@cleocode/core 2026.6.12 → 2026.6.14

package/dist/selfimprove/budget.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Budget caps + circuit-breaker state machine for the self-improvement loop
+ * (T11889 · T11889-C).
+ *
+ * The loop is an AUTONOMOUS dogfooding engine — it boots a sandbox, replays a
+ * scenario, and on a regression it WRITES a leased DHQ row and opens a draft PR.
+ * Two guardrails bound that autonomy:
+ *
+ *   1. {@link SelfImproveBudget} — HARD, in-code caps (`maxTokens`, `maxUsd`,
+ *      `maxPrs = 1`, `maxWorktrees = 1`). These are REAL, not advisory: the engine
+ *      asks {@link CircuitBreaker.assertWithinBudget} BEFORE each costed step, so a
+ *      cap is enforced as a PRE-FLIGHT check (never merely observed after the fact).
+ *      `MemoryMax=32G` is NOT an in-code cap — a CORE function cannot portably
+ *      self-confine to a cgroup (`systemd-run` is Linux-only) — it is an OPERATIONAL
+ *      launch-wrapper documented on {@link MEMORY_MAX_LAUNCH_WRAPPER}; the in-process
+ *      complement is the gondolin VM's own `memory` option.
+ *   2. {@link CircuitBreaker} — a one-way latch that HALTS the run (no further ops,
+ *      no DHQ write, no PR) the moment any of these trip:
+ *        - an architectural gate goes RED (`gateRed`);
+ *        - the writer lease throws {@link "../store/writer-lease.js".LeaseUnavailableError}
+ *          (a `require`-mode acquisition FAILURE — `leaseUnavailable`);
+ *        - a budget cap would be exceeded (`budgetOverrun`);
+ *        - a DB error escapes the leased section (`dbError`).
+ *      It does NOT trip on "daemon OFF": the default lease mode is `local` (no
+ *      daemon), so daemon-off is the NORMAL operating state — tripping on it would
+ *      block EVERY write in the default config (P5 spec §B.7 correction).
+ *
+ * This module is PURE — no DB, no native handle, no `cleo` mutation, no I/O.
+ * Import-time side-effect-free.
+ *
+ * @module @cleocode/core/selfimprove/budget
+ * @epic T11889
+ * @task T11913
+ */
+/**
+ * The reasons the circuit-breaker may latch OPEN. Each is a genuine
+ * halt-the-loop condition (P5 spec §B.7). Deliberately does NOT include a
+ * "daemon-off" reason — the default `local` lease mode runs daemon-less, so that
+ * is the normal state, not a fault.
+ */
+export type CircuitBreakerReason = 
+/** An architectural gate (`cleo check arch --strict`) went RED. */
+'gateRed'
+/** The writer lease threw `LeaseUnavailableError` (`require`-mode failure). */
+ | 'leaseUnavailable'
+/** A budget cap (tokens/$/PRs/worktrees) would be exceeded. */
+ | 'budgetOverrun'
+/** A DB error escaped the leased section. */
+ | 'dbError';
+/**
+ * Hard, in-code budget caps for ONE self-improvement run.
+ *
+ * `maxPrs` and `maxWorktrees` are pinned to `1` by {@link DEFAULT_BUDGET}: the loop
+ * opens AT MOST one draft PR and boots AT MOST one sandbox per run. `maxTokens` /
+ * `maxUsd` bound model spend; the engine accumulates per-op cost and asks
+ * {@link CircuitBreaker.assertWithinBudget} before each costed step.
+ *
+ * `MemoryMax=32G` is intentionally ABSENT here — it is enforced at the launch
+ * boundary (see {@link MEMORY_MAX_LAUNCH_WRAPPER}), not by this object.
+ */
+export interface SelfImproveBudget {
+    /** Maximum model tokens spent across the whole run. */
+    readonly maxTokens: number;
+    /** Maximum USD spent across the whole run. */
+    readonly maxUsd: number;
+    /** Maximum draft PRs opened in the run (pinned to `1`). */
+    readonly maxPrs: number;
+    /** Maximum sandbox envs booted in the run (pinned to `1`). */
+    readonly maxWorktrees: number;
+}
+/**
+ * The default budget for a self-improvement run. `maxPrs` / `maxWorktrees` are
+ * `1` by contract; `maxTokens` / `maxUsd` are conservative defaults overridable
+ * via {@link resolveBudget} (env) or an explicit partial.
+ */
+export declare const DEFAULT_BUDGET: SelfImproveBudget;
+/**
+ * The launch-boundary memory cap — an OPERATIONAL wrapper, NOT an in-code cap.
