@openagentsy/hooks 0.0.0-stage → 0.2.0

package/dist/approvals.test.js

@@ -0,0 +1,307 @@
+import { mkdir, mkdtemp, readdir, readFile, stat, utimes, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { approvalGate, approvalsPath, createApprovalStore, releaseLock, restoreLock, withLock, } from './approvals.js';
+/** The reason a result carries, when it stops the call. */
+function reasonOf(result) {
+    return 'reason' in result ? result.reason : undefined;
+}
+/** Whether a result lets the call through. */
+function continues(result) {
+    return 'continue' in result ? result.continue : true;
+}
+/** A pause. */
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+let root;
+beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'oa-approvals-'));
+});
+describe('the approval store', () => {
+    it('writes the grants under the state root and makes the directory', async () => {
+        const store = createApprovalStore(root);
+        expect(store.path).toBe(approvalsPath(root));
+        await store.approve('call-1', 1000, 60_000);
+        const raw = JSON.parse(await readFile(store.path, 'utf8'));
+        expect(raw).toEqual([{ callID: 'call-1', expiresAt: 61_000 }]);
+    });
+    it('passes a granted call exactly once', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-1', 1000, 60_000);
+        expect(await store.isApproved('call-1', 2000)).toBe(true);
+        expect(await store.consumeApproval('call-1', 2000)).toBe(true);
+        expect(await store.consumeApproval('call-1', 2000)).toBe(false);
+        expect(await store.isApproved('call-1', 2000)).toBe(false);
+    });
+    it('never passes an expired grant', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-1', 1000, 500);
+        expect(await store.isApproved('call-1', 2000)).toBe(false);
+        expect(await store.consumeApproval('call-1', 2000)).toBe(false);
+    });
+    it('prunes the grants that have run out', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('old', 1000, 500);
+        await store.approve('new', 1000, 60_000);
+        expect(await store.isApproved('new', 2000)).toBe(true);
+        const raw = JSON.parse(await readFile(store.path, 'utf8'));
+        expect(raw).toEqual([{ callID: 'new', expiresAt: 61_000 }]);
+    });
+    it('holds no grant for a call nobody approved', async () => {
+        const store = createApprovalStore(root);
+        expect(await store.isApproved('call-1', 2000)).toBe(false);
+    });
+    it('spends a grant once, even when two callers race', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('dup', 1000, 60_000);
+        const results = await Promise.all([
+            store.consumeApproval('dup', 2000),
+            store.consumeApproval('dup', 2000),
+        ]);
+        expect(results.filter(Boolean)).toHaveLength(1);
+    });
+    it('keeps the other grants when one is added', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('first', 1000, 60_000);
+        await store.approve('second', 1000, 60_000);
+        const raw = JSON.parse(await readFile(store.path, 'utf8'));
+        expect(raw).toHaveLength(2);
+    });
+    it('does not take a lock that a live writer holds', async () => {
+        const store = createApprovalStore(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${store.path}.lock`;
+        await writeFile(lockPath, 'held', 'utf8');
+        await expect(store.approve('call-1', 1000, 60_000)).rejects.toThrow('locked by another writer');
+        expect(await readFile(lockPath, 'utf8')).toBe('held');
+    });
+    it('lets one writer take a stale lock over and refuses the other', async () => {
+        const store = createApprovalStore(root, { timeoutMs: 50, staleMs: 200, heartbeatMs: 50 });
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${store.path}.lock`;
+        await writeFile(lockPath, 'held', 'utf8');
+        const old = new Date(Date.now() - 60_000);
+        await utimes(lockPath, old, old);
+        const results = await Promise.allSettled([
+            store.approve('first', 1000, 60_000),
+            store.approve('second', 1000, 60_000),
+        ]);
+        expect(results.filter((result) => result.status === 'fulfilled')).toHaveLength(1);
+        expect(results.filter((result) => result.status === 'rejected')).toHaveLength(1);
+    });
+    it('takes a stale lock over even when a reclaim file was left behind', async () => {
+        const store = createApprovalStore(root, { timeoutMs: 50, staleMs: 200, heartbeatMs: 50 });
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${store.path}.lock`;
+        await writeFile(lockPath, 'held', 'utf8');
+        const old = new Date(Date.now() - 60_000);
+        await utimes(lockPath, old, old);
+        const reclaimPath = `${lockPath}.reclaim`;
+        await writeFile(reclaimPath, 'orphan', 'utf8');
+        await utimes(reclaimPath, old, old);
+        const grant = await store.approve('call-1', 1000, 60_000);
+        expect(grant.entry.callID).toBe('call-1');
+        expect(grant.created).toBe(true);
+    });
+    it('takes a stale lock over even when a stale file was left behind', async () => {
+        const store = createApprovalStore(root, { timeoutMs: 50, staleMs: 200, heartbeatMs: 50 });
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${store.path}.lock`;
+        await writeFile(lockPath, 'held', 'utf8');
+        const old = new Date(Date.now() - 60_000);
+        await utimes(lockPath, old, old);
+        const stalePath = `${lockPath}.stale`;
+        await writeFile(stalePath, 'old', 'utf8');
+        await utimes(stalePath, old, old);
+        const grant = await store.approve('call-1', 1000, 60_000);
+        expect(grant.entry.callID).toBe('call-1');
+        expect(grant.created).toBe(true);
+    });
+    it('refreshes the lock while the action runs', async () => {
+        const path = approvalsPath(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const timing = { timeoutMs: 50, staleMs: 200, heartbeatMs: 50 };
+        await withLock(path, timing, async () => {
+            await sleep(150);
+            const stats = await stat(`${path}.lock`);
+            expect(Date.now() - stats.mtimeMs).toBeLessThan(100);
+        });
+    });
+    it('leaves no lock behind', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-1', 1000, 60_000);
+        const files = await readdir(join(root, '.openagentsy'));
+        expect(files.filter((name) => name.startsWith('approvals.json.lock'))).toEqual([]);
+    });
+    it('takes over a lock that was left behind', async () => {
+        const store = createApprovalStore(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${store.path}.lock`;
+        await writeFile(lockPath, '', 'utf8');
+        const old = new Date(Date.now() - 60_000);
+        await utimes(lockPath, old, old);
+        const grant = await store.approve('call-1', 1000, 60_000);
+        expect(grant.entry.callID).toBe('call-1');
