@descryy/runtime-evidence-correlation 0.0.0

package/dist/collector-version.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `Evidence.collectorVersion`'s source for the `source: "harness"` rows this
+ * package writes when the correlation pass itself breaks. Read from this
+ * package's own `package.json` rather than hand-duplicated into a second
+ * string that can drift from what actually shipped — the same rule
+ * `packages/orchestrator/src/collector-version.ts` already states for the
+ * orchestrator's own direct emissions.
+ */
+export declare const CORRELATOR_VERSION: string;
+//# sourceMappingURL=collector-version.d.ts.map

package/dist/collector-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector-version.d.ts","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,eAAO,MAAM,kBAAkB,EAAE,MAA6E,CAAC"}

package/dist/collector-version.js

@@ -0,0 +1,12 @@
+/**
+ * `Evidence.collectorVersion`'s source for the `source: "harness"` rows this
+ * package writes when the correlation pass itself breaks. Read from this
+ * package's own `package.json` rather than hand-duplicated into a second
+ * string that can drift from what actually shipped — the same rule
+ * `packages/orchestrator/src/collector-version.ts` already states for the
+ * orchestrator's own direct emissions.
+ */
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+export const CORRELATOR_VERSION = require("../package.json").version;
+//# sourceMappingURL=collector-version.js.map

package/dist/collector-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collector-version.js","sourceRoot":"","sources":["../src/collector-version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,kBAAkB,GAAY,OAAO,CAAC,iBAAiB,CAAkC,CAAC,OAAO,CAAC"}

package/dist/correlate-execution.d.ts

@@ -0,0 +1,262 @@
+/**
+ * **The production correlation pass — the caller RT-230 found missing.**
+ *
+ * `graph-correlator` answers "which graph node is this evidence about" as
+ * pure functions over a `SqlDriver`. `EvidenceStore.attribute()` makes an
+ * answer durable. Between those two there was nothing: every real
+ * `attribute()` call site in this repository lived inside a `test/` file,
+ * and the three per-package wrappers
+ * (`openapi-observation/endpoint-comparison.ts`,
+ * `database-observation/graph-mapping.ts`, `test-runner/graph-mapping.ts`)
+ * each say in their own doc comment that attribution needs an `evidenceId`
+ * that only exists after `store.write()` returns — "outside this
+ * collector's own reach. The caller that already holds both the store and
+ * the graph `driver` attributes; this only resolves."
+ *
+ * **This module is that caller.** It is the one shipped thing that owns an
+ * `EvidenceStore` and a graph `driver` together and performs
+ * resolve-then-attribute, so a real Descry run produces evidence that is
+ * *correlated* and not merely *correlatable*.
+ *
+ * ## Why it is a separate module and not part of `runInstrumentedExecution`
+ *
+ * `instrumented-execution.ts`'s own header states the boundary: it "does not
+ * decide whether a finding exists, does not correlate to graph nodes, and
+ * does not drive a browser. Those are separate stages with separate
+ * contracts, and folding them in here would make the one place that
+ * assembles the runtime also the place that judges it." That boundary is
+ * kept. This is a **post-run pass**, run after an execution's evidence is in
+ * the store, taking the graph as a parameter — the same way every other
+ * production function in this repo takes a `SqlDriver` it does not open.
+ * The stage order the architecture diagram (§3) already draws — collectors →
+ * evidence store → graph correlator → runtime findings — is the order these
+ * packages now depend in, with nothing inverted: this package depends on
+ * `graph-correlator`, and `finding` depends on neither.
+ *
+ * ## What it does NOT do, deliberately
+ *
+ * It does not compose findings (RT-027 places that in the finding layer, and
+ * `composeFinding` is where it lives). It does not open a graph, does not
+ * walk one (`traceApi` is the caller's call, RT-026), and does not decide
+ * confidence. It resolves and it attributes; that is the whole job.
+ *
+ * ## The OpenAPI family, wired (RT-232) — and how the earlier objection was met
+ *
+ * This header used to say the OpenAPI comparison family
+ * (`openapi-observation`'s `compareObservedEndpoint` /
+ * `compareObservedExchange`) was left out because "folding a conformance
+ * verdict into an attribution pass would put two different claims in one
+ * output." That objection was right about the risk and wrong about the
+ * remedy: the two claims must not share **an output**, which is not the same
+ * as not sharing **a pass**. So the family is wired, and the separation is
+ * structural rather than by omission:
+ *
+ * - **One graph query, not two.** `compareObservedEndpoint` *calls*
+ *   `resolveEndpointNode` and returns the very same node under
+ *   `documented`. Running both would ask the graph the identical question
+ *   twice and let two families race for `Evidence.graphNodeId`. The HTTP
+ *   family therefore routes **through** the wrapper, which is strictly more
+ *   informative and resolves exactly once.
+ * - **Identity keeps its own vocabulary.** `attributed` and `refusals` are
+ *   unchanged: a resolved endpoint is `family: "endpoint"`,
+ *   `method: "request-url"`; a miss is `not-found`, the same discriminant
+ *   `resolveEndpointNode` itself returns, carrying the wrapper's reason
+ *   verbatim. `undocumented` / `wrong-method` are contract words, and they
+ *   stay out of the identity channel.
+ * - **Conformance is its own field** (`conformance`, `CorrelationConformance`),
+ *   never persisted, never written to the evidence stream, never an
+ *   `EvidenceAttribution`. A reader that only cares about identity can
+ *   ignore it entirely, which is what "not one output" has to mean to be
+ *   worth anything.
+ *
+ * **What the exchange half needs, and what supplies it.** `compareObservedExchange`
+ * additionally consumes an observed **status** and, optionally, the request /
+ * response **bodies** — all three come off evidence that already exists:
+ * `InboundProxy` emits `{method, path, status}` on `NETWORK_RESPONSE` and
+ * `HTTP_ERROR`, and `BrowserNetworkCollector`'s `HTTP_ERROR` adds the captured
+ * response `body`. No declared OpenAPI *document* is read here or anywhere at
+ * runtime: the contract is whatever `adapter-openapi` already wrote into the
+ * graph (`API_ROUTE --SERVES_API--> API_ENDPOINT --`, `--USES_TYPE(roles)--> DTO`),
+ * so nothing new has to be supplied by a run. Two honest limits follow, and are
+ * reported rather than papered over:
+ *
+ * 1. A graph whose `API_ENDPOINT` nodes came from a **framework extractor**
+ *    rather than an OpenAPI document has no DTOs at all, and every declared
+ *    role reads empty — which `compareObservedExchange` correctly reports as
+ *    `statusSurprising: true`, meaning "this operation declares no shape for
+ *    an outcome like this one." Read alone that is indistinguishable from a
+ *    contract violation, so `contractSchemasDeclared` is reported beside it:
+ *    `false` means there was no contract to violate.
