@momentiq/dark-factory-cli 2.17.0 → 3.0.0

package/dist/adapters/mode-scope.d.ts

@@ -0,0 +1,86 @@
+import { type CriticConfig, type CriticResult, type DarkFactoryConfig, type DoctorCheck, type ReviewPacket } from "@momentiq/dark-factory-schemas";
+import type { CriticAdapter, CriticReviewOptions } from "./critic.js";
+export declare const MODE_SCOPE_ADAPTER_ID = "mode-scope";
+/** The git-trailer key that activates this critic (case-insensitive). */
+export declare const MODE_TRAILER_KEY = "mode";
+/**
+ * Count changed (added + removed) content lines in a unified diff — the churn
+ * the `diffBudget.maxLines` limit governs.
+ *
+ * HUNK-AWARE, not a global prefix filter. A `---`/`+++` prefix means a file
+ * marker ONLY in a file's header region; inside a hunk body those same
+ * prefixes are real content — a REMOVED line whose text starts with `--`
+ * renders as `---…` (e.g. deleting a CSS custom property `--token: …`), and an
+ * ADDED line whose text starts with `++` renders as `+++…`. A blanket
+ * "skip every `---`/`+++` line" undercounts that churn and lets an over-budget
+ * operator-mode PR slip under `maxLines`. So we track hunk state:
+ *
+ *   - `diff --git a/… b/…` begins a new file → HEADER mode. `packet.diff` is
+ *     produced by `git diff --patch` (git.ts), which ALWAYS emits this
+ *     per-file separator, so it is the authoritative file boundary — the
+ *     `--- a/…`/`+++ b/…` markers that follow are skipped as headers.
+ *   - `@@ …` (or `@@@` for a combined diff) opens a hunk → BODY mode.
+ *   - HEADER mode: every line is metadata (`index`, `--- a/…`, `+++ b/…`,
+ *     mode/rename/binary lines). None is churn — count nothing.
+ *   - BODY mode: every line carries a leading ` `/`+`/`-`/`\` column, so a
+ *     `+`/`-` line is UNAMBIGUOUSLY added/removed content (counted regardless
+ *     of what follows the marker), ` ` is context and `\ No newline…` a marker
+ *     (skipped).
+ *
+ * Monotonic under truncation: `packet.diff` may be capped (`diffTruncated`),
+ * in which case this returns a LOWER BOUND on the true churn — safe for the
+ * budget check (a truncated diff can only hide MORE churn), and the caller
+ * fails closed on an under-visible-budget-but-truncated diff. `maxFiles`
+ * (counted from the untruncated `changedFiles` list) is the coarse backstop.
+ *
+ * Exported for unit-testability.
+ */
+export declare function countDiffLines(diff: string): number;
+export interface ModeScopeAdapterOptions {
+    /**
+     * Catalog loader override — injected in tests so a unit test can supply a
+     * `modes` catalog without writing a darkfactory.yaml to disk. Defaults to
+     * reading `<repoRoot>/darkfactory.yaml` and parsing it through the
+     * canonical schemas parser. Throwing here (e.g. file missing) is caught by
+     * `review()` and surfaced as a fail-closed `blocker`.
+     */
+    loadCatalog?: (repoRoot: string) => DarkFactoryConfig;
+}
+export declare class ModeScopeAdapter implements CriticAdapter {
+    readonly id = "mode-scope";
+    readonly requiredEnvVars: readonly string[];
+    private readonly loadCatalog;
+    constructor(options?: ModeScopeAdapterOptions);
+    review(packet: ReviewPacket, critic: CriticConfig, options: CriticReviewOptions): Promise<CriticResult>;
+    /**
+     * Resolve the active `Mode:` trailer for the reviewed change, or undefined
+     * (→ no-op). Two sources, in order:
+     *
+     *   1. `packet.commit` — the reviewed commit's own message. In a local
+     *      `df gate-push` / `df review`, HEAD is the contributor's real commit,
+     *      so this is authoritative and needs no git I/O.
+     *   2. The reviewed RANGE (`packet.range` = `parent..HEAD`). In CI the
+     *      `agent-critic` checkout's HEAD is a synthetic merge ref whose message
+     *      lacks the trailer, but the contributor's commit lives INSIDE the
+     *      range — so scan every commit message there (newest-first; first match
+     *      wins). Reuses `commitMessagesInRange`, the established trailer-walk
+     *      helper. Any commit declaring a mode enforces it on the whole PR diff.
+     *
+     * ALWAYS-COMPLETE: the range scan shells out to git; any failure (not a
+     * repo, unreachable range) is caught and degrades to the source-1 result —
+     * never throws, never worse than reading HEAD alone. A root commit (bare
+     * `sha` range, no `..`) skips the scan rather than walking all history.
