@happyvertical/smrt-ingestion 0.57.14 → 0.57.16

package/dist/smrt-knowledge.json

@@ -3,21 +3,21 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-ingestion",
-  "packageVersion": "0.57.14",
+  "packageVersion": "0.57.16",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "3234b55aaed3f267ea4266d9159e8a6e2e5b0f678939eea32803d6f55e08b8c8",
-    "packageJson": "b811b4b9a2178937b2c6fd594bdc364d20f602a66c110ac5cbd50eed93fdcc91",
+    "manifest": "a6f525951d3d4f8f2b4e1114cc80073243099a5bc0156d8c30072e099d87a9ad",
+    "packageJson": "f749f65d3838840961823ea7334f863b6f4b548b1d30d59116eb7f39d2aa649f",
     "agents": "dea14442054ec1de798cba9be1fbdd955f44b0e4672639cbf3db8101d290c1fb",
     "moduleDoc:agents/execution.md": "b9ce254892a5dbd44c762b6f8b718d2f2705779d67b893418fc8fcc5677e2179",
     "moduleDoc:README.md": "75ad0e22d27c1cc8b18cd0666f1928a510f45403aeb3be8e5decef8d756b4846",
     "moduleDoc:EXTRACTION.md": "b735a25a7be75f3a13f3f9e92b0c25834c1394835c16ccd73a076d5720c14243",
-    "moduleDoc:PROPOSALS.md": "15109f9a3f1fd5fb5c4390b4d8e691cdef7a2a35e7491791baeb30f602c342e9",
+    "moduleDoc:PROPOSALS.md": "5478b20c7d32a31e0c74500c978c4148cff1939b50c078ec9179556f8e4f810c",
     "moduleDoc:FEEDBACK.md": "1da3dcf033d60aaf3e67c9813efcfe58cb69d3c238aa4526c33edaa884357f06",
     "moduleDoc:REVIEW.md": "dc7514212b58191a4b9ea77d665340cb6e9c8bb18458098cf7b231c45b87f3d1",
     "agentSurface:src/test-support/execution.ts": "1df56aaf1a692d822ed45ecb7e50df7d6806977ff3c03f9eeaf171c64f496865",
-    "agentSurface:src/test-support/proposals.ts": "ab60bd15118400974893041ead2d3e95276c35b4b355bb91b971668fd20aa1dd"
+    "agentSurface:src/test-support/proposals.ts": "e9fa6aadf355aa315a90dd876f06fe65704ef51f343bb9f93f9a7e2c01b2e6ae"
   },
   "exports": [
     ".",
@@ -49,7 +49,7 @@
     "@happyvertical/smrt-vitest": "workspace:*",
     "@types/node": "24.13.6",
     "typescript": "6.0.3",
-    "vite": "8.1.4",
+    "vite": "8.1.6",
     "vitest": "4.1.10",
     "@happyvertical/smrt-content": "workspace:*",
     "@happyvertical/smrt-messages": "workspace:*",
@@ -1614,7 +1614,7 @@
     {
       "path": "PROPOSALS.md",
       "module": "PROPOSALS",
-      "content": "# Application-aware proposal generation\n\n`@happyvertical/smrt-ingestion/proposals` is server-only. Configure\n`IngestionOptions.proposals` and the existing `execution.handlers` catalog.\nHandlers opt into discovery with `discovery.mediaTypes`, `references`, and an\noptional `candidates` callback. There is one catalog: the same operation or\nordered playbook adapter is discovered, validated, previewed, and later applied\nby the execution service. Generation never approves or applies.\n\n## Discovery and authority\n\n`listHandlers(itemId)` returns a bounded detached catalog. The owning execution\nservice checks the current principal, captured permissions/handler/operation\nceiling, policy, confidential scope, public registered operation facts, and\nordered playbook definition. Every configured provider must occur in the current\npolicy's `providers` allowlist. Missing grants remove handlers before model input.\nAn authorized catalog larger than the configured bound is rejected; the host must\nnarrow it explicitly instead of relying on silent truncation.\n\n`findCandidates({itemId,handlerId,handlerVersion,query,limit})` returns\n`{items,truncated}`. Its trusted handler callback receives `HandlerContext` with\nthe authorized transaction executor. Query by tenant and confidential scope\n**before** selecting, ranking, or building labels. Use a bounded query (often\n`limit + 1`) and report `hasMore`. The service projects candidate identity, model,\nrevision and label, then checks every target with the owning execution callback.\nThere are no hidden counts or pagination tokens. Truncated discovery forces\n`needs_review` and cannot enter generated preview.\n\nCompleted generation reload checks process authority, the current attempt, and\nowner/candidate visibility in the same final transaction. Database-backed grant\ncallbacks must use the supplied executor. The owning retention lifecycle encloses\nthat transaction so a denied read cannot roll back an authorized shorter privacy\nceiling; restoration starts only after the outer transaction has rolled back.\n\nCandidate callbacks perform bounded database reads only: no provider I/O, network,\nor domain mutations. Target locks and existing retention enforcement remain\nowned by execution. Hosts configure their database's statement deadlines; an\narbitrary trusted callback is not a sandbox. Each existing-record argument must\nbe a declared top-level `references` field of kind `candidate` with its qualified\nmodel, or `evidence`. Closed JSON argument schemas are required. The host owns\nthat declaration and its target authorization semantics.\n\n## Durable stages\n\n1. Complete extraction through the existing analysis ledger.\n2. Call `prepareGeneration(itemId, extractionAttemptId)`. It reads the current\n   completed/partial immutable extraction and returns configuration with\n   `stage: 'interpret'`, pinned source attempt/revision/input/output/evidence\n   digests, prompt/configuration/catalog/provider versions, limits and thresholds.\n3. Pass that configuration to `analyze(itemId, configuration, requestKey)` and\n   claim its new revision with `claimAnalysis`.\n4. The host's existing job callback routes on the frozen `configuration.stage`:\n   extraction invokes `extractAnalysis`; interpretation invokes\n   `generateProposals(lease)`.\n5. Reload the current completed generation using `getCompletedAnalysis(itemId)`,\n   or pass an explicit attempt ID to additionally reject stale client state.\n   Queued/running revisions never return an older completed attempt.\n\nA generation revision does not rewrite terminal extraction. Reprocessing starts\nwith a new extraction revision, followed by interpretation, while the host keeps\nthe same business intention keys. An interrupted still-current generation lease\ncan be retried; terminal generation output remains immutable. `getGenerationInput`\nreads historical extraction only through the current generation lease and its\nfrozen source pin. It verifies same-item scope, immutable hashes, durable evidence,\nand current process permission before returning detached data. The source must be\nthe immediately preceding revision, so an intervening reprocess invalidates a\nprepared generation. Completed generation reads additionally recheck current\ncatalog and target visibility before disclosing persisted candidate labels.\nExpired, cancelled, revoked, retried or superseded workers cannot read or publish late output. The\ncurrent lease and each offered handler/candidate are rechecked immediately before\neach outbound generative/decision boundary and before publication.