@rasensio/aidlc 1.16.0 → 1.17.0

package/dist/compliance/check.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `aidlc compliance check` — assess a change against installed pack controls.
+ *
+ * **The central rule: absence of assessment is never a pass.**
+ *
+ * A control's `fails_when` is prose, pinned per control by a human, and no code
+ * evaluates prose. So controls declare `check_kind`: a `mechanical` control carries
+ * a `pattern` this module applies to the diff itself; an `agent` control can only be
+ * assessed in a review session, and its outcome is read from the compliance findings
+ * stream.
+ *
+ * The failure mode this design exists to prevent: if `check` merely read the
+ * agent-written stream, then in continuous integration — no agent, no
+ * `*.compliance.md` — it would find nothing wrong and exit 0 on every change. The
+ * exit-1 gate could never fire, and the surface a buyer pays for would be
+ * permanently, silently green. So an unassessed control is reported as
+ * `pending-agent-review`, and under `--enforce` that exits 2 rather than 0.
+ *
+ * `--enforce` is per-invocation and reads no config. `compliance.enforce` governs
+ * phase transitions only. One key for both would mean a team wanting a failing
+ * pull-request check had to also accept blocking every local phase transition.
+ *
+ * Exit codes:
+ *   0  nothing failing and nothing pending, or advisory mode
+ *   1  a failing critical control under `--enforce`
+ *   2  usage error, pack-load error, or an unassessed control under `--enforce`
+ *
+ * Requirements: compliance-packs/AC-35, AC-36, AC-79, AC-80, AC-86, AC-87,
+ * AC-102, AC-103
+ */
+import type { Control } from './types.js';
+/** What was established about one control for this change. */
+export type ControlOutcome = {
+    control: string;
+    packId: string;
+    status: 'no-issues';
+    how: 'mechanical' | 'agent';
+} | {
+    control: string;
+    packId: string;
+    status: 'failing';
+    how: 'mechanical' | 'agent';
+    severity: Control['severity'];
+    detail: string;
+} | {
+    control: string;
+    packId: string;
+    status: 'pending-agent-review';
+    how: 'agent';
+};
+/** Result of a check run. */
+export interface CheckResult {
+    /** One outcome per applicable control. */
+    controls: ControlOutcome[];
+    /** Whether `--enforce` was passed. */
+    enforce: boolean;
+    /** Non-fatal problems worth printing. */
+    warnings: string[];
+    /** Fatal problems: an installed pack that will not load. */
+    errors: string[];
+    /** The git ref the diff was taken against, or null for the working tree. */
+    diffRef: string | null;
+    exitCode: 0 | 1 | 2;
+}
+export interface CheckOptions {
+    /** Assess the diff against this git ref instead of the working tree. */
+    diffRef?: string;
+    /** Raise the exit code on a failing or unassessed control. */
+    enforce?: boolean;
+}
+/**
+ * Check a change against every installed pack's controls.
+ *
+ * Never throws. A pack that will not load is an error and exit 2, never an empty
+ * result — a check that reported nothing wrong because it could not read its own
+ * rules would be the worst possible outcome.
+ */
+export declare function checkDiff(projectRoot: string, opts?: CheckOptions): CheckResult;
+//# sourceMappingURL=check.d.ts.map

package/dist/compliance/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/compliance/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AASH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GACtB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAA;CAAE,GACrF;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC;IAC5B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,GAAG,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtF,6BAA6B;AAC7B,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAwFD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,GAAE,YAAiB,GAAG,WAAW,CAgHnF"}

package/dist/compliance/check.js

@@ -0,0 +1,224 @@
+/**
+ * `aidlc compliance check` — assess a change against installed pack controls.
+ *
+ * **The central rule: absence of assessment is never a pass.**
+ *
+ * A control's `fails_when` is prose, pinned per control by a human, and no code
+ * evaluates prose. So controls declare `check_kind`: a `mechanical` control carries
+ * a `pattern` this module applies to the diff itself; an `agent` control can only be
+ * assessed in a review session, and its outcome is read from the compliance findings
+ * stream.
+ *
+ * The failure mode this design exists to prevent: if `check` merely read the
+ * agent-written stream, then in continuous integration — no agent, no
+ * `*.compliance.md` — it would find nothing wrong and exit 0 on every change. The
+ * exit-1 gate could never fire, and the surface a buyer pays for would be
+ * permanently, silently green. So an unassessed control is reported as
+ * `pending-agent-review`, and under `--enforce` that exits 2 rather than 0.
