@telora/daemon 0.21.26 → 0.21.82

package/dist/security-finding-gate.js

@@ -1,84 +0,0 @@
-/**
- * Deterministic check evaluator for the Security workflow verify-closed gate.
- *
- * The Security workflow declares its verify-closed stage with
- * `agent_directive.gate = { kind: 'deterministic', check:
- * 'security.finding_no_longer_present' }`. The gate's contract: a security
- * remediation injection cannot be verified (retired) unless the linked
- * security_findings row has flipped to status='resolved' (the re-scan
- * resolution sweep clears the indicator).
- *
- * If the gate fails, the linked finding is flipped to status='escalated'
- * with escalation_reason='verify_gate_failed'. After the D1 schema
- * collapse, the Security workflow no longer carries a 'Reopen (failed)'
- * transition — a failed verify-closed escalates and stays.
- *
- * Wired into verification-engine.ts: before calling verifyInjectionOnPass
- * on a 'passed' outcome, the engine consults this gate. A 'passed' outcome
- * is demoted to 'failed' when the finding is still open/remediating.
- *
- * @module security-finding-gate
- */
-import { callApi } from './queries/shared.js';
-import { createLogger } from './log.js';
-const log = createLogger({ module: 'security-finding-gate' });
-// ---------------------------------------------------------------------------
-// Pure evaluator
-// ---------------------------------------------------------------------------
-/**
- * Evaluate the `security.finding_no_longer_present` deterministic check for
- * a given injection node.
- *
- * Outcomes:
- *   - No finding linked to this injection -> passes as a no-op.
- *   - Linked finding has status 'resolved' -> passes.
- *   - Linked finding has any other status  -> fails, returns the findingId
- *     so the caller can escalate.
- *
- * The function does NOT mutate any state -- escalation is the caller's
- * responsibility via `escalateOnGateFail`.
- */
-export async function evaluateFindingNoLongerPresent(injectionNodeId, deps) {
-    const lookup = await deps.lookupFindingByInjection(injectionNodeId);
-    if (!lookup) {
-        return { passed: true, findingId: null, reason: 'no_linked_finding' };
-    }
-    if (lookup.status === 'resolved') {
-        return { passed: true, findingId: lookup.findingId, reason: 'finding_resolved' };
-    }
-    return {
-        passed: false,
-        findingId: lookup.findingId,
-        reason: `finding_status_is_${lookup.status}`,
-    };
-}
-/**
- * Best-effort escalation helper: when the gate fails, flip the linked
- * finding to status='escalated'. Logs and swallows on error so a failed
- * escalation does not throw out of the verification path.
- */
-export async function escalateOnGateFail(findingId, reason, deps) {
-    try {
-        await deps.escalateFinding(findingId, reason);
-    }
-    catch (err) {
-        log.warn(`[security-finding-gate] escalation failed for finding ${findingId}: ${err.message}`);
-    }
-}
-// ---------------------------------------------------------------------------
-// Default deps -- daemon-side wiring via callApi
-// ---------------------------------------------------------------------------
-export function buildDefaultSecurityFindingGateDeps() {
-    return {
-        lookupFindingByInjection: async (injectionNodeId) => {
-            const res = await callApi('daemon_lookup_finding_by_injection', { injectionNodeId });
-            if (!res?.findingId || !res.status)
-                return null;
-            return { findingId: res.findingId, status: res.status };
-        },
-        escalateFinding: async (findingId, reason) => {
-            await callApi('daemon_escalate_security_finding', { findingId, reason });
-        },
-    };
-}
-//# sourceMappingURL=security-finding-gate.js.map

