@paths.design/caws-cli 10.2.0 → 11.1.0

package/dist/shell/gates/local-evaluators/scope-boundary.d.ts

@@ -0,0 +1,23 @@
+import type { Spec, Policy } from '@paths.design/caws-kernel';
+import type { GatesViolation } from '../gate-result-contract';
+import { type StagedFileChange } from './diff-helpers';
+export interface ScopeBoundaryInput {
+    readonly spec: Spec;
+    readonly policy: Policy;
+    readonly repoRoot: string;
+    /** Worktree name; defaults to "scope-boundary" if not known. The kernel
+     *  uses this only for diagnostic data, not for authority. */
+    readonly worktreeName?: string;
+    /** Override staged-diff source (tests). */
+    readonly stagedChanges?: readonly StagedFileChange[];
+}
+export interface ScopeBoundaryResult {
+    readonly violations: readonly GatesViolation[];
+    readonly observed: {
+        readonly files_evaluated: number;
+        readonly rejected: number;
+        readonly invalid: number;
+    };
+}
+export declare function evaluateScopeBoundary(input: ScopeBoundaryInput): ScopeBoundaryResult;
+//# sourceMappingURL=scope-boundary.d.ts.map

package/dist/shell/gates/local-evaluators/scope-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-boundary.d.ts","sourceRoot":"","sources":["../../../../src/shell/gates/local-evaluators/scope-boundary.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;iEAC6D;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CA+CpF"}

package/dist/shell/gates/local-evaluators/scope-boundary.js

@@ -0,0 +1,67 @@
+"use strict";
+// scope_boundary evaluator.
+//
+// Iterates the staged file list and asks the kernel scope evaluator
+// (`evaluatePath`) for each path. Any `reject` decision becomes a
+// `scope_boundary` violation; `invalid_path` decisions also become
+// violations (the staged path is malformed and not policy-admissible).
+//
+// `admit` and `no_authority` decisions do NOT produce violations here.
+// `no_authority` (unbound or one_sided) is a binding problem — the
+// gates command itself should refuse to run in that state long before
+// this evaluator is called, OR a doctor-style separate diagnostic
+// should be raised. For v11.1 we treat `no_authority` as a non-blocking
+// "cannot decide" outcome consistent with the kernel's contract; the
+// caller's binding precondition is the authoritative gate.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateScopeBoundary = evaluateScopeBoundary;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const diff_helpers_1 = require("./diff-helpers");
+function evaluateScopeBoundary(input) {
+    const changes = input.stagedChanges ?? (0, diff_helpers_1.listStagedChanges)(input.repoRoot);
+    // Local evaluator assumes the gates command would not have proceeded
+    // unbound; we synthesize a `bound` BindingState from the spec under
+    // evaluation. The caws-cli `caws gates run --spec <id>` contract is
+    // that the caller has named the spec; we treat that as authority for
+    // the purpose of scope evaluation here.
+    const binding = {
+        kind: 'bound',
+        spec: input.spec,
+        worktreeName: input.worktreeName ?? 'gates-run',
+    };
+    const violations = [];
+    let rejected = 0;
+    let invalid = 0;
+    for (const c of changes) {
+        const d = (0, caws_kernel_1.evaluatePath)(c.path, binding, input.policy);
+        if (d.kind === 'reject') {
+            rejected++;
+            violations.push({
+                gate: 'scope_boundary',
+                type: d.rule,
+                message: d.message,
+                file: c.path,
+                severity: 'fail',
+            });
+        }
+        else if (d.kind === 'invalid_path') {
+            invalid++;
+            violations.push({
+                gate: 'scope_boundary',
+                type: d.rule,
+                message: d.message,
+                file: c.path,
+                severity: 'fail',
+            });
+        }
+    }
+    return {
+        violations,
+        observed: {
+            files_evaluated: changes.length,
+            rejected,
+            invalid,
+        },
+    };
+}
+//# sourceMappingURL=scope-boundary.js.map

