit.id } : null;
+}
+/**
+ * Grant a standing release authorization. Owner-only: the T13787 owner check
+ * (role fence, TTY, the owner-auth password against the bound session), an
+ * `ok` owner enrollment, and the password deriving the enrolled key. The grant
+ * is recorded as an owner decision and audited.
+ *
+ * @param projectRoot - Project root.
+ * @param input - The owner caller, scope, expiry (`30m`/`24h`/`30d`), reason, optional use cap.
+ * @returns The signed grant, or the refusal.
+ *
+ * @example
+ * ```ts
+ * await grantReleaseAuthorization(root, { ...caller, scope: 'canary', expires: '7d', reason: 'canary train' });
+ * ```
+ *
+ * @task T14141
+ */
+export async function grantReleaseAuthorization(projectRoot, input) {
+    const refuse = (code, message) => {
+        audit(projectRoot, { action: 'grant-refused', code, reason: message, scope: input.scope });
+        return { ok: false, code, message };
+    };
+    const scope = parseReleaseAuthorizationScope(input.scope);
+    if (scope === null)
+        return refuse('E_VALIDATION', // @sync-invariant none:input-shape a malformed grant request is refused before any write
+        `--scope must be canary, prerelease, stable or a CalVer version, not "${input.scope}"`);
+    const ttl = parseExpiry(input.expires);
+    if (ttl === null)
+        return refuse('E_VALIDATION', // @sync-invariant none:input-shape a malformed grant request is refused before any write
+        `--expires must be like 30m, 24h or 7d, at most ${RELEASE_AUTHORIZATION_MAX_DAYS}d`);
+    if (!input.reason.trim())
+        return refuse('E_VALIDATION', '--reason is required'); // @sync-invariant none:input-shape a malformed grant request is refused before any write
+    if (input.uses !== undefined && (!Number.isInteger(input.uses) || input.uses < 1))
+        return refuse('E_VALIDATION', '--uses must be a positive integer'); // @sync-invariant none:input-shape a malformed grant request is refused before any write
+    const check = ownerCheck(input);
+    if (!check.ok)
+        return refuse(check.code, check.message);
+    const state = await judgeOwnerState(projectRoot);
+    if (state.kind !== 'ok')
+        return refuse('E_OWNER_NOT_ENROLLED', // @sync-invariant none:local-only release grants are device-local owner files; refused before any write
+        state.kind === 'tampered'
+            ? `Owner settings are not usable: ${state.why}`
+            : 'No owner is enrolled for this project; the owner enrolls first with `cleo config owner-enroll`.');
+    const key = await ownerKey(input.password, state.file.salt);
+    if (key.pubkeyHex !== state.file.ownerPubkey)
+        return refuse('E_OVERRIDE_TOKEN_INVALID', // @sync-invariant none:local-only release grants are device-local owner files; refused before any write
+        'The password does not match the owner key enrolled for this project.');
+    const id = `ra-${randomBytes(6).toString('hex')}`;
+    const issuedAt = new Date();
+    const expiresAt = new Date(issuedAt.getTime() + ttl).toISOString();
+    let decisionId;
+    try {
+        const { storeDecision } = await import('../memory/decisions.js');
+        const row = await storeDecision(projectRoot, {
+            type: 'process',
+            decision: `Standing release authorization ${id}: scope ${scope} until ${expiresAt}${input.uses ? `, at most ${input.uses} cut(s)` : ''}`,
+            rationale: input.reason.trim(),
+            confidence: 'high',
+            confirmationState: 'accepted',
+            decidedBy: 'owner',
+            contextTaskId: 'T14141',
+        });
+        decisionId = row.id;
+    }
+    catch (err) {
+        return refuse('E_DECISION_NOT_RECORDED', // @sync-invariant none:local-only the grant is refused before its files are written
+        `The owner decision could not be recorded: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const unsigned = {
+        id,
+        scope,
+        reason: input.reason.trim(),
+        issuedAt: issuedAt.toISOString(),
+        expiresAt,
+        uses: input.uses ?? null,
+        decisionId,
+        revocationsAtIssue: readGlobal(projectRoot).revoked.length,
+        ownerPubkey: state.file.ownerPubkey,
+    };
+    const { signAuditLine } = await import('../identity/cleo-identity.js');
+    const { sig } = await signAuditLine(key, grantPayload(projectRoot, unsigned));
+    const grant = { ...unsigned, sig };
+    const project = readProject(projectRoot);
+    await atomicWriteJson(join(projectRoot, PROJECT_FILE), {
+        ...project,
+        grants: [...project.grants, grant],
+    });
+    const global = readGlobal(projectRoot);
+    await writeGlobal(projectRoot, { ...global, grants: [...global.grants, grant] });
+    audit(projectRoot, {
+        action: 'grant',
+        id,
+        scope,
+        expiresAt,
+        uses: grant.uses,
+        decisionId,
+        sessionId: input.session?.id ?? null,
+    });
+    return { ok: true, grant };
+}
+/**
+ * Revoke a grant now. Owner-only like granting (the password signs the
+ * revocation): the grant leaves both files, a signed revocation entry joins
+ * both, and the revocation count is sealed in `.cleo/owner-settings.json`.