\n\n## Providers and validation\n\n`createSDKProposalGenerator(client, identity, {maxTokens,timeoutMs})` uses an\nexisting AI SDK `chat` client. It sends a fixed system instruction and separate\nJSON evidence/catalog data, requests JSON, supplies cancellation and bounds, uses\nno tools or continuation, and rejects known truncation or tool calls,\nunexpected models, malformed JSON and oversized output. Configure SDK clients\nwithout automatic retry that would bypass application boundary checks. The\nadapter's public identity is exactly provider/model/version; credentials and raw\nprovider errors are never provenance.\n\nA trusted custom `ProposalGenerator` must likewise honor cancellation, bound its\nresponse, and explicitly declare validated `complete` or `unknown` completion.\nThe SDK currently normalizes missing/unknown finish reasons to `stop`\n([owning SDK follow-up](https://github.com/happyvertical/sdk/issues/1381)), so its\nadapter conservatively declares `unknown`, persisted as\n`generation_completion_unknown`. Otherwise valid suggestions remain available\nfor human preview; automatic eligibility always remains false. The service\ndeadline aborts requests and prevents late publication; it does not claim to terminate computation at a remote\nprovider or isolate native allocations. Extractor process limits remain separate.\n\nModel output can contain only offered handler versions, schema-valid arguments,\nretained evidence locations and offered alternative handler/candidate keys.\nCandidate IDs must occur in the offered set, and evidence IDs in retained source\nresults. Unknown enums, invented IDs, extra authority/tool/approval fields and\nmalformed structures fail closed. Missing required top-level fields are retained\nas `missingFields`, with `needs_review`; values are never invented to satisfy a\nschema. Observed page/time/source granularity is preserved. Logical scan splits\nuse `proposeDocumentSplits`; originals and hashes remain intact.\n\n`createSDKProposalDecisionClient(client)` adapts an existing SDK client’s optional\ncapability without changing its errors or protocol. Optional `decision` uses public core `executeDecision` and the existing SDK\npredicate, choice, score and batch contracts. Supported-effect predicates,\nhandler classification, candidate entity matching, and action ambiguity/risk\nare distinct questions. Their validated probabilities and provenance are stored\nseparately from generative provenance and unknown OCR certainty. The complete\nserialized decision request, including suggestions and questions, must fit the\nminimum configured/current policy byte ceiling before capability probing and\nagain before deciding. A policy change between these boundaries fails closed.\nTies, support probability or selected-handler confidence below\n`minimumDecisionProbability`, and actually incomplete extraction require review.\nUnknown provider\ncompletion metadata is preserved as `source_completion_unknown`; it does not\nblock otherwise schema-valid **human** preview or imply completeness. Automatic\naction eligibility remains false. An unconfigured decision path\nis recorded explicitly. Configured errors produce a durable safe failure outcome;\nthey never silently switch to a generative decision fallback.\n\nOutput records zero, one or multiple suggestions, alternatives, missing fields,\nsource links, proposed splits, versions, allowlisted usage, warnings and explicit\n`unknown`, `ambiguous`, `no_action`, `needs_review` or `provider_error` outcomes.\n`automaticActionEligible` is always false. Provider input/output and the complete\nserialized persisted envelope are bounded by configuration, live policy and the\nreceipt ceiling. Oversized output becomes a bounded review/limit result; when\nno safe envelope fits, the owning service records fixed `failAnalysis` metadata\noutside the provider payload budget without retaining provider output.\n\n## Explicit preview and stable intentions\n\nThe host chooses persisted suggestion indexes and calls:\n\n```ts\nawait service.previewGeneratedProposals({\n  itemId,\n  attemptId: generationAttemptId,\n  selections: [{\n    index: 0,\n    intentionKey: 'document:meeting-2026-10-09',\n    expectedRevision: 0,\n    requestId: 'review-request-1',\n  }],\n});\n```\n\n`intentionKey` is the host's stable business-intention identity across generation\nrevisions. Never derive a fresh key from model output, suggestion order or a retry.\nSelections must reference current persisted validated `ready_for_review` output.\nEach batch requires distinct suggestion indexes and intention keys; duplicate\nindexes are rejected before any operation or plan preview is written.\nThe service rechecks current catalog/schema/target/source provenance, then calls\nthe existing operation or plan preview. Each result still requires the ordinary\nhuman review and execution APIs. Reprocessing creates no new business identity;\nsuccessful-action replay protection stays with execution.\n\n## Evidence and limits\n\nThe test matrix is `docs/test-matrix/3673-ingestion-proposals.md`. SQLite and real\nPostgreSQL suites exercise authority, revisions, abstention, hostile output,\ncompound proposals, split provenance and reviewed domain effects. The upload\nreference composes authenticated multipart delivery of a generated embedded-text\nPDF through the actual packaged PDF child, durable interpretation, and the existing\nordered ContentDocument draft/retained-asset plan. It checks duplicate delivery,\nunauthenticated and foreign-tenant denial, explicit approval of both steps,\nidempotent execution replay, page provenance, and unchanged original bytes.\nThe compound-email case uses a declared messages-owner snapshot fixture.\n\nLocal HTTP fixtures execute the actual AI SDK transport and cancellation contract.\nGenerative responses and the separate injected PDF split boundaries establish\ndeterministic orchestration, not model accuracy or OCR quality. No held-out routing\nevaluation or automatic approval is claimed. Missing/unknown AI completion remains\nexplicit under [SDK #1381](https://github.com/happyvertical/sdk/issues/1381).\n\nProposal limits are checked at `IngestionService` construction: positive safe\nintegers, at most 20 handlers/candidates/suggestions and 2147483647 ms timeout.\nInterpretation output uses the exported `GenerationAnalysisOutput` wrapper at\n`analysis.result.output.proposals`; the published review host unwraps it.\nAn explicit feedback `retrieve` denial omits optional examples and feedback\nprovenance and continues generation. Item/execution denials, unexpected failures,\nand revocation after examples were selected still fail closed before disclosure.\n"
