@neurcode-ai/cli 0.9.38 → 0.9.40

package/dist/commands/guard.js

@@ -0,0 +1,390 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeGuardCommand = runtimeGuardCommand;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const diff_parser_1 = require("@neurcode-ai/diff-parser");
+const project_root_1 = require("../utils/project-root");
+const state_1 = require("../utils/state");
+const git_1 = require("../utils/git");
+const runtime_guard_1 = require("../utils/runtime-guard");
+const change_contract_1 = require("../utils/change-contract");
+const policy_compiler_1 = require("../utils/policy-compiler");
+let chalk;
+try {
+    chalk = require('chalk');
+}
+catch {
+    chalk = {
+        bold: (value) => value,
+        cyan: (value) => value,
+        dim: (value) => value,
+        green: (value) => value,
+        yellow: (value) => value,
+        red: (value) => value,
+    };
+}
+function normalizeRepoPath(value) {
+    return value.replace(/\\/g, '/').replace(/^\.\//, '').trim();
+}
+function emitJson(payload) {
+    console.log(JSON.stringify(payload, null, 2));
+}
+function resolveDiffText(options) {
+    if (options.staged) {
+        return (0, git_1.execGitCommand)('git diff --cached');
+    }
+    if (options.head) {
+        return (0, git_1.getDiffFromBase)('HEAD');
+    }
+    if (typeof options.base === 'string' && options.base.trim()) {
+        return (0, git_1.getDiffFromBase)(options.base.trim());
+    }
+    return (0, git_1.getDiffFromBase)('HEAD~1');
+}
+function buildStartFailurePayload(errors) {
+    return {
+        success: false,
+        message: `Runtime guard start failed: ${errors.join('; ')}`,
+        errors,
+    };
+}
+function evaluateSourceDrift(projectRoot, artifact) {
+    const violations = [];
+    if (artifact.source.changeContractPath) {
+        const contractRead = (0, change_contract_1.readChangeContract)(projectRoot, artifact.source.changeContractPath);
+        if (!contractRead.contract) {
+            violations.push({
+                code: 'RUNTIME_GUARD_CHANGE_CONTRACT_DRIFT',
+                message: contractRead.error
+                    ? `Runtime guard change contract invalid (${contractRead.error})`
+                    : `Runtime guard change contract missing (${contractRead.path})`,
+            });
+        }
+        else if (artifact.source.changeContractExpectedFilesFingerprint &&
+            contractRead.contract.expectedFilesFingerprint !== artifact.source.changeContractExpectedFilesFingerprint) {
+            violations.push({
+                code: 'RUNTIME_GUARD_CHANGE_CONTRACT_DRIFT',
+                message: `Runtime guard change contract drift detected (expected files fingerprint changed: ` +
+                    `${artifact.source.changeContractExpectedFilesFingerprint} -> ${contractRead.contract.expectedFilesFingerprint})`,
+            });
+        }
+    }
+    if (artifact.source.compiledPolicyPath) {
+        const compiledRead = (0, policy_compiler_1.readCompiledPolicyArtifact)(projectRoot, artifact.source.compiledPolicyPath);
+        if (!compiledRead.artifact) {
+            violations.push({
+                code: 'RUNTIME_GUARD_COMPILED_POLICY_DRIFT',
+                message: compiledRead.error
+                    ? `Runtime guard compiled policy invalid (${compiledRead.error})`
+                    : `Runtime guard compiled policy missing (${compiledRead.path})`,
+            });
+        }
+        else if (artifact.source.compiledPolicyFingerprint &&
+            compiledRead.artifact.fingerprint !== artifact.source.compiledPolicyFingerprint) {
+            violations.push({
+                code: 'RUNTIME_GUARD_COMPILED_POLICY_DRIFT',
+                message: `Runtime guard compiled policy drift detected (fingerprint changed: ` +
+                    `${artifact.source.compiledPolicyFingerprint} -> ${compiledRead.artifact.fingerprint})`,
+            });
+        }
+    }
+    return violations;
+}
+function printStatus(path, artifact) {
+    console.log(chalk.bold.cyan('\n🧱 Runtime Guard Status\n'));
+    console.log(chalk.dim(`Path: ${path}`));
+    console.log(chalk.dim(`Guard ID: ${artifact.guardId}`));
+    console.log(chalk.dim(`Mode: ${artifact.mode}`));
+    console.log(chalk.dim(`Active: ${artifact.active ? 'yes' : 'no'}`));
+    console.log(chalk.dim(`Created: ${artifact.createdAt}`));