+ *
+ * @param projectRoot - Project root.
+ * @param input - The owner caller and the grant id.
+ * @returns The revoked grant, or the refusal.
+ *
+ * @example
+ * ```ts
+ * await revokeReleaseAuthorization(root, { ...caller, id: 'ra-1a2b3c4d5e6f' });
+ * ```
+ *
+ * @task T14141
+ */
+export async function revokeReleaseAuthorization(projectRoot, input) {
+    const refuse = (code, message) => {
+        audit(projectRoot, { action: 'revoke-refused', id: input.id, code, reason: message });
+        return { ok: false, code, message };
+    };
+    const check = ownerCheck(input);
+    if (!check.ok)
+        return refuse(check.code, check.message);
+    const state = await judgeOwnerState(projectRoot);
+    if (state.kind !== 'ok')
+        return refuse('E_OWNER_NOT_ENROLLED', // @sync-invariant none:local-only release grants are device-local owner files; refused before any write
+        state.kind === 'tampered'
+            ? `Owner settings are not usable: ${state.why}`
+            : 'No owner is enrolled for this project.');
+    const key = await ownerKey(input.password, state.file.salt);
+    if (key.pubkeyHex !== state.file.ownerPubkey)
+        return refuse('E_OVERRIDE_TOKEN_INVALID', // @sync-invariant none:local-only release grants are device-local owner files; refused before any write
+        'The password does not match the owner key enrolled for this project.');
+    const project = readProject(projectRoot);
+    const global = readGlobal(projectRoot);
+    const grant = global.grants.find((g) => g.id === input.id) ?? project.grants.find((g) => g.id === input.id);
+    if (!grant)
+        return refuse('E_NOT_FOUND', `No release authorization ${input.id}`); // @sync-invariant none:input-shape an unknown grant id is refused before any write
+    const unsigned = { id: input.id, revokedAt: new Date().toISOString() };
+    const { signAuditLine } = await import('../identity/cleo-identity.js');
+    const { sig } = await signAuditLine(key, revocationPayload(projectRoot, unsigned, state.file.ownerPubkey));
+    const revoked = [...global.revoked, { ...unsigned, sig }];
+    await atomicWriteJson(join(projectRoot, PROJECT_FILE), {
+        schemaVersion: 1,
+        grants: project.grants.filter((g) => g.id !== input.id),
+        revoked,
+    });
+    await writeGlobal(projectRoot, {
+        grants: global.grants.filter((g) => g.id !== input.id),
+        revoked,
+    });
+    await writeSealedOwnerSetting(projectRoot, REVOCATION_COUNT_SETTING, revoked.length, key);
+    audit(projectRoot, { action: 'revoke', id: input.id, scope: grant.scope, count: revoked.length });
+    return { ok: true, grant };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/release/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/release/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAM1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,eAAe,EAEf,UAAU,EACV,QAAQ,EACR,UAAU,EACV,UAAU,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,oEAAoE;AACpE,MAAM,CAAC,MAAM,gCAAgC,GAAG,0CAA0C,CAAC;AAE3F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,wEAAwE;AACxE,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;AAClE,MAAM,cAAc,GAAG,+BAA+B,CAAC;AA0BvD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,6BAA6B,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAI,IAAY,EAAE,QAAW;IAC5C,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAuB,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,QAAQ,CAA8C,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,UAAU,CAAC,WAAmB;IACrC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,WAAmB,EAAE,MAAoB;IAClE,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC;IACtC,MAAM,eAAe,CAAC,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,kDAAkD;AAClD,SAAS,YAAY,CAAC,WAAmB,EAAE,CAAyC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;QAChC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,WAAW,EAAE,CAAC,CAAC,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,uDAAuD;AACvD,SAAS,iBAAiB,CACxB,WAAmB,EACnB,CAA0B,EAC1B,WAAmB;IAEnB,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC;QAChC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,WAAW;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAC9B,WAAmB,EACnB,OAAoB,EACpB,MAAoB,EACpB,WAAmB;IAEnB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;QACpE,OAAO,gDAAgD,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IACnF,IAAI,MAAM,KAAK,UAAU;QACvB,OAAO,GAAG,wBAAwB,0CAA0C,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK;QACjC,OAAO,6BAA6B,MAAM,CAAC,OAAO,CAAC,MAAM,kCAAkC,KAAK,+BAA+B,CAAC;IAClI,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,CAAC,EACD,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAC/E,CAAC;IACF,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM;QACjC,OAAO,4BAA4B,OAAO,0BAA0B,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,CAAC;IACzG,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IACE,CAAC,CAAC,MAAM,eAAe,CAAC,iBAAiB,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAE5F,OAAO,cAAc,CAAC,CAAC,EAAE,0CAA0C,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,WAAmB,EAAE,GAAqD;IACvF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,gCAAgC,CAAC,CAAC;QACjE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/D,cAAc,CACZ,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EACnH,OAAO,CACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,GAAW;IACxD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IAChD,OAAO,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgC,EAAE,OAAe;IAC3E,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,OAAO,CAAC;AAC3B,CAAC;AAED,yFAAyF;AACzF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAoB,CAAC,CAAC;IAC9F,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,8BAA8B,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,mFAAmF;AACnF,SAAS,MAAM,CAAC,WAAmB,EAAE,EAAU,EAAE,OAAe;IAC9D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxF,IAAI,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC;gBAC3F,IAAI,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,sBAAsB,EAAE,cAAc,CAAC,EAAE;YACnF,GAAG,EAAE,OAAO;YACZ,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC;aACC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,qBAAqB,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE,EACtB,UAAkB,WAAW;IAE7B,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,aAAa,GACjB,KAAK,CAAC,IAAI,KAAK,IAAI;QACjB,CAAC,CAAC,MAAM,iBAAiB,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;QACnF,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAiC,EAAE,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAA8B,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,GAAwC,QAAQ,CAAC;QAC1D,IAAI,GAAuB,CAAC;QAC5B,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5C,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,KAAK,GAAG,UAAU,CAAC;YACnB,GAAG,GAAG,wDAAwD,CAAC;QACjE,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,KAAK,GAAG,UAAU,CAAC;YACnB,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC;QACvE,CAAC;aAAM,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAClC,KAAK,GAAG,UAAU,CAAC;YACnB,GAAG,GAAG,aAAa,CAAC;QACtB,CAAC;aAAM,IACL,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;YAC5C,CAAC,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,EACxF,CAAC;YACD,KAAK,GAAG,UAAU,CAAC;YACnB,GAAG,GAAG,mDAAmD,CAAC;QAC5D,CAAC;aAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACxD,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACrD,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,OAAe,EACf,UAAkB,WAAW;IAE7B,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9F,KAAK,CAAC,WAAW,EAAE;YACjB,MAAM,EAAE,kBAAkB;YAC1B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,OAAO;YACP,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB,EACnB,KAAsF;IAEtF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAe,EAA8B,EAAE;QAC3E,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAChB,OAAO,MAAM,CACX,cAAc,EAAE,yFAAyF;QACzG,wEAAwE,KAAK,CAAC,KAAK,GAAG,CACvF,CAAC;IACJ,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,IAAI;QACd,OAAO,MAAM,CACX,cAAc,EAAE,yFAAyF;QACzG,kDAAkD,8BAA8B,GAAG,CACpF,CAAC;IACJ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC,CAAC,yFAAyF;IAC1K,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC,CAAC,yFAAyF;IAC/J,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,MAAM,CACX,sBAAsB,EAAE,wGAAwG;QAChI,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,kCAAkC,KAAK,CAAC,GAAG,EAAE;YAC/C,CAAC,CAAC,iGAAiG,CACtG,CAAC;IACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAC1C,OAAO,MAAM,CACX,0BAA0B,EAAE,wGAAwG;QACpI,sEAAsE,CACvE,CAAC;IAEJ,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE;YAC3C,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,kCAAkC,EAAE,WAAW,KAAK,UAAU,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;YACxI,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9B