@gate-forge/core 0.1.0

package/dist/schemas/adoption.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Adoption record schema (phase 8 workstream C): the loud, one-time
+ * record of `gateforge adopt` — the ONLY sanctioned bulk-add of baseline
+ * fingerprints a repo will ever get. Lives beside the baseline as
+ * `.gateforge/baselines/adoption.json`.
+ *
+ * Sibling-FILE decision (deliberate, vs. an `adoptedAt` field on the
+ * baseline document): the baseline stays a pure
+ * `{schemaVersion, fingerprints}` set. Folding adoption metadata into it
+ * would (a) force every shrink — `baseline update` builds fresh
+ * documents via `updateBaseline` — to carry adoption fields forward,
+ * risking silent loss of the record on the first shrink, and (b) make
+ * the invariant "the bulk-add happened exactly once" rest on a field a
+ * hand-edit can delete to re-arm a second bulk-add. A separate record
+ * inverts that: the check gate honors a baseline ONLY when its adoption
+ * record is present and valid, so an unrecorded (or record-stripped)
+ * baseline forgives nothing — fail closed. Absent file = pre-adoption
+ * baseline (backward compatible with every repo initialized before this
+ * schema existed, including empty init skeletons).
+ */
+import { z } from 'zod';
+/**
+ * The classification layer's id list shape, NON-optional: the record
+ * field wraps this in `.optional()` (absent = pre-layer receipt), while
+ * the capture/shrink helpers validate against THIS schema so a present
+ * list is always a sorted, duplicate-free, non-empty-string array.
+ */
+export declare const ClassificationBlockedIdsSchema: z.ZodArray<z.ZodString>;
+/** The adoption record: who forgave how much, when, on what commit. */
+export declare const AdoptionRecordSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    adoptedAt: z.ZodISODateTime;
+    gitSha: z.ZodNullable<z.ZodString>;
+    adopted: z.ZodNumber;
+    proven: z.ZodNumber;
+    classificationBlocked: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** Inferred adoption-record shape. */
+export type AdoptionRecord = z.infer<typeof AdoptionRecordSchema>;
+//# sourceMappingURL=adoption.d.ts.map

package/dist/schemas/adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../../src/schemas/adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,yBAA6B,CAAC;AAEzE,uEAAuE;AACvE,eAAO,MAAM,oBAAoB;;;;;;;kBAuD7B,CAAC;AAEL,sCAAsC;AACtC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/schemas/adoption.js

