@codyswann/lisa 4.27.4 → 4.27.6

package/dist/core/enforcement-census-report.js

@@ -0,0 +1,198 @@
+import { isInstallBehindDeclared, redactedLabel, } from "./enforcement-census.js";
+/** Where a host tree lives inside a checkout. */
+const HOST_TREE = "scripts/lisa-hooks";
+/** Where the monorepo's own tree lives inside a checkout. */
+const PLUGIN_TREE = "plugins/lisa/hooks";
+/** What dates a host tree. */
+const HOST_DATED_BY = ".lisa/apply-receipt.json";
+/** What dates a plugin tree. */
+const PLUGIN_DATED_BY = "plugins/lisa/.claude-plugin/plugin.json";
+/** What a redacted field says instead of a real path. */
+const REDACTED = "redacted";
+/**
+ * Replace every real path in a census with a stable anonymous label.
+ *
+ * The paths this census reads name real local checkouts, and they embed client
+ * and product names that must never reach a public issue, PR, or commit. The
+ * counts and the per-checkout rows survive redaction intact, so a fleet finding
+ * loses nothing by being quoted safely.
+ * @param census - A measured fleet
+ * @returns The same fleet with paths replaced by derived labels
+ */
+export function redactCensus(census) {
+    const scrubTree = (tree, label) => ({
+        ...tree,
+        root: `${label}/${tree.tree === "host" ? HOST_TREE : PLUGIN_TREE}`,
+        datedBy: `${label}/${tree.tree === "host" ? HOST_DATED_BY : PLUGIN_DATED_BY}`,
+    });
+    const scrub = (coverage) => {
+        const label = redactedLabel(coverage.checkoutPath);
+        return {
+            ...coverage,
+            label,
+            checkoutPath: label,
+            guards: coverage.guards.map(guard => ({ ...guard, script: null })),
+            trees: coverage.trees.map(tree => scrubTree(tree, label)),
+            governing: coverage.governing === null
+                ? null
+                : scrubTree(coverage.governing, label),
+        };
+    };
+    return {
+        ...census,
+        rosterOrigin: REDACTED,
+        referenceSource: REDACTED,
+        checkouts: census.checkouts.map(scrub),
+    };
+}
+/**
+ * Describe which copy governs a checkout and how old it is.
+ * @param coverage - One record
+ * @param reference - Newest Lisa the run could point at
+ * @returns One operator-readable clause
+ */
+function describeGoverning(coverage, reference) {
+    const governing = coverage.governing;
+    if (governing === null)
+        return "no copy in force";
+    const where = governing.tree === "host" ? HOST_TREE : PLUGIN_TREE;
+    if (governing.version === null) {
+        return `governed by ${where} — vintage unknown, so it cannot be shown current`;
+    }
+    if (coverage.vintage === "behind") {
+        return `governed by ${where} — lisa ${governing.version}, behind ${reference ?? "the newest on this disk"}`;
+    }
+    return `governed by ${where} — lisa ${governing.version}`;
+}
+/**
+ * Say what a checkout has installed against what it declares.
+ * @param coverage - One record
+ * @returns One operator-readable clause
+ */
+function describeInstallDrift(coverage) {
+    return `installed ${coverage.install.installed ?? "?"}, declares ${coverage.install.declared ?? "?"}`;
+}
+/**
+ * One row for a checkout that resolves at least one guard.
+ * @param coverage - One record
+ * @param reference - Newest Lisa the run could point at
+ * @returns The row
+ */
+function resolvingRow(coverage, reference) {
+    const parts = [
+        describeGoverning(coverage, reference),
+        coverage.receipt.present ? null : "no apply receipt",
+        coverage.resolution === "partial"
+            ? `unresolved: ${coverage.unresolvedGuards.join(", ")}`
+            : null,
+        isInstallBehindDeclared(coverage) ? describeInstallDrift(coverage) : null,
+    ].filter((part) => part !== null);
+    return `  - ${coverage.label} — ${parts.join("; ")}`;
+}
+/**
+ * Build the section for checkouts that resolve nothing.
+ *
+ * First in the report, and never merged into the stale section below it. These
+ * are not behind — they are unenforced, and the remedy is different.