,UAAU,EAAE,MAAM;YAClB,iBAAiB,EAAE,UAAU;YAC7B,SAAS,EAAE,OAAO;YAClB,aAAa,EAAE,QAAQ;SACxB,CAAC,CAAC;QACH,UAAU,GAAG,GAAG,CAAC,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,MAAM,CACX,yBAAyB,EAAE,oFAAoF;QAC/G,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,EAAE;QACF,KAAK;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QAC3B,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE;QAChC,SAAS;QACT,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,UAAU;QACV,kBAAkB,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,MAAM;QAC1D,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;KACpC,CAAC;IACF,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAA8B,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC;IAE9D,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACrD,GAAG,OAAO;QACV,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACjF,KAAK,CAAC,WAAW,EAAE;QACjB,MAAM,EAAE,OAAO;QACf,EAAE;QACF,KAAK;QACL,SAAS;QACT,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,IAAI;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,KAAmC;IAEnC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,OAAe,EAA8B,EAAE;QAC3E,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,MAAM,CACX,sBAAsB,EAAE,wGAAwG;QAChI,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,kCAAkC,KAAK,CAAC,GAAG,EAAE;YAC/C,CAAC,CAAC,wCAAwC,CAC7C,CAAC;IACJ,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW;QAC1C,OAAO,MAAM,CACX,0BAA0B,EAAE,wGAAwG;QACpI,sEAAsE,CACvE,CAAC;IACJ,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,aAAa,EAAE,4BAA4B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mFAAmF;IACrK,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACvE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACvE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,CACjC,GAAG,EACH,iBAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CACjE,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,MAAM,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACrD,aAAa,EAAE,CAAC;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;KACR,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,WAAW,EAAE;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;KACR,CAAC,CAAC;IACH,MAAM,uBAAuB,CAAC,WAAW,EAAE,wBAAwB,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1F,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/release/ci-evidence.d.ts

@@ -146,6 +146,14 @@ export interface MainCommit {
     /** Number of parents; 2+ is a merge commit. */
     parents: number;
 }
+/**
+ * What a targeted `test-run:` report must cover, worded once for the
+ * validator's refusal and for every hint that offers a targeted run (T14119),
+ * so a hint never offers a route the validator refuses.
+ *
+ * @task T14119
+ */
+export declare const TARGETED_RUN_COVERAGE: string;
 /** Most later default-branch commits examined for a green stand-in run (T12742). */
 export declare const CI_DESCENDANT_MAX_CANDIDATES = 20;
 /** Latest committer time after the merge commit a stand-in may have (T12742): 7 days. */
@@ -220,6 +228,12 @@ export interface ResolveCiEvidenceOptions {
      * `git log --first-parent -- <paths>`.
      */
     touchingCommits?: (from: string, to: string, paths: readonly string[], cwd: string) => MainCommit[] | null;
+    /**
+     * When later commits edited the PR's files, the first hunk the PR added
+     * that is no longer present at `at` (T14119), or null when every one is.
+     * Defaults to {@link missingPrHunk}.
+     */
+    missingPrHunk?: (merge: string, at: string, paths: readonly string[], cwd: string) => string | null;
     /**
      * Plain-text log of one Actions job (a check-run id), or null when it cannot
      * be read (T13809). Defaults to `gh api repos/{owner}/{repo}/actions/jobs/<id>/logs`.
@@ -326,6 +340,19 @@ export interface CiChecksConfig {
  * @task T12634
  */
 export declare function isCiDocumentPath(path: string): boolean;
+/**
+ * Whether a check run's name is the job a configured glob names (T14148). A
+ * matrix job's `name:` is a template (`Type Check${{ matrix.node … }}`), and a
+ * job skipped before its matrix expands reports that raw template as its check
+ * name; its static prefix (`Type Check`) is the job's name, so the skip counts
+ * as the job's, the same job its rendered variants run as.
+ *
+ * @param re - The configured job glob, anchored.
+ * @param name - The check run's name.
+ * @returns True when the run belongs to the job.