@@ -0,0 +1,87 @@
+/**
+ * Adoption record schema (phase 8 workstream C): the loud, one-time
+ * record of `gateforge adopt` — the ONLY sanctioned bulk-add of baseline
+ * fingerprints a repo will ever get. Lives beside the baseline as
+ * `.gateforge/baselines/adoption.json`.
+ *
+ * Sibling-FILE decision (deliberate, vs. an `adoptedAt` field on the
+ * baseline document): the baseline stays a pure
+ * `{schemaVersion, fingerprints}` set. Folding adoption metadata into it
+ * would (a) force every shrink — `baseline update` builds fresh
+ * documents via `updateBaseline` — to carry adoption fields forward,
+ * risking silent loss of the record on the first shrink, and (b) make
+ * the invariant "the bulk-add happened exactly once" rest on a field a
+ * hand-edit can delete to re-arm a second bulk-add. A separate record
+ * inverts that: the check gate honors a baseline ONLY when its adoption
+ * record is present and valid, so an unrecorded (or record-stripped)
+ * baseline forgives nothing — fail closed. Absent file = pre-adoption
+ * baseline (backward compatible with every repo initialized before this
+ * schema existed, including empty init skeletons).
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+/**
+ * The classification layer's id list shape, NON-optional: the record
+ * field wraps this in `.optional()` (absent = pre-layer receipt), while
+ * the capture/shrink helpers validate against THIS schema so a present
+ * list is always a sorted, duplicate-free, non-empty-string array.
+ */
+export const ClassificationBlockedIdsSchema = z.array(z.string().min(1));
+/** The adoption record: who forgave how much, when, on what commit. */
+export const AdoptionRecordSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Adoption instant, ISO-8601, from the run's injected clock. */
+    adoptedAt: z.iso.datetime(),
+    /** HEAD sha of the adopting commit, or null outside a git repo. */
+    gitSha: z
+        .string()
+        .regex(/^[0-9a-f]{40}$/, 'gitSha must be a 40-char lowercase sha1 hex')
+        .nullable(),
+    /** Fingerprints written into the baseline as forgiven (bulk-add size). */
+    adopted: z.number().int().min(0),
+    /** Obligations already satisfied/waived at adoption time (context). */
+    proven: z.number().int().min(0),
+    /**
+     * The classification layer (two-layer adoption): resource ids that
+     * were classification-blocked ([classification] entries with a
+     * derived resource id — e.g. PLANE_UNRESOLVED) at adoption time and
+     * are adopted as the sanctioned starting point. OPTIONAL for
+     * backward compatibility: a receipt without the field was written by
+     * a pre-layer engine and is simply NOT ADOPTED for this layer — the
+     * check forgives nothing classification-shaped without it (fail
+     * closed). Present or absent, the set is SHRINK-ONLY: a resource
+     * leaves only through the explicit `baseline update` path once it
+     * carries a real classification; NEW blocked resources never enter.
+     */
+    classificationBlocked: ClassificationBlockedIdsSchema.optional(),
+})
+    .strict()
+    .superRefine((record, ctx) => {
+    const ids = record.classificationBlocked;
+    if (ids === undefined)
+        return;
+    const sorted = [...ids].sort();
+    for (let index = 0; index < ids.length; index += 1) {
+        const current = ids[index];
+        const expected = sorted[index];
+        if (current !== expected) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['classificationBlocked', index],
+                message: "classificationBlocked must be sorted; expected '" + expected +
+                    "' at index " + index + ", got '" + current + "'",
+            });
+            break;
+        }
+        if (index > 0 && current === ids[index - 1]) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['classificationBlocked', index],
+                message: `duplicate classification-blocked resource id '${current}'`,
+            });
+            break;
+        }
+    }
+});
+//# sourceMappingURL=adoption.js.map

package/dist/schemas/adoption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.js","sourceRoot":"","sources":["../../src/schemas/adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzE,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,iEAAiE;IACjE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,mEAAmE;IACnE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SACtE,QAAQ,EAAE;IACb,0EAA0E;IAC1E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,uEAAuE;IACvE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,qBAAqB,EAAE,8BAA8B,CAAC,QAAQ,EAAE;CACjE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,uBAAuB,EAAE,KAAK,CAAC;gBACtC,OAAO,EACL,kDAAkD,GAAG,QAAQ;oBAC7D,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,GAAG;aACpD,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,uBAAuB,EAAE,KAAK,CAAC;gBACtC,OAAO,EAAE,iDAAiD,OAAO,GAAG;aACrE,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/baseline.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Baseline schema (pin #3): `.gateforge/baselines/obligations.json`.
+ * Baselines store obligation fingerprints (pin #2) and may only ever
+ * SHRINK to a strict subset (invariant 4) — the update command enforces
+ * that; this schema enforces the on-disk shape and ordering.
+ */
+import { z } from 'zod';
+/** A single obligation fingerprint: 64-char lowercase sha256 hex. */
+export declare const FingerprintHexSchema: z.ZodString;
+/** Inferred fingerprint-hex shape. */
+export type FingerprintHex = z.infer<typeof FingerprintHexSchema>;
+/** The baseline document: known-forgiven obligation fingerprints. */
+export declare const BaselineSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    fingerprints: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred baseline-document shape. */
+export type Baseline = z.infer<typeof BaselineSchema>;
+//# sourceMappingURL=baseline.d.ts.map

package/dist/schemas/baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../../src/schemas/baseline.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,aAE+C,CAAC;AAEjF,sCAAsC;AACtC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,qEAAqE;AACrE,eAAO,MAAM,cAAc;;;kBA+BvB,CAAC;AAEL,wCAAwC;AACxC,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/schemas/baseline.js

