@hawkeyexl/manni 4.4.1 → 4.6.0

package/dist/chunk-BWCWTHYS.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+import {
+  TracevalsError
+} from "./chunk-UKZNLVJW.js";
+import {
+  noticeOnce
+} from "./chunk-HX44GB4Z.js";
+import {
+  assertKnownProvider,
+  assertLocalFlag,
+  assertModelHasProvider,
+  localNotice,
+  providerSpecFor,
+  resolveIdentity,
+  selectProvider
+} from "./chunk-QCHVR4ZM.js";
+import {
+  errorMessage
+} from "./chunk-G3T47CFV.js";
+
+// src/tracevals/judge/provider.ts
+import {
+  makeProvider as makeInferenceProvider,
+  mockVerdict
+} from "@hawkeyexl/inference";
+var JEV = "jev";
+var JEV_OUT_OF_LOOP = "jev answers decisions only, so it cannot extract rules or write verdicts. Use it as tracevals.conformance.hook.provider.";
+var CONFIG_KEY = "tracevals.provider";
+var toTracevalsError = (message) => new TracevalsError(message);
+function selectProvider2(config, flags = {}, ev = {}) {
+  assertLocalFlag(flags, toTracevalsError);
+  return selectProvider(flags, [
+    {
+      ...ev.provider !== void 0 ? { provider: ev.provider } : {},
+      ...ev.model !== void 0 ? { model: ev.model } : {},
+      ...ev.origin !== void 0 ? { origin: ev.origin } : {}
+    },
+    ...configLevels(config)
+  ]);
+}
+function selectHookProvider(config) {
+  const hook = config.conformance?.hook;
+  return selectProvider({}, [
+    {
+      ...hook?.provider != null ? { provider: hook.provider } : {},
+      ...hook?.model != null ? { model: hook.model } : {},
+      origin: "tracevals.conformance.hook.provider"
+    },
+    ...configLevels(config)
+  ]);
+}
+function configLevels(config) {
+  return [
+    {
+      ...config.provider !== null ? { provider: config.provider } : {},
+      ...config.model !== null ? { model: config.model } : {},
+      origin: CONFIG_KEY
+    },
+    {
+      ...config.providers.provider !== void 0 ? { provider: config.providers.provider } : {},
+      ...config.providers.model !== void 0 ? { model: config.providers.model } : {},
+      origin: "providers.provider"
+    }
+  ];
+}
+function announceSelection(selection) {
+  const message = localNotice(selection);
+  if (message !== void 0) noticeOnce(message);
+}
+function assertProviderSelection(selection) {
+  if (selection.provider === JEV) throw new TracevalsError(JEV_OUT_OF_LOOP);
+  assertKnownProvider(selection.provider, toTracevalsError);
+  assertModelHasProvider(selection.provider, selection.model, CONFIG_KEY, toTracevalsError);
+}
+function providerSpecFor2(config, selection, options = {}) {
+  const spec = providerSpecFor(config.providers, selection);
+  switch (selection.provider) {
+    case "anthropic":
+      return { ...spec, anthropic: { toolName: "record_verdict" } };
+    case "openai":
+      return { ...spec, openai: { schemaName: "verdict" } };
+    case "llama-cpp":
+      return {
+        ...spec,
+        llamaCpp: { ...spec.llamaCpp, ...options.host ?? { host: "connect" } }
+      };
+    case "mock":
+      return {
+        ...spec,
+        mockResponses: options.mockResponses ?? [mockVerdict("pass", 0.95)]
+      };
+    default:
+      return spec;
+  }
+}
+async function resolveProviderIdentity(config, flags = {}, ev = {}) {
+  const selection = selectProvider2(config, flags, ev);
+  assertProviderSelection(selection);
+  return resolveSelectionIdentity(config, selection);
+}
+async function resolveSelectionIdentity(config, selection) {
+  const { provider, model } = selection;
+  assertKnownProvider(provider, toTracevalsError, { decisions: true });
+  assertModelHasProvider(provider, model, CONFIG_KEY, toTracevalsError);
+  announceSelection(selection);
+  return resolveIdentity(
+    providerSpecFor2(config, { provider, model: model ?? null }),
+    toTracevalsError
+  );
+}
+function constructProvider(config, identity, options = {}) {
+  if (identity.provider === JEV) {
+    const keyEnv = config.providers.jev?.apiKeyEnv ?? "TYPESAFE_API_KEY";
+    const key = process.env[keyEnv];
+    if (key === void 0 || key === "") {
+      throw new TracevalsError(`jev needs an API key in ${keyEnv}`);
+    }
+  }
+  try {
+    return makeInferenceProvider(providerSpecFor2(config, identity, options));
+  } catch (e) {
+    throw new TracevalsError(errorMessage(e));
+  }
+}
+async function makeJudgeProvider(config, flags = {}, ev = {}, options = {}) {
+  return constructProvider(
+    config,
+    await resolveProviderIdentity(config, flags, ev),
+    options
+  );
+}
+
+export {
+  JEV,
+  JEV_OUT_OF_LOOP,
+  selectProvider2 as selectProvider,
+  selectHookProvider,
+  announceSelection,
+  assertProviderSelection,
+  providerSpecFor2 as providerSpecFor,
+  resolveProviderIdentity,
+  resolveSelectionIdentity,
+  constructProvider,
+  makeJudgeProvider
+};
+//# sourceMappingURL=chunk-BWCWTHYS.js.map

package/dist/chunk-BWCWTHYS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tracevals/judge/provider.ts"],"sourcesContent":["/**\n * Choosing the provider and model, and building the shared inference\n * library's `ProviderSpec` for it.\n *\n * The providers themselves live in `@hawkeyexl/inference` (ADR 01006). The\n * names a provider may have, the two refusals, `--local`, the detection call,\n * the level-bound precedence and the mapping of the family's `providers:`\n * connection settings are `src/shared/providers.ts`, the same code\n * `manni meta fill` and `manni docevals` run. What stays here is what only\n * manni tracevals can decide: which levels it reads (a flag, an eval's own\n * `provider:`/`model:`, `tracevals.provider`/`model`, then the family's\n * `providers:`), and the judge-shaped options a verdict call wants.\n *\n * No model id is named in this file. A model the tool pinned would go stale\n * the week the provider shipped a better one, and would override the default\n * the library keeps current.\n */\nimport {\n  makeProvider as makeInferenceProvider,\n  mockVerdict,\n  type InferenceProvider,\n  type MockResponse,\n  type ProviderName as ConcreteProvider,\n  type ProviderSelector,\n  type ProviderSpec,\n} from \"@hawkeyexl/inference\";\nimport { TracevalsError } from \"../types.js\";\nimport type { HostSetting } from \"../rules/host.js\";\nimport type { TracevalsConfig } from \"../core/config.js\";\nimport {\n  assertKnownProvider,\n  assertLocalFlag,\n  assertModelHasProvider,\n  localNotice,\n  providerSpecFor as sharedProviderSpecFor,\n  resolveIdentity,\n  selectProvider as selectFromLevels,\n  type ProviderChoice,\n  type ProviderFlags,\n  type ProviderSelection,\n} from \"../../shared/providers.js\";\nimport { errorMessage } from \"../../shared/errors.js\";\nimport { noticeOnce } from \"../../shared/warn.js\";\n\nexport type { MockResponse, ProviderChoice, ProviderFlags, ProviderSelection };\n\n/** The decide-only provider (proposal 0079). */\nexport const JEV = \"jev\";\n\n/** Why jev cannot serve out of the loop, and where it goes instead. */\nexport const JEV_OUT_OF_LOOP =\n  \"jev answers decisions only, so it cannot extract rules or write verdicts. Use it as tracevals.conformance.hook.provider.\";\n\n/** The key a tracevals user writes, named by the refusal a bare model gets. */\nconst CONFIG_KEY = \"tracevals.provider\";\n\nconst toTracevalsError = (message: string): Error => new TracevalsError(message);\n\n/** What a caller wants of the provider beyond which one it is. */\nexport interface JudgeProviderOptions {\n  /**\n   * Responses for the `mock` seam. The default is verdict-shaped, which suits\n   * judging; callers with a different response schema (criteria proposals,\n   * say) must supply their own. `mock` is accepted when named but never\n   * offered, so nothing that lists providers mentions it.