package/dist/security-finding-gate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-finding-gate.js","sourceRoot":"","sources":["../src/security-finding-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAiC9D,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,eAAuB,EACvB,IAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,qBAAqB,MAAM,CAAC,MAAM,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,MAAc,EACd,IAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,yDAAyD,SAAS,KAAM,GAAa,CAAC,OAAO,EAAE,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,mCAAmC;IACjD,OAAO;QACL,wBAAwB,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,oCAAoC,EACpC,EAAE,eAAe,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAChD,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1D,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security-rescan-resolution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-rescan-resolution.d.ts","sourceRoot":"","sources":["../src/security-rescan-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACzF,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,2CAA2C;IAC3C,UAAU,EAAE,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB;;;OAGG;IACH,0BAA0B,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChF,uEAAuE;IACvE,eAAe,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;OAGG;IACH,wBAAwB,EAAE,CACxB,gBAAgB,EAAE,MAAM,EAAE,KACvB,OAAO,CAAC,KAAK,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClE;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,iBAAiB,EAAE,EACjC,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAkEnB;AAMD,wBAAgB,0BAA0B,IAAI,cAAc,CA6C3D"}

package/dist/security-rescan-resolution.js

@@ -1,117 +0,0 @@
-/**
- * Re-scan resolution: when a scan run completes that covered a finding's
- * IOC class but did not re-produce a previously-open finding, flip the
- * finding to 'resolved' and (if the linked injection's delivery is done)
- * auto-verify the injection.
- *
- * Called by the scanner engine immediately after a run finishes writing
- * its findings, before the next tick begins.
- *
- * @module security-rescan-resolution
- */
-import { callApi } from './queries/shared.js';
-import { createLogger } from './log.js';
-const log = createLogger({ module: 'security-rescan-resolution' });
-/**
- * Resolve previously-open findings that didn't re-appear in this run.
- *
- * @returns the list of finding ids that were flipped to 'resolved'.
- */
-export async function resolveStaleFindings(productId, observedSets, deps) {
-    const iocClasses = observedSets.map((s) => s.iocClass);
-    if (iocClasses.length === 0)
-        return [];
-    const openFindings = await deps.listOpenFindings(productId, iocClasses);
-    const observedByClass = new Map();
-    for (const set of observedSets) {
-        observedByClass.set(set.iocClass, set.identifiers);
-    }
-    const resolvedIds = [];
-    const resolvedInjectionIds = [];
-    for (const finding of openFindings) {
-        const observedInClass = observedByClass.get(finding.iocClass);
-        if (!observedInClass)
-            continue;
-        if (observedInClass.has(finding.identifier))
-            continue;
-        // Finding was open, its class was covered, but it didn't re-appear.
-        await deps.markFindingResolved(finding.id);
-        await deps.writeAudit({
-            findingId: finding.id,
-            organizationId: finding.organizationId,
-            action: 'resolved',
-            payload: { reason: 'absent_in_rescan', ioc_class: finding.iocClass },
-        });
-        resolvedIds.push(finding.id);
-        // Auto-verify the linked injection if its delivery has reached 'done'.
-        if (finding.linkedInjectionId) {
-            resolvedInjectionIds.push(finding.linkedInjectionId);
-            const status = await deps.getInjectionDeliveryStatus(finding.linkedInjectionId);
-            if (status === 'done') {
-                await deps.verifyInjection(finding.linkedInjectionId);
-            }
-        }
-    }
-    // Attempt to close any Security focuses whose findings have all been
-    // resolved by this sweep. The server-side gate enforces the close
-    // criteria (all findings resolved + all deliveries terminal); we just
-    // collect candidates here and fan out. closeSecurityFocus returning
-    // false (criteria not yet met) is non-fatal.
-    if (resolvedInjectionIds.length > 0) {
-        try {
-            const mappings = await deps.lookupFocusForInjections(resolvedInjectionIds);
-            const focusIds = Array.from(new Set(mappings.map((m) => m.focusId)));
-            for (const focusId of focusIds) {
-                try {
-                    await deps.closeSecurityFocus(focusId);
-                }
-                catch (err) {
-                    log.warn(`[security-rescan-resolution] closeSecurityFocus ${focusId}:`, err.message);
-                }
-            }
-        }
-        catch (err) {
-            log.warn('[security-rescan-resolution] lookupFocusForInjections:', err.message);
-        }
-    }
-    return resolvedIds;
-}
-// ---------------------------------------------------------------------------
-// Default Deps -- daemon-side wiring via callApi.
-// ---------------------------------------------------------------------------
-export function buildDefaultResolutionDeps() {
-    return {
-        listOpenFindings: async (productId, iocClasses) => {
-            const res = await callApi('daemon_list_open_security_findings', { productId, iocClasses });
-            return res.items ?? [];
-        },
-        markFindingResolved: async (findingId) => {
-            await callApi('daemon_resolve_security_finding', { findingId });
-        },
-        writeAudit: async (input) => {
-            // `action` is reserved at the wire layer for the dispatcher route, so
-            // we rename the audit action to `auditAction` to avoid the collision.
-            const { action, ...rest } = input;
-            await callApi('daemon_write_security_finding_audit', {
-                ...rest,
-                auditAction: action,
-            });
-        },
-        getInjectionDeliveryStatus: async (injectionNodeId) => {
-            const res = await callApi('daemon_get_injection_delivery_status', { injectionNodeId });
-            return res.status;
-        },
-        verifyInjection: async (injectionNodeId) => {
-            await callApi('reality_tree_verify_injection', { injectionNodeId });
-        },
-        lookupFocusForInjections: async (injectionNodeIds) => {
-            const res = await callApi('daemon_lookup_focus_for_injections', { injectionNodeIds });
-            return res.items ?? [];
-        },
-        closeSecurityFocus: async (focusId) => {
-            const res = await callApi('daemon_close_security_focus', { focusId });
-            return res.closed === true;
-        },
-    };
-}
-//# sourceMappingURL=security-rescan-resolution.js.map