package/dist/shell/gates/local-evaluators/scope-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-boundary.js","sourceRoot":"","sources":["../../../../src/shell/gates/local-evaluators/scope-boundary.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,EAAE;AACF,oEAAoE;AACpE,kEAAkE;AAClE,mEAAmE;AACnE,uEAAuE;AACvE,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,qEAAqE;AACrE,2DAA2D;;AA4B3D,sDA+CC;AAzED,2DAA4E;AAI5E,iDAA0E;AAsB1E,SAAgB,qBAAqB,CAAC,KAAyB;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,IAAI,IAAA,gCAAiB,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,wCAAwC;IACxC,MAAM,OAAO,GAAiB;QAC5B,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,WAAW;KAChD,CAAC;IAEF,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAA,0BAAY,EAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxB,QAAQ,EAAE,CAAC;YACX,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;YACV,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,QAAQ,EAAE;YACR,eAAe,EAAE,OAAO,CAAC,MAAM;YAC/B,QAAQ;YACR,OAAO;SACR;KACF,CAAC;AACJ,CAAC"}

package/dist/shell/gates/local-evaluators/spec-completeness.d.ts

@@ -0,0 +1,12 @@
+import type { Spec } from '@paths.design/caws-kernel';
+import type { GatesViolation } from '../gate-result-contract';
+export interface SpecCompletenessInput {
+    readonly spec: Spec;
+    /** Current ISO timestamp for evaluating experimental_mode.expires_at. */
+    readonly nowIso: string;
+}
+export interface SpecCompletenessResult {
+    readonly violations: readonly GatesViolation[];
+}
+export declare function evaluateSpecCompleteness(input: SpecCompletenessInput): SpecCompletenessResult;
+//# sourceMappingURL=spec-completeness.d.ts.map

package/dist/shell/gates/local-evaluators/spec-completeness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-completeness.d.ts","sourceRoot":"","sources":["../../../../src/shell/gates/local-evaluators/spec-completeness.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CAChD;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,qBAAqB,GAAG,sBAAsB,CAoD7F"}

package/dist/shell/gates/local-evaluators/spec-completeness.js

@@ -0,0 +1,73 @@
+"use strict";
+// spec_completeness evaluator.
+//
+// Bridges spec health into gate disposition. The kernel/schema layer
+// already enforces structural completeness (required fields, minItems
+// on invariants/acceptance, lifecycle_state shape, etc.); a spec that
+// fails schema validation never reaches this evaluator — composeStoreSnapshot
+// excludes it, and gates.ts already refuses the run.
+//
+// So this evaluator covers the *semantic* completeness checks that the
+// schema cannot enforce alone:
+//
+//   1. The active spec must be in lifecycle_state === 'active'. Running
+//      gates against a closed/archived/draft spec is a category error.
+//      Schema admits all four states; only 'active' is a valid gating
+//      target.
+//
+//   2. blast_radius.modules must be non-empty. The schema requires
+//      `modules` to exist but does not require minItems > 0.
+//
+//   3. If the spec has experimental_mode.enabled and expires_at is in
+//      the past, the experimental status is stale — a completeness
+//      issue surfaced for the operator to either renew or remove.
+//
+// Each failure produces one violation with gate: 'spec_completeness'.
+// `caws-cli` shell decides whether to block based on policy.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateSpecCompleteness = evaluateSpecCompleteness;
+function evaluateSpecCompleteness(input) {
+    const violations = [];
+    // Rule 1: lifecycle_state must be active for gating.
+    if (input.spec.lifecycle_state !== 'active') {
+        violations.push({
+            gate: 'spec_completeness',
+            type: 'spec_not_active',
+            message: `Spec ${input.spec.id} is in lifecycle_state '${input.spec.lifecycle_state}'; ` +
+                `gates only enforce against active specs. ` +
+                `Either reopen the spec or run gates against an active spec.`,
+            severity: 'fail',
+        });
+    }
+    // Rule 2: blast_radius.modules must be non-empty.
+    if (input.spec.blast_radius === undefined ||
+        !Array.isArray(input.spec.blast_radius.modules) ||
+        input.spec.blast_radius.modules.length === 0) {
+        violations.push({
+            gate: 'spec_completeness',
+            type: 'blast_radius_empty',
+            message: `Spec ${input.spec.id} has no blast_radius.modules; risk evaluation ` +
+                `cannot proceed without a declared blast radius.`,
+            severity: 'fail',
+        });
+    }
+    // Rule 3: experimental_mode expiry.
+    const exp = input.spec.experimental_mode;
+    if (exp !== undefined && exp.enabled === true) {
+        if (typeof exp.expires_at === 'string') {
+            const expDate = Date.parse(exp.expires_at);
+            const now = Date.parse(input.nowIso);
+            if (Number.isFinite(expDate) && Number.isFinite(now) && expDate < now) {
+                violations.push({
+                    gate: 'spec_completeness',
+                    type: 'experimental_mode_expired',
+                    message: `Spec ${input.spec.id} has experimental_mode.enabled=true but expires_at ` +
+                        `(${exp.expires_at}) is in the past. Renew or remove the experimental status.`,
+                    severity: 'fail',
+                });
+            }
+        }
+    }
+    return { violations };
+}
+//# sourceMappingURL=spec-completeness.js.map

