@smartmemory/stratum 0.3.3 → 0.4.0

package/dist/engine/evaluate.js

@@ -0,0 +1,61 @@
+import { spawn } from "node:child_process";
+/**
+ * Default `EvaluateRunner`: runs the declared command through `/bin/sh -c`,
+ * hands the bound input to it as JSON on stdin, and reads a JSON verdict from
+ * stdout. It only classifies the *transport* outcome — exit / timeout / parse.
+ * The engine owns the trust schema, so this never fabricates a verdict.
+ */
+export function createEvaluateRunner() {
+    return ({ command, input, timeoutMs }, context) => new Promise((resolve) => {
+        // `detached` makes the shell its own process-group leader, so a timeout
+        // can SIGKILL the whole tree (`-pid`) — killing only the shell would
+        // orphan grandchildren it backgrounded, leaking work and stdio handles.
+        const child = spawn("/bin/sh", ["-c", command], {
+            ...(context.workspaceRoot !== undefined ? { cwd: context.workspaceRoot } : {}),
+            stdio: ["pipe", "pipe", "pipe"],
+            detached: true,
+        });
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        const timer = setTimeout(() => {
+            // Kill the process group, not just the shell, so backgrounded children die too.
+            try {
+                if (child.pid !== undefined)
+                    process.kill(-child.pid, "SIGKILL");
+            }
+            catch { /* already exited */ }
+            finish({ ok: false, kind: "timeout", reason: `command exceeded ${timeoutMs}ms` });
+        }, timeoutMs);
+        child.stdout.on("data", (chunk) => { stdout += String(chunk); });
+        child.stderr.on("data", (chunk) => { stderr += String(chunk); });
+        child.on("error", (error) => finish({ ok: false, kind: "exit", reason: error.message }));
+        child.on("close", (code) => {
+            if (code !== 0) {
+                finish({ ok: false, kind: "exit", reason: `exit code ${String(code)}${stderr ? `: ${stderr.trim()}` : ""}` });
+                return;
+            }
+            try {
+                finish({ ok: true, result: JSON.parse(stdout) });
+            }
+            catch (error) {
+                finish({ ok: false, kind: "parse", reason: error instanceof Error ? error.message : String(error) });
+            }
+        });
+        // A command that never reads stdin (and has already exited) turns this
+        // write into an EPIPE on the pipe; swallow it — the close/error handlers
+        // above carry the real outcome. Left unhandled it crashes the process.
+        child.stdin.on("error", () => { });
+        if (input !== undefined)
+            child.stdin.write(JSON.stringify(input));
+        child.stdin.end();
+    });
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/engine/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../src/engine/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,CAChD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;YAC9C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAA2C,EAAE,EAAE;YAC7D,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,gFAAgF;YAChF,IAAI,CAAC;gBAAC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACxG,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,SAAS,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC9G,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/engine/ledger.js

@@ -33,4 +33,16 @@ export function validUsage(value) {
         return false;
     return Object.entries(value).every(([key, amount]) => BUDGET_KEYS.includes(key) && typeof amount === "number" && Number.isFinite(amount) && amount >= 0);
 }
+export function validConnectorTelemetry(value) {
+    if (value === undefined)
+        return true;
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const telemetry = value;
+    if (Object.keys(telemetry).some((key) => !["durationMs", "model", "effort"].includes(key)))
+        return false;
+    return typeof telemetry.durationMs === "number" && Number.isFinite(telemetry.durationMs) && telemetry.durationMs >= 0
+        && typeof telemetry.model === "string" && telemetry.model.length > 0
+        && (telemetry.effort === undefined || (typeof telemetry.effort === "string" && telemetry.effort.length > 0));
+}
 //# sourceMappingURL=ledger.js.map