+ *
+ * A CORE function cannot portably self-confine to a cgroup (`systemd-run` is
+ * Linux-only; re-exec'ing under it from inside the engine is fragile), so the
+ * runbook / spawn wrapper that invokes `cleo selfimprove run` wraps it on Linux.
+ * On macOS the gondolin VM's own `memory` option bounds the guest. Exported as a
+ * documented constant so the spawn wrapper and the runbook share one SSoT string.
+ */
+export declare const MEMORY_MAX_LAUNCH_WRAPPER: "systemd-run --user --scope -p MemoryMax=32G -p MemorySwapMax=0";
+/**
+ * The mutable cost accumulator the engine threads through one run. Every costed
+ * step ADDS to this before asking the breaker whether the next step fits.
+ */
+export interface BudgetSpend {
+    /** Tokens spent so far. */
+    tokens: number;
+    /** USD spent so far. */
+    usd: number;
+    /** Draft PRs opened so far. */
+    prs: number;
+    /** Sandbox envs booted so far. */
+    worktrees: number;
+}
+/** A fresh, zeroed {@link BudgetSpend}. */
+export declare function emptySpend(): BudgetSpend;
+/**
+ * The increment a single step would add to the spend. Each field defaults to `0`,
+ * so a step that only opens a PR passes `{ prs: 1 }`.
+ */
+export interface BudgetCharge {
+    /** Tokens this step would consume. */
+    readonly tokens?: number;
+    /** USD this step would consume. */
+    readonly usd?: number;
+    /** Draft PRs this step would open. */
+    readonly prs?: number;
+    /** Sandbox envs this step would boot. */
+    readonly worktrees?: number;
+}
+/**
+ * Thrown by {@link CircuitBreaker.assertWithinBudget} when a step's charge would
+ * push the accumulated spend past a cap. Carries the offending dimension so the
+ * engine can trip the breaker with `reason: 'budgetOverrun'` and surface WHICH cap.
+ */
+export declare class BudgetExceededError extends Error {
+    /** Stable machine-readable code. */
+    readonly code: "E_SELFIMPROVE_BUDGET_EXCEEDED";
+    /** Which cap was exceeded. */
+    readonly dimension: keyof SelfImproveBudget;
+    /**
+     * @param dimension - The exceeded cap dimension.
+     * @param attempted - The accumulated value the step would have reached.
+     * @param cap - The cap that bounds it.
+     */
+    constructor(dimension: keyof SelfImproveBudget, attempted: number, cap: number);
+}
+/** Snapshot of the circuit-breaker latch state. */
+export interface CircuitBreakerState {
+    /** Whether the breaker has latched OPEN (the loop must halt). */
+    readonly open: boolean;
+    /** The reason the breaker tripped, or `null` while closed. */
+    readonly reason: CircuitBreakerReason | null;
+    /** A human-readable detail for the trip, or `null` while closed. */
+    readonly detail: string | null;
+}
+/**
+ * A one-way circuit-breaker latch + pre-flight budget gate for ONE run.
+ *
+ * Once {@link trip} is called the breaker stays OPEN for the run's lifetime —
+ * there is no reset (a run is single-use; the next run constructs a fresh
+ * breaker). {@link assertOpen} short-circuits B.4-B.5 to a no-op the moment the
+ * latch is set, and {@link assertWithinBudget} is the PRE-FLIGHT check the engine
+ * runs before each costed step.
+ *
+ * PURE — holds only in-memory counters; no I/O.
+ */
+export declare class CircuitBreaker {
+    #private;
+    /**
+     * @param budget - The caps for this run (defaults to {@link DEFAULT_BUDGET}).
+     * @param spend - The starting spend (defaults to a zeroed accumulator).
+     */
+    constructor(budget?: SelfImproveBudget, spend?: BudgetSpend);
+    /** Whether the breaker has latched OPEN. */
+    get isOpen(): boolean;
+    /** The current latch state (open flag + reason + detail). */
+    get state(): CircuitBreakerState;
+    /** The accumulated spend so far (a live read of the internal counters). */
+    get spend(): Readonly<BudgetSpend>;
+    /**
+     * Latch the breaker OPEN. Idempotent: the FIRST trip wins — a later trip does
+     * not overwrite the original reason (the first fault is the relevant one).
+     *
+     * @param reason - The trip reason.
+     * @param detail - A human-readable detail for logs / the run report.
+     */
+    trip(reason: CircuitBreakerReason, detail: string): void;
+    /**
+     * Throw if the breaker is OPEN — the engine calls this at the top of each
+     * phase so a tripped breaker short-circuits the rest of the run.
