@miller-tech/uap 2.21.2 → 2.36.1

package/dist/placement/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/placement/registry.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAMlC,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;EAMvB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAS1D,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAoBD;;wEAEwE;AACxE,eAAO,MAAM,oBAAoB;;;;;;;IAQ/B;gEAC4D;;;;;;;IArB5D;;oDAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBhD,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEvE,eAAO,MAAM,sBAAsB;;;;;IA5BjC;;oDAEgD;;;;;;;;;;;;;;;;;;;;;;;EA6BhD,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,eAAO,MAAM,iBAAiB;;;;;;;IAd5B;gEAC4D;;;;;;;IArB5D;;oDAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFhD;;oDAEgD;;;;;;;;;;;;;;;;;;;;;;;IAgCsC,CAAC;AACzF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;QAjB3B;oEAC4D;;;;;;;QArB5D;;wDAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFhD;;wDAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8ChD,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA/B9B;wEAC4D;;;;;;;YArB5D;;4DAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAFhD;;4DAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqDhD,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;yEACyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAxChC;wEAC4D;;;;;;;YArB5D;;4DAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAFhD;;4DAEgD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DhD,CAAC;AAMH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,GAAG,IAAI,mBAAmB,CAE7E;AAED;oEACoE;AACpE,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAErD;AAED;;;;6BAI6B;AAC7B,wBAAgB,aAAa,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKpF;AAMD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB;;+CAE2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB;4CACwC;IACxC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;IAC5C;kCAC8B;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AA8CD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C,kBAAkB,CAsBpB;AAMD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;2CAC2C;AAC3C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAEzF;AAED;;6EAE6E;AAC7E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,GAAG,eAAe,EAAE,CA8DnG"}

package/dist/placement/registry.js

@@ -0,0 +1,274 @@
+/**
+ * Model placement registry: repo defaults merged with machine-local
+ * measurements.
+ *
+ * Two files, deep-merged local-over-repo (ADR-0006, decision 1):
+ *   - `config/model-registry.json`  (repo): shape — models, configs, units,
+ *     profiles, affinity, device kinds. Reviewable, machine-independent.
+ *   - `~/.uap/model-registry.json`  (local): measurements — device totals,
+ *     `reserved_mib`, and each config's `resident_gpu_mib` / `host_rss_mib`.
+ *     A footprint is a property of this hardware, not of the repo.
+ *
+ * Fail-closed doctrine (docs/specs/operator-model-placement.md §4.1): a config
+ * without a measurement is `unmeasured`. It may be served if already
+ * resident; it may never be loaded, and it never enters an eviction candidate
+ * set. Unknown cost is never guessed — guessing is how a 24 GiB card gets
+ * OOM-killed.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { z } from 'zod';
+export const REGISTRY_VERSION = 1;
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+export const DeviceSchema = z.object({
+    kind: z.enum(['gpu', 'cpu']),
+    name: z.string().optional(),
+    total_mib: z.number().int().positive().optional(),
+    reserved_mib: z.number().int().nonnegative().optional(),
+    reserve_reason: z.string().optional(),
+});
+/** Valid systemd unit name (for the effects placement builds from it:
+ * systemctl argv, drop-in file paths, drop-in content). Charset excludes
+ * `/`, whitespace, and control characters (no path traversal, no line
+ * injection into drop-in files); a leading dot or any `..` run is refused.