+     */
+    private resolveModeTrailer;
+    /**
+     * Pure core. NEVER throws — the mode branch is wrapped so any unexpected
+     * failure fails CLOSED as a blocker rather than propagating an error
+     * status (always-complete invariant). `rawMode` is pre-resolved by
+     * `resolveModeTrailer` (undefined → no-op).
+     */
+    private computeFindings;
+    private validateDiff;
+    private summaryFor;
+    doctor(_critic: CriticConfig): Promise<DoctorCheck[]>;
+}
+//# sourceMappingURL=mode-scope.d.ts.map

package/dist/adapters/mode-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-scope.d.ts","sourceRoot":"","sources":["../../src/adapters/mode-scope.ts"],"names":[],"mappings":"AAmEA,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAGhB,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEtE,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAElD,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAKvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqBnD;AAuED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,iBAAiB,CAAC;CACvD;AAOD,qBAAa,gBAAiB,YAAW,aAAa;IACpD,QAAQ,CAAC,EAAE,gBAAyB;IACpC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAM;IAEjD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0C;gBAE1D,OAAO,GAAE,uBAA4B;IAI3C,MAAM,CACV,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC;IAiDxB;;;;;;;;;;;;;;;;;;OAkBG;YACW,kBAAkB;IAiChC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAsEvB,OAAO,CAAC,YAAY;IAgFpB,OAAO,CAAC,UAAU;IAoBZ,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;CAqB5D"}

package/dist/adapters/mode-scope.js

@@ -0,0 +1,456 @@
+// Cycle 27 Phase C — deterministic operator-mode scope critic.
+//
+// The hard gate of Designer Mode (spec §4.3 item 5 / §4.4 layer 4). A
+// designer-driven PR carries a `Mode: <name>` git trailer on one of its
+// commits; this adapter reads that trailer, loads the repo's `modes`
+// catalog from darkfactory.yaml, and validates the DIFF against the named
+// mode's writeScopes / protectedPaths / diffBudget / dependencyPolicy.
+// Any violation is a `blocker` — out-of-scope code cannot merge even from
+// a jailbroken local session, because this runs inside the required CI
+// `agent-critic` check + the local pre-push gate.
+//
+// TRAILER RESOLUTION across the reviewed range (why not just HEAD). In a
+// local `df gate-push` / `df review`, HEAD IS the contributor's commit, so
+// its trailer is authoritative. But in CI the `agent-critic` reusable
+// workflow reviews a `pull_request` (and `merge_group`) checkout whose HEAD
+// is a SYNTHETIC merge ref — its commit message does NOT carry the
+// contributor's `Mode:` trailer. Reading only `packet.commit` there would
+// silently no-op and layer 4 would not exist. So the trailer is resolved by
+// scanning EVERY commit message in the reviewed range (`packet.range` =
+// `parent..HEAD`, the exact range whose diff this critic already judges),
+// reusing `commitMessagesInRange` — the established trailer-walk pattern.
+// The range contains the PR's real commits on every event, so the trailer
+// is found regardless of the merge-ref HEAD.
+//
+// Posture (mirrors adapters/static-schema-lint.ts — the precedent
+// deterministic adapter):
+//   - `requiredEnvVars: []` — no auth, no network, no LLM call.
+//   - Pure function over the packet (+ the on-disk catalog it names): same
+//     input → same output. No retries, no flake, no calibration window.
+//   - Registered `required: true` in the consumer config (a HARD GATE, wired
+//     by `df mode init`): its `blocker` findings veto under EVERY aggregation
+//     policy — including `block-if-any`, which demotes an optional critic's
+//     findings to warnings. Safe under `min-complete-quorum` too: it always
+//     completes, so it only ADDS a veto, never removes a quorum slot.
+//
+// THE NO-OP SAFETY INVARIANT (proven by unit test — an injected catalog
+// loader that throws if reached stays unreached): a reviewed range with NO
+// `Mode:` trailer on any commit is judged as a normal PR — the adapter
+// returns APPROVED with zero findings and performs NO catalog I/O. This is
+// what makes it safe to register in a repo's live critic fleet: it cannot
+// destabilize the engineer path. (Note: this adapter is intentionally NOT
+// wired into THIS repo's own `.agent-review/config.json`, so this PR's CI
+// `agent-critic` run does not exercise it — the unit test is the no-op
+// proof, not CI here.)
+//
+// ALWAYS-COMPLETE INVARIANT: the adapter NEVER returns `status: "error"`
+// and never throws out of `review()`. When a `Mode:` trailer names a mode
+// that cannot be validated (missing/unparseable catalog, unknown mode,
+// hostile slug), it FAILS CLOSED as a `blocker` on a `status: "complete"`
+// result — never as an error. This matters for quorum math: a
+// deterministic critic that sometimes errored would drop the completed
+// count below quorum and could wedge the gate. It always completes, so it
+// only ever ADDS a veto, never removes a quorum slot.