package/dist/shell/gates/local-evaluators/spec-completeness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec-completeness.js","sourceRoot":"","sources":["../../../../src/shell/gates/local-evaluators/spec-completeness.ts"],"names":[],"mappings":";AAAA,+BAA+B;AAC/B,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,8EAA8E;AAC9E,qDAAqD;AACrD,EAAE;AACF,uEAAuE;AACvE,+BAA+B;AAC/B,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,eAAe;AACf,EAAE;AACF,mEAAmE;AACnE,6DAA6D;AAC7D,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,kEAAkE;AAClE,EAAE;AACF,sEAAsE;AACtE,6DAA6D;;AAgB7D,4DAoDC;AApDD,SAAgB,wBAAwB,CAAC,KAA4B;IACnE,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,qDAAqD;IACrD,IAAI,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC5C,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EACL,QAAQ,KAAK,CAAC,IAAI,CAAC,EAAE,2BAA2B,KAAK,CAAC,IAAI,CAAC,eAAe,KAAK;gBAC/E,2CAA2C;gBAC3C,6DAA6D;YAC/D,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,IACE,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAC5C,CAAC;QACD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EACL,QAAQ,KAAK,CAAC,IAAI,CAAC,EAAE,gDAAgD;gBACrE,iDAAiD;YACnD,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,oCAAoC;IACpC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;IACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,GAAG,EAAE,CAAC;gBACtE,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EACL,QAAQ,KAAK,CAAC,IAAI,CAAC,EAAE,qDAAqD;wBAC1E,IAAI,GAAG,CAAC,UAAU,4DAA4D;oBAChF,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}

