@descent-vtt/spec-harness 0.0.0 → 0.1.0

package/dist/round.d.ts

@@ -0,0 +1,68 @@
+/**
+ * A round, measured: the operations the command line and the MCP server
+ * share. Each gathers what a pure module needs - from git, the disk and the
+ * siblings - and hands it over; the decisions are made in `context.ts`,
+ * `audit.ts`, `guard.ts` and `rulings.ts`.
+ */
+import { type AuditReport } from './audit.js';
+import { type ContextPacket } from './context.js';
+import type { DocumentReader } from './document.js';
+import { type Decision, type VerifiedRuling } from './guard.js';
+import { type DependencyChange } from './manifests.js';
+import { type EscalationOption, type EscalationRequest, type RulingRow } from './rulings.js';
+import type { BriefRow, Finding } from './types.js';
+import { type Workspace } from './workspace.js';
+export type Base = {
+    readonly kind: 'resolved';
+    readonly ref: string;
+    readonly sha: string;
+    readonly mergeBase: string;
+    readonly head: string;
+} | {
+    readonly kind: 'unresolved';
+    readonly reason: string;
+};
+/** What the round is measured from: the flag, the configuration, then the remote's default branch. */
+export declare function resolveBase(workspace: Workspace, flag: string | undefined): Promise<Base>;
+export interface RulingCheck {
+    readonly rows: readonly RulingRow[];
+    readonly verified: readonly VerifiedRuling[];
+    readonly unverified: readonly {
+        readonly id: string;
+        readonly reason: string;
+    }[];
+    readonly problems: readonly Finding[];
+}
+/**
+ * The brief's rulings, each checked against its signature: the commit that
+ * last changed its row must be signed by a principal the base branch's
+ * allowed-signers file lists (ADR-0006).
+ */
+export declare function checkRulings(workspace: Workspace, brief: BriefRow, text: string, reader: DocumentReader, base: Base): Promise<RulingCheck>;
+export declare function briefText(workspace: Workspace, brief: BriefRow): Promise<string>;
+/** Decides paths against the brief, with its verified rulings. */
+export declare function checkPaths(workspace: Workspace, brief: BriefRow | null, noBrief: string | undefined, given: readonly string[], cwd: string, reader: DocumentReader): Promise<Decision[]>;
+export declare function buildContext(workspace: Workspace, brief: BriefRow, briefs: readonly BriefRow[], reader: DocumentReader): Promise<ContextPacket>;
+export interface AuditResult {
+    readonly brief: BriefRow;
+    readonly base: Base;
+    readonly report: AuditReport;
+    readonly dependencies: readonly DependencyChange[];
+}
+export declare function runAudit(workspace: Workspace, brief: BriefRow, reader: DocumentReader, baseFlag: string | undefined): Promise<AuditResult>;
+export declare function listEscalations(workspace: Workspace): Promise<EscalationRequest[]>;
+export declare function raiseEscalation(workspace: Workspace, brief: BriefRow, request: {
+    paths: readonly string[];
+    reason: string;
+    options: readonly EscalationOption[];
+    recommendation: string | null;
+}): Promise<{
+    request: EscalationRequest;
+    memo: string;
+}>;
+/** Writes a person's ruling into the brief and retires the request. Never commits: the signature is the person's. */
+export declare function recordRuling(workspace: Workspace, escalationId: string, decision: 'allow' | 'deny', note: string, reader: DocumentReader): Promise<{
+    id: string;
+    file: string;
+    row: string;
+}>;

package/dist/round.js

@@ -0,0 +1,339 @@
+/**
+ * A round, measured: the operations the command line and the MCP server
+ * share. Each gathers what a pure module needs - from git, the disk and the
+ * siblings - and hands it over; the decisions are made in `context.ts`,
+ * `audit.ts`, `guard.ts` and `rulings.ts`.
+ */
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readdir, readFile, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { audit } from './audit.js';
+import { sameId } from './branch.js';
+import { renderContext } from './context.js';
+import { readText, repositoryPath, stateDirectory, writeAtomic } from './fs.js';
+import { blameLine, changes, mergeBase, remoteDefault, revision, show, verifyCommit } from './git.js';
+import { decide } from './guard.js';
+import { diffManifest, ecosystemOf, manifestMatcher } from './manifests.js';
+import { addRulingRow, nextId, readRulings, renderMemo, renderRow, } from './rulings.js';
+import { compileGlob } from './vendor/spec-core/pattern/index.js';
+import { dirname, isRelativeReference, resolveInside, splitReference } from './vendor/spec-core/path/index.js';
+import { UsageError } from './workspace.js';
+/** What the round is measured from: the flag, the configuration, then the remote's default branch. */
+export async function resolveBase(workspace, flag) {
+    const ref = flag ?? workspace.config.base ?? (await remoteDefault(workspace.root));
+    if (ref === null) {
+        return { kind: 'unresolved', reason: 'no base is named and the remote has no default branch; pass --base <ref> or set "base"' };
+    }
+    const sha = await revision(ref, workspace.root);
+    const head = await revision('HEAD', workspace.root);
+    if (sha === null || head === null)
+        return { kind: 'unresolved', reason: `"${ref}" names no commit` };
+    const common = await mergeBase(sha, head, workspace.root);
+    if (common === null)
+        return { kind: 'unresolved', reason: `"${ref}" and HEAD share no history` };
+    return { kind: 'resolved', ref, sha, mergeBase: common, head };
+}
+/**
+ * The brief's rulings, each checked against its signature: the commit that
+ * last changed its row must be signed by a principal the base branch's
+ * allowed-signers file lists (ADR-0006).