+ * @param census - A measured fleet
+ * @returns The section
+ */
+function unguardedSection(census) {
+    const rows = census.checkouts
+        .filter(entry => entry.resolution === "none")
+        .map(entry => `  - ${entry.label}`);
+    return {
+        heading: `NOT ENFORCING — ${rows.length} of ${census.summary.total} resolve no guard at all`,
+        note: "An agent working in one of these is checked by nothing, and nothing in the session says so. Repair: run `npx @codyswann/lisa apply` in that checkout.",
+        rows,
+    };
+}
+/**
+ * Build the section for checkouts the census could not read.
+ * @param census - A measured fleet
+ * @returns The section
+ */
+function unreadableSection(census) {
+    const rows = census.checkouts
+        .filter(entry => entry.resolution === "unreadable")
+        .map(entry => `  - ${entry.label} — ${entry.unreadableReason ?? "unknown"}`);
+    return {
+        heading: `COULD NOT LOOK — ${rows.length} of ${census.summary.total}`,
+        note: "Not counted as covered and not counted as unenforced: the census does not know. Repair: fix the path on the roster, or remove it.",
+        rows,
+    };
+}
+/**
+ * Build the section for checkouts that resolve at least one guard.
+ * @param census - A measured fleet
+ * @returns The section
+ */
+function resolvingSection(census) {
+    const { summary } = census;
+    const rows = census.checkouts
+        .filter(entry => entry.resolution === "partial" || entry.resolution === "full")
+        .map(entry => resolvingRow(entry, census.reference));
+    return {
+        heading: `ENFORCING — ${summary.resolving} of ${summary.total} (${summary.partial} of them only partly)`,
+        note: `behind: ${summary.behind} · vintage unknown: ${summary.undateable} · current: ${summary.current} · no apply receipt: ${summary.withoutReceipt}`,
+        rows,
+    };
+}
+/**
+ * Build the section for checkouts whose installed Lisa is behind their own
+ * manifest.
+ *
+ * Its own section because it fails in the affirmative: these checkouts resolve
+ * guards, run them, and answer confidently about a version nobody is using.
+ * @param census - A measured fleet
+ * @returns The section
+ */
+function installDriftSection(census) {
+    const rows = census.checkouts
+        .filter(entry => isInstallBehindDeclared(entry))
+        .map(entry => `  - ${entry.label} — ${describeInstallDrift(entry)}`);
+    return {
+        heading: `INSTALLED BEHIND DECLARED — ${rows.length} of ${census.summary.total}`,
+        note: "These answer every question confidently about a Lisa version nobody is running. Repair: reinstall dependencies in that checkout.",
+        rows,
+    };
+}
+/**
+ * Render one section, or nothing when it is empty and uninteresting.
+ * @param section - The section
+ * @param always - Whether to print it even when empty
+ * @returns The rendered lines
+ */
+function renderSection(section, always) {
+    if (section.rows.length === 0 && !always)
+        return [];
+    return [
+        "",
+        section.heading,
+        `  ${section.note}`,
+        ...(section.rows.length === 0 ? ["  (none)"] : section.rows),
+    ];
+}
+/**
+ * Render the whole census for a terminal.
+ * @param census - A measured fleet
+ * @returns The report
+ */
+export function renderFleetCensusReport(census) {
+    const { summary } = census;
+    const lines = [
+        `Lisa enforcement fleet census — ${census.measuredAt}`,
+        `Roster: ${census.rosterOrigin} (${summary.total} checkout${summary.total === 1 ? "" : "s"})`,
+        `Newest Lisa found: ${census.reference ?? "none"} (${census.referenceSource})`,
+        ...renderSection(unguardedSection(census), true),
+        ...renderSection(unreadableSection(census), true),
+        ...renderSection(resolvingSection(census), true),
+        ...renderSection(installDriftSection(census), false),
+        "",
+        `Covered — all six guards, a current copy, and an apply receipt: ${summary.covered} of ${summary.total}.`,
+        "This census reports and never gates: its exit status is 0 whatever it finds.",
+        "A checkout not on the roster was not measured, which is not the same as covered.",
+    ];
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=enforcement-census-report.js.map

