@open-everywhere/core 0.1.0

package/dist/agent/review/blast-radius.js

@@ -0,0 +1,224 @@
+// BLAST RADIUS — the pure reading that turns OPE-255's row-level config facts into the three
+// questions a merging human actually has: does anything get WIDER, does any room join a domain
+// that could already reach things, and does the agent get a new STANDING INSTRUCTION.
+//
+// EVERYTHING HERE IS DERIVED FROM THE FACTS DOCUMENT AND NOTHING ELSE. No model output reaches
+// this module, and it has no network, no filesystem and no clock — so every claim it makes is
+// reproducible from the artifact by hand. That is the property that lets the walkthrough render
+// this half as FACT and the narration as opinion (review/pr-walkthrough.ts).
+//
+// ⭐ WHY `widens` IS DEFINED NARROWLY. It is true iff a bound scope GAINED an access item, or a
+// domain's roster GAINED a member. It is deliberately NOT true for a standing-prompt change: a new
+// webhook `instruction` is arguably the most consequential thing in a config diff
+// (approvals/webhook-declare.ts's header: an unattended instruction that runs with a named
+// channel's full grants, forever, on anyone's POST) but it widens no ACCESS — it changes what the
+// agent will DO with access it already had. Folding the two into one boolean would make `widens`
+// mean "something worrying happened", which is not a fact, and a reviewer who learned that
+// `widens: false` still sometimes means "a standing prompt landed" would stop trusting the flag.
+// So they are separate fields and the renderer shows both.
+//
+// 🔴 EVERY LIST HERE IS CAPPED, AND EVERY CAP IS REPORTED. A silently-clipped widening list is a
+// green produced by blindness with extra steps.
+import { ACCESS_KEY_SEP, decodeSet } from "./config-facts.js";
+/** Max items carried per list before the reading reports truncation instead of listing more. */
+export const MAX_BLAST_ITEMS = 60;
+/** True when a value is the producer's digest form for an over-long string. */
+export function isDigestValue(value) {
+    return /^<\d+ chars, sha256:[0-9a-f]+>$/.test(value);
+}
+/**
+ * Is this row a STANDING INSTRUCTION — text the agent will be handed as trusted instruction on
+ * some future turn nobody is watching?
+ *
+ * Matched by key SHAPE rather than by an enumerated list of config fields, deliberately: the
+ * producer flattens config generically (`flattenEntity`) precisely so a field added tomorrow is
+ * covered the day it lands, and an enumerated list here would re-introduce the blind spot on the
+ * consumer side. The shapes are `…instruction` / `…instructions` (a webhook's standing prompt, a
+ * bundle's or role's instructions) and the resolver's own `instructionStack` facet.
+ */
+export function isStandingPromptKey(key) {
+    return /(?:^|[.\]\s])instructions?$/.test(key) || key.includes("instructionStack");
+}
+/** The scope half of an `access` row key (`<scope> · <facet>`), and the facet half. */
+function splitAccessKey(key) {
+    const i = key.indexOf(ACCESS_KEY_SEP);
+    if (i < 0)
+        return { scope: key, facet: "(unkeyed)" };
+    return { scope: key.slice(0, i), facet: key.slice(i + ACCESS_KEY_SEP.length) };
+}
+function sectionByName(facts, name) {
+    return facts.sections.find((s) => s.section === name);
+}
+/**
+ * Compute the blast radius. Total over the facts document: a section that is missing, or that the
+ * producer could not compare, contributes a `notComputable` row rather than an empty delta.