+     *
+     * @throws {Error} `E_SELFIMPROVE_CIRCUIT_OPEN` when the breaker is latched.
+     */
+    assertClosed(): void;
+    /**
+     * PRE-FLIGHT budget check for a costed step. Computes the spend the step WOULD
+     * reach and — if any dimension would exceed its cap — TRIPS the breaker with
+     * `reason: 'budgetOverrun'` and throws {@link BudgetExceededError} BEFORE the
+     * step runs. On success it COMMITS the charge to the accumulator.
+     *
+     * @param charge - The increment the step would add.
+     * @throws {BudgetExceededError} When a cap would be exceeded (and trips the breaker).
+     */
+    chargeOrTrip(charge: BudgetCharge): void;
+}
+/**
+ * Resolve the effective {@link SelfImproveBudget}, layering env overrides over an
+ * explicit partial over {@link DEFAULT_BUDGET}. `maxPrs` / `maxWorktrees` are
+ * ALWAYS clamped to at most `1` regardless of override — the one-PR / one-sandbox
+ * ceiling is a hard invariant, not a tunable.
+ *
+ * Env overrides (numeric): `CLEO_SELFIMPROVE_MAX_TOKENS`, `CLEO_SELFIMPROVE_MAX_USD`.
+ *
+ * @param overrides - Optional explicit partial caps (test / caller injection).
+ * @param env - The environment to read overrides from (defaults to `process.env`).
+ * @returns The resolved, invariant-clamped budget.
+ */
+export declare function resolveBudget(overrides?: Partial<SelfImproveBudget>, env?: NodeJS.ProcessEnv): SelfImproveBudget;
+//# sourceMappingURL=budget.d.ts.map

package/dist/selfimprove/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../src/selfimprove/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB;AAC9B,mEAAmE;AACjE,SAAS;AACX,+EAA+E;GAC7E,kBAAkB;AACpB,+DAA+D;GAC7D,eAAe;AACjB,6CAA6C;GAC3C,SAAS,CAAC;AAEd;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,iBAK5B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,EACpC,gEAAyE,CAAC;AAE5E;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,IAAI,WAAW,CAExC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,oCAAoC;IACpC,SAAgB,IAAI,EAAG,+BAA+B,CAAU;IAChE,8BAA8B;IAC9B,SAAgB,SAAS,EAAE,MAAM,iBAAiB,CAAC;IAEnD;;;;OAIG;gBACS,SAAS,EAAE,MAAM,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;CAK/E;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;;IAOzB;;;OAGG;gBACS,MAAM,GAAE,iBAAkC,EAAE,KAAK,GAAE,WAA0B;IAKzF,4CAA4C;IAC5C,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,6DAA6D;IAC7D,IAAI,KAAK,IAAI,mBAAmB,CAE/B;IAED,2EAA2E;IAC3E,IAAI,KAAK,IAAI,QAAQ,CAAC,WAAW,CAAC,CAEjC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAOxD;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAQpB;;;;;;;;OAQG;IACH,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;CA2BzC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,GAAE,OAAO,CAAC,iBAAiB,CAAM,EAC1C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,CAenB"}

package/dist/selfimprove/budget.js

@@ -0,0 +1,203 @@
+/**
+ * Budget caps + circuit-breaker state machine for the self-improvement loop
+ * (T11889 · T11889-C).
+ *
+ * The loop is an AUTONOMOUS dogfooding engine — it boots a sandbox, replays a
+ * scenario, and on a regression it WRITES a leased DHQ row and opens a draft PR.
+ * Two guardrails bound that autonomy:
+ *
+ *   1. {@link SelfImproveBudget} — HARD, in-code caps (`maxTokens`, `maxUsd`,
+ *      `maxPrs = 1`, `maxWorktrees = 1`). These are REAL, not advisory: the engine
+ *      asks {@link CircuitBreaker.assertWithinBudget} BEFORE each costed step, so a
+ *      cap is enforced as a PRE-FLIGHT check (never merely observed after the fact).
+ *      `MemoryMax=32G` is NOT an in-code cap — a CORE function cannot portably
+ *      self-confine to a cgroup (`systemd-run` is Linux-only) — it is an OPERATIONAL
+ *      launch-wrapper documented on {@link MEMORY_MAX_LAUNCH_WRAPPER}; the in-process
+ *      complement is the gondolin VM's own `memory` option.