package/dist/security-rescan-resolution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-rescan-resolution.js","sourceRoot":"","sources":["../src/security-rescan-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;AA0DnE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,YAAiC,EACjC,IAAoB;IAEpB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAE1C,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACnC,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe;YAAE,SAAS;QAC/B,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,SAAS;QAEtD,oEAAoE;QACpE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,UAAU,CAAC;YACpB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;SACrE,CAAC,CAAC;QACH,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE7B,uEAAuE;QACvE,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAChF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,6CAA6C;IAC7C,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CACN,mDAAmD,OAAO,GAAG,EAC5D,GAAa,CAAC,OAAO,CACvB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,wDAAwD,EACvD,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,oCAAoC,EACpC,EAAE,SAAS,EAAE,UAAU,EAAE,CAC1B,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACvC,MAAM,OAAO,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,sEAAsE;YACtE,sEAAsE;YACtE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YAClC,MAAM,OAAO,CAAC,qCAAqC,EAAE;gBACnD,GAAG,IAAI;gBACP,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;QACD,0BAA0B,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,EAAE,eAAe,EAAE,CACpB,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC;QACpB,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;YACzC,MAAM,OAAO,CAAC,+BAA+B,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,OAAO,CAEtB,oCAAoC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,6BAA6B,EAC7B,EAAE,OAAO,EAAE,CACZ,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security-scan-engine.d.ts