package/dist/engine/ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/engine/ledger.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAU,CAAC;AAS1E,SAAS,UAAU,CAAC,MAA0B;IAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,YAAY;IACd,MAAM,CAAU;IAChB,KAAK,CAAS;IAEvB,YAAY,MAAe,EAAE,QAAgB,EAAE;QAC7C,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAc;QAClB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACxG,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAClD,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CACzH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../src/engine/ledger.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAU,CAAC;AAS1E,SAAS,UAAU,CAAC,MAA0B;IAC5C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,YAAY;IACd,MAAM,CAAU;IAChB,KAAK,CAAS;IAEvB,YAAY,MAAe,EAAE,QAAgB,EAAE;QAC7C,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ,CAAC,MAAc;QACrB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAc;QAClB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACxG,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAClD,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CACzH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzG,OAAO,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,IAAI,CAAC;WAChH,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;WACjE,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC"}

package/dist/engine/receipts.js

@@ -0,0 +1,91 @@
+import { BUDGET_KEYS, validConnectorTelemetry, validUsage } from "./ledger.js";
+export class ReceiptValidationError extends Error {
+    errorType;
+    constructor(message, errorType = "invalid_receipt") {
+        super(message);
+        this.name = "ReceiptValidationError";
+        this.errorType = errorType;
+    }
+}
+export function buildReceipt(run, input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input))
+        invalid("receipt must be an object");
+    if (typeof input.dispatchId !== "string" || input.dispatchId.length === 0)
+        invalid("dispatchId must be a non-empty string");
+    if (input.stepId !== undefined && (typeof input.stepId !== "string" || input.stepId.length === 0)) {
+        invalid("stepId must be a non-empty string when present");
+    }
+    if (typeof input.source !== "string" || input.source.length === 0)
+        invalid("source must be a non-empty string");
+    if (!validUsage(input.usage))
+        invalid("usage must be a valid non-negative budget object");
+    if (Object.hasOwn(input.usage, "dispatches"))
+        invalid("dispatches are engine-accounted and cannot appear in a receipt");
+    if (!validConnectorTelemetry(input.telemetry))
+        invalid("telemetry must contain a non-empty model and non-negative durationMs");
+    if (input.usage.usd !== undefined && input.usdSource === undefined)
+        invalid("usdSource is required when usage.usd is present");
+    if (input.usdSource !== undefined && !["reported", "estimated", "legacy"].includes(input.usdSource)) {
+        invalid('usdSource must be "reported", "estimated", or "legacy"');
+    }
+    if (input.at !== undefined && typeof input.at !== "string")
+        invalid("at must be a string when present");
+    if (input.split !== undefined && !validSplit(input.split))
+        invalid("split must contain non-negative input/output token counts");
+    if (input.detail !== undefined && !isPlainObject(input.detail))
+        invalid("detail must be a plain object when present");
+    const telemetry = input.telemetry ?? { model: "unknown", durationMs: 0 };
+    const seq = (run.receiptCounter ?? 0) + 1;
+    run.receiptCounter = seq;
+    return {
+        seq,
+        dispatchId: input.dispatchId,
+        ...(input.stepId !== undefined ? { stepId: input.stepId } : {}),
+        source: input.source,
+        amount: { ...input.usage },
+        telemetry: { ...telemetry },
+        ...(input.split !== undefined ? { split: { ...input.split } } : {}),
+        ...(input.usdSource !== undefined ? { usdSource: input.usdSource } : {}),
+        ...(input.at !== undefined ? { reportedAt: input.at } : {}),
+        ...(input.detail !== undefined ? { detail: { ...input.detail } } : {}),
+        at: new Date().toISOString(),
+        egress: "pending",
+    };
+}
+export function findReceipt(run, dispatchId) {
+    return run.receipts?.find((receipt) => receipt.dispatchId === dispatchId);
+}
+export function spineSpent(run) {
+    const spent = {};
+    for (const receipt of run.receipts ?? []) {
+        for (const key of BUDGET_KEYS) {
+            const amount = receipt.amount[key];
+            if (amount !== undefined && amount !== 0)
+                spent[key] = (spent[key] ?? 0) + amount;
+        }
+    }
+    return spent;
+}
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function validSplit(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const split = value;
+    if (Object.keys(split).some((key) => !["input", "output", "cacheRead", "cacheCreation"].includes(key)))
+        return false;
+    return nonNegative(split.input) && nonNegative(split.output)
+        && (split.cacheRead === undefined || nonNegative(split.cacheRead))
+        && (split.cacheCreation === undefined || nonNegative(split.cacheCreation));
+}
+function nonNegative(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function invalid(message) {
+    throw new ReceiptValidationError(message);
+}
+//# sourceMappingURL=receipts.js.map