+        expect(grant.created).toBe(true);
+    });
+    it('refuses to grant on a store it cannot read', async () => {
+        const store = createApprovalStore(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        await writeFile(store.path, '{not json', 'utf8');
+        await expect(store.approve('call-1', 1000, 60_000)).rejects.toThrow();
+    });
+    it('keeps the grant that is already there', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-1', 1000, 60_000);
+        const grant = await store.approve('call-1', 2000, 60_000);
+        expect(grant.created).toBe(false);
+        expect(grant.entry.expiresAt).toBe(61_000);
+        const raw = JSON.parse(await readFile(store.path, 'utf8'));
+        expect(raw).toEqual([{ callID: 'call-1', expiresAt: 61_000 }]);
+    });
+    it('takes a grant back', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-1', 1000, 60_000);
+        expect(await store.revokeApproval('call-1', 2000)).toBe(true);
+        expect(await store.revokeApproval('call-1', 2000)).toBe(false);
+        const raw = JSON.parse(await readFile(store.path, 'utf8'));
+        expect(raw).toEqual([]);
+    });
+    it('refuses a grant that would not run out at a moment a date can name', async () => {
+        const store = createApprovalStore(root);
+        await expect(store.approve('call-1', 1000, 1e60)).rejects.toThrow('a moment a date can name');
+        await expect(readFile(store.path, 'utf8')).rejects.toThrow();
+    });
+    it('puts the grant back when the trail of the spend cannot be written', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-1', 1000, 60_000);
+        // The audit log is a directory, so nothing can be written to it.
+        await mkdir(join(root, '.openagentsy', 'audit.jsonl'), { recursive: true });
+        await expect(store.consumeApproval('call-1', 2000, 'builder')).rejects.toThrow();
+        const raw = JSON.parse(await readFile(store.path, 'utf8'));
+        expect(raw).toEqual([{ callID: 'call-1', expiresAt: 61_000 }]);
+    });
+    it('does not rewrite a store it cannot read', async () => {
+        const store = createApprovalStore(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        await writeFile(store.path, '{not json', 'utf8');
+        await expect(store.approve('call-1', 1000, 60_000)).rejects.toThrow();
+        expect(await readFile(store.path, 'utf8')).toBe('{not json');
+    });
+});
+describe('the approval gate', () => {
+    it('stops a destructive command and names the escape hatch', async () => {
+        const store = createApprovalStore(root);
+        const gate = approvalGate(/rm\s+-rf/, store);
+        const result = await gate({
+            toolName: 'bash',
+            args: {},
+            files: [],
+            command: 'rm -rf /',
+            callID: 'call-7',
+        });
+        expect(continues(result)).toBe(false);
+        expect(reasonOf(result)).toContain('/oa approve <callID>');
+        expect(reasonOf(result)).toContain('call-7');
+    });
+    it('lets an approved call through once', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-7', Date.now(), 60_000);
+        const gate = approvalGate(/rm\s+-rf/, store);
+        const first = await gate({
+            toolName: 'bash',
+            args: {},
+            files: [],
+            command: 'rm -rf /',
+            callID: 'call-7',
+        });
+        expect(continues(first)).toBe(true);
+        const second = await gate({
+            toolName: 'bash',
+            args: {},
+            files: [],
+            command: 'rm -rf /',
+            callID: 'call-7',
+        });
+        expect(continues(second)).toBe(false);
+    });
+    it('writes the trail of the spend when the gate lets a call through', async () => {
+        const store = createApprovalStore(root);
+        await store.approve('call-7', Date.now(), 60_000);
+        const gate = approvalGate(/rm\s+-rf/, store);
+        const result = await gate({
+            toolName: 'bash',
+            args: {},
+            files: [],
+            command: 'rm -rf /',
+            callID: 'call-7',
+            role: 'builder',
+        });
+        expect(continues(result)).toBe(true);
+        const raw = await readFile(join(root, '.openagentsy', 'audit.jsonl'), 'utf8');
+        const entry = JSON.parse(raw.trim());
+        expect(entry).toMatchObject({
+            policyId: 'oa.approve.used',
+            policyVersion: 'v1',
+            actor: 'builder',
+            action: 'approve_use',
+            resource: 'call-7',
+            effect: 'allow',
+        });
+    });
+    it('lets a command that does not match through', async () => {
+        const store = createApprovalStore(root);
+        const gate = approvalGate(/rm\s+-rf/, store);
+        const result = await gate({ toolName: 'bash', args: {}, files: [], command: 'ls -la' });
+        expect(continues(result)).toBe(true);
+    });
+    it('refuses when the store cannot be read', async () => {
+        const store = createApprovalStore(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        await writeFile(store.path, '{not json', 'utf8');
+        const gate = approvalGate(/rm\s+-rf/, store);
+        const result = await gate({
+            toolName: 'bash',
+            args: {},
+            files: [],
+            command: 'rm -rf /',
+            callID: 'call-7',
+        });
+        expect(continues(result)).toBe(false);
+        expect(reasonOf(result)).toContain('approval store');
+    });
+});
+describe('the release of a lock', () => {
+    it('does not put a foreign lock over a lock that is held now', async () => {
+        const path = approvalsPath(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${path}.lock`;
+        const privatePath = `${lockPath}.release.ours`;
+        await writeFile(privatePath, 'foreign', 'utf8');
+        await writeFile(lockPath, 'new-holder', 'utf8');
+        await restoreLock(privatePath, lockPath);
+        expect(await readFile(lockPath, 'utf8')).toBe('new-holder');
+    });
+    it('puts a foreign lock back when the path is free', async () => {
+        const path = approvalsPath(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${path}.lock`;
+        const privatePath = `${lockPath}.release.ours`;
+        await writeFile(privatePath, 'foreign', 'utf8');
+        await restoreLock(privatePath, lockPath);
+        expect(await readFile(lockPath, 'utf8')).toBe('foreign');
+    });
+    it('does not remove a lock that is not the writer’s', async () => {
+        const path = approvalsPath(root);
+        await mkdir(join(root, '.openagentsy'), { recursive: true });
+        const lockPath = `${path}.lock`;
+        await writeFile(lockPath, 'foreign', 'utf8');
+        await releaseLock(lockPath, 'ours');
+        expect(await readFile(lockPath, 'utf8')).toBe('foreign');
+    });
+});
+//# sourceMappingURL=approvals.test.js.map