+//
+// Hosted-App-gated consumers (spec §4.3.5): whether the hosted worker
+// (private `dark-factory-worker`, authoritative check `dark-factory/critic`)
+// honors consumer-config deterministic adapters is NOT verifiable from this
+// OSS repo. Until it is, a dogfood repo MUST keep the CI `agent-critic`
+// required check (where this adapter runs via the consumer's
+// `.agent-review/config.json`) rather than relying on the non-required
+// hosted `dark-factory/critic` for scope enforcement. See docs/CONSUMER-
+// ADOPTION.md §13.7 and this PR's body.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { MODE_NAME_RE, parseDarkFactoryConfig, } from "@momentiq/dark-factory-schemas";
+import { collectChangedPaths, getTrailer, parseCommitTrailers } from "../evidence/per-sha.js";
+import { commitMessagesInRange } from "../git.js";
+import { classifyModePath } from "../mode/scope-policy.js";
+import { resolveModeWithConfig } from "../mode/resolve.js";
+export const MODE_SCOPE_ADAPTER_ID = "mode-scope";
+/** The git-trailer key that activates this critic (case-insensitive). */
+export const MODE_TRAILER_KEY = "mode";
+// ---------------------------------------------------------------------------
+// Diff line counting.
+/**
+ * Count changed (added + removed) content lines in a unified diff — the churn
+ * the `diffBudget.maxLines` limit governs.
+ *
+ * HUNK-AWARE, not a global prefix filter. A `---`/`+++` prefix means a file
+ * marker ONLY in a file's header region; inside a hunk body those same
+ * prefixes are real content — a REMOVED line whose text starts with `--`
+ * renders as `---…` (e.g. deleting a CSS custom property `--token: …`), and an
+ * ADDED line whose text starts with `++` renders as `+++…`. A blanket
+ * "skip every `---`/`+++` line" undercounts that churn and lets an over-budget
+ * operator-mode PR slip under `maxLines`. So we track hunk state:
+ *
+ *   - `diff --git a/… b/…` begins a new file → HEADER mode. `packet.diff` is
+ *     produced by `git diff --patch` (git.ts), which ALWAYS emits this
+ *     per-file separator, so it is the authoritative file boundary — the
+ *     `--- a/…`/`+++ b/…` markers that follow are skipped as headers.
+ *   - `@@ …` (or `@@@` for a combined diff) opens a hunk → BODY mode.
+ *   - HEADER mode: every line is metadata (`index`, `--- a/…`, `+++ b/…`,
+ *     mode/rename/binary lines). None is churn — count nothing.
+ *   - BODY mode: every line carries a leading ` `/`+`/`-`/`\` column, so a
+ *     `+`/`-` line is UNAMBIGUOUSLY added/removed content (counted regardless
+ *     of what follows the marker), ` ` is context and `\ No newline…` a marker
+ *     (skipped).
+ *
+ * Monotonic under truncation: `packet.diff` may be capped (`diffTruncated`),
+ * in which case this returns a LOWER BOUND on the true churn — safe for the
+ * budget check (a truncated diff can only hide MORE churn), and the caller
+ * fails closed on an under-visible-budget-but-truncated diff. `maxFiles`
+ * (counted from the untruncated `changedFiles` list) is the coarse backstop.
+ *
+ * Exported for unit-testability.
+ */
+export function countDiffLines(diff) {
+    if (!diff)
+        return 0;
+    let count = 0;
+    let inHunk = false;
+    for (const line of diff.split("\n")) {
+        if (line.startsWith("diff --git ")) {
+            // New file section — reset to header mode so the following `--- a/…` /
+            // `+++ b/…` markers are treated as headers, not churn.
+            inHunk = false;
+            continue;
+        }
+        if (line.startsWith("@@")) {
+            inHunk = true; // hunk header — opens the body; not itself churn.
+            continue;
+        }
+        if (!inHunk)
+            continue; // header region — metadata only, never churn.
+        if (line.startsWith("\\"))
+            continue; // "".
+        if (line.startsWith("+") || line.startsWith("-"))
+            count++;
+        // else: context (leading space) or blank separator — not churn.
+    }
+    return count;
+}
+// ---------------------------------------------------------------------------
+// Finding construction.
+const CATEGORY = "mode-scope";
+// The catalog file — the natural anchor for findings not tied to a single
+// diffed path (diff-budget overruns, fail-closed catalog errors).
+const CATALOG_FILE = "darkfactory.yaml";
+function blocker(args) {
+    return {
+        severity: "blocker",
+        category: CATEGORY,
+        file: args.file,
+        // A concrete `line` is REQUIRED for a blocker to survive the v2
+        // `enforceFindingRubric` stripper (the `file + line + evidence`
+        // code-review shape — see policy/gate.ts). Without it the gate would
+        // strip the blocker and FAIL OPEN. Scope violations implicate the file
+        // as a whole, so line 1 is the honest anchor — the same convention
+        // static-schema-lint uses for its whole-file findings.
