@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/grade-runner.js

@@ -0,0 +1,176 @@
+/*
+ * grade-runner — the injection-safe, READ-ONLY bridge to the `shipwright-grade`
+ * plugin's `grade.py` tool (A09b, FR-01.53). The Intent-Wizard's Grade door
+ * renders the plugin's real `ReportModel`; this module produces it. Target
+ * validation + plugin resolution live in `grade-target.ts`; this owns the spawn
+ * + the outcome mapping.
+ *
+ * ── IO / injection boundary (the reason A09 was split) ──────────────────────
+ * `grade.py <target> --format json` is spawned with **shell:false** and a
+ * **fixed-literal python binary** (resolved by TEST-RUN, python3→python→py,
+ * reusing `readiness-probe.resolvePython`). The target is passed as a **fixed
+ * argv position** — never interpolated into a shell string, so no shell
+ * metacharacter in a user-entered path/URL can reach a shell (there is none).
+ * Mirrors the ADR-044 #9 / `pr-status.ts` spawn discipline. Must NOT trip
+ * Semgrep `spawn-shell-true`.
+ *
+ * READ-ONLY: grade is a pure read of a repo. It registers no project, writes
+ * nothing to the graded repo, and never touches `~/.claude/projects/**`,
+ * `shipwright_run_config.json` or `run_loop_state.json` (CLAUDE.md rules 1/12).
+ * A remote URL is shallow-cloned into a throwaway tempdir *by grade.py* and
+ * purged when it exits — webui does not clone.
+ *
+ * Every grade.py outcome maps to an HONEST state (never a fabricated grade):
+ *   exit 0 + JSON            → report-ready (raw model; the CLIENT reportShape
+ *                              guard is the cross-repo contract check, ADR-045)
+ *   exit 2 (TargetError)     → grade-failed        ("couldn't grade that repo")
+ *   exit 3 (EngineUnavail.)  → engine-unavailable  (reuse the readiness repair)
+ *   python/script missing    → engine-unavailable
+ *   non-JSON stdout          → shape-unrecognised
+ *   other non-zero / timeout → grade-failed
+ *
+ * Pure over its injected seams (`run`, `spawn`, `statDir`, fs) so every branch
+ * is unit-testable without a real toolchain / a real clone (CI mocks the
+ * subprocess — no live grade.py).
+ */
+import { execFile } from "node:child_process";
+import { defaultRun, READINESS_REPAIR_COMMAND, resolvePython, } from "./readiness-probe.js";
+import { defaultStatDir, ENV_COMPLIANCE_ROOT, resolveComplianceRoot, resolveGradeScript, validateGradeTarget, } from "./grade-target.js";
+/** grade.py can shallow-clone + read a whole history; a remote target needs
+ *  headroom over a local one. Generous, but bounded (a hung clone is killed). */
+export const DEFAULT_GRADE_TIMEOUT_MS = 120_000;
+/**
+ * Default spawn — `execFile` (shell:false) so no shell process exists and the
+ * event loop is never blocked while grade.py reads a history / clones. The
+ * target is `args[1]` (a fixed argv position), never a shell string.
+ */
+export const defaultSpawnGrade = (bin, args, opts) => new Promise((resolve) => {
+    execFile(bin, args, {
+        encoding: "utf-8",
+        timeout: opts.timeoutMs,
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+        env: opts.env,
+    }, (error, stdout, stderr) => {
+        const out = String(stdout ?? "");
+        const err = String(stderr ?? "");
+        if (!error) {
+            resolve({ code: 0, stdout: out, stderr: err });
+            return;
+        }
+        const e = error;
+        if (typeof e.code === "string") {
+            // ENOENT / EACCES — python failed to start.
+            resolve({ code: -1, stdout: out, stderr: err, spawnError: e.code });
+            return;
+        }
+        if (e.killed) {
+            resolve({ code: 124, stdout: out, stderr: err, spawnError: "timeout" });
+            return;
+        }
+        resolve({ code: typeof e.code === "number" ? e.code : 1, stdout: out, stderr: err });
+    });
+});
+const ENGINE_UNAVAILABLE_REASON = "The grade engine isn't installed.";
+function cleanStderr(stderr) {
+    // grade.py prefixes its own errors with "shipwright-grade: " — strip it for a
+    // plain-language card; keep the human reason.