@@ -0,0 +1,45 @@
+/**
+ * Baseline schema (pin #3): `.gateforge/baselines/obligations.json`.
+ * Baselines store obligation fingerprints (pin #2) and may only ever
+ * SHRINK to a strict subset (invariant 4) — the update command enforces
+ * that; this schema enforces the on-disk shape and ordering.
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+/** A single obligation fingerprint: 64-char lowercase sha256 hex. */
+export const FingerprintHexSchema = z
+    .string()
+    .regex(/^[0-9a-f]{64}$/, 'fingerprint must be a 64-char lowercase sha256 hex');
+/** The baseline document: known-forgiven obligation fingerprints. */
+export const BaselineSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** Sorted, duplicate-free fingerprint list. */
+    fingerprints: z.array(FingerprintHexSchema),
+})
+    .strict()
+    .superRefine((baseline, ctx) => {
+    const sorted = [...baseline.fingerprints].sort();
+    for (let index = 0; index < baseline.fingerprints.length; index += 1) {
+        const current = baseline.fingerprints[index];
+        const expected = sorted[index];
+        if (current !== expected) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['fingerprints', index],
+                message: "fingerprints must be sorted; expected '" + expected +
+                    "' at index " + index + ", got '" + current + "'",
+            });
+            break;
+        }
+        if (index > 0 && current === baseline.fingerprints[index - 1]) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['fingerprints', index],
+                message: `duplicate fingerprint '${current}'`,
+            });
+            break;
+        }
+    }
+});
+//# sourceMappingURL=baseline.js.map

package/dist/schemas/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/schemas/baseline.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,KAAK,CAAC,gBAAgB,EAAE,oDAAoD,CAAC,CAAC;AAKjF,qEAAqE;AACrE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,+CAA+C;IAC/C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;gBAC7B,OAAO,EACL,yCAAyC,GAAG,QAAQ;oBACpD,aAAa,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,GAAG,GAAG;aACpD,CAAC,CAAC;YACH,MAAM;QACR,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,KAAK,QAAQ,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;gBAC7B,OAAO,EAAE,0BAA0B,OAAO,GAAG;aAC9C,CAAC,CAAC;YACH,MAAM;QACR,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/schemas/claim.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Claim schema (plan §4.6): a test's declaration that it covers an
+ * obligation, expressed via native framework metadata (e.g. a Playwright
+ * annotation `{type: 'gateforge', description: '<obligation id>'}`).
+ *
+ * A claim is NOT proof (invariant 2) — it only links a test to an
+ * obligation so the verifier knows which evidence to gather.
+ */
+import { z } from 'zod';
+/**
+ * Obligation reference `<resourceId>:<contract>`: resourceId carries no
+ * colon, contract may (e.g. `crud:update`), so the id splits at the
+ * FIRST colon.
+ */
+export declare const ObligationIdSchema: z.ZodString;
+/** Inferred obligation-id shape. */
+export type ObligationId = z.infer<typeof ObligationIdSchema>;
+/** A test's declared coverage of one obligation. */
+export declare const ClaimSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    obligationId: z.ZodString;
+    testId: z.ZodString;
+    testFile: z.ZodOptional<z.ZodString>;
+    location: z.ZodOptional<z.ZodObject<{
+        file: z.ZodString;
+        line: z.ZodNumber;
+        col: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** Inferred claim shape. */
+export type Claim = z.infer<typeof ClaimSchema>;
+//# sourceMappingURL=claim.d.ts.map

package/dist/schemas/claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim.d.ts","sourceRoot":"","sources":["../../src/schemas/claim.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAM5B,CAAC;AAEJ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,oDAAoD;AACpD,eAAO,MAAM,WAAW;;;;;;;;;;kBAYb,CAAC;AAEZ,4BAA4B;AAC5B,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/schemas/claim.js