+ *
+ * `--enforce` is per-invocation and reads no config. `compliance.enforce` governs
+ * phase transitions only. One key for both would mean a team wanting a failing
+ * pull-request check had to also accept blocking every local phase transition.
+ *
+ * Exit codes:
+ *   0  nothing failing and nothing pending, or advisory mode
+ *   1  a failing critical control under `--enforce`
+ *   2  usage error, pack-load error, or an unassessed control under `--enforce`
+ *
+ * Requirements: compliance-packs/AC-35, AC-36, AC-79, AC-80, AC-86, AC-87,
+ * AC-102, AC-103
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { readComplianceConfig } from './config.js';
+import { parseComplianceFindings } from './findings.js';
+import { resolvePack } from './resolver.js';
+/**
+ * The diff text to assess.
+ *
+ * Working tree by default, so a developer can check before committing. A git failure
+ * yields null, which is reported rather than silently treated as an empty diff — an
+ * empty diff would make every mechanical control pass.
+ */
+function readDiff(projectRoot, ref) {
+    const args = ref === null ? ['diff', '--unified=0'] : ['diff', '--unified=0', ref];
+    try {
+        return execFileSync('git', args, {
+            cwd: projectRoot,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            maxBuffer: 64 * 1024 * 1024,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/** Added lines of a unified diff, without the leading `+`. */
+function addedLines(diff) {
+    return diff
+        .split('\n')
+        .filter((line) => line.startsWith('+') && !line.startsWith('+++'))
+        .map((line) => line.slice(1));
+}
+/**
+ * Agent-assessed outcomes, read from every compliance findings file in the project.
+ *
+ * Keyed by control id. A control cleared in one artifact and failing in another
+ * resolves to failing — the worse reading wins, because a check that reported the
+ * kinder of two answers would be worth nothing.
+ */
+function agentOutcomes(projectRoot) {
+    const byControl = new Map();
+    const warnings = [];
+    const stateDir = join(projectRoot, '.aidlc', 'state');
+    if (!existsSync(stateDir))
+        return { byControl, warnings };
+    for (const instance of readdirSync(stateDir).sort()) {
+        const instanceDir = join(stateDir, instance);
+        let entries;
+        try {
+            entries = readdirSync(instanceDir);
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries.filter((f) => f.endsWith('.compliance.md'))) {
+            let file;
+            try {
+                file = parseComplianceFindings(readFileSync(join(instanceDir, entry), 'utf8'));
+            }
+            catch (err) {
+                warnings.push(`${instance}/${entry} is unreadable (${err.message})`);
+                continue;
+            }
+            warnings.push(...file.warnings.map((w) => `${instance}/${entry}: ${w}`));
+            for (const id of file.cleared) {
+                if (!byControl.has(id))
+                    byControl.set(id, { status: 'no-issues' });
+            }
+            for (const finding of file.findings) {
+                if (finding.control === undefined)
+                    continue;
+                if (finding.status !== 'open' || finding.placeholder === true)
+                    continue;
+                // Failing always overrides a cleared reading from elsewhere.
+                byControl.set(finding.control, {
+                    status: 'failing',
+                    severity: finding.severity,
+                    detail: finding.issue ?? finding.title,
+                });
+            }
+        }
+    }
+    return { byControl, warnings };
+}
+/**
+ * Check a change against every installed pack's controls.
+ *
+ * Never throws. A pack that will not load is an error and exit 2, never an empty
+ * result — a check that reported nothing wrong because it could not read its own
+ * rules would be the worst possible outcome.
+ */
+export function checkDiff(projectRoot, opts = {}) {
+    const enforce = opts.enforce === true;
+    const diffRef = opts.diffRef ?? null;
+    const warnings = [];
+    const errors = [];
+    const config = readComplianceConfig(projectRoot);
+    if (config.packs.length === 0) {
+        return {
+            controls: [],
+            enforce,
+            warnings,
+            errors,
+            diffRef,
+            exitCode: 0,
+        };
+    }
+    const applicable = [];
+    for (const record of config.packs) {
+        const resolved = resolvePack(record.id);
+        if (!resolved.ok) {
+            errors.push(`installed pack '${record.id}' did not load: ${resolved.error.errors.join('; ')}`);
+            continue;
+        }
+        for (const control of resolved.pack.controls) {
+            applicable.push({ packId: record.id, control });
+        }
+    }
+    if (errors.length > 0) {
+        return { controls: [], enforce, warnings, errors, diffRef, exitCode: 2 };
+    }
+    const diff = readDiff(projectRoot, diffRef);
+    if (diff === null) {
+        // Not a git repository, or a bad ref. Mechanical controls cannot be assessed, and
+        // treating that as "nothing matched" would report a pass nobody earned.
