@sun-asterisk/sungen 3.2.34 → 3.3.0-alpha.1

package/dist/decisions/decision-integrity-check.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DECISION_INTEGRITY_RULES = void 0;
+exports.checkDecisionIntegrity = checkDecisionIntegrity;
+/**
+ * Append-only integrity of the decision layer (DOS-13.3). Emits the catalog's hard rules — it does
+ * not define severity; phase 04's resolver decides what a finding blocks.
+ *
+ *   decision.id-reuse   stored id ≠ id of the content (edited text, renamed file, moved to another scope)
+ *   decision.mutated    entry_hash ≠ entry, an unreadable entry, or an entry in `git show HEAD:` that
+ *                       was edited or deleted in the working tree — the only check a careful forger
+ *                       who recomputes both hashes cannot pass
+ *
+ * Outside git (or with no commit yet) the HEAD comparison is skipped; it never throws.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const safe_yaml_parse_1 = require("../utils/safe-yaml-parse");
+const decision_identity_1 = require("./decision-identity");
+const decision_file_1 = require("./decision-file");
+const git_head_trust_1 = require("./git-head-trust");
+exports.DECISION_INTEGRITY_RULES = { idReuse: 'decision.id-reuse', mutated: 'decision.mutated' };
+/** Same meaning, whatever the line endings or YAML layout: compare the parsed entries canonically. */
+function sameEntry(a, b) {
+    try {
+        return (0, decision_identity_1.canonicalJson)((0, safe_yaml_parse_1.safeYamlParse)(a)) === (0, decision_identity_1.canonicalJson)((0, safe_yaml_parse_1.safeYamlParse)(b));
+    }
+    catch {
+        return a.replace(/\r\n?/g, '\n') === b.replace(/\r\n?/g, '\n');
+    }
+}
+function checkDecisionIntegrity(projectRoot) {
+    const out = new Map();
+    const add = (rule, abs, message) => {
+        const rel = path.relative(projectRoot, abs).split(path.sep).join('/');
+        if (!out.has(`${rule} ${rel}`))
+            out.set(`${rule} ${rel}`, { rule, path: rel, message });
+    };
+    for (const { scope, dir } of (0, decision_file_1.listDecisionDirs)(projectRoot)) {
+        let names = [];
+        try {
+            names = fs.readdirSync(dir).filter((f) => f.endsWith('.yaml'));
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            const file = path.join(dir, name);
+            const v = (0, decision_file_1.verifyDecisionFile)(file, scope);
+            if (!v.problem)
+                continue;
+            add(v.problem.code === 'id-mismatch' ? exports.DECISION_INTEGRITY_RULES.idReuse : exports.DECISION_INTEGRITY_RULES.mutated, file, v.problem.message);
+        }
+    }
+    const listed = (0, git_head_trust_1.gitOutput)(projectRoot, ['ls-tree', '-r', '-z', '--name-only', 'HEAD', '--', 'qa']);
+    for (const rel of (listed ?? '').split('\0').filter((p) => decision_file_1.DECISION_FILE_PATH.test(p))) {
+        const abs = path.join(projectRoot, ...rel.split('/'));
+        if (!fs.existsSync(abs)) {
+            add(exports.DECISION_INTEGRITY_RULES.mutated, abs, 'committed entry was deleted (append-only: supersede it instead)');
+            continue;
+        }
+        const head = (0, git_head_trust_1.gitOutput)(projectRoot, ['show', `HEAD:./${rel}`]);
+        if (head !== null && !sameEntry(head, fs.readFileSync(abs, 'utf8'))) {
+            add(exports.DECISION_INTEGRITY_RULES.mutated, abs, 'committed entry was edited (append-only: record a superseding entry instead)');
+        }
+    }
+    return [...out.values()];
+}
+//# sourceMappingURL=decision-integrity-check.js.map