+ */
+export async function checkRulings(workspace, brief, text, reader, base) {
+    const { rulings: rows, problems } = readRulings(reader.sectionTables(text, workspace.config.rulings.section).tables);
+    const findings = problems.map((problem) => ({
+        rule: 'ruling-unreadable',
+        severity: 'warning',
+        message: problem.message,
+        hint: 'a ruling row is | id | `paths` | allow or deny | note |',
+        file: brief.file,
+        line: problem.line,
+    }));
+    const allows = rows.filter((row) => row.decision === 'allow');
+    if (allows.length === 0)
+        return { rows, verified: [], unverified: [], problems: findings };
+    if (base.kind === 'unresolved') {
+        return { rows, verified: [], unverified: allows.map((row) => ({ id: row.id, reason: `no base to read the allowed signers from: ${base.reason}` })), problems: findings };
+    }
+    const signers = await show(base.sha, workspace.config.rulings.allowedSigners, workspace.root);
+    if (signers === null) {
+        const reason = `${base.ref} has no ${workspace.config.rulings.allowedSigners}, so no signature can count`;
+        return { rows, verified: [], unverified: allows.map((row) => ({ id: row.id, reason })), problems: findings };
+    }
+    const directory = await stateDirectory(workspace.commonDir, 'signers');
+    const file = join(directory, `${createHash('sha256').update(signers).digest('hex').slice(0, 16)}`);
+    await writeAtomic(file, signers);
+    const verified = [];
+    const unverified = [];
+    for (const row of allows) {
+        // The row's line is a line of the text on disk, so it is blamed there: at
+        // HEAD the same number can be another line, one a signed commit wrote,
+        // and an uncommitted row would borrow that commit's signature.
+        const commit = await blameLine(null, brief.file, row.line, workspace.root);
+        if (commit === null || /^0+$/.test(commit)) {
+            unverified.push({ id: row.id, reason: 'its row is not committed' });
+            continue;
+        }
+        const signature = await verifyCommit(commit, file, workspace.root);
+        if (signature.good && signature.principal !== null)
+            verified.push({ id: row.id, paths: row.paths, signer: signature.principal });
+        else
+            unverified.push({ id: row.id, reason: `commit ${commit.slice(0, 12)} last changed its row, and ${signature.detail || 'it is not signed'}` });
+    }
+    return { rows, verified, unverified, problems: findings };
+}
+/* ------------------------------------------------------------------- guard */
+export async function briefText(workspace, brief) {
+    const text = await readText(join(workspace.root, brief.file));
+    if (text === null)
+        throw new UsageError(`${brief.file} cannot be read`);
+    return text;
+}
+/** Decides paths against the brief, with its verified rulings. */
+export async function checkPaths(workspace, brief, noBrief, given, cwd, reader) {
+    let rulings = [];
+    const resolved = given.map((path) => ({ given: path, path: repositoryPath(path, workspace.root, cwd) }));
+    if (brief !== null) {
+        // Rulings cost a blame and a signature check each, so they are read only
+        // when a write reaches a protected file.
+        const first = resolved.map(({ path, given: g }) => decide({ path, given: g, brief, noBrief, rulings: [], outOfScope: workspace.config.outOfScope }));
+        if (first.some((decision) => decision.reason === 'protected')) {
+            const base = await resolveBase(workspace, undefined);
+            rulings = (await checkRulings(workspace, brief, await briefText(workspace, brief), reader, base)).verified;
+        }
+        else {
+            return first;
+        }
+    }
+    return resolved.map(({ path, given: g }) => decide({ path, given: g, brief, noBrief, rulings, outOfScope: workspace.config.outOfScope }));
+}
+/* ----------------------------------------------------------------- context */
+function scopeBases(patterns) {
+    const bases = new Set();
+    for (const pattern of patterns) {
+        try {
+            for (const base of compileGlob(pattern, { dialect: 'path', caseSensitive: true }).bases)
+                bases.add(base === '' ? '.' : base);
+        }
+        catch {
+            // spec-brief lint reports a pattern it cannot read; the rules for the rest still count.
+        }
+    }
+    return [...bases].sort();
+}
+async function rulesFor(workspace, brief) {
+    const paths = scopeBases(brief.affectedFiles);
+    if (paths.length === 0)
+        return [];
+    const answer = await workspace.siblings.json('spec-guard', ['query', ...paths, '--json']);
+    if ('absent' in answer)
+        return { unavailable: answer.absent };
+    if (answer.code === 2)
+        return { unavailable: 'spec-guard could not read its specs' };
+    const document = answer.document;
+    const seen = new Set();
+    const out = [];
+    for (const result of document.results ?? []) {
+        for (const rule of result.rules ?? []) {
+            const key = `${rule.document}:${rule.line}`;
+            if (rule.inForce === false || seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ document: rule.document, line: rule.line, kind: rule.kind, description: rule.description, reason: rule.reason ?? null });
+        }
+    }
+    return out;
+}
+async function citedDocuments(workspace, brief, text, reader) {
+    const seen = new Set();
+    const out = [];
+    for (const citation of reader.citations(text)) {
+        if (!isRelativeReference(citation.target))
+            continue;
+        let target = splitReference(citation.target).path;
+        try {
+            target = decodeURIComponent(target);
+        }
+        catch {
+            // A destination that is not valid percent-encoding is read as written.
+        }
+        const path = resolveInside(dirname(brief.file), target);
+        if (path === null || path === '' || path === brief.file || seen.has(path))
+            continue;
+        seen.add(path);
+        const document = /\.(?:md|markdown|mdx|txt)$/i.test(path);
+        // A link to code or a directory that exists is not a document to include,
+        // and must not be reported as a link that resolves to nothing.