@@ -1,145 +0,0 @@
-/**
- * Security scan engine.
- *
- * Polls security_scan_configs for due scans (cron-due or manual_run_requested_at
- * set), dispatches pluggable Scanner implementations per IOC class, upserts
- * security_findings rows (one per product/ioc_class/identifier), and hands
- * any newly-observed or unremediated-open finding to security-auto-inject
- * for remediation materialization.
- *
- * No longer writes scan-run rows -- the current-state model only persists
- * findings. `last_run_at` on the config is updated directly at the end of
- * runScanForConfig.
- *
- * Activation: gated by shouldRunLoop('TELORA_SECURITY_SCAN_LOOP') in
- * unified-shell.ts. Opt-out semantics match the other daemon loop ticks
- * (unset/anything-but-'0' = enabled, '0' = disabled). See
- * docs/runbook-loop-activation.md.
- *
- * @module security-scan-engine
- */
-import type { DaemonConfig } from './types.js';
-import { type AutoInjectDeps } from './security-auto-inject.js';
-import { type ResolutionDeps } from './security-rescan-resolution.js';
-export type Severity = 'low' | 'medium' | 'high' | 'critical';
-export type FindingStatus = 'open' | 'remediating' | 'resolved' | 'escalated';
-/** Configuration row driving an individual product's scan cadence. */
-export interface ScanConfig {
-    id: string;
-    organizationId: string;
-    productId: string;
-    scheduleCron: string;
-    enabledIocClasses: string[];
-    enabled: boolean;
-    manualRunRequestedAt: string | null;
-    lastRunAt: string | null;
-}
-/** Per-scan context passed to each Scanner. */
-export interface ScanContext {
-    config: ScanConfig;
-    repoPath: string;
-}
-/** Single finding draft emitted by a Scanner. Stored in security_findings. */
-export interface FindingDraft {
-    iocClass: string;
-    severity: Severity;
-    identifier: string;
-    payload: Record<string, unknown>;
-}
-/** Per-scanner output for a single scan run. */
-export interface ScanResult {
-    findings: FindingDraft[];
-    /** Coverage breadcrumb (e.g. packages_audited, files_scanned) + any warnings. */
-    coverage: Record<string, unknown>;
-}
-/** Pluggable Scanner contract -- one per IOC class. */
-export interface Scanner {
-    /** IOC class slug, matched against ScanConfig.enabledIocClasses. */
-    iocClass: string;
-    scan(ctx: ScanContext): Promise<ScanResult>;
-}
-export declare function registerScanner(scanner: Scanner): void;
-export declare function getRegisteredScanners(): Scanner[];
-export interface UpsertFindingResult {
-    findingId: string;
-    /** True when this row was just inserted (vs an existing row was updated). */
-    wasNew: boolean;
-    status: FindingStatus;
-    linkedInjectionId: string | null;
-}
-/** Options that further narrow which due configs the tick should pick up. */
-export interface DueScanConfigsOptions {
-    /**
-     * When true, return only configs with a pending manual-run request and
-     * skip cron evaluation entirely. Used by the fast (30s) request-drain
-     * loop so the click-to-run latency matches other queued-work pickups.
-     */
-    manualOnly?: boolean;
-}
-export interface SecurityScanDeps {
-    getDueScanConfigs: (opts?: DueScanConfigsOptions) => Promise<ScanConfig[]>;
-    /**
-     * Insert or update one row of security_findings. Conflict on
-     * (product_id, ioc_class, identifier) updates last_seen_at, severity,
-     * and payload. first_seen_at is set on insert only.
-     */
-    upsertFinding: (productId: string, organizationId: string, finding: FindingDraft) => Promise<UpsertFindingResult>;
-    /** Stamp last_run_at on the config after a scan completes. */
-    updateConfigLastRun: (configId: string) => Promise<void>;
-    clearManualRunRequest: (configId: string) => Promise<void>;
-    /**
-     * Resolve the repo to scan for a product, or null when this daemon does not
-     * manage that product. NULL IS LOAD-BEARING: the caller must skip the scan
-     * entirely rather than substitute a fallback path. Returning some other
-     * repo's path makes `npm audit` (and every path-based scanner) report THAT
-     * repo's findings against this product -- see the fail-closed gate in
-     * runScanForConfig.
-     */
-    resolveCwd: (productId: string) => string | null;
-    /**
-     * Flush the OSV + GHSA feed caches. Invoked at the start of every
-     * manual-triggered scan so a user-clicked "Refresh feeds" pulls fresh
-     * upstream advisory data rather than the cached 15-minute window.
-     */
-    clearFeedCaches: () => void;
-    scanners: Scanner[];
-    /**
-     * Optional auto-injection hook. When set, each new finding (or
-     * existing open finding with no remediation) is passed to
-     * processNewFinding so the daemon can materialize a remediation
-     * injection + delivery for it.
-     */
-    autoInjectDeps?: AutoInjectDeps;
-    /**
-     * Optional re-scan resolution hook. When set, after every scan run
-     * finishes, the engine asks the resolution module to flip previously
-     * open findings whose identifiers did not re-appear to 'resolved'.
-     */
-    resolutionDeps?: ResolutionDeps;
-}
-/**
- * Memoize the per-batch identifiers within one scan-run: focus (+ tree),
- * entity node, injection node, and delivery. The server handlers always
- * create new rows; without this wrapper, every finding in the scan would
- * land in its own focus + delivery, producing N noisy copies of what is
- * conceptually one remediation batch. Returns undefined when no
- * auto-inject is configured.
- *
- * Failure semantics: if a memoized call throws, that slot's cached promise
- * is discarded so the next finding in the run retries the create. Slots
- * are independent -- a transient failure on createInjection does not
- * invalidate the already-resolved focus or entity.
- *
- * Also exposes peekFocusId() so the engine can finalize the focus name
- * (appending the finding count) once the scan loop completes.
- */
-export interface ScanRunAutoInject {
-    deps: AutoInjectDeps;
-    /** focusId of the memoized focus, or null if no focus was created. */
-    peekFocusId(): string | null;
-}
-export declare function wrapAutoInjectForScanRun(inner: AutoInjectDeps | undefined): ScanRunAutoInject | undefined;
-export declare function runScanForConfig(config: ScanConfig, trigger: 'schedule' | 'manual', deps: SecurityScanDeps): Promise<void>;
-export declare function runSecurityScanTick(deps: SecurityScanDeps, opts?: DueScanConfigsOptions): Promise<void>;
-export declare function buildDefaultSecurityScanDeps(config: DaemonConfig): SecurityScanDeps;
-//# sourceMappingURL=security-scan-engine.d.ts.map