\n   */\n  mockResponses?: MockResponse[];\n  /**\n   * How a `llama-cpp` provider reaches the model host. Unset, it connects to\n   * a running host and never starts one, which is every run by hand.\n   */\n  host?: HostSetting;\n}\n\n/**\n * The provider and model in force: a flag, then the eval's own choice, then\n * `tracevals.provider`/`model`, then the family's `providers.provider`/`model`,\n * then `auto`. A model is carried only to the provider its own level names, so\n * an eval that names a different provider takes that provider's default\n * instead of a model it cannot run (`selectProvider` in the shared module).\n *\n * `--local` runs llama-cpp over all of them. A `--provider` it contradicts is\n * refused here, so no path selects past it. `ev.origin` names the eval in the\n * notice for a provider `--local` replaced; the caller knows its artifact.\n */\nexport function selectProvider(\n  config: TracevalsConfig,\n  flags: ProviderFlags = {},\n  ev: ProviderChoice = {},\n): ProviderSelection {\n  assertLocalFlag(flags, toTracevalsError);\n  return selectFromLevels(flags, [\n    {\n      ...(ev.provider !== undefined ? { provider: ev.provider } : {}),\n      ...(ev.model !== undefined ? { model: ev.model } : {}),\n      ...(ev.origin !== undefined ? { origin: ev.origin } : {}),\n    },\n    ...configLevels(config),\n  ]);\n}\n\n/**\n * The judge inside a hook (proposal 0079, \"Two model roles\"):\n * `conformance.hook.provider`/`model`, then `tracevals.provider`/`model`, then\n * the family's `providers:`, then `auto`. No flag reaches it, because a hook\n * has no command line. A hook level naming only a model lends it to whichever\n * provider wins, as every level does.\n */\nexport function selectHookProvider(config: TracevalsConfig): ProviderSelection {\n  const hook = config.conformance?.hook;\n  return selectFromLevels({}, [\n    {\n      ...(hook?.provider != null ? { provider: hook.provider } : {}),\n      ...(hook?.model != null ? { model: hook.model } : {}),\n      origin: \"tracevals.conformance.hook.provider\",\n    },\n    ...configLevels(config),\n  ]);\n}\n\n/** `tracevals.provider`/`model`, then the family's `providers:`. */\nfunction configLevels(config: TracevalsConfig): ProviderChoice[] {\n  return [\n    {\n      ...(config.provider !== null ? { provider: config.provider } : {}),\n      ...(config.model !== null ? { model: config.model } : {}),\n      origin: CONFIG_KEY,\n    },\n    {\n      ...(config.providers.provider !== undefined\n        ? { provider: config.providers.provider }\n        : {}),\n      ...(config.providers.model !== undefined ? { model: config.providers.model } : {}),\n      origin: \"providers.provider\",\n    },\n  ];\n}\n\n/**\n * Say what `--local` set aside, once per source. Called where a selection is\n * about to be used, never where it is only checked, so a run that sends\n * nothing to a model says nothing.\n */\nexport function announceSelection(selection: ProviderSelection): void {\n  const message = localNotice(selection);\n  if (message !== undefined) noticeOnce(message);\n}\n\n/**\n * Refuse a selection that cannot be right, with `manni meta fill`'s messages:\n * an unknown name, or a model under `auto`. Both are `TracevalsError`s, which\n * is what maps them to exit 2.\n */\nexport function assertProviderSelection(selection: ProviderSelection): void {\n  // Every caller of this check generates: `run`'s and `calibrate`'s verdicts,\n  // `fill`'s proposals, and rule extraction. Only the turn judge may decide.\n  if (selection.provider === JEV) throw new TracevalsError(JEV_OUT_OF_LOOP);\n  assertKnownProvider(selection.provider, toTracevalsError);\n  assertModelHasProvider(selection.provider, selection.model, CONFIG_KEY, toTracevalsError);\n}\n\n/**\n * The spec for a selection, with the family's connection settings for the\n * provider it names, and under `auto` the settings detection reads.\n */\nexport function providerSpecFor(\n  config: TracevalsConfig,\n  selection: { provider: ProviderSelector; model: string | null },\n  options: JudgeProviderOptions = {},\n): ProviderSpec {\n  const spec = sharedProviderSpecFor(config.providers, selection);\n  switch (selection.provider) {\n    case \"anthropic\":\n      // A verdict-shaped tool name steers the model better than a generic\n      // one, and it is free to keep.\n      return { ...spec, anthropic: { toolName: \"record_verdict\" } };\n    case \"openai\":\n      return { ...spec, openai: { schemaName: \"verdict\" } };\n    case \"llama-cpp\":\n      return {\n        ...spec,\n        llamaCpp: { ...spec.llamaCpp, ...(options.host ?? { host: \"connect\" }) },\n      };\n    case \"mock\":\n      return {\n        ...spec,\n        mockResponses: options.mockResponses ?? [mockVerdict(\"pass\", 0.95)],\n      };\n    default:\n      return spec;\n  }\n}\n\n/**\n * The concrete provider and model, WITHOUT constructing the provider: cache\n * keys need it, and a fully cached run must not require an API key.\n *\n * Under `auto` this is where detection runs, exactly as `manni meta fill` runs\n * it, seeing the same connection settings. The model is the RESOLVED one (the\n * provider's default when none was named, a llama-cpp tier's concrete\n * weights), so a library default that changes changes every cache key built\n * from it.\n */\nexport async function resolveProviderIdentity(\n  config: TracevalsConfig,\n  flags: ProviderFlags = {},\n  ev: ProviderChoice = {},\n): Promise<{ provider: ConcreteProvider; model: string }> {\n  // Every caller of this generates, so jev is refused here as well as where\n  // a command checks its selection up front.\n  const selection = selectProvider(config, flags, ev);\n  assertProviderSelection(selection);\n  return resolveSelectionIdentity(config, selection);\n}\n\n/** `resolveProviderIdentity` for a selection already made. */\nexport async function resolveSelectionIdentity(\n  config: TracevalsConfig,\n  selection: ProviderSelection,\n): Promise<{ provider: ConcreteProvider; model: string }> {\n  const { provider, model } = selection;\n  // Generating callers refused jev in assertProviderSelection; reaching here\n  // with it means the turn judge, which decides.\n  assertKnownProvider(provider, toTracevalsError, { decisions: true });\n  assertModelHasProvider(provider, model, CONFIG_KEY, toTracevalsError);\n  announceSelection(selection);\n  return resolveIdentity(\n    providerSpecFor(config, { provider, model: model ?? null }),\n    toTracevalsError,\n  );\n}\n\n/** Construct a provider for an identity already resolved. */\nexport function constructProvider(\n  config: TracevalsConfig,\n  identity: { provider: ConcreteProvider; model: string },\n  options: JudgeProviderOptions = {},\n): InferenceProvider {\n  if (identity.provider === JEV) {\n    // Checked here, so the message names the variable a user sets rather than\n    // the library's wording for it.