+        line: args.line ?? 1,
+        evidence: args.evidence,
+        impact: args.impact,
+        requiredFix: args.requiredFix,
+    };
+}
+const HANDOFF_FIX = "Keep the change inside the mode's write scope, or escalate the out-of-scope part to an engineer via `df handoff` and drop it from this PR.";
+function pathViolationFinding(path, modeName, kind) {
+    switch (kind) {
+        case "protected":
+            return blocker({
+                file: path,
+                evidence: `"${path}" matches a \`protectedPaths\` pattern for mode "${modeName}" (protectedPaths always wins over writeScopes on overlap).`,
+                impact: `Mode "${modeName}" is explicitly barred from protected areas (auth, api, migrations, CI, config, dependency manifests). A designer-driven change here would touch a security- or infra-sensitive surface without engineer review — exactly the vibe-platform failure Dark Factory exists to prevent.`,
+                requiredFix: HANDOFF_FIX,
+            });
+        case "dependency":
+            return blocker({
+                file: path,
+                evidence: `"${path}" is a dependency manifest/lockfile and mode "${modeName}" declares \`dependencyPolicy: "none"\`.`,
+                impact: `Adding or changing installed packages under an operator mode with dependencyPolicy "none" is out of bounds — dependency changes are an engineer surface (supply-chain + build risk).`,
+                requiredFix: HANDOFF_FIX,
+            });
+        case "out-of-scope":
+            return blocker({
+                file: path,
+                evidence: `"${path}" matches no \`writeScopes\` entry for mode "${modeName}".`,
+                impact: `Mode "${modeName}" may only edit files inside its declared writeScopes. An out-of-scope edit means the diff reaches code the operator is not authorized to change under this mode.`,
+                requiredFix: HANDOFF_FIX,
+            });
+    }
+}
+function defaultLoadCatalog(repoRoot) {
+    const text = readFileSync(join(repoRoot, "darkfactory.yaml"), "utf8");
+    return parseDarkFactoryConfig(parseYaml(text));
+}
+export class ModeScopeAdapter {
+    id = MODE_SCOPE_ADAPTER_ID;
+    requiredEnvVars = [];
+    loadCatalog;
+    constructor(options = {}) {
+        this.loadCatalog = options.loadCatalog ?? defaultLoadCatalog;
+    }
+    async review(packet, critic, options) {
+        const startMs = Date.now();
+        options.emit?.({
+            ts: new Date().toISOString(),
+            event: "critic_run_started",
+            commit: packet.commit.sha,
+            criticId: critic.id,
+            adapter: this.id,
+            model: critic.model.id,
+        });
+        const rawMode = await this.resolveModeTrailer(packet);
+        const findings = this.computeFindings(packet, rawMode);
+        const verdict = findings.some((f) => options.blockingSeverities.includes(f.severity))
+            ? "CHANGES_REQUESTED"
+            : "APPROVED";
+        const durationMs = Date.now() - startMs;
+        options.emit?.({
+            ts: new Date().toISOString(),
+            event: "critic_run_finished",
+            commit: packet.commit.sha,
+            criticId: critic.id,
+            adapter: this.id,
+            model: critic.model.id,
+            durationMs,
+            verdict,
+        });
+        return {
+            criticId: critic.id,
+            status: "complete",
+            verdict,
+            requiresHumanJudgment: false,
+            reviewer: {
+                name: critic.name,
+                adapter: critic.adapter,
+                model: critic.model,
+                runtime: critic.runtime,
+            },
+            summary: this.summaryFor(packet, rawMode, findings, verdict),
+            findings,
+            validation: { qualityGateResults: [], qualityGatesMissing: [] },
+            confidence: "high",
+            durationMs,
+        };
+    }
+    /**
+     * Resolve the active `Mode:` trailer for the reviewed change, or undefined
+     * (→ no-op). Two sources, in order:
+     *
+     *   1. `packet.commit` — the reviewed commit's own message. In a local
+     *      `df gate-push` / `df review`, HEAD is the contributor's real commit,
+     *      so this is authoritative and needs no git I/O.
+     *   2. The reviewed RANGE (`packet.range` = `parent..HEAD`). In CI the
+     *      `agent-critic` checkout's HEAD is a synthetic merge ref whose message
+     *      lacks the trailer, but the contributor's commit lives INSIDE the
+     *      range — so scan every commit message there (newest-first; first match
+     *      wins). Reuses `commitMessagesInRange`, the established trailer-walk
+     *      helper. Any commit declaring a mode enforces it on the whole PR diff.
+     *
+     * ALWAYS-COMPLETE: the range scan shells out to git; any failure (not a
+     * repo, unreachable range) is caught and degrades to the source-1 result —
+     * never throws, never worse than reading HEAD alone. A root commit (bare
+     * `sha` range, no `..`) skips the scan rather than walking all history.