package/dist/engine/receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../../src/engine/receipts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAe,uBAAuB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAe5F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,SAAS,CAAqC;IAEvD,YAAY,OAAe,EAAE,YAAiD,iBAAiB;QAC7F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,YAAY,CAAC,GAAiB,EAAE,KAAmB;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9G,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC5H,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAChH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,kDAAkD,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC;QAAE,OAAO,CAAC,gEAAgE,CAAC,CAAC;IACxH,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,sEAAsE,CAAC,CAAC;IAC/H,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,iDAAiD,CAAC,CAAC;IAC/H,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpG,OAAO,CAAC,wDAAwD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,2DAA2D,CAAC,CAAC;IAChI,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,4CAA4C,CAAC,CAAC;IAEtH,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACzE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC;IACzB,OAAO;QACL,GAAG;QACH,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE;QAC1B,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE;QAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAiB,EAAE,UAAkB;IAC/D,OAAO,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAiB;IAC1C,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACzC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrH,OAAO,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;WACvD,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;WAC/D,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/engine/state.js

@@ -16,7 +16,9 @@ export class StateStore {
         await rename(temporary, path);
     }
     async load(runId) {
-        return JSON.parse(await readFile(this.path(runId), "utf8"));
+        const run = JSON.parse(await readFile(this.path(runId), "utf8"));
+        migrateLegacyPolicyRules(run);
+        return run;
     }
     async list() {
         let names;
@@ -36,6 +38,54 @@ export class StateStore {
         return join(this.root, `${runId}.json`);
     }
 }
+function migrateLegacyPolicyRules(run) {
+    if (run.policy_rules === undefined || run.policy_rules_version === 2)
+        return;
+    const scoped = new Map();
+    const flows = specificationFlows(run.spec);
+    for (const [flowName, stepIds] of flows) {
+        for (const stepId of stepIds)
+            scoped.set(`${flowName}/${stepId}`, `${flowName}/${stepId}`);
+    }
+    const migrated = {};
+    for (const [legacyKey, bindings] of Object.entries(run.policy_rules)) {
+        let target = scoped.get(legacyKey);
+        if (target === undefined) {
+            const matches = flows.filter(([, stepIds]) => stepIds.has(legacyKey)).map(([flowName]) => flowName);
+            if (matches.length !== 1) {
+                const detail = matches.length === 0
+                    ? "does not exist in any flow"
+                    : `is ambiguous across flows ${matches.map((name) => JSON.stringify(name)).join(", ")}`;
+                throw new Error(`run ${run.id}: legacy policy_rules step ${JSON.stringify(legacyKey)} ${detail}; re-plan required`);
+            }
+            target = `${matches[0]}/${legacyKey}`;
+        }
+        (migrated[target] ??= []).push(...bindings);
+    }
+    run.policy_rules = migrated;
+    run.policy_rules_version = 2;
+}
+function specificationFlows(spec) {
+    if (spec === null || typeof spec !== "object" || Array.isArray(spec))
+        return [];
+    const flows = spec.flows;
+    if (flows === null || typeof flows !== "object" || Array.isArray(flows))
+        return [];
+    return Object.entries(flows).flatMap(([flowName, flow]) => {
+        if (flowName === "entry" || flow === null || typeof flow !== "object" || Array.isArray(flow))
+            return [];
+        const steps = flow.steps;
+        if (!Array.isArray(steps))
+            return [];
+        const ids = steps.flatMap((step) => {
+            if (step === null || typeof step !== "object" || Array.isArray(step))
+                return [];
+            const id = step.id;
+            return typeof id === "string" ? [id] : [];
+        });
+        return [[flowName, new Set(ids)]];
+    });
+}
 function isNotFound(error) {
     return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }

package/dist/engine/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/engine/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA0M1C,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IAEtB,YAAY,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,oFAAoF;QACpF,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,iBAAiB,EAAE,MAAM,CAAC;QACtE,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7G,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACnG,CAAC"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/engine/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuO1C,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B,MAAM,OAAO,UAAU;IACZ,IAAI,CAAS;IAEtB,YAAY,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAiB;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,oFAAoF;QACpF,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,iBAAiB,EAAE,MAAM,CAAC;QACtE,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAiB,CAAC;QACjF,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7G,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,wBAAwB,CAAC,GAAiB;IACjD,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC;QAAE,OAAO;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,IAAI,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;oBACjC,CAAC,CAAC,4BAA4B;oBAC9B,CAAC,CAAC,6BAA6B,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1F,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,MAAM,oBAAoB,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,IAAI,SAAS,EAAE,CAAC;QACzC,CAAC;QACD,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC9C,CAAC;IACD,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;IAC5B,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAChF,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAgC,EAAE;QACtF,IAAI,QAAQ,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QACxG,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChF,MAAM,EAAE,GAAI,IAAyB,CAAC,EAAE,CAAC;YACzC,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AACnG,CAAC"}

package/dist/guard/authorization.js

@@ -0,0 +1,71 @@
+/**
+ * Signed one-shot authorizations for the two privileged guard operations that a
+ * reviewed descriptor cannot express: `guardOverride` (bypass predicates on one
+ * edge) and `guardMigrate` (arbitrary policy change, the emergency path).
+ *
+ * Replaces `STRATUM_GUARD_OVERRIDE_TOKEN`, which was a shared secret compared
+ * against the environment of whatever process happened to be running — so over
+ * the CLI a caller set both sides of the comparison and they matched. Verified
+ * empirically before removal: an honest transition was refused, and the same walk
+ * with a self-invented token returned `deviation` and moved the state.
+ *
+ * The replacement is a signature over a payload the SERVER reconstructs, so
+ * nothing about the authorization travels except the signature itself. Two
+ * properties fall out of that:
+ *
+ * - **It cannot be forged**, because the signing key's passphrase lives only in
+ *   the operator's head (see `contracts/guard-signers.allowed`).
+ * - **It cannot be replayed**, because the payload includes the resource's
+ *   current ledger head. An authorization is valid at exactly one point in that
+ *   resource's history; once it is used, the head has moved and the same
+ *   signature is dead. No clock, no nonce store, no expiry to tune.
+ */
+import { canonicalJson } from "./canonical.js";
+import { OverrideUnavailable } from "./errors.js";
+import { sshFingerprint, verifySshsig } from "./sshsig.js";
+import { loadAllowedSigners } from "./trust.js";
+/** One namespace per purpose, so an authorization for one can never act as another. */
+export const AUTHORIZATION_NAMESPACES = {
+    override: "stratum-guard-override",
+    migrate: "stratum-guard-migrate",
+};
+/**
+ * The exact bytes an operator signs. Canonical JSON so the operator's tooling
+ * and the server agree byte-for-byte without either transporting the payload.
+ */
+export function authorizationPayload(kind, fields) {
+    return canonicalJson({ action: kind, ...fields });
+}
+/**
+ * Verify `armored` authorizes exactly this operation on this resource at this
+ * point in its history. Throws `OverrideUnavailable` on every failure — the same
+ * slug the token check used, so callers and the error contract are unchanged.
+ */
+export function verifyAuthorization(kind, fields, armored) {
+    if (!armored || !armored.trim()) {
+        throw new OverrideUnavailable(`${kind} requires a signed authorization (see "stratum guard authorize")`);
+    }
+    let signers;
+    try {
+        signers = loadAllowedSigners();
+    }
+    catch (error) {
+        throw new OverrideUnavailable(error instanceof Error ? error.message : String(error));
+    }
+    const payload = Buffer.from(authorizationPayload(kind, fields), "utf8");
+    let key;
+    try {
+        key = verifySshsig(payload, armored, AUTHORIZATION_NAMESPACES[kind], signers.map((signer) => signer.publicKey));
+    }
+    catch (error) {
+        // The payload is echoed back because the most common honest failure is a
+        // stale ledger_head — the operator signed, the resource moved, and they need
+        // to see what the server expected in order to re-sign.
