@sun-asterisk/sungen 3.2.35 → 3.3.0-alpha.10

package/dist/harness/gates/in-run-decision-check.js

@@ -0,0 +1,166 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IN_RUN_RULE = exports.IN_RUN_KINDS = void 0;
+exports.committedDecisionPaths = committedDecisionPaths;
+exports.runStartOf = runStartOf;
+exports.inRunDecisions = inRunDecisions;
+exports.uncommittedReleaseDecisions = uncommittedReleaseDecisions;
+exports.hasInRunKindDecisions = hasInRunKindDecisions;
+/**
+ * `decision.in-run` (OES-11.5, red-team #3/#15) — a hard rule: a decision that relaxes or approves
+ * something (`gate-override`, `waiver`, `contract-approval`) must have been reviewed BEFORE the run
+ * being delivered. It is in-run when
+ *   - it is not in `git show HEAD:` (never committed, so never reviewed), or
+ *   - it was committed after the start of that run — judged by its git COMMIT time, not by the
+ *     `valid_from` it carries, which its author writes and can backdate (review H1).
+ * Without git only the second test is possible, on `valid_from`; the caller says so (lower confidence).
+ * Without git AND without a run, nothing can be judged — reported, not guessed. A commit time can be
+ * forged too (GIT_COMMITTER_DATE); it raises the bar, it is not a signature.
+ *
+ * A MIGRATED waiver (DOS-13.5) was reviewed when its legacy record was committed — the only record the
+ * import trusts — so it is judged by THAT commit (migrated-waiver-review.ts), never by its own decision
+ * file: in-run when the record was committed after the run started, or — run start or not (#925) —
+ * when it could not have been the import's source: not strictly before the decision file, the unit's
+ * import marker or the project's adoption of 3.3 appeared. Holding it to its decision file's commit would make
+ * every legacy project's waivers in-run the day they are imported (phase 09). An entry HEAD's legacy
+ * file does not vouch for — absent, uncommitted, different, introduced beyond the commits the walk
+ * reads (#924) or at a shallow clone's boundary — is judged as any other; in the last two cases an
+ * in-run finding says why.
+ *
+ * A manual triage classification that claims a human typed it (`triage-classification` with
+ * `humanConfirmed`, #928) is a claim the entry makes about itself — a script can write one. What backs
+ * it is review, so it is in-run while git HEAD does not hold it (and, with no git, always: nothing
+ * shows it was reviewed). Judged by HEAD membership only: it is always recorded after the run it
+ * judges, so its commit time says nothing. Only a test-defect / environment entry that is not
+ * superseded counts — the only kind the reader puts in force on that claim.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const decision_file_1 = require("../../decisions/decision-file");
+const git_head_trust_1 = require("../../decisions/git-head-trust");
+const read_decisions_1 = require("../../decisions/read-decisions");
+const manual_triage_decisions_1 = require("../../graph/manual-triage-decisions");
+const migrated_waiver_review_1 = require("./migrated-waiver-review");
+exports.IN_RUN_KINDS = ['gate-override', 'waiver', 'contract-approval'];
+exports.IN_RUN_RULE = 'decision.in-run';
+/** Paths (relative to the project, `/`-separated) of decision files in git HEAD; null outside git. */
+function committedDecisionPaths(projectRoot) {
+    if ((0, git_head_trust_1.gitOutput)(projectRoot, ['rev-parse', '--is-inside-work-tree'])?.trim() !== 'true')
+        return null;
+    const listed = (0, git_head_trust_1.gitOutput)(projectRoot, ['ls-tree', '-r', '-z', '--name-only', 'HEAD', '--', 'qa']) ?? ''; // no HEAD yet → nothing committed
+    return new Set(listed.split('\0').filter((p) => decision_file_1.DECISION_FILE_PATH.test(p)));
+}
+/** When a committed file was last committed (ISO), or null when git cannot say. */
+function commitTimeOf(projectRoot, rel) {
+    const t = (0, git_head_trust_1.gitOutput)(projectRoot, ['log', '-1', '--format=%cI', '--', rel])?.trim();
+    return t && !Number.isNaN(Date.parse(t)) ? t : null;
+}
+/** When the delivered run started: Playwright's `stats.startTime`; null when there is no readable run. */
+function runStartOf(resultsPath) {
+    if (!resultsPath)
+        return null;
+    try {
+        const json = JSON.parse(fs.readFileSync(resultsPath, 'utf8'));
+        const t = json?.stats?.startTime;
+        return typeof t === 'string' && !Number.isNaN(Date.parse(t)) ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+const isInRunKind = (kind) => exports.IN_RUN_KINDS.includes(kind);
+/**
+ * A triage classification claiming a human typed it (#928): reviewed only once git HEAD holds it.
+ * Only what the reader (manual-triage-decisions.ts) can put in force: a superseded entry is never read,
+ * and a product classification needs no human — its claim backs nothing, so it blocks nothing.
+ */
+const claimsHumanTriage = (e) => e.kind === manual_triage_decisions_1.TRIAGE_DECISION_KIND && !e.superseded_by && e.payload?.humanConfirmed === true
+    && manual_triage_decisions_1.HUMAN_ONLY_TRIAGE.has(e.payload?.class);
+/** In-run decisions among `scopes`, judged against one run start (null: HEAD membership only) and the committed set. */
+function inRunDecisions(projectRoot, scopes, runStart, committed) {
+    const out = [];
+    const after = (t) => !!runStart && Date.parse(t) > Date.parse(runStart);
+    const migratedReview = committed ? (0, migrated_waiver_review_1.migratedWaiverReview)(projectRoot) : null;
+    for (const scope of scopes) {
+        for (const e of (0, read_decisions_1.readDecisions)(projectRoot, scope).entries) {
+            const rel = path.relative(projectRoot, e.path).split(path.sep).join('/');
+            if (claimsHumanTriage(e) && !committed?.has(rel)) {
+                out.push({ id: e.id, kind: e.kind, path: rel, visibility: e.visibility, why: [committed
+                            ? 'a classification by hand that claims a human typed it, not in git HEAD (never committed through review)'
+                            : 'a classification by hand that claims a human typed it, and no git to show it was committed through review'] });
+            }
+            if (!isInRunKind(e.kind))
+                continue;
+            // A migrated waiver re-confirmed on a terminal is replaced: the new decision is judged on its own.
+            if (e.superseded_by && e.source?.where === 'migrated')
+                continue;
+            const why = [];
+            const migrated = migratedReview?.reviewOf(scope, e) ?? null;
+            if (migrated?.at) {
+                if (after(migrated.at))
+                    why.push(`migrated: its legacy record was committed at ${migrated.at}, after the run started ${runStart}`);
+                if (migrated.notImported)
+                    why.push(migrated.notImported);
+            }
+            else if (committed && !committed.has(rel)) {
+                why.push('not in git HEAD (never committed through review)');
+            }
+            else if (committed && runStart) {
+                const at = commitTimeOf(projectRoot, rel);
+                if (at ? after(at) : after(e.valid_from)) {
+                    why.push(at ? `committed at ${at}, after the run started ${runStart}` : `recorded ${e.valid_from} (commit time unavailable), after the run started ${runStart}`);
+                }
+            }
+            else if (!committed && after(e.valid_from)) {
+                why.push(`recorded ${e.valid_from}, after the run started ${runStart}`);
+            }
+            if (why.length && migrated?.unvouched)
+                why.push(migrated.unvouched);
+            if (why.length)
+                out.push({ id: e.id, kind: e.kind, path: rel, visibility: e.visibility, why });
+        }
+    }
+    return out;
+}
+/** Release decisions (override / waiver / approval) in reach that git HEAD does not hold — what `gate deliver` refuses. */
+function uncommittedReleaseDecisions(projectRoot, scopes) {
+    return inRunDecisions(projectRoot, scopes, null, committedDecisionPaths(projectRoot));
+}
+/** Whether any decision of an in-run kind is in reach at all — the no-git notes are printed only then. */
+function hasInRunKindDecisions(projectRoot, scopes) {
+    return scopes.some((s) => (0, read_decisions_1.readDecisions)(projectRoot, s).entries.some((e) => isInRunKind(e.kind)));
+}
+//# sourceMappingURL=in-run-decision-check.js.map

