@neurcode-ai/cli 0.10.1 → 0.12.0

package/dist/governance/pipeline/orchestration/scope-guard-orchestration.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Scope-Guard + Governance Evaluation Orchestration
+ * --------------------------------------------------
+ * Extracts the plan-resolution / governance-evaluation / scope-guard compute
+ * region previously inlined at `commands/verify.ts:4238–4376`.
+ *
+ * RESPONSIBILITIES (data-pure):
+ *   - resolve plan scope (local Plan Sync vs remote plan fetch)
+ *   - run the intent-aware engine
+ *   - run structural analysis (via the existing plan-structural-analysis module)
+ *   - call evaluateGovernance
+ *   - resolve session ID and fetch allowed files
+ *   - compute the approved-set intersection and filtered violations
+ *
+ * EXPLICITLY NOT RESPONSIBLE FOR:
+ *   - rendering scope violations (chalk output, emitVerifyJson, exitWithEvidence)
+ *   - `scopeGuardPassed` flag lifecycle (caller owns that)
+ *   - catch-block error logging (caller owns the surrounding try/catch)
+ *
+ * SEMANTIC PRESERVATION:
+ *   The computation sequence, fault-swallowing behaviour (intent engine, session
+ *   fetch), and intersection logic are byte-identical to the prior inline region.
+ *
+ * REPLAY INVARIANT:
+ *   - evaluateGovernance call params are identical to lines 4317-4330
+ *   - runPlanStructuralAnalysis call is identical to lines 4312-4315
+ *   - runIntentEngine call is identical to lines 4293-4302
+ *   - getSessionId() fallback chain is identical to lines 4335-4342
+ *   - allowedFiles resolution is identical to lines 4352-4371
+ *   - approvedSet intersection is identical to lines 4373-4376
+ */
+import { evaluateGovernance } from '../../../utils/governance';
+import type { IntentIssue, IntentSummary, FlowIssue, RegressionIssue } from '../../../intent-engine';
+import type { StructuralViolation } from '../../../structural-rules/types';
+import type { DiffFile } from '@neurcode-ai/diff-parser';
+import type { OrgGovernanceSettings } from '@neurcode-ai/core';
+interface PlanData {
+    intent: string;
+    sessionId: string | null;
+    content: {
+        title?: unknown;
+        summary?: unknown;
+        files: Array<{
+            action: string;
+            path: string;
+        }>;
+        dependencies?: unknown;
+    };
+}
+interface SessionData {
+    session: Record<string, unknown>;
+}
+export interface ScopeGuardPlanClient {
+    getPlan(planId: string): Promise<PlanData>;
+    getSession(sessionId: string): Promise<SessionData>;
+}
+export interface ScopeGuardLocalPlan {
+    intent: string;
+    constraints: string[];
+    expectedFiles?: string[];
+}
+export interface ScopeGuardSigningParams {
+    signedLogsRequired: boolean;
+    /** May be null when no signing key is configured. */
+    signingKey: string | null | undefined;
+    signingKeyId: string | null | undefined;
+    signingKeys: Record<string, string>;
+    /** String identifier for the AI-log signer (matches evaluateGovernance's signer param). */
+    signer: string | undefined;
+}
+export interface ScopeGuardOrchestrationInput {
+    /** True when the resolved planId is 'local-plan-sync'. */
+    useLocalPlanSync: boolean;
+    /** Snapshot from ensureLocalPlan(). */
+    localPlanSync: ScopeGuardLocalPlan;
+    /** Deduplicated expected files from the local plan file. */
+    localPlanExpectedFiles: string[];
+    /** Resolved plan ID (truthy, non-advisory). */
+    finalPlanId: string;
+    /** API client duck-typed to the two methods we need. */
+    client: ScopeGuardPlanClient;
+    /** Normalised diff files from the diff-normalization stage. */
+    diffFiles: DiffFile[];
+    /** Absolute project root path. */
+    projectRoot: string;
+    /** Config file data (neurcode.config.json). Narrow type — only fields used. */
+    configData: {
+        sessionId?: unknown;
+        lastSessionId?: unknown;
+    };
+    /** Governance signing credentials. */
+    signing: ScopeGuardSigningParams;
+    /** Org governance settings fetched from remote, or null. */
+    orgGovernanceSettings: OrgGovernanceSettings | null;
+    /** Returns true for file paths that should be excluded from scope-guard checks. */
+    shouldIgnore: (path: string) => boolean;
+}
+/** Note surfaced when session resolution is attempted but fails or not available. */
+export type SessionResolutionNote = 'session_not_available' | 'no_session_id' | null;
+export interface ScopeGuardOrchestrationResult {
+    /** Union of remote plan files and local plan files. */
+    planFilesForVerification: string[];
+    /** Dependency paths from the remote plan (empty for local sync). */
+    planDependencies: string[];
+    /** Original intent / constraint text used for intent-engine input. */
+    intentConstraintsForVerification: string | undefined;
+    /** Task label passed to evaluateGovernance. */
+    governanceTask: string;
