@gate-forge/core 0.1.0

package/dist/receipt/index.js

@@ -0,0 +1,154 @@
+/**
+ * Gate-receipt signing and verification (plan 2026-09-13 §5.1, ADR 0005
+ * D3, Phase 4). The receipt is signed by the SAME authority as witness
+ * records — the witness verifier key, HMAC-SHA256 over GF-canonical JSON —
+ * reusing the exact provenance primitives (`createHmac`, `canonicalJson`,
+ * constant-time compare). No second, weaker evidence system exists here:
+ * a receipt without a verifying MAC is rejected, and the MAC domain
+ * (`gateforge.receipt.v1`) is distinct from the ledger attestation domain,
+ * so neither envelope can ever verify as the other.
+ *
+ * Issuance rule (plan Phase 4 item 5): a receipt is minted ONLY after
+ * complete supervision success and evidence grading; verification is
+ * fail-closed — every structural or cryptographic problem is a typed
+ * rejection, never a partial pass.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { canonicalJson } from '../canonical-json.js';
+import { GateReceiptSchema } from '../schemas/gate-receipt.js';
+/** Domain tag binding receipt MACs to the gate-receipt envelope format. */
+export const RECEIPT_DOMAIN = 'gateforge.receipt.v1';
+/** The only receipt envelope version this code produces or honors. */
+export const RECEIPT_VERSION = 1;
+/** Shape a 64-char lowercase hex MAC must have. */
+const MAC_PATTERN = /^[0-9a-f]{64}$/;
+/**
+ * Computes the receipt MAC (ADR 0005 D3): HMAC-SHA256 over the GF-canonical
+ * JSON of `{domain: 'gateforge.receipt.v1', receiptVersion: 1, ...body}`
+ * keyed by the witness verifier key — the same secret the tested suite
+ * never receives for ledger attestations. The fixed domain tag prevents
+ * cross-format signature acceptance in BOTH directions: a v2 ledger MAC
+ * can never verify as a receipt, and a receipt MAC can never verify as a
+ * ledger attestation.
+ *
+ * Args:
+ *   verifierKey: the witness verifier secret (non-empty).
+ *   body: the unsigned receipt body.
+ *
+ * Returns:
+ *   string: 64-char lowercase hex HMAC.
+ *
+ * Throws:
+ *   TypeError: when the verifier key is empty.
+ */
+export function gateReceiptMac(verifierKey, body) {
+    if (typeof verifierKey !== 'string' || verifierKey.length === 0) {
+        throw new TypeError('gateReceiptMac: verifier key must be a non-empty string');
+    }
+    return createHmac('sha256', verifierKey)
+        .update(canonicalJson({
+        domain: RECEIPT_DOMAIN,
+        ...body,
+    }))
+        .digest('hex');
+}
+/**
+ * Verifies a receipt candidate end-to-end (fail closed):
+ * 1. structural — the value must parse against the strict v1 schema;
+ * 2. authenticity — the HMAC must verify over the exact body (a forged
+ *    or tampered receipt is a `mac-fail`, never a downgrade);
+ * 3. binding — when an expected context is given, every supplied digest
+ *    must equal the receipt's (mismatches are typed, per-field);
+ * 4. content — the sealed verdict summary must be clean (blocking 0).
+ * Adversary-controlled input never throws.
+ *
+ * Args:
+ *   verifierKey: the witness verifier secret (non-empty).
+ *   candidate: an arbitrary value (e.g. a parsed receipt.json).
+ *   expected: optional digests the receipt must match for THIS use.
+ *
+ * Returns:
+ *   ReceiptVerification: the validated receipt or a typed rejection.