+ *   2. {@link CircuitBreaker} — a one-way latch that HALTS the run (no further ops,
+ *      no DHQ write, no PR) the moment any of these trip:
+ *        - an architectural gate goes RED (`gateRed`);
+ *        - the writer lease throws {@link "../store/writer-lease.js".LeaseUnavailableError}
+ *          (a `require`-mode acquisition FAILURE — `leaseUnavailable`);
+ *        - a budget cap would be exceeded (`budgetOverrun`);
+ *        - a DB error escapes the leased section (`dbError`).
+ *      It does NOT trip on "daemon OFF": the default lease mode is `local` (no
+ *      daemon), so daemon-off is the NORMAL operating state — tripping on it would
+ *      block EVERY write in the default config (P5 spec §B.7 correction).
+ *
+ * This module is PURE — no DB, no native handle, no `cleo` mutation, no I/O.
+ * Import-time side-effect-free.
+ *
+ * @module @cleocode/core/selfimprove/budget
+ * @epic T11889
+ * @task T11913
+ */
+/**
+ * The default budget for a self-improvement run. `maxPrs` / `maxWorktrees` are
+ * `1` by contract; `maxTokens` / `maxUsd` are conservative defaults overridable
+ * via {@link resolveBudget} (env) or an explicit partial.
+ */
+export const DEFAULT_BUDGET = {
+    maxTokens: 200_000,
+    maxUsd: 5,
+    maxPrs: 1,
+    maxWorktrees: 1,
+};
+/**
+ * The launch-boundary memory cap — an OPERATIONAL wrapper, NOT an in-code cap.
+ *
+ * A CORE function cannot portably self-confine to a cgroup (`systemd-run` is
+ * Linux-only; re-exec'ing under it from inside the engine is fragile), so the
+ * runbook / spawn wrapper that invokes `cleo selfimprove run` wraps it on Linux.
+ * On macOS the gondolin VM's own `memory` option bounds the guest. Exported as a
+ * documented constant so the spawn wrapper and the runbook share one SSoT string.
+ */
+export const MEMORY_MAX_LAUNCH_WRAPPER = 'systemd-run --user --scope -p MemoryMax=32G -p MemorySwapMax=0';
+/** A fresh, zeroed {@link BudgetSpend}. */
+export function emptySpend() {
+    return { tokens: 0, usd: 0, prs: 0, worktrees: 0 };
+}
+/**
+ * Thrown by {@link CircuitBreaker.assertWithinBudget} when a step's charge would
+ * push the accumulated spend past a cap. Carries the offending dimension so the
+ * engine can trip the breaker with `reason: 'budgetOverrun'` and surface WHICH cap.
+ */
+export class BudgetExceededError extends Error {
+    /** Stable machine-readable code. */
+    code = 'E_SELFIMPROVE_BUDGET_EXCEEDED';
+    /** Which cap was exceeded. */
+    dimension;
+    /**
+     * @param dimension - The exceeded cap dimension.
+     * @param attempted - The accumulated value the step would have reached.
+     * @param cap - The cap that bounds it.
+     */
+    constructor(dimension, attempted, cap) {
+        super(`self-improve budget exceeded: ${dimension} would reach ${attempted}, cap is ${cap}`);
+        this.name = 'BudgetExceededError';
+        this.dimension = dimension;
+    }
+}
+/**
+ * A one-way circuit-breaker latch + pre-flight budget gate for ONE run.
+ *
+ * Once {@link trip} is called the breaker stays OPEN for the run's lifetime —
+ * there is no reset (a run is single-use; the next run constructs a fresh
+ * breaker). {@link assertOpen} short-circuits B.4-B.5 to a no-op the moment the
+ * latch is set, and {@link assertWithinBudget} is the PRE-FLIGHT check the engine
+ * runs before each costed step.
+ *
+ * PURE — holds only in-memory counters; no I/O.
+ */
+export class CircuitBreaker {
+    #budget;
+    #spend;
+    #open = false;
+    #reason = null;
+    #detail = null;
+    /**
+     * @param budget - The caps for this run (defaults to {@link DEFAULT_BUDGET}).
+     * @param spend - The starting spend (defaults to a zeroed accumulator).
+     */
+    constructor(budget = DEFAULT_BUDGET, spend = emptySpend()) {
+        this.#budget = budget;
+        this.#spend = spend;
+    }
+    /** Whether the breaker has latched OPEN. */
+    get isOpen() {
+        return this.#open;
+    }
+    /** The current latch state (open flag + reason + detail). */
+    get state() {
+        return { open: this.#open, reason: this.#reason, detail: this.#detail };
+    }
+    /** The accumulated spend so far (a live read of the internal counters). */
+    get spend() {
+        return { ...this.#spend };
+    }
+    /**
+     * Latch the breaker OPEN. Idempotent: the FIRST trip wins — a later trip does
+     * not overwrite the original reason (the first fault is the relevant one).