+ * 2. A `NETWORK_REQUEST` carries a request body (`postData`) but no status, so
+ *    only the endpoint half runs for it — request-body conformance needs the
+ *    exchange, and a status is not invented to obtain one.
+ *
+ * Bodies are read **after** `EvidenceStore` redaction, which re-serializes a
+ * JSON body with sensitive values replaced by a marker string. Field
+ * *presence* survives that intact; a `type-mismatch` on a non-string-typed
+ * field whose name matches a credential/PII pattern would be redaction's
+ * artifact, not the app's bug.
+ *
+ * ## Families still not wired here, named rather than left implicit
+ *
+ * **`resolveObservedFrontendCaller`** is deliberately excluded, not
+ * pending. It answers "which frontend function calls this endpoint", which
+ * is a question about a *node*, not about an evidence item, and it falls
+ * back to a structural answer when the observed stack does not resolve.
+ * Attributing evidence to a structurally-derived caller would break the
+ * rule the whole confirmed/strongly-supported gate rests on: a named node
+ * must be named by the observation itself.
+ *
+ * ## Refusals stay refusals (RT-229)
+ *
+ * `not-found` / `ambiguous` / `line-mismatch` / `producer-emitted-none` /
+ * `no-table` / `no-location` are correctly-typed **honest refusals**, and
+ * RT-229 ruled that writing `COLLECTOR_ERROR` for one would be a false
+ * failure signal. They are carried through into `refusals`, verbatim
+ * outcome and reason, and nothing about them touches the evidence stream.
+ * The only thing that becomes `COLLECTOR_ERROR` is a resolver or the store
+ * genuinely **throwing** — see `harnessErrors` below.
+ */
+import type { Evidence } from "@descryy/runtime-contracts";
+import type { EvidenceStore } from "@descryy/runtime-evidence-store";
+import type { SqlDriver } from "@descryy/core";
+import { type EndpointComparison, type StatusBucket } from "@descryhq-wq/runtime-openapi-observation";
+/**
+ * Which resolver answered (or refused). Not a confidence ranking — the
+ * families are disjoint by the evidence they read, except that
+ * `log-text-endpoint` is a *second* naming a backend line can carry
+ * alongside its own stack frame (RT-052's case: one observation, two real
+ * graph entities).
+ */
+export type CorrelationFamily = "endpoint" | "symbol" | "database-table" | "test-case" | "log-text-endpoint";
+/**
+ * What the caller declares about one service's evidence: which repository
+ * its symbols belong to, and the on-disk root its runtime paths are
+ * absolute against.
+ *
+ * **Required, never defaulted.** `resolveSymbolNode` takes `repo` as a
+ * required parameter precisely because there is no honest default, and a
+ * pass that guessed one would resolve the wrong repository's identically
+ * named file — RT-031's identity-proxy error at the correlation layer. A
+ * service with no entry here has its symbol-family and test-family evidence
+ * left alone and its name reported in `unscopedServices`; it is never
+ * resolved against a repository nobody named.
+ */
+export interface CorrelationScope {
+    readonly repo: string;
+    /** Absolute on-disk root, so an observed absolute path can be translated exactly. See `resolveSymbolNode`'s own doc. */
+    readonly repoRoot?: string;
+    /** The directory the observed process was launched in, for runtimes that echo their invocation argument verbatim (RT-113). */
+    readonly cwd?: string;
+}
+export interface CorrelateExecutionInput {
+    /** The store the execution's evidence was written to. Provided, never constructed, so the caller owns its lifetime — same rule `InstrumentedExecutionInput.store` states. */
+    readonly store: EvidenceStore;
+    /** The `descry-core` graph this evidence is resolved against. Consumed, never modified. */
+    readonly driver: SqlDriver;
+    readonly executionId: string;
+    /** Service name (`Evidence.service`) → the repository scope its symbols resolve in. */
+    readonly scopeByService?: Readonly<Record<string, CorrelationScope>>;
+}
+/**
+ * One (evidence, node) association this pass made. Structurally an
+ * `EvidenceAttribution` (`@descryy/runtime-finding`) — `evidenceId`,
+ * `graphNodeId`, `method` — so `secondary` can be handed straight to
+ * `composeFinding`'s fourth argument without a translation step. That
+ * assignability is asserted by an executing test rather than by a
+ * dependency, because this package must not depend on the governance layer
+ * it feeds (RT-027: resolution has no opinion on confidence).
+ */
+export interface CorrelationAttribution {
+    readonly evidenceId: string;
+    readonly graphNodeId: string;
+    /** How the association was made — `EvidenceAttribution.method`'s own vocabulary: `"request-url"`, `"stack-frame"`, `"query-table"`, `"test-location"`, `"log-text-endpoint"`. */
+    readonly method: string;
+    readonly family: CorrelationFamily;
+    /** True when this is the naming persisted onto `Evidence.graphNodeId`; false when it is a second naming the store's single column cannot hold. */
+    readonly persisted: boolean;
+}
+/**
+ * A resolver looked and could not answer. **Never an error.** The `outcome`
+ * is the resolver's own discriminant, unchanged, and the `reason` is the
+ * resolver's own sentence — this pass adds no interpretation of its own to
+ * either.
+ */
+export interface CorrelationRefusal {
+    readonly evidenceId: string;
+    readonly family: CorrelationFamily;
+    /** A resolver's own discriminant — `"not-found"`, `"ambiguous"`, `"line-mismatch"`, `"producer-emitted-none"`, `"no-table"`, `"no-location"` — or one of this pass's two input refusals, `"no-method"` and `"no-path"`, which say the observation itself did not name enough to look anything up. */
+    readonly outcome: string;
+    readonly reason: string;
+}
+/**
+ * A resolver or the store **threw** — not "looked and could not answer",
+ * but the correlation machinery itself breaking. Each distinct failure is
+ * also written into the evidence stream as `COLLECTOR_ERROR` /
+ * `source: "harness"`, which is the whole point: RT-229 declined to add
+ * this wrap because there was no production call site to put it at, and
+ * this is that call site.