+        throw new OverrideUnavailable(`${kind} authorization rejected: ${error instanceof Error ? error.message : String(error)}; `
+            + `expected a signature over ${authorizationPayload(kind, fields)}`);
+    }
+    const fingerprint = sshFingerprint(key);
+    const signer = signers.find((entry) => entry.fingerprint === fingerprint);
+    return { principal: signer.principal, fingerprint };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/guard/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/guard/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,QAAQ,EAAE,wBAAwB;IAClC,OAAO,EAAE,uBAAuB;CACxB,CAAC;AAqBX;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB,EAAE,MAA2B;IACvF,OAAO,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACpD,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,MAA2B,EAC3B,OAAe;IAEf,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAC3B,GAAG,IAAI,kEAAkE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,wBAAwB,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAClH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,6EAA6E;QAC7E,uDAAuD;QACvD,MAAM,IAAI,mBAAmB,CAC3B,GAAG,IAAI,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;cAC3F,6BAA6B,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAE,CAAC;IAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC;AACtD,CAAC"}

package/dist/guard/descriptors.js

@@ -0,0 +1,248 @@
+/**
+ * Server-owned guard upgrade descriptors — the authorization primitive that
+ * lets a pre-reviewed policy change be applied without the break-glass override
+ * token. See `docs/features/STRAT-GUARD-DESCRIPTOR/design.md`.
+ *
+ * Authorization is a SIGNATURE, not a value in the environment. The descriptor
+ * file must carry an sshsig (`ssh-keygen -Y sign`) from a key listed in the
+ * in-source trust root `contracts/guard-signers.allowed`, under the namespace
+ * `stratum-guard-descriptors`.
+ *
+ * Why a signature and not the digest pin this replaced: the threat model is an
+ * agent with a shell and the operator's filesystem privileges. Such an agent can
+ * set any environment variable, so an env-anchored digest is only as strong as
+ * the process that reads it — over a CLI, the caller sets both the file and the
+ * pin and they agree. It cannot, however, produce an Ed25519 signature without
+ * the private key, whose passphrase lives only in the operator's head. The
+ * remaining move is to edit the committed trust root, which is loud and shows up
+ * in review rather than being invisible.
+ *
+ * The descriptor file's PATH still comes from the environment. Locating an
+ * artifact is not authorizing it: point this anywhere, the signature still has
+ * to verify.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { isAbsolute } from "node:path";
+import { UpgradeDescriptorUnavailable } from "./errors.js";
+import { SshsigError, sshFingerprint, verifySshsig } from "./sshsig.js";
+import { loadAllowedSigners } from "./trust.js";
+export const DESCRIPTOR_PATH_ENV = "STRATUM_GUARD_UPGRADE_DESCRIPTORS";
+/** sshsig namespace for descriptor-file signatures; distinct per authorization purpose. */
+export const DESCRIPTOR_NAMESPACE = "stratum-guard-descriptors";
+export { setGuardTrustRootForTests } from "./trust.js";
+const DESCRIPTOR_ID_PATTERN = /^[A-Za-z0-9_.-]+$/;
+const DESCRIPTOR_KEYS = new Set(["id", "rationale", "from_checksum", "to_policy"]);
+const POLICY_KEYS = new Set(["graph", "edge_predicates", "terminal", "stakes"]);
+const FILE_KEYS = new Set(["version", "descriptors"]);
+const CHECKSUM_PATTERN = /^[0-9a-f]{64}$/;
+/** Path of the detached signature for a descriptor file. */
+export function signaturePathFor(descriptorPathValue) {
+    return `${descriptorPathValue}.sig`;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function unavailable(message) {
+    throw new UpgradeDescriptorUnavailable(message);
+}
+function assertOnlyKeys(value, allowed, where) {
+    // Rejected, not ignored: a typo'd key in an authorization artifact must never
+    // silently mean something other than what the reviewer read.