+     *
+     * @param reason - The trip reason.
+     * @param detail - A human-readable detail for logs / the run report.
+     */
+    trip(reason, detail) {
+        if (this.#open)
+            return;
+        this.#open = true;
+        this.#reason = reason;
+        this.#detail = detail;
+    }
+    /**
+     * Throw if the breaker is OPEN — the engine calls this at the top of each
+     * phase so a tripped breaker short-circuits the rest of the run.
+     *
+     * @throws {Error} `E_SELFIMPROVE_CIRCUIT_OPEN` when the breaker is latched.
+     */
+    assertClosed() {
+        if (this.#open) {
+            const err = new Error(`self-improve circuit-breaker OPEN (${this.#reason}): ${this.#detail}`);
+            err.code = 'E_SELFIMPROVE_CIRCUIT_OPEN';
+            throw err;
+        }
+    }
+    /**
+     * PRE-FLIGHT budget check for a costed step. Computes the spend the step WOULD
+     * reach and — if any dimension would exceed its cap — TRIPS the breaker with
+     * `reason: 'budgetOverrun'` and throws {@link BudgetExceededError} BEFORE the
+     * step runs. On success it COMMITS the charge to the accumulator.
+     *
+     * @param charge - The increment the step would add.
+     * @throws {BudgetExceededError} When a cap would be exceeded (and trips the breaker).
+     */
+    chargeOrTrip(charge) {
+        const next = {
+            tokens: this.#spend.tokens + (charge.tokens ?? 0),
+            usd: this.#spend.usd + (charge.usd ?? 0),
+            prs: this.#spend.prs + (charge.prs ?? 0),
+            worktrees: this.#spend.worktrees + (charge.worktrees ?? 0),
+        };
+        const checks = [
+            ['maxTokens', next.tokens, this.#budget.maxTokens],
+            ['maxUsd', next.usd, this.#budget.maxUsd],
+            ['maxPrs', next.prs, this.#budget.maxPrs],
+            ['maxWorktrees', next.worktrees, this.#budget.maxWorktrees],
+        ];
+        for (const [dimension, attempted, cap] of checks) {
+            if (attempted > cap) {
+                const err = new BudgetExceededError(dimension, attempted, cap);
+                this.trip('budgetOverrun', err.message);
+                throw err;
+            }
+        }
+        this.#spend.tokens = next.tokens;
+        this.#spend.usd = next.usd;
+        this.#spend.prs = next.prs;
+        this.#spend.worktrees = next.worktrees;
+    }
+}
+/**
+ * Resolve the effective {@link SelfImproveBudget}, layering env overrides over an
+ * explicit partial over {@link DEFAULT_BUDGET}. `maxPrs` / `maxWorktrees` are
+ * ALWAYS clamped to at most `1` regardless of override — the one-PR / one-sandbox
+ * ceiling is a hard invariant, not a tunable.
+ *
+ * Env overrides (numeric): `CLEO_SELFIMPROVE_MAX_TOKENS`, `CLEO_SELFIMPROVE_MAX_USD`.
+ *
+ * @param overrides - Optional explicit partial caps (test / caller injection).
+ * @param env - The environment to read overrides from (defaults to `process.env`).
+ * @returns The resolved, invariant-clamped budget.
+ */
+export function resolveBudget(overrides = {}, env = process.env) {
+    const envTokens = Number(env.CLEO_SELFIMPROVE_MAX_TOKENS);
+    const envUsd = Number(env.CLEO_SELFIMPROVE_MAX_USD);
+    const maxTokens = overrides.maxTokens ??
+        (Number.isFinite(envTokens) && envTokens > 0 ? envTokens : DEFAULT_BUDGET.maxTokens);
+    const maxUsd = overrides.maxUsd ?? (Number.isFinite(envUsd) && envUsd > 0 ? envUsd : DEFAULT_BUDGET.maxUsd);
+    // The one-PR / one-sandbox ceiling is invariant — clamp to at most 1.