+ * The registry comes from the repo's config/ — a cloned repo must not get
+ * to write outside ~/.config/systemd/user or inject `[Service]` sections. */
+const UNIT_NAME_RE = /^[A-Za-z0-9_][A-Za-z0-9_.@-]*$/;
+export function validUnitName(unit) {
+    return UNIT_NAME_RE.test(unit) && !unit.includes('..');
+}
+const UnitNameSchema = z.string().refine(validUnitName, {
+    message: 'invalid systemd unit name (charset [A-Za-z0-9_.@-], no leading dot, no ..)',
+});
+/** Identity fields a config carries regardless of measured state, so a
+ * `measure` write never drops the unit/profile/service it was found through. */
+const configIdentity = {
+    engine: z.string().optional(),
+    unit: UnitNameSchema.optional(),
+    profile: z.string().optional(),
+    /** Capacity-policy service name this config is cross-checked against
+     * (overrides the model-level `service`). The policy's `services` is a
+     * LIST keyed by `name` — never assume a map. */
+    service: z.string().optional(),
+    note: z.string().optional(),
+    flags: z.array(z.string()).optional(),
+    rails: z.number().int().positive().optional(),
+};
+/** A measured footprint. `measured_at` is the discriminator in practice: it
+ * is present iff the config has a measurement. `measured_on` gates reuse —
+ * a footprint measured on one device class is not valid for another. */
+export const MeasuredConfigSchema = z.object({
+    ...configIdentity,
+    resident_gpu_mib: z.number().int().positive(),
+    host_rss_mib: z.number().int().positive(),
+    context_pool_cells: z.number().int().positive(),
+    per_session_cap_cells: z.number().int().positive().optional(),
+    kv_resident_cells: z.number().int().positive(),
+    kv_kind: z.string().optional(),
+    /** Marginal KV cost above the resident pool. Absent = unknown, and cost
+     * above the pool fails closed rather than extrapolating. */
+    kv_mib_per_1k_cells: z.number().positive().optional(),
+    measured_at: z.string(),
+    measured_on: z.string(),
+});
+export const UnmeasuredConfigSchema = z.object({
+    ...configIdentity,
+    status: z.literal('unmeasured'),
+});
+export const ConfigEntrySchema = z.union([MeasuredConfigSchema, UnmeasuredConfigSchema]);
+export const ModelEntrySchema = z.object({
+    display: z.string(),
+    engine: z.string().optional(),
+    unit: UnitNameSchema.optional(),
+    service: z.string().optional(),
+    launch: z.string().optional(),
+    endpoint: z.string().optional(),
+    task_affinity: z.array(z.string()).optional(),
+    affinity: z.object({ device: z.array(z.string()) }).optional(),
+    advertises: z.array(z.string()).optional(),
+    configs: z.record(z.string(), ConfigEntrySchema),
+});
+export const ModelRegistrySchema = z.object({
+    version: z.literal(REGISTRY_VERSION),
+    devices: z.record(z.string(), DeviceSchema),
+    models: z.record(z.string(), ModelEntrySchema),
+});
+/** The machine-local file is an overlay, not a full document: it may carry
+ * only models (or only devices). `measure` writes exactly this shape. */
+export const RegistryOverlaySchema = z.object({
+    version: z.literal(REGISTRY_VERSION),
+    devices: z.record(z.string(), DeviceSchema).optional(),
+    models: z.record(z.string(), ModelEntrySchema).optional(),
+});
+// ---------------------------------------------------------------------------
+// Type guards and cost math
+// ---------------------------------------------------------------------------
+export function isMeasuredConfig(cfg) {
+    return 'measured_at' in cfg && 'resident_gpu_mib' in cfg;
+}
+/** A config is placeable only with a measurement. This is the fail-closed
+ * gate: `unmeasured` never becomes a load or eviction candidate. */
+export function isPlaceable(cfg) {
+    return isMeasuredConfig(cfg);
+}
+/** Admission cost (MiB) of serving `cells` context on a measured config:
+ * whole-config resident figure, plus marginal KV beyond the pool the config
+ * already paid for at startup. Returns null when the answer is unknown —
+ * `cells` beyond the resident pool with no `kv_mib_per_1k_cells`. Null is
+ * "refuse", never "free". */
+export function configCostMiB(cfg, cells) {
+    const overPool = Math.max(0, cells - cfg.kv_resident_cells);
+    if (overPool === 0)
+        return cfg.resident_gpu_mib;
+    if (cfg.kv_mib_per_1k_cells === undefined)
+        return null;
+    return cfg.resident_gpu_mib + (overPool / 1000) * cfg.kv_mib_per_1k_cells;