+    const line = stderr.split(/\r?\n/).map((l) => l.trim()).filter(Boolean).pop() ?? "";
+    return line.replace(/^shipwright-grade:\s*/i, "").trim();
+}
+/**
+ * Validate → resolve engine → spawn `grade.py <target> --format json` → map the
+ * outcome to an honest {@link GradeOutcome}. Never throws for a grade failure;
+ * only a programming error would reject.
+ */
+export async function runGrade(input, deps = {}) {
+    const statDir = deps.statDir ?? defaultStatDir;
+    const run = deps.run ?? defaultRun;
+    const spawn = deps.spawn ?? defaultSpawnGrade;
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_GRADE_TIMEOUT_MS;
+    const resolveDeps = {
+        homeDir: deps.homeDir,
+        existsFn: deps.existsFn,
+        readdirFn: deps.readdirFn,
+    };
+    // 1 — validate the target (shape + existence) BEFORE any spawn.
+    const v = validateGradeTarget(input.target, statDir);
+    if (!v.ok)
+        return { status: "grade-failed", reason: v.reason };
+    const target = input.target.trim();
+    // 2 — resolve the engine: grade.py + a working python. Either missing is an
+    //     honest "engine unavailable — run npx …" (reuse the readiness repair).
+    const script = resolveGradeScript({ ...resolveDeps, scriptOverride: deps.scriptOverride });
+    if (!script) {
+        return {
+            status: "engine-unavailable",
+            reason: ENGINE_UNAVAILABLE_REASON,
+            repairCommand: READINESS_REPAIR_COMMAND,
+        };
+    }
+    const py = await resolvePython(run);
+    if (!py) {
+        return {
+            status: "engine-unavailable",
+            reason: "No working Python (3.11+) was found.",
+            repairCommand: READINESS_REPAIR_COMMAND,
+        };
+    }
+    // 3 — spawn. The compliance root is passed via env so grade.py's engine loads
+    //     in the versioned cache layout (its default sibling-resolution fails there).
+    const complianceRoot = resolveComplianceRoot({
+        ...resolveDeps,
+        complianceOverride: deps.complianceOverride,
+    });
+    const baseEnv = deps.baseEnv ?? process.env;
+    const env = { ...baseEnv };
+    if (complianceRoot)
+        env[ENV_COMPLIANCE_ROOT] = complianceRoot;
+    // Fixed argv: options first, then a `--` END-OF-OPTIONS separator, then the
+    // target as the sole positional. shell:false already blocks shell injection;
+    // the `--` additionally blocks ARGUMENT injection — a target like `--no-clone`
+    // or `--allow-network-private` is treated as a path, never a grade.py flag
+    // (mirrors the pr-status.ts `--` discipline; verified against argparse).
+    const args = [script, "--format", "json", "--", target];
+    const r = await spawn(py.bin, args, { env, timeoutMs });
+    // 4 — map the outcome.
+    if (r.code === -1) {
+        return {
+            status: "engine-unavailable",
+            reason: "Python couldn't start on this machine.",
+            repairCommand: READINESS_REPAIR_COMMAND,
+        };
+    }
+    if (r.code === 3) {
+        return {
+            status: "engine-unavailable",
+            reason: cleanStderr(r.stderr) || ENGINE_UNAVAILABLE_REASON,
+            repairCommand: READINESS_REPAIR_COMMAND,
+        };
+    }
+    if (r.code === 2) {
+        return { status: "grade-failed", reason: cleanStderr(r.stderr) || "Couldn't grade that repo." };
+    }
+    if (r.code !== 0) {
+        return {
+            status: "grade-failed",
+            reason: r.spawnError === "timeout"
+                ? "Grading took too long and was stopped."