+ */
+export interface CorrelationHarnessError {
+    /** The `evidenceId` of the `COLLECTOR_ERROR` row written for this failure. */
+    readonly evidenceId: string;
+    readonly detail: string;
+    /** How many times this same failure occurred across the pass. One row is written per distinct failure, not per occurrence. */
+    readonly occurrences: number;
+}
+/**
+ * What `openapi-observation` concluded about one observed HTTP item's
+ * **contract**, as opposed to its identity. Every field is the comparison's
+ * own discriminant or boolean, carried verbatim — this pass derives exactly
+ * one value of its own, `contractSchemasDeclared`, and it is a read of
+ * `ExchangeComparison.declaredRoles`, not a judgement.
+ *
+ * **Nothing here is ever persisted or written into the evidence stream.** A
+ * contract verdict is a claim about the *contract*, not an observation about
+ * the run, and the evidence stream holds observations.
+ */
+export interface CorrelationConformance {
+    readonly evidenceId: string;
+    /** `EndpointComparison`'s own discriminant, verbatim. */
+    readonly endpointOutcome: EndpointComparison["outcome"];
+    /** The comparison's own sentence. `null` for `documented`, which states none. */
+    readonly reason: string | null;
+    /** Non-empty only for `wrong-method`: the verbs this path IS declared under. */
+    readonly declaredUnderMethods: readonly string[];
+    /** `null` when the observation carried no numeric status, so no exchange comparison ran. */
+    readonly statusBucket: StatusBucket | null;
+    /** `ExchangeComparison.statusSurprising`, verbatim. Read together with `contractSchemasDeclared` — see the header. */
+    readonly statusSurprising: boolean | null;
+    /** `SchemaComparison`'s own discriminant, verbatim; `null` when no exchange comparison ran or the endpoint did not resolve. */
+    readonly requestSchema: string | null;
+    readonly responseSchema: string | null;
+    /**
+     * Whether the resolved endpoint's serving routes declare **any** DTO, in any
+     * role. `false` with `statusSurprising: true` means "no contract is indexed
+     * for this endpoint", never "the contract was violated". `null` when no
+     * exchange comparison ran.
+     */
+    readonly contractSchemasDeclared: boolean | null;
+}
+export interface CorrelationPassResult {
+    readonly executionId: string;
+    /** Evidence items a family claimed and actually attempted to resolve. */
+    readonly considered: number;
+    /** Evidence items no family claimed — a CLICK, a SCREENSHOT, a PROCESS_STARTED. Nothing to resolve is not a gap, so these are counted, not refused. */
+    readonly skipped: number;
+    /** Every association made, persisted ones first. */
+    readonly attributed: readonly CorrelationAttribution[];
+    /** The subset that could not be persisted because `Evidence.graphNodeId` holds one node — ready for `composeFinding`'s attributions argument. */
+    readonly secondary: readonly CorrelationAttribution[];
+    readonly refusals: readonly CorrelationRefusal[];
+    /** One entry per HTTP item the OpenAPI comparison actually reached. A separate channel from `attributed`/`refusals`, on purpose — see `CorrelationConformance`. */
+    readonly conformance: readonly CorrelationConformance[];
+    /** Service names carrying symbol/test evidence that `scopeByService` never declared a repository for. Named, never guessed at. */
+    readonly unscopedServices: readonly string[];
+    /** Non-empty means the pass itself broke. See `CorrelationHarnessError`. */
+    readonly harnessErrors: readonly CorrelationHarnessError[];
+}
+/** Which resolver family owns this evidence item, or `null` when none does. */
+export declare function classifyEvidence(evidence: Pick<Evidence, "eventType" | "sourceLocation">): CorrelationFamily | null;
+export declare function correlateExecution(input: CorrelateExecutionInput): CorrelationPassResult;
+//# sourceMappingURL=correlate-execution.d.ts.map

package/dist/correlate-execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlate-execution.d.ts","sourceRoot":"","sources":["../src/correlate-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAoB,MAAM,4BAA4B,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAGL,KAAK,kBAAkB,EAEvB,KAAK,YAAY,EAClB,MAAM,0CAA0C,CAAC;AAMlD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAE7G;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wHAAwH;IACxH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,8HAA8H;IAC9H,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,6KAA6K;IAC7K,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;CACtE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iLAAiL;IACjL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,kJAAkJ;IAClJ,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,qSAAqS;IACrS,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8HAA8H;IAC9H,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACxD,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gFAAgF;IAChF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,4FAA4F;IAC5F,QAAQ,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;IAC3C,sHAAsH;IACtH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1C,+HAA+H;IAC/H,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,GAAG,IAAI,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uJAAuJ;IACvJ,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,UAAU,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACvD,iJAAiJ;IACjJ,QAAQ,CAAC,SAAS,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACjD,mKAAmK;IACnK,QAAQ,CAAC,WAAW,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACxD,kIAAkI;IAClI,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,uBAAuB,EAAE,CAAC;CAC5D;AA8BD,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,gBAAgB,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAWnH;AAmJD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,qBAAqB,CAyPxF"}

package/dist/correlate-execution.js

@@ -0,0 +1,499 @@
+/**
+ * **The production correlation pass — the caller RT-230 found missing.**
+ *
+ * `graph-correlator` answers "which graph node is this evidence about" as
+ * pure functions over a `SqlDriver`. `EvidenceStore.attribute()` makes an
+ * answer durable. Between those two there was nothing: every real
+ * `attribute()` call site in this repository lived inside a `test/` file,
+ * and the three per-package wrappers
+ * (`openapi-observation/endpoint-comparison.ts`,
+ * `database-observation/graph-mapping.ts`, `test-runner/graph-mapping.ts`)
+ * each say in their own doc comment that attribution needs an `evidenceId`
+ * that only exists after `store.write()` returns — "outside this
+ * collector's own reach. The caller that already holds both the store and
+ * the graph `driver` attributes; this only resolves."