+        if (!document && existsSync(join(workspace.root, path)))
+            continue;
+        const content = document ? await readText(join(workspace.root, path)) : null;
+        const meta = content === null ? { title: null, status: null } : reader.titleAndStatus(content);
+        out.push({ path, title: meta.title, status: meta.status, text: content });
+    }
+    return out;
+}
+export async function buildContext(workspace, brief, briefs, reader) {
+    const text = await briefText(workspace, brief);
+    const base = await resolveBase(workspace, undefined);
+    const [rules, cited, rulings] = await Promise.all([
+        rulesFor(workspace, brief),
+        citedDocuments(workspace, brief, text, reader),
+        checkRulings(workspace, brief, text, reader, base),
+    ]);
+    return renderContext({
+        brief,
+        briefText: text,
+        dependencies: brief.dependsOn.map((id) => 
+        // spec-brief reports a dependency as its front matter spells it, `7` for brief 007.
+        briefs.find((candidate) => sameId(candidate.id, id)) ?? {
+            ...brief,
+            id,
+            title: '(no such brief)',
+            file: '',
+            phase: 'live',
+            status: 'unknown',
+        }),
+        cited,
+        rules,
+        rulings: rulings.verified,
+        branch: workspace.branch,
+        base: base.kind === 'resolved' ? base.ref : null,
+        budget: workspace.config.context.budget,
+    });
+}
+/* ------------------------------------------------------------------- audit */
+async function dependencyChanges(workspace, base) {
+    if (base.kind === 'unresolved')
+        return { changes: [], unread: [] };
+    const isManifest = manifestMatcher(workspace.config.dependencies.manifests);
+    const out = [];
+    const unread = [];
+    for (const change of await changes(base.mergeBase, base.head, workspace.root)) {
+        if (!isManifest(change.path) && !(change.from !== undefined && isManifest(change.from)))
+            continue;
+        const ecosystem = ecosystemOf(change.path);
+        if (ecosystem === null) {
+            unread.push(change.path);
+            continue;
+        }
+        const before = change.status === 'A' ? null : await show(base.mergeBase, change.from ?? change.path, workspace.root);
+        const after = change.status === 'D' ? null : await show(base.head, change.path, workspace.root);
+        const diff = diffManifest(change.path, ecosystem, before, after);
+        if ('error' in diff)
+            unread.push(change.path);
+        else
+            out.push(...diff.changes);
+    }
+    return { changes: out, unread };
+}
+async function archiveReasons(workspace, brief, base) {
+    const args = ['archive', brief.id, '--dry-run', '--format', 'json', '--no-color'];
+    if (base.kind === 'resolved')
+        args.push('--base', base.ref);
+    const answer = await workspace.siblings.json('spec-brief', args);
+    if ('absent' in answer)
+        return { unavailable: answer.absent };
+    if (answer.code === 2)
+        return { unavailable: 'spec-brief could not plan the archive' };
+    const plan = answer.document.plan;
+    return { blocking: plan?.blocking ?? [], warnings: plan?.warnings ?? [] };
+}
+async function briefAssertions(workspace, brief, text, reader) {
+    const answer = await workspace.siblings.json('spec-guard', [brief.file, '--ignore-status', '--json']);
+    if ('absent' in answer)
+        return { unavailable: answer.absent };
+    if (answer.code === 2)
+        return { unavailable: 'spec-guard could not run the brief\'s assertions' };
+    const report = answer.document;
+    return (report.results ?? [])
+        .filter((result) => result.spec === undefined || result.spec.file.replace(/\\/g, '/') === brief.file)
+        .map((result) => {
+        const line = result.spec?.line ?? 0;
+        return { ok: result.ok, description: result.description, message: result.message, line, section: reader.sectionAt(text, line), enclosing: reader.sectionsAt(text, line) };
+    });
+}
+export async function runAudit(workspace, brief, reader, baseFlag) {
+    const base = await resolveBase(workspace, baseFlag);
+    const text = await briefText(workspace, brief);
+    const [dependencies, archive, assertions, rulings] = await Promise.all([
+        dependencyChanges(workspace, base),
+        archiveReasons(workspace, brief, base),
+        briefAssertions(workspace, brief, text, reader),
+        checkRulings(workspace, brief, text, reader, base),
+    ]);
+    const unmeasured = base.kind === 'unresolved' ? base.reason : base.mergeBase === base.head ? `${base.ref} and HEAD are the same commit: there is nothing to measure` : null;
+    const report = audit({
+        brief,
+        unmeasured,
+        dependencies,
+        archive,
+        assertions,
+        premiseSections: workspace.config.assertions.premises,
+        unverifiedRulings: rulings.unverified,
+    });
+    return {
+        brief,
+        base,
+        dependencies: dependencies.changes,
+        report: { findings: [...rulings.problems, ...report.findings], counts: tally([...rulings.problems, ...report.findings]) },
+    };
+}
+function tally(findings) {
+    const counts = { error: 0, warning: 0, note: 0 };
+    for (const finding of findings)
+        counts[finding.severity] += 1;
+    return counts;
+}
+/* -------------------------------------------------------------- escalation */
+async function escalationDirectory(workspace) {
+    return stateDirectory(workspace.commonDir, 'escalations');
+}
+export async function listEscalations(workspace) {
+    const directory = await escalationDirectory(workspace);
+    const out = [];
+    for (const name of (await readdir(directory)).filter((n) => n.endsWith('.json')).sort()) {
+        try {
+            out.push(JSON.parse(await readFile(join(directory, name), 'utf8')));
+        }
+        catch {
+            // A request that cannot be read is skipped; listing it would list nothing true.