+ */
+export function verifyGateReceipt(verifierKey, candidate, expected = {}) {
+    if (candidate === undefined || candidate === null) {
+        return { ok: false, rejection: 'missing', detail: 'gate receipt is missing' };
+    }
+    const parsed = GateReceiptSchema.safeParse(candidate);
+    if (!parsed.success) {
+        const issue = parsed.error.issues[0];
+        const path = issue === undefined ? '' : ` at '${issue.path.map(String).join('.')}':`;
+        return {
+            ok: false,
+            rejection: 'malformed',
+            detail: `gate receipt is malformed (expected receiptVersion 1 with the full binding set and mac)` +
+                `${path} ${issue?.message ?? 'unknown schema error'}`,
+        };
+    }
+    const receipt = parsed.data;
+    const { mac, ...body } = receipt;
+    if (typeof verifierKey !== 'string' || verifierKey.length === 0) {
+        return {
+            ok: false,
+            rejection: 'mac-fail',
+            detail: 'gate receipt cannot verify without a verifier key (fail closed)',
+        };
+    }
+    const claimed = mac;
+    if (!MAC_PATTERN.test(claimed)) {
+        return { ok: false, rejection: 'mac-fail', detail: 'gate receipt mac is malformed' };
+    }
+    let expectedMac;
+    let claimedMac;
+    try {
+        expectedMac = Buffer.from(gateReceiptMac(verifierKey, body), 'hex');
+        claimedMac = Buffer.from(claimed, 'hex');
+    }
+    catch {
+        return { ok: false, rejection: 'mac-fail', detail: 'gate receipt mac could not be recomputed' };
+    }
+    if (expectedMac.length !== claimedMac.length || !timingSafeEqual(expectedMac, claimedMac)) {
+        return {
+            ok: false,
+            rejection: 'mac-fail',
+            detail: 'gate receipt signature fails; the receipt was forged or tampered with (fail closed)',
+        };
+    }
+    const digestChecks = [
+        { field: 'inputDigest', receiptValue: receipt.inputDigest, expectedValue: expected.inputDigest, rejection: 'input-digest-mismatch', label: 'input digest' },
+        { field: 'trustedPolicyDigest', receiptValue: receipt.trustedPolicyDigest, expectedValue: expected.trustedPolicyDigest, rejection: 'policy-digest-mismatch', label: 'trusted policy digest' },
+        { field: 'selectionDigest', receiptValue: receipt.selectionDigest, expectedValue: expected.selectionDigest, rejection: 'selection-digest-mismatch', label: 'selection digest' },
+        { field: 'catalogDigest', receiptValue: receipt.catalogDigest, expectedValue: expected.catalogDigest, rejection: 'catalog-digest-mismatch', label: 'catalog digest' },
+        { field: 'executionResultDigest', receiptValue: receipt.executionResultDigest, expectedValue: expected.executionResultDigest, rejection: 'execution-digest-mismatch', label: 'execution-result digest' },
+        {
+            field: 'evidenceAttestationDigest',
+            receiptValue: receipt.evidenceAttestationDigest,
+            expectedValue: expected.evidenceAttestationDigest === undefined ? undefined : expected.evidenceAttestationDigest,
+            rejection: 'attestation-digest-mismatch',
+            label: 'evidence attestation digest',
+        },
+    ];
+    for (const check of digestChecks) {
+        if (check.expectedValue === undefined)
+            continue;
+        if (check.receiptValue !== check.expectedValue) {
+            return {
+                ok: false,
+                rejection: check.rejection,
+                detail: `gate receipt ${check.label} does not match the current run ` +
+                    `('${String(check.receiptValue)}' vs '${String(check.expectedValue)}'); ` +
+                    'the sealed run is not this run (fail closed)',
+            };
+        }
+    }
+    if (receipt.verdictSummary.blocking !== 0) {
+        return {
+            ok: false,
+            rejection: 'not-clean',
+            detail: `gate receipt seals a blocking verdict summary (${String(receipt.verdictSummary.blocking)} blocking); ` +
+                'receipts are issued only after complete success (fail closed)',
+        };
+    }
+    return { ok: true, receipt };
+}
+//# sourceMappingURL=index.js.map

package/dist/receipt/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/receipt/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAoB,MAAM,4BAA4B,CAAC;AAEjF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,mDAAmD;AACnD,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAKrC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,IAAqB;IACvE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC;SACrC,MAAM,CACL,aAAa,CAAC;QACZ,MAAM,EAAE,cAAc;QACtB,GAAG,IAAI;KACR,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAoBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,SAAkB,EAClB,WAOI,EAAE;IAEN,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QACrF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,WAAW;YACtB,MAAM,EACJ,yFAAyF;gBACzF,GAAG,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,sBAAsB,EAAE;SACxD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAmB,CAAC;IAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACjC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE,iEAAiE;SAC1E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC;IACpB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,WAAmB,CAAC;IACxB,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACpE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;QAC1F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,UAAU;YACrB,MAAM,EAAE,qFAAqF;SAC9F,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAMb;QACH,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,WAAW,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,cAAc,EAAE;QAC3J,EAAE,KAAK,EAAE,qBAAqB,EAAE,YAAY,EAAE,OAAO,CAAC,mBAAmB,EAAE,aAAa,EAAE,QAAQ,CAAC,mBAAmB,EAAE,SAAS,EAAE,wBAAwB,EAAE,KAAK,EAAE,uBAAuB,EAAE;QAC7L,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,OAAO,CAAC,eAAe,EAAE,aAAa,EAAE,QAAQ,CAAC,eAAe,EAAE,SAAS,EAAE,2BAA2B,EAAE,KAAK,EAAE,kBAAkB,EAAE;QAC/K,EAAE,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,SAAS,EAAE,yBAAyB,EAAE,KAAK,EAAE,gBAAgB,EAAE;QACrK,EAAE,KAAK,EAAE,uBAAuB,EAAE,YAAY,EAAE,OAAO,CAAC,qBAAqB,EAAE,aAAa,EAAE,QAAQ,CAAC,qBAAqB,EAAE,SAAS,EAAE,2BAA2B,EAAE,KAAK,EAAE,yBAAyB,EAAE;QACxM;YACE,KAAK,EAAE,2BAA2B;YAClC,YAAY,EAAE,OAAO,CAAC,yBAAyB;YAC/C,aAAa,EAAE,QAAQ,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB;YAChH,SAAS,EAAE,6BAA6B;YACxC,KAAK,EAAE,6BAA6B;SACrC;KACF,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,SAAS;QAChD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EACJ,gBAAgB,KAAK,CAAC,KAAK,kCAAkC;oBAC7D,KAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM;oBACzE,8CAA8C;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,WAAW;YACtB,MAAM,EACJ,kDAAkD,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,cAAc;gBACvG,+DAA+D;SAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/report/index.d.ts

@@ -0,0 +1,100 @@
+import type { ClassificationDecisionTrace } from '../classifier/schema.js';
+import type { BlockingEntry } from '../policy/index.js';
+import type { RunManifest } from '../schemas/run-manifest.js';
+import { type ObligationVerdict } from '../verdict/index.js';
+/** Waiver-population counts for report summaries (from the waivers loader). */
+export interface WaiverCounts {
+    /** All waivers found in the configured directory. */
+    total: number;
+    /** Valid at the injected `now` (five fields, unexpired, owner checked). */
+    active: number;
+    /** Expired at the injected `now` (GF-16) — blocking as `invalid`. */
+    expired: number;
+    /** Failed the owner check (GF-17) — blocking as `stale`. */
+    staleOwner: number;
+}
+/**
+ * Effective evaluation scope (plan §12.4): one decision, applied to
+ * obligations and blockers alike. Output-only — the input-snapshot
+ * digest never covers scope labels or report formats, so evidence reuse
+ * for identical inputs is unaffected by scope selection.
+ */
+export interface ScopeMetadata {
+    /** `all` = every obligation evaluated; `changed` = diff-narrowed. */
+    mode: 'all' | 'changed';
+    /** Sorted gate-defining inputs/reasons that forced expansion. */
+    expandedBecause: readonly string[];
+}
+/** Options for {@link renderRun}. */
+export interface RenderRunOptions {
+    /** Output format. */
+    format: 'json' | 'sarif' | 'text';
+    /** Blocking entries (unclassified/unresolved/findings/stale references). */
+    blocking?: readonly BlockingEntry[];
+    /** Waiver-population counts; included in json/text when provided. */
+    waiverCounts?: WaiverCounts;
+    /** Run manifest; included in the json report when provided. */
+    run?: RunManifest;
+    /** Tool version stamped into SARIF `tool.driver.version`. */
+    toolVersion?: string;
+    /**
+     * Effective evaluation scope (plan §12.4); included in json/SARIF and
+     * summarized in text when the scope expanded. Defaults to the full
+     * `all` scope when omitted.
+     */
+    scope?: ScopeMetadata;
+    /**
+     * Classification decision provenance per resource id (ADR 0003):
+     * decision fingerprint + rule trace, included in json/SARIF/text when
+     * provided. Report-visible so any signal change (and hence any
+     * fingerprint change) is auditable — never authoritative input.
+     */
+    classificationTraces?: Record<string, ClassificationDecisionTrace>;
+    /**
+     * Adoption-baseline forgiveness counts (phase 8 C), included in the
+     * json summary and the text report when provided. Baselined debt is
+     * LOUD on every run — a forgiveness that never announces itself is a
+     * silent waiver, and there are none of those in gateforge.
+     * `classificationBlocked` (two-layer adoption) counts blocking entries
+     * waived via the receipt's adopted classification set.
+     */
+    baseline?: {
+        obligations: number;
+        blockingEntries: number;
+        classificationBlocked?: number;
+    };
+}
+/** A run's exit code (architecture contract 4). */
+export type RunExitCode = 0 | 1 | 2;
+/**
+ * Maps a run outcome to its exit code: 2 for config/usage errors,
+ * 1 when any blocking verdict or blocking entry exists, else 0
+ * (clean or waived).
+ *
+ * Args:
+ *   input: verdicts, optional blocking entries, optional config-error flag.