+      "content": "# Application-aware proposal generation\n\n`@happyvertical/smrt-ingestion/proposals` is server-only. Configure\n`IngestionOptions.proposals` and the existing `execution.handlers` catalog.\nHandlers opt into discovery with `discovery.mediaTypes`, `references`, and an\noptional `candidates` callback. There is one catalog: the same operation or\nordered playbook adapter is discovered, validated, previewed, and later applied\nby the execution service. Generation never approves or applies.\n\nCredential-free review hosts may configure `IngestionOptions.proposalRead` with\n`ProposalReadConfiguration`: public generator/decision identities, version,\nprompt version, limits and thresholds only. It reads completed proposals,\npreserves current authority and snapshot validation, and permits human preview;\nit never accepts a generator or provider client. If a process supplies both\nsettings, their public configuration must match exactly. Preparing or generating\nproposals still requires `proposals` with a real generator.\n\n## Discovery and authority\n\n`listHandlers(itemId)` returns a bounded detached catalog. The owning execution\nservice checks the current principal, captured permissions/handler/operation\nceiling, policy, confidential scope, public registered operation facts, and\nordered playbook definition. Every configured provider must occur in the current\npolicy's `providers` allowlist. Missing grants remove handlers before model input.\nAn authorized catalog larger than the configured bound is rejected; the host must\nnarrow it explicitly instead of relying on silent truncation.\n\n`findCandidates({itemId,handlerId,handlerVersion,query,limit})` returns\n`{items,truncated}`. Its trusted handler callback receives `HandlerContext` with\nthe authorized transaction executor. Query by tenant and confidential scope\n**before** selecting, ranking, or building labels. Use a bounded query (often\n`limit + 1`) and report `hasMore`. The service projects candidate identity, model,\nrevision and label, then checks every target with the owning execution callback.\nThere are no hidden counts or pagination tokens. Truncated discovery forces\n`needs_review` and cannot enter generated preview.\n\nCompleted generation reload checks process authority, the current attempt, and\nowner/candidate visibility in the same final transaction. Database-backed grant\ncallbacks must use the supplied executor. The owning retention lifecycle encloses\nthat transaction so a denied read cannot roll back an authorized shorter privacy\nceiling; restoration starts only after the outer transaction has rolled back.\n\nCandidate callbacks perform bounded database reads only: no provider I/O, network,\nor domain mutations. Target locks and existing retention enforcement remain\nowned by execution. Hosts configure their database's statement deadlines; an\narbitrary trusted callback is not a sandbox. Each existing-record argument must\nbe a declared top-level `references` field of kind `candidate` with its qualified\nmodel, or `evidence`. Closed JSON argument schemas are required. The host owns\nthat declaration and its target authorization semantics.\n\n## Durable stages\n\n1. Complete extraction through the existing analysis ledger.\n2. Call `prepareGeneration(itemId, extractionAttemptId)`. It reads the current\n   completed/partial immutable extraction and returns configuration with\n   `stage: 'interpret'`, pinned source attempt/revision/input/output/evidence\n   digests, prompt/configuration/catalog/provider versions, limits and thresholds.\n3. Pass that configuration to `analyze(itemId, configuration, requestKey)` and\n   claim its new revision with `claimAnalysis`.\n4. The host's existing job callback routes on the frozen `configuration.stage`:\n   extraction invokes `extractAnalysis`; interpretation invokes\n   `generateProposals(lease)`.\n5. Reload the current completed generation using `getCompletedAnalysis(itemId)`,\n   or pass an explicit attempt ID to additionally reject stale client state.\n   Queued/running revisions never return an older completed attempt.\n\nA generation revision does not rewrite terminal extraction. Reprocessing starts\nwith a new extraction revision, followed by interpretation, while the host keeps\nthe same business intention keys. An interrupted still-current generation lease\ncan be retried; terminal generation output remains immutable. `getGenerationInput`\nreads historical extraction only through the current generation lease and its\nfrozen source pin. It verifies same-item scope, immutable hashes, durable evidence,\nand current process permission before returning detached data. The source must be\nthe immediately preceding revision, so an intervening reprocess invalidates a\nprepared generation. Completed generation reads additionally recheck current\ncatalog and target visibility before disclosing persisted candidate labels.\nExpired, cancelled, revoked, retried or superseded workers cannot read or publish late output. The\ncurrent lease and each offered handler/candidate are rechecked immediately before\neach outbound generative/decision boundary and before publication.\n\n## Providers and validation\n\n`createSDKProposalGenerator(client, identity, {maxTokens,timeoutMs})` uses an\nexisting AI SDK `chat` client. It sends a fixed system instruction and separate\nJSON evidence/catalog data, requests JSON, supplies cancellation and bounds, uses\nno tools or continuation, and rejects known truncation or tool calls,\nunexpected models, malformed JSON and oversized output. Configure SDK clients\nwithout automatic retry that would bypass application boundary checks. The\nadapter's public identity is exactly provider/model/version; credentials and raw\nprovider errors are never provenance.\n\nA trusted custom `ProposalGenerator` must likewise honor cancellation, bound its\nresponse, and explicitly declare validated `complete` or `unknown` completion.\nThe SDK currently normalizes missing/unknown finish reasons to `stop`\n([owning SDK follow-up](https://github.com/happyvertical/sdk/issues/1381)), so its\nadapter conservatively declares `unknown`, persisted as\n`generation_completion_unknown`. Otherwise valid suggestions remain available\nfor human preview; automatic eligibility always remains false. The service\ndeadline aborts requests and prevents late publication; it does not claim to terminate computation at a remote\nprovider or isolate native allocations. Extractor process limits remain separate.\n\nModel output can contain only offered handler versions, schema-valid arguments,\nretained evidence locations and offered alternative handler/candidate keys.\nCandidate IDs must occur in the offered set, and evidence IDs in retained source\nresults. Unknown enums, invented IDs, extra authority/tool/approval fields and\nmalformed structures fail closed. Missing required top-level fields are retained\nas `missingFields`, with `needs_review`; values are never invented to satisfy a\nschema. Observed page/time/source granularity is preserved. Logical scan splits\nuse `proposeDocumentSplits`; originals and hashes remain intact.\n\n`createSDKProposalDecisionClient(client)` adapts an existing SDK client’s optional\ncapability without changing its errors or protocol. Optional `decision` uses public core `executeDecision` and the existing SDK\npredicate, choice, score and batch contracts. Supported-effect predicates,\nhandler classification, candidate entity matching, and action ambiguity/risk\nare distinct questions. Their validated probabilities and provenance are stored\nseparately from generative provenance and unknown OCR certainty. The complete\nserialized decision request, including suggestions and questions, must fit the\nminimum configured/current policy byte ceiling before capability probing and\nagain before deciding. A policy change between these boundaries fails closed.