package/dist/core/enforcement-census-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-census-report.js","sourceRoot":"","sources":["../../src/core/enforcement-census-report.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,yBAAyB,CAAC;AAEjC,iDAAiD;AACjD,MAAM,SAAS,GAAG,oBAAoB,CAAC;AACvC,6DAA6D;AAC7D,MAAM,WAAW,GAAG,oBAAoB,CAAC;AACzC,8BAA8B;AAC9B,MAAM,aAAa,GAAG,0BAA0B,CAAC;AACjD,gCAAgC;AAChC,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAClE,yDAAyD;AACzD,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAmB;IAC9C,MAAM,SAAS,GAAG,CAChB,IAAO,EACP,KAAa,EACV,EAAE,CAAC,CAAC;QACP,GAAG,IAAI;QACP,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;QAClE,OAAO,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE;KAC9E,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,QAA0B,EAAoB,EAAE;QAC7D,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACnD,OAAO;YACL,GAAG,QAAQ;YACX,KAAK;YACL,YAAY,EAAE,KAAK;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzD,SAAS,EACP,QAAQ,CAAC,SAAS,KAAK,IAAI;gBACzB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;SAC3C,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,QAAQ;QACtB,eAAe,EAAE,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,QAA0B,EAC1B,SAAwB;IAExB,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,kBAAkB,CAAC;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAClE,IAAI,SAAS,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,eAAe,KAAK,mDAAmD,CAAC;IACjF,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,eAAe,KAAK,WAAW,SAAS,CAAC,OAAO,YAAY,SAAS,IAAI,yBAAyB,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,eAAe,KAAK,WAAW,SAAS,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,QAA0B;IACtD,OAAO,aAAa,QAAQ,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,cAAc,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CACnB,QAA0B,EAC1B,SAAwB;IAExB,MAAM,KAAK,GAAG;QACZ,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC;QACtC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB;QACpD,QAAQ,CAAC,UAAU,KAAK,SAAS;YAC/B,CAAC,CAAC,eAAe,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvD,CAAC,CAAC,IAAI;QACR,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,OAAO,OAAO,QAAQ,CAAC,KAAK,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACvD,CAAC;AASD;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,MAAmB;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;SAC5C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO;QACL,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,0BAA0B;QAC5F,IAAI,EAAE,uJAAuJ;QAC7J,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAAmB;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC;SAClD,GAAG,CACF,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,gBAAgB,IAAI,SAAS,EAAE,CACvE,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,oBAAoB,IAAI,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;QACrE,IAAI,EAAE,mIAAmI;QACzI,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAmB;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS;SAC1B,MAAM,CACL,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CACvE;SACA,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,OAAO;QACL,OAAO,EAAE,eAAe,OAAO,CAAC,SAAS,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO,uBAAuB;QACxG,IAAI,EAAE,WAAW,OAAO,CAAC,MAAM,uBAAuB,OAAO,CAAC,UAAU,eAAe,OAAO,CAAC,OAAO,wBAAwB,OAAO,CAAC,cAAc,EAAE;QACtJ,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAAmB;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS;SAC1B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;SAC/C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,KAAK,MAAM,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,+BAA+B,IAAI,CAAC,MAAM,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;QAChF,IAAI,EAAE,kIAAkI;QACxI,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAAgB,EAAE,MAAe;IACtD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACpD,OAAO;QACL,EAAE;QACF,OAAO,CAAC,OAAO;QACf,KAAK,OAAO,CAAC,IAAI,EAAE;QACnB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAmB;IACzD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG;QACZ,mCAAmC,MAAM,CAAC,UAAU,EAAE;QACtD,WAAW,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,KAAK,YAAY,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;QAC7F,sBAAsB,MAAM,CAAC,SAAS,IAAI,MAAM,KAAK,MAAM,CAAC,eAAe,GAAG;QAC9E,GAAG,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;QAChD,GAAG,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;QACjD,GAAG,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;QAChD,GAAG,aAAa,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;QACpD,EAAE;QACF,mEAAmE,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,KAAK,GAAG;QACzG,8EAA8E;QAC9E,kFAAkF;KACnF,CAAC;IACF,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/core/enforcement-census.d.ts

@@ -0,0 +1,177 @@
+import type { CheckoutCoverage } from "./enforcement-coverage.js";
+/** Where a checkout on the roster came from. */
+export type RosterSource = "roster" | "scan" | "argument";
+/** One checkout the census intends to look at. */
+export interface RosterEntry {
+    /** Operator-facing label. */
+    readonly label: string;
+    /** Absolute path to look at. */
+    readonly checkoutPath: string;
+    /** How this entry reached the roster. */
+    readonly source: RosterSource;
+}
+/**
+ * The disjoint classes a fleet falls into.
+ *
+ * `unreadable`, `unguarded`, `partial` and `full` partition the roster — they
+ * sum to `total` by construction. `behind`, `undateable` and `current`
+ * partition the *resolving* subset only, and never see an unguarded or
+ * unreadable checkout.
