@svenroth-ai/shipwright 0.24.1-next.0

package/server/dist/core/mission-context/merge-check.js

@@ -0,0 +1,217 @@
+/*
+ * core/mission-context/merge-check.ts — squash-aware merge detection
+ * (CONTRACT §5.3). "Delivered" is a REAL observation, not a guess.
+ *
+ * THIS FILE IS THE COMMAND-INJECTION SURFACE both external reviews (Gemini +
+ * GPT) flagged. The PR number originates in a TRANSCRIPT MARKER — attacker-
+ * influenced data. Three rules, all enforced here:
+ *
+ *   1. The PR number is validated as a BOUNDED INTEGER (`/^\d+$/`, 1..1e7)
+ *      BEFORE it is used for anything. A non-numeric marker is dropped, never
+ *      passed along "just to be safe downstream".
+ *   2. git runs via an ARGUMENT ARRAY with `shell: false`. There is no command
+ *      string anywhere in this module — nothing to escape, nothing to inject.
+ *   3. The check is SQUASH-AWARE. `--is-ancestor` is WRONG: webui is
+ *      squash-only, so the branch SHA never becomes an ancestor of main. The
+ *      squash commit's message carries `(#NNN)`, so that is what we grep. And
+ *      we check `origin/main` — local `main` may lag the squash, which would
+ *      report a false "pending" until the user happens to fetch.
+ *
+ * Caching is ASYMMETRIC on purpose: `merged` is terminal and cached
+ * indefinitely; `pending` re-checks on a finite TTL (never cache pending
+ * forever — that would freeze the UI on a stale answer forever).
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileP = promisify(execFile);
+/** Upper bound on a plausible PR number — bounds the input, not just its shape. */
+const MAX_PR_NUMBER = 10_000_000;
+/**
+ * Validate a transcript-derived PR number. Accepts ONLY a run of ASCII digits
+ * with no sign, whitespace, separator or leading `+`; rejects 0 and anything
+ * above the bound. Returns null for everything else — the caller then reports
+ * `unknown`, never an unchecked value.
+ */
+export function validatePrNumber(v) {
+    const s = typeof v === "number" && Number.isInteger(v) ? String(v) : v;
+    if (typeof s !== "string")
+        return null;
+    if (!/^\d+$/.test(s))
+        return null;
+    const n = Number.parseInt(s, 10);
+    if (!Number.isSafeInteger(n) || n <= 0 || n > MAX_PR_NUMBER)
+        return null;
+    return n;
+}
+const defaultGit = async (args, cwd) => {
+    const { stdout } = await execFileP("git", args, {
+        cwd,
+        encoding: "utf-8",
+        timeout: 8000,
+        windowsHide: true,
+        maxBuffer: 1024 * 1024,
+    });
+    return stdout;
+};
+const cache = new Map();
+const PENDING_TTL_MS = 60_000;
+const CACHE_CAP = 512;
+/**
+ * Is the PR's squash commit present on `origin/main`?
+ *
+ * `git log <ref> --grep=(#NNN) --fixed-strings -n 1 --format=%H` — every token
+ * is a separate argv member. `--fixed-strings` keeps the needle a literal so a
+ * PR number can never be read as a regex (belt-and-braces: it is already
+ * digits-only by the time it gets here).
+ *
+ * Returns `unknown` — never `pending` — when the check could not run at all
+ * (no PR number, git missing, ref absent). "We could not check" and "we
+ * checked and it is not there" are different facts and the UI shows them
+ * differently.
+ */
+export async function checkSquashMerged(projectRoot, prNumber, deps = {}) {
+    const pr = validatePrNumber(prNumber);
+    if (pr == null)
+        return "unknown";
+    const git = deps.git ?? defaultGit;
+    const now = deps.now ?? Date.now;
+    const ttl = deps.pendingTtlMs ?? PENDING_TTL_MS;
+    const ref = deps.ref ?? "origin/main";
+    const key = `${projectRoot}::${ref}::${pr}`;
+    const hit = cache.get(key);
+    if (hit && (hit.expiresAt === null || hit.expiresAt > now()))
+        return hit.state;
+    let state;
+    try {
+        // `--grep` matches anywhere in the message, so it alone false-positives
+        // when an UNRELATED squash merely mentions this PR number ("follow-up to
+        // (#123)"). This repo has that shape in its own history. So the grep is
+        // only a cheap prefilter: we ask for SUBJECT lines (%s) and then require
+        // one to END with the marker, which is where the squash suffix actually
+        // lives. `-n 20` bounds the candidate set.
+        const out = await git(["log", ref, `--grep=(#${pr})`, "--fixed-strings", "-n", "20", "--format=%s"], projectRoot);
+        const marker = `(#${pr})`;
+        const merged = out
+            .split(/\r?\n/)
+            .map((s) => s.trim())
+            .some((subject) => subject.endsWith(marker));
+        state = merged ? "merged" : "pending";
+    }
+    catch {
+        // git missing, not a repo, or `origin/main` absent (never fetched) — we
+        // genuinely do not know. Do NOT claim "pending": that reads as "checked".
+        state = "unknown";
+    }
+    // ASYNC RACE GUARD (external code review, openai MEDIUM). Now that this