+ *
+ * Returns:
+ *   RunExitCode: 0 clean/waived, 1 unresolved, 2 config.
+ */
+export declare function runExitCode(input: {
+    verdicts: readonly ObligationVerdict[];
+    blocking?: readonly BlockingEntry[];
+    configError?: boolean;
+}): RunExitCode;
+/**
+ * Renders a run's verdicts in the requested format. Output is canonical
+ * JSON for `json`/`sarif` and deterministic text for `text`.
+ *
+ * Args:
+ *   verdicts: per-obligation verdicts (any order; output is sorted).
+ *   options: format, blocking entries, waiver counts, run manifest.
+ *
+ * Returns:
+ *   string: the rendered report.
+ *
+ * Throws:
+ *   Error: when `format` is not one of the three supported formats.
+ */
+export declare function renderRun(verdicts: readonly ObligationVerdict[], options: RenderRunOptions): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/report/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAMhF,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,iEAAiE;IACjE,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,qCAAqC;AACrC,MAAM,WAAW,gBAAgB;IAC/B,qBAAqB;IACrB,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,qEAAqE;IACrE,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,+DAA+D;IAC/D,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IACjC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,QAAQ,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,WAAW,CAOd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,OAAO,EAAE,gBAAgB,GACxB,MAAM,CAkBR"}

package/dist/report/index.js

@@ -0,0 +1,355 @@
+/**
+ * Run reports (architecture contract 4, invariant 8, pin #10): renders
+ * per-obligation verdicts into one of three formats and maps a run to
+ * its exit code.
+ *
+ * - `json`: GF-canonical JSON (recursively key-sorted, no whitespace) of
+ *   the full report document — deterministic, snapshot-able.
+ * - `sarif`: SARIF 2.1.0 projection (pin #10): ruleId = policyId,
+ *   `partialFingerprints.gateforgeFingerprint`, blocking verdicts at
+ *   level `error`, `waived` results carry a suppression with the waiver
+ *   reason, properties carry resourceId/contract/verdict/trustTier.
+ * - `text`: the invariant-8 trace — detector → policy → obligation →
+ *   evidence gap — plus waiver counts. Every block names its evidence.
+ *
+ * Exit codes (contract 4): 0 clean/waived, 1 unresolved obligations
+ * (any blocking verdict or blocking entry), 2 config/usage error.
+ *
+ * Rendering is pure and deterministic: identical inputs serialize
+ * byte-for-byte identically.
+ */
+import { canonicalJson } from '../canonical-json.js';
+import { fingerprint } from '../fingerprints.js';
+import { compareStrings } from '../graph/util.js';
+import { BLOCKING_VERDICTS } from '../verdict/index.js';
+/** The official SARIF 2.1.0 (errata 01) JSON schema location. */
+const SARIF_SCHEMA_URI = 'https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json';
+/**
+ * Maps a run outcome to its exit code: 2 for config/usage errors,
+ * 1 when any blocking verdict or blocking entry exists, else 0
+ * (clean or waived).
+ *
+ * Args:
+ *   input: verdicts, optional blocking entries, optional config-error flag.
+ *
+ * Returns:
+ *   RunExitCode: 0 clean/waived, 1 unresolved, 2 config.
+ */
+export function runExitCode(input) {
+    if (input.configError)
+        return 2;
+    const hasBlockingEntries = (input.blocking ?? []).length > 0;
+    const hasBlockingVerdicts = input.verdicts.some((entry) => BLOCKING_VERDICTS.includes(entry.verdict));
+    return hasBlockingEntries || hasBlockingVerdicts ? 1 : 0;
+}
+/**
+ * Renders a run's verdicts in the requested format. Output is canonical
+ * JSON for `json`/`sarif` and deterministic text for `text`.
+ *
+ * Args:
+ *   verdicts: per-obligation verdicts (any order; output is sorted).
+ *   options: format, blocking entries, waiver counts, run manifest.
+ *
+ * Returns:
+ *   string: the rendered report.
+ *
+ * Throws:
+ *   Error: when `format` is not one of the three supported formats.
+ */
+export function renderRun(verdicts, options) {
+    const entries = [...verdicts].sort((a, b) => compareStrings(a.obligation.id, b.obligation.id));
+    const blocking = [...(options.blocking ?? [])].sort((a, b) => compareStrings(a.kind, b.kind) ||
+        compareStrings(a.resourceId ?? '', b.resourceId ?? '') ||
+        compareStrings(a.detail, b.detail));
+    // The report documents are JSON-safe by construction; the assertion
+    // records that invariant at the canonical-serialization boundary.