+ *
+ * **This module is that caller.** It is the one shipped thing that owns an
+ * `EvidenceStore` and a graph `driver` together and performs
+ * resolve-then-attribute, so a real Descry run produces evidence that is
+ * *correlated* and not merely *correlatable*.
+ *
+ * ## Why it is a separate module and not part of `runInstrumentedExecution`
+ *
+ * `instrumented-execution.ts`'s own header states the boundary: it "does not
+ * decide whether a finding exists, does not correlate to graph nodes, and
+ * does not drive a browser. Those are separate stages with separate
+ * contracts, and folding them in here would make the one place that
+ * assembles the runtime also the place that judges it." That boundary is
+ * kept. This is a **post-run pass**, run after an execution's evidence is in
+ * the store, taking the graph as a parameter — the same way every other
+ * production function in this repo takes a `SqlDriver` it does not open.
+ * The stage order the architecture diagram (§3) already draws — collectors →
+ * evidence store → graph correlator → runtime findings — is the order these
+ * packages now depend in, with nothing inverted: this package depends on
+ * `graph-correlator`, and `finding` depends on neither.
+ *
+ * ## What it does NOT do, deliberately
+ *
+ * It does not compose findings (RT-027 places that in the finding layer, and
+ * `composeFinding` is where it lives). It does not open a graph, does not
+ * walk one (`traceApi` is the caller's call, RT-026), and does not decide
+ * confidence. It resolves and it attributes; that is the whole job.
+ *
+ * ## The OpenAPI family, wired (RT-232) — and how the earlier objection was met
+ *
+ * This header used to say the OpenAPI comparison family
+ * (`openapi-observation`'s `compareObservedEndpoint` /
+ * `compareObservedExchange`) was left out because "folding a conformance
+ * verdict into an attribution pass would put two different claims in one
+ * output." That objection was right about the risk and wrong about the
+ * remedy: the two claims must not share **an output**, which is not the same
+ * as not sharing **a pass**. So the family is wired, and the separation is
+ * structural rather than by omission:
+ *
+ * - **One graph query, not two.** `compareObservedEndpoint` *calls*
+ *   `resolveEndpointNode` and returns the very same node under
+ *   `documented`. Running both would ask the graph the identical question
+ *   twice and let two families race for `Evidence.graphNodeId`. The HTTP
+ *   family therefore routes **through** the wrapper, which is strictly more
+ *   informative and resolves exactly once.
+ * - **Identity keeps its own vocabulary.** `attributed` and `refusals` are
+ *   unchanged: a resolved endpoint is `family: "endpoint"`,
+ *   `method: "request-url"`; a miss is `not-found`, the same discriminant
+ *   `resolveEndpointNode` itself returns, carrying the wrapper's reason
+ *   verbatim. `undocumented` / `wrong-method` are contract words, and they
+ *   stay out of the identity channel.
+ * - **Conformance is its own field** (`conformance`, `CorrelationConformance`),
+ *   never persisted, never written to the evidence stream, never an
+ *   `EvidenceAttribution`. A reader that only cares about identity can
+ *   ignore it entirely, which is what "not one output" has to mean to be
+ *   worth anything.
+ *
+ * **What the exchange half needs, and what supplies it.** `compareObservedExchange`
+ * additionally consumes an observed **status** and, optionally, the request /
+ * response **bodies** — all three come off evidence that already exists:
+ * `InboundProxy` emits `{method, path, status}` on `NETWORK_RESPONSE` and
+ * `HTTP_ERROR`, and `BrowserNetworkCollector`'s `HTTP_ERROR` adds the captured
+ * response `body`. No declared OpenAPI *document* is read here or anywhere at
+ * runtime: the contract is whatever `adapter-openapi` already wrote into the
+ * graph (`API_ROUTE --SERVES_API--> API_ENDPOINT --`, `--USES_TYPE(roles)--> DTO`),
+ * so nothing new has to be supplied by a run. Two honest limits follow, and are
+ * reported rather than papered over:
+ *
+ * 1. A graph whose `API_ENDPOINT` nodes came from a **framework extractor**
+ *    rather than an OpenAPI document has no DTOs at all, and every declared
+ *    role reads empty — which `compareObservedExchange` correctly reports as
+ *    `statusSurprising: true`, meaning "this operation declares no shape for
+ *    an outcome like this one." Read alone that is indistinguishable from a
+ *    contract violation, so `contractSchemasDeclared` is reported beside it:
+ *    `false` means there was no contract to violate.
+ * 2. A `NETWORK_REQUEST` carries a request body (`postData`) but no status, so
+ *    only the endpoint half runs for it — request-body conformance needs the
+ *    exchange, and a status is not invented to obtain one.
+ *
+ * Bodies are read **after** `EvidenceStore` redaction, which re-serializes a
+ * JSON body with sensitive values replaced by a marker string. Field
+ * *presence* survives that intact; a `type-mismatch` on a non-string-typed
+ * field whose name matches a credential/PII pattern would be redaction's
+ * artifact, not the app's bug.
+ *
+ * ## Families still not wired here, named rather than left implicit
+ *
+ * **`resolveObservedFrontendCaller`** is deliberately excluded, not
+ * pending. It answers "which frontend function calls this endpoint", which
+ * is a question about a *node*, not about an evidence item, and it falls
+ * back to a structural answer when the observed stack does not resolve.
+ * Attributing evidence to a structurally-derived caller would break the
+ * rule the whole confirmed/strongly-supported gate rests on: a named node
+ * must be named by the observation itself.
+ *
+ * ## Refusals stay refusals (RT-229)
+ *
+ * `not-found` / `ambiguous` / `line-mismatch` / `producer-emitted-none` /
+ * `no-table` / `no-location` are correctly-typed **honest refusals**, and
+ * RT-229 ruled that writing `COLLECTOR_ERROR` for one would be a false
+ * failure signal. They are carried through into `refusals`, verbatim
+ * outcome and reason, and nothing about them touches the evidence stream.
+ * The only thing that becomes `COLLECTOR_ERROR` is a resolver or the store
+ * genuinely **throwing** — see `harnessErrors` below.