+}
+export function repoRegistryPath(projectDir) {
+    return join(projectDir, 'config', 'model-registry.json');
+}
+export function localRegistryPath() {
+    return process.env.UAP_MODEL_REGISTRY_LOCAL ?? join(homedir(), '.uap', 'model-registry.json');
+}
+function parseRegistryFile(path, schema, errors) {
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8');
+    }
+    catch (err) {
+        errors.push(`${path}: unreadable (${err.message})`);
+        return null;
+    }
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch (err) {
+        errors.push(`${path}: unparseable JSON (${err.message})`);
+        return null;
+    }
+    const parsed = schema.safeParse(doc);
+    if (!parsed.success) {
+        errors.push(`${path}: invalid registry: ${parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ')}`);
+        return null;
+    }
+    return parsed.data;
+}
+/** Deep-merge local over repo. Devices merge field-by-field; models merge
+ * per key; configs merge per key with local winning wholesale (a measured
+ * local entry replaces an unmeasured repo entry). */
+function mergeRegistries(repo, local) {
+    const devices = { ...repo.devices };
+    for (const [key, dev] of Object.entries(local.devices)) {
+        devices[key] = { ...devices[key], ...dev };
+    }
+    const models = { ...repo.models };
+    for (const [key, model] of Object.entries(local.models)) {
+        const base = models[key];
+        if (!base) {
+            models[key] = model;
+            continue;
+        }
+        models[key] = { ...base, ...model, configs: { ...base.configs, ...model.configs } };
+    }
+    return { version: REGISTRY_VERSION, devices, models };
+}
+export function loadModelRegistry(projectDir, opts) {
+    const errors = [];
+    const repoPath = opts?.repoPath ?? repoRegistryPath(projectDir);
+    const localPath = opts?.localPath ?? localRegistryPath();
+    const repo = parseRegistryFile(repoPath, ModelRegistrySchema, errors);
+    const local = parseRegistryFile(localPath, RegistryOverlaySchema, errors);
+    if (!repo) {
+        return { registry: { version: REGISTRY_VERSION, devices: {}, models: {} }, repoPath, localPath, measuredFrom: new Map(), errors };
+    }
+    const merged = local
+        ? mergeRegistries(repo, { version: REGISTRY_VERSION, devices: local.devices ?? {}, models: local.models ?? {} })
+        : repo;
+    const measuredFrom = new Map();
+    for (const [mKey, model] of Object.entries(merged.models)) {
+        for (const [cKey, cfg] of Object.entries(model.configs)) {
+            if (!isMeasuredConfig(cfg))
+                continue;
+            const inLocal = local?.models?.[mKey]?.configs[cKey];
+            measuredFrom.set(`${mKey}/${cKey}`, inLocal && isMeasuredConfig(inLocal) ? 'local' : 'repo');
+        }
+    }
+    return { registry: merged, repoPath, localPath, measuredFrom, errors };
+}
+/** The capacity policy service a model/config is cross-checked against
+ * (config-level overrides model-level). */
+export function crossCheckService(model, cfg) {
+    return isMeasuredConfig(cfg) ? cfg.service ?? model.service : cfg.service ?? model.service;
+}
+/** Cross-check the registry against the capacity policy and its own internal
+ * consistency. One source of truth per number: a registry entry that
+ * contradicts the policy it should agree with is an error, not a warning. */
+export function validateRegistry(registry, policy) {
+    const findings = [];
+    const serviceByName = new Map(policy.services.map((s) => [s.name, s]));
+    const deviceKeys = new Set(Object.keys(registry.devices));
+    for (const [mKey, model] of Object.entries(registry.models)) {
+        const scope = (cfg) => `${mKey}/${cfg}`;
+        for (const device of model.affinity?.device ?? []) {
+            if (!deviceKeys.has(device)) {
+                findings.push({ severity: 'error', scope: `model:${mKey}`, message: `affinity device '${device}' is not declared in devices` });
+            }
+        }
+        for (const [cKey, cfg] of Object.entries(model.configs)) {
+            if (isMeasuredConfig(cfg)) {
+                if (!deviceKeys.has(cfg.measured_on)) {
+                    findings.push({ severity: 'error', scope: scope(cKey), message: `measured_on device '${cfg.measured_on}' is not declared in devices` });
+                }
+                else if (registry.devices[cfg.measured_on]?.kind !== 'gpu') {