package/dist/approvals.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.test.js","sourceRoot":"","sources":["../src/approvals.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EACL,YAAY,EACZ,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAGxB,2DAA2D;AAC3D,SAAS,QAAQ,CAAC,MAAqB;IACrC,OAAO,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,8CAA8C;AAC9C,SAAS,SAAS,CAAC,MAAqB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,eAAe;AACf,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;YAClC,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC;QACtC,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC;QACtC,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;YACpC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC;QACtC,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAC1C,MAAM,SAAS,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC;QACtC,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,QAAQ,QAAQ,CAAC;QACtC,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YACtC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC;QACtC,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE5C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAE5C,MAAM,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC9F,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,iEAAiE;QACjE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5E,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEjF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACtE,MAAM,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC;YACvB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;QAChE,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;YAC1B,QAAQ,EAAE,iBAAiB;YAC3B,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;YACxB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,EAAE;YACR,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;QAChC,MAAM,WAAW,GAAG,GAAG,QAAQ,eAAe,CAAC;QAC/C,MAAM,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;QAChC,MAAM,WAAW,GAAG,GAAG,QAAQ,eAAe,CAAC;QAC/C,MAAM,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;QAChC,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/base-tool.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The base name of a tool.
+ *
+ * A host hands a tool name over as `<server>_<tool>`: the memory server's
+ * `oa_memory_decide` arrives as `openagentsy-memory_oa_memory_decide`. The
+ * base name is the tool itself, and the rules are written against the base
+ * name, so it has to be the same whichever host called.
+ *
+ * The prefix is not stripped by a pattern. A pattern that strips
+ * `^[a-z0-9-]+_` in front of `oa_` leaves every `board_*` name untouched,
+ * which is the hole the vocabulary closes: the name is resolved by the
+ * longest suffix the registered vocabulary knows.
+ */
+export declare function baseToolName(toolName: string, vocabulary: readonly string[]): string;
+/**
+ * Every tool name the workspace knows.
+ *
+ * The board, the task store and the memory slice; whatever else a package
+ * exports. The list is the vocabulary a tool name is resolved against.
+ */
+export declare const toolVocabulary: readonly string[];
+/**
+ * The base name of a tool, against the workspace vocabulary.
+ */
+export declare function baseTool(toolName: string): string;
+//# sourceMappingURL=base-tool.d.ts.map