package/dist/harness/gates/in-run-decision-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-run-decision-check.js","sourceRoot":"","sources":["../../../src/harness/gates/in-run-decision-check.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,wDAIC;AASD,gCASC;AAaD,wCAmCC;AAGD,kEAEC;AAGD,sDAEC;AA3HD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,iEAAmE;AAEnE,mEAA2D;AAC3D,mEAA+D;AAC/D,iFAAiH;AACjH,qEAAgE;AAEnD,QAAA,YAAY,GAAG,CAAC,eAAe,EAAE,QAAQ,EAAE,mBAAmB,CAAU,CAAC;AACzE,QAAA,WAAW,GAAG,iBAAiB,CAAC;AAI7C,sGAAsG;AACtG,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,IAAI,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,MAAM,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAG,kCAAkC;IAC7I,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kCAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,WAAmB,EAAE,GAAW;IACpD,MAAM,CAAC,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACnF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,0GAA0G;AAC1G,SAAgB,UAAU,CAAC,WAA0B;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAwC,CAAC;QACrG,MAAM,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAE,oBAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClG;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAA8E,EAAW,EAAE,CACpH,CAAC,CAAC,IAAI,KAAK,8CAAoB,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI;OACtF,2CAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAA0B,CAAC,CAAC;AAElE,wHAAwH;AACxH,SAAgB,cAAc,CAAC,WAAmB,EAAE,MAAgB,EAAE,QAAuB,EAAE,SAA6B;IAC1H,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzF,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,IAAA,6CAAoB,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,IAAA,8BAAa,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS;4BACrF,CAAC,CAAC,yGAAyG;4BAC3G,CAAC,CAAC,2GAA2G,CAAC,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,mGAAmG;YACnG,IAAI,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,UAAU;gBAAE,SAAS;YAChE,MAAM,GAAG,GAAa,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,cAAc,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAC5D,IAAI,QAAQ,EAAE,EAAE,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,gDAAgD,QAAQ,CAAC,EAAE,2BAA2B,QAAQ,EAAE,CAAC,CAAC;gBACnI,IAAI,QAAQ,CAAC,WAAW;oBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC/D,CAAC;iBAAM,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;gBACjC,MAAM,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAC1C,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,2BAA2B,QAAQ,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,UAAU,qDAAqD,QAAQ,EAAE,CAAC,CAAC;gBACnK,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,UAAU,2BAA2B,QAAQ,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ,EAAE,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACpE,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2HAA2H;AAC3H,SAAgB,2BAA2B,CAAC,WAAmB,EAAE,MAAgB;IAC/E,OAAO,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,0GAA0G;AAC1G,SAAgB,qBAAqB,CAAC,WAAmB,EAAE,MAAgB;IACzE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAa,EAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC"}