\n    const keyEnv = config.providers.jev?.apiKeyEnv ?? \"TYPESAFE_API_KEY\";\n    const key = process.env[keyEnv];\n    if (key === undefined || key === \"\") {\n      throw new TracevalsError(`jev needs an API key in ${keyEnv}`);\n    }\n  }\n  try {\n    return makeInferenceProvider(providerSpecFor(config, identity, options));\n  } catch (e) {\n    // The library raises its own InferenceError (a missing API key). It must\n    // surface as a TracevalsError: `cli.ts`'s fail() maps only that to exit 2,\n    // and letting a foreign error type through turns \"no API key configured\"\n    // into an unhandled stack trace.\n    throw new TracevalsError(errorMessage(e));\n  }\n}\n\n/** Select, check, detect and construct: the provider a verb judges with. */\nexport async function makeJudgeProvider(\n  config: TracevalsConfig,\n  flags: ProviderFlags = {},\n  ev: ProviderChoice = {},\n  options: JudgeProviderOptions = {},\n): Promise<InferenceProvider> {\n  return constructProvider(\n    config,\n    await resolveProviderIdentity(config, flags, ev),\n    options,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA;AAAA,EACE,gBAAgB;AAAA,EAChB;AAAA,OAMK;AAsBA,IAAM,MAAM;AAGZ,IAAM,kBACX;AAGF,IAAM,aAAa;AAEnB,IAAM,mBAAmB,CAAC,YAA2B,IAAI,eAAe,OAAO;AA6BxE,SAASA,gBACd,QACA,QAAuB,CAAC,GACxB,KAAqB,CAAC,GACH;AACnB,kBAAgB,OAAO,gBAAgB;AACvC,SAAO,eAAiB,OAAO;AAAA,IAC7B;AAAA,MACE,GAAI,GAAG,aAAa,SAAY,EAAE,UAAU,GAAG,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,GAAG,UAAU,SAAY,EAAE,OAAO,GAAG,MAAM,IAAI,CAAC;AAAA,MACpD,GAAI,GAAG,WAAW,SAAY,EAAE,QAAQ,GAAG,OAAO,IAAI,CAAC;AAAA,IACzD;AAAA,IACA,GAAG,aAAa,MAAM;AAAA,EACxB,CAAC;AACH;AASO,SAAS,mBAAmB,QAA4C;AAC7E,QAAM,OAAO,OAAO,aAAa;AACjC,SAAO,eAAiB,CAAC,GAAG;AAAA,IAC1B;AAAA,MACE,GAAI,MAAM,YAAY,OAAO,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;AAAA,MAC5D,GAAI,MAAM,SAAS,OAAO,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACnD,QAAQ;AAAA,IACV;AAAA,IACA,GAAG,aAAa,MAAM;AAAA,EACxB,CAAC;AACH;AAGA,SAAS,aAAa,QAA2C;AAC/D,SAAO;AAAA,IACL;AAAA,MACE,GAAI,OAAO,aAAa,OAAO,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,MAChE,GAAI,OAAO,UAAU,OAAO,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MACvD,QAAQ;AAAA,IACV;AAAA,IACA;AAAA,MACE,GAAI,OAAO,UAAU,aAAa,SAC9B,EAAE,UAAU,OAAO,UAAU,SAAS,IACtC,CAAC;AAAA,MACL,GAAI,OAAO,UAAU,UAAU,SAAY,EAAE,OAAO,OAAO,UAAU,MAAM,IAAI,CAAC;AAAA,MAChF,QAAQ;AAAA,IACV;AAAA,EACF;AACF;AAOO,SAAS,kBAAkB,WAAoC;AACpE,QAAM,UAAU,YAAY,SAAS;AACrC,MAAI,YAAY,OAAW,YAAW,OAAO;AAC/C;AAOO,SAAS,wBAAwB,WAAoC;AAG1E,MAAI,UAAU,aAAa,IAAK,OAAM,IAAI,eAAe,eAAe;AACxE,sBAAoB,UAAU,UAAU,gBAAgB;AACxD,yBAAuB,UAAU,UAAU,UAAU,OAAO,YAAY,gBAAgB;AAC1F;AAMO,SAASC,iBACd,QACA,WACA,UAAgC,CAAC,GACnB;AACd,QAAM,OAAO,gBAAsB,OAAO,WAAW,SAAS;AAC9D,UAAQ,UAAU,UAAU;AAAA,IAC1B,KAAK;AAGH,aAAO,EAAE,GAAG,MAAM,WAAW,EAAE,UAAU,iBAAiB,EAAE;AAAA,IAC9D,KAAK;AACH,aAAO,EAAE,GAAG,MAAM,QAAQ,EAAE,YAAY,UAAU,EAAE;AAAA,IACtD,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,UAAU,EAAE,GAAG,KAAK,UAAU,GAAI,QAAQ,QAAQ,EAAE,MAAM,UAAU,EAAG;AAAA,MACzE;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,GAAG;AAAA,QACH,eAAe,QAAQ,iBAAiB,CAAC,YAAY,QAAQ,IAAI,CAAC;AAAA,MACpE;AAAA,IACF;AACE,aAAO;AAAA,EACX;AACF;AAYA,eAAsB,wBACpB,QACA,QAAuB,CAAC,GACxB,KAAqB,CAAC,GACkC;AAGxD,QAAM,YAAYD,gBAAe,QAAQ,OAAO,EAAE;AAClD,0BAAwB,SAAS;AACjC,SAAO,yBAAyB,QAAQ,SAAS;AACnD;AAGA,eAAsB,yBACpB,QACA,WACwD;AACxD,QAAM,EAAE,UAAU,MAAM,IAAI;AAG5B,sBAAoB,UAAU,kBAAkB,EAAE,WAAW,KAAK,CAAC;AACnE,yBAAuB,UAAU,OAAO,YAAY,gBAAgB;AACpE,oBAAkB,SAAS;AAC3B,SAAO;AAAA,IACLC,iBAAgB,QAAQ,EAAE,UAAU,OAAO,SAAS,KAAK,CAAC;AAAA,IAC1D;AAAA,EACF;AACF;AAGO,SAAS,kBACd,QACA,UACA,UAAgC,CAAC,GACd;AACnB,MAAI,SAAS,aAAa,KAAK;AAG7B,UAAM,SAAS,OAAO,UAAU,KAAK,aAAa;AAClD,UAAM,MAAM,QAAQ,IAAI,MAAM;AAC9B,QAAI,QAAQ,UAAa,QAAQ,IAAI;AACnC,YAAM,IAAI,eAAe,2BAA2B,MAAM,EAAE;AAAA,IAC9D;AAAA,EACF;AACA,MAAI;AACF,WAAO,sBAAsBA,iBAAgB,QAAQ,UAAU,OAAO,CAAC;AAAA,EACzE,SAAS,GAAG;AAKV,UAAM,IAAI,eAAe,aAAa,CAAC,CAAC;AAAA,EAC1C;AACF;AAGA,eAAsB,kBACpB,QACA,QAAuB,CAAC,GACxB,KAAqB,CAAC,GACtB,UAAgC,CAAC,GACL;AAC5B,SAAO;AAAA,IACL;AAAA,IACA,MAAM,wBAAwB,QAAQ,OAAO,EAAE;AAAA,IAC/C;AAAA,EACF;AACF;","names":["selectProvider","providerSpecFor"]}

package/dist/{chunk-MMTSSTG7.js → chunk-C3B2VJNC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   displayPath
-} from "./chunk-PU6DFJMY.js";
+} from "./chunk-C73RSUIC.js";
 import {
   escapeWorkflowCommandMessage,
   escapeWorkflowCommandProperty
@@ -20,4 +20,4 @@ function renderFindingsGithub(report) {
 export {
   renderFindingsGithub
 };
-//# sourceMappingURL=chunk-MMTSSTG7.js.map
+//# sourceMappingURL=chunk-C3B2VJNC.js.map

package/dist/{chunk-PU6DFJMY.js → chunk-C73RSUIC.js}

@@ -10,7 +10,7 @@ import {
   CONCEPT_FIELDS,
   fieldPointer,
   valueAt
-} from "./chunk-6JSSEWBG.js";
+} from "./chunk-GREQKO6M.js";
 import {
   STDIN_LABEL,
   STDIN_TOKEN,
@@ -20,13 +20,13 @@ import {
   gitignoreOptions,
   locateFrontmatter,
   resolveTargetSet
-} from "./chunk-57NEQRVO.js";
+} from "./chunk-KCOFEWV5.js";
 import {
   findConfigFile,
   readConfigFile,
   selectCollections,
   valeConfigPath
-} from "./chunk-Q35YIDBV.js";
+} from "./chunk-XKBEHKWO.js";
 import {
   ToolError,
   errorMessage
@@ -1972,4 +1972,4 @@ export {
   valeConfigFor,
   plural
 };
-//# sourceMappingURL=chunk-PU6DFJMY.js.map
+//# sourceMappingURL=chunk-C73RSUIC.js.map

package/dist/chunk-CU57HT2E.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+import {
+  TracevalsError
+} from "./chunk-UKZNLVJW.js";
+
+// src/tracevals/judge/redact.ts
+var SECRET_NAME = "(?:(?:[A-Za-z0-9]+[_\\-.])*(?:api[_\\-.]?key|access[_\\-.]?key|secret[_\\-.]?key|auth[_\\-.]?token|access[_\\-.]?token|refresh[_\\-.]?token|client[_\\-.]?secret|session[_\\-.]?token|key|token|secret|password|passwd|passphrase|credentials?|authorization)|AWS_[A-Za-z0-9_]+)";
+var REDACTION_PATTERNS = [
+  {
+    label: "private-key",
+    pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,
+    replacement: "[redacted:private-key]"
+  },
+  {
+    // `sk-`, `sk-ant-…`, `pk-`, `rk-`: the OpenAI/Anthropic/Stripe family.
+    label: "api-key",
+    pattern: /\b[sprk]k-(?:[A-Za-z0-9]+-)*[A-Za-z0-9_-]{16,}/g,
+    replacement: "[redacted:api-key]"
+  },
+  {
+    label: "aws-access-key-id",
+    pattern: /\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\b/g,
+    replacement: "[redacted:aws-access-key-id]"
+  },
+  {
+    label: "github-token",
+    pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g,
+    replacement: "[redacted:github-token]"
+  },
+  {
+    label: "slack-token",
+    pattern: /\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g,
+    replacement: "[redacted:slack-token]"
+  },
+  {
+    label: "google-api-key",
+    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    replacement: "[redacted:google-api-key]"
+  },
+  {
+    label: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+    replacement: "[redacted:jwt]"
+  },
+  {
+    // `Authorization: Bearer …`, `Basic …`, `Token …`. The scheme is kept so
+    // the judge can still see that authentication happened.
+    //
+    // Deliberately *not* case-insensitive as a whole: `basic` and `token` are
+    // ordinary English words, and `/i` would redact "basic configuration" as an
+    // auth header. `bearer` is not, so it gets both spellings.
+    label: "auth-token",
+    pattern: /\b([Bb]earer|Basic|Token)\s+[A-Za-z0-9\-._~+/]{12,}={0,2}/g,
+    replacement: "$1 [redacted:auth-token]"
+  },
+  {
+    // JSON member — the shape a tool input renders as.
+    label: "secret-member",
+    pattern: new RegExp(`("${SECRET_NAME}"\\s*:\\s*)"[^"]*"`, "gi"),
+    replacement: '$1"[redacted:secret-value]"'
+  },
+  {
+    // Shell / `.env` assignment. The variable name is kept: knowing that a
+    // secret was set, and which one, is often the adherence question.