+    if (artifact.archivedAt) {
+        console.log(chalk.dim(`Archived: ${artifact.archivedAt}`));
+    }
+    console.log(chalk.dim(`Plan ID: ${artifact.source.planId || '(none)'}`));
+    console.log(chalk.dim(`Expected files: ${artifact.expectedFiles.length}`));
+    console.log(chalk.dim(`Deterministic rules: ${artifact.deterministic.ruleCount}`));
+    console.log(chalk.dim(`Unmatched statements: ${artifact.deterministic.unmatchedStatements.length}`));
+    console.log(chalk.dim(`Checks run: ${artifact.stats.checksRun} (blocked ${artifact.stats.blockedChecks})`));
+    if (artifact.stats.lastCheckedAt) {
+        console.log(chalk.dim(`Last check: ${artifact.stats.lastCheckedAt}`));
+    }
+    console.log('');
+}
+function runtimeGuardCommand(program) {
+    const guard = program
+        .command('guard')
+        .description('Pre-generation runtime guardrail enforcement for deterministic governance');
+    guard
+        .command('start')
+        .description('Start runtime guard session from deterministic artifacts')
+        .option('--plan-id <id>', 'Plan ID override for runtime guard scope')
+        .option('--runtime-guard <path>', 'Runtime guard artifact path (default: .neurcode/runtime-guard.json)')
+        .option('--change-contract <path>', 'Change contract path (default: .neurcode/change-contract.json)')
+        .option('--compiled-policy <path>', 'Compiled policy path (default: neurcode.policy.compiled.json)')
+        .option('--strict', 'Require change contract + compiled policy artifacts (default)', true)
+        .option('--no-strict', 'Allow advisory runtime guard start without full deterministic artifacts')
+        .option('--json', 'Output machine-readable JSON')
+        .action((options) => {
+        const projectRoot = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const strict = options.strict !== false;
+        const changeContractRead = (0, change_contract_1.readChangeContract)(projectRoot, options.changeContract);
+        const compiledPolicyRead = (0, policy_compiler_1.readCompiledPolicyArtifact)(projectRoot, options.compiledPolicy);
+        const planId = (typeof options.planId === 'string' && options.planId.trim() ? options.planId.trim() : null)
+            || changeContractRead.contract?.planId
+            || (0, state_1.getActivePlanId)();
+        const errors = [];
+        if (strict && !changeContractRead.contract) {
+            errors.push(changeContractRead.error
+                ? `change contract invalid (${changeContractRead.error})`
+                : `change contract missing (${changeContractRead.path})`);
+        }
+        if (strict && !compiledPolicyRead.artifact) {
+            errors.push(compiledPolicyRead.error
+                ? `compiled policy invalid (${compiledPolicyRead.error})`
+                : `compiled policy missing (${compiledPolicyRead.path})`);
+        }
+        if (planId &&
+            changeContractRead.contract?.planId &&
+            planId !== changeContractRead.contract.planId) {
+            errors.push(`plan mismatch: requested ${planId}, change contract is ${changeContractRead.contract.planId}`);
+        }
+        const expectedFiles = changeContractRead.contract?.expectedFiles || [];
+        if (strict && expectedFiles.length === 0) {
+            errors.push('change contract has empty expected file scope');
+        }
+        if (strict && !planId) {
+            errors.push('planId missing (pass --plan-id or generate/import a plan contract first)');
+        }
+        if (errors.length > 0) {
+            if (options.json) {
+                emitJson(buildStartFailurePayload(errors));
+            }
+            else {
+                console.error(chalk.red('\n❌ Runtime guard start failed\n'));
+                for (const entry of errors) {
+                    console.error(chalk.red(`• ${entry}`));
+                }
+                console.error('');
+            }
+            process.exit(1);
+        }
+        const deterministicRules = compiledPolicyRead.artifact
+            ? (0, policy_compiler_1.hydrateCompiledPolicyRules)(compiledPolicyRead.artifact)
+            : [];
+        const artifact = (0, runtime_guard_1.createRuntimeGuardArtifact)({
+            mode: strict ? 'strict' : 'advisory',
+            planId,