package/dist/harness/gates/journey-gate-inputs.d.ts

@@ -0,0 +1,37 @@
+import { AuditVerification } from './audit-report-verification';
+import { GateOverrideReport } from './gate-override-report';
+import { ActiveOverride } from './resolve-rule';
+import { UnitGateOverrides } from './unit-gate-overrides';
+export interface JourneyAuditInput {
+    audit: Record<string, unknown> | null;
+    verification: AuditVerification;
+    /** Set when a report exists but does not count (stale / invalid). */
+    notCountedReason?: string;
+}
+export declare function readJourneyAudit(projectRoot: string, unit: string): JourneyAuditInput;
+/** The audit rule each design obligation stands for. */
+export declare const OBLIGATION_RULE: Readonly<Record<string, string>>;
+interface OverridableObligation {
+    id: string;
+    status: string;
+    detail: string;
+    overriddenBy?: string;
+}
+/**
+ * Mark needs-work obligations whose rule the audit recorded as overridden (applied). audit.json is
+ * output too: an `applied` entry counts only when the same override (decision id AND rule) is in
+ * force for the unit today (review M3); the others are ignored and returned for the board.
+ */
+export declare function applyAuditOverrides<T extends OverridableObligation>(obligations: T[], audit: Record<string, unknown>, inForce: ActiveOverride[]): GateOverrideReport[];
+export declare function ignoredOverrideText(g: GateOverrideReport): string;
+export interface DecisionGateFinding {
+    rule: 'decision.id-reuse' | 'decision.mutated' | 'gate.override-rejected';
+    path: string;
+    message: string;
+}
+export declare function unitOverrides(projectRoot: string, unit: string): UnitGateOverrides;
+/** Integrity of every decision in the unit's reach (project + unit dirs) plus its rejected overrides. */
+export declare function journeyDecisionFindings(projectRoot: string, overrides: UnitGateOverrides): DecisionGateFinding[];
+export declare function decisionFindingText(f: DecisionGateFinding): string;
+export {};
+//# sourceMappingURL=journey-gate-inputs.d.ts.map

package/dist/harness/gates/journey-gate-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journey-gate-inputs.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/journey-gate-inputs.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsC,iBAAiB,EAAqB,MAAM,6BAA6B,CAAC;AACvH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAyC,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAEjG,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAQrF;AAED,wDAAwD;AACxD,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK5D,CAAC;AAEF,UAAU,qBAAqB;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE;AAErG;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,qBAAqB,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,kBAAkB,EAAE,CAatK;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAEjE;AAED,MAAM,WAAW,mBAAmB;IAAG,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEjJ,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAGlF;AAED,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,mBAAmB,EAAE,CAOhH;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAElE"}

package/dist/harness/gates/journey-gate-inputs.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OBLIGATION_RULE = void 0;
+exports.readJourneyAudit = readJourneyAudit;
+exports.applyAuditOverrides = applyAuditOverrides;
+exports.ignoredOverrideText = ignoredOverrideText;
+exports.unitOverrides = unitOverrides;
+exports.journeyDecisionFindings = journeyDecisionFindings;
+exports.decisionFindingText = decisionFindingText;
+/**
+ * What the journey board and `runGate` take from the gate registry (OES-11.2/11.4, phase-03 review).
+ *
+ *   readJourneyAudit       the audit report, read through the T3 checks — a stale or untrusted one
+ *                          counts as never audited
+ *   applyAuditOverrides    an OB-* whose rule the AUDIT recorded as overridden is accepted
+ *                          (`overridden`); journey never re-applies an override itself (red-team #12)
+ *   journeyDecisionFindings the decision files in the unit's reach that do not verify, edits/deletes
+ *                          of committed entries (checkDecisionIntegrity), and rejected overrides — each
+ *                          a finding the board shows and the gate blocks on, never a crash
+ */
+const decision_integrity_check_1 = require("../../decisions/decision-integrity-check");
+const resolve_unit_1 = require("../../cli/resolve-unit");
+const audit_report_verification_1 = require("./audit-report-verification");
+const unit_gate_overrides_1 = require("./unit-gate-overrides");
+function readJourneyAudit(projectRoot, unit) {
+    const verification = (0, audit_report_verification_1.verifyAuditReport)(projectRoot, unit);
+    if ((0, audit_report_verification_1.auditCounts)(verification))
+        return { audit: verification.report, verification };
+    return {
+        audit: null,
+        verification,
+        ...(verification.state !== 'absent' ? { notCountedReason: (0, audit_report_verification_1.auditNotCountedReason)(verification, unit) } : {}),
+    };
+}
+/** The audit rule each design obligation stands for. */
+exports.OBLIGATION_RULE = {
+    'OB-spec': 'audit.spec-coverage',
+    'OB-coverage': 'audit.viewpoint-coverage',
+    'OB-depth': 'audit.assertion-depth',
+    'OB-trace': 'audit.taxonomy-mismatch',
+};
+/**
+ * Mark needs-work obligations whose rule the audit recorded as overridden (applied). audit.json is
+ * output too: an `applied` entry counts only when the same override (decision id AND rule) is in
+ * force for the unit today (review M3); the others are ignored and returned for the board.
+ */
+function applyAuditOverrides(obligations, audit, inForce) {
+    const recorded = (Array.isArray(audit.gateOverrides) ? audit.gateOverrides : [])
+        .filter((g) => g && g.status === 'applied');
+    const real = (g) => inForce.some((o) => o.decisionId === g.decisionId && o.rule === g.rule);
+    const applied = recorded.filter(real);
+    for (const ob of obligations) {
+        const o = applied.find((g) => g.rule === exports.OBLIGATION_RULE[ob.id]);
+        if (!o || ob.status !== 'needs-work')
+            continue;
+        ob.status = 'overridden';
+        ob.overriddenBy = o.decisionId;
+        ob.detail = `overridden by ${o.decisionId} (${o.rule} → ${o.severity}) — ${o.reason}. Was: ${ob.detail}`;
+    }
+    return recorded.filter((g) => !real(g));
+}
+function ignoredOverrideText(g) {
+    return `⚠️ audit.json says override ${String(g.decisionId)} (${String(g.rule)}) applied, but it is not in force for this unit — ignored. Re-run the audit; never edit its report.`;
+}
+function unitOverrides(projectRoot, unit) {
+    const found = (0, resolve_unit_1.resolveUnitCandidates)(unit, projectRoot);
+    return (0, unit_gate_overrides_1.loadUnitGateOverrides)(projectRoot, found.length === 1 ? (0, unit_gate_overrides_1.unitScopeOfDir)(projectRoot, found[0].dir) : null);
+}
+/** Integrity of every decision in the unit's reach (project + unit dirs) plus its rejected overrides. */
+function journeyDecisionFindings(projectRoot, overrides) {
+    const reach = ['qa/decisions/', ...(overrides.unitScope ? [`qa/${overrides.unitScope}/decisions/`] : [])];
+    const integrity = (0, decision_integrity_check_1.checkDecisionIntegrity)(projectRoot)
+        .filter((f) => reach.some((r) => f.path.startsWith(r)))
+        .map((f) => ({ rule: f.rule, path: f.path, message: f.message }));
+    const rejected = overrides.rejected.map((r) => ({ rule: 'gate.override-rejected', path: r.path, message: `${r.decisionId}: ${r.reason}` }));
+    return [...integrity, ...rejected];
+}
+function decisionFindingText(f) {
+    return `⛔ ${f.rule}: ${f.path} — ${f.message}. Hard rule: restore the file from git, or record a superseding decision on a terminal.`;
+}
+//# sourceMappingURL=journey-gate-inputs.js.map