\nTies, support probability or selected-handler confidence below\n`minimumDecisionProbability`, and actually incomplete extraction require review.\nUnknown provider\ncompletion metadata is preserved as `source_completion_unknown`; it does not\nblock otherwise schema-valid **human** preview or imply completeness. Automatic\naction eligibility remains false. An unconfigured decision path\nis recorded explicitly. Configured errors produce a durable safe failure outcome;\nthey never silently switch to a generative decision fallback.\n\nOutput records zero, one or multiple suggestions, alternatives, missing fields,\nsource links, proposed splits, versions, allowlisted usage, warnings and explicit\n`unknown`, `ambiguous`, `no_action`, `needs_review` or `provider_error` outcomes.\n`automaticActionEligible` is always false. Provider input/output and the complete\nserialized persisted envelope are bounded by configuration, live policy and the\nreceipt ceiling. Oversized output becomes a bounded review/limit result; when\nno safe envelope fits, the owning service records fixed `failAnalysis` metadata\noutside the provider payload budget without retaining provider output.\n\n## Explicit preview and stable intentions\n\nThe host chooses persisted suggestion indexes and calls:\n\n```ts\nawait service.previewGeneratedProposals({\n  itemId,\n  attemptId: generationAttemptId,\n  selections: [{\n    index: 0,\n    intentionKey: 'document:meeting-2026-10-09',\n    expectedRevision: 0,\n    requestId: 'review-request-1',\n  }],\n});\n```\n\n`intentionKey` is the host's stable business-intention identity across generation\nrevisions. Never derive a fresh key from model output, suggestion order or a retry.\nSelections must reference current persisted validated `ready_for_review` output.\nEach batch requires distinct suggestion indexes and intention keys; duplicate\nindexes are rejected before any operation or plan preview is written.\nThe service rechecks current catalog/schema/target/source provenance, then calls\nthe existing operation or plan preview. Each result still requires the ordinary\nhuman review and execution APIs. Reprocessing creates no new business identity;\nsuccessful-action replay protection stays with execution.\n\n## Evidence and limits\n\nThe test matrix is `docs/test-matrix/3673-ingestion-proposals.md`. SQLite and real\nPostgreSQL suites exercise authority, revisions, abstention, hostile output,\ncompound proposals, split provenance and reviewed domain effects. The upload\nreference composes authenticated multipart delivery of a generated embedded-text\nPDF through the actual packaged PDF child, durable interpretation, and the existing\nordered ContentDocument draft/retained-asset plan. It checks duplicate delivery,\nunauthenticated and foreign-tenant denial, explicit approval of both steps,\nidempotent execution replay, page provenance, and unchanged original bytes.\nThe compound-email case uses a declared messages-owner snapshot fixture.\n\nLocal HTTP fixtures execute the actual AI SDK transport and cancellation contract.\nGenerative responses and the separate injected PDF split boundaries establish\ndeterministic orchestration, not model accuracy or OCR quality. No held-out routing\nevaluation or automatic approval is claimed. Missing/unknown AI completion remains\nexplicit under [SDK #1381](https://github.com/happyvertical/sdk/issues/1381).\n\nProposal limits are checked at `IngestionService` construction: positive safe\nintegers, at most 20 handlers/candidates/suggestions and 2147483647 ms timeout.\nInterpretation output uses the exported `GenerationAnalysisOutput` wrapper at\n`analysis.result.output.proposals`; the published review host unwraps it.\nAn explicit feedback `retrieve` denial omits optional examples and feedback\nprovenance and continues generation. Item/execution denials, unexpected failures,\nand revocation after examples were selected still fail closed before disclosure.\n"
     },
     {
       "path": "FEEDBACK.md",
@@ -1651,7 +1651,7 @@
         "code": "not-module-scope",
         "helper": "definePlaybook",
         "message": "`definePlaybook()` must be called at module scope to be emitted into the manifest and knowledge graph. A declaration the scanner cannot read without evaluating it is not emittable — use `useWebMcpTool` for a tool set derived from computed or fetched data.",
-        "line": 894,
+        "line": 1118,
         "column": 9,
         "sourceFile": "src/test-support/proposals.ts"
       },
@@ -1659,7 +1659,7 @@
         "code": "not-module-scope",
         "helper": "definePlaybook",
         "message": "`definePlaybook()` must be called at module scope to be emitted into the manifest and knowledge graph. A declaration the scanner cannot read without evaluating it is not emittable — use `useWebMcpTool` for a tool set derived from computed or fetched data.",
-        "line": 1466,
+        "line": 1690,
         "column": 9,
         "sourceFile": "src/test-support/proposals.ts"
       },
@@ -1667,7 +1667,7 @@
         "code": "not-module-scope",
         "helper": "definePlaybook",
         "message": "`definePlaybook()` must be called at module scope to be emitted into the manifest and knowledge graph. A declaration the scanner cannot read without evaluating it is not emittable — use `useWebMcpTool` for a tool set derived from computed or fetched data.",
-        "line": 3887,
+        "line": 4111,
         "column": 9,
         "sourceFile": "src/test-support/proposals.ts"
       },
@@ -1675,7 +1675,7 @@
         "code": "not-module-scope",
         "helper": "definePlaybook",
         "message": "`definePlaybook()` must be called at module scope to be emitted into the manifest and knowledge graph. A declaration the scanner cannot read without evaluating it is not emittable — use `useWebMcpTool` for a tool set derived from computed or fetched data.",
-        "line": 4512,
+        "line": 4736,
         "column": 7,
         "sourceFile": "src/test-support/proposals.ts"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-ingestion",
-  "version": "0.57.14",
+  "version": "0.57.16",
   "description": "Durable tenant-scoped intake and evidence foundations",
   "type": "module",
   "main": "./dist/index.js",
@@ -50,32 +50,32 @@
     }
   },
   "dependencies": {
-    "@happyvertical/smrt-core": "0.57.14",
-    "@happyvertical/smrt-types": "0.57.14",
-    "@happyvertical/smrt-tenancy": "0.57.14",
-    "@happyvertical/smrt-assets": "0.57.14",
-    "@happyvertical/smrt-jobs": "0.57.14",
+    "@happyvertical/smrt-core": "0.57.16",
+    "@happyvertical/smrt-types": "0.57.16",
+    "@happyvertical/smrt-tenancy": "0.57.16",
+    "@happyvertical/smrt-assets": "0.57.16",