+ */
+export function computeBlastRadius(facts) {
+    const truncated = [];
+    const notComputable = facts.sections
+        .filter((s) => s.kind === "not-computable")
+        .map((s) => ({ section: s.section, reason: s.reason }));
+    // ── access, per scope ────────────────────────────────────────────────────────────────────
+    const scopes = new Map();
+    const bucket = (scope) => {
+        let b = scopes.get(scope);
+        if (!b) {
+            b = { gained: [], lost: [], opaque: [], addedRows: 0, removedRows: 0, changedRows: 0 };
+            scopes.set(scope, b);
+        }
+        return b;
+    };
+    const access = sectionByName(facts, "access");
+    if (access?.kind === "computed") {
+        for (const r of access.added) {
+            const { scope, facet } = splitAccessKey(r.key);
+            const b = bucket(scope);
+            b.addedRows++;
+            const members = decodeSet(r.value);
+            if (members === undefined)
+                b.opaque.push({ key: r.key, before: "(absent)", after: r.value });
+            else
+                for (const m of members)
+                    b.gained.push({ facet, item: m });
+        }
+        for (const r of access.removed) {
+            const { scope, facet } = splitAccessKey(r.key);
+            const b = bucket(scope);
+            b.removedRows++;
+            const members = decodeSet(r.value);
+            if (members === undefined)
+                b.opaque.push({ key: r.key, before: r.value, after: "(absent)" });
+            else
+                for (const m of members)
+                    b.lost.push({ facet, item: m });
+        }
+        for (const c of access.changed) {
+            const { scope, facet } = splitAccessKey(c.key);
+            const b = bucket(scope);
+            b.changedRows++;
+            const before = decodeSet(c.before);
+            const after = decodeSet(c.after);
+            if (before === undefined || after === undefined) {
+                b.opaque.push({ key: c.key, before: c.before, after: c.after });
+                continue;
+            }
+            for (const m of after.filter((x) => !before.includes(x)))
+                b.gained.push({ facet, item: m });
+            for (const m of before.filter((x) => !after.includes(x)))
+                b.lost.push({ facet, item: m });
+        }
+    }
+    const scopeDeltas = [...scopes.entries()]
+        .sort((a, b) => a[0].localeCompare(b[0]))
+        .map(([scope, b]) => ({
+        scope,
+        gained: cap(b.gained, `access gains for ${scope}`, truncated),
+        lost: cap(b.lost, `access losses for ${scope}`, truncated),
+        opaque: cap(b.opaque, `undecomposable access rows for ${scope}`, truncated),
+        // A scope every one of whose rows is ADDED had no baseline: it is newly bound. Same in
+        // reverse for a scope whose every row was removed.
+        newlyBound: b.addedRows > 0 && b.changedRows === 0 && b.removedRows === 0,
+        unbound: b.removedRows > 0 && b.changedRows === 0 && b.addedRows === 0,
+    }));
+    // ── domain rosters ───────────────────────────────────────────────────────────────────────
+    const rosterMap = new Map();
+    const rosterBucket = (domain, field) => {
+        const k = `${domain}.${field}`;
+        let b = rosterMap.get(k);
+        if (!b) {
+            b = { domain, field, gained: [], lost: [] };
+            rosterMap.set(k, b);
+        }
+        return b;
+    };
+    const domains = sectionByName(facts, "domains");
+    if (domains?.kind === "computed") {
+        const rosterField = (key) => {
+            const m = /^(.*)\.(reach|exclude)$/.exec(key);
+            return m ? { domain: m[1], field: m[2] } : undefined;
+        };
+        for (const r of domains.added) {
+            const f = rosterField(r.key);
+            if (!f)
+                continue;
+            rosterBucket(f.domain, f.field).gained.push(...(decodeSet(r.value) ?? [r.value]));
+        }
+        for (const r of domains.removed) {
+            const f = rosterField(r.key);
+            if (!f)
+                continue;
+            rosterBucket(f.domain, f.field).lost.push(...(decodeSet(r.value) ?? [r.value]));
+        }
+        for (const c of domains.changed) {
+            const f = rosterField(c.key);
+            if (!f)
+                continue;
+            const b = rosterBucket(f.domain, f.field);
+            const before = decodeSet(c.before);
+            const after = decodeSet(c.after);
+            if (before === undefined || after === undefined) {
+                // Not set-shaped: report the whole move rather than pretending to decompose it.