+                : cleanStderr(r.stderr) || "The grade tool exited with an error.",
+        };
+    }
+    // exit 0 — parse the JSON. A non-JSON / non-object payload is a shape the card
+    // can't render safely → the honest "report shape not recognised" state.
+    let model;
+    try {
+        model = JSON.parse(r.stdout);
+    }
+    catch {
+        return { status: "shape-unrecognised", reason: "The grade output wasn't valid JSON." };
+    }
+    if (model === null || typeof model !== "object" || Array.isArray(model)) {
+        return { status: "shape-unrecognised", reason: "The grade output wasn't a report object." };
+    }
+    return { status: "report-ready", model };
+}
+//# sourceMappingURL=grade-runner.js.map

package/server/dist/core/grade-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grade-runner.js","sourceRoot":"","sources":["../../src/core/grade-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EACL,UAAU,EACV,wBAAwB,EACxB,aAAa,GAEd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,mBAAmB,CAAC;AAE3B;iFACiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AA2ChD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACjE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,QAAQ,CACN,GAAG,EACH,IAAI,EACJ;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,KAAqD,CAAC;QAChE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,4CAA4C;YAC5C,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AA0BL,MAAM,yBAAyB,GAAG,mCAAmC,CAAC;AAEtE,SAAS,WAAW,CAAC,MAAc;IACjC,8EAA8E;IAC9E,8CAA8C;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACpF,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,KAAoB,EACpB,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,iBAAiB,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAC7D,MAAM,WAAW,GAAsB;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IAEF,gEAAgE;IAChE,MAAM,CAAC,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAEnC,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,sCAAsC;YAC9C,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,kFAAkF;IAClF,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,GAAG,WAAW;QACd,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5C,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,EAAE,CAAC;IAC9C,IAAI,cAAc;QAAE,GAAG,CAAC,mBAAmB,CAAC,GAAG,cAAc,CAAC;IAE9D,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAExD,uBAAuB;IACvB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,wCAAwC;YAChD,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,yBAAyB;YAC1D,aAAa,EAAE,wBAAwB;SACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,2BAA2B,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,MAAM,EACJ,CAAC,CAAC,UAAU,KAAK,SAAS;gBACxB,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,sCAAsC;SACtE,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,wEAAwE;IACxE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AAC3C,CAAC"}

package/server/dist/core/grade-target.d.ts

@@ -0,0 +1,43 @@
+/** grade.py's engine locator env var (engine_bridge._ENV_COMPLIANCE_ROOT). In
+ *  the versioned plugin CACHE layout the default sibling-resolution fails, so we
+ *  set this to the resolved shipwright-compliance plugin root. */
+export declare const ENV_COMPLIANCE_ROOT = "SHIPWRIGHT_GRADE_COMPLIANCE_ROOT";
+/** Server-side remote detection — never trust the client's `isRemote` hint. */
+export declare function looksRemote(target: string): boolean;
+export interface TargetValidation {
+    ok: boolean;
+    kind?: "local" | "remote";
+    reason?: string;
+}
+/**
+ * The feature is explicitly "a GitHub URL" — a bare read of a PUBLIC repo. So
+ * remote targets are gated by an ALLOWLIST of public git hosts, not a blocklist
+ * of private ranges. An allowlist eliminates the whole SSRF / IP-encoding-bypass
+ * class BY CONSTRUCTION: a lexical private-IP blocklist is bypassable (a hostname
+ * that DNS-resolves to a private address, integer/short/hex/octal IPv4 literals,
+ * IPv4-mapped IPv6, a trailing-dot FQDN) — every one of those simply isn't on the
+ * allowlist, so it never reaches `git clone`.