+    // function `await`s git, two concurrent misses for the same PR can spawn and
+    // resolve out of order. `merged` is TERMINAL and must never regress, so if a
+    // concurrent check already recorded it during our await, keep it — a later
+    // `pending` from our own spawn must not clobber it back to non-terminal.
+    const prior = cache.get(key);
+    if (prior?.state === "merged")
+        return "merged";
+    if (cache.size >= CACHE_CAP)
+        cache.clear();
+    cache.set(key, {
+        state,
+        // Merged is terminal — cache forever. Pending/unknown re-check on TTL.
+        expiresAt: state === "merged" ? null : now() + ttl,
+    });
+    return state;
+}
+/** Test-only: drop the module-level cache between cases. */
+export function _clearMergeCache() {
+    cache.clear();
+}
+/**
+ * Extract the LAST `pr-link` PR number from a raw JSONL transcript slice.
+ *
+ * The transcript is read SERVER-SIDE from webui's own authoritative source —
+ * the client never supplies it (CONTRACT §5.1 input trust boundary). The value
+ * found here is still untrusted DATA: it is handed straight to
+ * `validatePrNumber` and is never interpolated anywhere.
+ *
+ * Matches the github PR url shape rather than a bare number so an arbitrary
+ * `#123` in prose cannot be mistaken for a delivery marker.
+ *
+ * REPO BINDING (internal code review, MEDIUM): matching any `owner/repo` and
+ * keeping the LAST hit is not safe here. A shipwright session routinely cites a
+ * SIBLING repo's PR (`svenroth-ai/shipwright#290`) after its own webui link,
+ * and PR numbers across those two repos overlap almost completely — webui has
+ * its own #290. Grepping webui's `origin/main` for a shipwright PR number would
+ * render a false "Delivered". So a marker counts ONLY when its owner/repo
+ * matches the project's own `origin` remote; if the remote cannot be
+ * determined we return null and the merge state stays `unknown`, because
+ * "delivered" must be a real observation.
+ */
+const PR_URL_IN_TEXT = /https:\/\/github\.com\/([A-Za-z0-9._-]{1,64})\/([A-Za-z0-9._-]{1,64})\/pull\/(\d{1,8})\b/g;
+/**
+ * Parse `owner/repo` out of a git remote URL. Handles the https and scp-like
+ * SSH forms, with or without a trailing `.git`. Returns null for anything that
+ * is not a github remote — the caller then declines to verify.
+ */
+export function parseOriginSlug(remoteUrl) {
+    if (typeof remoteUrl !== "string" || remoteUrl.length === 0 || remoteUrl.length > 512)
+        return null;
+    const url = remoteUrl.trim();
+    const m = /^https?:\/\/(?:[^@/]+@)?github\.com\/([A-Za-z0-9._-]{1,64})\/([A-Za-z0-9._-]{1,64}?)(?:\.git)?\/?$/.exec(url) ??
+        /^(?:ssh:\/\/)?git@github\.com[:/]([A-Za-z0-9._-]{1,64})\/([A-Za-z0-9._-]{1,64}?)(?:\.git)?\/?$/.exec(url);
+    if (!m)
+        return null;
+    return { owner: m[1], repo: m[2] };
+}
+// The PROMISE is cached, not just the resolved value: two overlapping resolves
+// (e.g. two open tabs polling the same project) then share ONE `git remote`
+// spawn instead of racing two. `origin` is effectively immutable per project, so
+// a resolved slug is memoized for the process lifetime exactly as before.
+const slugCache = new Map();
+/** Read (and memoize) the project's own `origin` slug. Arg-array git, shell:false. */
+export function readOriginSlug(projectRoot, git = defaultGit) {
+    const cached = slugCache.get(projectRoot);
+    if (cached)
+        return cached;
+    const pending = (async () => {
+        try {
+            return parseOriginSlug(await git(["remote", "get-url", "origin"], projectRoot));
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (slugCache.size > 128)
+        slugCache.clear();
+    slugCache.set(projectRoot, pending);
+    return pending;
+}
+/** Test-only: reset the memoized origin slugs. */
+export function _clearOriginSlugCache() {
+    slugCache.clear();
+}
+function sameSlug(a, b) {
+    // GitHub owner/repo are case-insensitive.
+    return (a.owner.toLowerCase() === b.owner.toLowerCase() && a.repo.toLowerCase() === b.repo.toLowerCase());
+}
+/**
+ * The last PR marker in `transcript` that belongs to `expected`.
+ *
+ * `expected == null` (origin unknown / not github) → null: we cannot prove the
+ * marker is ours, so we decline rather than check a possibly-foreign number.
+ */
+export function extractPrMarker(transcript, expected) {
+    if (!transcript || !expected)
+        return null;
+    let last = null;
+    PR_URL_IN_TEXT.lastIndex = 0;
+    let m;
+    while ((m = PR_URL_IN_TEXT.exec(transcript)) !== null) {
+        const n = validatePrNumber(m[3]);
+        if (n == null)
+            continue;
+        const found = { owner: m[1], repo: m[2] };
+        if (!sameSlug(found, expected))
+            continue; // a sibling repo's PR is not ours
+        last = { number: n, url: m[0], owner: found.owner, repo: found.repo };
+    }
+    return last;
+}
+//# sourceMappingURL=merge-check.js.map