+                    findings.push({ severity: 'error', scope: scope(cKey), message: `measured_on device '${cfg.measured_on}' is not a gpu` });
+                }
+                if (cfg.kv_resident_cells > cfg.context_pool_cells) {
+                    findings.push({ severity: 'error', scope: scope(cKey), message: `kv_resident_cells ${cfg.kv_resident_cells} exceeds context_pool_cells ${cfg.context_pool_cells}` });
+                }
+                if (cfg.per_session_cap_cells !== undefined && cfg.per_session_cap_cells > cfg.context_pool_cells) {
+                    findings.push({ severity: 'error', scope: scope(cKey), message: `per_session_cap_cells ${cfg.per_session_cap_cells} exceeds context_pool_cells ${cfg.context_pool_cells}` });
+                }
+            }
+            const svcName = crossCheckService(model, cfg);
+            const svc = svcName ? serviceByName.get(svcName) : undefined;
+            if (svcName && !svc) {
+                findings.push({ severity: 'error', scope: scope(cKey), message: `declares service '${svcName}' but capacity policy has no service by that name` });
+                continue;
+            }
+            if (!svc) {
+                if (isMeasuredConfig(cfg)) {
+                    findings.push({ severity: 'warning', scope: scope(cKey), message: 'measured but no capacity-policy service to cross-check against' });
+                }
+                continue;
+            }
+            if (svc.http?.metricsMustMatch && isMeasuredConfig(cfg)) {
+                const want = svc.http.metricsMustMatch;
+                if ('max_context' in want && want.max_context !== cfg.context_pool_cells) {
+                    findings.push({ severity: 'error', scope: scope(cKey), message: `context_pool_cells ${cfg.context_pool_cells} contradicts policy metricsMustMatch max_context=${want.max_context}` });
+                }
+                if ('kv' in want && want.kv !== cfg.kv_kind) {
+                    findings.push({ severity: 'error', scope: scope(cKey), message: `kv_kind '${cfg.kv_kind}' contradicts policy metricsMustMatch kv='${want.kv}'` });
+                }
+            }
+            else if (svc.http?.metricsMustMatch && !isMeasuredConfig(cfg)) {
+                findings.push({ severity: 'warning', scope: scope(cKey), message: 'cannot cross-check metricsMustMatch: config is unmeasured' });
+            }
+            if (svc.systemd && model.unit && svc.systemd.unit !== model.unit) {
+                findings.push({ severity: 'warning', scope: scope(cKey), message: `unit '${model.unit}' differs from policy service systemd unit '${svc.systemd.unit}'` });
+            }
+        }
+    }
+    for (const [dKey, dev] of Object.entries(registry.devices)) {
+        if (dev.total_mib !== undefined && dev.reserved_mib !== undefined && dev.reserved_mib > dev.total_mib) {
+            findings.push({ severity: 'error', scope: `device:${dKey}`, message: `reserved_mib ${dev.reserved_mib} exceeds total_mib ${dev.total_mib}` });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=registry.js.map

package/dist/placement/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/placement/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACvD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH;;;;;6EAK6E;AAC7E,MAAM,YAAY,GAAG,gCAAgC,CAAC;AACtD,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AACD,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE;IACtD,OAAO,EAAE,4EAA4E;CACtF,CAAC,CAAC;AAEH;gFACgF;AAChF,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;;oDAEgD;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;AAEF;;wEAEwE;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,cAAc;IACjB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACzC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B;gEAC4D;IAC5D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,GAAG,cAAc;IACjB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAChC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAGzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC;CACjD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;CAC/C,CAAC,CAAC;AAGH;yEACyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE;IACtD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,OAAO,aAAa,IAAI,GAAG,IAAI,kBAAkB,IAAI,GAAG,CAAC;AAC3D,CAAC;AAED;oEACoE;AACpE,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;6BAI6B;AAC7B,MAAM,UAAU,aAAa,CAAC,GAAwB,EAAE,KAAa;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