+    "@happyvertical/smrt-jobs": "0.57.16",
     "@happyvertical/sql": "^0.105.5",
     "@happyvertical/pdf": "^0.65.9",
     "@happyvertical/ocr": "^0.62.1",
     "@happyvertical/speech": "^0.105.5",
     "@happyvertical/ai": "^0.105.5",
     "sharp": "^0.35.5",
-    "@happyvertical/smrt-agents": "0.57.14",
-    "@happyvertical/smrt-playbooks": "0.57.14",
+    "@happyvertical/smrt-agents": "0.57.16",
+    "@happyvertical/smrt-playbooks": "0.57.16",
     "ajv": "8.20.0",
-    "@happyvertical/smrt-ui": "0.57.14"
+    "@happyvertical/smrt-ui": "0.57.16"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.57.14",
+    "@happyvertical/smrt-vitest": "0.57.16",
     "@types/node": "24.13.6",
     "typescript": "6.0.3",
-    "vite": "8.1.4",
+    "vite": "8.1.6",
     "vitest": "4.1.10",
-    "@happyvertical/smrt-content": "0.57.14",
-    "@happyvertical/smrt-messages": "0.57.14",
+    "@happyvertical/smrt-content": "0.57.16",
+    "@happyvertical/smrt-messages": "0.57.16",
     "@happyvertical/email": "^0.105.5",
-    "@happyvertical/smrt-users": "0.57.14",
+    "@happyvertical/smrt-users": "0.57.16",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "svelte": "^5.57.1",

package/dist/chunks/proposal-errors-BQjFXSOt.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proposal-errors-BQjFXSOt.js","names":[],"sources":["../../src/proposal-limits.ts","../../src/extraction.ts","../../src/proposal-errors.ts"],"sourcesContent":["import type { ProposalConfiguration } from './proposal-contracts.js';\n\n/** Validate deployment limits before any item is interpreted. */\nexport function assertProposalLimits(\n  limits: ProposalConfiguration['limits'],\n): void {\n  if (\n    !limits ||\n    [\n      'maxHandlers',\n      'maxCandidates',\n      'maxSuggestions',\n      'maxInputBytes',\n      'maxOutputBytes',\n      'maxQueryLength',\n      'timeoutMs',\n    ].some(\n      (key) =>\n        !Number.isSafeInteger(limits[key as keyof typeof limits]) ||\n        limits[key as keyof typeof limits] <= 0,\n    ) ||\n    limits.maxHandlers > 20 ||\n    limits.maxCandidates > 20 ||\n    limits.maxSuggestions > 20 ||\n    limits.timeoutMs > 2_147_483_647\n  )\n    throw new Error('Invalid proposal limits');\n}\n","import { fork } from 'node:child_process';\nimport { createHash } from 'node:crypto';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport type { GetAIOptions } from '@happyvertical/ai';\nimport type { PDFReaderOptions } from '@happyvertical/pdf';\nimport type { GetTranscriberOptions } from '@happyvertical/speech';\nimport type { AnalysisOutput } from './dto.js';\nimport {\n  ExtractionFailure,\n  emptyExtraction,\n  validateExtractionRequest,\n} from './extraction-providers.js';\nimport type {\n  ExtractionAdapter,\n  ExtractionRequest,\n  ExtractionResult,\n  ProviderIdentity,\n} from './extraction-types.js';\nimport { providerIdentity } from './extraction-types.js';\nimport type { AnalysisLease, IngestionService } from './server.js';\n\nexport type * from './extraction-types.js';\n\n/** Trusted server configuration. Credentials never enter analysis provenance. */\nexport interface ExtractionSDKConfiguration {\n  pdf?: {\n    provider: NonNullable<PDFReaderOptions['provider']>;\n    identity: ProviderIdentity;\n  };\n  ocr?: { identity: ProviderIdentity; options?: Record<string, unknown> };\n  speech?: { identity: ProviderIdentity; options: GetTranscriberOptions };\n  vision?: { identity: ProviderIdentity; options: GetAIOptions };\n  imageMode?: 'ocr' | 'vision';\n  /** Maximum concurrent child processes for this adapter instance (default 1). */\n  maxConcurrentProcesses?: number;\n  /** The deployment enforces a native-memory ceiling outside Node (e.g. container).\n   * Required for native decoders: Node's heap cap does not bound native allocation. */\n  nativeMemoryIsolation: 'host-enforced';\n}\n\n/** Production adapter: bounded per-evidence child, terminated on deadline/abort. */\nexport function createSDKExtractionAdapter(\n  configuration: ExtractionSDKConfiguration,\n): ExtractionAdapter {\n  try {\n    configuration = structuredClone(configuration);\n  } catch {\n    throw new Error('Serializable SDK configuration required');\n  }\n  const maximum = configuration.maxConcurrentProcesses ?? 1;\n  if (!Number.isSafeInteger(maximum) || maximum < 1 || maximum > 32)\n    throw new Error('Invalid extraction concurrency');\n  let running = 0;\n  if (configuration.nativeMemoryIsolation !== 'host-enforced')\n    throw new Error('Native memory isolation is required');\n  for (const provider of [\n    configuration.pdf,\n    configuration.ocr,\n    configuration.speech,\n    configuration.vision,\n  ]) {\n    if (provider) provider.identity = providerIdentity(provider.identity);\n  }\n  if (\n    configuration.pdf?.provider === 'auto' ||\n    configuration.ocr?.identity.provider === 'auto'\n  )\n    throw new Error('Pin extraction providers');\n  return {\n    async extract(request) {\n      let latest = emptyExtraction(request);\n      try {\n        validateExtractionRequest(request);\n      } catch (caught) {\n        if (!(caught instanceof ExtractionFailure)) throw caught;\n        latest.errors.push({\n          category: caught.category,\n          location: { kind: 'source' },\n        });\n        return latest;\n      }\n      if (request.evidence.mediaType.toLowerCase().startsWith('video/')) {\n        latest.status = 'unsupported';\n        latest.errors.push({\n          category: 'unsupported_type',\n          location: { kind: 'source' },\n        });\n        return latest;\n      }\n      if (request.signal?.aborted) {\n        latest.errors.push({\n          category: 'cancelled',\n          location: { kind: 'source' },\n        });\n        return latest;\n      }\n      if (running >= maximum) {\n        latest.errors.push({ category: 'limit', location: { kind: 'source' } });\n        return latest;\n      }\n      running++;\n      return new Promise<ExtractionResult>((resolve) => {\n        // A public entry can move shared code into chunks; resolve without loading it.\n        const child = fork(\n          join(\n            dirname(\n              fileURLToPath(\n                import.meta.resolve('@happyvertical/smrt-ingestion/server'),\n              ),\n            ),\n            'extraction-worker.js',\n          ),\n          [],\n          {\n            serialization: 'advanced',\n            stdio: ['ignore', 'ignore', 'ignore', 'ipc'],\n            execArgv: [`--max-old-space-size=${request.limits.workerHeapMb}`],\n            detached: process.platform !== 'win32',\n          },\n        );\n        let done = false;\n        const stop = () => {\n          try {\n            if (process.platform !