package/server/dist/core/mission-context/merge-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-check.js","sourceRoot":"","sources":["../../../src/core/mission-context/merge-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAKtC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,mFAAmF;AACnF,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAU;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,GAAc,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC9C,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI,GAAG,IAAI;KACvB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAQF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;AAC5C,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,SAAS,GAAG,GAAG,CAAC;AAUtB;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,QAAiB,EACjB,OAAuB,EAAE;IAEzB,MAAM,EAAE,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,cAAc,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IAEtC,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,GAAG,KAAK,EAAE,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC;IAE/E,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,2CAA2C;QAC3C,MAAM,GAAG,GAAG,MAAM,GAAG,CACnB,CAAC,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,EAC7E,WAAW,CACZ,CAAC;QACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAG,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG;aACf,KAAK,CAAC,OAAO,CAAC;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,0EAA0E;QAC1E,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;IAED,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE/C,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS;QAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;QACb,KAAK;QACL,uEAAuE;QACvE,SAAS,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG;KACnD,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB;IAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,cAAc,GAClB,2FAA2F,CAAC;AAc9F;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,SAAkB;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,CAAC,GACL,oGAAoG,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9G,gGAAgG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7G,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE9D,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,MAAiB,UAAU;IAE3B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,KAAK,IAA8B,EAAE;QACpD,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG;QAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAC5C,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,qBAAqB;IACnC,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAW,EAAE,CAAW;IACxC,0CAA0C;IAC1C,OAAO,CACL,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CACjG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,QAAyB;IAEzB,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,IAAI,GAAoB,IAAI,CAAC;IACjC,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI;YAAE,SAAS;QACxB,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,SAAS,CAAC,kCAAkC;QAC5E,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/server/dist/core/mission-context/merge-refresh.d.ts