+    /** Session ID extracted from the remote plan response (null for local sync). */
+    remotePlanSessionId: string | null;
+    intentEngineIssues: IntentIssue[];
+    intentEngineDomains: string[];
+    intentEngineSummary: IntentSummary | null;
+    intentEngineFlowIssues: FlowIssue[];
+    intentEngineRegressions: RegressionIssue[];
+    structuralViolations: StructuralViolation[];
+    structuralRulesApplied: string[];
+    structuralSuppressedCount: number;
+    governanceResult: ReturnType<typeof evaluateGovernance> | null;
+    /** All file paths from the diff. */
+    modifiedFiles: string[];
+    /** Files from session allowedFiles (empty when session resolution fails). */
+    allowedFiles: string[];
+    /** Union set of plan files + allowedFiles (the approval boundary). */
+    approvedSet: Set<string>;
+    /** Modified files not in approvedSet (before shouldIgnore). */
+    violations: string[];
+    /** Violations after shouldIgnore filtering — the actionable violation set. */
+    filteredViolations: string[];
+    /** Resolved session ID string (for caller debug rendering). */
+    sessionIdString: string | null;
+    /**
+     * Set to true when useLocalPlanSync is true so the caller can render
+     * "Plan Sync scope loaded: N file(s)".
+     */
+    planSyncUsed: boolean;
+    planSyncFileCount: number;
+    /**
+     * Indicates why session-based allowed files were unavailable.
+     * Caller decides whether and how to surface this to the user.
+     */
+    sessionResolutionNote: SessionResolutionNote;
+}
+/**
+ * Compute the scope-guard orchestration result. Replaces the inline compute
+ * region at verify.ts:4239–4376.
+ *
+ * Does not emit JSON, does not log, does not exit.
+ */
+export declare function runScopeGuardOrchestration(input: ScopeGuardOrchestrationInput): Promise<ScopeGuardOrchestrationResult>;
+export {};
+//# sourceMappingURL=scope-guard-orchestration.d.ts.map

package/dist/governance/pipeline/orchestration/scope-guard-orchestration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-guard-orchestration.d.ts","sourceRoot":"","sources":["../../../../src/governance/pipeline/orchestration/scope-guard-orchestration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGrG,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAM/D,UAAU,QAAQ;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE;QACP,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/C,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,CAAC;CACH;AAKD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACrD;AAID,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAID,MAAM,WAAW,uBAAuB;IACtC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qDAAqD;IACrD,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACtC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,2FAA2F;IAC3F,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAID,MAAM,WAAW,4BAA4B;IAC3C,0DAA0D;IAC1D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,aAAa,EAAE,mBAAmB,CAAC;IACnC,4DAA4D;IAC5D,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,+DAA+D;IAC/D,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7D,sCAAsC;IACtC,OAAO,EAAE,uBAAuB,CAAC;IACjC,4DAA4D;IAC5D,qBAAqB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpD,mFAAmF;IACnF,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;CACzC;AAED,qFAAqF;AACrF,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,eAAe,GAAG,IAAI,CAAC;AAErF,MAAM,WAAW,6BAA6B;IAE5C,uDAAuD;IACvD,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,oEAAoE;IACpE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,sEAAsE;IACtE,gCAAgC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrD,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGnC,kBAAkB,EAAE,WAAW,EAAE,CAAC;IAClC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,mBAAmB,EAAE,aAAa,GAAG,IAAI,CAAC;IAC1C,sBAAsB,EAAE,SAAS,EAAE,CAAC;IACpC,uBAAuB,EAAE,eAAe,EAAE,CAAC;IAG3C,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;IAC5C,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,yBAAyB,EAAE,MAAM,CAAC;IAGlC,gBAAgB,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,GAAG,IAAI,CAAC;IAG/D,oCAAoC;IACpC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sEAAsE;IACtE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,+DAA+D;IAC/D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,+DAA+D;IAC/D,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAG/B;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,qBAAqB,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,6BAA6B,CAAC,CAiLxC"}

package/dist/governance/pipeline/orchestration/scope-guard-orchestration.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * Scope-Guard + Governance Evaluation Orchestration
+ * --------------------------------------------------
+ * Extracts the plan-resolution / governance-evaluation / scope-guard compute
+ * region previously inlined at `commands/verify.ts:4238–4376`.