+                b.lost.push(c.before);
+                b.gained.push(c.after);
+                continue;
+            }
+            b.gained.push(...after.filter((x) => !before.includes(x)));
+            b.lost.push(...before.filter((x) => !after.includes(x)));
+        }
+    }
+    const rosters = [...rosterMap.values()]
+        .filter((r) => r.gained.length > 0 || r.lost.length > 0)
+        .sort((a, b) => `${a.domain}.${a.field}`.localeCompare(`${b.domain}.${b.field}`))
+        .map((r) => ({
+        domain: r.domain,
+        field: r.field,
+        gained: cap(r.gained, `roster gains for ${r.domain}.${r.field}`, truncated),
+        lost: cap(r.lost, `roster losses for ${r.domain}.${r.field}`, truncated),
+    }));
+    // ── standing prompts, across EVERY computed section ──────────────────────────────────────
+    const prompts = [];
+    for (const s of facts.sections) {
+        if (s.kind !== "computed")
+            continue;
+        for (const r of s.added) {
+            if (isStandingPromptKey(r.key))
+                prompts.push({ section: s.section, key: r.key, change: "added", value: r.value, digested: isDigestValue(r.value) });
+        }
+        for (const r of s.removed) {
+            if (isStandingPromptKey(r.key))
+                prompts.push({ section: s.section, key: r.key, change: "removed", value: r.value, digested: isDigestValue(r.value) });
+        }
+        for (const c of s.changed) {
+            if (isStandingPromptKey(c.key))
+                prompts.push({ section: s.section, key: c.key, change: "changed", value: c.after, digested: isDigestValue(c.after) });
+        }
+    }
+    prompts.sort((a, b) => `${a.section}/${a.key}`.localeCompare(`${b.section}/${b.key}`));
+    // 🔴 THE TWO LISTS WIDEN IN OPPOSITE DIRECTIONS (OPE-254). A `reach` GAIN hands a domain's
+    // bundles to more surfaces; an `exclude` gain takes them away, and an `exclude` LOSS hands them
+    // back. Reading "gained" as "widened" on both would call an added carve-out a widening and, far
+    // worse, call a DELETED carve-out no widening at all — the exact PR a reviewer needs flagged.
+    const widensReach = rosters.some((r) => r.field === "reach" && r.gained.length > 0);
+    const widensByUnexcluding = rosters.some((r) => r.field === "exclude" && r.lost.length > 0);
+    const widens = scopeDeltas.some((s) => s.gained.length > 0) || widensReach || widensByUnexcluding;
+    return {
+        widens,
+        scopes: scopeDeltas,
+        rosters,
+        standingPrompts: cap(prompts, "standing-prompt changes", truncated),
+        notComputable,
+        truncated,
+    };
+}
+/** Cap a list at {@link MAX_BLAST_ITEMS}, recording the cap by name so the render can state it. */
+function cap(items, label, into) {
+    if (items.length <= MAX_BLAST_ITEMS)
+        return items;
+    into.push(`${label} (${items.length} item(s), showing ${MAX_BLAST_ITEMS})`);
+    return items.slice(0, MAX_BLAST_ITEMS);
+}
+/** True iff the facts document establishes NOTHING — every section not-computable. */
+export function factsEstablishNothing(facts) {
+    return facts.sections.every((s) => s.kind === "not-computable");
+}
+//# sourceMappingURL=blast-radius.js.map

package/dist/agent/review/blast-radius.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blast-radius.js","sourceRoot":"","sources":["../../../agent/review/blast-radius.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,+FAA+F;AAC/F,sFAAsF;AACtF,EAAE;AACF,+FAA+F;AAC/F,8FAA8F;AAC9F,gGAAgG;AAChG,6EAA6E;AAC7E,EAAE;AACF,+FAA+F;AAC/F,mGAAmG;AACnG,kFAAkF;AAClF,2FAA2F;AAC3F,kGAAkG;AAClG,iGAAiG;AACjG,2FAA2F;AAC3F,iGAAiG;AACjG,2DAA2D;AAC3D,EAAE;AACF,iGAAiG;AACjG,gDAAgD;AAEhD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAsC,MAAM,mBAAmB,CAAC;AAElG,gGAAgG;AAChG,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AA2DlC,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AACrF,CAAC;AAED,uFAAuF;AACvF,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,KAAkB,EAAE,IAAY;IACrD,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAkB;IACnD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ;SACjC,MAAM,CAAC,CAAC,CAAC,EAAyD,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC;SACjG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1D,4FAA4F;IAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IACJ,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;QAC/B,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YACvF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC,CAAC,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,SAAS;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;;gBACxF,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,OAAO,KAAK,SAAS;