package/dist/shell/gates/quality-gates-adapter.d.ts

@@ -0,0 +1,55 @@
+import { type Result } from '@paths.design/caws-kernel';
+import { type GatesReport } from './gate-result-contract';
+/**
+ * Pure resolver: given the CLI install directory and the consumer project
+ * cwd, decide which on-disk path to spawn. Walks up from each starting
+ * point looking for `node_modules/.bin/<BIN_NAME>`.
+ *
+ * Resolution order (documented per CLI-GATES-003 A4):
+ *   1. CLI-install-local — walk up from cliDir. This wins when caws-cli is
+ *      installed globally or in a separate sandbox: caws-quality-gates
+ *      ships as a runtime dep of caws-cli, so it lives beside the caws
+ *      binary, not beside the consumer project.
+ *   2. Project-local — walk up from projectCwd. Preserves the prior
+ *      behavior for the project-local install pattern (CLI-GATES-002 A1).
+ *
+ * The CLI-install-local check wins when both exist. That ordering is by
+ * design: a global caws install was a deliberate choice to use one CLI
+ * version everywhere, and we want that single subprocess version too —
+ * not whatever happens to be in the consumer's node_modules from an older
+ * project-local install.
+ *
+ * Returns the resolved path on success, or { tried: string[] } so the
+ * adapter can surface both attempted paths in the GATES_SUBPROCESS_NOT_FOUND
+ * diagnostic.
+ */
+export declare function resolveQualityGatesBin(cliDir: string, projectCwd: string, fsCheck?: (p: string) => boolean): {
+    resolved: string;
+    source: 'cli-local' | 'project-local';
+} | {
+    tried: string[];
+};
+export interface SubprocessResult {
+    /** Exit code of the subprocess. */
+    readonly status: number | null;
+    /** stdout captured as UTF-8. */
+    readonly stdout: string;
+    /** stderr captured as UTF-8. */
+    readonly stderr: string;
+    /** Any error thrown by the spawn itself (ENOENT, etc.). */
+    readonly error?: Error;
+}
+export interface QualityGatesRunnerInput {
+    readonly cwd: string;
+    /** Extra CLI args after `--json` (e.g. ['--context=cli', '--quiet']). */
+    readonly args: readonly string[];
+}
+export type QualityGatesRunner = (input: QualityGatesRunnerInput) => SubprocessResult;
+export interface RunQualityGatesOptions {
+    readonly cwd: string;
+    readonly args?: readonly string[];
+    /** Inject a custom runner. Tests use this; production omits. */
+    readonly runner?: QualityGatesRunner;
+}
+export declare function runQualityGates(opts: RunQualityGatesOptions): Result<GatesReport>;
+//# sourceMappingURL=quality-gates-adapter.d.ts.map

package/dist/shell/gates/quality-gates-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality-gates-adapter.d.ts","sourceRoot":"","sources":["../../../src/shell/gates/quality-gates-adapter.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA4B,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAGlF,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAI/E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAuB,GAC9C;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,eAAe,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBnF;AAED,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,uBAAuB,KAAK,gBAAgB,CAAC;AAgDtF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAAC,WAAW,CAAC,CAqCjF"}