+ */
+export declare const ALLOWED_REMOTE_HOSTS: Set<string>;
+/** True iff `host` is an allowed PUBLIC git host. Normalizes a leading `www.`
+ *  and a single trailing FQDN dot before the exact-match check (so `github.com.`
+ *  / `www.github.com` still resolve to GitHub) — everything else is rejected. */
+export declare function hostIsAllowed(host: string): boolean;
+export declare function validateGradeTarget(target: unknown, statDir: (p: string) => boolean): TargetValidation;
+/** Default statDir seam — true iff `p` is an existing directory. */
+export declare function defaultStatDir(p: string): boolean;
+export interface PluginResolveDeps {
+    homeDir?: string;
+    existsFn?: (p: string) => boolean;
+    readdirFn?: (p: string) => string[];
+}
+/** Resolve `grade.py`, or an explicit `scriptOverride`. */
+export declare function resolveGradeScript(deps?: PluginResolveDeps & {
+    scriptOverride?: string;
+}): string | null;
+/** Resolve the shipwright-compliance plugin root (the dir carrying
+ *  `scripts/lib/control_grade.py`), which grade.py's engine_bridge needs. */
+export declare function resolveComplianceRoot(deps?: PluginResolveDeps & {
+    complianceOverride?: string;
+}): string | null;
+//# sourceMappingURL=grade-target.d.ts.map

package/server/dist/core/grade-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grade-target.d.ts","sourceRoot":"","sources":["../../src/core/grade-target.ts"],"names":[],"mappings":"AA6BA;;kEAEkE;AAClE,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AAQtE,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,aAAyD,CAAC;AAkB3F;;iFAEiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAUD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,GAC9B,gBAAgB,CAmClB;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAMjD;AAMD,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACrC;AA4BD,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAChC,IAAI,GAAE,iBAAiB,GAAG;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GACzD,MAAM,GAAG,IAAI,CAIf;AAED;6EAC6E;AAC7E,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,iBAAiB,GAAG;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,MAAM,GAAG,IAAI,CAQf"}

package/server/dist/core/grade-target.js

@@ -0,0 +1,162 @@
+/*
+ * grade-target — target validation + plugin resolution for the read-only Grade
+ * route (A09b, FR-01.53). The "where + is-it-legit" half of the grade bridge;
+ * `grade-runner.ts` owns the spawn + outcome mapping.
+ *
+ * Target validation is shape + existence, NOT path-confinement: grade may grade
+ * ANY repo, so this is not a project-root guard. It rejects obviously-bad input
+ * with an honest error BEFORE any spawn (empty/oversized, a NUL byte, a remote
+ * that isn't a plausible git/GitHub URL, or a local path that isn't a real dir).
+ * shell:false already makes injection impossible in the runner; this is honesty
+ * + a fast, clear failure. Remote-ness is re-derived here — never trust a client
+ * `isRemote` hint.
+ *
+ * Plugin resolution walks the versioned CACHE layout
+ * (`<cacheRoot>/shipwright-grade/<version>/scripts/tools/grade.py` and the
+ * `shipwright-compliance/<version>/` engine root), reusing readiness-probe's
+ * `shipwrightCacheRoot` + `compareVersions`. Pure over its fs seams.
+ */
+import { existsSync as fsExistsSync, readdirSync as fsReaddirSync, statSync as fsStatSync, } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { compareVersions, shipwrightCacheRoot } from "./readiness-probe.js";
+/** grade.py's engine locator env var (engine_bridge._ENV_COMPLIANCE_ROOT). In
+ *  the versioned plugin CACHE layout the default sibling-resolution fails, so we
+ *  set this to the resolved shipwright-compliance plugin root. */
+export const ENV_COMPLIANCE_ROOT = "SHIPWRIGHT_GRADE_COMPLIANCE_ROOT";
+/* ── Target validation ────────────────────────────────────────────────────── */
+const REMOTE_SCHEME_RE = /:\/\//;
+const GIT_SSH_RE = /^git@[^\s:]+:[^\s/]+\/.+/i;
+const HOST_SHORTHAND_RE = /^(?:www\.)?(?:(?:github|gitlab)\.com|bitbucket\.org)[/:]/i;
+/** Server-side remote detection — never trust the client's `isRemote` hint. */
+export function looksRemote(target) {
+    return REMOTE_SCHEME_RE.test(target) || GIT_SSH_RE.test(target) || HOST_SHORTHAND_RE.test(target);
+}
+/**
+ * The feature is explicitly "a GitHub URL" — a bare read of a PUBLIC repo. So
+ * remote targets are gated by an ALLOWLIST of public git hosts, not a blocklist
+ * of private ranges. An allowlist eliminates the whole SSRF / IP-encoding-bypass
+ * class BY CONSTRUCTION: a lexical private-IP blocklist is bypassable (a hostname
+ * that DNS-resolves to a private address, integer/short/hex/octal IPv4 literals,
+ * IPv4-mapped IPv6, a trailing-dot FQDN) — every one of those simply isn't on the
+ * allowlist, so it never reaches `git clone`.