@@ -0,0 +1,14 @@
+import { type MergeCheckDeps } from "./merge-check.js";
+import type { GitRunner } from "./worktree-roots.js";
+import type { MissionContext } from "./types.js";
+export interface MergeRefreshDeps {
+    git?: GitRunner;
+    merge?: MergeCheckDeps;
+}
+/**
+ * Return `context` with a freshly-checked merge state, or the SAME object when
+ * nothing could change (no commit artifact, not yet available, or already
+ * terminal) so callers pay nothing on the common path.
+ */
+export declare function refreshMerge(context: MissionContext, projectRoot: string, transcript: string, deps?: MergeRefreshDeps): Promise<MissionContext>;
+//# sourceMappingURL=merge-refresh.d.ts.map

package/server/dist/core/mission-context/merge-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-refresh.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/merge-refresh.ts"],"names":[],"mappings":"AAyBA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAkB,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAsBzB"}

package/server/dist/core/mission-context/merge-refresh.js

@@ -0,0 +1,53 @@
+/*
+ * core/mission-context/merge-refresh.ts — keep the merge state live across
+ * resolver cache hits (CONTRACT §5.3 asymmetric TTL).
+ *
+ * THE BUG THIS FIXES (internal code review, HIGH). The resolver caches its
+ * whole response keyed on a revision built from source-file mtimes. After a run
+ * finalizes, every one of those files goes quiescent — so `rev` stops changing,
+ * every later poll is a cache hit, and the cached commit artifact keeps
+ * whatever `merge` value it was built with. In practice that is "pending",
+ * frozen forever, because the squash lands on origin/main AFTER the run
+ * finishes. The asymmetric TTL in merge-check.ts (`merged` cached forever,
+ * `pending` re-checked) was unreachable dead code, CONTRACT §11's required
+ * "pending → merged after the TTL re-check" behaviour was impossible, and AC2's
+ * merge state was correct only by luck.
+ *
+ * Merge is the ONLY time-varying field in the response, so rather than
+ * weakening the cache (which correctly avoids re-reading unchanged files) we
+ * re-derive just this one field on every call — but only while it is
+ * NON-TERMINAL. Once `merged` is observed it is terminal and we stop asking.
+ *
+ * Cost is bounded: `checkSquashMerged` has its own TTL cache, so a re-check
+ * inside the TTL is a map lookup, not a git spawn.
+ */
+import { refreshCommitMerge } from "./artifacts-commit.js";
+import { checkSquashMerged, extractPrMarker, readOriginSlug, } from "./merge-check.js";
+/**
+ * Return `context` with a freshly-checked merge state, or the SAME object when
+ * nothing could change (no commit artifact, not yet available, or already
+ * terminal) so callers pay nothing on the common path.
+ */
+export async function refreshMerge(context, projectRoot, transcript, deps = {}) {
+    const commit = context.artifacts.find((a) => a.kind === "commit");
+    if (!commit || commit.state !== "available" || !commit.detail)
+        return context;
+    // `merged` is terminal — never re-ask, never regress it to pending.
+    if (commit.detail.merge === "merged")
+        return context;
+    const marker = extractPrMarker(transcript, await readOriginSlug(projectRoot, deps.git));
+    if (!marker)
+        return context;
+    const merge = await checkSquashMerged(projectRoot, marker.number, {
+        git: deps.git,
+        ...deps.merge,
+    });
+    const refreshed = refreshCommitMerge(commit, merge, marker);
+    if (refreshed === commit)
+        return context;
+    return {
+        ...context,
+        artifacts: context.artifacts.map((a) => (a.kind === "commit" ? refreshed : a)),
+    };
+}
+//# sourceMappingURL=merge-refresh.js.map