+    label: "secret-assignment",
+    pattern: new RegExp(
+      `\\b(${SECRET_NAME})(\\s*=\\s*)(?:"[^"\\n]*"|'[^'\\n]*'|[^\\s"'\\n]+)`,
+      "gi"
+    ),
+    replacement: "$1$2[redacted:secret-value]"
+  }
+];
+var CUSTOM_PLACEHOLDER = "[redacted]";
+function makeRedactor(extra = []) {
+  const custom = compileRedactPatterns(extra).map(
+    (pattern) => [pattern, CUSTOM_PLACEHOLDER]
+  );
+  const all = [
+    ...REDACTION_PATTERNS.map(
+      ({ pattern, replacement }) => [pattern, replacement]
+    ),
+    ...custom
+  ];
+  return (text) => {
+    let out = text;
+    for (const [pattern, replacement] of all) {
+      out = out.replace(pattern, replacement);
+    }
+    return out;
+  };
+}
+function compileRedactPatterns(sources) {
+  return sources.map((source) => {
+    try {
+      return new RegExp(source, "g");
+    } catch (err) {
+      throw new TracevalsError(
+        `invalid config: judge.redact pattern ${JSON.stringify(source)} is not a valid regular expression: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+  });
+}
+
+// src/tracevals/capture/types.ts
+var MANIFEST_VERSION = 1;
+var DEFAULT_CAPTURE_DIR = ".manni/tracevals/sessions";
+
+export {
+  REDACTION_PATTERNS,
+  CUSTOM_PLACEHOLDER,
+  makeRedactor,
+  compileRedactPatterns,
+  MANIFEST_VERSION,
+  DEFAULT_CAPTURE_DIR
+};
+//# sourceMappingURL=chunk-CU57HT2E.js.map

package/dist/chunk-CU57HT2E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tracevals/judge/redact.ts","../src/tracevals/capture/types.ts"],"sourcesContent":["/**\n * Redaction for the judge digest (ADR 01020).\n *\n * `renderTrace` builds the only trace-derived text that leaves this machine,\n * and a session transcript routinely carries credentials: a `Bash` input with\n * an `Authorization` header, an `.env` file echoed into a message, a key pasted\n * into a prompt. Every block that enters the digest is filtered through here\n * first.\n *\n * This is **best-effort pattern matching, not a guarantee.** It recognizes\n * shapes — vendor key prefixes, auth schemes, secret-looking assignment names —\n * so it catches the common accidents and cannot catch an arbitrary secret that\n * looks like ordinary prose. `--deterministic-only` is the only setting that\n * guarantees nothing leaves the machine.\n *\n * Two properties the rest of the system leans on:\n *\n *  - **Stable output.** A given input always redacts to the same text, so\n *    `sha256(renderedTrace)` stays a usable judge cache key.\n *  - **Idempotent.** Placeholders contain no `=`, no `:` inside quotes, and no\n *    vendor prefix, so redacting redacted text is a no-op.\n */\nimport { TracevalsError } from \"../types.js\";\n\nexport interface RedactionPattern {\n  /** Kebab name; appears in the placeholder so a reader knows what went. */\n  label: string;\n  pattern: RegExp;\n  /** Replacement template; `$1`-style references into `pattern` are allowed. */\n  replacement: string;\n}\n\n/**\n * Names that mark a value as secret, in the shapes they appear in shell\n * assignments and in JSON object members (tool inputs render as JSON).\n *\n * The whole name must match, which is what keeps `monkey` out of the `key`\n * alternative: the `(?:[A-Za-z0-9]+[_\\-.])*` prefix only consumes segments that\n * end in a separator. `api[_\\-.]?key` covers `apiKey` and `API_KEY` alike under\n * the `i` flag.\n */\nconst SECRET_NAME =\n  \"(?:(?:[A-Za-z0-9]+[_\\\\-.])*(?:api[_\\\\-.]?key|access[_\\\\-.]?key|secret[_\\\\-.]?key|auth[_\\\\-.]?token|access[_\\\\-.]?token|refresh[_\\\\-.]?token|client[_\\\\-.]?secret|session[_\\\\-.]?token|key|token|secret|password|passwd|passphrase|credentials?|authorization)|AWS_[A-Za-z0-9_]+)\";\n\n/**\n * Applied in order. Broad structural shapes first (a private key block spans\n * lines and would otherwise be chewed up by the narrower rules), then vendor\n * prefixes, then name-driven assignment forms.\n */\nexport const REDACTION_PATTERNS: readonly RedactionPattern[] = [\n  {\n    label: \"private-key\",\n    pattern:\n      /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g,\n    replacement: \"[redacted:private-key]\",\n  },\n  {\n    // `sk-`, `sk-ant-…`, `pk-`, `rk-`: the OpenAI/Anthropic/Stripe family.\n    label: \"api-key\",\n    pattern: /\\b[sprk]k-(?:[A-Za-z0-9]+-)*[A-Za-z0-9_-]{16,}/g,\n    replacement: \"[redacted:api-key]\",\n  },\n  {\n    label: \"aws-access-key-id\",\n    pattern: /\\b(?:AKIA|ASIA|AROA|AIDA)[0-9A-Z]{16}\\b/g,\n    replacement: \"[redacted:aws-access-key-id]\",\n  },\n  {\n    label: \"github-token\",\n    pattern: /\\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\\b/g,\n    replacement: \"[redacted:github-token]\",\n  },\n  {\n    label: \"slack-token\",\n    pattern: /\\bxox[abeoprs]-[A-Za-z0-9-]{10,}/g,\n    replacement: \"[redacted:slack-token]\",\n  },\n  {\n    label: \"google-api-key\",\n    pattern: /\\bAIza[0-9A-Za-z_-]{35}\\b/g,\n    replacement: \"[redacted:google-api-key]\",\n  },\n  {\n    label: \"jwt\",\n    pattern: /\\beyJ[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}/g,\n    replacement: \"[redacted:jwt]\",\n  },\n  {\n    // `Authorization: Bearer …`, `Basic …`, `Token …`. The scheme is kept so\n    // the judge can still see that authentication happened.\n    //\n    // Deliberately *not* case-insensitive as a whole: `basic` and `token` are\n    // ordinary English words, and `/i` would redact \"basic configuration\" as an\n    // auth header. `bearer` is not, so it gets both spellings.\n    label: \"auth-token\",\n    pattern: /\\b([Bb]earer|Basic|Token)\\s+[A-Za-z0-9\\-._~+/]{12,}={0,2}/g,\n    replacement: \"$1 [redacted:auth-token]\",\n  },\n  {\n    // JSON member — the shape a tool input renders as.\n    label: \"secret-member\",\n    pattern: new RegExp(`(\"${SECRET_NAME}\"\\\\s*:\\\\s*)\"[^\"]*\"`, \"gi\"),\n    replacement: '$1\"[redacted:secret-value]\"',\n  },\n  {\n    // Shell / `.env` assignment. The variable name is kept: knowing that a\n    // secret was set, and which one, is often the adherence question.\n    label: \"secret-assignment\",\n    pattern: new RegExp(\n      `\\\\b(${SECRET_NAME})(\\\\s*=\\\\s*)(?:\"[^\"\\\\n]*\"|'[^'\\\\n]*'|[^\\\\s\"'\\\\n]+)`,\n      \"gi\",\n    ),\n    replacement: \"$1$2[redacted:secret-value]\",\n  },\n];\n\n/** Placeholder used for a pattern the config supplied; it has no label. */\nexport const CUSTOM_PLACEHOLDER = \"[redacted]\";\n\nexport type Redactor = (text: string) => string;\n\n/**\n * Build the redactor for a run. Configured patterns are applied **after** the\n * built-ins and never replace them: a project adding one pattern of its own\n * must not silently lose the whole floor, which is the same reasoning that\n * makes `--require` additive (ADR 01017).\n *\n * A pattern that will not compile is an operational error raised here, not a\n * throw from inside the judge and never a silent skip — a dropped pattern is a\n * silent leak.\n */\nexport function makeRedactor(extra: readonly string[] = []): Redactor {\n  // Compiled once and reused across every block of a render. Safe with a `g`\n  // regex because `String.prototype.replace` sets `lastIndex` to 0 before it\n  // starts and leaves it at 0 — unlike `exec`/`test`, where the shared instance\n  // state would make a reused pattern skip matches.\n  const custom = compileRedactPatterns(extra).map(\n    (pattern) => [pattern, CUSTOM_PLACEHOLDER] as const,\n  );\n  const all: ReadonlyArray<readonly [RegExp, string]> = [\n    ...REDACTION_PATTERNS.map(\n      ({ pattern, replacement }) => [pattern, replacement] as const,\n    ),\n    ...custom,\n  ];\n  return (text) => {\n    let out = text;\n    for (const [pattern, replacement] of all) {\n      out = out.replace(pattern, replacement);\n    }\n    return out;\n  };\n}\n\n/**\n * Compile configured pattern sources, or say which one is unusable. Exported so\n * `parseConfig()` can reject a bad pattern at load time rather than at the\n * moment a digest is about to be sent.