+    const maxPrs = Math.min(1, overrides.maxPrs ?? DEFAULT_BUDGET.maxPrs);
+    const maxWorktrees = Math.min(1, overrides.maxWorktrees ?? DEFAULT_BUDGET.maxWorktrees);
+    return { maxTokens, maxUsd, maxPrs, maxWorktrees };
+}
+//# sourceMappingURL=budget.js.map

package/dist/selfimprove/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../../src/selfimprove/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAwCH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,SAAS,EAAE,OAAO;IAClB,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,YAAY,EAAE,CAAC;CAChB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,gEAAyE,CAAC;AAiB5E,2CAA2C;AAC3C,MAAM,UAAU,UAAU;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,oCAAoC;IACpB,IAAI,GAAG,+BAAwC,CAAC;IAChE,8BAA8B;IACd,SAAS,CAA0B;IAEnD;;;;OAIG;IACH,YAAY,SAAkC,EAAE,SAAiB,EAAE,GAAW;QAC5E,KAAK,CAAC,iCAAiC,SAAS,gBAAgB,SAAS,YAAY,GAAG,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IAChB,OAAO,CAAoB;IAC3B,MAAM,CAAc;IAC7B,KAAK,GAAG,KAAK,CAAC;IACd,OAAO,GAAgC,IAAI,CAAC;IAC5C,OAAO,GAAkB,IAAI,CAAC;IAE9B;;;OAGG;IACH,YAAY,SAA4B,cAAc,EAAE,QAAqB,UAAU,EAAE;QACvF,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,6DAA6D;IAC7D,IAAI,KAAK;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC1E,CAAC;IAED,2EAA2E;IAC3E,IAAI,KAAK;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,MAA4B,EAAE,MAAc;QAC/C,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,OAAO,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7F,GAAgC,CAAC,IAAI,GAAG,4BAA4B,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CAAC,MAAoB;QAC/B,MAAM,IAAI,GAAgB;YACxB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YACjD,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YACxC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YACxC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;SAC3D,CAAC;QAEF,MAAM,MAAM,GAAqD;YAC/D,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAClD,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;SAC5D,CAAC;QACF,KAAK,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YACjD,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC/D,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAwC,EAAE,EAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAEpD,MAAM,SAAS,GACb,SAAS,CAAC,SAAS;QACnB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACvF,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAE/F,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,YAAY,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IAExF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACrD,CAAC"}

package/dist/selfimprove/dhq-adapter.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Durable DHQ adapter for the self-improvement loop (T11889 · T11889-C).
+ *
+ * This adapter sits OUTSIDE the store chokepoint (it is in `selfimprove/`, not
+ * `store/`), so it MUST NOT open a raw native handle (Gate-3). It is the lease
+ * boundary: EVERY write it performs is wrapped in
+ * {@link "../store/writer-lease.js".withWriterLease}`('project', 'bulk', …)`, which
+ * serializes the write against any other writer on the `(project, bulk)` lane. It
+ * then calls the Gate-3 accessors in
+ * {@link "../store/selfimprove-dhq-store.js"} (the ONLY native-handle toucher) —
+ * whose prepared statements target ONLY `selfimprove_dhq`.
+ *
+ * Two invariants the rest of the loop relies on:
+ *
+ *   1. **No raw / unleased write.** Reads go straight through the accessor (the
+ *      shared handle, no lease); every WRITE goes through {@link upsertOpenDhq} /
+ *      {@link recordPrUrl}, both of which acquire the lease first. There is no
+ *      code path here that mutates `cleo.db` without the lease.
+ *   2. **`selfimprove_dhq` ONLY — never a prod `tasks`/`brain` row.** The lease
+ *      SERIALIZES the write; it does NOT confine it to a table. The
+ *      table-confinement is ENTIRELY this adapter's discipline: it calls only the
+ *      `selfimprove_dhq` accessors, whose SQL references no other table. A unit
+ *      test asserts the accessor SQL targets `selfimprove_dhq` and nothing else.
+ *
+ * Lease-mode note (P5 spec §B.7): the default mode is `local` (no daemon), where a
+ * contended lease DEGRADES under `busy_timeout` rather than throwing. To get a hard
+ * denial signal for the circuit-breaker, the process runs in `require` mode
+ * (`CLEO_WRITER_LEASE_MODE=require`), where an unacquirable lease THROWS
+ * {@link "../store/writer-lease.js".LeaseUnavailableError}. This adapter does NOT
+ * swallow that throw — it propagates so {@link runSelfImprove} trips the breaker.
+ *
+ * This module is import-time side-effect-free.
+ *
+ * @module @cleocode/core/selfimprove/dhq-adapter
+ * @epic T11889
+ * @task T11913
+ */
+import { type SelfimproveDhqRow } from '../store/selfimprove-dhq-store.js';
+/**
+ * The fields the engine supplies to {@link upsertOpenDhq}. `now` and the fixed
+ * `status: 'open'` are stamped by the accessor; `dhqId` / `severity` carry through.