+    for (const key of Object.keys(value)) {
+        if (!allowed.has(key))
+            unavailable(`${where} has unknown key ${JSON.stringify(key)}`);
+    }
+}
+function parsePolicy(value, where) {
+    if (!isRecord(value))
+        unavailable(`${where} must be an object`);
+    assertOnlyKeys(value, POLICY_KEYS, where);
+    for (const key of POLICY_KEYS) {
+        if (!Object.hasOwn(value, key))
+            unavailable(`${where} is missing ${JSON.stringify(key)}`);
+    }
+    if (!isRecord(value.graph))
+        unavailable(`${where}.graph must be an object`);
+    if (!isRecord(value.edge_predicates))
+        unavailable(`${where}.edge_predicates must be an object`);
+    if (!Array.isArray(value.terminal))
+        unavailable(`${where}.terminal must be an array`);
+    if (!isRecord(value.stakes))
+        unavailable(`${where}.stakes must be an object`);
+    // Field-level shape (arrays of state names, predicate objects, string stakes)
+    // is enforced by _validatePolicy at apply time — authorized is not the same
+    // as well-formed, and that check is shared with register/migrate/upgrade.
+    return {
+        graph: value.graph,
+        edge_predicates: value.edge_predicates,
+        terminal: value.terminal,
+        stakes: value.stakes,
+    };
+}
+function parseDescriptor(value, index) {
+    const where = `descriptors[${index}]`;
+    if (!isRecord(value))
+        unavailable(`${where} must be an object`);
+    assertOnlyKeys(value, DESCRIPTOR_KEYS, where);
+    for (const key of DESCRIPTOR_KEYS) {
+        if (!Object.hasOwn(value, key))
+            unavailable(`${where} is missing ${JSON.stringify(key)}`);
+    }
+    const { id, rationale, from_checksum: fromChecksum } = value;
+    if (typeof id !== "string" || !DESCRIPTOR_ID_PATTERN.test(id)) {
+        unavailable(`${where}.id must match [A-Za-z0-9_.-]+`);
+    }
+    if (typeof rationale !== "string" || !rationale.trim()) {
+        // The ledger carries this, so the audit trail says why and not only what.
+        unavailable(`${where}.rationale must be a non-empty string`);
+    }
+    if (typeof fromChecksum !== "string" || !CHECKSUM_PATTERN.test(fromChecksum)) {
+        unavailable(`${where}.from_checksum must be a lowercase sha256 hex digest`);
+    }
+    return { id, rationale, from_checksum: fromChecksum, to_policy: parsePolicy(value.to_policy, `${where}.to_policy`) };
+}
+/** Digest of a descriptor file's exact bytes — what the env pin is compared against. */
+export function descriptorFileDigest(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/** Trust-root failures are "you do not have this capability" at this surface. */
+function allowedSignersOrUnavailable() {
+    try {
+        return loadAllowedSigners();
+    }
+    catch (error) {
+        unavailable(error instanceof Error ? error.message : String(error));
+    }
+}
+function descriptorPath(env) {
+    const path = env[DESCRIPTOR_PATH_ENV];
+    if (!path)
+        unavailable(`upgrade descriptors unavailable: ${DESCRIPTOR_PATH_ENV} not set in server env`);
+    if (!isAbsolute(path))
+        unavailable(`${DESCRIPTOR_PATH_ENV} must be an absolute path`);
+    return path;
+}
+function readDescriptorBytes(path) {
+    let stats;
+    try {
+        stats = statSync(path);
+    }
+    catch {
+        unavailable(`upgrade descriptor file is unreadable: ${JSON.stringify(path)}`);
+    }
+    if (!stats.isFile())
+        unavailable(`upgrade descriptor path is not a regular file: ${JSON.stringify(path)}`);