\n */\nexport function compileRedactPatterns(sources: readonly string[]): RegExp[] {\n  return sources.map((source) => {\n    try {\n      return new RegExp(source, \"g\");\n    } catch (err) {\n      throw new TracevalsError(\n        `invalid config: judge.redact pattern ${JSON.stringify(source)} is not a valid regular expression: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      );\n    }\n  });\n}\n","/**\n * The session manifest: what the project's instruction artifacts said, and\n * which commit they said it at, **when the session started** (ADR 01024).\n *\n * ADR 01016 established that the availability roster — what the session was\n * offered — is recoverable from the transcript itself, retroactively and on any\n * machine. Two things are not: the artifact **bodies** and the **git SHA**. The\n * transcript injects skill instructions into the model's context without ever\n * recording their text, so \"the SKILL.md says X now; did it say X then?\" has no\n * answer inside the trace. ADR 01021 answers it with mtime, which is a\n * heuristic that a `git checkout` defeats wholesale.\n *\n * A manifest closes that gap by recording, at session start, a sha256 per\n * instruction artifact. `run` then compares — and a mismatch is exact where\n * mtime was a guess.\n *\n * **A manifest is a claim, not proof.** It is written by the capturing device\n * and travels with the repository, so it is evidence *about that device*. It\n * never reaches an eval outcome, never moves the exit code, and never turns a\n * `skipped` into a `pass`; the only thing it may quiet is the mtime warning,\n * whose own question it answers exactly.\n *\n * Types and constants only, with no dependency of its own beyond\n * `ArtifactType` — `artifacts/resolve.ts` consumes a manifest and\n * `capture/build.ts` produces one from `artifacts/discover.ts`, so anything\n * shared has to sit below both or the two would import each other.\n */\nimport type { ArtifactType } from \"../artifacts/types.js\";\n\n/**\n * Manifest format version. Bumped when the *shape* changes incompatibly; a\n * manifest from a higher version is ignored rather than half-read, because a\n * partial read of an evidence file is worse than no evidence.\n */\nexport const MANIFEST_VERSION = 1;\n\n/** Default directory, under the state directory the judge cache already uses. */\nexport const DEFAULT_CAPTURE_DIR = \".manni/tracevals/sessions\";\n\nexport interface ManifestArtifact {\n  /** Reference name, spelled as the coverage table spells it. */\n  name: string;\n  type: ArtifactType;\n  /**\n   * Path relative to `root`, with POSIX separators — never absolute, so the\n   * manifest still joins after the repository is checked out somewhere else.\n   */\n  path: string;\n  /** Lowercase hex sha256 of the file's bytes at capture time. */\n  sha256: string;\n  bytes: number;\n}\n\n/** What `git` could answer about the project at capture time. */\nexport interface ManifestGit {\n  /** The commit the session ran against. */\n  sha: string;\n  branch?: string;\n  /** Tracked files differed from the commit, so `sha` alone is incomplete. */\n  dirty: boolean;\n}\n\nexport interface SessionManifest {\n  version: number;\n  sessionId: string;\n  /** When `capture` ran, ISO-8601. */\n  capturedAt: string;\n  /** The hook that supplied the payload, or `manual` for a direct run. */\n  hookEvent: string;\n  /** How the session started or why it ended, when the payload said so. */\n  reason?: string;\n  /** Where the session file will be written. A correlation key, never read. */\n  transcriptPath?: string;\n  /** Project root the artifact paths are relative to. */\n  root: string;\n  git?: ManifestGit;\n  /**\n   * Which machine captured this. An opaque digest rather than the hostname:\n   * the question a reader has is \"same machine or not\", and that does not need\n   * the name of the machine to answer.\n   */\n  device: { id: string; platform: string };\n  tool: { name: string; version: string };\n  artifacts: ManifestArtifact[];\n  /** The resolved `tracevals:` section, redacted. Recorded, not consumed. */\n  config: unknown;\n}\n\nexport type ContentCheckStatus = \"match\" | \"mismatch\" | \"skipped\";\n\n/**\n * Whether an artifact still says what the manifest recorded. Three-valued on\n * purpose: `skipped` is not a shade of `match`, and collapsing them would let\n * an absent manifest read as a clean bill of health.\n */\nexport interface ContentCheck {\n  status: ContentCheckStatus;\n  /** Why no comparison was possible. Present only on `skipped`. */\n  reason?: string;\n  /** The digest recorded at capture time. */\n  expected?: string;\n  /** The digest of the file as it is now. */\n  actual?: string;\n}\n\n/** The manifest `run` consulted, summarised for the report. */\nexport interface ManifestReport {\n  /** Where it was read from. */\n  path: string;\n  sessionId: string;\n  capturedAt: string;\n  /** The commit the session ran against, when git could answer. */\n  gitSha?: string;\n  /** Coverage rows the manifest could speak to, and what it said. */\n  matched: number;\n  changed: number;\n  /** Rows it had nothing to say about; those keep the mtime heuristic. */\n  unrecorded: number;\n}\n"],"mappings":";;;;;;AAyCA,IAAM,cACJ;AAOK,IAAM,qBAAkD;AAAA,EAC7D;AAAA,IACE,OAAO;AAAA,IACP,SACE;AAAA,IACF,aAAa;AAAA,EACf;AAAA,EACA;AAAA;AAAA,IAEE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA;AAAA,IAEE,OAAO;AAAA,IACP,SAAS,IAAI,OAAO,KAAK,WAAW,sBAAsB,IAAI;AAAA,IAC9D,aAAa;AAAA,EACf;AAAA,EACA;AAAA;AAAA;AAAA,IAGE,OAAO;AAAA,IACP,SAAS,IAAI;AAAA,MACX,OAAO,WAAW;AAAA,MAClB;AAAA,IACF;AAAA,IACA,aAAa;AAAA,EACf;AACF;AAGO,IAAM,qBAAqB;AAc3B,SAAS,aAAa,QAA2B,CAAC,GAAa;AAKpE,QAAM,SAAS,sBAAsB,KAAK,EAAE;AAAA,IAC1C,CAAC,YAAY,CAAC,SAAS,kBAAkB;AAAA,EAC3C;AACA,QAAM,MAAgD;AAAA,IACpD,GAAG,mBAAmB;AAAA,MACpB,CAAC,EAAE,SAAS,YAAY,MAAM,CAAC,SAAS,WAAW;AAAA,IACrD;AAAA,IACA,GAAG;AAAA,EACL;AACA,SAAO,CAAC,SAAS;AACf,QAAI,MAAM;AACV,eAAW,CAAC,SAAS,WAAW,KAAK,KAAK;AACxC,YAAM,IAAI,QAAQ,SAAS,WAAW;AAAA,IACxC;AACA,WAAO;AAAA,EACT;AACF;AAOO,SAAS,sBAAsB,SAAsC;AAC1E,SAAO,QAAQ,IAAI,CAAC,WAAW;AAC7B,QAAI;AACF,aAAO,IAAI,OAAO,QAAQ,GAAG;AAAA,IAC/B,SAAS,KAAK;AACZ,YAAM,IAAI;AAAA,QACR,wCAAwC,KAAK,UAAU,MAAM,CAAC,uCAC5D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACH;;;ACzIO,IAAM,mBAAmB;AAGzB,IAAM,sBAAsB;","names":[]}

package/dist/chunk-CWXZ2MRT.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+
+// src/tracevals/graders/util.ts
+function finding(plan, message) {
+  return {
+    evalName: plan.evalName,
+    artifact: plan.artifact.path,
+    message,
+    severity: plan.severity
+  };
+}
+function fail(plan, message) {
+  return { findings: [finding(plan, message)] };
+}
+var pass = { findings: [] };
+function optionsError(kind, message) {
+  return { findings: [], error: `${kind}: ${message}` };
+}
+function firstError(...checks) {
+  return checks.find((check) => check !== void 0);
+}
+function requiredString(options, key) {
+  const value = options[key];
+  if (typeof value !== "string" || value.length === 0) {
+    return `options.${key} is required`;
+  }
+  return void 0;
+}
+function optionalString(options, key) {
+  const value = options[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.length === 0) {
+    return `options.${key} must be a non-empty string`;
+  }
+  return void 0;
+}
+function optionalEnum(options, key, allowed) {
+  const value = options[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    return `options.${key} must be one of: ${allowed.join(", ")}`;
+  }
+  return void 0;
+}
+function optionalNumber(options, key, bounds = {}) {
+  const value = options[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    return `options.${key} must be a finite number`;
+  }
+  if (bounds.integer === true && !Number.isInteger(value)) {
+    return `options.${key} must be a whole number`;
+  }
+  if (bounds.min !== void 0 && value < bounds.min) {