+            sessionId: (0, state_1.getSessionId)(),
+            projectId: (0, state_1.getProjectId)(),
+            changeContractPath: changeContractRead.contract ? changeContractRead.path : null,
+            changeContractId: changeContractRead.contract?.contractId || null,
+            changeContractExpectedFilesFingerprint: changeContractRead.contract?.expectedFilesFingerprint || null,
+            compiledPolicyPath: compiledPolicyRead.artifact ? compiledPolicyRead.path : null,
+            compiledPolicyFingerprint: compiledPolicyRead.artifact?.fingerprint || null,
+            expectedFiles,
+            deterministicRules,
+            unmatchedStatements: compiledPolicyRead.artifact?.compilation.unmatchedStatements || [],
+        });
+        const writtenPath = (0, runtime_guard_1.writeRuntimeGuardArtifact)(projectRoot, artifact, options.runtimeGuard);
+        if (options.json) {
+            emitJson({
+                success: true,
+                message: 'Runtime guard started.',
+                path: writtenPath,
+                guard: {
+                    guardId: artifact.guardId,
+                    mode: artifact.mode,
+                    active: artifact.active,
+                    planId: artifact.source.planId,
+                    expectedFiles: artifact.expectedFiles.length,
+                    deterministicRules: artifact.deterministic.ruleCount,
+                    unmatchedStatements: artifact.deterministic.unmatchedStatements.length,
+                },
+            });
+            return;
+        }
+        console.log(chalk.bold.cyan('\n🧱 Runtime Guard Started\n'));
+        console.log(chalk.green(`Path: ${writtenPath}`));
+        console.log(chalk.dim(`Guard ID: ${artifact.guardId}`));
+        console.log(chalk.dim(`Mode: ${artifact.mode}`));
+        console.log(chalk.dim(`Plan ID: ${artifact.source.planId || '(none)'}`));
+        console.log(chalk.dim(`Expected files: ${artifact.expectedFiles.length}`));
+        console.log(chalk.dim(`Deterministic rules: ${artifact.deterministic.ruleCount}`));
+        if (artifact.deterministic.unmatchedStatements.length > 0) {
+            console.log(chalk.yellow(`Unmatched deterministic statements: ${artifact.deterministic.unmatchedStatements.length}`));
+        }
+        console.log(chalk.dim('\nRun `neurcode guard check --staged` before commit to enforce runtime scope.\n'));
+    });
+    guard
+        .command('check')
+        .description('Check current diff against active runtime guard session')
+        .option('--runtime-guard <path>', 'Runtime guard artifact path (default: .neurcode/runtime-guard.json)')
+        .option('--staged', 'Check staged changes only')
+        .option('--head', 'Check working tree against HEAD')
+        .option('--base <ref>', 'Check working tree against specific git ref')
+        .option('--json', 'Output machine-readable JSON')
+        .action((options) => {
+        const projectRoot = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const guardRead = (0, runtime_guard_1.readRuntimeGuardArtifact)(projectRoot, options.runtimeGuard);
+        if (!guardRead.artifact) {
+            const message = guardRead.error
+                ? `Runtime guard invalid (${guardRead.error})`
+                : `Runtime guard not found (${guardRead.path})`;
+            if (options.json) {
+                emitJson({
+                    success: false,
+                    message,
+                    path: guardRead.path,
+                });
+            }
+            else {
+                console.error(chalk.red(`\n❌ ${message}\n`));
+            }
+            process.exit(1);
+        }
+        const diffText = resolveDiffText(options);
+        const parsed = (0, diff_parser_1.parseDiff)(diffText);
+        const filtered = parsed.map((file) => ({
+            ...file,
+            path: normalizeRepoPath(file.path),
+        }));
+        const fileContents = {};
+        for (const file of filtered) {
+            const absolutePath = (0, path_1.resolve)(projectRoot, file.path);
+            if ((0, fs_1.existsSync)(absolutePath)) {
+                try {
+                    fileContents[file.path] = (0, fs_1.readFileSync)(absolutePath, 'utf-8');
+                }
+                catch {
+                    // Best-effort file content loading.