+        warnings.push(diffRef === null
+            ? 'could not read a diff — mechanical controls cannot be assessed here'
+            : `could not read a diff against '${diffRef}' — mechanical controls cannot be assessed`);
+    }
+    const added = diff === null ? null : addedLines(diff);
+    const { byControl, warnings: agentWarnings } = agentOutcomes(projectRoot);
+    warnings.push(...agentWarnings);
+    const controls = [];
+    for (const { packId, control } of applicable) {
+        // An agent assessment always wins: a human looked at this control against this
+        // change, which is strictly better evidence than a pattern match.
+        const assessed = byControl.get(control.id);
+        if (assessed?.status === 'failing') {
+            controls.push({
+                control: control.id,
+                packId,
+                status: 'failing',
+                how: 'agent',
+                severity: assessed.severity ?? control.severity,
+                detail: assessed.detail ?? control.fails_when,
+            });
+            continue;
+        }
+        if (control.check_kind === 'mechanical' && control.pattern !== undefined) {
+            if (added === null) {
+                // No diff to match against. Not a pass.
+                controls.push({ control: control.id, packId, status: 'pending-agent-review', how: 'agent' });
+                continue;
+            }
+            const re = new RegExp(control.pattern);
+            const hit = added.find((line) => re.test(line));
+            if (hit !== undefined) {
+                controls.push({
+                    control: control.id,
+                    packId,
+                    status: 'failing',
+                    how: 'mechanical',
+                    severity: control.severity,
+                    detail: `${control.fails_when} — matched an added line`,
+                });
+            }
+            else {
+                controls.push({ control: control.id, packId, status: 'no-issues', how: 'mechanical' });
+            }
+            continue;
+        }
+        if (assessed?.status === 'no-issues') {
+            controls.push({ control: control.id, packId, status: 'no-issues', how: 'agent' });
+            continue;
+        }
+        controls.push({ control: control.id, packId, status: 'pending-agent-review', how: 'agent' });
+    }
+    const failingCritical = controls.some((c) => c.status === 'failing' && c.severity === 'critical');
+    const pending = controls.some((c) => c.status === 'pending-agent-review');
+    // Advisory mode reports everything and exits 0. Under enforcement, a failing
+    // critical control is 1 and an unassessed control is 2 — the continuous-integration
+    // case, where exiting 0 would be a silent false green.
+    let exitCode = 0;
+    if (enforce) {
+        if (failingCritical)
+            exitCode = 1;
+        else if (pending)
+            exitCode = 2;
+    }
+    return { controls, enforce, warnings, errors, diffRef, exitCode };
+}
+//# sourceMappingURL=check.js.map

package/dist/compliance/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/compliance/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAsC5C;;;;;;GAMG;AACH,SAAS,QAAQ,CAAC,WAAmB,EAAE,GAAkB;IACvD,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,WAAmB;IAIxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAGtB,CAAC;IACJ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAE1D,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,IAAI,CAAC;YACT,IAAI,CAAC;gBACH,IAAI,GAAG,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,mBAAoB,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAEzE,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;oBAAE,SAAS;gBAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI;oBAAE,SAAS;gBACxE,6DAA6D;gBAC7D,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE;oBAC7B,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;iBACvC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,WAAmB,EAAE,OAAqB,EAAE;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,OAAO;YACP,QAAQ;YACR,MAAM;YACN,OAAO;YACP,QAAQ,EAAE,CAAC;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAA2C,EAAE,CAAC;IAC9D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,EAAE,mBAAmB,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/F,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,kFAAkF;QAClF,wEAAwE;QACxE,QAAQ,CAAC,IAAI,CACX,OAAO,KAAK,IAAI;YACd,CAAC,CAAC,qEAAqE;YACvE,CAAC,CAAC,kCAAkC,OAAO,4CAA4C,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAEtD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;IAEhC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;QAC7C,+EAA+E;QAC/E,kEAAkE;QAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,OAAO,CAAC,EAAE;gBACnB,MAAM;gBACN,MAAM,EAAE,SAAS;gBACjB,GAAG,EAAE,OAAO;gBACZ,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;gBAC/C,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU;aAC9C,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,KAAK,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACzE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,wCAAwC;gBACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC7F,SAAS;YACX,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAChD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,MAAM;oBACN,MAAM,EAAE,SAAS;oBACjB,GAAG,EAAE,YAAY;oBACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,0BAA0B;iBACxD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,EAAE,MAAM,KAAK,WAAW,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAC3D,CAAC;IACF,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC;IAE1E,6EAA6E;IAC7E,oFAAoF;IACpF,uDAAuD;IACvD,IAAI,QAAQ,GAAc,CAAC,CAAC;IAC5B,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,eAAe;YAAE,QAAQ,GAAG,CAAC,CAAC;aAC7B,IAAI,OAAO;YAAE,QAAQ,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACpE,CAAC"}

package/dist/compliance/config.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The `compliance:` section of `.aidlc/config.yaml`.