+ */
+import { resolveEndpointFromLogText, resolveSymbolNode } from "@descryy/runtime-graph-correlator";
+import { compareObservedEndpoint, compareObservedExchange, } from "@descryhq-wq/runtime-openapi-observation";
+import { resolveObservedDatabaseQuery } from "@descryhq-wq/runtime-database-observation";
+import { resolveObservedTestCase } from "@descryhq-wq/runtime-test-runner";
+import { CORRELATOR_VERSION } from "./collector-version.js";
+const TEST_EVENT_TYPES = new Set([
+    "TEST_STARTED",
+    "TEST_PASSED",
+    "TEST_FAILED",
+    "TEST_SKIPPED",
+]);
+/**
+ * HTTP evidence, whichever collector produced it: the browser network
+ * collector (`payload.url`, absolute), `InboundProxy` (`payload.path`,
+ * already a path) and `ExternalRequestCollector` (`payload.url`).
+ *
+ * `NETWORK_RESPONSE` is in this set and will usually refuse with
+ * `"no-method"` — the browser collector's response payload carries `url`
+ * but no `method`, because a response observation does not on its own state
+ * which verb produced it. **That is left as a disclosed refusal rather than
+ * joined to the matching request by `requestId`.** The failing exchange is
+ * already attributed through the `HTTP_ERROR` the same collector emits
+ * beside it, which does carry `method`, so the join would buy little and
+ * would make an otherwise strictly per-item pass depend on other items.
+ */
+const HTTP_EVENT_TYPES = new Set([
+    "NETWORK_REQUEST",
+    "NETWORK_RESPONSE",
+    "HTTP_ERROR",
+    "EXTERNAL_REQUEST",
+]);
+/** Which resolver family owns this evidence item, or `null` when none does. */
+export function classifyEvidence(evidence) {
+    if (evidence.eventType === "DATABASE_QUERY")
+        return "database-table";
+    if (TEST_EVENT_TYPES.has(evidence.eventType))
+        return "test-case";
+    // Checked before the source-location branch on purpose: the browser's
+    // NETWORK_REQUEST carries a `sourceLocation` for the *frontend* frame that
+    // issued the call, and treating that as the item's identity would resolve
+    // a request to its caller instead of to the endpoint it named.
+    if (HTTP_EVENT_TYPES.has(evidence.eventType))
+        return "endpoint";
+    const location = evidence.sourceLocation;
+    if (location !== null && location.file !== null && location.functionName !== null)
+        return "symbol";
+    return null;
+}
+function asRecord(payload) {
+    return typeof payload === "object" && payload !== null ? payload : null;
+}
+function stringOrNull(value) {
+    return typeof value === "string" ? value : null;
+}
+/**
+ * `{method, path}` from an HTTP evidence payload, or the reason it is not
+ * there. Accepts `url` (absolute, browser/fetch collectors) and `path`
+ * (`InboundProxy`, which records `req.url` exactly as the client sent it) —
+ * a query string is stripped from either, since `API_ENDPOINT` names carry
+ * a path and never a query.
+ *
+ * `status` and the two bodies are the **exchange** half's inputs, and they
+ * are read here rather than in a second walker so that one function owns the
+ * whole "what did this payload actually observe" question. Each is `null`
+ * when the payload does not carry it — never defaulted, since a guessed
+ * status would manufacture a status-bucket verdict out of nothing.
+ * `postData` is `BrowserNetworkCollector`'s request-body key and `body` is
+ * its response-body key; `requestBody`/`responseBody` are accepted as the
+ * names a future producer would most plausibly use.
+ */
+function httpTarget(payload) {
+    const record = asRecord(payload);
+    if (record === null) {
+        return { ok: false, outcome: "no-path", reason: "The payload is not an object, so it names neither a URL nor a method." };
+    }
+    const method = typeof record["method"] === "string" ? record["method"] : null;
+    const rawUrl = typeof record["url"] === "string" ? record["url"] : null;
+    const rawPath = typeof record["path"] === "string" ? record["path"] : null;
+    let path = null;
+    if (rawUrl !== null) {
+        try {
+            path = new URL(rawUrl).pathname;
+        }
+        catch {
+            return {
+                ok: false,
+                outcome: "no-path",
+                reason: `payload.url ${JSON.stringify(rawUrl)} is not a parseable absolute URL, so no path can be read from it without guessing at a base.`,
+            };
+        }
+    }
+    else if (rawPath !== null) {
+        const queryIndex = rawPath.indexOf("?");
+        path = queryIndex === -1 ? rawPath : rawPath.slice(0, queryIndex);
+    }
+    if (path === null) {
+        return { ok: false, outcome: "no-path", reason: "The payload carries neither `url` nor `path`, so no request path was observed." };
+    }
+    if (method === null) {
+        return {
+            ok: false,
+            outcome: "no-method",
+            reason: "The payload names a path but no HTTP method. An API_ENDPOINT is identified by method AND path, and this " +
+                "observation does not state the method — reported rather than assumed to be GET, and rather than joined to " +
+                "another evidence item that happens to share a request id.",
+        };
+    }
+    return {
+        ok: true,
+        method,
+        path,
+        status: typeof record["status"] === "number" ? record["status"] : null,
+        requestBody: stringOrNull(record["postData"]) ?? stringOrNull(record["requestBody"]),
+        responseBody: stringOrNull(record["body"]) ?? stringOrNull(record["responseBody"]),
+    };
+}
+/**
+ * `EndpointComparison`/`ExchangeComparison` → the two channels, kept apart.
+ *
+ * The identity half deliberately collapses `undocumented` and `wrong-method`
+ * back to `not-found`: both mean "no `API_ENDPOINT` matched this method and
+ * path", which is `resolveEndpointNode`'s own answer and the discriminant the
+ * identity channel has always used. The reason is the comparison's own
+ * sentence, verbatim — for `wrong-method` that sentence is strictly richer
+ * than the resolver's, which is the point of routing through the wrapper.