== 'win32' && child.pid)\n              process.kill(-child.pid, 'SIGKILL');\n            else child.kill('SIGKILL');\n          } catch {\n            child.kill('SIGKILL');\n          }\n        };\n        const finish = (\n          category?: 'timeout' | 'cancelled' | 'unavailable' | 'limit',\n        ) => {\n          if (done) return;\n          done = true;\n          running--;\n          clearTimeout(timer);\n          request.signal?.removeEventListener('abort', abort);\n          stop();\n          if (category) {\n            latest.errors.push({ category, location: { kind: 'source' } });\n            latest.status = latest.segments.length ? 'partial' : 'failed';\n            latest.truncated = true;\n            latest.omitted.push({ kind: 'source' });\n          }\n          resolve(latest);\n        };\n        const abort = () => finish('cancelled');\n        const timer = setTimeout(\n          () => finish('timeout'),\n          request.limits.timeoutMs,\n        );\n        request.signal?.addEventListener('abort', abort, { once: true });\n        child.on('error', () => finish('unavailable'));\n        child.on('exit', () => {\n          if (!done) finish('unavailable');\n        });\n        child.on(\n          'message',\n          async (message: {\n            kind: string;\n            id?: number;\n            result?: ExtractionResult;\n          }) => {\n            if (done) return;\n            if (\n              message.kind === 'authorize' &&\n              Number.isSafeInteger(message.id)\n            ) {\n              try {\n                await request.beforeProviderCall?.();\n                if (!done) child.send({ kind: 'authorized', id: message.id });\n              } catch {\n                finish('cancelled');\n              }\n              return;\n            }\n            if (\n              (message.kind === 'progress' || message.kind === 'result') &&\n              message.result\n            ) {\n              // The child is our trusted normalizer; bound serialized IPC output as well.\n              if (\n                Buffer.byteLength(JSON.stringify(message.result)) >\n                request.limits.maxOutputBytes + 65536\n              )\n                return finish('limit');\n              latest = message.result;\n              if (message.kind === 'result') finish();\n            } else finish('unavailable');\n          },\n        );\n        const {\n          signal: _signal,\n          beforeProviderCall: _authorize,\n          ...wireRequest\n        } = request;\n        child.send({ request: wireRequest, configuration }, (error) => {\n          if (error) finish('unavailable');\n        });\n        if (request.signal?.aborted) abort();\n      });\n    },\n  };\n}\n\nfunction validateAndNormalizeExtractionOutput(\n  result: ExtractionResult,\n  request: ExtractionRequest,\n): void {\n  const numeric = (value: number) => Number.isFinite(value) && value >= 0;\n  const location = (\n    value: ExtractionResult['segments'][number]['location'],\n  ) => {\n    if (!value || typeof value !== 'object') return false;\n    if (value.kind === 'source') return true;\n    if (value.kind === 'page')\n      return Number.isSafeInteger(value.page) && value.page > 0;\n    if (value.kind === 'pages')\n      return (\n        Number.isSafeInteger(value.startPage) &&\n        value.startPage > 0 &&\n        Number.isSafeInteger(value.endPage) &&\n        value.endPage >= value.startPage\n      );\n    return (\n      value.kind === 'time' &&\n      numeric(value.startMs) &&\n      numeric(value.endMs) &&\n      value.endMs >= value.startMs\n    );\n  };\n  if (\n    !result ||\n    !['complete', 'partial', 'failed', 'unsupported'].includes(result.status) ||\n    result.automaticActionEligible !== false ||\n    result.configurationRevision !== request.configurationRevision ||\n    !result.evidence ||\n    Object.entries(request.evidence).some(\n      ([key, value]) =>\n        result.evidence[key as keyof typeof result.evidence] !== value,\n    ) ||\n    typeof result.truncated !== 'boolean' ||\n    !Array.isArray(result.capabilities) ||\n    result.capabilities.some(\n      (capability) =>\n        !capability ||\n        typeof capability.confidence !== 'boolean' ||\n        typeof capability.boxes !== 'boolean' ||\n        !['source', 'page', 'time'].includes(capability.location) ||\n        !['unknown', 'reported'].includes(capability.truncation) ||\n        !['unknown', 'reported'].includes(capability.usage),\n    ) ||\n    !result.limits ||\n    Object.entries(request.limits).some(\n      ([key, value]) =>\n        result.limits[key as keyof typeof result.limits] !== value,\n    ) ||\n    !Array.isArray(result.segments) ||\n    !Array.isArray(result.errors) ||\n    !Array.isArray(result.omitted) ||\n    (result.status === 'complete' &&\n      (result.truncated ||\n        result.errors.length > 0 ||\n        result.omitted.length > 0)) ||\n    result.omitted.some((value) => !location(value)) ||\n    result.segments.some(\n      (segment) =>\n        typeof segment.text !== 'string' ||\n        !location(segment.location) ||\n        segment.location.kind === 'pages' ||\n        (segment.provenance?.provider === 'unlimited-ocr' &&\n          (segment.confidence !== null || segment.boxes !== null)) ||\n        !segment.provenance ||\n        [\n          segment.provenance.provider,\n          segment.provenance.model,\n          segment.provenance.version,\n        ].some((value) => typeof value !== 'string' || !value) ||\n        (segment.confidence !== null &&\n          (!segment.confidence ||\n            !numeric(segment.confidence.value) ||\n            segment.confidence.value > 1 ||\n            segment.confidence.scale !== '0-1' ||\n            segment.confidence.calibration !== 'unknown')) ||\n        (segment.boxes !== null &&\n          (!Array.isArray(segment.boxes) ||\n            segment.boxes.some(\n              (box) =>\n                typeof box.text !== 'string' ||\n                ![box.x, box.y, box.width, box.height].every(numeric),\n            ))),\n    ) ||\n    result.errors.some(\n      (error) =>\n        ![\n          'unsupported_type',\n          'malformed_output',\n          'limit',\n          'timeout',\n          'unavailable',\n          'authentication',\n          'cancelled',\n          'integrity',\n        ].includes(error.category) || !location(error.location),\n    ) ||\n    !result.usage ||\n    Object.values(result.usage).some((value) => !numeric(value))\n  )\n    throw new Error('Invalid extraction output');\n  // Structural typing permits extra host fields. Never persist them as identity.\n  for (const segment of result.segments)\n    segment.provenance = providerIdentity(segment.provenance);\n  result.capabilities = result.capabilities.map((capability) => ({\n    ...providerIdentity(capability),\n    confidence: capability.confidence,\n    boxes: capability.boxes,\n    location: capability.location,\n    truncation: capability.truncation,\n    usage: capability.usage,\n  }));\n}\n\n/** Current access is rechecked on read and fenced publication by the foundation.