package/dist/shell/gates/quality-gates-adapter.js

@@ -0,0 +1,161 @@
+"use strict";
+// Adapter for the `caws-quality-gates` subprocess.
+//
+// Single responsibility: invoke the subprocess in `--json` mode, capture
+// stdout, validate the JSON shape against `gate-result-contract`, and
+// return Ok(GatesReport) or Err(diagnostic).
+//
+// What this adapter does NOT do:
+//   - it does not interpret violations
+//   - it does not decide pass/fail/skip
+//   - it does not append events
+//   - it does not write to any file
+//
+// The runner is pluggable so tests can inject canned JSON without spawning
+// real subprocesses. Production uses a default child_process runner.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQualityGatesBin = resolveQualityGatesBin;
+exports.runQualityGates = runQualityGates;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+const rules_1 = require("../rules");
+const gate_result_contract_1 = require("./gate-result-contract");
+const BIN_NAME = 'caws-quality-gates';
+/**
+ * Pure resolver: given the CLI install directory and the consumer project
+ * cwd, decide which on-disk path to spawn. Walks up from each starting
+ * point looking for `node_modules/.bin/<BIN_NAME>`.
+ *
+ * Resolution order (documented per CLI-GATES-003 A4):
+ *   1. CLI-install-local — walk up from cliDir. This wins when caws-cli is
+ *      installed globally or in a separate sandbox: caws-quality-gates
+ *      ships as a runtime dep of caws-cli, so it lives beside the caws
+ *      binary, not beside the consumer project.
+ *   2. Project-local — walk up from projectCwd. Preserves the prior
+ *      behavior for the project-local install pattern (CLI-GATES-002 A1).
+ *
+ * The CLI-install-local check wins when both exist. That ordering is by
+ * design: a global caws install was a deliberate choice to use one CLI
+ * version everywhere, and we want that single subprocess version too —
+ * not whatever happens to be in the consumer's node_modules from an older
+ * project-local install.
+ *
+ * Returns the resolved path on success, or { tried: string[] } so the
+ * adapter can surface both attempted paths in the GATES_SUBPROCESS_NOT_FOUND
+ * diagnostic.
+ */
+function resolveQualityGatesBin(cliDir, projectCwd, fsCheck = fs.existsSync) {
+    const tried = [];
+    for (const [source, start] of [
+        ['cli-local', cliDir],
+        ['project-local', projectCwd],
+    ]) {
+        let dir = path.resolve(start);
+        while (true) {
+            const candidate = path.join(dir, 'node_modules', '.bin', BIN_NAME);
+            tried.push(candidate);
+            if (fsCheck(candidate)) {
+                return { resolved: candidate, source };
+            }
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    return { tried };
+}
+function diag(rule, message, data) {
+    const base = {
+        rule,
+        authority: 'kernel/diagnostics',
+        severity: 'error',
+        message,
+    };
+    return data !== undefined ? { ...base, data } : base;
+}
+function defaultRunner(input) {
+    // CLI-GATES-003: resolve the subprocess from the installed CLI package
+    // location first (covers global / sandboxed install), then fall back to
+    // the consumer project (covers project-local install — CLI-GATES-002 A1).
+    // No PATH fallback — explicit failure beats a hijacked binary.
+    //
+    // Spawn cwd stays as input.cwd (CLI-GATES-003 A3): the analyzed files
+    // come from the consumer project, never from the CLI's install dir.
+    const resolution = resolveQualityGatesBin(__dirname, input.cwd);
+    if ('tried' in resolution) {
+        return {
+            status: null,
+            stdout: '',
+            stderr: '',
+            error: Object.assign(new Error(`caws-quality-gates not found. Tried ${resolution.tried.length} location(s): ${resolution.tried.join(', ')}`), { code: 'ENOENT' }),
+        };
+    }
+    const r = (0, node_child_process_1.spawnSync)(resolution.resolved, ['--json', ...input.args], { cwd: input.cwd, encoding: 'utf8' });
+    const out = {
+        status: r.status,
+        stdout: typeof r.stdout === 'string' ? r.stdout : '',
+        stderr: typeof r.stderr === 'string' ? r.stderr : '',
+        ...(r.error !== undefined ? { error: r.error } : {}),
+    };
+    return out;
+}
+function runQualityGates(opts) {
+    const runner = opts.runner ?? defaultRunner;
+    const result = runner({ cwd: opts.cwd, args: opts.args ?? [] });
+    // Subprocess could not be spawned (ENOENT, permission, etc.).
+    if (result.error !== undefined) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_SUBPROCESS_NOT_FOUND, `Failed to spawn caws-quality-gates: ${result.error.message}`, { errno: result.error.code }));
+    }
+    // Nonzero exit is acceptable IF we still got valid JSON: violations
+    // routinely produce nonzero exit. We do NOT treat exit code as the
+    // disposition source — policy does. But if the subprocess didn't
+    // produce JSON at all, that's an integration failure.
+    if (result.stdout.trim().length === 0) {
+        return (0, caws_kernel_1.err)(diag(rules_1.SHELL_RULES.GATES_SUBPROCESS_FAILED, `caws-quality-gates produced no stdout (exit=${result.status}).`, {
+            exit: result.status,
+            stderr: result.stderr.slice(0, 4000),
+        }));
+    }
+    // Validate the JSON shape before trusting it. This is the contract gate.
+    const reportResult = (0, gate_result_contract_1.validateGatesReport)(result.stdout);
+    if (!reportResult.ok)
+        return reportResult;
+    return (0, caws_kernel_1.ok)(reportResult.value);
+}
+//# sourceMappingURL=quality-gates-adapter.js.map