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;;gBACxF,KAAK,MAAM,CAAC,IAAI,OAAO;oBAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAuB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAC1D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpB,KAAK;QACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,oBAAoB,KAAK,EAAE,EAAE,SAAS,CAAC;QAC7D,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,KAAK,EAAE,EAAE,SAAS,CAAC;QAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,kCAAkC,KAAK,EAAE,EAAE,SAAS,CAAC;QAC3E,uFAAuF;QACvF,mDAAmD;QACnD,UAAU,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC;QACzE,OAAO,EAAE,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC;KACvE,CAAC,CAAC,CAAC;IAEN,4FAA4F;IAC5F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+E,CAAC;IACzG,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE;QACrD,MAAM,CAAC,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC5C,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAiD,EAAE;YACjF,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACvD,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChD,gFAAgF;gBAChF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAkB,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;SACnD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC;QAC3E,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC;KACzE,CAAC,CAAC,CAAC;IAEN,4FAA4F;IAC5F,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QACpC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEvF,2FAA2F;IAC3F,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,WAAW,IAAI,mBAAmB,CAAC;IAElG,OAAO;QACL,MAAM;QACN,MAAM,EAAE,WAAW;QACnB,OAAO;QACP,eAAe,EAAE,GAAG,CAAC,OAAO,EAAE,yBAAyB,EAAE,SAAS,CAAC;QACnE,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,SAAS,GAAG,CAAI,KAAU,EAAE,KAAa,EAAE,IAAc;IACvD,IAAI,KAAK,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,qBAAqB,eAAe,GAAG,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC;AAClE,CAAC"}

package/dist/agent/review/config-facts.d.ts

@@ -0,0 +1,69 @@
+/** The snapshot ROW ENCODING this consumer understands. Must track the producer's
+ *  `SNAPSHOT_FORMAT_VERSION` (scripts/config-snapshot-diff.ts); a mismatch is a refusal, and
+ *  `scripts/pr-walkthrough-facts-test.ts` asserts the two are equal so a producer bump fails CI
+ *  rather than silently making every walkthrough blind. */
+export declare const READABLE_SNAPSHOT_FORMAT_VERSION = 1;
+/** Separator inside an `access` row key: `<scope> · <facet>` (the producer's `ACCESS_KEY_SEP`). */
+export declare const ACCESS_KEY_SEP = " \u00B7 ";
+/** One comparable config fact. */
+export interface FactRow {
+    readonly section: string;
+    readonly key: string;
+    readonly value: string;
+}
+/** One row whose value moved. */
+export interface FactRowChange {
+    readonly key: string;
+    readonly before: string;
+    readonly after: string;
+}
+/** A section either compared cleanly, or could not be compared. There is deliberately no third shape. */
+export type FactSection = {
+    readonly kind: "computed";
+    readonly section: string;
+    readonly added: readonly FactRow[];
+    readonly removed: readonly FactRow[];
+    readonly changed: readonly FactRowChange[];
+} | {
+    readonly kind: "not-computable";
+    readonly section: string;
+    readonly reason: string;
+};
+/** A named observation the producer made about the diff as a whole. */
+export interface FactFinding {
+    readonly id: string;
+    readonly detail: string;
+}
+/** The whole facts document, validated. */
+export interface ConfigFacts {
+    /** The snapshot row-encoding version both sides agreed on. */
+    readonly formatVersion: number;
+    readonly sections: readonly FactSection[];
+    readonly findings: readonly FactFinding[];
+    /** Why the BASE snapshot is absent, when it is — the producer's own reason, verbatim. */
+    readonly baseFailure: string | undefined;
+    /** Files the PR touches, or undefined when the producer could not establish them (never guessed). */
+    readonly changedFiles: readonly string[] | undefined;
+}
+/** Parse result. A failure carries a reason a human can act on; it is never an empty success. */
+export type ConfigFactsResult = {
+    readonly ok: true;
+    readonly facts: ConfigFacts;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Validate + parse the `--json` facts document.
+ *
+ * `formatVersion` is read from the HEAD snapshot (`head.formatVersion`) because that is the
+ * revision whose row encoding the blast-radius reader will be parsing. A base/head mismatch is
+ * the producer's problem and it already reports it as `format-version-mismatch` with every
+ * section not-computable, so this parser does not need to re-derive it.