+        }
+    }
+    return out;
+}
+export async function raiseEscalation(workspace, brief, request) {
+    const existing = await listEscalations(workspace);
+    const id = nextId('E', brief.id, existing.map((e) => e.id));
+    const full = {
+        id,
+        brief: brief.id,
+        briefFile: brief.file,
+        paths: request.paths,
+        reason: request.reason,
+        options: request.options,
+        recommendation: request.recommendation,
+        created: new Date().toISOString(),
+        branch: workspace.branch,
+        head: await revision('HEAD', workspace.root),
+    };
+    await writeAtomic(join(await escalationDirectory(workspace), `${id}.json`), `${JSON.stringify(full, null, 2)}\n`);
+    return { request: full, memo: renderMemo(full) };
+}
+/** Writes a person's ruling into the brief and retires the request. Never commits: the signature is the person's. */
+export async function recordRuling(workspace, escalationId, decision, note, reader) {
+    const request = (await listEscalations(workspace)).find((candidate) => candidate.id === escalationId.toUpperCase() || candidate.id === escalationId);
+    if (request === undefined)
+        throw new UsageError(`no escalation "${escalationId}" is waiting; spec-harness escalate --list shows those that are`);
+    const path = join(workspace.root, request.briefFile);
+    const text = await readText(path);
+    if (text === null)
+        throw new UsageError(`${request.briefFile} cannot be read`);
+    const where = reader.sectionTables(text, workspace.config.rulings.section);
+    const taken = readRulings(where.tables).rulings.map((row) => row.id);
+    const id = nextId('R', request.brief, taken);
+    const row = renderRow(id, request.paths, decision, note);
+    await writeAtomic(path, addRulingRow(text, workspace.config.rulings.section, row, where));
+    await rm(join(await escalationDirectory(workspace), `${request.id}.json`), { force: true });
+    return { id, file: request.briefFile, row };
+}
+//# sourceMappingURL=round.js.map

package/dist/round.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"round.js","sourceRoot":"","sources":["../src/round.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,EAA2C,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,aAAa,EAA4D,MAAM,cAAc,CAAC;AAEvG,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACtG,OAAO,EAAE,MAAM,EAAsC,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAyB,MAAM,gBAAgB,CAAC;AACnG,OAAO,EACL,YAAY,EACZ,MAAM,EACN,WAAW,EACX,UAAU,EACV,SAAS,GAIV,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAC/G,OAAO,EAAE,UAAU,EAAkB,MAAM,gBAAgB,CAAC;AAQ5D,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAoB,EAAE,IAAwB;IAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACnF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,wFAAwF,EAAE,CAAC;IAClI,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACrG,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAG,6BAA6B,EAAE,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACjE,CAAC;AAWD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAoB,EAAE,KAAe,EAAE,IAAY,EAAE,MAAsB,EAAE,IAAU;IACxH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAc,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,SAAS;QACnB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,yDAAyD;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC3F,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,6CAA6C,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC3K,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,WAAW,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,6BAA6B,CAAC;QAC1G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC/G,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,UAAU,GAAqC,EAAE,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,0EAA0E;QAC1E,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;;YAC5H,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,SAAS,CAAC,MAAM,IAAI,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAoB,EAAE,KAAe;IACnE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,iBAAiB,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,SAAoB,EACpB,KAAsB,EACtB,OAA2B,EAC3B,KAAwB,EACxB,GAAW,EACX,MAAsB;IAEtB,IAAI,OAAO,GAA8B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,yEAAyE;QACzE,yCAAyC;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CACjG,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC5I,CAAC;AAED,+EAA+E;AAE/E,SAAS,UAAU,CAAC,QAA2B;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/H,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,SAAoB,EAAE,KAAe;IAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAA0J,CAAC;IACnL,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACtI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAoB,EAAE,KAAe,EAAE,IAAY,EAAE,MAAsB;IACvG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACpD,IAAI,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACpF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAAE,SAAS;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC/F,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAoB,EACpB,KAAe,EACf,MAA2B,EAC3B,MAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;QAC1B,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC9C,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;KACnD,CAAC,CAAC;IACH,OAAO,aAAa,CAAC;QACnB,KAAK;QACL,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAC/B,CAAC,EAAE,EAAE,EAAE;QACL,oFAAoF;QACpF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI;YACtD,GAAG,KAAK;YACR,EAAE;YACF,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,SAAS;SAClB,CACJ;QACD,KAAK;QACL,KAAK;QACL,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;QAChD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;KACxC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,iBAAiB,CAAC,SAAoB,EAAE,IAAU;IAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACnE,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAClG,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACjE,IAAI,OAAO,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;YACzC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,SAAoB,EAAE,KAAe,EAAE,IAAU;IAC7E,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;IACvF,MAAM,IAAI,GAAI,MAAM,CAAC,QAAsE,CAAC,IAAI,CAAC;IACjG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAoB,EAAE,KAAe,EAAE,IAAY,EAAE,MAAsB;IACxG,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtG,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,QAAwH,CAAC;IAC/I,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;SACpG,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;IAC5K,CAAC,CAAC,CAAC;AACP,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAoB,EAAE,KAAe,EAAE,MAAsB,EAAE,QAA4B;IACxH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrE,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC;QAClC,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC;QACtC,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;QAC/C,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,4DAA4D,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3J,MAAM,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK;QACL,UAAU;QACV,YAAY;QACZ,OAAO;QACP,UAAU;QACV,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ;QACrD,iBAAiB,EAAE,OAAO,CAAC,UAAU;KACtC,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,IAAI;QACJ,YAAY,EAAE,YAAY,CAAC,OAAO;QAClC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE;KAC1H,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,QAA4B;IACzC,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACjD,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,mBAAmB,CAAC,SAAoB;IACrD,OAAO,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAoB;IACxD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxF,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAsB,CAAC,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAoB,EACpB,KAAe,EACf,OAA0H;IAE1H,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAsB;QAC9B,EAAE;QACF,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACjC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,IAAI,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;KAC7C,CAAC;IACF,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAoB,EACpB,YAAoB,EACpB,QAA0B,EAC1B,IAAY,EACZ,MAAsB;IAEtB,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IACrJ,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,YAAY,iEAAiE,CAAC,CAAC;IACjJ,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,SAAS,iBAAiB,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1F,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC;AAC9C,CAAC","sourcesContent":["/**\n * A round, measured: the operations the command line and the MCP server\n * share. Each gathers what a pure module needs - from git, the disk and the\n * siblings - and hands it over; the decisions are made in `context.ts`,\n * `audit.ts`, `guard.ts` and `rulings.ts`.\n */\n\nimport { createHash } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { readdir, readFile, rm } from 'node:fs/promises';\nimport { join } from 'node:path';\n\nimport { audit, type AssertionOutcome, type AuditReport } from './audit.js';\nimport { sameId } from './branch.js';\nimport { renderContext, type CitedDocument, type ContextPacket, type RuleInForce } from './context.js';\nimport type { DocumentReader } from './document.js';\nimport { readText, repositoryPath, stateDirectory, writeAtomic } from './fs.js';\nimport { blameLine, changes, mergeBase, remoteDefault, revision, show, verifyCommit } from './git.js';\nimport { decide, type Decision, type VerifiedRuling } from './guard.js';\nimport { diffManifest, ecosystemOf, manifestMatcher, type DependencyChange } from './manifests.js';\nimport {\n  addRulingRow,\n  nextId,\n  readRulings,\n  renderMemo,\n  renderRow,\n  type EscalationOption,\n  type EscalationRequest,\n  type RulingRow,\n} from './rulings.js';\nimport type { BriefRow, Finding } from './types.js';\nimport { compileGlob } from './vendor/spec-core/pattern/index.js';\nimport { dirname, isRelativeReference, resolveInside, splitReference } from './vendor/spec-core/path/index.js';\nimport { UsageError, type Workspace } from './workspace.js';\n\n/* -------------------------------------------------------------------- base */\n\nexport type Base =\n  | { readonly kind: 'resolved'; readonly ref: string; readonly sha: string; readonly mergeBase: string; readonly head: string }\n  | { readonly kind: 'unresolved'; readonly reason: string };\n\n/** What the round is measured from: the flag, the configuration, then the remote's default branch. */\nexport async function resolveBase(workspace: Workspace, flag: string | undefined): Promise<Base> {\n  const ref = flag ?? workspace.config.base ?? (await remoteDefault(workspace.root));\n  if (ref === null) {\n    return { kind: 'unresolved', reason: 'no base is named and the remote has no default branch; pass --base <ref> or set \"base\"' };\n  }\n  const sha = await revision(ref, workspace.root);\n  const head = await revision('HEAD', workspace.root);\n  if (sha === null || head === null) return { kind: 'unresolved', reason: `\"${ref}\" names no commit` };\n  const common = await mergeBase(sha, head, workspace.root);\n  if (common === null) return { kind: 'unresolved', reason: `\"${ref}\" and HEAD share no history` };\n  return { kind: 'resolved', ref, sha, mergeBase: common, head };\n}\n\n/* ----------------------------------------------------------------- rulings */\n\nexport interface RulingCheck {\n  readonly rows: readonly RulingRow[];\n  readonly verified: readonly VerifiedRuling[];\n  readonly unverified: readonly { readonly id: string; readonly reason: string }[];\n  readonly problems: readonly Finding[];\n}\n\n/**\n * The brief's rulings, each checked against its signature: the commit that\n * last changed its row must be signed by a principal the base branch's\n * allowed-signers file lists (ADR-0006).