+ */
+export interface FleetCensusSummary {
+    /** Checkouts the census set out to look at. */
+    readonly total: number;
+    /** Checkouts it could not look into. Never counted as covered. */
+    readonly unreadable: number;
+    /** Checkouts that resolve NO guard. Not stale — unenforced. */
+    readonly unguarded: number;
+    /** Checkouts that resolve some guards but not all six. */
+    readonly partial: number;
+    /** Checkouts that resolve all six guards. */
+    readonly full: number;
+    /** Checkouts resolving at least one guard. */
+    readonly resolving: number;
+    /** Resolving checkouts whose governing copy is behind the reference. */
+    readonly behind: number;
+    /** Resolving checkouts whose governing copy cannot be dated at all. */
+    readonly undateable: number;
+    /** Resolving checkouts whose governing copy is current. */
+    readonly current: number;
+    /** Resolving checkouts carrying no apply receipt. */
+    readonly withoutReceipt: number;
+    /** Checkouts whose installed Lisa is behind the version they declare. */
+    readonly installBehindDeclared: number;
+    /** All six guards, current copy, apply receipt present. */
+    readonly covered: number;
+}
+/** One complete census run. */
+export interface FleetCensus {
+    /** When the census ran. */
+    readonly measuredAt: string;
+    /** Newest Lisa the run could point at, and what proved it. */
+    readonly reference: string | null;
+    /** Where the reference came from, in the operator's language. */
+    readonly referenceSource: string;
+    /** Where the roster came from. */
+    readonly rosterOrigin: string;
+    /** One record per checkout, in roster order. */
+    readonly checkouts: readonly CheckoutCoverage[];
+    /** The disjoint classes. */
+    readonly summary: FleetCensusSummary;
+}
+/** The fleet roster `scripts/lisa-update-local.sh` already maintains. */
+export declare const DEFAULT_ROSTER_FILE = ".lisa.workspaces.json";
+/**
+ * Read a fleet roster file.
+ *
+ * The primary shape is the one already on disk: an object mapping checkout path
+ * to target branch, which `scripts/lisa-update-local.sh` reads. An array of
+ * paths is accepted too, so a census can be pointed at an ad-hoc list without
+ * inventing a branch for each entry.
+ * @param rosterPath - Path to the roster file
+ * @returns The checkouts it names, or null when it cannot be read
+ */
+export declare function readFleetRoster(rosterPath: string): Promise<readonly RosterEntry[] | null>;
+/**
+ * Find checkouts under a directory, without a roster.
+ *
+ * Discovery exists because a hand-maintained roster can go stale the same way
+ * the frozen comment did: a checkout nobody added is a checkout the census
+ * cannot see, and an unseen checkout reads as coverage it does not have. A
+ * candidate is any directory containing a `.git` entry, found no deeper than
+ * `depth` levels so the walk stays bounded on a large disk.
+ * @param root - Directory to search
+ * @param depth - How many levels below `root` to descend
+ * @returns The checkouts found, in listing order
+ */
+export declare function scanForCheckouts(root: string, depth: number): Promise<readonly RosterEntry[]>;
+/**
+ * Collapse entries that name the same checkout twice.
+ *
+ * Two roster spellings of one directory, or a roster entry a scan also found,
+ * would otherwise be counted twice — inflating both the numerator and the
+ * denominator and making the census disagree with itself.
+ * @param entries - Entries from every source
+ * @returns One entry per distinct checkout, first spelling wins
+ */
+export declare function dedupeRoster(entries: readonly RosterEntry[]): Promise<readonly RosterEntry[]>;
+/**
+ * Count the resolving checkouts whose governing copy is behind.
+ *
+ * Defined over the resolving set on purpose, and named so that folding the
+ * unguarded class into it is a visible edit rather than an accident. A checkout
+ * that resolves nothing has no copy to be behind: calling it stale describes a
+ * guard that would refuse things, and there is none.
+ * @param checkouts - Every record in the run
+ * @returns How many resolving checkouts are behind the reference
+ */
+export declare function countStale(checkouts: readonly CheckoutCoverage[]): number;
+/**
+ * Reduce a run to its disjoint classes.
+ * @param checkouts - Every record in the run
+ * @returns The summary
+ */
+export declare function summarizeFleetCensus(checkouts: readonly CheckoutCoverage[]): FleetCensusSummary;
+/**
+ * Whether a checkout's installed Lisa is older than the one it declares.