+ */
+function splitComparison(evidenceId, comparison, exchange) {
+    const identity = comparison.outcome === "documented"
+        ? { family: "endpoint", method: "request-url", nodeId: comparison.endpoint.id, refusal: null }
+        : {
+            family: "endpoint",
+            method: "request-url",
+            nodeId: null,
+            refusal: { outcome: comparison.outcome === "ambiguous" ? "ambiguous" : "not-found", reason: comparison.reason },
+        };
+    const declaredRoles = exchange?.declaredRoles ?? null;
+    const conformance = {
+        evidenceId,
+        endpointOutcome: comparison.outcome,
+        reason: comparison.outcome === "documented" ? null : comparison.reason,
+        declaredUnderMethods: comparison.outcome === "wrong-method" ? comparison.declaredUnderMethods : [],
+        statusBucket: exchange?.statusBucket ?? null,
+        statusSurprising: exchange?.statusSurprising ?? null,
+        requestSchema: exchange?.requestSchema?.outcome ?? null,
+        responseSchema: exchange?.responseSchema?.outcome ?? null,
+        contractSchemasDeclared: declaredRoles === null
+            ? null
+            : declaredRoles.request.length + declaredRoles.response.length + declaredRoles.errorResponse.length > 0,
+    };
+    return { identity, conformance };
+}
+export function correlateExecution(input) {
+    const { store, driver, executionId } = input;
+    const scopeByService = input.scopeByService ?? {};
+    const attributed = [];
+    const secondary = [];
+    const refusals = [];
+    const conformance = [];
+    const unscopedServices = new Set();
+    /** detail → occurrences. Written to the store once each, after the pass, so a dead driver produces one row rather than one per evidence item. */
+    const thrown = new Map();
+    let considered = 0;
+    let skipped = 0;
+    /**
+     * RT-229's declined wrap, now that a call site exists for it. Every
+     * resolver reads the graph through `@descryy/core`'s store reader,
+     * which has no try/catch of its own: a `DriverError` from it propagates
+     * out of a resolver as a throw, and unguarded here it would reject this
+     * whole pass with no evidence trail — the identical "harness machinery
+     * breaks, zero evidence trail" shape RT-219 fixed for `collector.start()`
+     * and RT-228 for `ExecutionController.run()`.
+     *
+     * A throw is NOT a refusal and is deliberately not folded into one: the
+     * item is left unattributed and the failure is reported as the harness's
+     * own, so a reader can tell "we looked and the graph does not have it"
+     * from "our own reader broke" without inspecting payload text.
+     */
+    function attempt(fn, what) {
+        try {
+            return fn();
+        }
+        catch (error) {
+            const cause = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+            const detail = `${what} threw instead of returning a resolution: ${cause}`;
+            thrown.set(detail, (thrown.get(detail) ?? 0) + 1);
+            return null;
+        }
+    }
+    for (const evidence of store.getByExecution(executionId)) {
+        const family = classifyEvidence(evidence);
+        // A backend line carries a possible endpoint naming in its own text
+        // whether or not any family claimed it: a `BACKEND_LOG` with no stack
+        // frame classifies as nothing, and is still the only record that a
+        // particular route was exercised.
+        const backendSourced = evidence.source === "backend-log" || evidence.source === "backend-process";
+        if (family === null && !backendSourced) {
+            skipped += 1;
+            continue;
+        }
+        const outcomes = [];
+        if (family === null)
+            considered += 1;
+        if (family === "endpoint") {
+            considered += 1;
+            const target = httpTarget(evidence.payload);
+            if (!target.ok) {
+                outcomes.push({ family, method: "request-url", nodeId: null, refusal: { outcome: target.outcome, reason: target.reason } });
+            }
+            else {
+                const observed = { method: target.method, path: target.path };
+                // One graph query, through `openapi-observation`'s wrapper — which is
+                // where `resolveEndpointNode` is actually called. Which wrapper
+                // depends on whether a status was observed, and nothing else: the
+                // exchange comparison needs one and it is never invented.
+                const status = target.status;
+                const exchange = status === null
+                    ? null
+                    : attempt(() => compareObservedExchange(driver, {
+                        ...observed,
+                        status,
+                        requestBody: target.requestBody,
+                        responseBody: target.responseBody,
+                    }), "compareObservedExchange");
+                const comparison = status === null ? attempt(() => compareObservedEndpoint(driver, observed), "compareObservedEndpoint") : (exchange?.endpoint ?? null);
+                if (comparison !== null) {
+                    const split = splitComparison(evidence.evidenceId, comparison, exchange);
+                    outcomes.push(split.identity);
+                    conformance.push(split.conformance);
+                }
+            }
+        }
+        else if (family === "database-table") {
+            considered += 1;
+            const resolution = attempt(() => resolveObservedDatabaseQuery(driver, evidence), "resolveObservedDatabaseQuery");
+            if (resolution !== null) {
+                outcomes.push({
+                    family,
+                    method: "query-table",
+                    nodeId: resolution.outcome === "resolved" ? resolution.node.id : null,
+                    refusal: resolution.outcome === "resolved" ? null : { outcome: resolution.outcome, reason: resolution.reason },
+                });
+            }
+        }
+        else if (family === "test-case" || family === "symbol") {
+            const service = evidence.service;
+            const scope = service === null ? undefined : scopeByService[service];
+            if (scope === undefined) {
+                // Not a refusal: the caller never claimed this service's evidence
+                // was resolvable against a repository, so nothing was attempted.
+                // Named here so "we did not try" stays distinguishable from "we
+                // tried and found nothing" (plan §17). The log-text pass below still
+                // runs for backend evidence — `API_ENDPOINT` is workspace-scoped
+                // (DEC-054) and needs no repository to resolve against.
+                unscopedServices.add(service ?? "(no service)");
+                skipped += 1;
+            }
+            else {
+                considered += 1;
+                const options = {
+                    ...(scope.repoRoot === undefined ? {} : { repoRoot: scope.repoRoot }),
+                    ...(scope.cwd === undefined ? {} : { cwd: scope.cwd }),
+                };
+                const location = evidence.sourceLocation;
+                const resolution = family === "test-case"
+                    ? attempt(() => resolveObservedTestCase(driver, evidence, scope.repo, options), "resolveObservedTestCase")
+                    : attempt(() => resolveSymbolNode(driver, {
+                        file: location.file,
+                        symbolName: location.functionName,
+                        ...(location.line === null ? {} : { line: location.line }),
+                    }, scope.repo, options), "resolveSymbolNode");
+                if (resolution !== null) {
+                    outcomes.push({
+                        family,
+                        method: family === "test-case" ? "test-location" : "stack-frame",
+                        nodeId: resolution.outcome === "resolved" ? resolution.node.id : null,
+                        refusal: resolution.outcome === "resolved" ? null : { outcome: resolution.outcome, reason: resolution.reason },
+                    });
+                }
+            }
+        }
+        // The second naming a backend line can carry alongside its own frame
+        // (RT-052, and `continuous-chain.test.ts`'s `extraAttributions` block,
+        // which is the glue this replaces). Attempted for backend-sourced
+        // evidence regardless of which family claimed the item — including a
+        // BACKEND_LOG with no stack at all, where it becomes the item's only
+        // naming and is therefore the one persisted.