package/dist/harness/gates/journey-gate-inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journey-gate-inputs.js","sourceRoot":"","sources":["../../../src/harness/gates/journey-gate-inputs.ts"],"names":[],"mappings":";;;AAyBA,4CAQC;AAiBD,kDAaC;AAED,kDAEC;AAID,sCAGC;AAGD,0DAOC;AAED,kDAEC;AAxFD;;;;;;;;;;GAUG;AACH,uFAAkF;AAClF,yDAA+D;AAC/D,2EAAuH;AAGvH,+DAAiG;AASjG,SAAgB,gBAAgB,CAAC,WAAmB,EAAE,IAAY;IAChE,MAAM,YAAY,GAAG,IAAA,6CAAiB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,IAAA,uCAAW,EAAC,YAAY,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IACnF,OAAO;QACL,KAAK,EAAE,IAAI;QACX,YAAY;QACZ,GAAG,CAAC,YAAY,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAA,iDAAqB,EAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED,wDAAwD;AAC3C,QAAA,eAAe,GAAqC;IAC/D,SAAS,EAAE,qBAAqB;IAChC,aAAa,EAAE,0BAA0B;IACzC,UAAU,EAAE,uBAAuB;IACnC,UAAU,EAAE,yBAAyB;CACtC,CAAC;AAIF;;;;GAIG;AACH,SAAgB,mBAAmB,CAAkC,WAAgB,EAAE,KAA8B,EAAE,OAAyB;IAC9I,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrG,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;IACzH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAe,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,YAAY;YAAE,SAAS;QAC/C,EAAE,CAAC,MAAM,GAAG,YAAY,CAAC;QACzB,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,UAAU,CAAC;QAC/B,EAAE,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC;IAC3G,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,mBAAmB,CAAC,CAAqB;IACvD,OAAO,+BAA+B,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,qGAAqG,CAAC;AACrL,CAAC;AAID,SAAgB,aAAa,CAAC,WAAmB,EAAE,IAAY;IAC7D,MAAM,KAAK,GAAG,IAAA,oCAAqB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACvD,OAAO,IAAA,2CAAqB,EAAC,WAAW,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAc,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACnH,CAAC;AAED,yGAAyG;AACzG,SAAgB,uBAAuB,CAAC,WAAmB,EAAE,SAA4B;IACvF,MAAM,KAAK,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1G,MAAM,SAAS,GAA0B,IAAA,iDAAsB,EAAC,WAAW,CAAC;SACzE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAA0B,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACnK,OAAO,CAAC,GAAG,SAAS,EAAE,GAAG,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,SAAgB,mBAAmB,CAAC,CAAsB;IACxD,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,yFAAyF,CAAC;AACxI,CAAC"}