package/dist/decisions/decision-integrity-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-integrity-check.js","sourceRoot":"","sources":["../../src/decisions/decision-integrity-check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,wDA4BC;AA5DD;;;;;;;;;;GAUG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,8DAAyD;AACzD,2DAAoD;AACpD,mDAA2F;AAC3F,qDAAoD;AAEvC,QAAA,wBAAwB,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,kBAAkB,EAAW,CAAC;AAK/G,sGAAsG;AACtG,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC;QACH,OAAO,IAAA,iCAAa,EAAC,IAAA,+BAAa,EAAC,CAAC,CAAC,CAAC,KAAK,IAAA,iCAAa,EAAC,IAAA,+BAAa,EAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,MAAM,GAAG,GAAG,CAAC,IAA2B,EAAE,GAAW,EAAE,OAAe,EAAQ,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC;IAEF,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,IAAA,gCAAgB,EAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,IAAA,kCAAkB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,SAAS;YACzB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,gCAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAwB,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,0BAAG,EAAC,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5F,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,gCAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,iEAAiE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACrJ,MAAM,IAAI,GAAG,IAAA,0BAAG,EAAC,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,gCAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,8EAA8E,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC3B,CAAC"}

package/dist/decisions/decision-schema.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Decision entry schema (DOS-13.2).
+ *
+ * `{id, kind, anchors[], text, reason, payload?, source:{by, where}, valid_from, supersedes?,
+ *   visibility: internal|client, evidence_hash?, entry_hash}`
+ *
+ * Validation is strict both ways: a draft is checked before it is written, and a stored entry is
+ * checked when read — an unknown key (a stored `superseded_by`, say) makes the entry invalid, because
+ * a field outside the id's content could carry meaning the id does not vouch for.
+ */
+export declare const DECISION_KINDS: readonly ["waiver", "gate-override", "contract-approval", "viewpoint-acceptance", "clarification"];
+export type DecisionKind = typeof DECISION_KINDS[number];
+export type DecisionVisibility = 'internal' | 'client';
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export interface DecisionSource {
+    by: string;
+    where: string;
+}
+export interface DecisionDraft {
+    kind: DecisionKind;
+    anchors: string[];
+    text: string;
+    reason: string;
+    payload?: Record<string, JsonValue>;
+    source: DecisionSource;
+    valid_from: string;
+    supersedes?: string;
+    visibility: DecisionVisibility;
+    evidence_hash?: string;
+}
+export interface DecisionEntry extends DecisionDraft {
+    id: string;
+    entry_hash: string;
+}
+export declare const DECISION_ID_RE: RegExp;
+/** Errors in a draft (empty = valid). Shared by the write boundary and the stored-entry check. */
+export declare function draftErrors(d: Record<string, unknown>): string[];
+/** A stored entry: the draft rules plus id, entry_hash and no unknown keys. */
+export declare function storedEntryErrors(raw: unknown): string[];
+//# sourceMappingURL=decision-schema.d.ts.map

package/dist/decisions/decision-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-schema.d.ts","sourceRoot":"","sources":["../../src/decisions/decision-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,oGAAqG,CAAC;AACjI,MAAM,MAAM,YAAY,GAAG,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtG,MAAM,WAAW,cAAc;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAE7D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,MAAM,EAAE,cAAc,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAEvF,eAAO,MAAM,cAAc,QAAqB,CAAC;AAgBjD,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,CAgBhE;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAOxD"}