+    return `options.${key} must be at least ${bounds.min}`;
+  }
+  return void 0;
+}
+function optionalBoolean(options, key) {
+  if (options[key] !== void 0 && typeof options[key] !== "boolean") {
+    return `options.${key} must be a boolean`;
+  }
+  return void 0;
+}
+function orderedBounds(options, minKey, maxKey) {
+  const min = options[minKey];
+  const max = options[maxKey];
+  if (typeof min === "number" && typeof max === "number" && min > max) {
+    return `options.${maxKey} must be greater than or equal to options.${minKey}`;
+  }
+  return void 0;
+}
+function requireOneOf(options, keys) {
+  if (keys.some((key) => options[key] !== void 0)) return void 0;
+  return `at least one of ${keys.map((k) => `options.${k}`).join(" or ")} is required`;
+}
+function windowFor(trace, plan) {
+  return windowOf(trace, plan.artifact);
+}
+function windowOf(trace, artifact) {
+  const { name, type } = artifact;
+  if (type === "skill") return skillWindow(trace, name);
+  if (type === "agent") return agentWindow(trace, name);
+  if (type === "slash-command") return slashCommandWindow(trace, name);
+  return {
+    scope: "session",
+    label: "whole session",
+    empty: false,
+    events: trace.events,
+    toolCalls: trace.toolCalls,
+    fileAccesses: trace.fileAccesses,
+    skillInvocations: trace.skillInvocations,
+    userMessages: trace.userMessages,
+    assistantTexts: trace.assistantTexts,
+    turnCount: trace.turnCount
+  };
+}
+function skippedWindow(window) {
+  return { findings: [], skipped: window.reason ?? "the artifact governed no turns" };
+}
+function skillWindow(trace, name) {
+  return injectionWindow(trace, "skill", `skill "${name}"`, (s) => s.name === name);
+}
+function slashCommandWindow(trace, name) {
+  return injectionWindow(
+    trace,
+    "slash-command",
+    `slash command "/${name}"`,
+    (s) => s.name === name && s.via === "command-injection"
+  );
+}
+function injectionWindow(trace, scope, label, opensHere) {
+  const opens = trace.skillInvocations.filter(opensHere).map((s) => s.index);
+  if (opens.length === 0) {
+    return emptyWindow(
+      scope,
+      label,
+      `${label} was never invoked in this trace, so it governed no turns`
+    );
+  }
+  const chainOf = (index) => trace.events[index]?.branchId;
+  const own = new Set(opens.map(chainOf));
+  const boundaries = trace.skillInvocations.filter((s) => own.has(chainOf(s.index))).map((s) => s.index).sort((a, b) => a - b);
+  const spans = opens.map((start) => ({
+    start,
+    end: boundaries.find((b) => b > start) ?? Number.POSITIVE_INFINITY
+  }));
+  return materialize(trace, scope, label, spans, void 0, own);
+}
+function agentWindow(trace, name) {
+  const label = `agent "${name}"`;
+  const mine = trace.subagentBranches.filter((b) => b.agentType === name);
+  if (mine.length === 0) {
+    const spawned = trace.agentSpawns.some((a) => a.subagentType === name);
+    return emptyWindow(
+      "agent",
+      label,
+      spawned ? `${label} was spawned but recorded no subagent turns (no inline sidechain records and no sidecar transcript), so it governed no turns` : `${label} was never spawned in this trace, so it governed no turns`
+    );
+  }
+  const branchIds = new Set(mine.map((b) => b.branchId));
+  for (const branch of trace.subagentBranches) {
+    if (branchIds.has(branch.branchId)) continue;
+    const nested = mine.some(
+      (m) => m.startIndex <= branch.startIndex && branch.endIndex <= m.endIndex
+    );
+    if (nested) branchIds.add(branch.branchId);
+  }
+  const spans = mine.map((b) => ({ start: b.startIndex, end: b.endIndex }));
+  return materialize(
+    trace,
+    "agent",
+    label,
+    spans,
+    branchIds,
+    new Set(mine.map((b) => b.branchId))
+  );
+}
+function emptyWindow(scope, label, reason) {
+  return {
+    scope,
+    label,
+    empty: true,
+    reason,
+    events: [],
+    toolCalls: [],
+    fileAccesses: [],
+    skillInvocations: [],
+    userMessages: [],
+    assistantTexts: [],
+    turnCount: 0
+  };
+}
+function materialize(trace, scope, label, spans, branchIds, own) {
+  const inSpan = (index) => spans.some((s) => index >= s.start && index < s.end);
+  const excluded = /* @__PURE__ */ new Set();
+  if (branchIds !== void 0) {
+    for (const event of trace.events) {
+      if (!inSpan(event.index)) continue;
+      if (event.branchId === void 0 || !branchIds.has(event.branchId)) {
+        excluded.add(event.index);
+      }
+    }
+  }
+  const inWindow = (index) => inSpan(index) && !excluded.has(index);
+  const events = trace.events.filter((e) => inWindow(e.index));
+  const textOf = (kind) => events.filter((e) => e.kind === kind && own.has(e.branchId) && e.text).map((e) => e.text);
+  const userMessages = textOf("user");
+  return {
+    scope,
+    label,
+    empty: false,
+    events,
+    toolCalls: trace.toolCalls.filter((c) => inWindow(c.index)),
+    fileAccesses: trace.fileAccesses.filter((a) => inWindow(a.index)),
+    skillInvocations: trace.skillInvocations.filter((s) => inWindow(s.index)),
+    userMessages,
+    assistantTexts: textOf("assistant"),
+    turnCount: userMessages.length
+  };
+}
+
+export {
+  finding,
+  fail,
+  pass,
+  optionsError,
+  firstError,
+  requiredString,
+  optionalString,
+  optionalEnum,
+  optionalNumber,
+  optionalBoolean,
+  orderedBounds,
+  requireOneOf,
+  windowFor,
+  windowOf,
+  skippedWindow,
+  emptyWindow,
+  materialize
+};
+//# sourceMappingURL=chunk-CWXZ2MRT.js.map

package/dist/chunk-CWXZ2MRT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tracevals/graders/util.ts"],"sourcesContent":["/** Shared helpers for deterministic graders. */\nimport type { EvalPlan } from \"../core/plan.js\";\nimport type {\n  FileAccess,\n  SkillInvocation,\n  ToolCall,\n  Trace,\n  TraceEvent,\n} from \"../trace/types.js\";\nimport type { Finding, GradeResult } from \"./types.js\";\n\nexport function finding(plan: EvalPlan, message: string): Finding {\n  return {\n    evalName: plan.evalName,\n    artifact: plan.artifact.path,\n    message,\n    severity: plan.severity,\n  };\n}\n\nexport function fail(plan: EvalPlan, message: string): GradeResult {\n  return { findings: [finding(plan, message)] };\n}\n\nexport const pass: GradeResult = { findings: [] };\n\nexport function optionsError(kind: string, message: string): GradeResult {\n  return { findings: [], error: `${kind}: ${message}` };\n}\n\n/** An option-validation outcome: a message when invalid, undefined when fine. */\nexport type OptionCheck = string | undefined;\n\nexport type Options = Record<string, unknown>;\n\n/** First failing check, so callers read as a flat list of constraints. */\nexport function firstError(...checks: OptionCheck[]): OptionCheck {\n  return checks.find((check) => check !== undefined);\n}\n\nexport function requiredString(options: Options, key: string): OptionCheck {\n  const value = options[key];\n  if (typeof value !== \"string\" || value.length === 0) {\n    return `options.${key} is required`;\n  }\n  return undefined;\n}\n\nexport function optionalString(options: Options, key: string): OptionCheck {\n  const value = options[key];\n  if (value === undefined) return undefined;\n  if (typeof value !== \"string\" || value.length === 0) {\n    return `options.${key} must be a non-empty string`;\n  }\n  return undefined;\n}\n\nexport function optionalEnum(\n  options: Options,\n  key: string,\n  allowed: readonly string[],\n): OptionCheck {\n  const value = options[key];\n  if (value === undefined) return undefined;\n  if (typeof value !== \"string\" || !allowed.includes(value)) {\n    return `options.${key} must be one of: ${allowed.join(\", \")}`;\n  }\n  return undefined;\n}\n\nexport function optionalNumber(\n  options: Options,\n  key: string,\n  bounds: { min?: number; integer?: boolean } = {},\n): OptionCheck {\n  const value = options[key];\n  if (value === undefined) return undefined;\n  // Number.isFinite also rejects NaN and both infinities.