+ */
+export declare function parseConfigFacts(text: string): ConfigFactsResult;
+/** True iff this section state carries at least one delta (the producer's `sectionHasDelta`). */
+export declare function sectionHasDelta(s: FactSection): boolean;
+/** Parse an `encodeSet` value (`[a, b]`) back to its members, or undefined when it isn't set-shaped. */
+export declare function decodeSet(value: string): string[] | undefined;
+//# sourceMappingURL=config-facts.d.ts.map

package/dist/agent/review/config-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-facts.d.ts","sourceRoot":"","sources":["../../../agent/review/config-facts.ts"],"names":[],"mappings":"AAyBA;;;2DAG2D;AAC3D,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,mGAAmG;AACnG,eAAO,MAAM,cAAc,aAAQ,CAAC;AAEpC,kCAAkC;AAClC,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,yGAAyG;AACzG,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,qGAAqG;IACrG,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACtD;AAED,iGAAiG;AACjG,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA4BrI;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAwEhE;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAEvD;AAED,wGAAwG;AACxG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAK7D"}

package/dist/agent/review/config-facts.js

@@ -0,0 +1,155 @@
+// THE FACTS WIRE CONTRACT — the typed, validating reader for the config-diff facts document
+// OPE-255's CI gate writes (`scripts/config-diff.ts --json`, uploaded as the `config-diff`
+// workflow artifact).
+//
+// ⭐ WHY CORE RE-DECLARES A SHAPE THAT ALREADY HAS TYPES. `scripts/config-snapshot-diff.ts` owns
+// the PRODUCER's types, and it lives in the app tier (it imports the deployer's own config
+// modules). Core cannot import it, and should not: this module is the CONSUMER, and a consumer
+// that shares a type with its producer does not validate anything — it just asserts. What arrives
+// here is bytes fetched over the network from a third-party API, so it is parsed and CHECKED, and
+// anything unrecognised becomes a stated NOT-COMPUTABLE reason rather than a partially-populated
+// facts object. `scripts/pr-walkthrough-facts-test.ts` binds the two spellings executably: it
+// builds a real diff through the real producer and feeds the real JSON through this parser, so a
+// producer-side shape change fails a test instead of silently degrading every walkthrough.
+//
+// 🔴 THE ONE RULE INHERITED VERBATIM FROM OPE-255: **NEVER EMIT A GREEN PRODUCED BY BLINDNESS.**
+// Every failure mode of this parser returns a REASON. There is no lenient path, no default empty
+// facts object, and no "best effort" partial — because an empty facts object renders as "no
+// section changed", which is the single most dangerous thing this feature could tell a reviewer.
+//
+// FORMAT VERSION. `review/blast-radius.ts` parses the ROW ENCODING (the `<scope> · <facet>` key
+// grammar and the `[a, b]` set-value grammar) to say what a change means. That encoding is
+// versioned by the producer as `formatVersion`, so this module pins the version it can read and
+// refuses a newer one — a blast-radius reading derived from a grammar we are guessing at is worse
+// than no blast-radius reading, and the walkthrough can say "not computable" perfectly well.
+/** The snapshot ROW ENCODING this consumer understands. Must track the producer's
+ *  `SNAPSHOT_FORMAT_VERSION` (scripts/config-snapshot-diff.ts); a mismatch is a refusal, and
+ *  `scripts/pr-walkthrough-facts-test.ts` asserts the two are equal so a producer bump fails CI
+ *  rather than silently making every walkthrough blind. */
+export const READABLE_SNAPSHOT_FORMAT_VERSION = 1;
+/** Separator inside an `access` row key: `<scope> · <facet>` (the producer's `ACCESS_KEY_SEP`). */
+export const ACCESS_KEY_SEP = " · ";
+const isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function rows(v, where) {
+    if (!Array.isArray(v))
+        return `${where} is not an array`;
+    const out = [];
+    for (const [i, r] of v.entries()) {
+        if (!isRecord(r) || typeof r.section !== "string" || typeof r.key !== "string" || typeof r.value !== "string") {
+            return `${where}[${i}] is not a {section,key,value} row`;
+        }
+        out.push({ section: r.section, key: r.key, value: r.value });
+    }
+    return out;
+}
+function changes(v, where) {
+    if (!Array.isArray(v))
+        return `${where} is not an array`;
+    const out = [];
+    for (const [i, c] of v.entries()) {
+        if (!isRecord(c) || typeof c.key !== "string" || typeof c.before !== "string" || typeof c.after !== "string") {
+            return `${where}[${i}] is not a {key,before,after} change`;
+        }
+        out.push({ key: c.key, before: c.before, after: c.after });
+    }
+    return out;
+}
+/**
+ * Validate + parse the `--json` facts document.
+ *
+ * `formatVersion` is read from the HEAD snapshot (`head.formatVersion`) because that is the
+ * revision whose row encoding the blast-radius reader will be parsing. A base/head mismatch is
+ * the producer's problem and it already reports it as `format-version-mismatch` with every
+ * section not-computable, so this parser does not need to re-derive it.