+                }
+            }
+        }
+        const baseEvaluation = (0, runtime_guard_1.evaluateRuntimeGuardArtifact)(guardRead.artifact, filtered, fileContents);
+        const sourceDriftViolations = evaluateSourceDrift(projectRoot, guardRead.artifact);
+        const violations = [...baseEvaluation.violations, ...sourceDriftViolations];
+        const pass = violations.length === 0;
+        const updatedArtifact = (0, runtime_guard_1.withRuntimeGuardCheckStats)(guardRead.artifact, {
+            blocked: !pass,
+        });
+        (0, runtime_guard_1.writeRuntimeGuardArtifact)(projectRoot, updatedArtifact, options.runtimeGuard);
+        if (options.json) {
+            emitJson({
+                success: pass,
+                pass,
+                guardId: updatedArtifact.guardId,
+                mode: updatedArtifact.mode,
+                path: guardRead.path,
+                changedFiles: baseEvaluation.changedFiles,
+                outOfScopeFiles: baseEvaluation.outOfScopeFiles,
+                constraintViolations: baseEvaluation.constraintViolations,
+                violations,
+                adherenceScore: baseEvaluation.adherenceScore,
+                plannedFilesModified: baseEvaluation.plannedFilesModified,
+                totalPlannedFiles: baseEvaluation.totalPlannedFiles,
+                stats: updatedArtifact.stats,
+                message: pass
+                    ? 'Runtime guard check passed.'
+                    : `Runtime guard blocked ${violations.length} violation(s).`,
+            });
+        }
+        else if (pass) {
+            console.log(chalk.bold.cyan('\n🧱 Runtime Guard Check\n'));
+            console.log(chalk.green('✅ Pass'));
+            console.log(chalk.dim(`Changed files: ${baseEvaluation.changedFiles.length}`));
+            console.log(chalk.dim(`Scope adherence: ${baseEvaluation.adherenceScore}%`));
+            console.log('');
+        }
+        else {
+            console.log(chalk.bold.cyan('\n🧱 Runtime Guard Check\n'));
+            console.log(chalk.red(`⛔ Blocked (${violations.length} violation(s))`));
+            for (const violation of violations) {
+                const prefix = violation.file ? `${violation.file}: ` : '';
+                console.log(chalk.red(`• [${violation.code}] ${prefix}${violation.message}`));
+            }
+            console.log('');
+        }
+        process.exit(pass ? 0 : 1);
+    });
+    guard
+        .command('status')
+        .description('Show runtime guard session status')
+        .option('--runtime-guard <path>', 'Runtime guard artifact path (default: .neurcode/runtime-guard.json)')
+        .option('--json', 'Output machine-readable JSON')
+        .action((options) => {
+        const projectRoot = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const guardRead = (0, runtime_guard_1.readRuntimeGuardArtifact)(projectRoot, options.runtimeGuard);
+        if (!guardRead.artifact) {
+            const message = guardRead.error
+                ? `Runtime guard invalid (${guardRead.error})`
+                : `Runtime guard not found (${guardRead.path})`;
+            if (options.json) {
+                emitJson({
+                    success: false,
+                    path: guardRead.path,
+                    message,
+                });
+            }
+            else {
+                console.error(chalk.red(`\n❌ ${message}\n`));
+            }
+            process.exit(1);
+        }
+        if (options.json) {
+            emitJson({
+                success: true,
+                path: guardRead.path,
+                guard: guardRead.artifact,
+            });
+            return;
+        }
+        printStatus(guardRead.path, guardRead.artifact);
+    });
+    guard
+        .command('stop')
+        .description('Stop the active runtime guard session')
+        .option('--runtime-guard <path>', 'Runtime guard artifact path (default: .neurcode/runtime-guard.json)')
+        .option('--json', 'Output machine-readable JSON')
+        .action((options) => {
+        const projectRoot = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const guardRead = (0, runtime_guard_1.readRuntimeGuardArtifact)(projectRoot, options.runtimeGuard);
+        if (!guardRead.artifact) {
+            const message = guardRead.error
+                ? `Runtime guard invalid (${guardRead.error})`
+                : `Runtime guard not found (${guardRead.path})`;
+            if (options.json) {
+                emitJson({
+                    success: false,
+                    path: guardRead.path,
+                    message,
+                });
+            }