package/dist/decisions/decision-schema.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DECISION_ID_RE = exports.DECISION_KINDS = void 0;
+exports.draftErrors = draftErrors;
+exports.storedEntryErrors = storedEntryErrors;
+/**
+ * Decision entry schema (DOS-13.2).
+ *
+ * `{id, kind, anchors[], text, reason, payload?, source:{by, where}, valid_from, supersedes?,
+ *   visibility: internal|client, evidence_hash?, entry_hash}`
+ *
+ * Validation is strict both ways: a draft is checked before it is written, and a stored entry is
+ * checked when read — an unknown key (a stored `superseded_by`, say) makes the entry invalid, because
+ * a field outside the id's content could carry meaning the id does not vouch for.
+ */
+exports.DECISION_KINDS = ['waiver', 'gate-override', 'contract-approval', 'viewpoint-acceptance', 'clarification'];
+exports.DECISION_ID_RE = /^D-[0-9a-f]{16}$/;
+const ENTRY_HASH_RE = /^[0-9a-f]{64}$/;
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/;
+const STORED_KEYS = new Set(['id', 'kind', 'anchors', 'text', 'reason', 'payload', 'source', 'valid_from', 'supersedes', 'visibility', 'evidence_hash', 'entry_hash']);
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const nonEmpty = (v) => typeof v === 'string' && v.trim().length > 0;
+function isJson(v, depth = 0) {
+    if (depth > 20)
+        return false;
+    if (v === null || typeof v === 'string' || typeof v === 'boolean')
+        return true;
+    if (typeof v === 'number')
+        return Number.isFinite(v);
+    if (Array.isArray(v))
+        return v.every((x) => isJson(x, depth + 1));
+    return isObject(v) && Object.values(v).every((x) => isJson(x, depth + 1));
+}
+/** Errors in a draft (empty = valid). Shared by the write boundary and the stored-entry check. */
+function draftErrors(d) {
+    const e = [];
+    if (!exports.DECISION_KINDS.includes(d.kind))
+        e.push(`kind must be one of ${exports.DECISION_KINDS.join('|')}`);
+    if (!Array.isArray(d.anchors) || !d.anchors.every(nonEmpty))
+        e.push('anchors must be a list of non-empty strings');
+    if (!nonEmpty(d.text))
+        e.push('text is required');
+    if (!nonEmpty(d.reason))
+        e.push('reason is required');
+    if (d.payload !== undefined && !(isObject(d.payload) && isJson(d.payload)))
+        e.push('payload must be a JSON object');
+    const src = d.source;
+    if (!isObject(src) || typeof src.by !== 'string' || !nonEmpty(src.where) || Object.keys(src).some((k) => k !== 'by' && k !== 'where')) {
+        e.push('source must be {by, where}');
+    }
+    if (typeof d.valid_from !== 'string' || !ISO_RE.test(d.valid_from) || Number.isNaN(Date.parse(d.valid_from)))
+        e.push('valid_from must be an ISO-8601 timestamp');
+    if (d.supersedes !== undefined && (typeof d.supersedes !== 'string' || !exports.DECISION_ID_RE.test(d.supersedes)))
+        e.push('supersedes must be a decision id D-<16 hex>');
+    if (d.visibility !== 'internal' && d.visibility !== 'client')
+        e.push('visibility must be internal|client');
+    if (d.evidence_hash !== undefined && typeof d.evidence_hash !== 'string')
+        e.push('evidence_hash must be a string');
+    return e;
+}
+/** A stored entry: the draft rules plus id, entry_hash and no unknown keys. */
+function storedEntryErrors(raw) {
+    if (!isObject(raw))
+        return ['not a mapping'];
+    const e = draftErrors(raw);
+    for (const k of Object.keys(raw))
+        if (!STORED_KEYS.has(k))
+            e.push(`unknown key "${k}"`);
+    if (typeof raw.id !== 'string' || !exports.DECISION_ID_RE.test(raw.id))
+        e.push('id must be D-<16 hex>');
+    if (typeof raw.entry_hash !== 'string' || !ENTRY_HASH_RE.test(raw.entry_hash))
+        e.push('entry_hash must be 64 hex');
+    return e;
+}
+//# sourceMappingURL=decision-schema.js.map

package/dist/decisions/decision-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-schema.js","sourceRoot":"","sources":["../../src/decisions/decision-schema.ts"],"names":[],"mappings":";;;AAiDA,kCAgBC;AAGD,8CAOC;AA3ED;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,eAAe,CAAU,CAAC;AAsBpH,QAAA,cAAc,GAAG,kBAAkB,CAAC;AACjD,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,MAAM,GAAG,qEAAqE,CAAC;AACrF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;AAEvK,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAEvF,SAAS,MAAM,CAAC,CAAU,EAAE,KAAK,GAAG,CAAC;IACnC,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,kGAAkG;AAClG,SAAgB,WAAW,CAAC,CAA0B;IACpD,MAAM,CAAC,GAAa,EAAE,CAAC;IACvB,IAAI,CAAC,sBAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAoB,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,sBAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACnH,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACpH,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,EAAE,CAAC;QACtI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACjK,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,sBAAc,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAClK,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC3G,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACnH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxF,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,sBAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAChG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACnH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/decisions/decision-source.d.ts

@@ -0,0 +1,2 @@
+export declare function gitUserName(cwd: string): string;
+//# sourceMappingURL=decision-source.d.ts.map

package/dist/decisions/decision-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-source.d.ts","sourceRoot":"","sources":["../../src/decisions/decision-source.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAO/C"}

package/dist/decisions/decision-source.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitUserName = gitUserName;
+/**
+ * Who recorded a decision: `git config user.name` — a name, never the email (DOS-13.2, security
+ * considerations). Best-effort: no git, no name → 'unknown'.
+ */
+const child_process_1 = require("child_process");
+function gitUserName(cwd) {
+    try {
+        const name = (0, child_process_1.execFileSync)('git', ['config', 'user.name'], { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).toString('utf8').trim();
+        return name || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+//# sourceMappingURL=decision-source.js.map

package/dist/decisions/decision-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-source.js","sourceRoot":"","sources":["../../src/decisions/decision-source.ts"],"names":[],"mappings":";;AAMA,kCAOC;AAbD;;;GAGG;AACH,iDAA6C;AAE7C,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/I,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/decisions/exclusive-file-create.d.ts