+ */
+export function parseConfigFacts(text) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (err) {
+        return { ok: false, reason: `the facts document is not valid JSON (${err instanceof Error ? err.message : String(err)})` };
+    }
+    if (!isRecord(doc))
+        return { ok: false, reason: "the facts document is not a JSON object" };
+    const head = doc.head;
+    if (!isRecord(head) || typeof head.formatVersion !== "number") {
+        return { ok: false, reason: "the facts document carries no `head` snapshot with a numeric `formatVersion`" };
+    }
+    if (head.formatVersion !== READABLE_SNAPSHOT_FORMAT_VERSION) {
+        return {
+            ok: false,
+            reason: `the facts document uses snapshot row-encoding version ${head.formatVersion}, and this deployment can only read ` +
+                `version ${READABLE_SNAPSHOT_FORMAT_VERSION} — the key/value grammar the blast-radius reading depends on may have changed, ` +
+                `so refusing to interpret it (upgrade the deployment, or read the artifact by hand)`,
+        };
+    }
+    const diff = doc.diff;
+    if (!isRecord(diff))
+        return { ok: false, reason: "the facts document carries no `diff` object" };
+    if (!Array.isArray(diff.sections))
+        return { ok: false, reason: "the facts document's `diff.sections` is not an array" };
+    if (!Array.isArray(diff.findings))
+        return { ok: false, reason: "the facts document's `diff.findings` is not an array" };
+    const sections = [];
+    for (const [i, s] of diff.sections.entries()) {
+        if (!isRecord(s) || typeof s.section !== "string")
+            return { ok: false, reason: `diff.sections[${i}] has no \`section\` name` };
+        if (s.kind === "not-computable") {
+            if (typeof s.reason !== "string" || s.reason.trim().length === 0) {
+                // A not-computable section with no reason is the one shape that would let a blind section
+                // render as a bare label a reader could mistake for a clean one.
+                return { ok: false, reason: `diff.sections[${i}] ("${s.section}") is not-computable but carries no reason` };
+            }
+            sections.push({ kind: "not-computable", section: s.section, reason: s.reason });
+            continue;
+        }
+        if (s.kind !== "computed")
+            return { ok: false, reason: `diff.sections[${i}] ("${s.section}") has unrecognised kind ${JSON.stringify(s.kind)}` };
+        const added = rows(s.added, `diff.sections[${i}].added`);
+        if (typeof added === "string")
+            return { ok: false, reason: added };
+        const removed = rows(s.removed, `diff.sections[${i}].removed`);
+        if (typeof removed === "string")
+            return { ok: false, reason: removed };
+        const changed = changes(s.changed, `diff.sections[${i}].changed`);
+        if (typeof changed === "string")
+            return { ok: false, reason: changed };
+        sections.push({ kind: "computed", section: s.section, added, removed, changed });
+    }
+    if (sections.length === 0) {
+        return { ok: false, reason: "the facts document reports zero sections — there is nothing in it to establish anything about this PR" };
+    }
+    const findings = [];
+    for (const [i, f] of diff.findings.entries()) {
+        if (!isRecord(f) || typeof f.id !== "string" || typeof f.detail !== "string") {
+            return { ok: false, reason: `diff.findings[${i}] is not a {id,detail} finding` };
+        }
+        findings.push({ id: f.id, detail: f.detail });
+    }
+    let changedFiles;
+    if (Array.isArray(doc.changedFiles)) {
+        if (!doc.changedFiles.every((f) => typeof f === "string"))
+            return { ok: false, reason: "`changedFiles` contains a non-string entry" };
+        changedFiles = doc.changedFiles;
+    }
+    else if (doc.changedFiles !== null && doc.changedFiles !== undefined) {
+        return { ok: false, reason: "`changedFiles` is neither an array nor null" };
+    }
+    const baseFailure = typeof doc.baseFailure === "string" && doc.baseFailure.trim().length > 0 ? doc.baseFailure.trim() : undefined;
+    return { ok: true, facts: { formatVersion: head.formatVersion, sections, findings, baseFailure, changedFiles } };
+}
+/** True iff this section state carries at least one delta (the producer's `sectionHasDelta`). */
+export function sectionHasDelta(s) {
+    return s.kind === "computed" && (s.added.length > 0 || s.removed.length > 0 || s.changed.length > 0);
+}
+/** Parse an `encodeSet` value (`[a, b]`) back to its members, or undefined when it isn't set-shaped. */