5D,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,gBAAgB,CAAC;IAChD,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,GAAG,CAAC,gBAAgB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,mBAAmB,CAAC;AAC5E,CAAC;AAqBD,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,OAAO,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,iBAAiB,CAAyB,IAAY,EAAE,MAAS,EAAE,MAAgB;IAC1F,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,iBAAkB,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAwB,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5H,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;qDAEqD;AACrD,SAAS,eAAe,CAAC,IAAmB,EAAE,KAAoB;IAChE,MAAM,OAAO,GAA6B,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACtF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAAgD;IAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,CAAC;IAEzD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;IACpI,CAAC;IACD,MAAM,MAAM,GAAG,KAAK;QAClB,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChH,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,IAAI,GAAG,EAA4B,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,MAAM,OAAO,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACrD,YAAY,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACzE,CAAC;AAYD;2CAC2C;AAC3C,MAAM,UAAU,iBAAiB,CAAC,KAAiB,EAAE,GAAgB;IACnE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAE,GAA6B,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;AACxH,CAAC;AAED;;6EAE6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,QAAuB,EAAE,MAAsB;IAC9E,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAE1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QAChD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,OAAO,EAAE,oBAAoB,MAAM,8BAA8B,EAAE,CAAC,CAAC;YAClI,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,WAAW,8BAA8B,EAAE,CAAC,CAAC;gBAC1I,CAAC;qBAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,uBAAuB,GAAG,CAAC,WAAW,gBAAgB,EAAE,CAAC,CAAC;gBAC5H,CAAC;gBACD,IAAI,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,CAAC,iBAAiB,+BAA+B,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;gBACvK,CAAC;gBACD,IAAI,GAAG,CAAC,qBAAqB,KAAK,SAAS,IAAI,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,GAAG,CAAC,qBAAqB,+BAA+B,GAAG,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;gBAC/K,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,OAAO,mDAAmD,EAAE,CAAC,CAAC;gBACnJ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;gBACxI,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,EAAE,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACvC,IAAI,aAAa,IAAI,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,kBAAkB,EAAE,CAAC;oBACzE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sBAAsB,GAAG,CAAC,kBAAkB,oDAAoD,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACxL,CAAC;gBACD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,GAAG,CAAC,OAAO,6CAA6C,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpJ,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,EAAE,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,2DAA2D,EAAE,CAAC,CAAC;YACnI,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,IAAI,+CAA+C,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YAC7J,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;YACtG,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,IAAI,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,CAAC,YAAY,sBAAsB,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAChJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/policies/liveness.d.ts

@@ -62,15 +62,13 @@ export interface LivenessCache {
     policies: Record<string, Omit<PolicyLivenessResult, 'name'>>;
 }
 /**
- * The MAIN checkout root for a session cwd. The gate hook strips
- * `/.worktrees/<name>` to find it (${CHECKOUT_ROOT%%/.worktrees/*}); the
- * writers must anchor the same way or a worktree session — the workflow
- * CLAUDE.md MANDATES — writes the cache and reads the policy DB where the
- * gate never looks (review should-fix, 2026-07-13). policies.db lives ONLY
- * in the main checkout (the hook's own header documents this), so the DB
- * read must anchor too. Non-git roots (unit fixtures) pass through unchanged.
+ * The MAIN checkout root for a session cwd. Moved to
+ * src/utils/checkout-root.ts (memoized there) so the attention queue can
+ * anchor the same way without importing the policies layer; imported and
+ * re-exported here for existing callers.