@@ -0,0 +1,3 @@
+/** true = created, false = the name was already taken. Any other failure throws. */
+export declare function createFileExclusive(file: string, text: string): boolean;
+//# sourceMappingURL=exclusive-file-create.d.ts.map

package/dist/decisions/exclusive-file-create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-file-create.d.ts","sourceRoot":"","sources":["../../src/decisions/exclusive-file-create.ts"],"names":[],"mappings":"AAcA,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BvE"}

package/dist/decisions/exclusive-file-create.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFileExclusive = createFileExclusive;
+/**
+ * Create a file only if its name is free, and never leave it half-written (red-team #13).
+ *
+ * The bytes go to a private tmp file opened with O_EXCL, are fsynced, then hard-linked to the final
+ * name. `link` fails with EEXIST when the name is taken, so the final file appears complete or not at
+ * all. On a filesystem without hard links an O_EXCL create of the final name keeps the exclusivity.
+ * Used for decision entries (same content → same name → "already recorded") and for the migration
+ * sentinel (two migrations of one unit cannot both believe they hold it).
+ */
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const NO_HARD_LINKS = new Set(['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS', 'EXDEV']);
+/** true = created, false = the name was already taken. Any other failure throws. */
+function createFileExclusive(file, text) {
+    const tmp = `${file}.tmp-${process.pid}-${(0, crypto_1.randomBytes)(6).toString('hex')}`;
+    const fd = fs.openSync(tmp, 'wx');
+    try {
+        fs.writeFileSync(fd, text);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        fs.linkSync(tmp, file);
+        return true;
+    }
+    catch (err) {
+        const code = err.code ?? '';
+        if (code === 'EEXIST')
+            return false;
+        if (!NO_HARD_LINKS.has(code))
+            throw err;
+        try {
+            fs.writeFileSync(file, text, { flag: 'wx' });
+            return true;
+        }
+        catch (e) {
+            if (e.code === 'EEXIST')
+                return false;
+            throw e;
+        }
+    }
+    finally {
+        fs.rmSync(tmp, { force: true });
+    }
+}
+//# sourceMappingURL=exclusive-file-create.js.map

package/dist/decisions/exclusive-file-create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusive-file-create.js","sourceRoot":"","sources":["../../src/decisions/exclusive-file-create.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,kDA0BC;AAzCD;;;;;;;;GAQG;AACH,mCAAqC;AACrC,uCAAyB;AAEzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAErF,oFAAoF;AACpF,SAAgB,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAC;QACvD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,CAAC;QACxC,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/decisions/git-head-trust.d.ts

@@ -0,0 +1,7 @@
+/** stdout of a git command run in `cwd`, or null when git fails (no repo, no HEAD, untracked path…). */
+export declare function gitOutput(cwd: string, args: string[]): string | null;
+/** The committed text of `abs` (a file inside `projectRoot`), or null when git HEAD has no such file. */
+export declare function committedText(projectRoot: string, abs: string): string | null;
+/** The committed JSON of `abs`, or null (absent from HEAD, or not JSON). */
+export declare function committedJson(projectRoot: string, abs: string): unknown;
+//# sourceMappingURL=git-head-trust.d.ts.map

package/dist/decisions/git-head-trust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-head-trust.d.ts","sourceRoot":"","sources":["../../src/decisions/git-head-trust.ts"],"names":[],"mappings":"AAUA,wGAAwG;AACxG,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAMpE;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI7E;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAIvE"}