+ */
+export interface UpsertDhqInput {
+    /** Stable `'DHQ-###'` handle (used only on first insert for a hash). */
+    readonly dhqId: string;
+    /** The scenario name replayed. */
+    readonly scenario: string;
+    /** sha256 of the normalized regression signature — the idempotency key. */
+    readonly questionHash: string;
+    /** Human-readable DHQ title. */
+    readonly title: string;
+    /** The envelope-diff payload (the evidence) as serialized JSON. */
+    readonly regressionJson: string;
+    /** Severity classification, or `null` until triaged. */
+    readonly severity: string | null;
+    /** Ties the row to ONE loop run. */
+    readonly runId: string;
+}
+/** The durable DHQ adapter — the lease boundary for the self-improvement loop. */
+export interface DhqAdapter {
+    /**
+     * Read the open DHQ row for a `question_hash` (lease-free — readers share the
+     * handle). Returns `null` when no open row exists.
+     */
+    readOpen(questionHash: string): Promise<SelfimproveDhqRow | null>;
+    /**
+     * UPSERT exactly ONE open DHQ row for a `question_hash`, under the
+     * `(project, bulk)` writer lease. Idempotent via the partial-UNIQUE index: a
+     * repeated open regression refreshes the existing row.
+     */
+    upsertOpenDhq(input: UpsertDhqInput): Promise<void>;
+    /**
+     * Record the draft PR URL on the open DHQ row for a `question_hash`, under the
+     * `(project, bulk)` writer lease.
+     *
+     * @returns The number of rows updated (0 when no open row exists).
+     */
+    recordPrUrl(questionHash: string, prUrl: string): Promise<number>;
+}
+/**
+ * Construct the durable DHQ adapter bound to a project working directory.
+ *
+ * Every WRITE method acquires the `(project, bulk)` writer lease via
+ * {@link "../store/writer-lease.js".withWriterLease} before delegating to the
+ * Gate-3 accessor. The native handle is resolved per call through
+ * {@link "../store/selfimprove-dhq-store.js".getSelfimproveDhqNativeDb} (the
+ * chokepoint singleton — no raw open). The clock is injectable for deterministic
+ * tests; production uses `Date.now`.
+ *
+ * @param opts - Adapter options.
+ * @param opts.cwd - Project working directory for scope resolution (defaults to `cwd`).
+ * @param opts.now - Injectable clock (defaults to {@link Date.now}).
+ * @returns A {@link DhqAdapter}.
+ *
+ * @example
+ * ```ts
+ * const adapter = createDhqAdapter({ cwd: projectRoot });
+ * await adapter.upsertOpenDhq({ dhqId: 'DHQ-001', … }); // leased UPSERT
+ * ```
+ */
+export declare function createDhqAdapter(opts?: {
+    cwd?: string;
+    now?: () => number;
+}): DhqAdapter;
+//# sourceMappingURL=dhq-adapter.d.ts.map

package/dist/selfimprove/dhq-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dhq-adapter.d.ts","sourceRoot":"","sources":["../../src/selfimprove/dhq-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAGL,KAAK,iBAAiB,EAIvB,MAAM,mCAAmC,CAAC;AAG3C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAClE;;;;OAIG;IACH,aAAa,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;OAKG;IACH,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAO,GAAG,UAAU,CAoC5F"}

package/dist/selfimprove/dhq-adapter.js

@@ -0,0 +1,95 @@
+/**
+ * Durable DHQ adapter for the self-improvement loop (T11889 · T11889-C).
+ *
+ * This adapter sits OUTSIDE the store chokepoint (it is in `selfimprove/`, not
+ * `store/`), so it MUST NOT open a raw native handle (Gate-3). It is the lease
+ * boundary: EVERY write it performs is wrapped in
+ * {@link "../store/writer-lease.js".withWriterLease}`('project', 'bulk', …)`, which
+ * serializes the write against any other writer on the `(project, bulk)` lane. It
+ * then calls the Gate-3 accessors in
+ * {@link "../store/selfimprove-dhq-store.js"} (the ONLY native-handle toucher) —
+ * whose prepared statements target ONLY `selfimprove_dhq`.
+ *
+ * Two invariants the rest of the loop relies on:
+ *
+ *   1. **No raw / unleased write.** Reads go straight through the accessor (the
+ *      shared handle, no lease); every WRITE goes through {@link upsertOpenDhq} /
+ *      {@link recordPrUrl}, both of which acquire the lease first. There is no
+ *      code path here that mutates `cleo.db` without the lease.