  */
-export declare function mainCheckoutRoot(projectRoot: string): string;
+import { mainCheckoutRoot } from '../utils/checkout-root.js';
+export { mainCheckoutRoot };
 /**
  * Whether a failed path requirement sits on a surface the AGENT could have
  * broken. Inside the repo → agent-writable (it could have deleted or chmod'd

package/dist/policies/liveness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"liveness.d.ts","sourceRoot":"","sources":["../../src/policies/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;4EACwE;IACxE,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAO9D,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;wEAGoE;IACpE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9D;AAID;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAc5D;AA0BD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAKvF;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAgDlG;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAO9F;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAe/F;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAS3E;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqB/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwC9C"}
+{"version":3,"file":"liveness.d.ts","sourceRoot":"","sources":["../../src/policies/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;4EACwE;IACxE,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAO9D,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,kBAAkB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oFAAoF;IACpF,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB;;;wEAGoE;IACpE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9D;AAID;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AA0B5B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,CAKvF;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAgDlG;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAO9F;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAe/F;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAS3E;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqB/E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAwC9C"}

package/dist/policies/liveness.js

@@ -38,32 +38,13 @@ export const POLICY_LIVENESS = {
 };
 const CACHE_REL = join('.uap', 'policy-liveness.json');
 /**
- * The MAIN checkout root for a session cwd. The gate hook strips
- * `/.worktrees/<name>` to find it (${CHECKOUT_ROOT%%/.worktrees/*}); the
- * writers must anchor the same way or a worktree session — the workflow
- * CLAUDE.md MANDATES — writes the cache and reads the policy DB where the
- * gate never looks (review should-fix, 2026-07-13). policies.db lives ONLY
- * in the main checkout (the hook's own header documents this), so the DB
- * read must anchor too. Non-git roots (unit fixtures) pass through unchanged.
+ * The MAIN checkout root for a session cwd. Moved to
+ * src/utils/checkout-root.ts (memoized there) so the attention queue can
+ * anchor the same way without importing the policies layer; imported and
+ * re-exported here for existing callers.
  */
-export function mainCheckoutRoot(projectRoot) {
-    try {
-        const r = spawnSync('git', ['rev-parse', '--show-toplevel'], {
-            cwd: projectRoot,
-            encoding: 'utf-8',
-        });
-        if (r.status !== 0)
-            return projectRoot;
-        const top = (r.stdout ?? '').trim();
-        if (!top)
-            return projectRoot;
-        const i = top.indexOf(`${sep}.worktrees${sep}`);
-        return i === -1 ? top : top.slice(0, i);
-    }
-    catch {
-        return projectRoot;
-    }
-}
+import { mainCheckoutRoot } from '../utils/checkout-root.js';
+export { mainCheckoutRoot };
 /** Directories skills are resolved from, repo first then user-level. */
 function skillDirs(projectRoot) {
     return [

package/dist/policies/liveness.js.map

@@ -1 +1 @@
-{"version":3,"file":"liveness.js","sourceRoot":"","sources":["../../src/policies/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AActD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;IAC7C,kEAAkE;IAClE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;CAC3C,CAAC;AA+BF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;YAC3D,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC;QACvC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG;YAAE,OAAO,WAAW,CAAC;QAC7B,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,GAAG,aAAa,GAAG,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO;QACL,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;QACtC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,WAAmB;IACtD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACnE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAY;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,8BAA8B;IAC9B,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;IACtE,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,wEAAwE;YACxE,uEAAuE;YACvE,uBAAuB;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,GAAG,eAAe,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,kBAAkB,EAAE,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,qDAAqD;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,mBAAmB,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YACvC,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,KAAK,oBAAoB,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,OAAO,IAAI,iBAAiB,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,WAAqB;IACpE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAA+B;IACrF,wEAAwE;IACxE,wEAAwE;IACxE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAkB,CAAC;QAC7F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtG,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,sEAAsE;IACtE,uEAAuE;IACvE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,SAAS,CACjB,SAAS,EACT,CAAC,EAAE,EAAE,+CAA+C,CAAC,EACrD,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CACjC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAGtC;IACC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAc,EAAQ,EAAE;YACnC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC;QACF,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5B,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvC,2EAA2E;QAC3E,6CAA6C;QAC7C,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,IAAI,EAAE,6CAA6C,EAAE;SACjE,CAAC,CACH,CAAC;QACF,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAE9B,MAAM,CAAC,GAAG,SAAS,CACjB,OAAO,CAAC,QAAQ,EAChB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,EACzH,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAChG,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACvD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK;YAClB,CAAC,CAAC,qBAAqB,OAAO,IAAI,yBAAyB,GAAG;YAC9D,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM,IAAI,MAAM,WAAW,OAAO,IAAI,OAAO,iBAAiB,aAAa,IAAI,SAAS,EAAE;gBAC9G,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}