package/dist/decisions/git-head-trust.js

@@ -0,0 +1,76 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitOutput = gitOutput;
+exports.committedText = committedText;
+exports.committedJson = committedJson;
+/**
+ * What git HEAD says — the trust anchor for agent-writable state (red-team #3, review H1).
+ *
+ * `.sungen/` files are written by the CLI and, without the guard, by any agent. A record in them is
+ * trusted only where it equals its committed version: a commit went through review, a local edit
+ * did not. Outside git, or for a file git does not track, nothing is trusted. Never throws.
+ */
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+/** stdout of a git command run in `cwd`, or null when git fails (no repo, no HEAD, untracked path…). */
+function gitOutput(cwd, args) {
+    try {
+        return (0, child_process_1.execFileSync)('git', args, { cwd, stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024, timeout: 30000 }).toString('utf8');
+    }
+    catch {
+        return null;
+    }
+}
+/** The committed text of `abs` (a file inside `projectRoot`), or null when git HEAD has no such file. */
+function committedText(projectRoot, abs) {
+    const rel = path.relative(projectRoot, abs).split(path.sep).join('/');
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel))
+        return null;
+    return gitOutput(projectRoot, ['show', `HEAD:./${rel}`]);
+}
+/** The committed JSON of `abs`, or null (absent from HEAD, or not JSON). */
+function committedJson(projectRoot, abs) {
+    const text = committedText(projectRoot, abs);
+    if (text === null)
+        return null;
+    try {
+        return JSON.parse(text.replace(/^/, ''));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=git-head-trust.js.map

package/dist/decisions/git-head-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-head-trust.js","sourceRoot":"","sources":["../../src/decisions/git-head-trust.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAWA,8BAMC;AAGD,sCAIC;AAGD,sCAIC;AA/BD;;;;;;GAMG;AACH,iDAA6C;AAC7C,2CAA6B;AAE7B,wGAAwG;AACxG,SAAgB,SAAS,CAAC,GAAW,EAAE,IAAc;IACnD,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/I,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAgB,aAAa,CAAC,WAAmB,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,WAAmB,EAAE,GAAW;IAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC3E,CAAC"}

package/dist/decisions/human-confirmation.d.ts

@@ -0,0 +1,33 @@
+export interface ConfirmationIO {
+    input: NodeJS.ReadableStream & {
+        isTTY?: boolean;
+    };
+    output: NodeJS.WritableStream;
+    /** The CLI's real terminal: prompt on `/dev/tty` (opened only when a confirmation is asked). */
+    controllingTerminal?: boolean;
+}
+export declare class HumanConfirmationRefused extends Error {
+    readonly command?: string;
+    constructor(message: string, command?: string);
+}
+/** The CLI's streams: stdin decides whether a human is there; the prompt itself uses /dev/tty. */
+export declare const processIO: () => ConfirmationIO;
+export declare const isInteractive: (io: ConfirmationIO) => boolean;
+export declare function shellQuote(arg: string): string;
+export declare const formatCommand: (argv: string[]) => string;
+/** A fresh, hard-to-guess suffix for one prompt. */
+export declare const confirmationNonce: () => string;
+export declare function requireTypedConfirmation(opts: {
+    what: string;
+    phrase: string;
+    command: string;
+    summary: string[];
+    io: ConfirmationIO;
+}): Promise<void>;
+/** A leftover write-ahead sentinel: the human answers REVERT or KEEP. Never answered for them. */
+export declare function askMigrationChoice(opts: {
+    detail: string;
+    command: string;
+    io: ConfirmationIO;
+}): Promise<'REVERT' | 'KEEP'>;
+//# sourceMappingURL=human-confirmation.d.ts.map

package/dist/decisions/human-confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-confirmation.d.ts","sourceRoot":"","sources":["../../src/decisions/human-confirmation.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;aACJ,OAAO,CAAC,EAAE,MAAM;gBAAjD,OAAO,EAAE,MAAM,EAAkB,OAAO,CAAC,EAAE,MAAM;CAI9D;AAED,kGAAkG;AAClG,eAAO,MAAM,SAAS,QAAO,cAA+F,CAAC;AAC7H,eAAO,MAAM,aAAa,GAAI,IAAI,cAAc,KAAG,OAAkC,CAAC;AAEtF,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AACD,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,KAAG,MAAwC,CAAC;AAyCxF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,QAAO,MAAsD,CAAC;AAE5F,wBAAsB,wBAAwB,CAAC,IAAI,EAAE;IACnD,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,EAAE,EAAE,cAAc,CAAC;CACtF,GAAG,OAAO,CAAC,IAAI,CAAC,CAahB;AAED,kGAAkG;AAClG,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,cAAc,CAAA;CAAE,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAWlI"}