package/dist/base-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tool.d.ts","sourceRoot":"","sources":["../src/base-tool.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAIpF;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAI3C,CAAC;AAEF;;GAEG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/base-tool.js

@@ -0,0 +1,37 @@
+import { boardToolNames, memoryToolNames, taskToolNames } from '@openagentsy/core';
+/**
+ * The base name of a tool.
+ *
+ * A host hands a tool name over as `<server>_<tool>`: the memory server's
+ * `oa_memory_decide` arrives as `openagentsy-memory_oa_memory_decide`. The
+ * base name is the tool itself, and the rules are written against the base
+ * name, so it has to be the same whichever host called.
+ *
+ * The prefix is not stripped by a pattern. A pattern that strips
+ * `^[a-z0-9-]+_` in front of `oa_` leaves every `board_*` name untouched,
+ * which is the hole the vocabulary closes: the name is resolved by the
+ * longest suffix the registered vocabulary knows.
+ */
+export function baseToolName(toolName, vocabulary) {
+    const longest = [...vocabulary].sort((a, b) => b.length - a.length);
+    const found = longest.find((entry) => toolName === entry || toolName.endsWith(`_${entry}`));
+    return found ?? toolName;
+}
+/**
+ * Every tool name the workspace knows.
+ *
+ * The board, the task store and the memory slice; whatever else a package
+ * exports. The list is the vocabulary a tool name is resolved against.
+ */
+export const toolVocabulary = [
+    ...boardToolNames,
+    ...taskToolNames,
+    ...memoryToolNames,
+];
+/**
+ * The base name of a tool, against the workspace vocabulary.
+ */
+export function baseTool(toolName) {
+    return baseToolName(toolName, toolVocabulary);
+}
+//# sourceMappingURL=base-tool.js.map

package/dist/base-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tool.js","sourceRoot":"","sources":["../src/base-tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,UAA6B;IAC1E,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5F,OAAO,KAAK,IAAI,QAAQ,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,GAAG,cAAc;IACjB,GAAG,aAAa;IAChB,GAAG,eAAe;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAChD,CAAC"}

package/dist/base-tool.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=base-tool.test.d.ts.map

package/dist/base-tool.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tool.test.d.ts","sourceRoot":"","sources":["../src/base-tool.test.ts"],"names":[],"mappings":""}