package/server/dist/core/mission-context/merge-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-refresh.js","sourceRoot":"","sources":["../../../src/core/mission-context/merge-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAS1B;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAuB,EACvB,WAAmB,EACnB,UAAkB,EAClB,OAAyB,EAAE;IAE3B,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CACnC,CAAC,CAAC,EAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAChD,CAAC;IACF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC9E,oEAAoE;IACpE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAErD,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,EAAE,MAAM,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;QAChE,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,IAAI,CAAC,KAAK;KACd,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IAEzC,OAAO;QACL,GAAG,OAAO;QACV,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC/E,CAAC;AACJ,CAAC"}

package/server/dist/core/mission-context/merged-events.d.ts

@@ -0,0 +1,34 @@
+import { type EventLookup } from "./iterate-record.js";
+import type { GitRunner } from "./worktree-roots.js";
+export interface MergedEventsDeps {
+    git?: GitRunner;
+    /** Default ref to read; overridden in tests with a real fixture repo. */
+    ref?: string;
+    now?: () => number;
+    ttlMs?: number;
+}
+/**
+ * The `work_completed` row for `runId` as it exists on the default remote ref.
+ *
+ * `unavailable` — the ref/blob could not be read at all.
+ * `absent`      — the ref read fine and this run is not on it (not merged yet).
+ * `found`       — the merged row, with `mtimeMs: 0` (a git blob has no mtime;
+ *                 the field is unused downstream, which the resolver relies on).
+ */
+export declare function findWorkCompletedFromMergedRef(projectRoot: string, runId: string, deps?: MergedEventsDeps): Promise<EventLookup>;
+export interface ResolvedEvents {
+    events: EventLookup;
+    /** True when the ref WAS consulted for a finished run and did not find it —
+     *  the resolver declines to cache that, so a later fetch is picked up. */
+    mergedRefMiss: boolean;
+}
+/**
+ * The run's `work_completed` — WORKING TREE first, then the merged ref for a
+ * FINISHED run (`!isWorktree`) whose row has not been pulled (see the module
+ * header). A live run keeps a registered worktree and its row is not on the ref
+ * yet, so it is never asked.
+ */
+export declare function resolveWorkCompleted(projectRoot: string, runId: string, isWorktree: boolean, deps?: MergedEventsDeps): Promise<ResolvedEvents>;
+/** Test-only: drop the module-level ref cache between cases. */
+export declare function _clearMergedEventsCache(): void;
+//# sourceMappingURL=merged-events.d.ts.map

package/server/dist/core/mission-context/merged-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-events.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/merged-events.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAkC,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA0CrD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAsBD;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAC;IACpB;8EAC0E;IAC1E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,OAAO,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,cAAc,CAAC,CAOzB;AAED,gEAAgE;AAChE,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/server/dist/core/mission-context/merged-events.js