+     */
+    async resolveModeTrailer(packet) {
+        const fromHead = getTrailer(parseCommitTrailers(`${packet.commit.subject}\n\n${packet.commit.body}`), MODE_TRAILER_KEY);
+        if (fromHead !== undefined)
+            return fromHead;
+        try {
+            const sep = packet.range.indexOf("..");
+            if (sep < 0)
+                return undefined; // bounded ranges only — never walk all history
+            const base = packet.range.slice(0, sep);
+            const messages = await commitMessagesInRange(base, packet.commit.sha, packet.repoRoot);
+            for (const msg of messages) {
+                const m = getTrailer(parseCommitTrailers(msg), MODE_TRAILER_KEY);
+                if (m !== undefined)
+                    return m;
+            }
+        }
+        catch {
+            // DELIBERATELY degrade to HEAD-only (fall through to undefined → no-op);
+            // do NOT fail closed here. A git failure means the range is unreadable
+            // (packet built outside a git repo — e.g. unit tests — or a transient git
+            // error). Failing CLOSED on this path would block EVERY normal engineer
+            // PR (which legitimately carries no `Mode:` trailer) on a git hiccup,
+            // breaking the no-op safety guarantee that makes this critic safe to
+            // register live — a far worse failure than the narrow, already-covered
+            // case this recovers. In CI the checkout is a real repo, so the scan
+            // succeeds and the merge-ref trailer is found; this degrade is the
+            // fail-safe for the rare unreadable-range case. (Fail-closed IS applied
+            // where it belongs: once a `Mode:` trailer IS resolved, an unvalidatable
+            // catalog/mode/budget fails closed as a blocker — see `computeFindings`.)
+        }
+        return undefined;
+    }
+    /**
+     * Pure core. NEVER throws — the mode branch is wrapped so any unexpected
+     * failure fails CLOSED as a blocker rather than propagating an error
+     * status (always-complete invariant). `rawMode` is pre-resolved by
+     * `resolveModeTrailer` (undefined → no-op).
+     */
+    computeFindings(packet, rawMode) {
+        // NO-OP SAFETY PATH — evaluated first, before any catalog I/O. No `Mode:`
+        // trailer anywhere in the reviewed range → normal PR: contribute nothing.
+        if (rawMode === undefined)
+            return [];
+        try {
+            // Hostile / malformed slug: never interpolate it into a filesystem
+            // path or catalog lookup. Fail closed.
+            if (!MODE_NAME_RE.test(rawMode)) {
+                return [
+                    blocker({
+                        file: CATALOG_FILE,
+                        evidence: `Commit ${packet.commit.sha.slice(0, 12)} carries a \`Mode:\` trailer whose value ${JSON.stringify(rawMode)} is not a valid mode name (must match ${MODE_NAME_RE.source}).`,
+                        impact: "A malformed Mode: trailer cannot be resolved to a catalog entry, so the diff cannot be proven in-scope. The scope critic fails closed rather than letting an unverifiable claim pass.",
+                        requiredFix: "Fix the `Mode:` trailer to a valid lowercase mode slug (e.g. `Mode: designer`), or remove it if this is not an operator-mode PR.",
+                    }),
+                ];
+            }
+            let config;
+            try {
+                config = this.loadCatalog(packet.repoRoot);
+            }
+            catch (err) {
+                return [
+                    blocker({
+                        file: CATALOG_FILE,
+                        evidence: `Commit carries \`Mode: ${rawMode}\` but the modes catalog could not be loaded: ${err.message}`,
+                        impact: "A PR that claims an operator mode must resolve to a committed catalog so the diff can be validated against its guardrails. A missing/unparseable darkfactory.yaml means the scope critic cannot verify the change — fail closed.",
+                        requiredFix: "Ensure darkfactory.yaml exists and parses, and that `df mode init <name>` has seeded the mode. If this is not an operator-mode PR, remove the `Mode:` trailer.",
+                    }),
+                ];
+            }
+            let resolved;
+            try {
+                resolved = resolveModeWithConfig(config, rawMode);
+            }
+            catch (err) {
+                return [
+                    blocker({
+                        file: CATALOG_FILE,
+                        evidence: `Commit carries \`Mode: ${rawMode}\` but that mode is not in the catalog: ${err.message}`,
+                        impact: "The Mode: trailer names a mode with no catalog entry, so there are no writeScopes/protectedPaths to validate the diff against — the change cannot be proven in-scope.",
+                        requiredFix: "Seed the mode with `df mode init " + rawMode + "` (engineer reviews the scopes in the init PR), or correct the `Mode:` trailer to an existing mode.",
+                    }),
+                ];
+            }
+            return this.validateDiff(packet, resolved.modeName, resolved.mode);
+        }
+        catch (err) {
+            // Belt-and-suspenders: any unforeseen throw fails CLOSED as a blocker
+            // on a complete result — never an error status.