+        if (backendSourced) {
+            const text = typeof evidence.payload === "string" ? evidence.payload : JSON.stringify(evidence.payload);
+            const resolution = attempt(() => resolveEndpointFromLogText(driver, text), "resolveEndpointFromLogText");
+            if (resolution !== null && resolution.outcome === "resolved") {
+                outcomes.push({ family: "log-text-endpoint", method: "log-text-endpoint", nodeId: resolution.nodeId, refusal: null });
+            }
+            // A `no-mention` is not a refusal worth reporting: most log lines
+            // simply are not about an endpoint, and recording one per line would
+            // bury the refusals that mean something. `not-found`/`ambiguous` DO
+            // mean something -- the line named routes and the graph could not
+            // place them -- and are reported.
+            else if (resolution !== null && resolution.outcome !== "no-mention") {
+                refusals.push({ evidenceId: evidence.evidenceId, family: "log-text-endpoint", outcome: resolution.outcome, reason: resolution.reason });
+            }
+        }
+        let persistedNodeId = evidence.graphNodeId;
+        for (const outcome of outcomes) {
+            if (outcome.refusal !== null) {
+                refusals.push({ evidenceId: evidence.evidenceId, family: outcome.family, outcome: outcome.refusal.outcome, reason: outcome.refusal.reason });
+                continue;
+            }
+            if (outcome.nodeId === null)
+                continue;
+            if (persistedNodeId === null) {
+                // `attribute()` throws for an unknown id and refuses to overwrite a
+                // different node. Both are real bugs in a caller, and both are
+                // wrapped rather than allowed to abort the pass — the store is the
+                // other half of the machinery this wrap exists to observe.
+                const written = attempt(() => {
+                    store.attribute(evidence.evidenceId, outcome.nodeId);
+                    return true;
+                }, "EvidenceStore.attribute()");
+                if (written === null)
+                    continue;
+                persistedNodeId = outcome.nodeId;
+                attributed.push({ evidenceId: evidence.evidenceId, graphNodeId: outcome.nodeId, method: outcome.method, family: outcome.family, persisted: true });
+                continue;
+            }
+            if (persistedNodeId === outcome.nodeId) {
+                // Already durable — a re-run of the pass, or the same node named
+                // twice. `attribute()` is idempotent for this case, so nothing is
+                // written and the association is still reported.
+                attributed.push({ evidenceId: evidence.evidenceId, graphNodeId: outcome.nodeId, method: outcome.method, family: outcome.family, persisted: true });
+                continue;
+            }
+            const association = {
+                evidenceId: evidence.evidenceId,
+                graphNodeId: outcome.nodeId,
+                method: outcome.method,
+                family: outcome.family,
+                persisted: false,
+            };
+            attributed.push(association);
+            secondary.push(association);
+        }
+    }
+    const harnessErrors = [];
+    for (const [detail, occurrences] of thrown) {
+        const row = store.write({
+            executionId,
+            timestamp: new Date().toISOString(),
+            source: "harness",
+            service: null,
+            process: null,
+            eventType: "COLLECTOR_ERROR",
+            payload: {
+                raw: `correlateExecution: ${detail}${occurrences > 1 ? ` (${occurrences} occurrences in this pass)` : ""}`,
+                error: detail,
+                occurrences,
+            },
+            traceId: null,
+            requestId: null,
+            correlationId: null,
+            graphNodeId: null,
+            sourceLocation: null,
+            stackTrace: null,
+            confidence: 1,
+            collectorVersion: CORRELATOR_VERSION,
+        });
+        harnessErrors.push({ evidenceId: row.evidenceId, detail, occurrences });
+    }
+    return {
+        executionId,
+        considered,
+        skipped,
+        attributed,
+        secondary,
+        refusals,
+        conformance,
+        unscopedServices: [...unscopedServices],
+        harnessErrors,
+    };
+}
+//# sourceMappingURL=correlate-execution.js.map

package/dist/correlate-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlate-execution.js","sourceRoot":"","sources":["../src/correlate-execution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAKH,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAClG,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GAIxB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAE3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAiJ5D,MAAM,gBAAgB,GAAkC,IAAI,GAAG,CAAC;IAC9D,cAAc;IACd,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,gBAAgB,GAAkC,IAAI,GAAG,CAAC;IAC9D,iBAAiB;IACjB,kBAAkB;IAClB,YAAY;IACZ,kBAAkB;CACnB,CAAC,CAAC;AAEH,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,QAAwD;IACvF,IAAI,QAAQ,CAAC,SAAS,KAAK,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IACrE,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,WAAW,CAAC;IACjE,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,+DAA+D;IAC/D,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC;IACzC,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB;IAChC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAE,OAAmC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvG,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CACjB,OAAgB;IAWhB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IAC5H,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9E,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,8FAA8F;aAC5I,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IACrI,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,WAAW;YACpB,MAAM,EACJ,0GAA0G;gBAC1G,4GAA4G;gBAC5G,2DAA2D;SAC9D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,IAAI;QACJ,MAAM,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACtE,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACpF,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CACtB,UAAkB,EAClB,UAA8B,EAC9B,QAAmC;IAEnC,MAAM,QAAQ,GACZ,UAAU,CAAC,OAAO,KAAK,YAAY;QACjC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QAC9F,CAAC,CAAC;YACE,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;SAChH,CAAC;IAER,MAAM,aAAa,GAAG,QAAQ,EAAE,aAAa,IAAI,IAAI,CAAC;IACtD,MAAM,WAAW,GAA2B;QAC1C,UAAU;QACV,eAAe,EAAE,UAAU,CAAC,OAAO;QACnC,MAAM,EAAE,UAAU,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM;QACtE,oBAAoB,EAAE,UAAU,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE;QAClG,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI;QAC5C,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,IAAI,IAAI;QACpD,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,IAAI,IAAI;QACvD,