+ *
+ * RESPONSIBILITIES (data-pure):
+ *   - resolve plan scope (local Plan Sync vs remote plan fetch)
+ *   - run the intent-aware engine
+ *   - run structural analysis (via the existing plan-structural-analysis module)
+ *   - call evaluateGovernance
+ *   - resolve session ID and fetch allowed files
+ *   - compute the approved-set intersection and filtered violations
+ *
+ * EXPLICITLY NOT RESPONSIBLE FOR:
+ *   - rendering scope violations (chalk output, emitVerifyJson, exitWithEvidence)
+ *   - `scopeGuardPassed` flag lifecycle (caller owns that)
+ *   - catch-block error logging (caller owns the surrounding try/catch)
+ *
+ * SEMANTIC PRESERVATION:
+ *   The computation sequence, fault-swallowing behaviour (intent engine, session
+ *   fetch), and intersection logic are byte-identical to the prior inline region.
+ *
+ * REPLAY INVARIANT:
+ *   - evaluateGovernance call params are identical to lines 4317-4330
+ *   - runPlanStructuralAnalysis call is identical to lines 4312-4315
+ *   - runIntentEngine call is identical to lines 4293-4302
+ *   - getSessionId() fallback chain is identical to lines 4335-4342
+ *   - allowedFiles resolution is identical to lines 4352-4371
+ *   - approvedSet intersection is identical to lines 4373-4376
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runScopeGuardOrchestration = runScopeGuardOrchestration;
+const governance_1 = require("../../../utils/governance");
+const intent_engine_1 = require("../../../intent-engine");
+const state_1 = require("../../../utils/state");
+const plan_structural_analysis_1 = require("./plan-structural-analysis");
+/**
+ * Compute the scope-guard orchestration result. Replaces the inline compute
+ * region at verify.ts:4239–4376.
+ *
+ * Does not emit JSON, does not log, does not exit.
+ */
+async function runScopeGuardOrchestration(input) {
+    const { useLocalPlanSync, localPlanSync, localPlanExpectedFiles, finalPlanId, client, diffFiles, projectRoot, configData, signing, orgGovernanceSettings, shouldIgnore, } = input;
+    // ── Step A: Modified files ────────────────────────────────────────────────
+    const modifiedFiles = diffFiles.map(f => f.path);
+    // ── Step B: Resolve plan scope ────────────────────────────────────────────
+    let originalIntent = '';
+    let governanceTask = 'Plan verification';
+    let planFiles = [];
+    let planDependencies = [];
+    let remotePlanSessionId = null;
+    let planSyncUsed = false;
+    if (useLocalPlanSync) {
+        const localIntent = (localPlanSync.intent || '').trim();
+        const localConstraintText = localPlanSync.constraints.length > 0 ? localPlanSync.constraints.join('; ') : '';
+        planFiles = [...localPlanExpectedFiles];
+        originalIntent = localIntent || localConstraintText;
+        governanceTask = localIntent
+            ? `Local Plan Sync: ${localIntent}`
+            : 'Local Plan Sync verification';
+        planSyncUsed = true;
+    }
+    else {
+        const planData = await client.getPlan(finalPlanId);
+        originalIntent = planData.intent || '';
+        const planTitle = typeof planData.content.title === 'string'
+            ? planData.content.title?.trim()
+            : '';
+        const planSummary = typeof planData.content.summary === 'string' ? planData.content.summary.trim() : '';
+        governanceTask = planTitle || planSummary || originalIntent || 'Plan verification';
+        planFiles = planData.content.files
+            .filter((f) => f.action === 'CREATE' || f.action === 'MODIFY')
+            .map((f) => f.path);
+        planDependencies = Array.isArray(planData.content.dependencies)
+            ? planData.content.dependencies.filter((item) => typeof item === 'string')
+            : [];
+        remotePlanSessionId = planData.sessionId || null;
+    }
+    const planFilesForVerification = [...new Set([...planFiles, ...localPlanExpectedFiles])];
+    const intentConstraintsForVerification = originalIntent || undefined;
+    // ── Intent-Aware Engine ───────────────────────────────────────────────────
+    let intentEngineIssues = [];
+    let intentEngineDomains = [];
+    let intentEngineSummary = null;
+    let intentEngineFlowIssues = [];
+    let intentEngineRegressions = [];
+    if (intentConstraintsForVerification && diffFiles.length > 0) {
+        try {
+            const engineResult = (0, intent_engine_1.runIntentEngine)(intentConstraintsForVerification, diffFiles, projectRoot);
+            intentEngineIssues = engineResult.intentIssues;
+            intentEngineDomains = engineResult.checkedDomains;
+            intentEngineSummary = engineResult.intentSummary;
+            intentEngineFlowIssues = engineResult.flowIssues;
+            intentEngineRegressions = engineResult.regressions;
+        }
+        catch {
+            // Non-fatal: intent engine errors must never break verification
+        }
+    }
+    // ── Structural Rule Engine (plan-mode) ────────────────────────────────────
+    const planStructural = (0, plan_structural_analysis_1.runPlanStructuralAnalysis)({ projectRoot, diffFiles });
+    // ── Governance Evaluation ─────────────────────────────────────────────────
+    const governanceResult = (0, governance_1.evaluateGovernance)({
+        projectRoot,
+        task: governanceTask,
+        expectedFiles: planFilesForVerification,
+        expectedDependencies: planDependencies,
+        diffFiles,
+        contextCandidates: planFilesForVerification,
+        orgGovernance: orgGovernanceSettings,
+        requireSignedAiLogs: signing.signedLogsRequired,
+        // Normalise null → undefined to match evaluateGovernance's optional params.