@@ -0,0 +1,120 @@
+/*
+ * core/mission-context/merged-events.ts — read a finished run's work_completed
+ * from the DEFAULT REMOTE REF when it is not in the working tree yet.
+ *
+ * WHY (2026-07-23, Sven — sessions 3cfa001d / 2ed3c046). An iterate records its
+ * `work_completed` into `shipwright_events.jsonl` INSIDE its PR. After a squash
+ * merge the row is on `origin/main` — but the user's main working tree is not
+ * pulled (the iterate merges via `gh`; the main tree stays at its old HEAD), so
+ * `findWorkCompleted` (working-tree only) reports `absent` and every artifact
+ * that hangs off the run vanishes, leaving ONLY Decisions (which are written to
+ * the main tree directly at F3). MEASURED: `origin/main`'s events.jsonl DOES
+ * carry the merged row locally (origin is fetched at finalization), so this is
+ * a read-path gap, not missing data.
+ *
+ * Same read-only, ARG-ARRAY, `shell:false` git discipline as merge-check.ts.
+ * The ref and the filename are both CONSTANTS — nothing here is attacker-
+ * influenced and no path is built from user input. The result is a normal
+ * `EventLookup`, so the resolver substitutes it for the working-tree lookup
+ * with no downstream change.
+ *
+ * Consulted ONLY when the run's own worktree is gone (finished) AND the working
+ * tree lacks the row — never for a live run, whose row is not on the ref yet.
+ * `unavailable` (ref unreadable / never fetched) is kept distinct from `absent`
+ * (ref read fine, run genuinely not on it): the resolver declines to cache the
+ * former so a later fetch is picked up.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { EVENTS_FILE, findWorkCompleted } from "./iterate-record.js";
+import { projectEventLog } from "../event-log-reader.js";
+const execFileP = promisify(execFile);
+/** The default line webui merges to (matches merge-check.ts's `origin/main`). */
+const DEFAULT_REF = "origin/main";
+const TTL_MS = 60_000;
+const CACHE_CAP = 64;
+/**
+ * The ref-blob read must budget the SAME ceiling as the working-tree reader it
+ * substitutes for — `iterate-record.ts`'s `MAX_EVENT_LOG_BYTES` (64 MB) — NOT
+ * worktree-roots' 4 MB `defaultGit`. `shipwright_events.jsonl` is append-only and
+ * never evicted; once it crosses 4 MB, a 4 MB `git show` would overflow
+ * `maxBuffer`, throw, degrade to `unavailable`, and silently re-collapse the rail
+ * to Decisions for exactly the projects this module exists to serve — and never
+ * recover, since the file only grows (internal code review, MEDIUM).
+ */
+const MAX_REF_BLOB_BYTES = 64 * 1024 * 1024;
+/** ARG-ARRAY, `shell:false`, big-buffer git for reading the (large) event blob. */
+const defaultGit = async (args, cwd) => {
+    const { stdout } = await execFileP("git", args, {
+        cwd,
+        encoding: "utf-8",
+        timeout: 8000,
+        windowsHide: true,
+        maxBuffer: MAX_REF_BLOB_BYTES,
+    });
+    return stdout;
+};
+/** Per-(projectRoot, ref) blob index, TTL'd so N tabs share ONE `git show`. */
+const cache = new Map();
+async function loadRef(projectRoot, ref, git, now) {
+    try {
+        // `git show <ref>:<file>` — every token a separate argv member. The ref and
+        // file are constants; there is no command string to escape.
+        const text = await git(["show", `${ref}:${EVENTS_FILE}`], projectRoot);
+        const runs = new Map();
+        for (const r of projectEventLog(text.split(/\r?\n/)).runs)
+            runs.set(r.runId, r);
+        return { at: now(), runs, ok: true };
+    }
+    catch {
+        // ref absent (never fetched), not a repo, git missing, or the file was not
+        // tracked at that ref — we cannot read the merged copy. NOT "no such run".
+        return { at: now(), runs: new Map(), ok: false };
+    }
+}
+/**
+ * The `work_completed` row for `runId` as it exists on the default remote ref.
+ *
+ * `unavailable` — the ref/blob could not be read at all.
+ * `absent`      — the ref read fine and this run is not on it (not merged yet).
+ * `found`       — the merged row, with `mtimeMs: 0` (a git blob has no mtime;
+ *                 the field is unused downstream, which the resolver relies on).
+ */
+export async function findWorkCompletedFromMergedRef(projectRoot, runId, deps = {}) {
+    const git = deps.git ?? defaultGit;
+    const ref = deps.ref ?? DEFAULT_REF;
+    const now = deps.now ?? Date.now;
+    const ttl = deps.ttlMs ?? TTL_MS;
+    const key = `${projectRoot}::${ref}`;
+    let entry = cache.get(key);
+    if (!entry || now() - entry.at > ttl) {
+        entry = await loadRef(projectRoot, ref, git, now);
+        if (cache.size >= CACHE_CAP)
+            cache.clear();
+        cache.set(key, entry);
+    }
+    if (!entry.ok)
+        return { status: "unavailable" };
+    const run = entry.runs.get(runId) ?? null;
+    return run ? { status: "found", run, mtimeMs: 0 } : { status: "absent", mtimeMs: 0 };
+}
+/**
+ * The run's `work_completed` — WORKING TREE first, then the merged ref for a
+ * FINISHED run (`!isWorktree`) whose row has not been pulled (see the module
+ * header). A live run keeps a registered worktree and its row is not on the ref
+ * yet, so it is never asked.
+ */
+export async function resolveWorkCompleted(projectRoot, runId, isWorktree, deps = {}) {
+    const events = findWorkCompleted(projectRoot, runId);
+    if (events.status !== "absent" || isWorktree)
+        return { events, mergedRefMiss: false };
+    const fromRef = await findWorkCompletedFromMergedRef(projectRoot, runId, deps);
+    return fromRef.status === "found"
+        ? { events: fromRef, mergedRefMiss: false }
+        : { events, mergedRefMiss: true };
+}
+/** Test-only: drop the module-level ref cache between cases. */
+export function _clearMergedEventsCache() {
+    cache.clear();
+}
+//# sourceMappingURL=merged-events.js.map