\n  if (typeof value !== \"number\" || !Number.isFinite(value)) {\n    return `options.${key} must be a finite number`;\n  }\n  if (bounds.integer === true && !Number.isInteger(value)) {\n    return `options.${key} must be a whole number`;\n  }\n  if (bounds.min !== undefined && value < bounds.min) {\n    return `options.${key} must be at least ${bounds.min}`;\n  }\n  return undefined;\n}\n\nexport function optionalBoolean(options: Options, key: string): OptionCheck {\n  if (options[key] !== undefined && typeof options[key] !== \"boolean\") {\n    return `options.${key} must be a boolean`;\n  }\n  return undefined;\n}\n\n/** Rejects min > max once both are present and already known to be numbers. */\nexport function orderedBounds(\n  options: Options,\n  minKey: string,\n  maxKey: string,\n): OptionCheck {\n  const min = options[minKey];\n  const max = options[maxKey];\n  if (typeof min === \"number\" && typeof max === \"number\" && min > max) {\n    return `options.${maxKey} must be greater than or equal to options.${minKey}`;\n  }\n  return undefined;\n}\n\n/**\n * Rejects a criterion that configures no bound at all. Such a criterion can\n * never fail, so it reads as coverage while asserting nothing.\n */\nexport function requireOneOf(options: Options, keys: string[]): OptionCheck {\n  if (keys.some((key) => options[key] !== undefined)) return undefined;\n  return `at least one of ${keys.map((k) => `options.${k}`).join(\" or \")} is required`;\n}\n\n// ── Scoped grading ───────────────────────────────────────────────\n\n/**\n * The slice of a trace an artifact was actually governing (ADR 01015). The\n * window is derived from the artifact's *type*, never declared: a skill governs\n * from its invocation until the next skill takes over, an agent governs its own\n * branch, and project rules govern the whole session.\n */\nexport interface TraceWindow {\n  /**\n   * Which rule produced this window. `turn` is the last turn of a session or\n   * a subagent's whole run, cut by `rules/turn.ts` (proposal 0079).\n   */\n  scope: \"session\" | \"skill\" | \"agent\" | \"slash-command\" | \"turn\";\n  /** Names the window in reasons and in the judge digest. */\n  label: string;\n  /**\n   * True when the artifact governed no turn at all. Graders must report\n   * `skipped` on an empty window — never a pass, which would be a verdict\n   * about turns the artifact had no part in.\n   */\n  empty: boolean;\n  /** Why the window is empty; set only when `empty`. */\n  reason?: string;\n  events: TraceEvent[];\n  toolCalls: ToolCall[];\n  fileAccesses: FileAccess[];\n  skillInvocations: SkillInvocation[];\n  /** Prompts on the window's own chain; nested subagent turns are excluded. */\n  userMessages: string[];\n  assistantTexts: string[];\n  turnCount: number;\n}\n\n/** Half-open ordinal range over `trace.events`; `end` may be Infinity. */\nexport interface Span {\n  start: number;\n  end: number;\n}\n\nexport function windowFor(trace: Trace, plan: EvalPlan): TraceWindow {\n  return windowOf(trace, plan.artifact);\n}\n\n/** `windowFor` keyed on the artifact alone, for callers with no eval plan. */\nexport function windowOf(\n  trace: Trace,\n  artifact: Pick<EvalPlan[\"artifact\"], \"name\" | \"type\">,\n): TraceWindow {\n  const { name, type } = artifact;\n  if (type === \"skill\") return skillWindow(trace, name);\n  if (type === \"agent\") return agentWindow(trace, name);\n  if (type === \"slash-command\") return slashCommandWindow(trace, name);\n  // Project rules govern everything, so the window is the trace itself —\n  // handed back by reference, so a session-scoped eval grades exactly what it\n  // graded before scoping existed.\n  return {\n    scope: \"session\",\n    label: \"whole session\",\n    empty: false,\n    events: trace.events,\n    toolCalls: trace.toolCalls,\n    fileAccesses: trace.fileAccesses,\n    skillInvocations: trace.skillInvocations,\n    userMessages: trace.userMessages,\n    assistantTexts: trace.assistantTexts,\n    turnCount: trace.turnCount,\n  };\n}\n\n/** A grader's response to an empty window: a stated skip, never a verdict. */\nexport function skippedWindow(window: TraceWindow): GradeResult {\n  return { findings: [], skipped: window.reason ?? \"the artifact governed no turns\" };\n}\n\nfunction skillWindow(trace: Trace, name: string): TraceWindow {\n  // A skill loads either way: through the `Skill` tool, or by someone typing\n  // its slash form.\n  return injectionWindow(trace, \"skill\", `skill \"${name}\"`, (s) => s.name === name);\n}\n\n/**\n * A slash command's window is a skill's window, because the mechanism is the\n * same one: an instruction set injected at a point in the session, in force\n * until the next injection takes over (ADR 01023). Only the opening differs —\n * a `Skill` tool call is not the slash-command mechanism, so it can close a\n * command's window but never open it.\n */\nfunction slashCommandWindow(trace: Trace, name: string): TraceWindow {\n  return injectionWindow(\n    trace,\n    \"slash-command\",\n    `slash command \"/${name}\"`,\n    (s) => s.name === name && s.via === \"command-injection\",\n  );\n}\n\n/**\n * The window an injected instruction set governed: from each of its own\n * injections until the next injection of any kind — including another of its\n * own, which simply reopens the window — or to the end of the session.\n */\nfunction injectionWindow(\n  trace: Trace,\n  scope: \"skill\" | \"slash-command\",\n  label: string,\n  opensHere: (invocation: SkillInvocation) => boolean,\n): TraceWindow {\n  const opens = trace.skillInvocations.filter(opensHere).map((s) => s.index);\n  if (opens.length === 0) {\n    return emptyWindow(\n      scope,\n      label,\n      `${label} was never invoked in this trace, so it governed no turns`,\n    );\n  }\n  // An instruction set injected inside a subagent branch governs that branch's\n  // chain; one injected on the main chain governs the main chain.\n  const chainOf = (index: number): string | undefined =>\n    trace.events[index]?.branchId;\n  const own = new Set<string | undefined>(opens.map(chainOf));\n  // **Boundaries are drawn from the opening chain only** (ADR 01015: the next\n  // invocation *on the same chain*). Drawn from every invocation, a subagent\n  // that loaded a skill of its own closed the parent's window at the spawn —\n  // so a `not-used` eval passed on turns it never saw, and the judge digest\n  // stopped where the subagent started.\n  const boundaries = trace.skillInvocations\n    .filter((s) => own.has(chainOf(s.index)))\n    .map((s) => s.index)\n    .sort((a, b) => a - b);\n  const spans = opens.map((start) => ({\n    start,\n    end: boundaries.find((b) => b > start) ?? Number.POSITIVE_INFINITY,\n  }));\n  return materialize(trace, scope, label, spans, undefined, own);\n}\n\nfunction agentWindow(trace: Trace, name: string): TraceWindow {\n  const label = `agent \"${name}\"`;\n  const mine = trace.subagentBranches.filter((b) => b.agentType === name);\n  if (mine.length === 0) {\n    const spawned = trace.agentSpawns.some((a) => a.subagentType === name);\n    return emptyWindow(\n      \"agent\",\n      label,\n      spawned\n        ? `${label} was spawned but recorded no subagent turns (no inline ` +\n            `sidechain records and no sidecar transcript), so it governed no turns`\n        : `${label} was never spawned in this trace, so it governed no turns`,\n    );\n  }\n  // A branch's span already covers everything nested under it (ADR 01014), so\n  // one containment pass reaches subagents at any depth.