@@ -0,0 +1,34 @@
+/**
+ * Claim schema (plan §4.6): a test's declaration that it covers an
+ * obligation, expressed via native framework metadata (e.g. a Playwright
+ * annotation `{type: 'gateforge', description: '<obligation id>'}`).
+ *
+ * A claim is NOT proof (invariant 2) — it only links a test to an
+ * obligation so the verifier knows which evidence to gather.
+ */
+import { z } from 'zod';
+import { LocationSchema, SchemaVersionField } from './common.js';
+/**
+ * Obligation reference `<resourceId>:<contract>`: resourceId carries no
+ * colon, contract may (e.g. `crud:update`), so the id splits at the
+ * FIRST colon.
+ */
+export const ObligationIdSchema = z
+    .string()
+    .min(1)
+    .regex(/^[^:]+:.+$/, "obligation id must match '<resourceId>:<contract>' (split at the first colon)");
+/** A test's declared coverage of one obligation. */
+export const ClaimSchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /** The obligation this test claims to cover. */
+    obligationId: ObligationIdSchema,
+    /** Stable test identifier (framework test id or full title). */
+    testId: z.string().min(1),
+    /** File the test lives in, when the framework provides it. */
+    testFile: z.string().min(1).optional(),
+    /** Source location of the test declaration, when available. */
+    location: LocationSchema.optional(),
+})
+    .strict();
+//# sourceMappingURL=claim.js.map

package/dist/schemas/claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claim.js","sourceRoot":"","sources":["../../src/schemas/claim.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,KAAK,CACJ,YAAY,EACZ,+EAA+E,CAChF,CAAC;AAKJ,oDAAoD;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,gDAAgD;IAChD,YAAY,EAAE,kBAAkB;IAChC,gEAAgE;IAChE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schemas/classification-policy.d.ts

@@ -0,0 +1,84 @@
+/**
+ * `classification-policy.yml` schema (ADR 0003 D5): the repository-wide
+ * deterministic rules replacing hand-authored per-resource
+ * classifications. The policy never decides anything by itself — it is
+ * one INPUT to the classifier lattice, and organization internal rules
+ * are certificate-checked like declarations (a matching name rule alone
+ * NEVER proves internality, ADR 0003 D2 exposure rule 3).
+ */
+import { z } from 'zod';
+/** One trusted internal entry-point category (worker, migration, …). */
+export declare const InternalEntryPointCategorySchema: z.ZodObject<{
+    category: z.ZodString;
+    patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    detector: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred internal entry-point category shape. */
+export type InternalEntryPointCategory = z.infer<typeof InternalEntryPointCategorySchema>;
+/** Match keys an organization internal rule can scope itself by. */
+export declare const InternalRuleMatchSchema: z.ZodObject<{
+    resourceName: z.ZodOptional<z.ZodString>;
+    resourceKind: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred internal-rule match shape. */
+export type InternalRuleMatch = z.infer<typeof InternalRuleMatchSchema>;
+/** One organization internal rule — an input to the certificate, not an override. */
+export declare const InternalRuleSchema: z.ZodObject<{
+    match: z.ZodObject<{
+        resourceName: z.ZodOptional<z.ZodString>;
+        resourceKind: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+/** Inferred internal-rule shape. */
+export type InternalRule = z.infer<typeof InternalRuleSchema>;
+/**
+ * One coverage requirement (red-team round 3): the named detector must
+ * report examining every applicable file for a scan to count as COMPLETE.
+ * Coverage is per-detector by capability — never a flattened union
+ * (a detector that cannot see routes reading a file proves nothing about
+ * route coverage). A rule naming a detector that is not configured, or
+ * that does not report coverage, fails the attestation — so removing a
+ * required detector from the config cannot silently pass a closed-world
+ * proof.
+ */
+export declare const CoverageRuleSchema: z.ZodObject<{
+    capability: z.ZodString;
+    detector: z.ZodString;
+    appliesTo: z.ZodArray<z.ZodString>;
+    exhaustive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/** Inferred coverage-rule shape. */
+export type CoverageRule = z.infer<typeof CoverageRuleSchema>;
+/**
+ * The classification-policy document: scan roots (complete-scan scope),
+ * trusted internal entry-point categories, organization internal rules,
+ * the supported source declaration syntax, and volatile fields.
+ */
+export declare const ClassificationPolicySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    scanRoots: z.ZodArray<z.ZodString>;
+    trustedInternalEntryPoints: z.ZodArray<z.ZodObject<{
+        category: z.ZodString;
+        patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        detector: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    internalRules: z.ZodArray<z.ZodObject<{
+        match: z.ZodObject<{
+            resourceName: z.ZodOptional<z.ZodString>;
+            resourceKind: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        reason: z.ZodString;
+    }, z.core.$strict>>;
+    coverage: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        capability: z.ZodString;
+        detector: z.ZodString;
+        appliesTo: z.ZodArray<z.ZodString>;
+        exhaustive: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>>;
+    declarations: z.ZodRecord<z.ZodString, z.ZodString>;
+    volatileFields: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred classification-policy shape. */
+export type ClassificationPolicy = z.infer<typeof ClassificationPolicySchema>;
+//# sourceMappingURL=classification-policy.d.ts.map