+ *
+ * The comparison is against the range's own floor, read as a plain version once
+ * the usual range punctuation is stripped. A range this cannot parse yields
+ * `false` — absence of proof never becomes proof of drift.
+ * @param coverage - One record
+ * @returns Whether the installed copy is behind the declared one
+ */
+export declare function isInstallBehindDeclared(coverage: CheckoutCoverage): boolean;
+/**
+ * Resolve the newest Lisa this run can point at.
+ *
+ * A maximum over evidence found on the same disk during the same run, never a
+ * network lookup and never a nominated authority. A copy is reported behind
+ * only when something newer can actually be pointed at, so the worst case is
+ * silence rather than a fleet-wide false alarm.
+ * @param checkouts - Records collected with no reference
+ * @param seed - A version the caller can vouch for, such as its own manifest
+ * @returns The reference version and what proved it
+ */
+export declare function resolveReference(checkouts: readonly CheckoutCoverage[], seed: string | null): {
+    readonly version: string | null;
+    readonly source: string;
+};
+/** Everything a census run needs. */
+export interface FleetCensusOptions {
+    /** Checkouts to look at, already deduped. */
+    readonly roster: readonly RosterEntry[];
+    /** Where that roster came from, for the report header. */
+    readonly rosterOrigin: string;
+    /** A version the caller can vouch for, folded into the reference. */
+    readonly seedVersion?: string | null;
+    /** An explicit reference, which suppresses the maximum entirely. */
+    readonly reference?: string | null;
+    /** Clock seam, so the report is reproducible under test. */
+    readonly now?: () => Date;
+}
+/**
+ * Run the census.
+ *
+ * Never throws for a fleet finding and never returns a status: the caller
+ * prints this and exits 0. The only thing that can fail here is the census
+ * itself, and a checkout it cannot read comes back as `unreadable` rather than
+ * as an exception, because one unreachable directory must not stop the other
+ * twenty-six from being measured.
+ * @param options - Roster and reference inputs
+ * @returns The measured fleet
+ */
+export declare function runFleetCensus(options: FleetCensusOptions): Promise<FleetCensus>;
+/**
+ * A stable, path-free label for a checkout.
+ *
+ * The census names real local checkouts, and those paths embed client and
+ * product names that must never reach a public issue or PR. Redaction keeps the
+ * counts and the per-checkout rows — which is all a fleet finding needs — while
+ * making the report safe to paste. It is derived from the path, so the same
+ * checkout carries the same label between runs and can still be discussed.
+ * @param checkoutPath - The real path
+ * @returns A stable anonymous label
+ */
+export declare function redactedLabel(checkoutPath: string): string;
+//# sourceMappingURL=enforcement-census.d.ts.map

package/dist/core/enforcement-census.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-census.d.ts","sourceRoot":"","sources":["../../src/core/enforcement-census.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAUlE,gDAAgD;AAChD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE1D,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;CAC/B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,+BAA+B;AAC/B,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kCAAkC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAa3D;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,WAAW,EAAE,GAAG,IAAI,CAAC,CAWxC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAiBjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,SAAS,WAAW,EAAE,GAC9B,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAajC;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,CAMzE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,kBAAkB,CA8BpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAQ3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,IAAI,EAAE,MAAM,GAAG,IAAI,GAClB;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwB9D;AAED,qCAAqC;AACrC,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAyBtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK1D"}

package/dist/core/enforcement-census.js

@@ -0,0 +1,252 @@
+/**
+ * The fleet census: how many checkouts resolve enforcement, re-derived on
+ * every run.
+ *
+ * The per-session staleness notice reports **this** checkout to **this**
+ * session, and it is right to do so — it keeps running while stale, and it
+ * prints once per session rather than per call, both deliberately. The gap it
+ * leaves is that nobody was looking at the fleet, so the only fleet-wide number
+ * that ever existed was hand-taken and frozen in a code comment
+ * (CodySwannGT/lisa#3490).
+ *
+ * Two rules shape everything below, and both are learned from that notice:
+ *
+ *   - **Report, do not gate.** No finding about the fleet may change the exit
+ *     status. Reddening a build because someone else's checkout is stale would
+ *     be a worse control than the one it replaces, and it would be routed
+ *     around — and a guard routed around protects nothing.