+    if (options.format === 'json') {
+        return canonicalJson(jsonReport(entries, options, blocking));
+    }
+    if (options.format === 'sarif') {
+        return canonicalJson(sarifReport(entries, options));
+    }
+    if (options.format === 'text')
+        return textReport(entries, options, blocking);
+    throw new Error(`renderRun: unknown format '${String(options.format)}'`);
+}
+/** Per-verdict summary counts keyed by verdict name. */
+function summarize(entries) {
+    const counts = {
+        satisfied: 0,
+        missing: 0,
+        invalid: 0,
+        unclassified: 0,
+        unresolved: 0,
+        waived: 0,
+        stale: 0,
+    };
+    for (const entry of entries)
+        counts[entry.verdict] += 1;
+    return counts;
+}
+/** Builds the canonical json-format report document. */
+function jsonReport(entries, options, blocking) {
+    const counts = summarize(entries);
+    // The blocking total covers BOTH sources of red: blocking verdicts and
+    // policy blocking entries (findings/stale references block the gate
+    // too — undercounting them would show "0 blocking" next to exit 1).
+    const blockingCount = counts.missing +
+        counts.invalid +
+        counts.unclassified +
+        counts.unresolved +
+        counts.stale +
+        blocking.length;
+    const scope = options.scope ?? { mode: 'all', expandedBecause: [] };
+    const report = {
+        schemaVersion: 1,
+        summary: {
+            obligations: entries.length,
+            blocking: blockingCount,
+            blockingEntries: blocking.length,
+            ...counts,
+            ...(options.baseline !== undefined
+                ? {
+                    baselinedObligations: options.baseline.obligations,
+                    baselinedBlockingEntries: options.baseline.blockingEntries,
+                    ...(options.baseline.classificationBlocked !== undefined
+                        ? { baselinedClassificationBlocked: options.baseline.classificationBlocked }
+                        : {}),
+                }
+                : {}),
+        },
+        // Effective scope (§12.4): which obligations were evaluated and why
+        // the scope expanded. Output-only — never part of the snapshot digest.
+        scope: { mode: scope.mode, expandedBecause: [...scope.expandedBecause] },
+        verdicts: entries.map((entry) => {
+            const record = {
+                obligationId: entry.obligation.id,
+                resourceId: entry.obligation.resourceId,
+                contract: entry.obligation.contract,
+                policyId: entry.obligation.policyId,
+                verdict: entry.verdict,
+                reason: entry.reason,
+                // Stable plan §5.4 cause + next action (ADR 0005): null when the
+                // verdict is clean or no honest mapping exists yet.
+                cause: entry.cause ?? null,
+                nextAction: entry.nextAction ?? null,
+                recordIds: entry.recordIds,
+                fingerprint: fingerprint({
+                    resourceId: entry.obligation.resourceId,
+                    contract: entry.obligation.contract,
+                    policyId: entry.obligation.policyId,
+                    lifecycle: entry.obligation.lifecycle,
+                }),
+                trustTier: entry.trustTier,
+            };
+            if (entry.detector !== undefined && entry.detector !== null) {
+                record['detector'] = entry.detector;
+            }
+            return record;
+        }),
+        blocking,
+    };
+    if (options.run !== undefined) {
+        report['run'] = options.run;
+    }
+    if (options.waiverCounts !== undefined) {
+        report['waiverCounts'] = options.waiverCounts;
+    }
+    if (options.classificationTraces !== undefined) {
+        // Canonical JSON sorts keys, so insertion order is irrelevant.
+        report['classifications'] = options.classificationTraces;
+    }
+    return report;
+}
+/** Builds the SARIF 2.1.0 projection (pin #10). */
+function sarifReport(entries, options) {
+    const ruleIds = [...new Set(entries.map((entry) => entry.obligation.policyId))].sort(compareStrings);
+    const scope = options.scope ?? { mode: 'all', expandedBecause: [] };
+    const ruleIndex = {};
+    ruleIds.forEach((ruleId, index) => {
+        ruleIndex[ruleId] = index;
+    });
+    const results = entries.map((entry) => {
+        const blocking = BLOCKING_VERDICTS.includes(entry.verdict);
+        const result = {
+            ruleId: entry.obligation.policyId,
+            ruleIndex: ruleIndex[entry.obligation.policyId],
+            level: blocking ? 'error' : 'none',
+            message: {
+                text: entry.reason ??
+                    `obligation '${entry.obligation.id}' is ${entry.verdict}`,
+            },
+            properties: {
+                resourceId: entry.obligation.resourceId,
+                contract: entry.obligation.contract,
+                verdict: entry.verdict,
+                trustTier: entry.trustTier,
+                // Stable plan §5.4 cause + next action (ADR 0005), carried under
+                // properties so SARIF consumers see the same codes as text/JSON.