+    try {
+        return { bytes: readFileSync(path), groupOrWorldWritable: (stats.mode & 0o022) !== 0 };
+    }
+    catch {
+        unavailable(`upgrade descriptor file is unreadable: ${JSON.stringify(path)}`);
+    }
+}
+function parseDescriptorFile(bytes) {
+    let parsed;
+    try {
+        parsed = JSON.parse(bytes.toString("utf8"));
+    }
+    catch (error) {
+        unavailable(`upgrade descriptor file is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!isRecord(parsed))
+        unavailable("upgrade descriptor file must contain a JSON object");
+    assertOnlyKeys(parsed, FILE_KEYS, "upgrade descriptor file");
+    if (parsed.version !== 1)
+        unavailable(`unsupported upgrade descriptor file version ${JSON.stringify(parsed.version)}`);
+    if (!Array.isArray(parsed.descriptors))
+        unavailable("upgrade descriptor file requires a descriptors array");
+    const descriptors = parsed.descriptors.map((entry, index) => parseDescriptor(entry, index));
+    const seen = new Set();
+    for (const descriptor of descriptors) {
+        if (seen.has(descriptor.id))
+            unavailable(`duplicate upgrade descriptor id ${JSON.stringify(descriptor.id)}`);
+        seen.add(descriptor.id);
+    }
+    return descriptors;
+}
+/**
+ * Read, authenticate and parse the configured descriptor file. Every failure is
+ * `upgrade_descriptor_unavailable`: from the caller's side "not configured",
+ * "tampered" and "malformed" are the same answer — you do not have this
+ * capability — and collapsing them avoids turning the error into an oracle.
+ */
+export function loadDescriptorFile(env = process.env) {
+    const path = descriptorPath(env);
+    const signers = allowedSignersOrUnavailable();
+    const { bytes, groupOrWorldWritable } = readDescriptorBytes(path);
+    // Defence in depth now rather than load-bearing: the signature already covers
+    // the content, so tampering is detected regardless. A world-writable
+    // authorization artifact is still a smell worth refusing.
+    if (groupOrWorldWritable) {
+        unavailable(`upgrade descriptor file must not be group- or world-writable: ${JSON.stringify(path)}`);
+    }
+    const signaturePath = signaturePathFor(path);
+    let armored;
+    try {
+        armored = readFileSync(signaturePath, "utf8");
+    }
+    catch {
+        unavailable(`upgrade descriptor file is not signed: expected ${JSON.stringify(signaturePath)} `
+            + `(sign it with: ssh-keygen -Y sign -f <key> -n ${DESCRIPTOR_NAMESPACE} ${path})`);
+    }
+    let signerKey;
+    try {
+        signerKey = verifySshsig(bytes, armored, DESCRIPTOR_NAMESPACE, signers.map((signer) => signer.publicKey));
+    }
+    catch (error) {
+        unavailable(`upgrade descriptor signature rejected: ${error instanceof SshsigError ? error.message : String(error)}`);
+    }
+    const fingerprint = sshFingerprint(signerKey);
+    const signer = signers.find((entry) => entry.fingerprint === fingerprint);
+    return {
+        path,
+        digest: descriptorFileDigest(bytes),
+        signedBy: { principal: signer.principal, fingerprint },
+        descriptors: parseDescriptorFile(bytes),
+    };
+}
+/**
+ * Operator-facing inspection. Reports what is installed and whether it verifies,
+ * without being able to grant anything: it reads the same trust root the apply
+ * path does and reports failures as text rather than treating them as success.