+export function decodeSet(value) {
+    if (!value.startsWith("[") || !value.endsWith("]"))
+        return undefined;
+    const inner = value.slice(1, -1);
+    if (inner.trim().length === 0)
+        return [];
+    return inner.split(", ");
+}
+//# sourceMappingURL=config-facts.js.map

package/dist/agent/review/config-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-facts.js","sourceRoot":"","sources":["../../../agent/review/config-facts.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,2FAA2F;AAC3F,sBAAsB;AACtB,EAAE;AACF,gGAAgG;AAChG,2FAA2F;AAC3F,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,2FAA2F;AAC3F,EAAE;AACF,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,iGAAiG;AACjG,EAAE;AACF,gGAAgG;AAChG,2FAA2F;AAC3F,gGAAgG;AAChG,kGAAkG;AAClG,6FAA6F;AAE7F;;;2DAG2D;AAC3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,mGAAmG;AACnG,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAgDpC,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAExH,SAAS,IAAI,CAAC,CAAU,EAAE,KAAa;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,KAAK,kBAAkB,CAAC;IACzD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9G,OAAO,GAAG,KAAK,IAAI,CAAC,oCAAoC,CAAC;QAC3D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,OAAO,CAAC,CAAU,EAAE,KAAa;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,KAAK,kBAAkB,CAAC;IACzD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7G,OAAO,GAAG,KAAK,IAAI,CAAC,sCAAsC,CAAC;QAC7D,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IAE5F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,gCAAgC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,yDAAyD,IAAI,CAAC,aAAa,sCAAsC;gBACjH,WAAW,gCAAgC,iFAAiF;gBAC5H,oFAAoF;SACvF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IACxH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAExH,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,2BAA2B,EAAE,CAAC;QAC/H,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjE,0FAA0F;gBAC1F,iEAAiE;gBACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,4CAA4C,EAAE,CAAC;YAC/G,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC,OAAO,4BAA4B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAChJ,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uGAAuG,EAAE,CAAC;IACxI,CAAC;IAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,gCAAgC,EAAE,CAAC;QACnF,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,YAA2C,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QACtI,YAAY,GAAG,GAAG,CAAC,YAAiC,CAAC;IACvD,CAAC;SAAM,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAElI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,CAAC;AACnH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,CAAc;IAC5C,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/agent/review/facts-artifact.d.ts

@@ -0,0 +1,108 @@
+import { type ConfigFacts } from "./config-facts.js";
+import { type CloudStatusFacts } from "./facts-cloud-status.js";
+/**
+ * Minimal fetch shape for this module — `scm/pr.ts`'s `PrFetchFn` plus `arrayBuffer()`, because the
+ * artifact download is BINARY (a zip) and that is the one GitHub read in the tree that isn't text.
+ * Declared here rather than widened on `PrFetchFn`: every other caller of that type GETs JSON, and
+ * adding a binary method to the shared shape would oblige each of their test doubles to grow one.
+ */
+export type ArtifactFetchFn = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+    arrayBuffer(): Promise<ArrayBuffer>;
+}>;
+/** The workflow file whose runs are the ONLY accepted source of config facts. CODEOWNED. */
+export declare const CONFIG_DIFF_WORKFLOW_PATH = ".github/workflows/config-diff.yml";
+/** The artifact name the workflow's upload step uses. */
+export declare const CONFIG_DIFF_ARTIFACT_NAME = "config-diff";
+/**
+ * Which changed paths make a config diff meaningful. A walkthrough uses it to distinguish "the gate
+ * did not run because this PR touches no config" (a COMPUTED absence) from "the gate should have run
+ * and we cannot find its output" (an UNKNOWN). Those two must never render the same way, and only
+ * this list can tell them apart.
+ *
+ * 🔴 KEPT HONEST BY A TEST, NOT BY DISCIPLINE: `scripts/pr-walkthrough-facts-test.ts` joins every
+ * glob below to the repo's own tracked files and refuses one that matches nothing. Core cannot read
+ * the repo (there is none at runtime), so the app tier binds them — the same split
+ * `packages/core/scripts/codeowners-coverage-test.ts` uses for CODEOWNERS. A glob naming a path the
+ * tree no longer has is the failure this catches: it can never match, so it silently narrows the
+ * trigger set and turns an UNKNOWN into a computed absence.