package/dist/harness/gates/migrated-waiver-import-bounds.d.ts

@@ -0,0 +1,13 @@
+import type { ReadDecision } from '../../decisions/read-decisions';
+/**
+ * What a human does about a migrated waiver its legacy record cannot vouch for: record it anew on a
+ * terminal (a `cli` decision that supersedes it — the superseded one is no longer judged), or accept it
+ * for one delivery.
+ */
+export declare const migratedWaiverRemedy: (scope: string, ob: string) => string;
+/** One run's bounds: each decision's first appearance, each unit's marker and the project's adoption, read once. */
+export declare function migratedWaiverImportBounds(projectRoot: string): {
+    /** Why a record committed at `at` (state file of `slug`) cannot have been the source of `e`'s import; undefined when it can. */
+    notImported(slug: string, e: ReadDecision, at: string): string | undefined;
+};
+//# sourceMappingURL=migrated-waiver-import-bounds.d.ts.map

package/dist/harness/gates/migrated-waiver-import-bounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrated-waiver-import-bounds.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/migrated-waiver-import-bounds.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAKnE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,MAE2B,CAAC;AAO7F,oHAAoH;AACpH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,MAAM;IAmD1D,gIAAgI;sBAC9G,MAAM,KAAK,YAAY,MAAM,MAAM,GAAG,MAAM,GAAG,SAAS;EAK7E"}

package/dist/harness/gates/migrated-waiver-import-bounds.js

@@ -0,0 +1,141 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migratedWaiverRemedy = void 0;
+exports.migratedWaiverImportBounds = migratedWaiverImportBounds;
+/**
+ * Could a migrated waiver's legacy record have been the source of the import that wrote it? (#925)
+ *
+ * The one-time import (legacy-waiver-migration.ts) reads a record git HEAD ALREADY holds, and only
+ * before 3.3 takes over. So a genuine record was committed strictly before each of:
+ *   1. the decision file's first appearance — its first commit, else its creation on disk;
+ *   2. the unit's import marker `.sungen/migrations/<slug>.waivers-imported.json` — the commit that
+ *      added the one HEAD holds (an agent can delete or recreate the file, not that commit), else its
+ *      creation on disk; once it exists the import never reads that unit's legacy file again;
+ *   3. the project's adoption of 3.3 — the first commit that added any 3.3-only file: an import marker
+ *      or other `.sungen/migrations/` file, a decision file (`qa/**\/decisions/*.yaml`) or a contract lock
+ *      (`qa/**\/contracts.lock.yaml`). Only the 3.3 CLI writes them, and only committed ones count: a
+ *      legacy waiver is one written before the project's first reviewed 3.3 change. Mixed versions pay
+ *      for it: a waiver a pre-3.3 CLI writes after that commit must be re-confirmed on a terminal.
+ * A record failing any bound claims a migration that never happened: the decision is in-run.
+ *
+ * What stays open (the limit of any time-based check, as for ordinary decisions): a record forged and
+ * committed before the project's first 3.3 commit — indistinguishable from a real legacy waiver, as on
+ * a project adopting 3.3 for the very first time — and commit times forged with GIT_COMMITTER_DATE.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const git_head_trust_1 = require("../../decisions/git-head-trust");
+const human_confirmation_1 = require("../../decisions/human-confirmation");
+const legacy_waiver_migration_1 = require("../../decisions/legacy-waiver-migration");
+/** Files only the 3.3 CLI writes, as pathspecs relative to the project. */
+const ADOPTION_PATHSPECS = ['.sungen/migrations', ':(glob)qa/**/decisions/*.yaml', ':(glob)qa/**/contracts.lock.yaml'];
+/**
+ * What a human does about a migrated waiver its legacy record cannot vouch for: record it anew on a
+ * terminal (a `cli` decision that supersedes it — the superseded one is no longer judged), or accept it
+ * for one delivery.
+ */
+const migratedWaiverRemedy = (scope, ob) => `re-confirm it on a terminal: ${(0, human_confirmation_1.formatCommand)(['sungen', 'journey', '--screen', scope.split('/').pop() ?? scope, '--waive', ob, '--reason', '…'])}, `
+    + 'then commit the new decision; or accept it once with `sungen delivery --accept-in-run`';
+exports.migratedWaiverRemedy = migratedWaiverRemedy;
+const validMs = (iso) => (iso && !Number.isNaN(Date.parse(iso)) ? Date.parse(iso) : null);
+const createdMs = (abs) => {
+    try {
+        const s = fs.statSync(abs);
+        return s.birthtimeMs || s.mtimeMs;
+    }
+    catch {
+        return null;
+    }
+};
+/** One run's bounds: each decision's first appearance, each unit's marker and the project's adoption, read once. */
+function migratedWaiverImportBounds(projectRoot) {
+    const relOf = (abs) => path.relative(projectRoot, abs).split(path.sep).join('/');
+    const firstSeen = new Map();
+    const markers = new Map();
+    let adoption;
+    /** When a decision file first appeared: its first commit, else its creation (or last change) on disk. */
+    const decisionMs = (e) => {
+        if (!firstSeen.has(e.path)) {
+            const added = (0, git_head_trust_1.gitOutput)(projectRoot, ['log', '--diff-filter=A', '--format=%cI', '--', relOf(e.path)])?.trim().split('\n').filter(Boolean).pop();
+            firstSeen.set(e.path, validMs(added) ?? createdMs(e.path) ?? Number.NEGATIVE_INFINITY);
+        }
+        return firstSeen.get(e.path);
+    };
+    const markerMs = (slug) => {
+        if (!markers.has(slug)) {
+            const abs = (0, legacy_waiver_migration_1.importMarkerPath)(projectRoot, slug);
+            const added = (0, git_head_trust_1.committedText)(projectRoot, abs) !== null
+                ? validMs((0, git_head_trust_1.gitOutput)(projectRoot, ['log', '-1', '--diff-filter=A', '--format=%cI', '--', relOf(abs)])?.trim()) : null;
+            markers.set(slug, added ?? createdMs(abs));
+        }
+        return markers.get(slug);
+    };
+    const adoptionMs = () => {
+        if (adoption === undefined) {
+            const added = ((0, git_head_trust_1.gitOutput)(projectRoot, ['log', '--diff-filter=A', '--format=%cI', '--', ...ADOPTION_PATHSPECS]) ?? '')
+                .split('\n').map((l) => validMs(l.trim())).filter((t) => t !== null);
+            adoption = added.length ? Math.min(...added) : null;
+        }
+        return adoption;
+    };
+    /** The first bound a record committed at `legacy` (ms) crosses, or undefined. */
+    const boundCrossed = (slug, e, legacy) => {
+        const decision = decisionMs(e);
+        if (legacy > decision)
+            return 'after this decision first appeared';
+        if (legacy === decision)
+            return 'when this decision first appeared, not before it — an import only reads a record already committed';
+        const marker = markerMs(slug);
+        if (marker !== null && legacy >= marker) {
+            return `after this unit's waivers were imported (${relOf((0, legacy_waiver_migration_1.importMarkerPath)(projectRoot, slug))}, ${new Date(marker).toISOString()}) `
+                + '— from then on the import never reads the legacy file';
+        }
+        const adopted = adoptionMs();
+        if (adopted !== null && legacy >= adopted) {
+            return `after this project adopted sungen 3.3 (${new Date(adopted).toISOString()}: the first commit adding a .sungen/migrations/ file, `
+                + 'a decision or a contract lock) — a legacy waiver is one written before that';
+        }
+        return undefined;
+    };
+    return {
+        /** Why a record committed at `at` (state file of `slug`) cannot have been the source of `e`'s import; undefined when it can. */
+        notImported(slug, e, at) {
+            const why = boundCrossed(slug, e, Date.parse(at));
+            return why && `migrated: its legacy record was committed at ${at}, ${why}; ${(0, exports.migratedWaiverRemedy)(e.scope, String(e.payload?.obligation))}`;
+        },
+    };
+}
+//# sourceMappingURL=migrated-waiver-import-bounds.js.map