+{"version":3,"file":"liveness.js","sourceRoot":"","sources":["../../src/policies/liveness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AActD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,sBAAsB,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;IAC7C,kEAAkE;IAClE,mBAAmB,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;CAC3C,CAAC;AA+BF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AAEvD;;;;;GAKG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,wEAAwE;AACxE,SAAS,SAAS,CAAC,WAAmB;IACpC,OAAO;QACL,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;QACtC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC;QACvC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC;QACvC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,WAAmB;IACtD,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,WAAmB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACnE,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,IAAY;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,8BAA8B;IAC9B,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;IACtE,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,wEAAwE;YACxE,uEAAuE;YACvE,uBAAuB;YACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,GAAG,eAAe,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,kBAAkB,EAAE,CAAC,CAAC;YAClG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,qDAAqD;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,GAAG,mBAAmB,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YACvC,uEAAuE;YACvE,+DAA+D;YAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,KAAK,oBAAoB,EAAE,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,OAAO,IAAI,iBAAiB,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;IACpG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,WAAqB;IACpE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,mBAAmB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAA+B;IACrF,wEAAwE;IACxE,wEAAwE;IACxE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAkB,CAAC;QAC7F,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtG,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IAC1D,sEAAsE;IACtE,uEAAuE;IACvE,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC5C,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,SAAS,CACjB,SAAS,EACT,CAAC,EAAE,EAAE,+CAA+C,CAAC,EACrD,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;IACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CACjC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAGtC;IACC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,IAAc,EAAQ,EAAE;YACnC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC;QACF,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5B,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACpD,GAAG,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvC,2EAA2E;QAC3E,6CAA6C;QAC7C,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,EAAE,IAAI,EAAE,6CAA6C,EAAE;SACjE,CAAC,CACH,CAAC;QACF,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAE9B,MAAM,CAAC,GAAG,SAAS,CACjB,OAAO,CAAC,QAAQ,EAChB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,kDAAkD,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,EACzH,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAChG,CAAC;QACF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YACvD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,KAAK;YAClB,CAAC,CAAC,qBAAqB,OAAO,IAAI,yBAAyB,GAAG;YAC9D,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM,IAAI,MAAM,WAAW,OAAO,IAAI,OAAO,iBAAiB,aAAa,IAAI,SAAS,EAAE;gBAC9G,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/policies/sandbox-anchor.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The sandbox-consent trust anchor (ADR 0011's named operator-surface follow-up).
+ *
+ * The grant ledger and audit trail live under the MAIN checkout root —
+ * writable by the operator side of every run. The kernel ro-bind closes the
+ * *sandboxed* side, and the load path re-validates shape, but neither
+ * can prove WHO wrote a row: a process with the checkout's write reach can
+ * plant a well-formed grant and claim the operator consented.
+ *
+ * This module is the honest increment: **tamper-evidence, not tamper-proofing**.
+ * A 0600 anchor file OUTSIDE the checkout's write reach records the hash of
+ * the sanitized ledger as of the last recorded consent operation. On load,
+ * the on-disk ledger is re-hashed and compared: a match proves the ledger is
+ * exactly the state a recorded grant/renew/revoke produced; a mismatch means
+ * something with checkout write access altered it — which fails CLOSED (no
+ * extra holes, loud warning) at the sandbox launch and refuses new grants.
+ *
+ * What this does NOT do (kept explicit, not hidden): the anchor lives in the
+ * user's state dir, so a *same-user* process outside the checkout can still
+ * write it. The boundary it draws is exactly the ADR's frame — the
+ * checkout's write reach vs. outside it. True origin proof (a different uid
+ * or a hardware key) remains open and is not claimed.
+ */
+import type { SandboxGrant } from './sandbox-grants.js';
+/** Anchor file version — future shape changes bump this and re-anchor. */
+export declare const ANCHOR_VERSION = 1;
+export interface AnchorState {
+    v: number;
+    /** sha256 of the sanitized ledger array as of the last recorded mutation. */
+    ledgerHead: string;
+    /** Monotonic count of recorded ledger mutations (context for the operator). */
+    mutations: number;
+    /** High-water of audit seqs this anchor has WITNESSED: seq continuity then
+     *  survives not just compaction but audit-file DELETION — a trail whose
+     *  numbering can restart from 0 is a forgeable trail. A duplicate seq is
+     *  evidence to investigate, not proof of planting on its own: concurrent
+     *  appends can mint the same next-seq before either lands (a documented
+     *  pre-existing race; serializing audit writes is open on purpose).