+            else {
+                console.error(chalk.red(`\n❌ ${message}\n`));
+            }
+            process.exit(1);
+        }
+        const stopped = (0, runtime_guard_1.markRuntimeGuardStopped)(guardRead.artifact);
+        const writtenPath = (0, runtime_guard_1.writeRuntimeGuardArtifact)(projectRoot, stopped, options.runtimeGuard);
+        if (options.json) {
+            emitJson({
+                success: true,
+                path: writtenPath,
+                guardId: stopped.guardId,
+                active: stopped.active,
+                archivedAt: stopped.archivedAt,
+                message: 'Runtime guard stopped.',
+            });
+            return;
+        }
+        console.log(chalk.bold.cyan('\n🧱 Runtime Guard Stopped\n'));
+        console.log(chalk.green(`Path: ${writtenPath}`));
+        console.log(chalk.dim(`Guard ID: ${stopped.guardId}`));
+        if (stopped.archivedAt) {
+            console.log(chalk.dim(`Archived at: ${stopped.archivedAt}`));
+        }
+        console.log('');
+    });
+}
+//# sourceMappingURL=guard.js.map

package/dist/commands/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../src/commands/guard.ts"],"names":[],"mappings":";;AAmKA,kDA8SC;AAhdD,2BAA8C;AAC9C,+BAA+B;AAC/B,0DAAqD;AACrD,wDAAmE;AACnE,0CAAkG;AAClG,sCAA+D;AAC/D,0DASgC;AAChC,8DAA8D;AAC9D,8DAAkG;AAElG,IAAI,KAAU,CAAC;AACf,IAAI,CAAC;IACH,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAAC,MAAM,CAAC;IACP,KAAK,GAAG;QACN,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK;QAC9B,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK;QAC9B,GAAG,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK;QAC7B,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK;QAC/B,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK;QAChC,GAAG,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK;KAC9B,CAAC;AACJ,CAAC;AA6BD,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgC;IAChD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,OAA0B;IACjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,IAAA,oBAAc,EAAC,mBAAmB,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,IAAA,qBAAe,EAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5D,OAAO,IAAA,qBAAe,EAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAA,qBAAe,EAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAgB;IAChD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO,EAAE,+BAA+B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC3D,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,QAA8B;IAC9E,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,IAAA,oCAAkB,EAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACzF,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,OAAO,EAAE,YAAY,CAAC,KAAK;oBACzB,CAAC,CAAC,0CAA0C,YAAY,CAAC,KAAK,GAAG;oBACjE,CAAC,CAAC,0CAA0C,YAAY,CAAC,IAAI,GAAG;aACnE,CAAC,CAAC;QACL,CAAC;aAAM,IACL,QAAQ,CAAC,MAAM,CAAC,sCAAsC;YACtD,YAAY,CAAC,QAAQ,CAAC,wBAAwB,KAAK,QAAQ,CAAC,MAAM,CAAC,sCAAsC,EACzG,CAAC;YACD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,OAAO,EACL,oFAAoF;oBACpF,GAAG,QAAQ,CAAC,MAAM,CAAC,sCAAsC,OAAO,YAAY,CAAC,QAAQ,CAAC,wBAAwB,GAAG;aACpH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,IAAA,4CAA0B,EAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACjG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,OAAO,EAAE,YAAY,CAAC,KAAK;oBACzB,CAAC,CAAC,0CAA0C,YAAY,CAAC,KAAK,GAAG;oBACjE,CAAC,CAAC,0CAA0C,YAAY,CAAC,IAAI,GAAG;aACnE,CAAC,CAAC;QACL,CAAC;aAAM,IACL,QAAQ,CAAC,MAAM,CAAC,yBAAyB;YACzC,YAAY,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,yBAAyB,EAC/E,CAAC;YACD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,qCAAqC;gBAC3C,OAAO,EACL,qEAAqE;oBACrE,GAAG,QAAQ,CAAC,MAAM,CAAC,yBAAyB,OAAO,YAAY,CAAC,QAAQ,CAAC,WAAW,GAAG;aAC1F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAA8B;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,eAAe,QAAQ,CAAC,KAAK,CAAC,SAAS,aAAa,QAAQ,CAAC,KAAK,CAAC,aAAa,GAAG,CACpF,CACF,CAAC;IACF,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,2EAA2E,CAAC,CAAC;IAE5F,KAAK;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,gBAAgB,EAAE,0CAA0C,CAAC;SACpE,MAAM,CAAC,wBAAwB,EAAE,qEAAqE,CAAC;SACvG,MAAM,CAAC,0BAA0B,EAAE,gEAAgE,CAAC;SACpG,MAAM,CAAC,0BAA0B,EAAE,+DAA+D,CAAC;SACnG,MAAM,CAAC,UAAU,EAAE,+DAA+D,EAAE,IAAI,CAAC;SACzF,MAAM,CAAC,aAAa,EAAE,yEAAyE,CAAC;SAChG,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;SAChD,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,IAAA,yCAA0B,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;QACxC,MAAM,kBAAkB,GAAG,IAAA,oCAAkB,EAAC,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QACnF,MAAM,kBAAkB,GAAG,IAAA,4CAA0B,EAAC,WAAW,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