+        signingKey: signing.signingKey ?? undefined,
+        signingKeyId: signing.signingKeyId ?? undefined,
+        signingKeys: signing.signingKeys,
+        signer: signing.signer,
+    });
+    // ── Session ID Resolution ─────────────────────────────────────────────────
+    // Priority: state file → config.sessionId → config.lastSessionId → plan sessionId
+    // Use explicit if/else chain to keep TypeScript narrowing clear.
+    let sessionIdString = (0, state_1.getSessionId)();
+    if (!sessionIdString) {
+        if (typeof configData.sessionId === 'string') {
+            sessionIdString = configData.sessionId;
+        }
+        else if (typeof configData.lastSessionId === 'string') {
+            sessionIdString = configData.lastSessionId;
+        }
+    }
+    if (!sessionIdString && remotePlanSessionId) {
+        sessionIdString = remotePlanSessionId;
+    }
+    // ── Allowed Files (from session) ──────────────────────────────────────────
+    let allowedFiles = [];
+    let sessionResolutionNote = null;
+    if (sessionIdString) {
+        try {
+            const sessionData = await client.getSession(sessionIdString);
+            allowedFiles = sessionData.session.allowedFiles || [];
+        }
+        catch {
+            // Non-fatal: session fetch failure means scope-guard uses plan files only
+            sessionResolutionNote = 'session_not_available';
+        }
+    }
+    else {
+        sessionResolutionNote = 'no_session_id';
+    }
+    // ── Step C: Intersection Logic ────────────────────────────────────────────
+    const approvedSet = new Set([...planFilesForVerification, ...allowedFiles]);
+    const violations = modifiedFiles.filter(f => !approvedSet.has(f));
+    const filteredViolations = violations.filter((p) => !shouldIgnore(p));
+    return {
+        // Plan scope
+        planFilesForVerification,
+        planDependencies,
+        intentConstraintsForVerification,
+        governanceTask,
+        remotePlanSessionId,
+        // Intent engine
+        intentEngineIssues,
+        intentEngineDomains,
+        intentEngineSummary,
+        intentEngineFlowIssues,
+        intentEngineRegressions,
+        // Structural
+        structuralViolations: planStructural.violations,
+        structuralRulesApplied: planStructural.rulesApplied,
+        structuralSuppressedCount: planStructural.suppressedCount,
+        // Governance
+        governanceResult,
+        // Scope guard
+        modifiedFiles,
+        allowedFiles,
+        approvedSet,
+        violations,
+        filteredViolations,
+        sessionIdString,
+        // UI hints
+        planSyncUsed,
+        planSyncFileCount: planFiles.length,
+        sessionResolutionNote,
+    };
+}
+//# sourceMappingURL=scope-guard-orchestration.js.map

package/dist/governance/pipeline/orchestration/scope-guard-orchestration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-guard-orchestration.js","sourceRoot":"","sources":["../../../../src/governance/pipeline/orchestration/scope-guard-orchestration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;AAsJH,gEAmLC;AAvUD,0DAA+D;AAC/D,0DAAyD;AAEzD,gDAAoD;AACpD,yEAAuE;AA0IvE;;;;;GAKG;AACI,KAAK,UAAU,0BAA0B,CAC9C,KAAmC;IAEnC,MAAM,EACJ,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,WAAW,EACX,MAAM,EACN,SAAS,EACT,WAAW,EACX,UAAU,EACV,OAAO,EACP,qBAAqB,EACrB,YAAY,GACb,GAAG,KAAK,CAAC;IAEV,6EAA6E;IAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjD,6EAA6E;IAC7E,IAAI,cAAc,GAAG,EAAE,CAAC;IACxB,IAAI,cAAc,GAAG,mBAAmB,CAAC;IACzC,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,gBAAgB,GAAa,EAAE,CAAC;IACpC,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAC9C,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,mBAAmB,GACvB,aAAa,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,SAAS,