+                cause: entry.cause ?? null,
+                nextAction: entry.nextAction ?? null,
+                ...(options.classificationTraces?.[entry.obligation.resourceId] !== undefined
+                    ? {
+                        classificationFingerprint: options.classificationTraces[entry.obligation.resourceId]?.decisionFingerprint,
+                        classificationRules: options.classificationTraces[entry.obligation.resourceId]?.rules,
+                    }
+                    : {}),
+            },
+            partialFingerprints: {
+                gateforgeFingerprint: fingerprint({
+                    resourceId: entry.obligation.resourceId,
+                    contract: entry.obligation.contract,
+                    policyId: entry.obligation.policyId,
+                    lifecycle: entry.obligation.lifecycle,
+                }),
+            },
+        };
+        if (entry.verdict === 'waived') {
+            result['suppressions'] = [
+                {
+                    kind: 'external',
+                    status: 'accepted',
+                    justification: entry.reason ?? 'waived',
+                },
+            ];
+        }
+        return result;
+    });
+    return {
+        $schema: SARIF_SCHEMA_URI,
+        version: '2.1.0',
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: 'gateforge',
+                        version: options.toolVersion ?? '0.1.0',
+                        rules: ruleIds.map((ruleId) => ({ ruleId })),
+                    },
+                },
+                // Effective evaluation scope (§12.4) in the run property bag:
+                // which obligations were evaluated and why the scope expanded.
+                properties: {
+                    scope: { mode: scope.mode, expandedBecause: [...scope.expandedBecause] },
+                },
+                // Blocking policy entries (unclassified/unresolved resources,
+                // detector findings, stale references) are not obligation
+                // verdicts, so they surface as tool-execution notifications
+                // (SARIF 2.1.0 §3.20) instead of results — visible, error-level,
+                // never silently omitted from the projection.
+                invocations: [
+                    {
+                        toolExecutionNotifications: (options.blocking ?? []).map((entry) => ({
+                            level: 'error',
+                            message: {
+                                text: `[${entry.kind}] ${entry.resourceId ?? entry.name ?? '<unnamed>'} — ${entry.detail}`,
+                            },
+                            properties: {
+                                kind: entry.kind,
+                                // Stable plan §5.4 cause + next action when the entry
+                                // carries one (coverage/strict-enforcement findings).
+                                ...(entry.cause !== undefined && entry.cause !== null
+                                    ? { cause: entry.cause, nextAction: entry.nextAction ?? null }
+                                    : {}),
+                                ...(entry.location !== null ? { location: entry.location } : {}),
+                            },
+                        })),
+                    },
+                ],
+                results,
+            },
+        ],
+    };
+}
+/** One text-format trace block per non-satisfied verdict (invariant 8). */
+function textReport(entries, options, blocking) {
+    const lines = [];
+    const counts = summarize(entries);
+    const blockingCount = counts.missing +
+        counts.invalid +
+        counts.unclassified +
+        counts.unresolved +
+        counts.stale +
+        blocking.length;
+    lines.push(`gateforge run: ${entries.length} obligation(s) — ` +
+        `${counts.satisfied} satisfied, ${counts.waived} waived, ${blockingCount} blocking`);
+    const scope = options.scope;
+    if (scope !== undefined && scope.expandedBecause.length > 0) {
+        lines.push(`scope: all obligations; expanded because ${[...scope.expandedBecause].join(', ')}`);
+    }
+    if (options.waiverCounts !== undefined) {
+        const wc = options.waiverCounts;
+        lines.push(`waivers: ${wc.total} total, ${wc.active} active, ${wc.expired} expired, ` +
+            `${wc.staleOwner} stale-owner`);
+    }
+    if (options.baseline !== undefined) {
+        lines.push(`baseline (adopted): ${options.baseline.obligations} obligation(s) + ` +
+            `${options.baseline.blockingEntries} blocking entry(ies)` +
+            (options.baseline.classificationBlocked !== undefined
+                ? ` + ${options.baseline.classificationBlocked} classification-blocked resource(s)`
+                : '') +
+            ` forgiven — shrink-only: resolve debt, then 'gateforge baseline update'`);
+    }
+    for (const entry of entries) {
+        if (entry.verdict === 'satisfied')
+            continue;
+        lines.push('');
+        lines.push(`[${entry.verdict}] ${entry.obligation.id}`);
+        if (entry.detector !== undefined && entry.detector !== null) {
+            lines.push(`  detector: ${entry.detector.id}@${entry.detector.version}`);
+        }
+        lines.push(`  policy: ${entry.obligation.policyId}`);
+        lines.push(`  obligation: ${entry.obligation.id}`);
+        lines.push(`  fingerprint: ${fingerprint({