3F,MAAM,MAAM,GACV,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;eACzF,kBAAkB,CAAC,QAAQ,EAAE,MAAM;eACnC,IAAA,uBAAe,GAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,KAAK;gBACtB,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,GAAG;gBACzD,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,IAAI,GAAG,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CACT,kBAAkB,CAAC,KAAK;gBACtB,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,GAAG;gBACzD,CAAC,CAAC,4BAA4B,kBAAkB,CAAC,IAAI,GAAG,CAC3D,CAAC;QACJ,CAAC;QACD,IACE,MAAM;YACN,kBAAkB,CAAC,QAAQ,EAAE,MAAM;YACnC,MAAM,KAAK,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAC7C,CAAC;YACD,MAAM,CAAC,IAAI,CACT,4BAA4B,MAAM,wBAAwB,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAC/F,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,EAAE,aAAa,IAAI,EAAE,CAAC;QACvE,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,QAAQ,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,QAAQ;YACpD,CAAC,CAAC,IAAA,4CAA0B,EAAC,kBAAkB,CAAC,QAAQ,CAAC;YACzD,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,QAAQ,GAAG,IAAA,0CAA0B,EAAC;YAC1C,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;YACpC,MAAM;YACN,SAAS,EAAE,IAAA,oBAAY,GAAE;YACzB,SAAS,EAAE,IAAA,oBAAiB,GAAE;YAC9B,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAChF,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,EAAE,UAAU,IAAI,IAAI;YACjE,sCAAsC,EAAE,kBAAkB,CAAC,QAAQ,EAAE,wBAAwB,IAAI,IAAI;YACrG,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YAChF,yBAAyB,EAAE,kBAAkB,CAAC,QAAQ,EAAE,WAAW,IAAI,IAAI;YAC3E,aAAa;YACb,kBAAkB;YAClB,mBAAmB,EAAE,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,mBAAmB,IAAI,EAAE;SACxF,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,IAAA,yCAAyB,EAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAE3F,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,wBAAwB;gBACjC,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE;oBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM;oBAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,MAAM;oBAC5C,kBAAkB,EAAE,QAAQ,CAAC,aAAa,CAAC,SAAS;oBACpD,mBAAmB,EAAE,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,MAAM;iBACvE;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CACV,uCAAuC,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAC3F,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,wBAAwB,EAAE,qEAAqE,CAAC;SACvG,MAAM,CAAC,UAAU,EAAE,2BAA2B,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC;SACnD,MAAM,CAAC,cAAc,EAAE,6CAA6C,CAAC;SACrE,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;SAChD,MAAM,CAAC,CAAC,OAA0B,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,IAAA,yCAA0B,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAA,wCAAwB,EAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK;gBAC7B,CAAC,CAAC,0BAA0B,SAAS,CAAC,KAAK,GAAG;gBAC9C,CAAC,CAAC,4BAA4B,SAAS,CAAC,IAAI,GAAG,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,OAAO;oBACP,IAAI,EAAE,SAAS,CAAC,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAA,uBAAS,EAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrC,GAAG,IAAI;YACP,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;SACnC,CAAC,CAAC,CAAC;QACJ,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC;oBACH,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAChE,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,IAAA,4CAA4B,EAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAChG,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnF,MAAM,UAAU,GAAG,CAAC,GAAG,cAAc,CAAC,UAAU,EAAE,GAAG,qBAAqB,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;QAErC,MAAM,eAAe,GAAG,IAAA,0CAA0B,EAAC,SAAS,CAAC,QAAQ,EAAE;YACrE,OAAO,EAAE,CAAC,IAAI;SACf,CAAC,CAAC;QACH,IAAA,yCAAyB,EAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAE9E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,OAAO,EAAE,eAAe,CAAC,OAAO;gBAChC,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,eAAe,EAAE,cAAc,CAAC,eAAe;gBAC/C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;gBACzD,UAAU;gBACV,cAAc,EAAE,cAAc,CAAC,cAAc;gBAC7C,oBAAoB,EAAE,cAAc,CAAC,oBAAoB;gBACzD,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;gBACnD,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,OAAO,EAAE,IAAI;oBACX,CAAC,CAAC,6BAA6B;oBAC/B,CAAC,CAAC,yBAAyB,UAAU,CAAC,MAAM,gBAAgB;aAC/D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,cAAc,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,UAAU,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC;YACxE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,wBAAwB,EAAE,qEAAqE,CAAC;SACvG,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;SAChD,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,MAAM,WAAW,GAAG,IAAA,yCAA0B,