+ *
+ * ⚠️ WHAT THE JOIN DOES NOT CATCH: a MISSING entry. It reads each glob and asks whether the tree has
+ * a file for it; it has no second list to compare against, so a config path nobody added here stays
+ * invisible. The mirror that did catch that read the config-diff workflow's own `paths:` filter, and
+ * OPE-1113 deleted the workflow. A deployment that restores one owes this list a fresh comparison.
+ */
+export declare const CONFIG_DIFF_TRIGGER_PATHS: readonly string[];
+/**
+ * Does `path` match one of GitHub's `paths:` globs? Supports the two forms the filter actually
+ * uses — a trailing `**` (any depth) and a single `*` inside one segment — and nothing else, so a
+ * glob form nobody wrote cannot be silently mis-matched. Pure.
+ */
+export declare function pathMatchesGlob(path: string, glob: string): boolean;
+/** True iff a PR touching `paths` would trigger the config-diff workflow at all. */
+export declare function triggersConfigDiff(paths: readonly string[]): boolean;
+/** Where a facts document came from — carried into the render so a reviewer can go and check it. */
+export interface FactsProvenance {
+    readonly repo: string;
+    readonly headSha: string;
+    readonly workflowPath: string;
+    readonly runId: number;
+    readonly runUrl: string;
+    readonly runAttempt: number;
+    readonly runConclusion: string | null;
+    readonly artifactId: number;
+    readonly artifactName: string;
+}
+/**
+ * The facts, or a stated reason there are none. FOUR outcomes, never two — `artifact` and
+ * `cloud-status` are the two provenances the header names, `not-triggered` is a computed absence and
+ * `unavailable` is an unknown, and the renderer shows all four differently.
+ */
+export type FactsSource = Extract<CloudStatusFacts, {
+    kind: "cloud-status";
+}> | {
+    readonly kind: "artifact";
+    readonly facts: ConfigFacts;
+    readonly provenance: FactsProvenance;
+    /** The overlay single-scope gate's own report, verbatim and bounded, when the artifact carried it. */
+    readonly overlayGateReport: string | undefined;
+} | {
+    readonly kind: "not-triggered";
+    /** Which of the trigger globs went unmatched is not interesting; WHY there are no facts is. */
+    readonly reason: string;
+} | {
+    readonly kind: "unavailable";
+    readonly reason: string;
+};
+export interface FetchConfigFactsOpts {
+    readonly repo: string;
+    readonly headSha: string;
+    readonly token: string;
+    /** The files this PR touches, when known — lets a non-config PR report `not-triggered`. */
+    readonly changedPaths?: readonly string[];
+    readonly fetchFn?: ArtifactFetchFn;
+    readonly apiBase?: string;
+}
+/**
+ * Fetch the config-diff facts for one PR head, from whichever provenance can produce them.
+ *
+ * The order and what it means is in the header. In short: a PR that touches no config answers
+ * `not-triggered` without a single request; otherwise the CODEOWNED Actions artifact is tried first
+ * and the vouching commit status second, and an answer from either is returned as it stands.
+ *
+ * NEVER THROWS — every failure of either lane is an outcome with a reason, because a throw here
+ * would surface to the caller as a tool error and a tool error reads, to a model and then to a
+ * human, as "the check didn't apply". Even a transport failure becomes `unavailable`.
+ *
+ * 🔴 WHEN BOTH LANES COME BACK EMPTY THE REASON NAMES BOTH. A single reason would read as "the
+ * workflow has not finished" on a repository that has no workflow at all, and an operator would go
+ * looking for a run rather than for the status that was actually missing.
+ */
+export declare function fetchConfigFacts(opts: FetchConfigFactsOpts): Promise<FactsSource>;
+//# sourceMappingURL=facts-artifact.d.ts.map

package/dist/agent/review/facts-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facts-artifact.d.ts","sourceRoot":"","sources":["../../../agent/review/facts-artifact.ts"],"names":[],"mappings":"AA2DA,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGvF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACtD,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAA;CAAE,CAAC,CAAC;AAEtI,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,sCAAsC,CAAC;AAE7E,yDAAyD;AACzD,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AAcvD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAKtD,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWnE;AAED,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEpE;AAED,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB,OAAO,CAAC,gBAAgB,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,GACnD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,sGAAsG;IACtG,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;CAChD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAa9D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2BvF"}