+ *   2. **`selfimprove_dhq` ONLY — never a prod `tasks`/`brain` row.** The lease
+ *      SERIALIZES the write; it does NOT confine it to a table. The
+ *      table-confinement is ENTIRELY this adapter's discipline: it calls only the
+ *      `selfimprove_dhq` accessors, whose SQL references no other table. A unit
+ *      test asserts the accessor SQL targets `selfimprove_dhq` and nothing else.
+ *
+ * Lease-mode note (P5 spec §B.7): the default mode is `local` (no daemon), where a
+ * contended lease DEGRADES under `busy_timeout` rather than throwing. To get a hard
+ * denial signal for the circuit-breaker, the process runs in `require` mode
+ * (`CLEO_WRITER_LEASE_MODE=require`), where an unacquirable lease THROWS
+ * {@link "../store/writer-lease.js".LeaseUnavailableError}. This adapter does NOT
+ * swallow that throw — it propagates so {@link runSelfImprove} trips the breaker.
+ *
+ * This module is import-time side-effect-free.
+ *
+ * @module @cleocode/core/selfimprove/dhq-adapter
+ * @epic T11889
+ * @task T11913
+ */
+import { getSelfimproveDhqNativeDb, readOpenSelfimproveDhq, setSelfimproveDhqPrUrl, upsertOpenSelfimproveDhq, } from '../store/selfimprove-dhq-store.js';
+import { withWriterLease } from '../store/writer-lease.js';
+/**
+ * Construct the durable DHQ adapter bound to a project working directory.
+ *
+ * Every WRITE method acquires the `(project, bulk)` writer lease via
+ * {@link "../store/writer-lease.js".withWriterLease} before delegating to the
+ * Gate-3 accessor. The native handle is resolved per call through
+ * {@link "../store/selfimprove-dhq-store.js".getSelfimproveDhqNativeDb} (the
+ * chokepoint singleton — no raw open). The clock is injectable for deterministic
+ * tests; production uses `Date.now`.
+ *
+ * @param opts - Adapter options.
+ * @param opts.cwd - Project working directory for scope resolution (defaults to `cwd`).
+ * @param opts.now - Injectable clock (defaults to {@link Date.now}).
+ * @returns A {@link DhqAdapter}.
+ *
+ * @example
+ * ```ts
+ * const adapter = createDhqAdapter({ cwd: projectRoot });
+ * await adapter.upsertOpenDhq({ dhqId: 'DHQ-001', … }); // leased UPSERT
+ * ```
+ */
+export function createDhqAdapter(opts = {}) {
+    const cwd = opts.cwd;
+    const now = opts.now ?? (() => Date.now());
+    return {
+        async readOpen(questionHash) {
+            const native = await getSelfimproveDhqNativeDb(cwd);
+            return readOpenSelfimproveDhq(native, questionHash);
+        },
+        async upsertOpenDhq(input) {
+            // EVERY write is leased — never raw / unleased. The lease serializes against
+            // other writers on (project, bulk); the table-confinement is the accessor's.
+            await withWriterLease('project', 'bulk', async () => {
+                const native = await getSelfimproveDhqNativeDb(cwd);
+                const row = {
+                    dhqId: input.dhqId,
+                    scenario: input.scenario,
+                    questionHash: input.questionHash,
+                    title: input.title,
+                    regressionJson: input.regressionJson,
+                    severity: input.severity,
+                    runId: input.runId,
+                    now: now(),
+                };
+                upsertOpenSelfimproveDhq(native, row);
+            });
+        },
+        async recordPrUrl(questionHash, prUrl) {
+            return withWriterLease('project', 'bulk', async () => {
+                const native = await getSelfimproveDhqNativeDb(cwd);
+                return setSelfimproveDhqPrUrl(native, questionHash, prUrl, now());
+            });
+        },
+    };
+}
+//# sourceMappingURL=dhq-adapter.js.map

package/dist/selfimprove/dhq-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dhq-adapter.js","sourceRoot":"","sources":["../../src/selfimprove/dhq-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAGtB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA6C3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA6C,EAAE;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE3C,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,YAAoB;YACjC,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,sBAAsB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAqB;YACvC,6EAA6E;YAC7E,6EAA6E;YAC7E,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;gBAClD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAyB;oBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,GAAG,EAAE;iBACX,CAAC;gBACF,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,YAAoB,EAAE,KAAa;YACnD,OAAO,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;gBACnD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;gBACpD,OAAO,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}