package/dist/harness/gates/migrated-waiver-import-bounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrated-waiver-import-bounds.js","sourceRoot":"","sources":["../../../src/harness/gates/migrated-waiver-import-bounds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,gEAyDC;AAtGD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,uCAAyB;AACzB,2CAA6B;AAC7B,mEAA0E;AAC1E,2EAAmE;AACnE,qFAA2E;AAG3E,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,EAAE,+BAA+B,EAAE,kCAAkC,CAAC,CAAC;AAEvH;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAAC,KAAa,EAAE,EAAU,EAAU,EAAE,CACxE,gCAAgC,IAAA,kCAAa,EAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI;MACnJ,wFAAwF,CAAC;AAFhF,QAAA,oBAAoB,wBAE4D;AAE7F,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAiB,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7H,MAAM,SAAS,GAAG,CAAC,GAAW,EAAiB,EAAE;IAC/C,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC/F,CAAC,CAAC;AAEF,oHAAoH;AACpH,SAAgB,0BAA0B,CAAC,WAAmB;IAC5D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,IAAI,QAAmC,CAAC;IAExC,yGAAyG;IACzG,MAAM,UAAU,GAAG,CAAC,CAAe,EAAU,EAAE;QAC7C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;YAChJ,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,CAAC;IAChC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAiB,EAAE;QAC/C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,IAAA,0CAAgB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,IAAA,8BAAa,EAAC,WAAW,EAAE,GAAG,CAAC,KAAK,IAAI;gBACpD,CAAC,CAAC,OAAO,CAAC,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvH,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,GAAkB,EAAE;QACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,CAAC,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;iBAClH,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACpF,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,iFAAiF;IACjF,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,CAAe,EAAE,MAAc,EAAsB,EAAE;QACzF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,MAAM,GAAG,QAAQ;YAAE,OAAO,oCAAoC,CAAC;QACnE,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,oGAAoG,CAAC;QACrI,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACxC,OAAO,4CAA4C,KAAK,CAAC,IAAA,0CAAgB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,IAAI;kBAChI,uDAAuD,CAAC;QAC9D,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,IAAI,OAAO,EAAE,CAAC;YAC1C,OAAO,0CAA0C,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,wDAAwD;kBACpI,6EAA6E,CAAC;QACpF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO;QACL,gIAAgI;QAChI,WAAW,CAAC,IAAY,EAAE,CAAe,EAAE,EAAU;YACnD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,OAAO,GAAG,IAAI,gDAAgD,EAAE,KAAK,GAAG,KAAK,IAAA,4BAAoB,EAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9I,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/harness/gates/migrated-waiver-review.d.ts