+            return [
+                blocker({
+                    file: CATALOG_FILE,
+                    evidence: `mode-scope critic errored while validating \`Mode: ${rawMode}\`: ${err.message}`,
+                    impact: "The scope critic could not complete its check for a mode-tagged PR. Failing closed prevents an out-of-scope change from slipping through on an internal error.",
+                    requiredFix: "Re-run the gate; if it persists, file a bug against the mode-scope adapter with the commit SHA and darkfactory.yaml.",
+                }),
+            ];
+        }
+    }
+    validateDiff(packet, modeName, mode) {
+        const findings = [];
+        // Per-path scope classification. `collectChangedPaths` yields the new
+        // path AND (for renames/copies) the old path, so a rename OUT of a
+        // protected area or writeScope is caught on both endpoints — a
+        // path-only check would miss the vacated side.
+        const paths = collectChangedPaths(packet.changedFiles);
+        const seen = new Set();
+        for (const path of paths) {
+            if (seen.has(path))
+                continue;
+            seen.add(path);
+            const classification = classifyModePath(path, mode);
+            if (classification.kind !== "allow") {
+                findings.push(pathViolationFinding(path, modeName, classification.kind));
+            }
+        }
+        // Diff budget. maxFiles uses the authoritative (untruncated)
+        // changedFiles count; maxLines uses the churn visible in the diff.
+        // Budget findings aren't tied to one path, so anchor them to the first
+        // changed file (falling back to the catalog) — a `file` is required for
+        // the finding to survive the v2 rubric.
+        const anchor = packet.changedFiles[0]?.path ?? CATALOG_FILE;
+        const budget = mode.diffBudget;
+        if (budget?.maxFiles !== undefined) {
+            const fileCount = packet.changedFiles.length;
+            if (fileCount > budget.maxFiles) {
+                findings.push(blocker({
+                    file: anchor,
+                    evidence: `This PR changes ${fileCount} file(s), over mode "${modeName}" \`diffBudget.maxFiles\` = ${budget.maxFiles}.`,
+                    impact: "Operator-mode changes are capped to a small, reviewable surface. A change over the file budget is too large for the mode's risk profile.",
+                    requiredFix: `Split the change into smaller PRs each within ${budget.maxFiles} file(s), or escalate to an engineer via \`df handoff\`.`,
+                }));
+            }
+        }
+        if (budget?.maxLines !== undefined) {
+            const lineCount = countDiffLines(packet.diff);
+            if (lineCount > budget.maxLines) {
+                findings.push(blocker({
+                    file: anchor,
+                    evidence: `This PR changes ${lineCount}+ line(s), over mode "${modeName}" \`diffBudget.maxLines\` = ${budget.maxLines}.${packet.diffTruncated ? " (diff was truncated; the true count is at least this.)" : ""}`,
+                    impact: "Operator-mode changes are capped to a small, reviewable churn. A change over the line budget is too large for the mode's risk profile.",
+                    requiredFix: `Reduce the change to at most ${budget.maxLines} changed line(s), split into smaller PRs, or escalate to an engineer via \`df handoff\`.`,
+                }));
+            }
+            else if (packet.diffTruncated) {
+                // FAIL CLOSED on a truncated diff whose VISIBLE churn is under budget.
+                // `countDiffLines` on a truncated `packet.diff` is only a LOWER bound,
+                // so an under-visible-budget-but-truncated diff cannot be PROVEN within
+                // `maxLines` — the true churn may exceed it. Approving here would let an
+                // over-budget operator-mode change through whenever the trusted-surface
+                // diff is capped before the visible count crosses the limit. (This gap
+                // is specific to `maxLines`; `maxFiles` above is exact — it counts the
+                // untruncated `changedFiles` list — so there is no truncation twin
+                // there.)
+                findings.push(blocker({
+                    file: anchor,
+                    evidence: `Mode "${modeName}" sets \`diffBudget.maxLines\` = ${budget.maxLines}, but the reviewed diff was TRUNCATED (${lineCount} line(s) visible); the true churn cannot be proven within budget.`,
+                    impact: "A truncated diff can hide churn above the mode's hard line budget, so approving it would let an over-budget change merge. The scope critic fails closed until the change is provably within budget.",
+                    requiredFix: `Shrink the change so its FULL diff is within ${budget.maxLines} line(s) (small enough that the diff is not truncated), split into smaller PRs, or escalate to an engineer via \`df handoff\`.`,
+                }));
+            }
+        }
+        return findings;
+    }
+    summaryFor(packet, rawMode, findings, verdict) {
+        // `rawMode` is the SAME resolved trailer `review()` fed to `computeFindings`
+        // (`resolveModeTrailer` — HEAD trailer OR any commit in the reviewed range),
+        // NOT a re-parse of `packet.commit`. On the merge-ref path the trailer lives
+        // on a range commit, not on HEAD; recomputing from `packet.commit` here would
+        // make the summary claim "no-op" while `findings` actually block the PR. The
+        // summary MUST narrate the same mode the findings were judged against.