+ *
+ * Owns one section and nothing else. There is no central config loader in this
+ * codebase — ten call sites each join the path and parse it inline — and unifying
+ * them is out of scope here, so this module is deliberately narrow rather than an
+ * eleventh ad-hoc parse pretending to be general.
+ *
+ * The record shape exists to answer three questions no other state can:
+ *
+ * - **Is this layer locally edited?** By comparing the on-disk hash against the
+ *   hash recorded *at install*. Comparing against the currently bundled body —
+ *   what the framework path does, correctly, for its own layers — would make every
+ *   installed layer read as edited the moment pack content is updated upstream, so
+ *   `remove` would refuse to delete anything and corrected control text would never
+ *   land.
+ * - **Which instances does a report cover?** By comparing each instance's
+ *   completion moment against `installed_at`. A pack cannot evidence a change that
+ *   predates it.
+ * - **Is an installed pack stale?** By comparing `version` against the resolvable
+ *   one. Reported, never silently upgraded.
+ *
+ * Requirements: compliance-packs/AC-70, AC-71
+ */
+import type { ModifiedDetector } from '../compile/layer-install.js';
+/** One installed file, with the hash it had when it was written. */
+export interface InstalledFile {
+    /** Filename within `.aidlc/guidance/`, as registered. */
+    path: string;
+    /** Hex sha256 of the bytes written at install. */
+    sha256: string;
+}
+/** One installed pack, as recorded in the project config. */
+export interface InstalledPack {
+    id: string;
+    /** Pack content version at the time of install. */
+    version: string;
+    /** ISO 8601 UTC. Bounds the report's default scope. */
+    installed_at: string;
+    files: InstalledFile[];
+}
+/** The `compliance:` section. */
+export interface ComplianceConfig {
+    /**
+     * Whether a critical control finding blocks a phase transition.
+     *
+     * Governs transitions only. The diff check takes `--enforce` per invocation, so
+     * a team can have a failing continuous-integration check without also blocking
+     * every local phase transition.
+     */
+    enforce: boolean;
+    packs: InstalledPack[];
+}
+/** The empty state: no packs, no enforcement. Distinct from "no section at all". */
+export declare const EMPTY_COMPLIANCE: ComplianceConfig;
+/** Hex sha256 of a string, as written to disk. */
+export declare function hashContent(content: string): string;
+/**
+ * Read the `compliance:` section.
+ *
+ * A malformed section reads as empty rather than throwing, because every consumer
+ * of this — the gate criterion, the report, the check — must degrade to "no packs
+ * installed" rather than break an unrelated command. A malformed section is
+ * reported by `aidlc doctor`, which is where a repair belongs.
+ */
+export declare function readComplianceConfig(projectRoot: string): ComplianceConfig;
+/**
+ * Write the `compliance:` section, leaving every other section untouched.
+ *
+ * The whole document is read, one key is replaced, and the document is written
+ * back — so a hand-added section survives, the same guarantee `computeSetup` gives
+ * for the sections it does not own.