GAAG,CAAC,GAAG,sBAAsB,CAAC,CAAC;QACxC,cAAc,GAAG,WAAW,IAAI,mBAAmB,CAAC;QACpD,cAAc,GAAG,WAAW;YAC1B,CAAC,CAAC,oBAAoB,WAAW,EAAE;YACnC,CAAC,CAAC,8BAA8B,CAAC;QACnC,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnD,cAAc,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,SAAS,GACb,OAAQ,QAAQ,CAAC,OAA+B,CAAC,KAAK,KAAK,QAAQ;YACjE,CAAC,CAAE,QAAQ,CAAC,OAA8B,CAAC,KAAK,EAAE,IAAI,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,cAAc,GAAG,SAAS,IAAI,WAAW,IAAI,cAAc,IAAI,mBAAmB,CAAC;QACnF,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtB,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAE,QAAQ,CAAC,OAAe,CAAC,YAAY,CAAC;YACtE,CAAC,CAAE,QAAQ,CAAC,OAAe,CAAC,YAAY,CAAC,MAAM,CAC3C,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAC5D;YACH,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC;IACnD,CAAC;IAED,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,gCAAgC,GAAG,cAAc,IAAI,SAAS,CAAC;IAErE,6EAA6E;IAC7E,IAAI,kBAAkB,GAAkB,EAAE,CAAC;IAC3C,IAAI,mBAAmB,GAAa,EAAE,CAAC;IACvC,IAAI,mBAAmB,GAAyB,IAAI,CAAC;IACrD,IAAI,sBAAsB,GAAgB,EAAE,CAAC;IAC7C,IAAI,uBAAuB,GAAsB,EAAE,CAAC;IAEpD,IAAI,gCAAgC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAA,+BAAe,EAClC,gCAAgC,EAChC,SAAS,EACT,WAAW,CACZ,CAAC;YACF,kBAAkB,GAAG,YAAY,CAAC,YAAY,CAAC;YAC/C,mBAAmB,GAAG,YAAY,CAAC,cAAc,CAAC;YAClD,mBAAmB,GAAG,YAAY,CAAC,aAAa,CAAC;YACjD,sBAAsB,GAAG,YAAY,CAAC,UAAU,CAAC;YACjD,uBAAuB,GAAG,YAAY,CAAC,WAAW,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAA,oDAAyB,EAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAE7E,6EAA6E;IAC7E,MAAM,gBAAgB,GAAG,IAAA,+BAAkB,EAAC;QAC1C,WAAW;QACX,IAAI,EAAE,cAAc;QACpB,aAAa,EAAE,wBAAwB;QACvC,oBAAoB,EAAE,gBAAgB;QACtC,SAAS;QACT,iBAAiB,EAAE,wBAAwB;QAC3C,aAAa,EAAE,qBAAqB;QACpC,mBAAmB,EAAE,OAAO,CAAC,kBAAkB;QAC/C,4EAA4E;QAC5E,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;QAC3C,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,SAAS;QAC/C,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,kFAAkF;IAClF,iEAAiE;IACjE,IAAI,eAAe,GAAkB,IAAA,oBAAY,GAAE,CAAC;IACpD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,OAAO,UAAU,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC7C,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC;QACzC,CAAC;aAAM,IAAI,OAAO,UAAU,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YACxD,eAAe,GAAG,UAAU,CAAC,aAAa,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,eAAe,IAAI,mBAAmB,EAAE,CAAC;QAC5C,eAAe,GAAG,mBAAmB,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,qBAAqB,GAA0B,IAAI,CAAC;IAExD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAC7D,YAAY,GAAI,WAAW,CAAC,OAAe,CAAC,YAAY,IAAI,EAAE,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qBAAqB,GAAG,uBAAuB,CAAC;QAClD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,qBAAqB,GAAG,eAAe,CAAC;IAC1C,CAAC;IAED,6EAA6E;IAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,aAAa;QACb,wBAAwB;QACxB,gBAAgB;QAChB,gCAAgC;QAChC,cAAc;QACd,mBAAmB;QAEnB,gBAAgB;QAChB,kBAAkB;QAClB,mBAAmB;QACnB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QAEvB,aAAa;QACb,oBAAoB,EAAE,cAAc,CAAC,UAAU;QAC/C,sBAAsB,EAAE,cAAc,CAAC,YAAY;QACnD,yBAAyB,EAAE,cAAc,CAAC,eAAe;QAEzD,aAAa;QACb,gBAAgB;QAEhB,cAAc;QACd,aAAa;QACb,YAAY;QACZ,WAAW;QACX,UAAU;QACV,kBAAkB;QAClB,eAAe;QAEf,WAAW;QACX,YAAY;QACZ,iBAAiB,EAAE,SAAS,CAAC,MAAM;QACnC,qBAAqB;KACtB,CAAC;AACJ,CAAC"}

package/dist/governance/pipeline/runtime.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Governance pipeline runtime.
+ *
+ * Executes individual stages with:
+ *   - deterministic input/output fingerprinting
+ *   - bounded failure isolation per stage
+ *   - timing + item-count metrics
+ *   - dependency precondition checks
+ *   - replay-metadata emission
+ *
+ * The runtime is INTENTIONALLY minimal. It does not implement a generic
+ * workflow engine; it is a thin, explicit ledger for the canonical
+ * verify pipeline.