package/server/dist/core/mission-context/merged-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"merged-events.js","sourceRoot":"","sources":["../../../src/core/mission-context/merged-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAoB,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAsB,MAAM,wBAAwB,CAAC;AAG7E,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,iFAAiF;AACjF,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,mFAAmF;AACnF,MAAM,UAAU,GAAc,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC9C,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,kBAAkB;KAC9B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAUF,+EAA+E;AAC/E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAU1C,KAAK,UAAU,OAAO,CACpB,WAAmB,EACnB,GAAW,EACX,GAAc,EACd,GAAiB;IAEjB,IAAI,CAAC;QACH,4EAA4E;QAC5E,4DAA4D;QAC5D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,2EAA2E;QAC3E,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,WAAmB,EACnB,KAAa,EACb,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC;IACjC,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,GAAG,EAAE,CAAC;IAErC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;QACrC,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,IAAI,SAAS;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC3C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACvF,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,KAAa,EACb,UAAmB,EACnB,OAAyB,EAAE;IAE3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IACtF,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC,MAAM,KAAK,OAAO;QAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE;QAC3C,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,uBAAuB;IACrC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC"}

package/server/dist/core/mission-context/pipeline-artifacts.d.ts

@@ -0,0 +1,53 @@
+import type { PhaseArtifact, SpecArtifact } from "./types.js";
+/**
+ * The phase-task facts the resolver is handed. A narrowed, plain-data mirror of
+ * run-config v2's `PhaseTask` — the resolver never sees the whole config.
+ */
+export interface PhaseTaskFacts {
+    phaseTaskId: string;
+    phase: string;
+    splitId: string | null;
+    status: string;
+    slashCommand: string | null;
+    title: string | null;
+    description: string | null;
+    startedAt: string | null;
+    completedAt: string | null;
+    executionCount: number | null;
+    errors: string[];
+    outputs: string[];
+}
+/**
+ * Why the three failure shapes are distinct, and must stay distinct:
+ *   - `unavailable`     — the run-config could not be read. We do not know.
+ *   - `task_not_found`  — the config read FINE and does not contain this task.
+ *                         That is an integrity fault (the task points at a phase
+ *                         task its own run-config does not have), not an absence.
+ *   - `ok`              — resolved.
+ * Folding the first two into "nothing here" is the failure this campaign has
+ * now made three times; it does not get to happen a fourth.
+ */
+export type PipelineFact = {
+    status: "ok";
+    runId: string;
+    task: PhaseTaskFacts;
+} | {
+    status: "task_not_found";
+    runId: string;
+} | {
+    status: "unavailable";
+};
+export declare function buildPhaseArtifact(fact: PipelineFact): PhaseArtifact;
+/**
+ * The pipeline's Spec artifact: the project's ADOPTED specification, which is
+ * also where its FR table lives — hence the combined label.
+ *
+ * `documentId` is minted by the caller ONLY when the file was actually resolved
+ * under a validated read-root, so this never produces a link to nothing.
+ */
+export declare function buildPipelineSpecArtifact(input: {
+    documentId: string | null;
+    title: string | null;
+    denied: boolean;
+}): SpecArtifact;
+//# sourceMappingURL=pipeline-artifacts.d.ts.map

package/server/dist/core/mission-context/pipeline-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-artifacts.d.ts","sourceRoot":"","sources":["../../../src/core/mission-context/pipeline-artifacts.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE9D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,CAAC;AA+C9B,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,aAAa,CAoDpE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,YAAY,CAkCf"}