+ */
+export declare function writeComplianceConfig(projectRoot: string, config: ComplianceConfig): void;
+/** The record for one installed pack, or null when it is not installed. */
+export declare function findInstalledPack(config: ComplianceConfig, id: string): InstalledPack | null;
+/**
+ * A modified-detector that compares against the hash recorded at install.
+ *
+ * This is the pack rule, and it is the reason `installLayers` takes the detector
+ * as a parameter rather than hard-coding one. `bundledBodyDiffers` answers "does
+ * this differ from what we ship *now*", which for a pack conflates "the user
+ * edited it" with "we published a new version".
+ *
+ * A file with no recorded hash counts as modified: we have no evidence we wrote
+ * it, so it is not ours to delete.
+ */
+export declare function recordedHashDiffers(pack: InstalledPack | null): ModifiedDetector;
+/** True when the pack is installed and its recorded version differs from `available`. */
+export declare function isStale(pack: InstalledPack | null, available: string): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/compliance/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/compliance/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAQH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,EAAE,gBAAgD,CAAC;AAEhF,kDAAkD;AAClD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAwCD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAW1E;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAkBzF;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAE5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,gBAAgB,CAchF;AAeD,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9E"}

package/dist/compliance/config.js

@@ -0,0 +1,173 @@
+/**
+ * The `compliance:` section of `.aidlc/config.yaml`.
+ *
+ * Owns one section and nothing else. There is no central config loader in this
+ * codebase — ten call sites each join the path and parse it inline — and unifying
+ * them is out of scope here, so this module is deliberately narrow rather than an
+ * eleventh ad-hoc parse pretending to be general.
+ *
+ * The record shape exists to answer three questions no other state can:
+ *
+ * - **Is this layer locally edited?** By comparing the on-disk hash against the
+ *   hash recorded *at install*. Comparing against the currently bundled body —
+ *   what the framework path does, correctly, for its own layers — would make every
+ *   installed layer read as edited the moment pack content is updated upstream, so
+ *   `remove` would refuse to delete anything and corrected control text would never
+ *   land.
+ * - **Which instances does a report cover?** By comparing each instance's
+ *   completion moment against `installed_at`. A pack cannot evidence a change that
+ *   predates it.
+ * - **Is an installed pack stale?** By comparing `version` against the resolvable
+ *   one. Reported, never silently upgraded.
+ *
+ * Requirements: compliance-packs/AC-70, AC-71
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { serializeYaml } from '../state/yaml-helpers.js';
+/** The empty state: no packs, no enforcement. Distinct from "no section at all". */
+export const EMPTY_COMPLIANCE = { enforce: false, packs: [] };
+/** Hex sha256 of a string, as written to disk. */
+export function hashContent(content) {
+    return createHash('sha256').update(content, 'utf8').digest('hex');
+}
+/** Absolute path of a project's config file. */
+function configPath(projectRoot) {
+    return join(projectRoot, '.aidlc', 'config.yaml');
+}
+/** Read the whole config document, or an empty object when absent or unusable. */
+function readConfigDocument(projectRoot) {
+    const path = configPath(projectRoot);
+    if (!existsSync(path))
+        return {};
+    try {
+        const parsed = parseYaml(readFileSync(path, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return {};
+        return parsed;
+    }
+    catch {
+        return {};
+    }
+}
+/** Narrow an unknown value to an `InstalledFile`, or null. */
+function toInstalledFile(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const r = raw;
+    if (typeof r.path !== 'string' || typeof r.sha256 !== 'string')
+        return null;
+    return { path: r.path, sha256: r.sha256 };
+}
+/** Narrow an unknown value to an `InstalledPack`, or null. */
+function toInstalledPack(raw) {
+    if (typeof raw !== 'object' || raw === null)
+        return null;
+    const r = raw;
+    if (typeof r.id !== 'string' || typeof r.version !== 'string')
+        return null;
+    if (typeof r.installed_at !== 'string')
+        return null;
+    const files = Array.isArray(r.files)
+        ? r.files.map(toInstalledFile).filter((f) => f !== null)
+        : [];
+    return { id: r.id, version: r.version, installed_at: r.installed_at, files };
+}
+/**
+ * Read the `compliance:` section.
+ *
+ * A malformed section reads as empty rather than throwing, because every consumer
+ * of this — the gate criterion, the report, the check — must degrade to "no packs
+ * installed" rather than break an unrelated command. A malformed section is
+ * reported by `aidlc doctor`, which is where a repair belongs.