+ */
+import type { GovernanceStageId, GovernanceStageResult } from '@neurcode-ai/contracts';
+import type { GovernancePipelineContext, GovernancePipelineStage } from './types';
+export interface RunStageOptions {
+    /** Override status when the stage chose to skip itself (returns null). */
+    skipReason?: string;
+}
+/**
+ * Run a single pipeline stage. The result is appended to the context ledger
+ * automatically; callers can also read it from the return value.
+ *
+ * Dependency preconditions:
+ *   For each id in stage.boundary.dependencies, the ledger must contain a
+ *   prior entry with status === 'succeeded' or 'degraded'. Missing or failed
+ *   dependencies cause an 'aborted-precondition' failure.
+ *
+ * Failure isolation:
+ *   When stage.boundary.isolateFailure is true, exceptions are caught and the
+ *   result is recorded with status === 'failed'. Otherwise exceptions propagate
+ *   to the caller (after the result is appended to the ledger).
+ */
+export declare function runStage<TIn, TOut>(stage: GovernancePipelineStage<TIn, TOut>, input: TIn, ctx: GovernancePipelineContext, options?: RunStageOptions): Promise<GovernanceStageResult<TOut>>;
+/**
+ * Pipeline-level execution: runs a sequential array of stages and returns the
+ * accumulated ledger. Stops on the first unrecoverable failure.
+ *
+ * Most callers should use `runStage` directly inside verify.ts — this helper
+ * exists for tests, fixture replay, and future fully-staged orchestration.
+ */
+export declare function runPipeline(stages: Array<{
+    stage: GovernancePipelineStage<unknown, unknown>;
+    input: unknown;
+}>, ctx: GovernancePipelineContext): Promise<GovernanceStageResult[]>;
+/**
+ * Get the most recent result for a given stage from the ledger.
+ * Returns undefined if the stage has not run yet.
+ */
+export declare function getStageResult<T = unknown>(ctx: GovernancePipelineContext, stageId: GovernanceStageId): GovernanceStageResult<T> | undefined;
+/**
+ * Build an immutable pipeline context. Convenience factory.
+ */
+export declare function createPipelineContext(init: {
+    projectRoot: string;
+    ciMode: boolean;
+    jsonMode: boolean;
+    startedAtMs?: number;
+    runId?: string;
+}): GovernancePipelineContext;
+/**
+ * Thrown when a required stage fails. The pipeline runtime appends the failing
+ * result to the ledger BEFORE throwing, so callers can inspect via ctx.ledger.
+ */
+export declare class GovernanceStageAbortedError extends Error {
+    readonly result: GovernanceStageResult;
+    constructor(result: GovernanceStageResult);
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/governance/pipeline/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/governance/pipeline/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAGV,iBAAiB,EAGjB,qBAAqB,EAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,eAAe;IAC9B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,IAAI,EACtC,KAAK,EAAE,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,EACzC,KAAK,EAAE,GAAG,EACV,GAAG,EAAE,yBAAyB,EAC9B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAuFtC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,EACnF,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAYlC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,GAAG,OAAO,EACxC,GAAG,EAAE,yBAAyB,EAC9B,OAAO,EAAE,iBAAiB,GACzB,qBAAqB,CAAC,CAAC,CAAC,GAAG,SAAS,CAOtC;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,yBAAyB,CAS5B;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;gBAC3B,MAAM,EAAE,qBAAqB;CAO1C"}

package/dist/governance/pipeline/runtime.js

@@ -0,0 +1,223 @@
+"use strict";
+/**
+ * Governance pipeline runtime.
+ *
+ * Executes individual stages with:
+ *   - deterministic input/output fingerprinting
+ *   - bounded failure isolation per stage
+ *   - timing + item-count metrics
+ *   - dependency precondition checks
+ *   - replay-metadata emission
+ *
+ * The runtime is INTENTIONALLY minimal. It does not implement a generic
+ * workflow engine; it is a thin, explicit ledger for the canonical
+ * verify pipeline.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernanceStageAbortedError = void 0;
+exports.runStage = runStage;
+exports.runPipeline = runPipeline;
+exports.getStageResult = getStageResult;
+exports.createPipelineContext = createPipelineContext;
+/**
+ * Run a single pipeline stage. The result is appended to the context ledger
+ * automatically; callers can also read it from the return value.
+ *
+ * Dependency preconditions:
+ *   For each id in stage.boundary.dependencies, the ledger must contain a
+ *   prior entry with status === 'succeeded' or 'degraded'. Missing or failed
+ *   dependencies cause an 'aborted-precondition' failure.
+ *
+ * Failure isolation:
+ *   When stage.boundary.isolateFailure is true, exceptions are caught and the
+ *   result is recorded with status === 'failed'. Otherwise exceptions propagate
+ *   to the caller (after the result is appended to the ledger).