\n */\nexport async function checkRulings(workspace: Workspace, brief: BriefRow, text: string, reader: DocumentReader, base: Base): Promise<RulingCheck> {\n  const { rulings: rows, problems } = readRulings(reader.sectionTables(text, workspace.config.rulings.section).tables);\n  const findings: Finding[] = problems.map((problem) => ({\n    rule: 'ruling-unreadable',\n    severity: 'warning',\n    message: problem.message,\n    hint: 'a ruling row is | id | `paths` | allow or deny | note |',\n    file: brief.file,\n    line: problem.line,\n  }));\n  const allows = rows.filter((row) => row.decision === 'allow');\n  if (allows.length === 0) return { rows, verified: [], unverified: [], problems: findings };\n  if (base.kind === 'unresolved') {\n    return { rows, verified: [], unverified: allows.map((row) => ({ id: row.id, reason: `no base to read the allowed signers from: ${base.reason}` })), problems: findings };\n  }\n  const signers = await show(base.sha, workspace.config.rulings.allowedSigners, workspace.root);\n  if (signers === null) {\n    const reason = `${base.ref} has no ${workspace.config.rulings.allowedSigners}, so no signature can count`;\n    return { rows, verified: [], unverified: allows.map((row) => ({ id: row.id, reason })), problems: findings };\n  }\n  const directory = await stateDirectory(workspace.commonDir, 'signers');\n  const file = join(directory, `${createHash('sha256').update(signers).digest('hex').slice(0, 16)}`);\n  await writeAtomic(file, signers);\n  const verified: VerifiedRuling[] = [];\n  const unverified: { id: string; reason: string }[] = [];\n  for (const row of allows) {\n    // The row's line is a line of the text on disk, so it is blamed there: at\n    // HEAD the same number can be another line, one a signed commit wrote,\n    // and an uncommitted row would borrow that commit's signature.\n    const commit = await blameLine(null, brief.file, row.line, workspace.root);\n    if (commit === null || /^0+$/.test(commit)) {\n      unverified.push({ id: row.id, reason: 'its row is not committed' });\n      continue;\n    }\n    const signature = await verifyCommit(commit, file, workspace.root);\n    if (signature.good && signature.principal !== null) verified.push({ id: row.id, paths: row.paths, signer: signature.principal });\n    else unverified.push({ id: row.id, reason: `commit ${commit.slice(0, 12)} last changed its row, and ${signature.detail || 'it is not signed'}` });\n  }\n  return { rows, verified, unverified, problems: findings };\n}\n\n/* ------------------------------------------------------------------- guard */\n\nexport async function briefText(workspace: Workspace, brief: BriefRow): Promise<string> {\n  const text = await readText(join(workspace.root, brief.file));\n  if (text === null) throw new UsageError(`${brief.file} cannot be read`);\n  return text;\n}\n\n/** Decides paths against the brief, with its verified rulings. */\nexport async function checkPaths(\n  workspace: Workspace,\n  brief: BriefRow | null,\n  noBrief: string | undefined,\n  given: readonly string[],\n  cwd: string,\n  reader: DocumentReader,\n): Promise<Decision[]> {\n  let rulings: readonly VerifiedRuling[] = [];\n  const resolved = given.map((path) => ({ given: path, path: repositoryPath(path, workspace.root, cwd) }));\n  if (brief !== null) {\n    // Rulings cost a blame and a signature check each, so they are read only\n    // when a write reaches a protected file.\n    const first = resolved.map(({ path, given: g }) =>\n      decide({ path, given: g, brief, noBrief, rulings: [], outOfScope: workspace.config.outOfScope }),\n    );\n    if (first.some((decision) => decision.reason === 'protected')) {\n      const base = await resolveBase(workspace, undefined);\n      rulings = (await checkRulings(workspace, brief, await briefText(workspace, brief), reader, base)).verified;\n    } else {\n      return first;\n    }\n  }\n  return resolved.map(({ path, given: g }) => decide({ path, given: g, brief, noBrief, rulings, outOfScope: workspace.config.outOfScope }));\n}\n\n/* ----------------------------------------------------------------- context */\n\nfunction scopeBases(patterns: readonly string[]): string[] {\n  const bases = new Set<string>();\n  for (const pattern of patterns) {\n    try {\n      for (const base of compileGlob(pattern, { dialect: 'path', caseSensitive: true }).bases) bases.add(base === '' ? '.' : base);\n    } catch {\n      // spec-brief lint reports a pattern it cannot read; the rules for the rest still count.\n    }\n  }\n  return [...bases].sort();\n}\n\nasync function rulesFor(workspace: Workspace, brief: BriefRow): Promise<readonly RuleInForce[] | { unavailable: string }> {\n  const paths = scopeBases(brief.affectedFiles);\n  if (paths.length === 0) return [];\n  const answer = await workspace.siblings.json('spec-guard', ['query', ...paths, '--json']);\n  if ('absent' in answer) return { unavailable: answer.absent };\n  if (answer.code === 2) return { unavailable: 'spec-guard could not read its specs' };\n  const document = answer.document as { results?: { rules?: { document: string; line: number; kind: string; description: string; reason?: string | null; inForce?: boolean }[] }[] };\n  const seen = new Set<string>();\n  const out: RuleInForce[] = [];\n  for (const result of document.results ?? []) {\n    for (const rule of result.rules ?? []) {\n      const key = `${rule.document}:${rule.line}`;\n      if (rule.inForce === false || seen.has(key)) continue;\n      seen.add(key);\n      out.push({ document: rule.document, line: rule.line, kind: rule.kind, description: rule.description, reason: rule.reason ?? null });\n    }\n  }\n  return out;\n}\n\nasync function citedDocuments(workspace: Workspace, brief: BriefRow, text: string, reader: DocumentReader): Promise<CitedDocument[]> {\n  const seen = new Set<string>();\n  const out: CitedDocument[] = [];\n  for (const citation of reader.citations(text)) {\n    if (!isRelativeReference(citation.target)) continue;\n    let target = splitReference(citation.target).path;\n    try {\n      target = decodeURIComponent(target);\n    } catch {\n      // A destination that is not valid percent-encoding is read as written.\n    }\n    const path = resolveInside(dirname(brief.file), target);\n    if (path === null || path === '' || path === brief.file || seen.has(path)) continue;\n    seen.add(path);\n    const document = /\\.(?:md|markdown|mdx|txt)$/i.test(path);\n    // A link to code or a directory that exists is not a document to include,\n    // and must not be reported as a link that resolves to nothing.