+     *  Additive optional v1 field: anchors written before it existed simply
+     *  lack it, and pre-field anchors stay valid. */
+    seqHi?: number;
+    updatedAt: string;
+    updatedBy: string;
+}
+/** The anchor dir: OUTSIDE the checkout's write reach by construction. */
+export declare function anchorDir(): string;
+/** One anchor per MAIN-checkout root (keyed by its hash, never its literal
+ *  path — the path can contain spaces/usernames that must not reach a
+ *  filename). Keying by `mainCheckoutRoot` — NOT the raw argument — is the
+ *  whole point: every surface passes a cwd (often a `.worktrees/NNN-*`
+ *  subdir), and the LEDGER already resolves through the same helper, so
+ *  keying the anchor by the raw cwd would give the shared ledger one anchor
+ *  per cwd string: worktree sessions would silently run UNANCHORED, and a
+ *  grant recorded from one cwd would look tampered from another. All three
+ *  P-debt reviewers caught this independently; the fix is to key exactly
+ *  the way the ledger does. */
+export declare function anchorPath(projectRoot: string): string;
+/** True when a granted writable path would cover the anchor dir — the one
+ *  grant that must be refused, because a hole over the anchor lets the
+ *  sandboxed side delete or corrupt the tamper evidence itself. */
+export declare function pathCoversAnchorDir(grantPath: string): boolean;
+/** The tamper-evidence hash of a ledger state: over the SANITIZED rows (the
+ *  same shape the load path enforces), in stored order. */
+export declare function ledgerHeadOf(grants: SandboxGrant[]): string;
+/** Read the anchor; null when absent or malformed (absent = unanchored).
+ *  The metadata fields are termSafe'd here — they are interpolated into the
+ *  mismatch banners on the dashboard/CLI/launch stderr, and whoever can
+ *  write the anchor can plant control bytes in them. */
+export declare function readAnchor(projectRoot: string): AnchorState | null;
+/** Write the anchor atomically with tight permissions (0600, 0700 dirs).
+ *  Best-effort: a failure is reported by return value, never a throw — the
+ *  ledger itself stays the operative record; without an anchor there is
+ *  simply nothing to verify against yet. `seqHi` is the audit high-water the
+ *  caller witnessed AFTER the operation's audit line landed (the recorded
+ *  mutations run audit-then-anchor for exactly this reason). */
+export declare function writeAnchor(projectRoot: string, ledgerHead: string, mutations: number, seqHi: number): boolean;
+export type LedgerIntegrity = 'ok' | 'unanchored' | 'mismatch';
+export interface Verification {
+    state: LedgerIntegrity;
+    /** Operator-facing explanation, set for every non-ok state. */
+    detail: string;
+}
+/**
+ * Verify the on-disk ledger against the anchor. 'unanchored' is not a
+ * failure — it is the pre-bootstrap state (existing ledgers predate the
+ * anchor; the first recorded mutation anchors them). 'mismatch' is the
+ * tamper signal: something changed the ledger outside a recorded consent
+ * operation.
+ */
+export declare function verifyLedger(projectRoot: string, onDiskHead: string): Verification;
+//# sourceMappingURL=sandbox-anchor.d.ts.map

package/dist/policies/sandbox-anchor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-anchor.d.ts","sourceRoot":"","sources":["../../src/policies/sandbox-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,0EAA0E;AAC1E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,MAAM,CAAC;IACV,6EAA6E;IAC7E,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;qDAOiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,IAAI,MAAM,CASlC;AA4BD;;;;;;;;;+BAS+B;AAC/B,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;mEAEmE;AACnE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED;2DAC2D;AAC3D,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAE3D;AAED;;;wDAGwD;AACxD,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAqBlE;AAED;;;;;gEAKgE;AAChE,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAgC9G;AAED,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,YAAY,GAAG,UAAU,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,eAAe,CAAC;IACvB,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,CAalF"}