+ * @task T14148
+ */
+export declare function jobNameMatches(re: RegExp, name: string): boolean;
 /**
  * Path glob to an anchored regular expression (T13175): `**` followed by `/` is
  * any number of whole directories (including none), a trailing `/` followed by
@@ -427,7 +454,9 @@ export type SupersededOnMergeResult = {
  * SUPERSEDED there (T12742): its latest merge-commit verdict is `cancelled`
  * or `skipped`, and no run of a required check or of a job in a pinned
  * workflow on the merge commit — any attempt — concluded with a failure. A
- * failed, timed-out, pending or missing check is never superseded. Pure.
+ * failed, timed-out or pending check is never superseded, nor is a missing
+ * one unless its pinned workflow's run on the merge commit was cancelled or
+ * skipped, so it never ran (T14103, T14144). Pure.
  *
  * @param required - Required check names.
  * @param checks - Every check fetched for the merge commit (and PR head).
@@ -697,6 +726,8 @@ export interface FindGreenDescendantInput {
     listDescendants: NonNullable<ResolveCiEvidenceOptions['listDescendants']>;
     /** First-parent commits in a range touching paths. */
     touchingCommits: NonNullable<ResolveCiEvidenceOptions['touchingCommits']>;
+    /** First PR hunk missing at a later commit (T14119). */
+    missingPrHunk: NonNullable<ResolveCiEvidenceOptions['missingPrHunk']>;
     /** Ancestry test. */
     isAncestor: NonNullable<ResolveCiEvidenceOptions['isAncestor']>;
     /** First parent of a commit (T13453: the inherited-failure walk); absent = never inherit. */
@@ -775,8 +806,10 @@ export type FindGreenDescendantResult = {
  *    failed job of a pinned workflow) refuses, and a PENDING run refuses with
  *    "wait for <sha>" — a later green run is never shopped for past one that
  *    is red or may still go red. Only cancelled, skipped and missing
- *    (never-started) runs, and a run red only for the flaky-quarantine budget
- *    (T13809), move on to the next candidate.
+ *    (never-started) runs, a run red only for the flaky-quarantine budget
+ *    (T13809), and a run whose every failing job tested nothing — its runner
+ *    was cancelled or a test worker crashed, no test failed (T14176) — move
+ *    on to the next candidate.
  *
  * @param input - Merge-commit checks, pins, changed paths, PR head and injected I/O.
  * @returns The stand-in SHA, its checks and proven range, or the refusal reason.
@@ -836,7 +869,9 @@ export type FindGreenCurrentHeadResult = {
  *
  * Candidates are HEAD, then its first parents while they differ from HEAD only
  * in documentation ({@link isCiDocumentPath}, the T13784 rule: nothing a test
- * reads moved), up to {@link CI_DESCENDANT_MAX_CANDIDATES}. Each must descend
+ * reads moved), or while every commit stepped past had green required checks
+ * and its gates' jobs skipped by CI's own change filter (T14177: the filter
+ * judged its change untested), up to {@link CI_DESCENDANT_MAX_CANDIDATES}. Each must descend
  * from the merge commit. The first decisive verdict decides, as in
  * {@link findGreenDescendant}: every required check green on its own `push`
  * runs (and the gates' jobs run, T13846) accepts; a failed or pending one
@@ -875,6 +910,22 @@ export declare function listMainDescendants(mergeSha: string, ref: string, cwd:
  * @task T12742
  */
 export declare function listPathTouchingMainCommits(from: string, to: string, paths: readonly string[], cwd: string): MainCommit[] | null;
+/**
+ * Default {@link ResolveCiEvidenceOptions.missingPrHunk} (T14119): the first
+ * hunk the PR added (`git diff -U0 <merge>^1 <merge>`) whose added lines no
+ * longer appear, contiguous and in order, in that file at `at`. A binary file
+ * counts as missing once its blob differs. Lines the PR removed are not
+ * checked: a later commit cannot un-test a deletion. A git error is reported
+ * as missing, never as present.
+ *
+ * @param merge - The PR's merge commit (its first parent is the base).
+ * @param at - The later commit whose run would stand in.
+ * @param paths - The PR's changed paths.
+ * @param cwd - Repository work tree.
+ * @returns The missing hunk, described, or null when every hunk is present.
+ * @task T14119
+ */
+export declare function missingPrHunk(merge: string, at: string, paths: readonly string[], cwd: string): string | null;
 /**
  * Default branch name from `gh repo view --json defaultBranchRef`.
  *