+ */
+export function inspectDescriptorFile(env = process.env) {
+    const path = descriptorPath(env);
+    const { bytes, groupOrWorldWritable } = readDescriptorBytes(path);
+    const signaturePath = signaturePathFor(path);
+    let signers = [];
+    let signature;
+    try {
+        signers = allowedSignersOrUnavailable();
+        const armored = readFileSync(signaturePath, "utf8");
+        const key = verifySshsig(bytes, armored, DESCRIPTOR_NAMESPACE, signers.map((entry) => entry.publicKey));
+        const fingerprint = sshFingerprint(key);
+        signature = `verified: signed by ${signers.find((entry) => entry.fingerprint === fingerprint).principal} (${fingerprint})`;
+    }
+    catch (error) {
+        signature = `NOT VERIFIED: ${error instanceof Error ? error.message : String(error)}`;
+    }
+    return {
+        path,
+        sha256: descriptorFileDigest(bytes),
+        group_or_world_writable: groupOrWorldWritable,
+        signature_path: signaturePath,
+        signature,
+        allowed_signers: signers.map(({ principal, fingerprint }) => ({ principal, fingerprint })),
+        descriptors: parseDescriptorFile(bytes).map(({ id, rationale, from_checksum: fromChecksum }) => ({
+            id, rationale, from_checksum: fromChecksum,
+        })),
+    };
+}
+/** Resolve one descriptor by id, or refuse. */
+export function findDescriptor(file, descriptorId) {
+    const descriptor = file.descriptors.find((entry) => entry.id === descriptorId);
+    if (!descriptor)
+        unavailable(`no upgrade descriptor ${JSON.stringify(descriptorId)} in ${JSON.stringify(file.path)}`);
+    return descriptor;
+}
+//# sourceMappingURL=descriptors.js.map

package/dist/guard/descriptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.js","sourceRoot":"","sources":["../../src/guard/descriptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAqC,MAAM,YAAY,CAAC;AAGnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AACvE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAClD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AACnF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AACtD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAwB1C,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,mBAA2B;IAC1D,OAAO,GAAG,mBAAmB,MAAM,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,IAAI,4BAA4B,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B,EAAE,OAAoB,EAAE,KAAa;IACzF,8EAA8E;IAC9E,6DAA6D;IAC7D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,KAAK,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,WAAW,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChE,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,WAAW,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;QAAE,WAAW,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,WAAW,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,WAAW,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAmB;QAChC,eAAe,EAAE,KAAK,CAAC,eAAiC;QACxD,QAAQ,EAAE,KAAK,CAAC,QAAoB;QACpC,MAAM,EAAE,KAAK,CAAC,MAAgC;KAC/C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa;IACpD,MAAM,KAAK,GAAG,eAAe,KAAK,GAAG,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,WAAW,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAChE,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,KAAK,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC7D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9D,WAAW,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,0EAA0E;QAC1E,WAAW,CAAC,GAAG,KAAK,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7E,WAAW,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,YAAY,CAAC,EAAE,CAAC;AACvH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,KAAsB;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,iFAAiF;AACjF,SAAS,2BAA2B;IAClC,IAAI,CAAC;QACH,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAsB;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,WAAW,CAAC,oCAAoC,mBAAmB,wBAAwB,CAAC,CAAC;IACxG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,WAAW,CAAC,GAAG,mBAAmB,2BAA2B,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,WAAW,CAAC,kDAAkD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3G,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,oBAAoB,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,WAAW,CAAC,oDAAoD,CAAC,CAAC;IACzF,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,WAAW,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,WAAW,CAAC,sDAAsD,CAAC,CAAC;IAE5G,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,WAAW,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;IAC9C,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAClE,8EAA8E;IAC9E,qEAAqE;IACrE,0DAA0D;IAC1D,IAAI,oBAAoB,EAAE,CAAC;QACzB,WAAW,CAAC,iEAAiE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CACT,mDAAmD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG;cACjF,iDAAiD,oBAAoB,IAAI,IAAI,GAAG,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CACT,0CAA0C,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAE,CAAC;IAE3E,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACnC,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;QACtD,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IASxE,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,OAAO,GAAoB,EAAE,CAAC;IAClC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,2BAA2B,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACxC,SAAS,GAAG,uBAAuB,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,WAAW,CAAE,CAAC,SAAS,KAAK,WAAW,GAAG,CAAC;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,GAAG,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACxF,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,oBAAoB,CAAC,KAAK,CAAC;QACnC,uBAAuB,EAAE,oBAAoB;QAC7C,cAAc,EAAE,aAAa;QAC7B,SAAS;QACT,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC1F,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/F,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY;SAC3C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,IAAoB,EAAE,YAAoB;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU;QAAE,WAAW,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtH,OAAO,UAAU,CAAC;AACpB,CAAC"}