+ */
+async function runStage(stage, input, ctx, options = {}) {
+    const startedAtMs = Date.now();
+    const startedAt = new Date(startedAtMs).toISOString();
+    const inputFingerprint = stage.fingerprintInput?.(input);
+    const memoryBaseline = readHeapUsed();
+    // Dependency precondition check
+    const unmetDependency = findUnmetDependency(stage.boundary.dependencies, ctx);
+    if (unmetDependency) {
+        const finishedAtMs = Date.now();
+        const result = {
+            stageId: stage.id,
+            status: 'failed',
+            output: null,
+            metrics: emitMetrics(startedAtMs, finishedAtMs, memoryBaseline, input, null, stage),
+            replay: {
+                stageId: stage.id,
+                determinism: stage.determinism,
+                inputFingerprint,
+                dependsOn: [...stage.boundary.dependencies],
+                startedAt,
+                finishedAt: new Date(finishedAtMs).toISOString(),
+            },
+            failure: {
+                category: 'aborted-precondition',
+                message: `stage '${stage.id}' aborted: dependency '${unmetDependency}' did not succeed`,
+                recoverable: stage.boundary.isolateFailure,
+            },
+        };
+        ctx.ledger.push(result);
+        if (!stage.boundary.isolateFailure && stage.boundary.required) {
+            throw new GovernanceStageAbortedError(result);
+        }
+        return result;
+    }
+    // Execute
+    let output = null;
+    let status = 'succeeded';
+    let failure;
+    try {
+        const raw = await stage.execute(input, ctx);
+        if (raw === null || raw === undefined) {
+            output = null;
+            status = options.skipReason ? 'skipped' : 'degraded';
+        }
+        else {
+            output = raw;
+        }
+    }
+    catch (err) {
+        output = null;
+        status = 'failed';
+        failure = {
+            category: classifyError(err),
+            message: shortError(err),
+            recoverable: stage.boundary.isolateFailure,
+        };
+    }
+    const finishedAtMs = Date.now();
+    const outputFingerprint = output !== null ? stage.fingerprintOutput?.(output) : undefined;
+    const result = {
+        stageId: stage.id,
+        status,
+        output,
+        metrics: emitMetrics(startedAtMs, finishedAtMs, memoryBaseline, input, output, stage),
+        replay: {
+            stageId: stage.id,
+            determinism: stage.determinism,
+            inputFingerprint,
+            outputFingerprint,
+            dependsOn: [...stage.boundary.dependencies],
+            startedAt,
+            finishedAt: new Date(finishedAtMs).toISOString(),
+        },
+        failure,
+        notes: options.skipReason ? [options.skipReason] : undefined,
+    };
+    ctx.ledger.push(result);
+    if (status === 'failed' && !stage.boundary.isolateFailure) {
+        throw new GovernanceStageAbortedError(result);
+    }
+    return result;
+}
+/**
+ * Pipeline-level execution: runs a sequential array of stages and returns the
+ * accumulated ledger. Stops on the first unrecoverable failure.
+ *
+ * Most callers should use `runStage` directly inside verify.ts — this helper
+ * exists for tests, fixture replay, and future fully-staged orchestration.
+ */
+async function runPipeline(stages, ctx) {
+    for (const { stage, input } of stages) {
+        try {
+            await runStage(stage, input, ctx);
+        }
+        catch (err) {
+            if (err instanceof GovernanceStageAbortedError) {
+                break;
+            }
+            throw err;
+        }
+    }
+    return ctx.ledger;
+}
+/**
+ * Get the most recent result for a given stage from the ledger.
+ * Returns undefined if the stage has not run yet.
+ */
+function getStageResult(ctx, stageId) {
+    for (let i = ctx.ledger.length - 1; i >= 0; i--) {
+        if (ctx.ledger[i].stageId === stageId) {
+            return ctx.ledger[i];
+        }
+    }
+    return undefined;
+}
+/**
+ * Build an immutable pipeline context. Convenience factory.
+ */
+function createPipelineContext(init) {
+    return {
+        projectRoot: init.projectRoot,
+        ciMode: init.ciMode,
+        jsonMode: init.jsonMode,
+        startedAtMs: init.startedAtMs ?? Date.now(),
+        runId: init.runId,
+        ledger: [],
+    };
+}
+/**
+ * Thrown when a required stage fails. The pipeline runtime appends the failing
+ * result to the ledger BEFORE throwing, so callers can inspect via ctx.ledger.