+ */
+export const ALLOWED_REMOTE_HOSTS = new Set(["github.com", "gitlab.com", "bitbucket.org"]);
+/** Extract the host from a remote target across all accepted forms, or null. */
+function extractRemoteHost(t) {
+    let m = /^(?:https?|ssh|git):\/\/([^/]+)/i.exec(t);
+    if (m) {
+        let authority = m[1];
+        const at = authority.lastIndexOf("@"); // strip any userinfo
+        if (at >= 0)
+            authority = authority.slice(at + 1);
+        return authority.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();
+    }
+    m = /^git@([^:]+):/i.exec(t);
+    if (m)
+        return m[1].toLowerCase();
+    m = /^(?:www\.)?((?:github|gitlab)\.com|bitbucket\.org)\//i.exec(t);
+    if (m)
+        return m[1].toLowerCase();
+    return null;
+}
+/** True iff `host` is an allowed PUBLIC git host. Normalizes a leading `www.`
+ *  and a single trailing FQDN dot before the exact-match check (so `github.com.`
+ *  / `www.github.com` still resolve to GitHub) — everything else is rejected. */
+export function hostIsAllowed(host) {
+    const h = host.toLowerCase().replace(/\.$/, "").replace(/^www\./, "");
+    return ALLOWED_REMOTE_HOSTS.has(h);
+}
+const PLAUSIBLE_URL_RES = [
+    /^https?:\/\/[^\s/]+\/[^\s/]+\/[^\s]+/i, // https://host/owner/repo
+    /^ssh:\/\/[^\s]+\/[^\s/]+\/[^\s]+/i, // ssh://host/owner/repo
+    /^git:\/\/[^\s]+\/[^\s/]+\/[^\s]+/i, // git://host/owner/repo
+    /^git@[^\s:]+:[^\s/]+\/[^\s]+/i, // git@host:owner/repo
+    /^(?:www\.)?(?:(?:github|gitlab)\.com|bitbucket\.org)\/[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+/i, // host/owner/repo
+];
+export function validateGradeTarget(target, statDir) {
+    if (typeof target !== "string")
+        return { ok: false, reason: "No repo was given." };
+    const t = target.trim();
+    if (t.length === 0)
+        return { ok: false, reason: "No repo was given." };
+    if (t.length > 400)
+        return { ok: false, reason: "That path or URL is too long." };
+    if (t.includes("\0"))
+        return { ok: false, reason: "That path or URL is not valid." };
+    if (looksRemote(t)) {
+        // Reject credentials embedded in an http(s) URL (`https://user:pass@host/…`)
+        // — a grade never needs them, and echoing one back would leak a secret. The
+        // legitimate `git@host:owner/repo` SSH form (no scheme) is untouched.
+        if (/^https?:\/\/[^/@\s]*@/i.test(t)) {
+            return { ok: false, reason: "Remove the credentials from that URL — a grade never needs them." };
+        }
+        const plausible = PLAUSIBLE_URL_RES.some((re) => re.test(t));
+        if (!plausible) {
+            return { ok: false, reason: "That doesn't look like a git or GitHub repository URL." };
+        }
+        // ALLOWLIST gate (SSRF): only public GitHub / GitLab / Bitbucket hosts. Any
+        // other host — a private-IP literal in ANY encoding, a rebinding hostname, an
+        // internal name — is rejected here and never reaches `git clone`.