\n  const branchIds = new Set(mine.map((b) => b.branchId));\n  for (const branch of trace.subagentBranches) {\n    if (branchIds.has(branch.branchId)) continue;\n    const nested = mine.some(\n      (m) => m.startIndex <= branch.startIndex && branch.endIndex <= m.endIndex,\n    );\n    if (nested) branchIds.add(branch.branchId);\n  }\n  const spans = mine.map((b) => ({ start: b.startIndex, end: b.endIndex }));\n  return materialize(\n    trace,\n    \"agent\",\n    label,\n    spans,\n    branchIds,\n    new Set<string | undefined>(mine.map((b) => b.branchId)),\n  );\n}\n\nexport function emptyWindow(\n  scope: TraceWindow[\"scope\"],\n  label: string,\n  reason: string,\n): TraceWindow {\n  return {\n    scope,\n    label,\n    empty: true,\n    reason,\n    events: [],\n    toolCalls: [],\n    fileAccesses: [],\n    skillInvocations: [],\n    userMessages: [],\n    assistantTexts: [],\n    turnCount: 0,\n  };\n}\n\n/**\n * Cut every derived list to the spans. `branchIds`, when given, additionally\n * drops events that fall inside an *inline* branch's bounding range without\n * belonging to it — a sidecar branch is contiguous and loses nothing here, but\n * an inline one can enclose interleaved main-chain turns (ADR 01014).\n *\n * `own` names the chain the window is anchored to. Prompts and assistant text\n * are taken from that chain alone, so a subagent spawned inside the window\n * contributes tool calls and file accesses but not turns.\n */\nexport function materialize(\n  trace: Trace,\n  scope: TraceWindow[\"scope\"],\n  label: string,\n  spans: Span[],\n  branchIds: Set<string> | undefined,\n  own: Set<string | undefined>,\n): TraceWindow {\n  const inSpan = (index: number): boolean =>\n    spans.some((s) => index >= s.start && index < s.end);\n  const excluded = new Set<number>();\n  if (branchIds !== undefined) {\n    for (const event of trace.events) {\n      if (!inSpan(event.index)) continue;\n      if (event.branchId === undefined || !branchIds.has(event.branchId)) {\n        excluded.add(event.index);\n      }\n    }\n  }\n  const inWindow = (index: number): boolean =>\n    inSpan(index) && !excluded.has(index);\n\n  const events = trace.events.filter((e) => inWindow(e.index));\n  const textOf = (kind: TraceEvent[\"kind\"]): string[] =>\n    events\n      .filter((e) => e.kind === kind && own.has(e.branchId) && e.text)\n      .map((e) => e.text as string);\n  const userMessages = textOf(\"user\");\n\n  return {\n    scope,\n    label,\n    empty: false,\n    events,\n    toolCalls: trace.toolCalls.filter((c) => inWindow(c.index)),\n    fileAccesses: trace.fileAccesses.filter((a) => inWindow(a.index)),\n    skillInvocations: trace.skillInvocations.filter((s) => inWindow(s.index)),\n    userMessages,\n    assistantTexts: textOf(\"assistant\"),\n    turnCount: userMessages.length,\n  };\n}\n"],"mappings":";;;AAWO,SAAS,QAAQ,MAAgB,SAA0B;AAChE,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,UAAU,KAAK,SAAS;AAAA,IACxB;AAAA,IACA,UAAU,KAAK;AAAA,EACjB;AACF;AAEO,SAAS,KAAK,MAAgB,SAA8B;AACjE,SAAO,EAAE,UAAU,CAAC,QAAQ,MAAM,OAAO,CAAC,EAAE;AAC9C;AAEO,IAAM,OAAoB,EAAE,UAAU,CAAC,EAAE;AAEzC,SAAS,aAAa,MAAc,SAA8B;AACvE,SAAO,EAAE,UAAU,CAAC,GAAG,OAAO,GAAG,IAAI,KAAK,OAAO,GAAG;AACtD;AAQO,SAAS,cAAc,QAAoC;AAChE,SAAO,OAAO,KAAK,CAAC,UAAU,UAAU,MAAS;AACnD;AAEO,SAAS,eAAe,SAAkB,KAA0B;AACzE,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO,WAAW,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,eAAe,SAAkB,KAA0B;AACzE,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,WAAO,WAAW,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAEO,SAAS,aACd,SACA,KACA,SACa;AACb,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,UAAU,YAAY,CAAC,QAAQ,SAAS,KAAK,GAAG;AACzD,WAAO,WAAW,GAAG,oBAAoB,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC7D;AACA,SAAO;AACT;AAEO,SAAS,eACd,SACA,KACA,SAA8C,CAAC,GAClC;AACb,QAAM,QAAQ,QAAQ,GAAG;AACzB,MAAI,UAAU,OAAW,QAAO;AAEhC,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,WAAO,WAAW,GAAG;AAAA,EACvB;AACA,MAAI,OAAO,YAAY,QAAQ,CAAC,OAAO,UAAU,KAAK,GAAG;AACvD,WAAO,WAAW,GAAG;AAAA,EACvB;AACA,MAAI,OAAO,QAAQ,UAAa,QAAQ,OAAO,KAAK;AAClD,WAAO,WAAW,GAAG,qBAAqB,OAAO,GAAG;AAAA,EACtD;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAkB,KAA0B;AAC1E,MAAI,QAAQ,GAAG,MAAM,UAAa,OAAO,QAAQ,GAAG,MAAM,WAAW;AACnE,WAAO,WAAW,GAAG;AAAA,EACvB;AACA,SAAO;AACT;AAGO,SAAS,cACd,SACA,QACA,QACa;AACb,QAAM,MAAM,QAAQ,MAAM;AAC1B,QAAM,MAAM,QAAQ,MAAM;AAC1B,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,MAAM,KAAK;AACnE,WAAO,WAAW,MAAM,6CAA6C,MAAM;AAAA,EAC7E;AACA,SAAO;AACT;AAMO,SAAS,aAAa,SAAkB,MAA6B;AAC1E,MAAI,KAAK,KAAK,CAAC,QAAQ,QAAQ,GAAG,MAAM,MAAS,EAAG,QAAO;AAC3D,SAAO,mBAAmB,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,MAAM,CAAC;AACxE;AA0CO,SAAS,UAAU,OAAc,MAA6B;AACnE,SAAO,SAAS,OAAO,KAAK,QAAQ;AACtC;AAGO,SAAS,SACd,OACA,UACa;AACb,QAAM,EAAE,MAAM,KAAK,IAAI;AACvB,MAAI,SAAS,QAAS,QAAO,YAAY,OAAO,IAAI;AACpD,MAAI,SAAS,QAAS,QAAO,YAAY,OAAO,IAAI;AACpD,MAAI,SAAS,gBAAiB,QAAO,mBAAmB,OAAO,IAAI;AAInE,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,IACP,QAAQ,MAAM;AAAA,IACd,WAAW,MAAM;AAAA,IACjB,cAAc,MAAM;AAAA,IACpB,kBAAkB,MAAM;AAAA,IACxB,cAAc,MAAM;AAAA,IACpB,gBAAgB,MAAM;AAAA,IACtB,WAAW,MAAM;AAAA,EACnB;AACF;AAGO,SAAS,cAAc,QAAkC;AAC9D,SAAO,EAAE,UAAU,CAAC,GAAG,SAAS,OAAO,UAAU,iCAAiC;AACpF;AAEA,SAAS,YAAY,OAAc,MAA2B;AAG5D,SAAO,gBAAgB,OAAO,SAAS,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAClF;AASA,SAAS,mBAAmB,OAAc,MAA2B;AACnE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB,IAAI;AAAA,IACvB,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,QAAQ;AAAA,EACtC;AACF;AAOA,SAAS,gBACP,OACA,OACA,OACA,WACa;AACb,QAAM,QAAQ,MAAM,iBAAiB,OAAO,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;AACzE,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAG,KAAK;AAAA,IACV;AAAA,EACF;AAGA,QAAM,UAAU,CAAC,UACf,MAAM,OAAO,KAAK,GAAG;AACvB,QAAM,MAAM,IAAI,IAAwB,MAAM,IAAI,OAAO,CAAC;AAM1D,QAAM,aAAa,MAAM,iBACtB,OAAO,CAAC,MAAM,IAAI,IAAI,QAAQ,EAAE,KAAK,CAAC,CAAC,EACvC,IAAI,CAAC,MAAM,EAAE,KAAK,EAClB,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AACvB,QAAM,QAAQ,MAAM,IAAI,CAAC,WAAW;AAAA,IAClC;AAAA,IACA,KAAK,WAAW,KAAK,CAAC,MAAM,IAAI,KAAK,KAAK,OAAO;AAAA,EACnD,EAAE;AACF,SAAO,YAAY,OAAO,OAAO,OAAO,OAAO,QAAW,GAAG;AAC/D;AAEA,SAAS,YAAY,OAAc,MAA2B;AAC5D,QAAM,QAAQ,UAAU,IAAI;AAC5B,QAAM,OAAO,MAAM,iBAAiB,OAAO,CAAC,MAAM,EAAE,cAAc,IAAI;AACtE,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,UAAU,MAAM,YAAY,KAAK,CAAC,MAAM,EAAE,iBAAiB,IAAI;AACrE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,UACI,GAAG,KAAK,iIAER,GAAG,KAAK;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAY,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AACrD,aAAW,UAAU,MAAM,kBAAkB;AAC3C,QAAI,UAAU,IAAI,OAAO,QAAQ,EAAG;AACpC,UAAM,SAAS,KAAK;AAAA,MAClB,CAAC,MAAM,EAAE,cAAc,OAAO,cAAc,OAAO,YAAY,EAAE;AAAA,IACnE;AACA,QAAI,OAAQ,WAAU,IAAI,OAAO,QAAQ;AAAA,EAC3C;AACA,QAAM,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,KAAK,EAAE,SAAS,EAAE;AACxE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,IAAwB,KAAK,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAAA,EACzD;AACF;AAEO,SAAS,YACd,OACA,OACA,QACa;AACb,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,QAAQ,CAAC;AAAA,IACT,WAAW,CAAC;AAAA,IACZ,cAAc,CAAC;AAAA,IACf,kBAAkB,CAAC;AAAA,IACnB,cAAc,CAAC;AAAA,IACf,gBAAgB,CAAC;AAAA,IACjB,WAAW;AAAA,EACb;AACF;AAYO,SAAS,YACd,OACA,OACA,OACA,OACA,WACA,KACa;AACb,QAAM,SAAS,CAAC,UACd,MAAM,KAAK,CAAC,MAAM,SAAS,EAAE,SAAS,QAAQ,EAAE,GAAG;AACrD,QAAM,WAAW,oBAAI,IAAY;AACjC,MAAI,cAAc,QAAW;AAC3B,eAAW,SAAS,MAAM,QAAQ;AAChC,UAAI,CAAC,OAAO,MAAM,KAAK,EAAG;AAC1B,UAAI,MAAM,aAAa,UAAa,CAAC,UAAU,IAAI,MAAM,QAAQ,GAAG;AAClE,iBAAS,IAAI,MAAM,KAAK;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,CAAC,UAChB,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK;AAEtC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,SAAS,EAAE,KAAK,CAAC;AAC3D,QAAM,SAAS,CAAC,SACd,OACG,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,IAAI,IAAI,EAAE,QAAQ,KAAK,EAAE,IAAI,EAC9D,IAAI,CAAC,MAAM,EAAE,IAAc;AAChC,QAAM,eAAe,OAAO,MAAM;AAElC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,WAAW,MAAM,UAAU,OAAO,CAAC,MAAM,SAAS,EAAE,KAAK,CAAC;AAAA,IAC1D,cAAc,MAAM,aAAa,OAAO,CAAC,MAAM,SAAS,EAAE,KAAK,CAAC;AAAA,IAChE,kBAAkB,MAAM,iBAAiB,OAAO,CAAC,MAAM,SAAS,EAAE,KAAK,CAAC;AAAA,IACxE;AAAA,IACA,gBAAgB,OAAO,WAAW;AAAA,IAClC,WAAW,aAAa;AAAA,EAC1B;AACF;","names":[]}