+ *   - **"Resolves nothing" and "resolves something old" are different
+ *     findings.** They have different remedies, and folding them into one "N
+ *     stale" number loses the serious half — which is exactly how the
+ *     unenforced checkouts stayed easy to miss. They are separate
+ *     fields here, and `countStale` is defined over the resolving set alone, so
+ *     folding them takes a code change that a named test refuses.
+ *
+ * Nothing in this module stores a count. The roster names where to look, the
+ * checkouts on disk answer, and the reference version is a maximum over the
+ * evidence found during the same run. A census that restated today's number in
+ * a different file would go stale exactly the way the comment did.
+ * @module core/enforcement-census
+ */
+import { createHash } from "node:crypto";
+import { readdir, realpath } from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { applyReference, collectCheckoutCoverage, isOlderVersion, versionEvidence, } from "./enforcement-coverage.js";
+import { readJsonOrNull } from "../utils/json-utils.js";
+import { pathExists } from "../utils/file-operations.js";
+/** The fleet roster `scripts/lisa-update-local.sh` already maintains. */
+export const DEFAULT_ROSTER_FILE = ".lisa.workspaces.json";
+/**
+ * Expand a leading `~` the way the roster's other reader does.
+ * @param value - A path that may start with `~`
+ * @returns The expanded path
+ */
+function expandHome(value) {
+    return value.startsWith("~")
+        ? path.join(os.homedir(), value.slice(1))
+        : value;
+}
+/**
+ * Read a fleet roster file.
+ *
+ * The primary shape is the one already on disk: an object mapping checkout path
+ * to target branch, which `scripts/lisa-update-local.sh` reads. An array of
+ * paths is accepted too, so a census can be pointed at an ad-hoc list without
+ * inventing a branch for each entry.
+ * @param rosterPath - Path to the roster file
+ * @returns The checkouts it names, or null when it cannot be read
+ */
+export async function readFleetRoster(rosterPath) {
+    const parsed = await readJsonOrNull(rosterPath);
+    if (parsed === null || typeof parsed !== "object")
+        return null;
+    const raw = Array.isArray(parsed)
+        ? parsed.filter((entry) => typeof entry === "string")
+        : Object.keys(parsed);
+    return raw.map(entry => ({
+        label: entry,
+        checkoutPath: path.resolve(expandHome(entry)),
+        source: "roster",
+    }));
+}
+/**
+ * Find checkouts under a directory, without a roster.
+ *
+ * Discovery exists because a hand-maintained roster can go stale the same way
+ * the frozen comment did: a checkout nobody added is a checkout the census
+ * cannot see, and an unseen checkout reads as coverage it does not have. A
+ * candidate is any directory containing a `.git` entry, found no deeper than
+ * `depth` levels so the walk stays bounded on a large disk.
+ * @param root - Directory to search
+ * @param depth - How many levels below `root` to descend
+ * @returns The checkouts found, in listing order
+ */
+export async function scanForCheckouts(root, depth) {
+    const resolved = path.resolve(expandHome(root));
+    if (depth < 0 || !(await pathExists(resolved)))
+        return [];
+    if (await pathExists(path.join(resolved, ".git"))) {
+        return [{ label: resolved, checkoutPath: resolved, source: "scan" }];
+    }
+    const entries = await readdir(resolved, { withFileTypes: true }).catch(() => []);
+    const children = entries
+        .filter(entry => entry.isDirectory() && !entry.name.startsWith("."))
+        .filter(entry => entry.name !== "node_modules")
+        .map(entry => path.join(resolved, entry.name));
+    const found = await Promise.all(children.map(child => scanForCheckouts(child, depth - 1)));
+    return found.flat();
+}
+/**
+ * Collapse entries that name the same checkout twice.
+ *
+ * Two roster spellings of one directory, or a roster entry a scan also found,
+ * would otherwise be counted twice — inflating both the numerator and the
+ * denominator and making the census disagree with itself.
+ * @param entries - Entries from every source
+ * @returns One entry per distinct checkout, first spelling wins
+ */
+export async function dedupeRoster(entries) {
+    const keyed = await Promise.all(entries.map(async (entry) => ({
+        entry,
+        key: await realpath(entry.checkoutPath).catch(() => entry.checkoutPath),
+    })));
+    return keyed
+        .filter((candidate, index) => keyed.findIndex(other => other.key === candidate.key) === index)
+        .map(candidate => candidate.entry);
+}
+/**
+ * Count the resolving checkouts whose governing copy is behind.