\n    if (!document && existsSync(join(workspace.root, path))) continue;\n    const content = document ? await readText(join(workspace.root, path)) : null;\n    const meta = content === null ? { title: null, status: null } : reader.titleAndStatus(content);\n    out.push({ path, title: meta.title, status: meta.status, text: content });\n  }\n  return out;\n}\n\nexport async function buildContext(\n  workspace: Workspace,\n  brief: BriefRow,\n  briefs: readonly BriefRow[],\n  reader: DocumentReader,\n): Promise<ContextPacket> {\n  const text = await briefText(workspace, brief);\n  const base = await resolveBase(workspace, undefined);\n  const [rules, cited, rulings] = await Promise.all([\n    rulesFor(workspace, brief),\n    citedDocuments(workspace, brief, text, reader),\n    checkRulings(workspace, brief, text, reader, base),\n  ]);\n  return renderContext({\n    brief,\n    briefText: text,\n    dependencies: brief.dependsOn.map(\n      (id) =>\n        // spec-brief reports a dependency as its front matter spells it, `7` for brief 007.\n        briefs.find((candidate) => sameId(candidate.id, id)) ?? {\n          ...brief,\n          id,\n          title: '(no such brief)',\n          file: '',\n          phase: 'live',\n          status: 'unknown',\n        },\n    ),\n    cited,\n    rules,\n    rulings: rulings.verified,\n    branch: workspace.branch,\n    base: base.kind === 'resolved' ? base.ref : null,\n    budget: workspace.config.context.budget,\n  });\n}\n\n/* ------------------------------------------------------------------- audit */\n\nasync function dependencyChanges(workspace: Workspace, base: Base): Promise<{ changes: DependencyChange[]; unread: string[] }> {\n  if (base.kind === 'unresolved') return { changes: [], unread: [] };\n  const isManifest = manifestMatcher(workspace.config.dependencies.manifests);\n  const out: DependencyChange[] = [];\n  const unread: string[] = [];\n  for (const change of await changes(base.mergeBase, base.head, workspace.root)) {\n    if (!isManifest(change.path) && !(change.from !== undefined && isManifest(change.from))) continue;\n    const ecosystem = ecosystemOf(change.path);\n    if (ecosystem === null) {\n      unread.push(change.path);\n      continue;\n    }\n    const before = change.status === 'A' ? null : await show(base.mergeBase, change.from ?? change.path, workspace.root);\n    const after = change.status === 'D' ? null : await show(base.head, change.path, workspace.root);\n    const diff = diffManifest(change.path, ecosystem, before, after);\n    if ('error' in diff) unread.push(change.path);\n    else out.push(...diff.changes);\n  }\n  return { changes: out, unread };\n}\n\nasync function archiveReasons(workspace: Workspace, brief: BriefRow, base: Base): Promise<{ blocking: Finding[]; warnings: Finding[] } | { unavailable: string }> {\n  const args = ['archive', brief.id, '--dry-run', '--format', 'json', '--no-color'];\n  if (base.kind === 'resolved') args.push('--base', base.ref);\n  const answer = await workspace.siblings.json('spec-brief', args);\n  if ('absent' in answer) return { unavailable: answer.absent };\n  if (answer.code === 2) return { unavailable: 'spec-brief could not plan the archive' };\n  const plan = (answer.document as { plan?: { blocking?: Finding[]; warnings?: Finding[] } }).plan;\n  return { blocking: plan?.blocking ?? [], warnings: plan?.warnings ?? [] };\n}\n\nasync function briefAssertions(workspace: Workspace, brief: BriefRow, text: string, reader: DocumentReader): Promise<AssertionOutcome[] | { unavailable: string }> {\n  const answer = await workspace.siblings.json('spec-guard', [brief.file, '--ignore-status', '--json']);\n  if ('absent' in answer) return { unavailable: answer.absent };\n  if (answer.code === 2) return { unavailable: 'spec-guard could not run the brief\\'s assertions' };\n  const report = answer.document as { results?: { ok: boolean; description: string; message: string; spec?: { file: string; line: number } }[] };\n  return (report.results ?? [])\n    .filter((result) => result.spec === undefined || result.spec.file.replace(/\\\\/g, '/') === brief.file)\n    .map((result) => {\n      const line = result.spec?.line ?? 0;\n      return { ok: result.ok, description: result.description, message: result.message, line, section: reader.sectionAt(text, line), enclosing: reader.sectionsAt(text, line) };\n    });\n}\n\nexport interface AuditResult {\n  readonly brief: BriefRow;\n  readonly base: Base;\n  readonly report: AuditReport;\n  readonly dependencies: readonly DependencyChange[];\n}\n\nexport async function runAudit(workspace: Workspace, brief: BriefRow, reader: DocumentReader, baseFlag: string | undefined): Promise<AuditResult> {\n  const base = await resolveBase(workspace, baseFlag);\n  const text = await briefText(workspace, brief);\n  const [dependencies, archive, assertions, rulings] = await Promise.all([\n    dependencyChanges(workspace, base),\n    archiveReasons(workspace, brief, base),\n    briefAssertions(workspace, brief, text, reader),\n    checkRulings(workspace, brief, text, reader, base),\n  ]);\n  const unmeasured =\n    base.kind === 'unresolved' ? base.reason : base.mergeBase === base.head ? `${base.ref} and HEAD are the same commit: there is nothing to measure` : null;\n  const report = audit({\n    brief,\n    unmeasured,\n    dependencies,\n    archive,\n    assertions,\n    premiseSections: workspace.config.assertions.premises,\n    unverifiedRulings: rulings.unverified,\n  });\n  return {\n    brief,\n    base,\n    dependencies: dependencies.changes,\n    report: { findings: [...rulings.problems, ...report.findings], counts: tally([...rulings.problems, ...report.findings]) },\n  };\n}\n\nfunction tally(findings: readonly Finding[]): AuditReport['counts'] {\n  const counts = { error: 0, warning: 0, note: 0 };\n  for (const finding of findings) counts[finding.severity] += 1;\n  return counts;\n}\n\n/* -------------------------------------------------------------- escalation */\n\nasync function escalationDirectory(workspace: Workspace): Promise<string> {\n  return stateDirectory(workspace.commonDir, 'escalations');\n}\n\nexport async function listEscalations(workspace: Workspace): Promise<EscalationRequest[]> {\n  const directory = await escalationDirectory(workspace);\n  const out: EscalationRequest[] = [];\n  for (const name of (await readdir(directory)).filter((n) => n.endsWith('.json')).sort()) {\n    try {\n      out.push(JSON.parse(await readFile(join(directory, name), 'utf8')) as EscalationRequest);\n    } catch {\n      // A request that cannot be read is skipped; listing it would list nothing true.