+            resourceId: entry.obligation.resourceId,
+            contract: entry.obligation.contract,
+            policyId: entry.obligation.policyId,
+            lifecycle: entry.obligation.lifecycle,
+        })}`);
+        lines.push(`  evidence gap: ${entry.reason ?? '<none>'}`);
+        if (entry.cause !== undefined && entry.cause !== null) {
+            lines.push(`  cause: ${entry.cause}`);
+            lines.push(`  next action: ${entry.nextAction ?? '<none>'}`);
+        }
+        lines.push(`  records: ${entry.recordIds.length > 0 ? entry.recordIds.join(', ') : '<none consulted>'}`);
+    }
+    if (blocking.length > 0) {
+        lines.push('');
+        lines.push('blocking entries (unclassified/unresolved/findings/stale references):');
+        for (const entry of blocking) {
+            const where = entry.location !== null ? ` at ${entry.location.file}:${entry.location.line}` : '';
+            const cause = entry.cause !== undefined && entry.cause !== null
+                ? ` (cause: ${entry.cause} → ${entry.nextAction ?? 'no action available'})`
+                : '';
+            lines.push(`  [${entry.kind}] ${entry.resourceId ?? entry.name ?? '<unnamed>'} — ${entry.detail}${where}${cause}`);
+        }
+    }
+    if (options.classificationTraces !== undefined) {
+        const ids = Object.keys(options.classificationTraces).sort(compareStrings);
+        if (ids.length > 0) {
+            lines.push('');
+            lines.push('classification decisions (automatic, conservative — ADR 0003):');
+            for (const id of ids) {
+                const trace = options.classificationTraces[id];
+                if (trace === undefined)
+                    continue;
+                lines.push(`  ${id}`);
+                lines.push(`    decision fingerprint: ${trace.decisionFingerprint}`);
+                lines.push(`    rules: ${trace.rules.join(', ')}`);
+                if (trace.defaultsApplied.length > 0) {
+                    lines.push(`    defaults applied: ${trace.defaultsApplied.join(', ')}`);
+                }
+                lines.push(`    contributing signals: ${trace.contributingSignalIds.length}`);
+                if (trace.contradictions.length > 0) {
+                    for (const contradiction of trace.contradictions) {
+                        lines.push(`    contradiction [${contradiction.dimension}]: ${contradiction.detail}`);
+                    }
+                }
+            }
+        }
+    }
+    lines.push('');
+    lines.push(`exit code: ${runExitCode({ verdicts: entries, blocking })}`);
+    return `${lines.join('\n')}\n`;
+}
+//# sourceMappingURL=index.js.map

package/dist/report/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAkB,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKlD,OAAO,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAC;AAEhF,iEAAiE;AACjE,MAAM,gBAAgB,GACpB,4FAA4F,CAAC;AAsE/F;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAI3B;IACC,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7D,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACxD,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;IACF,OAAO,kBAAkB,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CACvB,QAAsC,EACtC,OAAyB;IAEzB,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACjD,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC9B,cAAc,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC;QACtD,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,oEAAoE;IACpE,kEAAkE;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAyB,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAyB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7E,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC3E,CAAC;AAED,wDAAwD;AACxD,SAAS,SAAS,CAAC,OAAqC;IACtD,MAAM,MAAM,GAAG;QACb,SAAS,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,CAAC;QACf,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;KACyB,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,SAAS,UAAU,CACjB,OAAqC,EACrC,OAAyB,EACzB,QAAkC;IAElC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,aAAa,GACjB,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,KAAK;QACZ,QAAQ,CAAC,MAAM,CAAC;IAClB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,KAAc,EAAE,eAAe,EAAE,EAAuB,EAAE,CAAC;IAClG,MAAM,MAAM,GAA4B;QACtC,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE;YACP,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,aAAa;YACvB,eAAe,EAAE,QAAQ,CAAC,MAAM;YAChC,GAAG,MAAM;YACT,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAChC,CAAC,CAAC;oBACE,oBAAoB,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;oBAClD,wBAAwB,EAAE,OAAO,CAAC,QAAQ,CAAC,eAAe;oBAC1D,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;wBACtD,CAAC,CAAC,EAAE,8BAA8B,EAAE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EAAE;wBAC5E,CAAC,CAAC,EAAE,CAAC;iBACR;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,oEAAoE;QACpE,uEAAuE;QACvE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE;QACxE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9B,MAAM,MAAM,GAA4B;gBACtC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;gBACjC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACnC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACnC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,iEAAiE;gBACjE,oDAAoD;gBACpD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,WAAW,EAAE,WAAW,CAAC;oBACvB,