package/dist/shell/gates/quality-gates-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality-gates-adapter.js","sourceRoot":"","sources":["../../../src/shell/gates/quality-gates-adapter.ts"],"names":[],"mappings":";AAAA,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,6CAA6C;AAC7C,EAAE;AACF,iCAAiC;AACjC,uCAAuC;AACvC,wCAAwC;AACxC,gCAAgC;AAChC,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCrE,wDAuBC;AA0ED,0CAqCC;AAxKD,4CAA8B;AAC9B,gDAAkC;AAClC,2DAAsE;AAEtE,2DAAkF;AAElF,oCAAuC;AACvC,iEAA+E;AAE/E,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,sBAAsB,CACpC,MAAc,EACd,UAAkB,EAClB,UAAkC,EAAE,CAAC,UAAU;IAE/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI;QAC5B,CAAC,WAAW,EAAE,MAAM,CAAC;QACrB,CAAC,eAAe,EAAE,UAAU,CAAC;KACrB,EAAE,CAAC;QACX,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM;YAC1B,GAAG,GAAG,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAqBD,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,IAA8B;IACzE,MAAM,IAAI,GAAe;QACvB,IAAI;QACJ,SAAS,EAAE,oBAAoB;QAC/B,QAAQ,EAAE,OAAO;QACjB,OAAO;KACR,CAAC;IACF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,uEAAuE;IACvE,wEAAwE;IACxE,0EAA0E;IAC1E,+DAA+D;IAC/D,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,UAAU,GAAG,sBAAsB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,MAAM,CAAC,MAAM,CAClB,IAAI,KAAK,CACP,uCAAuC,UAAU,CAAC,KAAK,CAAC,MAAM,iBAAiB,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,EACD,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAA6B,IAAA,8BAAS,EAC3C,UAAU,CAAC,QAAQ,EACnB,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EACzB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrC,CAAC;IACF,MAAM,GAAG,GAAqB;QAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AASD,SAAgB,eAAe,CAAC,IAA4B;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAEhE,8DAA8D;IAC9D,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,0BAA0B,EACtC,uCAAuC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAC7D,EAAE,KAAK,EAAG,MAAM,CAAC,KAA+B,CAAC,IAAI,EAAE,CACxD,CACF,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,IAAA,iBAAG,EACR,IAAI,CACF,mBAAW,CAAC,uBAAuB,EACnC,+CAA+C,MAAM,CAAC,MAAM,IAAI,EAChE;YACE,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACrC,CACF,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,YAAY,GAAG,IAAA,0CAAmB,EAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC;IAE1C,OAAO,IAAA,gBAAE,EAAC,YAAY,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC"}

package/dist/shell/gates/waiver-filter.d.ts

@@ -0,0 +1,58 @@
+import { type Waiver } from '@paths.design/caws-kernel';
+import type { GatesReport } from './gate-result-contract';
+export interface WaiverFilterInput {
+    readonly report: GatesReport;
+    readonly waivers: readonly Waiver[];
+    readonly specId: string;
+    readonly now: Date;
+    /**
+     * Gate ids the policy declares. Violations targeting any other gate
+     * pass through the filter unmodified — waivers MUST NOT promote an
+     * unmatched (subprocess-only) violation to a policy-suppressed state,
+     * because policy doesn't own that gate. Treating waivers as scoped to
+     * policy-declared gates keeps the unmatched bucket purely
+     * observational, which is the contract `deriveDispositions` relies on.
+     *
+     * If omitted, every gate is considered policy-declared (legacy / test
+     * convenience). Production callers should always pass this.
+     */
+    readonly policyGateIds?: readonly string[];
+}
+export interface WaiverEvidence {
+    /** Number of violations on this gate that an effective waiver suppressed. */
+    readonly waived_count: number;
+    /** Stable ids of the waivers credited with the suppression, deduped + sorted. */
+    readonly waiver_ids: readonly string[];
+}
+export interface WaiverFilterResult {
+    /**
+     * The same report shape, but with `violations` reduced to those NOT
+     * suppressed by an effective waiver. `warnings`, `timestamp`,
+     * `context`, `files_scoped`, and the optional `waivers` / `performance`
+     * blocks are passed through unchanged.
+     */
+    readonly reportForDisposition: GatesReport;
+    /**
+     * Per-gate evidence keyed by the violation's `gate` field. Only gates
+     * that actually had at least one suppression appear here. Gates with
+     * zero suppressions are intentionally omitted: callers should default
+     * them to `{ waived_count: 0, waiver_ids: [] }` if they need a uniform
+     * shape, but the canonical form is "absent means zero".
+     */
+    readonly waivedByGate: Readonly<Record<string, WaiverEvidence>>;
+}
+/**
+ * Filter `report.violations` against the supplied effective waivers.
+ *
+ * For each violation:
+ *   - look up the effective waivers for that violation's gate (kernel call)
+ *   - if any are effective, the violation is suppressed and the waivers'
+ *     ids are recorded as evidence on that gate's bucket
+ *   - if none are effective, the violation passes through unchanged
+ *
+ * The kernel's effectiveness rule (active && not expired && gate matches
+ * && (no spec_id OR matches input.specId)) is the only applicability
+ * decision. Path scoping is not consulted (see file header).
+ */
+export declare function filterWaivedViolations(input: WaiverFilterInput): WaiverFilterResult;
+//# sourceMappingURL=waiver-filter.d.ts.map