\n    }\n  }\n  return out;\n}\n\nexport async function raiseEscalation(\n  workspace: Workspace,\n  brief: BriefRow,\n  request: { paths: readonly string[]; reason: string; options: readonly EscalationOption[]; recommendation: string | null },\n): Promise<{ request: EscalationRequest; memo: string }> {\n  const existing = await listEscalations(workspace);\n  const id = nextId('E', brief.id, existing.map((e) => e.id));\n  const full: EscalationRequest = {\n    id,\n    brief: brief.id,\n    briefFile: brief.file,\n    paths: request.paths,\n    reason: request.reason,\n    options: request.options,\n    recommendation: request.recommendation,\n    created: new Date().toISOString(),\n    branch: workspace.branch,\n    head: await revision('HEAD', workspace.root),\n  };\n  await writeAtomic(join(await escalationDirectory(workspace), `${id}.json`), `${JSON.stringify(full, null, 2)}\\n`);\n  return { request: full, memo: renderMemo(full) };\n}\n\n/** Writes a person's ruling into the brief and retires the request. Never commits: the signature is the person's. */\nexport async function recordRuling(\n  workspace: Workspace,\n  escalationId: string,\n  decision: 'allow' | 'deny',\n  note: string,\n  reader: DocumentReader,\n): Promise<{ id: string; file: string; row: string }> {\n  const request = (await listEscalations(workspace)).find((candidate) => candidate.id === escalationId.toUpperCase() || candidate.id === escalationId);\n  if (request === undefined) throw new UsageError(`no escalation \"${escalationId}\" is waiting; spec-harness escalate --list shows those that are`);\n  const path = join(workspace.root, request.briefFile);\n  const text = await readText(path);\n  if (text === null) throw new UsageError(`${request.briefFile} cannot be read`);\n  const where = reader.sectionTables(text, workspace.config.rulings.section);\n  const taken = readRulings(where.tables).rulings.map((row) => row.id);\n  const id = nextId('R', request.brief, taken);\n  const row = renderRow(id, request.paths, decision, note);\n  await writeAtomic(path, addRulingRow(text, workspace.config.rulings.section, row, where));\n  await rm(join(await escalationDirectory(workspace), `${request.id}.json`), { force: true });\n  return { id, file: request.briefFile, row };\n}\n"]}

package/dist/rulings.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Escalations an agent raises and the rulings a person signs.
+ *
+ * A brief says what a round may not touch. When the round cannot be done
+ * without touching it, the agent stops and asks; a person decides; and the
+ * decision becomes a row in the brief's rulings table:
+ *
+ * ```markdown
+ * ## Rulings
+ *
+ * | Ruling | Paths | Decision | Note |
+ * | --- | --- | --- | --- |
+ * | R-012-1 | `src/db/schema.ts` | allow | Add rotated_at; no other schema change. |
+ * ```
+ *
+ * A row is text, and an agent can write text. What makes a row a ruling is
+ * the commit that last changed it: signed, with a key listed in the allowed
+ * signers file as the base branch has it (ADR-0006). The row states the
+ * decision; the signature says a person made it; the base branch says whose
+ * signatures count. A hash of the row, which the agent could compute as well
+ * as anyone, would say none of that.
+ *
+ * The request itself lives outside the work tree while it waits
+ * (`<git-common-dir>/spec-harness/escalations/`): it is in-flight state, and
+ * only its outcome belongs in the record (spec-core ADR-0005).
+ */
+export interface EscalationOption {
+    readonly label: string;
+    readonly consequence: string;
+}
+export interface EscalationRequest {
+    readonly id: string;
+    readonly brief: string;
+    readonly briefFile: string;
+    readonly paths: readonly string[];
+    readonly reason: string;
+    readonly options: readonly EscalationOption[];
+    readonly recommendation: string | null;
+    readonly created: string;
+    readonly branch: string | null;
+    readonly head: string | null;
+}
+export interface RulingRow {
+    readonly id: string;
+    readonly paths: readonly string[];
+    readonly decision: 'allow' | 'deny';
+    readonly note: string;
+    /** 1-based line of the row in the brief. */
+    readonly line: number;
+}
+/** A table as the Markdown scanner reads it: header cells, and rows with their lines. */
+export interface TableView {
+    readonly headers: readonly string[];
+    readonly rows: readonly {
+        readonly cells: readonly string[];
+        readonly line: number;
+    }[];
+}
+export type RulingProblem = {
+    readonly line: number;
+    readonly message: string;
+};
+/** The globs a paths cell names: backtick-quoted, or comma-separated. */
+export declare function pathsOf(cell: string): string[];
+/**
+ * The rulings in a brief's rulings section, from its tables. A table whose
+ * header does not name the columns is not a rulings table; a row that cannot
+ * be read is a problem to report, never a ruling.
+ */
+export declare function readRulings(tables: readonly TableView[]): {
+    rulings: RulingRow[];
+    problems: RulingProblem[];
+};
+/**
+ * The next free escalation id for a brief, given the ids already taken. The
+ * stem compares without case: `readRulings` reads ids in capitals, so a brief
+ * named `auth` has `R-AUTH-1` taken when this writes `R-auth-2`.
+ */
+export declare function nextId(prefix: 'E' | 'R', brief: string, taken: readonly string[]): string;
+/** The memo a person reads to rule: what, why, the choices, and what each costs. */
+export declare function renderMemo(request: EscalationRequest): string;
+/** The table row a ruling writes. */
+export declare function renderRow(id: string, paths: readonly string[], decision: 'allow' | 'deny', note: string): string;
+/**
+ * The brief with a ruling row added: under the rulings section's table when
+ * there is one, or in a new section at the end. Every other line is left as
+ * it was; line endings are the brief's own.
+ */
+export declare function addRulingRow(text: string, section: string, row: string, where: {
+    readonly headingLine: number | null;
+    readonly tableEndLine: number | null;
+}): string;