\n * The host already allocated the immutable input/config revision and lease. */\nexport async function extractAnalysis(\n  service: IngestionService,\n  lease: AnalysisLease,\n  adapter: ExtractionAdapter,\n  options: Pick<\n    ExtractionRequest,\n    'limits' | 'configurationRevision' | 'signal'\n  >,\n): Promise<boolean> {\n  const snapshot = await service.getAnalysisInput(lease);\n  const persisted = snapshot.configuration.extraction as\n    | { configurationRevision?: unknown; limits?: Record<string, unknown> }\n    | undefined;\n  if (\n    !persisted ||\n    persisted.configurationRevision !== options.configurationRevision ||\n    !persisted.limits ||\n    Object.keys(options.limits).some(\n      (key) =>\n        persisted.limits?.[key] !==\n        options.limits[key as keyof typeof options.limits],\n    ) ||\n    Object.keys(persisted.limits).length !== Object.keys(options.limits).length\n  )\n    throw new Error('Extraction configuration mismatch');\n  const evidence = snapshot.evidence;\n  const boundOptions = { ...options, limits: structuredClone(options.limits) };\n  const results: ExtractionResult[] = [];\n  let limited = false;\n  const publication = (reserve = false): AnalysisOutput => {\n    const allComplete =\n      !limited &&\n      results.length === evidence.length &&\n      results.every((result) => result.status === 'complete');\n    const firstError =\n      limited || reserve\n        ? 'limit'\n        : results.flatMap((result) => result.errors)[0]?.category;\n    return {\n      status: reserve\n        ? 'needs_attention'\n        : allComplete\n          ? 'completed'\n          : results.some((result) => result.segments.length)\n            ? 'partial'\n            : 'needs_attention',\n      provider: 'smrt-ingestion-extraction',\n      model: 'none',\n      version: '1',\n      output: {\n        configurationRevision: options.configurationRevision,\n        results,\n        ...(limited || reserve\n          ? {\n              truncated: true,\n              omittedEvidenceCount: evidence.length - results.length,\n            }\n          : {}),\n      },\n      usage: {},\n      ...(firstError ? { error: firstError } : {}),\n    };\n  };\n  // Canonical persistence sorts keys but uses identical JSON value encoding/size.\n  const fits = (output: AnalysisOutput) =>\n    Buffer.byteLength(JSON.stringify(output)) <= snapshot.maxOutputBytes;\n  const minimum: AnalysisOutput = {\n    status: 'needs_attention',\n    provider: 'smrt-ingestion-extraction',\n    model: 'none',\n    version: '1',\n    output: {},\n    usage: {},\n    error: 'limit',\n  };\n  if (!fits(minimum)) return service.failAnalysis(lease, 'limit');\n  if (!fits(publication(true))) return service.completeAnalysis(lease, minimum);\n  for (const part of evidence) {\n    await service.getAnalysisInput(lease);\n    const bytes = await service.readEvidence(lease.itemId, part.id);\n    await service.getAnalysisInput(lease);\n    const request = { ...boundOptions, evidence: part, bytes };\n    const result = await adapter.extract({\n      ...request,\n      evidence: { ...part },\n      limits: { ...request.limits },\n      bytes: bytes.slice(),\n      beforeProviderCall: async () => {\n        await service.getAnalysisInput(lease);\n      },\n    });\n    validateAndNormalizeExtractionOutput(result, request);\n    results.push(result);\n    if (!fits(publication(true))) {\n      limited = true;\n      // Preserve earlier parts and the largest prefix of complete segments that fits.\n      result.status = 'partial';\n      result.truncated = true;\n      result.errors.push({ category: 'limit', location: { kind: 'source' } });\n      while (result.segments.length && !fits(publication(true))) {\n        const removed = result.segments.pop();\n        if (removed) result.omitted.push(removed.location);\n      }\n      // Diagnostics are indivisible: omit this result rather than erase known gaps.\n      if (!fits(publication(true))) results.pop();\n    }\n    // Revalidation after an external call prevents returning/publishing revoked evidence.\n    await service.getAnalysisInput(lease);\n    if (limited || options.signal?.aborted) break;\n  }\n  return service.completeAnalysis(lease, publication());\n}\n\n/** Side-effect-free, versioned split proposal. Original evidence is not replaced. */\nexport function proposeDocumentSplits(\n  result: ExtractionResult,\n  revision: number,\n  groups: number[][],\n) {\n  if (!Number.isSafeInteger(revision) || revision < 1 || !groups.length)\n    throw new Error('Invalid split revision');\n  const available = new Set(\n    result.segments.flatMap((segment) =>\n      segment.location.kind === 'page' ? [segment.location.page] : [],\n    ),\n  );\n  const seen = new Set<number>();\n  for (const group of groups) {\n    if (!group.length) throw new Error('Empty split');\n    for (const page of group) {\n      if (!Number.isSafeInteger(page) || !available.has(page) || seen.has(page))\n        throw new Error('Invalid split page');\n      seen.add(page);\n    }\n    if (group.some((page, index) => index > 0 && page <= group[index - 1]))\n      throw new Error('Unordered split');\n  }\n  const proposal = {\n    revision,\n    evidenceId: result.evidence.id,\n    inputHash: result.evidence.contentHash,\n    configurationRevision: result.configurationRevision,\n    groups: groups.map((pages) => ({ pages: [...pages] })),\n    status: 'proposed' as const,\n  };\n  return {\n    ...proposal,\n    digest: createHash('sha256').update(JSON.stringify(proposal)).digest('hex'),\n  };\n}\n","/** Current generation is authorized, but its immutable candidate revisions are stale. */\nexport class GenerationSnapshotStaleError extends Error {\n  constructor() {\n    super('Generation snapshot stale');\n    this.name = 'GenerationSnapshotStaleError';\n  }\n}\n"],"mappings":";;;;;;AAGO,SAAS,qBACd,QACM;CACN,IACE,CAAC,UACD;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAA,CAAE,MACC,QACC,CAAC,OAAO,cAAc,OAAO,IAA2B,KACxD,OAAO,QAA+B,CAC1C,KACA,OAAO,cAAc,MACrB,OAAO,gBAAgB,MACvB,OAAO,iBAAiB,MACxB,OAAO,YAAY,YAEnB,MAAM,IAAI,MAAM,yBAAyB;AAC7C;;;ACeO,SAAS,2BACd,eACmB;CACnB,IAAI;EACF,gBAAgB,gBAAgB,aAAa;CAC/C,QAAQ;EACN,MAAM,IAAI,MAAM,yCAAyC;CAC3D;CACA,MAAM,UAAU,cAAc,0BAA0B;CACxD,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,UAAU,KAAK,UAAU,IAC7D,MAAM,IAAI,MAAM,gCAAgC;CAClD,IAAI,UAAU;CACd,IAAI,cAAc,0BAA0B,iBAC1C,MAAM,IAAI,MAAM,qCAAqC;CACvD,KAAA,MAAW,YAAY;EACrB,cAAc;EACd,cAAc;EACd,cAAc;EACd,cAAc;CAChB,GACE,IAAI,UAAU,SAAS,WAAW,iBAAiB,SAAS,QAAQ;CAEtE,IACE,cAAc,KAAK,aAAa,UAChC,cAAc,KAAK,SAAS,aAAa,QAEzC,MAAM,IAAI,MAAM,0BAA0B;CAC5C,OAAO,EACL,MAAM,QAAQ,SAAS;EACrB,IAAI,SAAS,gBAAgB,OAAO;EACpC,IAAI;GACF,0BAA0B,OAAO;EACnC,SAAS,QAAQ;GACf,IAAI,EAAE,kBAAkB,oBAAoB,MAAM;GAClD,OAAO,OAAO,KAAK;IACjB,UAAU,OAAO;IACjB,UAAU,EAAE,MAAM,SAAS;GAC7B,CAAC;GACD,OAAO;EACT;EACA,IAAI,QAAQ,SAAS,UAAU,YAAY,CAAA,CAAE,WAAW,QAAQ,GAAG;GACjE,OAAO,SAAS;GAChB,OAAO,OAAO,KAAK;IACjB,UAAU;IACV,UAAU,EAAE,MAAM,SAAS;GAC7B,CAAC;GACD,OAAO;EACT;EACA,IAAI,QAAQ,QAAQ,SAAS;GAC3B,OAAO,OAAO,KAAK;IACjB,UAAU;IACV,UAAU,EAAE,MAAM,SAAS;GAC7B,CAAC;GACD,OAAO;EACT;EACA,IAAI,WAAW,SAAS;GACtB,OAAO,OAAO,KAAK;IAAE,UAAU;IAAS,UAAU,EAAE,MAAM,SAAS;GAAE,CAAC;GACtE,OAAO;EACT;EACA;EACA,OAAO,IAAI,SAA2B,YAAY;GAEhD,MAAM,QAAQ,KACZ,KACE,QACE,cACE,OAAA,KAAY,QAAQ,sCAAsC,CAC5D,CACF,GACA,sBACF,GACA,CAAC,GACD;IACE,eAAe;IACf,OAAO;KAAC;KAAU;KAAU;KAAU;IAAK;IAC3C,UAAU,CAAC,wBAAwB,QAAQ,OAAO,cAAc;IAChE,UAAU,QAAQ,aAAa;GACjC,CACF;GACA,IAAI,OAAO;GACX,MAAM,aAAa;IACjB,IAAI;KACF,IAAI,QAAQ,aAAa,WAAW,MAAM,KACxC,QAAQ,KAAK,CAAC,MAAM,KAAK,SAAS;UAC/B,MAAM,KAAK,SAAS;IAC3B,QAAQ;KACN,MAAM,KAAK,SAAS;IACtB;GACF;GACA,MAAM,UACJ,aACG;IACH,IAAI,MAAM;IACV,OAAO;IACP;IACA,aAAa,KAAK;IAClB,QAAQ,QAAQ,oBAAoB,SAAS,KAAK;IAClD,KAAK;IACL,IAAI,UAAU;KACZ,OAAO,OAAO,KAAK;MAAE;MAAU,UAAU,EAAE,MAAM,SAAS;KAAE,CAAC;KAC7D,OAAO,SAAS,OAAO,SAAS,SAAS,YAAY;KACrD,OAAO,YAAY;KACnB,OAAO,QAAQ,KAAK,EAAE,MAAM,SAAS,CAAC;IACxC;IACA,QAAQ,MAAM;GAChB;GACA,MAAM,cAAc,OAAO,WAAW;GACtC,MAAM,QAAQ,iBACN,OAAO,SAAS,GACtB,QAAQ,OAAO,SACjB;GACA,QAAQ,QAAQ,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;GAC/D,MAAM,GAAG,eAAe,OAAO,aAAa,CAAC;GAC7C,MAAM,GAAG,cAAc;IACrB,IAAI,CAAC,MAAM,OAAO,aAAa;GACjC,CAAC;GACD,MAAM,GACJ,WACA,OAAO,YAID;IACJ,IAAI,MAAM;IACV,IACE,QAAQ,SAAS,eACjB,OAAO,cAAc,QAAQ,EAAE,GAC/B;KACA,IAAI;MACF,MAAM,QAAQ,qBAAqB;MACnC,IAAI,CAAC,MAAM,MAAM,KAAK;OAAE,MAAM;OAAc,IAAI,QAAQ;MAAG,CAAC;KAC9D,QAAQ;MACN,OAAO,WAAW;KACpB;KACA;IACF;IACA,KACG,QAAQ,SAAS,cAAc,QAAQ,SAAS,aACjD,QAAQ,QACR;KAEA,IACE,OAAO,WAAW,KAAK,UAAU,QAAQ,MAAM,CAAC,IAChD,QAAQ,OAAO,iBAAiB,OAEhC,OAAO,OAAO,OAAO;KACvB,SAAS,QAAQ;KACjB,IAAI,QAAQ,SAAS,UAAU,OAAO;IACxC,OAAO,OAAO,aAAa;GAC7B,CACF;GACA,MAAM,EACJ,QAAQ,SACR,oBAAoB,YACpB,GAAG,gBACD;GACJ,MAAM,KAAK;IAAE,SAAS;IAAa;GAAc,IAAI,UAAU;IAC7D,IAAI,OAAO,OAAO,aAAa;GACjC,CAAC;GACD,IAAI,QAAQ,QAAQ,SAAS,MAAM;EACrC,CAAC;CACH,EACF;AACF;AAEA,SAAS,qCACP,QACA,SACM;CACN,MAAM,WAAW,UAAkB,OAAO,SAAS,KAAK,KAAK,SAAS;CACtE,MAAM,YACJ,UACG;EACH,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;EAChD,IAAI,MAAM,SAAS,UAAU,OAAO;EACpC,IAAI,MAAM,SAAS,QACjB,OAAO,OAAO,cAAc,MAAM,IAAI,KAAK,MAAM,OAAO;EAC1D,IAAI,MAAM,SAAS,SACjB,OACE,OAAO,cAAc,MAAM,SAAS,KACpC,MAAM,YAAY,KAClB,OAAO,cAAc,MAAM,OAAO,KAClC,MAAM,WAAW,MAAM;EAE3B,OACE,MAAM,SAAS,UACf,QAAQ,MAAM,OAAO,KACrB,QAAQ,MAAM,KAAK,KACnB,MAAM,SAAS,MAAM;CAEzB;CACA,IACE,CAAC,UACD,CAAC;EAAC;EAAY;EAAW;EAAU;CAAa,CAAA,CAAE,SAAS,OAAO,MAAM,KACxE,OAAO,4BAA4B,SACnC,OAAO,0BAA0B,QAAQ,yBACzC,CAAC,OAAO,YACR,OAAO,QAAQ,QAAQ,QAAQ,CAAA,CAAE,MAC9B,CAAC,KAAK,WACL,OAAO,SAAS,SAAyC,KAC7D,KACA,OAAO,OAAO,cAAc,aAC5B,CAAC,MAAM,QAAQ,OAAO,YAAY,KAClC,OAAO,aAAa,MACjB,eACC,CAAC,cACD,OAAO,WAAW,eAAe,aACjC,OAAO,WAAW,UAAU,aAC5B,CAAC;EAAC;EAAU;EAAQ;CAAM,CAAA,CAAE,SAAS,WAAW,QAAQ,KACxD,CAAC,CAAC,WAAW,UAAU,CAAA,CAAE,SAAS,WAAW,UAAU,KACvD,CAAC,CAAC,WAAW,UAAU,CAAA,CAAE,SAAS,WAAW,KAAK,CACtD,KACA,CAAC,OAAO,UACR,OAAO,QAAQ,QAAQ,MAAM,CAAA,CAAE,MAC5B,CAAC,KAAK,WACL,OAAO,OAAO,SAAuC,KACzD,KACA,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAC9B,CAAC,MAAM,QAAQ,OAAO,MAAM,KAC5B,CAAC,MAAM,QAAQ,OAAO,OAAO,KAC5B,OAAO,WAAW,eAChB,OAAO,aACN,OAAO,OAAO,SAAS,KACvB,OAAO,QAAQ,SAAS,MAC5B,OAAO,QAAQ,MAAM,UAAU,CAAC,SAAS,KAAK,CAAC,KAC/C,OAAO,SAAS,MACb,YACC,OAAO,QAAQ,SAAS,YACxB,CAAC,SAAS,QAAQ,QAAQ,KAC1B,QAAQ,SAAS,SAAS,WACzB,QAAQ,YAAY,aAAa,oBAC/B,QAAQ,eAAe,QAAQ,QAAQ,UAAU,SACpD,CAAC,QAAQ,cACT;EACE,QAAQ,WAAW;EACnB,QAAQ,WAAW;EACnB,QAAQ,WAAW;CACrB,CAAA,CAAE,MAAM,UAAU,OAAO,UAAU,YAAY,CAAC,KAAK,KACpD,QAAQ,eAAe,SACrB,CAAC,QAAQ,cACR,CAAC,QAAQ,QAAQ,WAAW,KAAK,KACjC,QAAQ,WAAW,QAAQ,KAC3B,QAAQ,WAAW,UAAU,SAC7B,QAAQ,WAAW,gBAAgB,cACtC,QAAQ,UAAU,SAChB,CAAC,MAAM,QAAQ,QAAQ,KAAK,KAC3B,QAAQ,MAAM,MACX,QACC,OAAO,IAAI,SAAS,YACpB,CAAC;EAAC,IAAI;EAAG,IAAI;EAAG,IAAI;EAAO,IAAI;CAAM,CAAA,CAAE,MAAM,OAAO,CACxD,EACR,KACA,OAAO,OAAO,MACX,UACC,CAAC;EACC;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAA,CAAE,SAAS,MAAM,QAAQ,KAAK,CAAC,SAAS,MAAM,QAAQ,CAC1D,KACA,CAAC,OAAO,SACR,OAAO,OAAO,OAAO,KAAK,CAAA,CAAE,MAAM,UAAU,CAAC,QAAQ,KAAK,CAAC,GAE3D,MAAM,IAAI,MAAM,2BAA2B;CAE7C,KAAA,MAAW,WAAW,OAAO,UAC3B,QAAQ,aAAa,iBAAiB,QAAQ,UAAU;CAC1D,OAAO,eAAe,OAAO,aAAa,KAAK,gBAAgB;EAC7D,GAAG,iBAAiB,UAAU;EAC9B,YAAY,WAAW;EACvB,OAAO,WAAW;EAClB,UAAU,WAAW;EACrB,YAAY,WAAW;EACvB,OAAO,WAAW;CACpB,EAAE;AACJ;AAIA,eAAsB,gBACpB,SACA,OACA,SACA,SAIkB;CAClB,MAAM,WAAW,MAAM,QAAQ,iBAAiB,KAAK;CACrD,MAAM,YAAY,SAAS,cAAc;CAGzC,IACE,CAAC,aACD,UAAU,0BAA0B,QAAQ,yBAC5C,CAAC,UAAU,UACX,OAAO,KAAK,QAAQ,MAAM,CAAA,CAAE,MACzB,QACC,UAAU,SAAS,SACnB,QAAQ,OAAO,IACnB,KACA,OAAO,KAAK,UAAU,MAAM,CAAA,CAAE,WAAW,OAAO,KAAK,QAAQ,MAAM,CAAA,CAAE,QAErE,MAAM,IAAI,MAAM,mCAAmC;CACrD,MAAM,WAAW,SAAS;CAC1B,MAAM,eAAe;EAAE,GAAG;EAAS,QAAQ,gBAAgB,QAAQ,MAAM;CAAE;CAC3E,MAAM,UAA8B,CAAC;CACrC,IAAI,UAAU;CACd,MAAM,eAAe,UAAU,UAA0B;EACvD,MAAM,cACJ,CAAC,WACD,QAAQ,WAAW,SAAS,UAC5B,QAAQ,OAAO,WAAW,OAAO,WAAW,UAAU;EACxD,MAAM,aACJ,WAAW,UACP,UACA,QAAQ,SAAS,WAAW,OAAO,MAAM,CAAA,CAAE,EAAC,EAAG;EACrD,OAAO;GACL,QAAQ,UACJ,oBACA,cACE,cACA,QAAQ,MAAM,WAAW,OAAO,SAAS,MAAM,IAC7C,YACA;GACR,UAAU;GACV,OAAO;GACP,SAAS;GACT,QAAQ;IACN,uBAAuB,QAAQ;IAC/B;IACA,GAAI,WAAW,UACX;KACE,WAAW;KACX,sBAAsB,SAAS,SAAS,QAAQ;IAClD,IACA,CAAC;GACP;GACA,OAAO,CAAC;GACR,GAAI,aAAa,EAAE,OAAO,WAAW,IAAI,CAAC;EAC5C;CACF;CAEA,MAAM,QAAQ,WACZ,OAAO,WAAW,KAAK,UAAU,MAAM,CAAC,KAAK,SAAS;CACxD,MAAM,UAA0B;EAC9B,QAAQ;EACR,UAAU;EACV,OAAO;EACP,SAAS;EACT,QAAQ,CAAC;EACT,OAAO,CAAC;EACR,OAAO;CACT;CACA,IAAI,CAAC,KAAK,OAAO,GAAG,OAAO,QAAQ,aAAa,OAAO,OAAO;CAC9D,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,GAAG,OAAO,QAAQ,iBAAiB,OAAO,OAAO;CAC5E,KAAA,MAAW,QAAQ,UAAU;EAC3B,MAAM,QAAQ,iBAAiB,KAAK;EACpC,MAAM,QAAQ,MAAM,QAAQ,aAAa,MAAM,QAAQ,KAAK,EAAE;EAC9D,MAAM,QAAQ,iBAAiB,KAAK;EACpC,MAAM,UAAU;GAAE,GAAG;GAAc,UAAU;GAAM;EAAM;EACzD,MAAM,SAAS,MAAM,QAAQ,QAAQ;GACnC,GAAG;GACH,UAAU,EAAE,GAAG,KAAK;GACpB,QAAQ,EAAE,GAAG,QAAQ,OAAO;GAC5B,OAAO,MAAM,MAAM;GACnB,oBAAoB,YAAY;IAC9B,MAAM,QAAQ,iBAAiB,KAAK;GACtC;EACF,CAAC;EACD,qCAAqC,QAAQ,OAAO;EACpD,QAAQ,KAAK,MAAM;EACnB,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,GAAG;GAC5B,UAAU;GAEV,OAAO,SAAS;GAChB,OAAO,YAAY;GACnB,OAAO,OAAO,KAAK;IAAE,UAAU;IAAS,UAAU,EAAE,MAAM,SAAS;GAAE,CAAC;GACtE,OAAO,OAAO,SAAS,UAAU,CAAC,KAAK,YAAY,IAAI,CAAC,GAAG;IACzD,MAAM,UAAU,OAAO,SAAS,IAAI;IACpC,IAAI,SAAS,OAAO,QAAQ,KAAK,QAAQ,QAAQ;GACnD;GAEA,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,GAAG,QAAQ,IAAI;EAC5C;EAEA,MAAM,QAAQ,iBAAiB,KAAK;EACpC,IAAI,WAAW,QAAQ,QAAQ,SAAS;CAC1C;CACA,OAAO,QAAQ,iBAAiB,OAAO,YAAY,CAAC;AACtD;AAGO,SAAS,sBACd,QACA,UACA,QACA;CACA,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,WAAW,KAAK,CAAC,OAAO,QAC7D,MAAM,IAAI,MAAM,wBAAwB;CAC1C,MAAM,YAAY,IAAI,IACpB,OAAO,SAAS,SAAS,YACvB,QAAQ,SAAS,SAAS,SAAS,CAAC,QAAQ,SAAS,IAAI,IAAI,CAAC,CAChE,CACF;CACA,MAAM,uBAAO,IAAI,IAAY;CAC7B,KAAA,MAAW,SAAS,QAAQ;EAC1B,IAAI,CAAC,MAAM,QAAQ,MAAM,IAAI,MAAM,aAAa;EAChD,KAAA,MAAW,QAAQ,OAAO;GACxB,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,GACtE,MAAM,IAAI,MAAM,oBAAoB;GACtC,KAAK,IAAI,IAAI;EACf;EACA,IAAI,MAAM,MAAM,MAAM,UAAU,QAAQ,KAAK,QAAQ,MAAM,QAAQ,EAAE,GACnE,MAAM,IAAI,MAAM,iBAAiB;CACrC;CACA,MAAM,WAAW;EACf;EACA,YAAY,OAAO,SAAS;EAC5B,WAAW,OAAO,SAAS;EAC3B,uBAAuB,OAAO;EAC9B,QAAQ,OAAO,KAAK,WAAW,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE;EACrD,QAAQ;CACV;CACA,OAAO;EACL,GAAG;EACH,QAAQ,WAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAA,CAAE,OAAO,KAAK;CAC5E;AACF;;;AC1dO,IAAM,+BAAN,cAA2C,MAAM;CACtD,cAAc;EACZ,MAAM,2BAA2B;EACjC,KAAK,OAAO;CACd;AACF"}