package/dist/schemas/classification-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification-policy.d.ts","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,wEAAwE;AACxE,eAAO,MAAM,gCAAgC;;;;kBAmBlC,CAAC;AAEZ,oDAAoD;AACpD,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;kBAUhC,CAAC;AAEL,0CAA0C;AAC1C,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,qFAAqF;AACrF,eAAO,MAAM,kBAAkB;;;;;;kBAOpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;kBAyBpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;kBAmC5B,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/classification-policy.js

@@ -0,0 +1,130 @@
+/**
+ * `classification-policy.yml` schema (ADR 0003 D5): the repository-wide
+ * deterministic rules replacing hand-authored per-resource
+ * classifications. The policy never decides anything by itself — it is
+ * one INPUT to the classifier lattice, and organization internal rules
+ * are certificate-checked like declarations (a matching name rule alone
+ * NEVER proves internality, ADR 0003 D2 exposure rule 3).
+ */
+import { z } from 'zod';
+import { SchemaVersionField } from './common.js';
+/** One trusted internal entry-point category (worker, migration, …). */
+export const InternalEntryPointCategorySchema = z
+    .object({
+    /** Stable category name signals assert, e.g. `worker`. */
+    category: z.string().min(1),
+    /**
+     * Repo-root-relative glob patterns files of this category live in
+     * (advisory; detectors categorize, the classifier checks the name).
+     */
+    patterns: z.array(z.string().min(1)).optional(),
+    /**
+     * The ONLY bundled detector allowed to assert this category's
+     * reachability (red-team round 5). Reachability evidence is
+     * load-bearing for the internality certificate — suppressive in
+     * effect — so it is accepted only from this detector, only at
+     * locations the detector's own coverage report includes. Absent ⇒
+     * no plugin may assert the category (reachability unavailable).
+     */
+    detector: z.string().min(1).optional(),
+})
+    .strict();
+/** Match keys an organization internal rule can scope itself by. */
+export const InternalRuleMatchSchema = z
+    .object({
+    /** Glob over the bare resource name (e.g. `*_audit`). Name rules alone are NOT proof. */
+    resourceName: z.string().min(1).optional(),
+    /** Exact detector kind the rule applies to (e.g. `sqlalchemy.table`). */
+    resourceKind: z.string().min(1).optional(),
+})
+    .strict()
+    .refine((match) => match.resourceName !== undefined || match.resourceKind !== undefined, {
+    message: 'internal rule must match on at least one of resourceName / resourceKind',
+});
+/** One organization internal rule — an input to the certificate, not an override. */
+export const InternalRuleSchema = z
+    .object({
+    /** What the rule matches. */
+    match: InternalRuleMatchSchema,
+    /** Why the organization classifies these resources internal (rendered in traces). */
+    reason: z.string().min(1),
+})
+    .strict();
+/**
+ * One coverage requirement (red-team round 3): the named detector must
+ * report examining every applicable file for a scan to count as COMPLETE.
+ * Coverage is per-detector by capability — never a flattened union
+ * (a detector that cannot see routes reading a file proves nothing about
+ * route coverage). A rule naming a detector that is not configured, or