+        const host = extractRemoteHost(t);
+        if (!host || !hostIsAllowed(host)) {
+            return {
+                ok: false,
+                reason: "Only public GitHub, GitLab or Bitbucket repository URLs are supported.",
+            };
+        }
+        return { ok: true, kind: "remote" };
+    }
+    // A local target must resolve to a real directory on this machine.
+    if (!statDir(t)) {
+        return { ok: false, reason: "That folder doesn't exist on this machine (or isn't a folder)." };
+    }
+    return { ok: true, kind: "local" };
+}
+/** Default statDir seam — true iff `p` is an existing directory. */
+export function defaultStatDir(p) {
+    try {
+        return fsStatSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function resolveVersionedFile(pluginName, relFile, deps) {
+    const existsFn = deps.existsFn ?? fsExistsSync;
+    const readdirFn = deps.readdirFn ?? ((p) => fsReaddirSync(p));
+    const homeDir = deps.homeDir ?? os.homedir();
+    const pluginRoot = path.join(shipwrightCacheRoot(homeDir), pluginName);
+    let versions = [];
+    try {
+        versions = readdirFn(pluginRoot).filter((v) => /^\d/.test(v));
+    }
+    catch {
+        versions = [];
+    }
+    versions.sort((a, b) => compareVersions(b, a)); // highest first
+    for (const v of versions) {
+        const cand = path.join(pluginRoot, v, ...relFile);
+        if (existsFn(cand))
+            return cand;
+    }
+    // Defensive: unversioned (monorepo-style) layout.
+    const flat = path.join(pluginRoot, ...relFile);
+    return existsFn(flat) ? flat : null;
+}
+/** Resolve `grade.py`, or an explicit `scriptOverride`. */
+export function resolveGradeScript(deps = {}) {
+    const existsFn = deps.existsFn ?? fsExistsSync;
+    if (deps.scriptOverride)
+        return existsFn(deps.scriptOverride) ? deps.scriptOverride : null;
+    return resolveVersionedFile("shipwright-grade", ["scripts", "tools", "grade.py"], deps);
+}
+/** Resolve the shipwright-compliance plugin root (the dir carrying
+ *  `scripts/lib/control_grade.py`), which grade.py's engine_bridge needs. */
+export function resolveComplianceRoot(deps = {}) {
+    if (deps.complianceOverride)
+        return deps.complianceOverride;
+    const file = resolveVersionedFile("shipwright-compliance", ["scripts", "lib", "control_grade.py"], deps);
+    return file ? path.dirname(path.dirname(path.dirname(file))) : null;
+}
+//# sourceMappingURL=grade-target.js.map

package/server/dist/core/grade-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grade-target.js","sourceRoot":"","sources":["../../src/core/grade-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,UAAU,IAAI,YAAY,EAC1B,WAAW,IAAI,aAAa,EAC5B,QAAQ,IAAI,UAAU,GACvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE5E;;kEAEkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAEtE,iFAAiF;AAEjF,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,iBAAiB,GAAG,2DAA2D,CAAC;AAEtF,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACpG,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,CAAC,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,CAAC;QACN,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB;QAC5D,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,CAAC;IACD,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC,GAAG,uDAAuD,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtE,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,uCAAuC,EAAE,0BAA0B;IACnE,mCAAmC,EAAE,wBAAwB;IAC7D,mCAAmC,EAAE,wBAAwB;IAC7D,+BAA+B,EAAE,sBAAsB;IACvD,yFAAyF,EAAE,kBAAkB;CAC9G,CAAC;AAEF,MAAM,UAAU,mBAAmB,CACjC,MAAe,EACf,OAA+B;IAE/B,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvE,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAClF,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAErF,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACnB,6EAA6E;QAC7E,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACzF,CAAC;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,kEAAkE;QAClE,MAAM,IAAI,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,wEAAwE;aACjF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IACD,mEAAmE;IACnE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAYD,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,OAAiB,EACjB,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;IAEvE,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;IAChE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAClC,CAAC;IACD,kDAAkD;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAChC,OAAwD,EAAE;IAE1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC;IAC/C,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,OAAO,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,qBAAqB,CACnC,OAA4D,EAAE;IAE9D,IAAI,IAAI,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC;IAC5D,MAAM,IAAI,GAAG,oBAAoB,CAC/B,uBAAuB,EACvB,CAAC,SAAS,EAAE,KAAK,EAAE,kBAAkB,CAAC,EACtC,IAAI,CACL,CAAC;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/server/dist/core/inbox-derive.d.ts

@@ -0,0 +1,56 @@
+import type { ParsedSessionEvent } from "./session-parser.js";
+export declare const DEFAULT_USER_BLOCKING_TOOLS: Set<string>;
+export interface DeriveInboxArgs {
+    events: ParsedSessionEvent[];
+    allowlist?: Set<string>;
+    /** Ids the user explicitly dismissed; never resurface. */
+    dismissed?: Set<string>;
+}
+export interface InboxEntry {
+    toolUseId: string;
+    toolName: string;
+    input: unknown;
+    /** Assistant event index in `events`. */
+    atAssistantEvent: number;
+}
+export interface DeriveInboxResult {
+    pending: InboxEntry[];
+    /** All tool_use ids (blocking + non-blocking) seen; diagnostics only. */
+    allToolUseIds: string[];
+    /** Resolved ids (had matching tool_result). Useful to shrink the store. */
+    resolvedToolUseIds: string[];
+}
+export declare function deriveInbox(args: DeriveInboxArgs): DeriveInboxResult;
+/** Max chars of detected question text surfaced to the inbox (length cap). */
+export declare const MAX_QUESTION_TEXT_LEN = 2000;
+export interface TextQuestion {
+    /** uuid of the LAST assistant event of the trailing turn — stable id. */
+    questionId: string;
+    /** Detected question text, capped at MAX_QUESTION_TEXT_LEN. */
+    questionText: string;
+    /** Index in `events` of that last assistant event. */
+    atAssistantEvent: number;
+}
+export interface DeriveSessionInboxResult extends DeriveInboxResult {
+    /**
+     * Set when the session's latest turn is an unanswered plain-text question
+     * AND no tool_use is pending (a pending tool_use always wins — see
+     * `deriveSessionInbox`).
+     */
+    textQuestion: TextQuestion | null;
+}
+/**
+ * Surfaces a plain-text "awaiting user" question for the session, or null.
+ * Mutually exclusive with a pending tool_use by construction: a pending
+ * tool_use leaves a trailing assistant `tool_use` block, which step 3 rejects.
+ */
+export declare function detectAwaitingUserQuestion(events: ParsedSessionEvent[]): TextQuestion | null;
+/**
+ * Unified per-session inbox derivation. Runs the tool_use path
+ * (`deriveInbox`) and the plain-text-question path
+ * (`detectAwaitingUserQuestion`) and applies the precedence rule in ONE
+ * place: a pending tool_use (e.g. AskUserQuestion) wins — a session with a
+ * pending tool interaction never also surfaces a text question.
+ */
+export declare function deriveSessionInbox(args: DeriveInboxArgs): DeriveSessionInboxResult;
+//# sourceMappingURL=inbox-derive.d.ts.map

package/server/dist/core/inbox-derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-derive.d.ts","sourceRoot":"","sources":["../../src/core/inbox-derive.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9D,eAAO,MAAM,2BAA2B,aAAuC,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,yEAAyE;IACzE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,2EAA2E;IAC3E,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,iBAAiB,CAyBpE;AAcD,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,MAAM,WAAW,YAAY;IAC3B,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;;OAIG;IACH,YAAY,EAAE,YAAY,GAAG,IAAI,CAAC;CACnC;AAyFD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,kBAAkB,EAAE,GAC3B,YAAY,GAAG,IAAI,CA0CrB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,GACpB,wBAAwB,CAK1B"}