@@ -0,0 +1,16 @@
+import type { ReadDecision } from '../../decisions/read-decisions';
+/** A migrated waiver HEAD's legacy file holds: when it was reviewed, or why that cannot be said. */
+export interface MigratedReview {
+    /** When its legacy record was committed; null when that commit is out of reach (see `unvouched`). */
+    at: string | null;
+    /** Set with `at`: why the record cannot have been the import's source — the decision is in-run. */
+    notImported?: string;
+    /** Set when `at` is null: why the record vouches for nothing — the decision is judged as any other. */
+    unvouched?: string;
+}
+/** One run's reads for migrated waivers: each state file's history, decision's first commit and import marker, read once. */
+export declare function migratedWaiverReview(projectRoot: string): {
+    /** How a migrated waiver was reviewed; null when it is not one HEAD's legacy file holds (judged as any other). */
+    reviewOf(scope: string, e: ReadDecision): MigratedReview | null;
+};
+//# sourceMappingURL=migrated-waiver-review.d.ts.map

package/dist/harness/gates/migrated-waiver-review.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrated-waiver-review.d.ts","sourceRoot":"","sources":["../../../src/harness/gates/migrated-waiver-review.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAYnE,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,qGAAqG;IACrG,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,mGAAmG;IACnG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uGAAuG;IACvG,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA4CD,6HAA6H;AAC7H,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM;IAWpD,kHAAkH;oBAClG,MAAM,KAAK,YAAY,GAAG,cAAc,GAAG,IAAI;EAgBlE"}

package/dist/harness/gates/migrated-waiver-review.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migratedWaiverReview = migratedWaiverReview;
+/**
+ * When a MIGRATED waiver was reviewed (DOS-13.5, phase 09) — for `decision.in-run`.
+ *
+ * The import (legacy-waiver-migration.ts) trusts a legacy waiver only when git HEAD's
+ * `.sungen/journey/<slug>.state.json` holds that exact record; its review was the commit that put the
+ * record there. So a migrated decision is judged by THAT commit, not by its own file:
+ *
+ *   vouched   HEAD's state file holds the record (same reason, `at`, auditHashAtWaive) — reviewedAt is
+ *             the commit time of the oldest commit in the unbroken run, back from HEAD, that holds it
+ *   imported  the record could have been the import's source (#925) — always checked, run start or not:
+ *             committed strictly before the decision file, the unit's import marker and the project's
+ *             adoption of 3.3 first appeared (migrated-waiver-import-bounds.ts). Failing one, the decision
+ *             claims a migration that never happened → in-run, even at `gate --phase deliver`, which has
+ *             no run start.
+ *   with a run start   also in-run when reviewedAt is after it (the same test as any committed decision)
+ * Anything else — no git, no such record in HEAD, a record that differs — is not vouched for: the
+ * decision is judged as any other (`not in git HEAD`, or its own commit time). Only a rewritten history
+ * (a squash or rebase that folds the record's commit into the import's) can fail a genuine import; the
+ * finding says which bound it crossed.
+ *
+ * Nor is a record whose introducing commit is out of reach — judged as any other, with `unvouched`
+ * saying why, never vouched for by a later commit taken for its introduction: the walk reads at most
+ * MAX_COMMITS commits of a state file and the record is held by the commit before them too (#924), or
+ * the record reaches a shallow clone's boundary commit. One review reads each state file's history
+ * once (one `git log`, one `git cat-file --batch`), however many waivers share it.
+ */
+const git_head_trust_1 = require("../../decisions/git-head-trust");
+const waiver_decisions_1 = require("../../decisions/waiver-decisions");
+const unit_paths_1 = require("../unit-paths");
+const migrated_waiver_import_bounds_1 = require("./migrated-waiver-import-bounds");
+/** Commits of one state file the walk reads at most. */
+const MAX_COMMITS = 200;
+const parse = (text) => {
+    if (text === null)
+        return null;
+    try {
+        return JSON.parse(text.replace(/^/, ''));
+    }
+    catch {
+        return null;
+    }
+};
+function holds(state, e, ob) {
+    const w = state?.waivers?.[ob];
+    return (0, waiver_decisions_1.isLegacyWaiver)(w) && w.at === e.valid_from && (0, waiver_decisions_1.sameWaiver)(w, (0, waiver_decisions_1.asLegacyWaiver)(e));
+}
+function readHistory(projectRoot, rel) {
+    const log = ((0, git_head_trust_1.gitOutput)(projectRoot, ['log', `--max-count=${MAX_COMMITS + 1}`, '--format=%H %cI %P', '--', rel]) ?? '')
+        .split('\n').filter(Boolean).map((line) => line.trim().split(' '));
+    const texts = (0, git_head_trust_1.gitFileTexts)(projectRoot, [`HEAD:./${rel}`, ...log.map(([sha]) => `${sha}:./${rel}`)]);
+    return {
+        rel,
+        head: parse(texts?.[0] ?? null),
+        commits: log.map(([, at, ...parents], i) => ({ at, state: parse(texts?.[i + 1] ?? null), root: parents.length === 0 })),
+    };
+}
+/**
+ * The commit time of the oldest commit, in the unbroken run back from HEAD, whose state file holds the
+ * record. The walk reads MAX_COMMITS commits; the next one only says whether the last of them introduced it.
+ * In a shallow clone a commit with no parent shown is the boundary: every file seems to appear there, so a
+ * record reaching it has no known commit time.
+ */
+function introducedAt(h, e, ob, scope, shallow) {
+    let run = 0;
+    while (run < h.commits.length && holds(h.commits[run].state, e, ob))
+        run++;
+    const unvouched = (why) => ({ at: null, unvouched: `migrated, but its legacy record cannot vouch for it: ${why}` });
+    if (run > MAX_COMMITS) {
+        return unvouched(`${h.rel} changed in more than ${MAX_COMMITS} commits, and the commit that introduced the record is older than all of them`);
+    }
+    const oldest = run ? h.commits[run - 1] : null;
+    if (oldest?.root && shallow()) {
+        return unvouched(`the git history is shallow, so the record's real commit time is unknown — fetch the full history `
+            + `(\`git fetch --unshallow\`; \`fetch-depth: 0\` in CI), or ${(0, migrated_waiver_import_bounds_1.migratedWaiverRemedy)(scope, ob)}`);
+    }
+    return oldest && !Number.isNaN(Date.parse(oldest.at)) ? { at: oldest.at } : null;
+}
+/** One run's reads for migrated waivers: each state file's history, decision's first commit and import marker, read once. */
+function migratedWaiverReview(projectRoot) {
+    const histories = new Map();
+    const bounds = (0, migrated_waiver_import_bounds_1.migratedWaiverImportBounds)(projectRoot);
+    let isShallow;
+    const shallow = () => (isShallow ?? (isShallow = (0, git_head_trust_1.isShallowRepository)(projectRoot)));
+    const historyOf = (rel) => {
+        if (!histories.has(rel))
+            histories.set(rel, readHistory(projectRoot, rel));
+        return histories.get(rel);
+    };
+    return {
+        /** How a migrated waiver was reviewed; null when it is not one HEAD's legacy file holds (judged as any other). */
+        reviewOf(scope, e) {
+            const ob = e.payload?.obligation;
+            if (e.kind !== 'waiver' || e.source?.where !== 'migrated' || typeof ob !== 'string')
+                return null;
+            // The journey keys its state by the unit name it was given: `<name>`, or the catalog id for api units.
+            const slugs = new Set([scope.split('/').pop() ?? '', (0, unit_paths_1.reportSlug)(scope.replace(/^(screens|flows)\//, ''))]);
+            let unvouched = null;
+            for (const slug of slugs) {
+                const h = historyOf(`.sungen/journey/${slug}.state.json`);
+                if (!holds(h.head, e, ob))
+                    continue;
+                const review = introducedAt(h, e, ob, scope, shallow);
+                if (review?.at)
+                    return { at: review.at, notImported: bounds.notImported(slug, e, review.at) };
+                unvouched = unvouched ?? review;
+            }
+            return unvouched;
+        },
+    };
+}
+//# sourceMappingURL=migrated-waiver-review.js.map