package/dist/base-tool.test.js

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'vitest';
+import { baseTool, baseToolName, toolVocabulary } from './base-tool.js';
+/**
+ * The pattern revision 1 used to strip a server prefix.
+ *
+ * It looked ahead for `oa_`, so it left every `board_*` name alone. The
+ * test below pins that the old pattern would not have resolved the name.
+ */
+const OLD_PREFIX = /^[a-z0-9-]+_(?=oa_)/i;
+describe('the base tool name', () => {
+    it('resolves a board tool the old prefix pattern left alone', () => {
+        const name = 'openagentsy-board_board_record';
+        expect(OLD_PREFIX.test(name)).toBe(false);
+        expect(baseToolName(name, toolVocabulary)).toBe('board_record');
+    });
+    it('keeps a tool that is already its base name', () => {
+        expect(baseToolName('oa_task_list', toolVocabulary)).toBe('oa_task_list');
+        expect(baseTool('oa_task_list')).toBe('oa_task_list');
+    });
+    it('returns an unknown tool as it is', () => {
+        expect(baseToolName('a_tool_nobody_registers', toolVocabulary)).toBe('a_tool_nobody_registers');
+    });
+    it('takes the longest suffix the vocabulary knows', () => {
+        expect(baseToolName('openagentsy-board_oa_task_list', toolVocabulary)).toBe('oa_task_list');
+        expect(baseToolName('openagentsy-memory_oa_memory_decide', toolVocabulary)).toBe('oa_memory_decide');
+        expect(baseToolName('openagentsy-board_board_lease_grant', toolVocabulary)).toBe('board_lease_grant');
+    });
+    it('knows the board, the task and the memory tools', () => {
+        expect(toolVocabulary).toContain('board_record');
+        expect(toolVocabulary).toContain('oa_task_list');
+        expect(toolVocabulary).toContain('oa_memory_decide');
+    });
+});
+//# sourceMappingURL=base-tool.test.js.map

package/dist/base-tool.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tool.test.js","sourceRoot":"","sources":["../src/base-tool.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAExE;;;;;GAKG;AACH,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAG,gCAAgC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,YAAY,CAAC,yBAAyB,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,YAAY,CAAC,gCAAgC,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5F,MAAM,CAAC,YAAY,CAAC,qCAAqC,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAC9E,kBAAkB,CACnB,CAAC;QACF,MAAM,CAAC,YAAY,CAAC,qCAAqC,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAC9E,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,CAAC,cAAc,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/eval/index.d.ts

@@ -0,0 +1,3 @@
+export * from './runner.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/eval/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/eval/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/eval/index.js

@@ -0,0 +1,3 @@
+export * from './runner.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/eval/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/eval/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/eval/runner.d.ts