+        if (rawMode === undefined) {
+            return "mode-scope: no `Mode:` trailer — judged as a normal PR (no-op).";
+        }
+        return verdict === "APPROVED"
+            ? `mode-scope: \`Mode: ${rawMode}\` diff is within scope (${packet.changedFiles.length} file(s), 0 violations).`
+            : `mode-scope: \`Mode: ${rawMode}\` — ${findings.length} scope violation(s) block this PR.`;
+    }
+    async doctor(_critic) {
+        // Dependency-light: no env, no subprocess, no network. The smoke check
+        // confirms the shared scope classifier is wired correctly on this host.
+        const protectedHit = classifyModePath("src/auth/login.ts", {
+            writeScopes: ["src/**"],
+            protectedPaths: ["**/auth/**"],
+        }).kind === "protected";
+        return [
+            {
+                name: "mode_scope_classifier",
+                passed: protectedHit,
+                detail: protectedHit
+                    ? "scope classifier resolves protectedPaths over writeScopes as expected."
+                    : "scope classifier did NOT resolve protectedPaths over writeScopes — precedence bug.",
+                ...(protectedHit
+                    ? {}
+                    : { remediation: "Investigate packages/cli/src/mode/scope-policy.ts classifyModePath precedence." }),
+            },
+        ];
+    }
+}
+//# sourceMappingURL=mode-scope.js.map

package/dist/adapters/mode-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-scope.js","sourceRoot":"","sources":["../../src/adapters/mode-scope.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,kDAAkD;AAClD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,4EAA4E;AAC5E,mEAAmE;AACnE,0EAA0E;AAC1E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,6CAA6C;AAC7C,EAAE;AACF,kEAAkE;AAClE,0BAA0B;AAC1B,gEAAgE;AAChE,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,sEAAsE;AACtE,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,uBAAuB;AACvB,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,8DAA8D;AAC9D,uEAAuE;AACvE,0EAA0E;AAC1E,sDAAsD;AACtD,EAAE;AACF,sEAAsE;AACtE,6EAA6E;AAC7E,4EAA4E;AAC5E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,yEAAyE;AACzE,wCAAwC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,sBAAsB,GAQvB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,8EAA8E;AAC9E,sBAAsB;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,uEAAuE;YACvE,uDAAuD;YACvD,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC,CAAC,kDAAkD;YACjE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,8CAA8C;QACrE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,iCAAiC;QACtE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;QAC1D,gEAAgE;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AAExB,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,0EAA0E;AAC1E,kEAAkE;AAClE,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC,SAAS,OAAO,CAAC,IAMhB;IACC,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,gEAAgE;QAChE,gEAAgE;QAChE,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,uDAAuD;QACvD,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GACf,4IAA4I,CAAC;AAE/I,SAAS,oBAAoB,CAC3B,IAAY,EACZ,QAAgB,EAChB,IAAiD;IAEjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,WAAW;YACd,OAAO,OAAO,CAAC;gBACb,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,IAAI,IAAI,oDAAoD,QAAQ,6DAA6D;gBAC3I,MAAM,EAAE,SAAS,QAAQ,qRAAqR;gBAC9S,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;QACL,KAAK,YAAY;YACf,OAAO,OAAO,CAAC;gBACb,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,IAAI,IAAI,iDAAiD,QAAQ,0CAA0C;gBACrH,MAAM,EAAE,sLAAsL;gBAC9L,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;QACL,KAAK,cAAc;YACjB,OAAO,OAAO,CAAC;gBACb,IAAI,EAAE,IAAI;gBACV,QAAQ,EAAE,IAAI,IAAI,gDAAgD,QAAQ,IAAI;gBAC9E,MAAM,EAAE,SAAS,QAAQ,mKAAmK;gBAC5L,WAAW,EAAE,WAAW;aACzB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAgBD,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,OAAO,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,EAAE,GAAG,qBAAqB,CAAC;IAC3B,eAAe,GAAsB,EAAE,CAAC;IAEhC,WAAW,CAA0C;IAEtE,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CACV,MAAoB,EACpB,MAAoB,EACpB,OAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACnF,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