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,IAAI,IAAI;QACzD,uBAAuB,EACrB,aAAa,KAAK,IAAI;YACpB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;KAC5G,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;IAElD,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAC1C,MAAM,WAAW,GAA6B,EAAE,CAAC;IACjD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,iJAAiJ;IACjJ,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEzC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB;;;;;;;;;;;;;OAaG;IACH,SAAS,OAAO,CAAI,EAAW,EAAE,IAAY;QAC3C,IAAI,CAAC;YACH,OAAO,EAAE,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzF,MAAM,MAAM,GAAG,GAAG,IAAI,6CAA6C,KAAK,EAAE,CAAC;YAC3E,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,oEAAoE;QACpE,sEAAsE;QACtE,mEAAmE;QACnE,kCAAkC;QAClC,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,KAAK,aAAa,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,CAAC;QAClG,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAoB,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,IAAI;YAAE,UAAU,IAAI,CAAC,CAAC;QAErC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9H,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC9D,sEAAsE;gBACtE,gEAAgE;gBAChE,kEAAkE;gBAClE,0DAA0D;gBAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,QAAQ,GACZ,MAAM,KAAK,IAAI;oBACb,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,OAAO,CACL,GAAG,EAAE,CACH,uBAAuB,CAAC,MAAM,EAAE;wBAC9B,GAAG,QAAQ;wBACX,MAAM;wBACN,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;qBAClC,CAAC,EACJ,yBAAyB,CAC1B,CAAC;gBACR,MAAM,UAAU,GACd,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;gBAEvI,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACzE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACvC,UAAU,IAAI,CAAC,CAAC;YAChB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,8BAA8B,CAAC,CAAC;YACjH,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM;oBACN,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;oBACrE,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;iBAC/G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;YACjC,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,kEAAkE;gBAClE,iEAAiE;gBACjE,gEAAgE;gBAChE,qEAAqE;gBACrE,iEAAiE;gBACjE,wDAAwD;gBACxD,gBAAgB,CAAC,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC;gBAChD,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,UAAU,IAAI,CAAC,CAAC;gBAChB,MAAM,OAAO,GAAG;oBACd,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACrE,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;iBACvD,CAAC;gBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC;gBACzC,MAAM,UAAU,GACd,MAAM,KAAK,WAAW;oBACpB,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,yBAAyB,CAAC;oBAC1G,CAAC,CAAC,OAAO,CACL,GAAG,EAAE,CACH,iBAAiB,CACf,MAAM,EACN;wBACE,IAAI,EAAE,QAAS,CAAC,IAAK;wBACrB,UAAU,EAAE,QAAS,CAAC,YAAa;wBACnC,GAAG,CAAC,QAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAS,CAAC,IAAI,EAAE,CAAC;qBAC7D,EACD,KAAK,CAAC,IAAI,EACV,OAAO,CACR,EACH,mBAAmB,CACpB,CAAC;gBACR,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;oBACxB,QAAQ,CAAC,IAAI,CAAC;wBACZ,MAAM;wBACN,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;wBAChE,MAAM,EAAE,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;wBACrE,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;qBAC/G,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,uEAAuE;QACvE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,6CAA6C;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxG,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;YACzG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACxH,CAAC;YACD,kEAAkE;YAClE,qEAAqE;YACrE,oEAAoE;YACpE,kEAAkE;YAClE,kCAAkC;iBAC7B,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,mBAAmB,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;QAED,IAAI,eAAe,GAAkB,QAAQ,CAAC,WAAW,CAAC;QAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC7I,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;gBAAE,SAAS;YAEtC,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;gBAC7B,oEAAoE;gBACpE,+DAA+D;gBAC/D,mEAAmE;gBACnE,2DAA2D;gBAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;oBAC3B,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,MAAO,CAAC,CAAC;oBACtD,OAAO,IAAI,CAAC;gBACd,CAAC,EAAE,2BAA2B,CAAC,CAAC;gBAChC,IAAI,OAAO,KAAK,IAAI;oBAAE,SAAS;gBAC/B,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;gBACjC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnJ,SAAS;YACX,CAAC;YAED,IAAI,eAAe,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvC,iEAAiE;gBACjE,kEAAkE;gBAClE,iDAAiD;gBACjD,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnJ,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAA2B;gBAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,KAAK;aACjB,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAA8B,EAAE,CAAC;IACpD,KAAK,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,MAAM,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC;YACtB,WAAW;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,iBAAiB;YAC5B,OAAO,EAAE;gBACP,GAAG,EAAE,uBAAuB,MAAM,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,4BAA4B,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1G,KAAK,EAAE,MAAM;gBACb,WAAW;aACZ;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,IAAI;YACf,aAAa,EAAE,IAAI;YACnB,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,IAAI;YACpB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,CAAC;YACb,gBAAgB,EAAE,kBAAkB;SACrC,CAAC,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO;QACL,WAAW;QACX,UAAU;QACV,OAAO;QACP,UAAU;QACV,SAAS;QACT,QAAQ;QACR,WAAW;QACX,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { correlateExecution, classifyEvidence, type CorrelateExecutionInput, type CorrelationScope, type CorrelationFamily, type CorrelationAttribution, type CorrelationRefusal, type CorrelationConformance, type CorrelationHarnessError, type CorrelationPassResult, } from "./correlate-execution.ts";
+export { CORRELATOR_VERSION } from "./collector-version.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { correlateExecution, classifyEvidence, } from "./correlate-execution.js";
+export { CORRELATOR_VERSION } from "./collector-version.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GASjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@descryy/runtime-evidence-correlation",
+  "version": "0.0.0",
+  "type": "module",
+  "description": "The production correlation pass (RT-230): the one shipped component that owns an EvidenceStore and a descry-core graph driver together and performs resolve-then-attribute over a finished execution's stored evidence. graph-correlator's typed refusals are carried through as refusals, never converted into errors.",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=22.5"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "@descryy/runtime-contracts": "*",
+    "@descryy/runtime-evidence-store": "*",
+    "@descryy/runtime-graph-correlator": "*",
+    "@descryhq-wq/runtime-openapi-observation": "*",
+    "@descryhq-wq/runtime-database-observation": "*",
+    "@descryhq-wq/runtime-test-runner": "*",
+    "@descryy/core": "^0.1.0"
+  }
+}