package/dist/harness/gates/migrated-waiver-review.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrated-waiver-review.js","sourceRoot":"","sources":["../../../src/harness/gates/migrated-waiver-review.ts"],"names":[],"mappings":";;AA4FA,oDA4BC;AAxHD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,mEAA8F;AAE9F,uEAA8F;AAC9F,8CAA2C;AAC3C,mFAAmG;AAEnG,wDAAwD;AACxD,MAAM,WAAW,GAAG,GAAG,CAAC;AAgBxB,MAAM,KAAK,GAAG,CAAC,IAAmB,EAAS,EAAE;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,SAAS,KAAK,CAAC,KAAY,EAAE,CAAe,EAAE,EAAU;IACtD,MAAM,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,IAAA,iCAAc,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,IAAI,IAAA,6BAAU,EAAC,CAAC,EAAE,IAAA,iCAAc,EAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,GAAW;IACnD,MAAM,GAAG,GAAG,CAAC,IAAA,0BAAS,EAAC,WAAW,EAAE,CAAC,KAAK,EAAE,eAAe,WAAW,GAAG,CAAC,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;SACnH,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,IAAA,6BAAY,EAAC,WAAW,EAAE,CAAC,UAAU,GAAG,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACrG,OAAO;QACL,GAAG;QACH,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC/B,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;KACxH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,CAAe,EAAE,CAAe,EAAE,EAAU,EAAE,KAAa,EAAE,OAAsB;IACvG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAAE,GAAG,EAAE,CAAC;IAC3E,MAAM,SAAS,GAAG,CAAC,GAAW,EAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,wDAAwD,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5I,IAAI,GAAG,GAAG,WAAW,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,yBAAyB,WAAW,+EAA+E,CAAC,CAAC;IAChJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,MAAM,EAAE,IAAI,IAAI,OAAO,EAAE,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,mGAAmG;cAChH,6DAA6D,IAAA,oDAAoB,EAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnF,CAAC;AAED,6HAA6H;AAC7H,SAAgB,oBAAoB,CAAC,WAAmB;IACtD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;IAClD,MAAM,MAAM,GAAG,IAAA,0DAA0B,EAAC,WAAW,CAAC,CAAC;IACvD,IAAI,SAA8B,CAAC;IACnC,MAAM,OAAO,GAAG,GAAY,EAAE,CAAC,CAAC,SAAS,KAAT,SAAS,GAAK,IAAA,oCAAmB,EAAC,WAAW,CAAC,EAAC,CAAC;IAChF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAgB,EAAE;QAC9C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,kHAAkH;QAClH,QAAQ,CAAC,KAAa,EAAE,CAAe;YACrC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,UAAU,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACjG,uGAAuG;YACvG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAA,uBAAU,EAAC,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3G,IAAI,SAAS,GAA0B,IAAI,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,SAAS,CAAC,mBAAmB,IAAI,aAAa,CAAC,CAAC;gBAC1D,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;oBAAE,SAAS;gBACpC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBACtD,IAAI,MAAM,EAAE,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9F,SAAS,GAAG,SAAS,IAAI,MAAM,CAAC;YAClC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}