,UAAU,CAAC;QACf,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QAExC,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE;YACtB,UAAU;YACV,OAAO;SACR,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,UAAU;YAClB,OAAO;YACP,qBAAqB,EAAE,KAAK;YAC5B,QAAQ,EAAE;gBACR,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB;YACD,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC5D,QAAQ;YACR,UAAU,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,mBAAmB,EAAE,EAAE,EAAE;YAC/D,UAAU,EAAE,MAAM;YAClB,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAoB;QACnD,MAAM,QAAQ,GAAG,UAAU,CACzB,mBAAmB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EACxE,gBAAgB,CACjB,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,+CAA+C;YAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,CAAC;gBACjE,IAAI,CAAC,KAAK,SAAS;oBAAE,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;QAC5E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,MAAoB,EAAE,OAA2B;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAErC,IAAI,CAAC;YACH,mEAAmE;YACnE,uCAAuC;YACvC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,CAAC;wBACN,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,UAAU,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yCAAyC,YAAY,CAAC,MAAM,IAAI;wBACrL,MAAM,EACJ,uLAAuL;wBACzL,WAAW,EACT,kIAAkI;qBACrI,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,IAAI,MAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,CAAC;wBACN,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,0BAA0B,OAAO,iDAAkD,GAAa,CAAC,OAAO,EAAE;wBACpH,MAAM,EACJ,kOAAkO;wBACpO,WAAW,EACT,gKAAgK;qBACnK,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,IAAI,QAAkD,CAAC;YACvD,IAAI,CAAC;gBACH,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO;oBACL,OAAO,CAAC;wBACN,IAAI,EAAE,YAAY;wBAClB,QAAQ,EAAE,0BAA0B,OAAO,2CAA4C,GAAa,CAAC,OAAO,EAAE;wBAC9G,MAAM,EACJ,uKAAuK;wBACzK,WAAW,EACT,mCAAmC,GAAG,OAAO,GAAG,qGAAqG;qBACxJ,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,gDAAgD;YAChD,OAAO;gBACL,OAAO,CAAC;oBACN,IAAI,EAAE,YAAY;oBAClB,QAAQ,EAAE,sDAAsD,OAAO,OAAQ,GAAa,CAAC,OAAO,EAAE;oBACtG,MAAM,EACJ,gKAAgK;oBAClK,WAAW,EACT,sHAAsH;iBACzH,CAAC;aACH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,YAAY,CAClB,MAAoB,EACpB,QAAgB,EAChB,IAAgB;QAEhB,MAAM,QAAQ,GAAoB,EAAE,CAAC;QAErC,sEAAsE;QACtE,mEAAmE;QACnE,+DAA+D;QAC/D,+CAA+C;QAC/C,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,cAAc,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,YAAY,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YAC7C,IAAI,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,mBAAmB,SAAS,wBAAwB,QAAQ,+BAA+B,MAAM,CAAC,QAAQ,GAAG;oBACvH,MAAM,EACJ,0IAA0I;oBAC5I,WAAW,EAAE,iDAAiD,MAAM,CAAC,QAAQ,0DAA0D;iBACxI,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,mBAAmB,SAAS,yBAAyB,QAAQ,+BAA+B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,yDAAyD,CAAC,CAAC,CAAC,EAAE,EAAE;oBAChN,MAAM,EACJ,wIAAwI;oBAC1I,WAAW,EAAE,gCAAgC,MAAM,CAAC,QAAQ,0FAA0F;iBACvJ,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBAChC,uEAAuE;gBACvE,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,wEAAwE;gBACxE,uEAAuE;gBACvE,uEAAuE;gBACvE,mEAAmE;gBACnE,UAAU;gBACV,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC;oBACN,IAAI,EAAE,MAAM;oBACZ,QAAQ,EAAE,SAAS,QAAQ,oCAAoC,MAAM,CAAC,QAAQ,0CAA0C,SAAS,mEAAmE;oBACpM,MAAM,EACJ,qMAAqM;oBACvM,WAAW,EAAE,gDAAgD,MAAM,CAAC,QAAQ,gIAAgI;iBAC7M,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,UAAU,CAChB,MAAoB,EACpB,OAA2B,EAC3B,QAAyB,EACzB,OAAyC;QAEzC,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,iEAAiE,CAAC;QAC3E,CAAC;QACD,OAAO,OAAO,KAAK,UAAU;YAC3B,CAAC,CAAC,uBAAuB,OAAO,4BAA4B,MAAM,CAAC,YAAY,CAAC,MAAM,0BAA0B;YAChH,CAAC,CAAC,uBAAuB,OAAO,QAAQ,QAAQ,CAAC,MAAM,oCAAoC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAqB;QAChC,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,YAAY,GAChB,gBAAgB,CAAC,mBAAmB,EAAE;YACpC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,cAAc,EAAE,CAAC,YAAY,CAAC;SAC/B,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC;QAC1B,OAAO;YACL;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,YAAY;oBAClB,CAAC,CAAC,wEAAwE;oBAC1E,CAAC,CAAC,oFAAoF;gBACxF,GAAG,CAAC,YAAY;oBACd,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;aACvG;SACF,CAAC;IACJ,CAAC;CACF"}