+ * that does not report coverage, fails the attestation — so removing a
+ * required detector from the config cannot silently pass a closed-world
+ * proof.
+ */
+export const CoverageRuleSchema = z
+    .object({
+    /**
+     * The capability this rule grants over its files, e.g.
+     * `exposure.http`. Negative proofs are capability-scoped: a
+     * closed-world EXPOSURE proof requires every requested file to be
+     * covered by an `exposure.*` rule. A rule without an exposure
+     * capability (model discovery, task linkage, …) can never serve an
+     * exposure negative proof, whatever it scanned.
+     */
+    capability: z.string().min(1),
+    /** Plugin id of the detector whose coverage is required. */
+    detector: z.string().min(1),
+    /** Repo-root-relative globs: the files this detector must examine. */
+    appliesTo: z.array(z.string().min(1)).min(1),
+    /**
+     * Declares the detector an EXHAUSTIVE parser for the capability over
+     * these files — an organization assertion the engine enforces as
+     * written (bundled detector, reported coverage). Only exhaustive
+     * rules may serve negative proofs. A regex heuristic must NOT be
+     * declared exhaustive; without an exhaustive exposure rule, internality
+     * stays unavailable for the scope (red-team round 6).
+     */
+    exhaustive: z.boolean().optional(),
+})
+    .strict();
+/**
+ * The classification-policy document: scan roots (complete-scan scope),
+ * trusted internal entry-point categories, organization internal rules,
+ * the supported source declaration syntax, and volatile fields.
+ */
+export const ClassificationPolicySchema = z
+    .object({
+    schemaVersion: SchemaVersionField,
+    /**
+     * Repo-root-relative globs defining the scope a closed-world proof
+     * must cover. A non-empty list is the prerequisite of every
+     * complete-scan attestation (ADR 0003 D4); findings or unresolved
+     * entries inside these roots invalidate the attestation.
+     */
+    scanRoots: z.array(z.string().min(1)).min(1),
+    /** Entry-point categories counted as trusted-internal reachability. */
+    trustedInternalEntryPoints: z.array(InternalEntryPointCategorySchema),
+    /** Organization internal rules — certificate inputs, never overrides. */
+    internalRules: z.array(InternalRuleSchema),
+    /**
+     * Coverage requirements for COMPLETE-scan proofs (ADR 0003 D4). A
+     * closed-world attestation holds only when every rule's detector is
+     * configured, reports coverage, and covers every applicable requested
+     * file. Declaring none means no scan is provably complete — closed-
+     * world proofs stay unavailable (fail closed).
+     */
+    coverage: z.array(CoverageRuleSchema).optional(),
+    /**
+     * Supported source declaration syntax: the machine-readable keys
+     * detectors may translate into declaration signals (e.g.
+     * `internality: 'gateforge:internal'`). Declarations are assertions
+     * consumed by the classifier — contradictory code signals still block.
+     */
+    declarations: z.record(z.string(), z.string().min(1)),
+    /**
+     * Bookkeeping columns that never satisfy an update by themselves
+     * (mirrors the verdict engine's `updateableFields` fail-closed rule).
+     */
+    volatileFields: z.array(z.string().min(1)),
+})
+    .strict();
+//# sourceMappingURL=classification-policy.js.map