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAA,wCAAwB,EAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK;gBAC7B,CAAC,CAAC,0BAA0B,SAAS,CAAC,KAAK,GAAG;gBAC9C,CAAC,CAAC,4BAA4B,SAAS,CAAC,IAAI,GAAG,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,KAAK,EAAE,SAAS,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,wBAAwB,EAAE,qEAAqE,CAAC;SACvG,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;SAChD,MAAM,CAAC,CAAC,OAAyB,EAAE,EAAE;QACpC,MAAM,WAAW,GAAG,IAAA,yCAA0B,EAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAA,wCAAwB,EAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK;gBAC7B,CAAC,CAAC,0BAA0B,SAAS,CAAC,KAAK,GAAG;gBAC9C,CAAC,CAAC,4BAA4B,SAAS,CAAC,IAAI,GAAG,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,QAAQ,CAAC;oBACP,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAA,uCAAuB,EAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,IAAA,yCAAyB,EAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,QAAQ,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,wBAAwB;aAClC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0KpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAknDpD"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/commands/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsLpC,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0vDpD"}

package/dist/commands/policy.js

@@ -36,6 +36,16 @@ function toJsonPack(pack) {
         ruleCount: Array.isArray(pack.rules) ? pack.rules.length : 0,
     };
 }
+const BOOTSTRAP_INTENT_BY_PACK = {
+    fintech: 'No payment bypass, no secret literals, and no unsafe migration shortcuts.',
+    hipaa: 'No PHI leakage in logs, no auth bypass, and no plaintext sensitive data handling.',
+    soc2: 'No auth bypass, no secret literals, and no CI/workflow integrity regressions.',
+    'startup-fast': 'No secret literals, no unsafe debug backdoors, and keep changes scoped.',
+    node: 'No auth bypass, no secret literals, and no unsafe child_process shell execution.',
+    python: 'No credential leakage, no unsafe eval/exec patterns, and protect dependency boundaries.',
+    java: 'No auth bypass, no credential literals, and no insecure security-configuration drift.',
+    frontend: 'No client-side secret leakage, no unsafe DOM injection, and no auth-route bypass.',
+};
 function loadPolicyRuntimeConfig() {
     const config = (0, config_1.loadConfig)();
     if (process.env.NEURCODE_API_KEY) {
@@ -108,7 +118,7 @@ async function resolveCustomPolicies(client, includeDashboardPolicies, requireDa
 function policyCommand(program) {
     const policy = program
         .command('policy')
-        .description('Install and manage enterprise policy packs (fintech, hipaa, soc2, startup-fast)');
+        .description('Install and manage enterprise policy packs (fintech, hipaa, soc2, startup-fast, node, python, java, frontend)');
     policy
         .command('list')
         .description('List available policy packs')
@@ -204,6 +214,101 @@ function policyCommand(program) {
             process.exit(1);
         }
     });
+    policy
+        .command('bootstrap')
+        .description('Install a stack policy pack and generate lock + compiled artifact in one deterministic step')
+        .argument('<pack-id>', 'Policy pack ID')
+        .option('--force', 'Replace any existing installed policy pack')
+        .option('--intent <text>', 'Optional deterministic intent constraints for compilation')
+        .option('--include-dashboard', 'Include dashboard custom policies in lock + compile')
+        .option('--require-dashboard', 'Fail if dashboard custom policies cannot be loaded')
+        .option('--require-deterministic-match', 'Fail if any intent statement cannot be compiled into deterministic enforcement rules')
+        .option('--output <path>', 'Output file path (default: neurcode.policy.compiled.json)')
+        .option('--json', 'Output as JSON')
+        .action(async (packId, options) => {
+        const cwd = (0, project_root_1.resolveNeurcodeProjectRoot)(process.cwd());
+        const config = loadPolicyRuntimeConfig();
+        const client = new api_client_1.ApiClient(config);
+        try {
+            const installed = (0, policy_packs_1.installPolicyPack)(cwd, packId, options.force === true);
+            const includeDashboard = options.includeDashboard === true;
+            const customPolicyResolution = await resolveCustomPolicies(client, includeDashboard, options.requireDashboard === true);
+            const customRules = customPolicyResolution.includeDashboardPolicies
+                ? (0, custom_policy_rules_1.mapActiveCustomPoliciesToRules)(customPolicyResolution.customPolicies)
+                : [];