+ *
+ * Defined over the resolving set on purpose, and named so that folding the
+ * unguarded class into it is a visible edit rather than an accident. A checkout
+ * that resolves nothing has no copy to be behind: calling it stale describes a
+ * guard that would refuse things, and there is none.
+ * @param checkouts - Every record in the run
+ * @returns How many resolving checkouts are behind the reference
+ */
+export function countStale(checkouts) {
+    return checkouts.filter(entry => (entry.resolution === "partial" || entry.resolution === "full") &&
+        entry.vintage === "behind").length;
+}
+/**
+ * Reduce a run to its disjoint classes.
+ * @param checkouts - Every record in the run
+ * @returns The summary
+ */
+export function summarizeFleetCensus(checkouts) {
+    const resolving = checkouts.filter(entry => entry.resolution === "partial" || entry.resolution === "full");
+    const count = (list, predicate) => list.filter(predicate).length;
+    return {
+        total: checkouts.length,
+        unreadable: count(checkouts, entry => entry.resolution === "unreadable"),
+        unguarded: count(checkouts, entry => entry.resolution === "none"),
+        partial: count(checkouts, entry => entry.resolution === "partial"),
+        full: count(checkouts, entry => entry.resolution === "full"),
+        resolving: resolving.length,
+        behind: countStale(checkouts),
+        undateable: count(resolving, entry => entry.vintage === "undateable"),
+        current: count(resolving, entry => entry.vintage === "current"),
+        withoutReceipt: count(resolving, entry => !entry.receipt.present),
+        installBehindDeclared: count(checkouts, entry => isInstallBehindDeclared(entry)),
+        covered: count(checkouts, entry => entry.resolution === "full" &&
+            entry.vintage === "current" &&
+            entry.receipt.present),
+    };
+}
+/**
+ * Whether a checkout's installed Lisa is older than the one it declares.
+ *
+ * The comparison is against the range's own floor, read as a plain version once
+ * the usual range punctuation is stripped. A range this cannot parse yields
+ * `false` — absence of proof never becomes proof of drift.
+ * @param coverage - One record
+ * @returns Whether the installed copy is behind the declared one
+ */
+export function isInstallBehindDeclared(coverage) {
+    const { declared, installed } = coverage.install;
+    if (declared === null || installed === null)
+        return false;
+    // Bounded quantifiers rather than `\d+`: a range string arrives from a
+    // manifest this repository does not own, and an unbounded pattern over
+    // untrusted input is the shape that backtracks pathologically.
+    const floor = /(\d{1,9}\.\d{1,9}\.\d{1,9})/u.exec(declared)?.[1];
+    return floor !== undefined && isOlderVersion(installed, floor);
+}
+/**
+ * Resolve the newest Lisa this run can point at.
+ *
+ * A maximum over evidence found on the same disk during the same run, never a
+ * network lookup and never a nominated authority. A copy is reported behind
+ * only when something newer can actually be pointed at, so the worst case is
+ * silence rather than a fleet-wide false alarm.
+ * @param checkouts - Records collected with no reference
+ * @param seed - A version the caller can vouch for, such as its own manifest
+ * @returns The reference version and what proved it
+ */
+export function resolveReference(checkouts, seed) {
+    const candidates = checkouts.flatMap(entry => versionEvidence(entry).map(version => ({
+        version,
+        source: entry.label,
+    })));
+    const all = seed === null
+        ? candidates
+        : [
+            { version: seed, source: "this checkout's own manifest" },
+            ...candidates,
+        ];
+    const best = all.reduce((winner, candidate) => winner === null || isOlderVersion(winner.version, candidate.version)
+        ? candidate
+        : winner, null);
+    return best === null
+        ? { version: null, source: "no Lisa version could be found on this disk" }
+        : best;
+}
+/**
+ * Run the census.
+ *
+ * Never throws for a fleet finding and never returns a status: the caller
+ * prints this and exits 0. The only thing that can fail here is the census
+ * itself, and a checkout it cannot read comes back as `unreadable` rather than
+ * as an exception, because one unreachable directory must not stop the other
+ * twenty-six from being measured.