package/dist/schemas/classification-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,yFAAyF;IACzF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;IACvF,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAKL,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,6BAA6B;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,uEAAuE;IACvE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACrE,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schemas/classification-signal.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Classification-signal schemas (ADR 0003 D1): the framework-neutral
+ * evidence contract detectors emit so core can classify resources
+ * automatically. A signal is a FACT — source-located, detector-versioned,
+ * basis-typed — never a classification and never authoritative. Core's
+ * deterministic rule lattice (ADR 0003 D2) turns signals into decisions.
+ *
+ * Anti-pattern guards encoded here:
+ * - no confidence score field (a signal has a `basis`, not a probability);
+ * - every signal must carry a `Location` and a detector identity;
+ * - `code-negative-closed-world` names the only basis allowed to
+ *   suppress, and the classifier additionally demands a complete-scan
+ *   attestation before honoring it.
+ */
+import { z } from 'zod';
+/** What a signal addresses: bare name, plane-qualified id, or symbol. */
+export declare const SignalTargetSchema: z.ZodObject<{
+    resourceName: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    symbol: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Inferred signal-target shape. */
+export type SignalTarget = z.infer<typeof SignalTargetSchema>;
+/** Every classification dimension a signal can speak about. */
+export declare const SIGNAL_DIMENSIONS: readonly ["exposure", "plane", "identity", "lifecycle.create", "lifecycle.read", "lifecycle.update", "lifecycle.delete", "delete-semantics", "archive-state", "adapter-binding", "internality"];
+/** Union of signal dimensions. */
+export type SignalDimension = (typeof SIGNAL_DIMENSIONS)[number];
+export declare const SignalDimensionSchema: z.ZodEnum<{
+    exposure: "exposure";
+    plane: "plane";
+    identity: "identity";
+    "lifecycle.create": "lifecycle.create";
+    "lifecycle.read": "lifecycle.read";
+    "lifecycle.update": "lifecycle.update";
+    "lifecycle.delete": "lifecycle.delete";
+    "delete-semantics": "delete-semantics";
+    "archive-state": "archive-state";
+    "adapter-binding": "adapter-binding";
+    internality: "internality";
+}>;
+/**
+ * The evidence basis of a signal (ADR 0003 D1). Only
+ * `code-negative-closed-world` may ever suppress obligations, and only
+ * when the classifier's complete-scan attestation holds.
+ */
+export declare const SignalBasisSchema: z.ZodEnum<{
+    "code-positive": "code-positive";
+    "code-negative-closed-world": "code-negative-closed-world";
+    declaration: "declaration";
+    "organization-policy": "organization-policy";
+}>;
+/** Inferred signal-basis type. */
+export type SignalBasis = z.infer<typeof SignalBasisSchema>;
+/**
+ * Dimension-typed assertion payload: `exposure`/`internality` carry a
+ * boolean or category string, `plane` a plane name, `identity` the
+ * ORDERED primary-key columns, `delete-semantics` `hard|archive`,
+ * `archive-state` the owner-owned archived field values, lifecycle
+ * dimensions a boolean.
+ */
+export declare const SignalAssertionSchema: z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>;
+/** Inferred signal-assertion type. */
+export type SignalAssertion = z.infer<typeof SignalAssertionSchema>;
+/**
+ * One classification signal (ADR 0003 D1). Strict: unknown fields are
+ * detector bugs and must fail validation, not ride along.
+ */
+export declare const ClassificationSignalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    target: z.ZodObject<{
+        resourceName: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        symbol: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    dimension: z.ZodEnum<{
+        exposure: "exposure";
+        plane: "plane";
+        identity: "identity";
+        "lifecycle.create": "lifecycle.create";
+        "lifecycle.read": "lifecycle.read";
+        "lifecycle.update": "lifecycle.update";
+        "lifecycle.delete": "lifecycle.delete";
+        "delete-semantics": "delete-semantics";
+        "archive-state": "archive-state";
+        "adapter-binding": "adapter-binding";
+        internality: "internality";
+    }>;
+    assertion: z.ZodUnion<readonly [z.ZodString, z.ZodBoolean, z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>]>;
+    basis: z.ZodEnum<{
+        "code-positive": "code-positive";
+        "code-negative-closed-world": "code-negative-closed-world";
+        declaration: "declaration";
+        "organization-policy": "organization-policy";
+    }>;
+    source: z.ZodString;
+    location: z.ZodObject<{
+        file: z.ZodString;
+        line: z.ZodNumber;
+        col: z.ZodNumber;
+    }, z.core.$strict>;
+    detector: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** Inferred classification-signal shape. */
+export type ClassificationSignal = z.infer<typeof ClassificationSignalSchema>;
+/**
+ * Canonical signal identity (ADR 0003 D1): sha256 over the GF-canonical
+ * JSON of the full signal document. Any change of location, assertion,
+ * basis, or detector version changes the id — which is what makes
+ * `decisionFingerprint`s stale-aware (plan goal 8).
+ *
+ * Args:
+ *   signal: a validated classification signal.
+ *
+ * Returns:
+ *   string: 64-char lowercase sha256 hex.
+ */
+export declare function signalId(signal: ClassificationSignal): string;
+/**
+ * The plane-assertion payload narrowed, for signals that assert a plane.
+ */
+export declare function planeAssertion(signal: ClassificationSignal): string | null;
+//# sourceMappingURL=classification-signal.d.ts.map

package/dist/schemas/classification-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification-signal.d.ts","sourceRoot":"","sources":["../../src/schemas/classification-signal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;kBASpB,CAAC;AAEZ,oCAAoC;AACpC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,iMAYpB,CAAC;AAEX,kCAAkC;AAClC,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;EAA4B,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;EAK5B,CAAC;AAEH,kCAAkC;AAClC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,oKAKhC,CAAC;AAEH,sCAAsC;AACtC,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA6B5B,CAAC;AAEZ,4CAA4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAE7D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAI1E"}