+ */
+export function readComplianceConfig(projectRoot) {
+    const doc = readConfigDocument(projectRoot);
+    const section = doc.compliance;
+    if (typeof section !== 'object' || section === null || Array.isArray(section)) {
+        return { ...EMPTY_COMPLIANCE, packs: [] };
+    }
+    const s = section;
+    const packs = Array.isArray(s.packs)
+        ? s.packs.map(toInstalledPack).filter((p) => p !== null)
+        : [];
+    return { enforce: s.enforce === true, packs };
+}
+/**
+ * Write the `compliance:` section, leaving every other section untouched.
+ *
+ * The whole document is read, one key is replaced, and the document is written
+ * back — so a hand-added section survives, the same guarantee `computeSetup` gives
+ * for the sections it does not own.
+ */
+export function writeComplianceConfig(projectRoot, config) {
+    const doc = readConfigDocument(projectRoot);
+    if (config.packs.length === 0 && !config.enforce) {
+        // No packs and no enforcement is indistinguishable from never having had a
+        // section, and an empty stanza invites the question of what it means.
+        delete doc.compliance;
+    }
+    else {
+        doc.compliance = {
+            enforce: config.enforce,
+            packs: config.packs.map((p) => ({
+                id: p.id,
+                version: p.version,
+                installed_at: p.installed_at,
+                files: p.files.map((f) => ({ path: f.path, sha256: f.sha256 })),
+            })),
+        };
+    }
+    writeFileSync(configPath(projectRoot), serializeYaml(doc), 'utf8');
+}
+/** The record for one installed pack, or null when it is not installed. */
+export function findInstalledPack(config, id) {
+    return config.packs.find((p) => p.id === id) ?? null;
+}
+/**
+ * A modified-detector that compares against the hash recorded at install.
+ *
+ * This is the pack rule, and it is the reason `installLayers` takes the detector
+ * as a parameter rather than hard-coding one. `bundledBodyDiffers` answers "does
+ * this differ from what we ship *now*", which for a pack conflates "the user
+ * edited it" with "we published a new version".
+ *
+ * A file with no recorded hash counts as modified: we have no evidence we wrote
+ * it, so it is not ours to delete.
+ */
+export function recordedHashDiffers(pack) {
+    const byPath = new Map((pack?.files ?? []).map((f) => [f.path, f.sha256]));
+    return (targetPath) => {
+        const recorded = byPath.get(basenameOf(targetPath));
+        if (recorded === undefined)
+            return true;
+        let actual;
+        try {
+            actual = hashContent(readFileSync(targetPath, 'utf8'));
+        }
+        catch {
+            // Unreadable now, so not safely ours to act on.
+            return true;
+        }
+        return actual !== recorded;
+    };
+}
+/**
+ * The registered filename of a target path.
+ *
+ * Recorded paths are the `file` values from a pack's index — relative names inside
+ * `.aidlc/guidance/` — while the detector receives an absolute path. Matching on
+ * the trailing segments keeps the two comparable without either side needing to
+ * know the project root.
+ */
+function basenameOf(targetPath) {
+    const parts = targetPath.split(/[\\/]/);
+    return parts[parts.length - 1] ?? targetPath;
+}
+/** True when the pack is installed and its recorded version differs from `available`. */
+export function isStale(pack, available) {
+    return pack !== null && pack.version !== available;
+}
+//# sourceMappingURL=config.js.map

package/dist/compliance/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/compliance/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAkCzD,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAEhF,kDAAkD;AAClD,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,gDAAgD;AAChD,SAAS,UAAU,CAAC,WAAmB;IACrC,OAAO,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AACpD,CAAC;AAED,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,8DAA8D;AAC9D,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAClC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,GAAG,gBAAgB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,GAAG,OAAkC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAClC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,MAAwB;IACjF,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjD,2EAA2E;QAC3E,sEAAsE;QACtE,OAAO,GAAG,CAAC,UAAU,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,UAAU,GAAG;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;aAChE,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,MAAwB,EAAE,EAAU;IACpE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,CAAC,UAAkB,EAAE,EAAE;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,KAAK,QAAQ,CAAC;IAC7B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,UAAkB;IACpC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,UAAU,CAAC;AAC/C,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,IAA0B,EAAE,SAAiB;IACnE,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AACrD,CAAC"}