+ * @param options - Roster and reference inputs
+ * @returns The measured fleet
+ */
+export async function runFleetCensus(options) {
+    const undated = await Promise.all(options.roster.map(entry => collectCheckoutCoverage({
+        label: entry.label,
+        checkoutPath: entry.checkoutPath,
+        reference: null,
+    })));
+    const resolved = options.reference != null && options.reference !== ""
+        ? { version: options.reference, source: "supplied by the caller" }
+        : resolveReference(undated, options.seedVersion ?? null);
+    const checkouts = undated.map(entry => applyReference(entry, resolved.version));
+    return {
+        measuredAt: (options.now?.() ?? new Date()).toISOString(),
+        reference: resolved.version,
+        referenceSource: resolved.source,
+        rosterOrigin: options.rosterOrigin,
+        checkouts,
+        summary: summarizeFleetCensus(checkouts),
+    };
+}
+/**
+ * A stable, path-free label for a checkout.
+ *
+ * The census names real local checkouts, and those paths embed client and
+ * product names that must never reach a public issue or PR. Redaction keeps the
+ * counts and the per-checkout rows — which is all a fleet finding needs — while
+ * making the report safe to paste. It is derived from the path, so the same
+ * checkout carries the same label between runs and can still be discussed.
+ * @param checkoutPath - The real path
+ * @returns A stable anonymous label
+ */
+export function redactedLabel(checkoutPath) {
+    return `checkout-${createHash("sha256")
+        .update(checkoutPath)
+        .digest("hex")
+        .slice(0, 8)}`;
+}
+//# sourceMappingURL=enforcement-census.js.map

package/dist/core/enforcement-census.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement-census.js","sourceRoot":"","sources":["../../src/core/enforcement-census.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,cAAc,EACd,eAAe,GAChB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAkEzD,yEAAyE;AACzE,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAU,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvB,KAAK,EAAE,KAAK;QACZ,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,EAAE,QAAiB;KAC1B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1D,IAAI,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CACpE,GAAG,EAAE,CAAC,EAAE,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO;SACrB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACnE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;SAC9C,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAC1D,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,CAAC;QAC1B,KAAK;QACL,GAAG,EAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC;KACxE,CAAC,CAAC,CACJ,CAAC;IACF,OAAO,KAAK;SACT,MAAM,CACL,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CACnB,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,CAAC,KAAK,KAAK,CAClE;SACA,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,SAAsC;IAC/D,OAAO,SAAS,CAAC,MAAM,CACrB,KAAK,CAAC,EAAE,CACN,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;QAC/D,KAAK,CAAC,OAAO,KAAK,QAAQ,CAC7B,CAAC,MAAM,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAsC;IAEtC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAChC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CACvE,CAAC;IACF,MAAM,KAAK,GAAG,CACZ,IAAiC,EACjC,SAA+C,EACvC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,MAAM;QACvB,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,YAAY,CAAC;QACxE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;QACjE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC;QAClE,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;QAC5D,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAC7B,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,YAAY,CAAC;QACrE,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC;QAC/D,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACjE,qBAAqB,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAC9C,uBAAuB,CAAC,KAAK,CAAC,CAC/B;QACD,OAAO,EAAE,KAAK,CACZ,SAAS,EACT,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,UAAU,KAAK,MAAM;YAC3B,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CACxB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA0B;IAChE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjD,IAAI,QAAQ,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC1D,uEAAuE;IACvE,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAsC,EACtC,IAAmB;IAEnB,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC3C,eAAe,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,KAAK;KACpB,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,GAAG,GACP,IAAI,KAAK,IAAI;QACX,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC;YACE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE;YACzD,GAAG,UAAU;SACd,CAAC;IACR,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CACrB,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CACpB,MAAM,KAAK,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;QAClE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,EACZ,IAAI,CACL,CAAC;IACF,OAAO,IAAI,KAAK,IAAI;QAClB,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE;QAC1E,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA2B;IAE3B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACzB,uBAAuB,CAAC;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI;KAChB,CAAC,CACH,CACF,CAAC;IACF,MAAM,QAAQ,GACZ,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE;QACnD,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE;QAClE,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACpC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CACxC,CAAC;IACF,OAAO;QACL,UAAU,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACzD,SAAS,EAAE,QAAQ,CAAC,OAAO;QAC3B,eAAe,EAAE,QAAQ,CAAC,MAAM;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;QACT,OAAO,EAAE,oBAAoB,CAAC,SAAS,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,YAAoB;IAChD,OAAO,YAAY,UAAU,CAAC,QAAQ,CAAC;SACpC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACnB,CAAC"}