package/dist/shell/gates/waiver-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver-filter.d.ts","sourceRoot":"","sources":["../../../src/shell/gates/waiver-filter.ts"],"names":[],"mappings":"AAiCA,OAAO,EAEL,KAAK,MAAM,EACZ,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,wBAAwB,CAAC;AAE1E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;IACnB;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,GACvB,kBAAkB,CAuEpB"}

package/dist/shell/gates/waiver-filter.js

@@ -0,0 +1,119 @@
+"use strict";
+// Waiver filter — shell-level helper that removes effective-waiver-suppressed
+// violations from a GatesReport before disposition.
+//
+// Discipline:
+//
+//   1. This helper does NOT mutate `policy.gates[gate].mode`. A waived
+//      violation is removed from the blocking calculation, but the gate's
+//      block/warn/skip meaning still comes only from policy. After filtering,
+//      `deriveDispositions(filteredReport, policy)` is run unchanged.
+//
+//   2. Applicability is delegated to the kernel
+//      (`effectiveWaiversForGate`) so kernel rules stay the single source
+//      of truth. The shell only knows: "given the per-gate effective
+//      waivers, drop the violations that match this gate."
+//
+//   3. Path scoping (`scope.paths`) is intentionally absent. The kernel
+//      type does not include it. Doing it half-way here would be worse
+//      than deferring it to a later slice.
+//
+//   4. The "violation matched this gate" rule is the same as
+//      `deriveDispositions`'s grouping rule: violations whose `gate`
+//      field equals a gate in the waiver's `gates` list. We do NOT use
+//      the violation's `severity` field for matching — policy and waivers
+//      are both gate-level constructs in this slice; per-violation
+//      identity (e.g. by rule + subject) is not yet a thing waivers
+//      address.
+//
+//   5. Subprocess "unmatched" gates (gates the subprocess reports but
+//      policy doesn't declare) are never waiver-suppressed: waivers
+//      filter violations that policy can act on, and unmatched gates
+//      are observational by construction. Leaving them untouched here
+//      preserves the existing `unmatchedViolations` surface.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterWaivedViolations = filterWaivedViolations;
+const caws_kernel_1 = require("@paths.design/caws-kernel");
+/**
+ * Filter `report.violations` against the supplied effective waivers.
+ *
+ * For each violation:
+ *   - look up the effective waivers for that violation's gate (kernel call)
+ *   - if any are effective, the violation is suppressed and the waivers'
+ *     ids are recorded as evidence on that gate's bucket
+ *   - if none are effective, the violation passes through unchanged
+ *
+ * The kernel's effectiveness rule (active && not expired && gate matches
+ * && (no spec_id OR matches input.specId)) is the only applicability
+ * decision. Path scoping is not consulted (see file header).
+ */
+function filterWaivedViolations(input) {
+    // Per-gate effective waivers, computed lazily so we don't pay the cost
+    // for gates that have no violations in this report.
+    const effectiveByGate = new Map();
+    const policyGateSet = input.policyGateIds === undefined
+        ? undefined
+        : new Set(input.policyGateIds);
+    function effectiveFor(gate) {
+        // Waivers only touch policy-declared gates. An unmatched (subprocess-
+        // only) violation is observational by construction; letting waivers
+        // suppress it would break that contract and confuse the unmatched
+        // surface in `deriveDispositions`.
+        if (policyGateSet !== undefined && !policyGateSet.has(gate)) {
+            return [];