@@ -0,0 +1,179 @@
+import { EvalArtifact, type EvalAssertions, type EvalResult, type EvalScenario } from './types.js';
+/** The environment a proof gets: the allowlist, and nothing else. */
+export declare function childEnv(env?: NodeJS.ProcessEnv): Record<string, string>;
+/**
+ * The command, checked.
+ *
+ * The schema already holds an array, and this says why: a string is a shell
+ * line, and a shell line is a program the runner does not choose.
+ */
+export declare function assertArgv(command: unknown): asserts command is string[];
+/** The hash of a command, so a result can name it without carrying it. */
+export declare function hashOf(text: string): string;
+/** The hash of an argv. */
+export declare function commandHash(command: readonly string[]): string;
+/** What a run produced. */
+export type RunOutcome = {
+    exitCode: number | null;
+    timedOut: boolean;
+    stdout: string;
+    stderr: string;
+};
+/**
+ * Run one command.
+ *
+ * The spawn has no shell, the environment is the allowlist, and the timeout
+ * kills the group. The output is kept in memory for the assertions and is
+ * never written anywhere.
+ */
+export declare function runCommand(command: string[], cwd: string, timeoutMs: number): Promise<RunOutcome>;
+/**
+ * The verdicts of one scenario.
+ *
+ * A scenario that only names an exit code does not care what was printed, so
+ * only the named assertions are recorded. The spawn itself is always one:
+ * a command that could not start has not passed.
+ */
+export declare function assertionsOf(scenario: EvalScenario, outcome: RunOutcome): EvalAssertions;
+/** Whether every assertion held. */
+export declare function allPassed(assertions: EvalAssertions): boolean;
+/**
+ * The directory the results live in.
+ */
+export declare function evalResultsDir(stateRoot: string): string;
+/**
+ * The path a result is written to.
+ *
+ * The lesson id names the file, so it is checked before it names anything:
+ * an id that is really a path would write the result outside the directory
+ * the results belong in.
+ */
+export declare function evalResultPath(stateRoot: string, lessonId: string, at: Date): string;
+/**
+ * Write a result.
+ *
+ * The mode is 0600, because a result says what a proof did in a project and
+ * nobody else has a reason to read it. The file is opened with
+ * O_NOFOLLOW, so a symlink at the path is not followed, and with O_EXCL, so
+ * an existing file is never replaced: a result is evidence and evidence is
+ * not overwritten.
+ */
+export declare function writeEvalResult(path: string, result: EvalResult, stateRoot: string): Promise<string>;
+/**
+ * Check that the verdicts agree with the assertions.
+ *
+ * The result is recomputed from the assertions and compared with what was
+ * recorded. A result that disagrees with its own evidence is not written,
+ * because a proof nobody can reconcile is not a proof.
+ */
+export declare function assertConsistent(result: EvalResult): void;
+/** What a run needs. */
+export type EvalRunOptions = {
+    /** The artifact file. */
+    artifactPath: string;
+    /** The root a working directory may sit in. */
+    workspace: string;
+    /**
+     * The other roots a working directory may sit in.
+     *
+     * An OpenAgentsy worktree of the same project is one, and so is a
+     * temporary worktree the runner made itself.
+     */
+    allowedRoots?: string[];
+    /** The directory a relative working directory resolves against. */
+    base?: string;
+    /** Where the result is written. The workspace by default. */
+    stateRoot?: string;
+    /** The lesson the run belongs to. The artifact's own lesson by default. */
+    lessonId?: string;
+    /** The clock, so a test can pin the moment. */
+    now?: () => Date;
+};
+/**
+ * The roots a working directory may sit in.
+ *
+ * The workspace, the OpenAgentsy worktrees of the same project, and whatever
+ * the caller adds.
+ */
+export declare function allowedRoots(options: EvalRunOptions): string[];
+/**
+ * The working directory of a scenario, checked.
+ *
+ * A relative one resolves against the base and has to land inside one of the
+ * roots. An absolute one has to land inside one of them as well, so a proof
+ * cannot ask for `/etc` or for a directory that only looks close.
+ *
+ * The check is made on the real paths, because a link inside the workspace
+ * can point out of it: a scenario that names a link would otherwise run
+ * somewhere the workspace does not cover.
+ */
+export declare function resolveScenarioCwd(scenario: EvalScenario, base: string, roots: string[]): Promise<string>;
+/**
+ * The artifact, read and checked.
+ *
+ * The schema is the contract: an artifact that does not match it is not a
+ * proof, and the issues say what is wrong with it.
+ */
+export declare function readArtifact(path: string): Promise<EvalArtifact>;
+/**
+ * Run an artifact and write the result.
+ *
+ * The result is written whatever the verdicts are: a failing run is the
+ * evidence that a lesson is not real, and it is worth keeping.
+ */
+export declare function runEvalArtifact(options: EvalRunOptions): Promise<EvalResult>;
+/**
+ * The argv of a git command, with the runner's own settings in front of it.
+ *
+ * A git option only counts before the subcommand it belongs to, so the
+ * settings come first.
+ */
+export declare function gitCommand(args: readonly string[]): string[];
+/**
+ * A temporary worktree, and what to do in it.
+ *
+ * The worktree is where the candidate change is applied: the baseline
+ * scenario has to fail on the current owner and pass with the change, and
+ * the change lives in a commit, so the commit is checked out apart from the
+ * tree that is being worked in.
+ *
+ * The directory is made before the worktree is added, so the cleanup has to
+ * run whether the add worked or not: a directory left behind holds a
+ * checkout of the project.
+ */
+export declare function withTemporaryWorktree<T>(options: {
+    repo: string;
+    ref: string;
+    run: (worktree: string) => Promise<T>;
+}): Promise<T>;
+/** What the reproduction found. */
+export type BaselineOutcome = {
+    /** Whether the baseline scenario failed on the current owner. */
+    baseline_failed: boolean;
+    /** Whether the same scenario passed with the change applied. */
+    with_change_passed: boolean;
+    /** Whether the proof holds. */
+    passed: boolean;
+    /** Why the baseline could not be reproduced, when it could not. */
+    reason?: string;
+    /** The run on the current owner, before the change. */
+    before?: EvalResult;
+    /** The run with the change applied, in the temporary worktree. */
+    after?: EvalResult;
+};
+/**
+ * Reproduce the baseline.
+ *
+ * The baseline scenario has to fail on the current owner and pass with the
+ * change applied in a temporary worktree. A baseline that passes on the
+ * current owner proves nothing: the behaviour was already there.
+ */
+export declare function reproduceBaseline(options: {
+    artifactPath: string;
+    workspace: string;
+    repo: string;
+    changeRef: string;
+    lessonId?: string;
+    now?: () => Date;
+}): Promise<BaselineOutcome>;
+//# sourceMappingURL=runner.d.ts.map