+ */
+class GovernanceStageAbortedError extends Error {
+    result;
+    constructor(result) {
+        super(`governance stage '${result.stageId}' aborted: ${result.failure?.message ?? 'unknown failure'}`);
+        this.name = 'GovernanceStageAbortedError';
+        this.result = result;
+    }
+}
+exports.GovernanceStageAbortedError = GovernanceStageAbortedError;
+// ── Internals ────────────────────────────────────────────────────────────────
+function findUnmetDependency(deps, ctx) {
+    for (const dep of deps) {
+        const prior = getStageResult(ctx, dep);
+        if (!prior || (prior.status !== 'succeeded' && prior.status !== 'degraded')) {
+            return dep;
+        }
+    }
+    return null;
+}
+function emitMetrics(startedAtMs, finishedAtMs, memoryBaseline, input, output, stage) {
+    const memoryNow = readHeapUsed();
+    const memoryDeltaBytes = typeof memoryBaseline === 'number' && typeof memoryNow === 'number'
+        ? memoryNow - memoryBaseline
+        : undefined;
+    return {
+        durationMs: finishedAtMs - startedAtMs,
+        inputItemCount: stage.inputItemCount?.(input),
+        outputItemCount: output !== null ? stage.outputItemCount?.(output) : undefined,
+        memoryDeltaBytes,
+    };
+}
+function readHeapUsed() {
+    try {
+        return process.memoryUsage().heapUsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+function classifyError(err) {
+    const message = (err instanceof Error ? err.message : String(err)).toLowerCase();
+    if (message.includes('timeout') || message.includes('timed out'))
+        return 'timeout';
+    if (message.includes('invariant'))
+        return 'invariant-violation';
+    if (message.includes('depend'))
+        return 'degraded-dependency';
+    return 'exception';
+}
+function shortError(err) {
+    const raw = err instanceof Error ? (err.message || err.name) : String(err);
+    // Strip absolute paths and bound length so failure messages stay stable + PII-free.
+    const stripped = raw.replace(/\/Users\/[^/\s]+\//g, '/<user>/').replace(/\/home\/[^/\s]+\//g, '/<user>/');
+    return stripped.length > 240 ? stripped.slice(0, 237) + '…' : stripped;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/governance/pipeline/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/governance/pipeline/runtime.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;AAmCH,4BA4FC;AASD,kCAeC;AAMD,wCAUC;AAKD,sDAeC;AAtKD;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,QAAQ,CAC5B,KAAyC,EACzC,KAAU,EACV,GAA8B,EAC9B,UAA2B,EAAE;IAE7B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,YAAY,EAAE,CAAC;IAEtC,gCAAgC;IAChC,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,MAAM,GAAgC;YAC1C,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,WAAW,CAAC,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;YACnF,MAAM,EAAE;gBACN,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,gBAAgB;gBAChB,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC3C,SAAS;gBACT,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;aACjD;YACD,OAAO,EAAE;gBACP,QAAQ,EAAE,sBAAsB;gBAChC,OAAO,EAAE,UAAU,KAAK,CAAC,EAAE,0BAA0B,eAAe,mBAAmB;gBACvF,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;aAC3C;SACF,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC9D,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,UAAU;IACV,IAAI,MAAM,GAAgB,IAAI,CAAC;IAC/B,IAAI,MAAM,GAA0B,WAAW,CAAC;IAChD,IAAI,OAA2C,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,GAAG,QAAQ,CAAC;QAClB,OAAO,GAAG;YACR,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC;YAC5B,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;YACxB,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChC,MAAM,iBAAiB,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,MAAM,MAAM,GAAgC;QAC1C,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,MAAM;QACN,MAAM;QACN,OAAO,EAAE,WAAW,CAAC,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC;QACrF,MAAM,EAAE;YACN,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,gBAAgB;YAChB,iBAAiB;YACjB,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC3C,SAAS;YACT,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;SACjD;QACD,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC1D,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,WAAW,CAC/B,MAAmF,EACnF,GAA8B;IAE9B,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;gBAC/C,MAAM;YACR,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,GAA8B,EAC9B,OAA0B;IAE1B,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACtC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAA6B,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CAAC,IAMrC;IACC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;QAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,EAAE;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAa,2BAA4B,SAAQ,KAAK;IAC3C,MAAM,CAAwB;IACvC,YAAY,MAA6B;QACvC,KAAK,CACH,qBAAqB,MAAM,CAAC,OAAO,cAAc,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,CAChG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AATD,kEASC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAC1B,IAAkC,EAClC,GAA8B;IAE9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;YAC5E,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,WAAmB,EACnB,YAAoB,EACpB,cAAkC,EAClC,KAAU,EACV,MAAmB,EACnB,KAAyC;IAEzC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,gBAAgB,GACpB,OAAO,cAAc,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ;QACjE,CAAC,CAAC,SAAS,GAAG,cAAc;QAC5B,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,UAAU,EAAE,YAAY,GAAG,WAAW;QACtC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC;QAC7C,eAAe,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9E,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC7D,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3E,oFAAoF;IACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;IAC1G,OAAO,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AACzE,CAAC"}