+        }
+        const cached = effectiveByGate.get(gate);
+        if (cached !== undefined)
+            return cached;
+        const computed = (0, caws_kernel_1.effectiveWaiversForGate)({
+            waivers: input.waivers,
+            gate,
+            specId: input.specId,
+            now: input.now,
+        });
+        effectiveByGate.set(gate, computed);
+        return computed;
+    }
+    const survivors = [];
+    const evidenceByGate = new Map();
+    for (const v of input.report.violations) {
+        const effective = effectiveFor(v.gate);
+        if (effective.length === 0) {
+            survivors.push(v);
+            continue;
+        }
+        // Suppressed. Credit every effective waiver — overlapping coverage is
+        // fine; the audit record names every authorized exception.
+        let bucket = evidenceByGate.get(v.gate);
+        if (bucket === undefined) {
+            bucket = new Set();
+            evidenceByGate.set(v.gate, bucket);
+        }
+        for (const w of effective)
+            bucket.add(w.id);
+    }
+    const waivedByGate = {};
+    for (const [gate, ids] of evidenceByGate) {
+        const sorted = Array.from(ids).sort();
+        // waived_count counts violations on this gate that were suppressed,
+        // not waivers credited. Recompute by re-walking; cheaper than carrying
+        // a parallel counter and keeps the meaning explicit.
+        let count = 0;
+        for (const v of input.report.violations) {
+            if (v.gate !== gate)
+                continue;
+            if (effectiveFor(v.gate).length > 0)
+                count++;
+        }
+        waivedByGate[gate] = {
+            waived_count: count,
+            waiver_ids: sorted,
+        };
+    }
+    const reportForDisposition = {
+        ...input.report,
+        violations: survivors,
+    };
+    return { reportForDisposition, waivedByGate };
+}
+//# sourceMappingURL=waiver-filter.js.map

package/dist/shell/gates/waiver-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiver-filter.js","sourceRoot":"","sources":["../../../src/shell/gates/waiver-filter.ts"],"names":[],"mappings":";AAAA,8EAA8E;AAC9E,oDAAoD;AACpD,EAAE;AACF,cAAc;AACd,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,8EAA8E;AAC9E,sEAAsE;AACtE,EAAE;AACF,gDAAgD;AAChD,0EAA0E;AAC1E,qEAAqE;AACrE,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,uEAAuE;AACvE,2CAA2C;AAC3C,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,mEAAmE;AACnE,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,6DAA6D;;AAkE7D,wDAyEC;AAzID,2DAGmC;AAgDnC;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,KAAwB;IAExB,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC7D,MAAM,aAAa,GACjB,KAAK,CAAC,aAAa,KAAK,SAAS;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,GAAG,CAAS,KAAK,CAAC,aAAa,CAAC,CAAC;IAE3C,SAAS,YAAY,CAAC,IAAY;QAChC,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,mCAAmC;QACnC,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAA,qCAAuB,EAAC;YACvC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,EAAE,KAAK,CAAC,GAAG;SACf,CAAC,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEtD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;YAC3B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,cAAc,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,oEAAoE;QACpE,uEAAuE;QACvE,qDAAqD;QACrD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC9B,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,GAAG;YACnB,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,MAAM;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAgB;QACxC,GAAG,KAAK,CAAC,MAAM;QACf,UAAU,EAAE,SAAS;KACtB,CAAC;IAEF,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC;AAChD,CAAC"}