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;oBACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;oBACnC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;oBACnC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;iBACtC,CAAC;gBACF,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC5D,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;YACtC,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,QAAQ;KACT,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC/C,+DAA+D;QAC/D,MAAM,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mDAAmD;AACnD,SAAS,WAAW,CAClB,OAAqC,EACrC,OAAyB;IAEzB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,KAAc,EAAE,eAAe,EAAE,EAAuB,EAAE,CAAC;IAClG,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,SAAS,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,MAAM,GAA4B;YACtC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACjC,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC/C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAClC,OAAO,EAAE;gBACP,IAAI,EACF,KAAK,CAAC,MAAM;oBACZ,eAAe,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,KAAK,CAAC,OAAO,EAAE;aAC5D;YACD,UAAU,EAAE;gBACV,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;gBACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;gBACnC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,iEAAiE;gBACjE,iEAAiE;gBACjE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,SAAS;oBAC3E,CAAC,CAAC;wBACE,yBAAyB,EACvB,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,mBAAmB;wBAChF,mBAAmB,EACjB,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK;qBACnE;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,mBAAmB,EAAE;gBACnB,oBAAoB,EAAE,WAAW,CAAC;oBAChC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;oBACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;oBACnC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;oBACnC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;iBACtC,CAAC;aACH;SACF,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,cAAc,CAAC,GAAG;gBACvB;oBACE,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,UAAU;oBAClB,aAAa,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ;iBACxC;aACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO;wBACvC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;qBAC7C;iBACF;gBACD,8DAA8D;gBAC9D,+DAA+D;gBAC/D,UAAU,EAAE;oBACV,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,EAAE;iBACzE;gBACD,8DAA8D;gBAC9D,0DAA0D;gBAC1D,4DAA4D;gBAC5D,iEAAiE;gBACjE,8CAA8C;gBAC9C,WAAW,EAAE;oBACX;wBACE,0BAA0B,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;4BACnE,KAAK,EAAE,OAAgB;4BACvB,OAAO,EAAE;gCACP,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,IAAI,WAAW,MAAM,KAAK,CAAC,MAAM,EAAE;6BAC3F;4BACD,UAAU,EAAE;gCACV,IAAI,EAAE,KAAK,CAAC,IAAI;gCAChB,sDAAsD;gCACtD,sDAAsD;gCACtD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;oCACnD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE;oCAC9D,CAAC,CAAC,EAAE,CAAC;gCACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BACjE;yBACF,CAAC,CAAC;qBACJ;iBACF;gBACD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,UAAU,CACjB,OAAqC,EACrC,OAAyB,EACzB,QAAkC;IAElC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,aAAa,GACjB,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,OAAO;QACd,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,UAAU;QACjB,MAAM,CAAC,KAAK;QACZ,QAAQ,CAAC,MAAM,CAAC;IAClB,KAAK,CAAC,IAAI,CACR,kBAAkB,OAAO,CAAC,MAAM,mBAAmB;QACjD,GAAG,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,MAAM,YAAY,aAAa,WAAW,CACtF,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CACR,4CAA4C,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;QAChC,KAAK,CAAC,IAAI,CACR,YAAY,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC,MAAM,YAAY,EAAE,CAAC,OAAO,YAAY;YACxE,GAAG,EAAE,CAAC,UAAU,cAAc,CACjC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CACR,uBAAuB,OAAO,CAAC,QAAQ,CAAC,WAAW,mBAAmB;YACpE,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,sBAAsB;YACzD,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;gBACnD,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,qBAAqB,qCAAqC;gBACnF,CAAC,CAAC,EAAE,CAAC;YACP,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW;YAAE,SAAS;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CACR,kBAAkB,WAAW,CAAC;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU;YACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACnC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;YACnC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;SACtC,CAAC,EAAE,CACL,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACtD,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACtC,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CACR,cAAc,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;gBAC/C,CAAC,CAAC,YAAY,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,UAAU,IAAI,qBAAqB,GAAG;gBAC3E,CAAC,CAAC,EAAE,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,IAAI,WAAW,MAAM,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;YAC7E,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;gBAC/C,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC;gBACrE,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrC,KAAK,CAAC,IAAI,CAAC,yBAAyB,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;wBACjD,KAAK,CAAC,IAAI,CAAC,sBAAsB,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;oBACxF,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,cAAc,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}