+            const snapshot = (0, policy_packs_1.buildPolicyStateSnapshot)({
+                policyPack: (0, policy_packs_1.getInstalledPolicyPackRules)(cwd),
+                policyPackRules: installed.rules,
+                customPolicies: customPolicyResolution.customPolicies,
+                customRules,
+                includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
+            });
+            const lockPath = (0, policy_packs_1.writePolicyLockFile)(cwd, snapshot);
+            const resolvedIntent = (options.intent && options.intent.trim())
+                || BOOTSTRAP_INTENT_BY_PACK[installed.packId]
+                || '';
+            const compiledUnsigned = (0, policy_compiler_1.buildCompiledPolicyArtifact)({
+                includeDashboardPolicies: customPolicyResolution.includeDashboardPolicies,
+                policyLockPath: (0, policy_packs_1.getPolicyLockPath)(cwd),
+                policyLockFingerprint: snapshot.effective.fingerprint,
+                policyPack: {
+                    id: installed.packId,
+                    name: installed.packName,
+                    version: installed.version,
+                },
+                defaultRuleCount: snapshot.defaultRules.count,
+                policyPackRuleCount: installed.rules.length,
+                customRuleCount: customRules.length,
+                effectiveRuleCount: snapshot.effective.ruleCount,
+                intentConstraints: resolvedIntent,
+                policyRules: customPolicyResolution.customPolicies.map((policy) => policy.rule_text),
+            });
+            const artifactSigningConfig = (0, artifact_signature_1.resolveGovernanceArtifactSigningConfigFromEnv)();
+            const compiled = (0, artifact_signature_1.signGovernanceArtifact)(compiledUnsigned, artifactSigningConfig);
+            if (options.requireDeterministicMatch === true
+                && compiled.compilation.unmatchedStatements.length > 0) {
+                throw new Error(`Deterministic policy compilation blocked: ${compiled.compilation.unmatchedStatements.length} intent statement(s) could not be converted into enforceable rules.`);
+            }
+            const artifactPath = (0, policy_compiler_1.writeCompiledPolicyArtifact)(cwd, compiled, options.output);
+            if (options.json) {
+                console.log(JSON.stringify({
+                    bootstrap: {
+                        packId: installed.packId,
+                        packName: installed.packName,
+                        version: installed.version,
+                        lockPath,
+                        compiledPolicyPath: artifactPath,
+                        dashboardMode: compiled.source.includeDashboardPolicies ? 'dashboard' : 'disabled',
+                        deterministicRuleCount: compiled.compilation.deterministicRuleCount,
+                        unmatchedStatements: compiled.compilation.unmatchedStatements,
+                        effectiveRuleCount: snapshot.effective.ruleCount,
+                    },
+                    warning: customPolicyResolution.dashboardWarning || null,
+                }, null, 2));
+                return;
+            }
+            console.log(chalk.green('\n✅ Policy bootstrap complete\n'));
+            console.log(chalk.cyan(`Pack: ${installed.packName}`) + chalk.dim(` (${installed.packId}@${installed.version})`));
+            console.log(chalk.dim(`Lock baseline: ${lockPath}`));
+            console.log(chalk.dim(`Compiled artifact: ${artifactPath}`));
+            console.log(chalk.dim(`Effective rules: ${snapshot.effective.ruleCount}`));
+            console.log(chalk.dim(`Deterministic compiled rules: ${compiled.compilation.deterministicRuleCount}`));
+            console.log(chalk.dim(`Unmatched intent statements: ${compiled.compilation.unmatchedStatements.length}`));
+            if (customPolicyResolution.dashboardWarning) {
+                console.log(chalk.yellow(`\n⚠️  ${customPolicyResolution.dashboardWarning}`));
+            }
+            console.log(chalk.dim('\nNext: run `neurcode verify --record --compiled-policy neurcode.policy.compiled.json --enforce-change-contract --strict-artifacts`.\n'));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            if (options.json) {
+                console.log(JSON.stringify({ error: message }, null, 2));
+                process.exit(1);
+            }
+            console.error(chalk.red(`\n❌ ${message}\n`));
+            process.exit(1);
+        }
+    });
     policy
         .command('uninstall')
         .description('Remove the installed policy pack from this repository')