package/dist/security-scan-engine.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-scan-engine.d.ts","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,iCAAiC,CAAC;AAYzC,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAC9D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE9E,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,gDAAgD;AAChD,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,MAAM,WAAW,OAAO;IACtB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAQD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED,wBAAgB,qBAAqB,IAAI,OAAO,EAAE,CAEjD;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3E;;;;OAIG;IACH,aAAa,EAAE,CACb,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,YAAY,KAClB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD;;;;OAIG;IACH,eAAe,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,cAAc,CAAC;IACrB,sEAAsE;IACtE,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAwBD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,iBAAiB,GAAG,SAAS,CAyB/B;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,UAAU,GAAG,QAAQ,EAC9B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwIf;AAaD,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,gBAAgB,EACtB,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,IAAI,CAAC,CAiBf;AAMD,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAiDnF"}

package/dist/security-scan-engine.js

@@ -1,271 +0,0 @@
-/**
- * Security scan engine.
- *
- * Polls security_scan_configs for due scans (cron-due or manual_run_requested_at
- * set), dispatches pluggable Scanner implementations per IOC class, upserts
- * security_findings rows (one per product/ioc_class/identifier), and hands
- * any newly-observed or unremediated-open finding to security-auto-inject
- * for remediation materialization.
- *
- * No longer writes scan-run rows -- the current-state model only persists
- * findings. `last_run_at` on the config is updated directly at the end of
- * runScanForConfig.
- *
- * Activation: gated by shouldRunLoop('TELORA_SECURITY_SCAN_LOOP') in
- * unified-shell.ts. Opt-out semantics match the other daemon loop ticks
- * (unset/anything-but-'0' = enabled, '0' = disabled). See
- * docs/runbook-loop-activation.md.
- *
- * @module security-scan-engine
- */
-import { callApi } from './queries/shared.js';
-import { configForProduct } from './config.js';
-import { buildDefaultAutoInjectDeps, processNewFinding, } from './security-auto-inject.js';
-import { resolveStaleFindings, buildDefaultResolutionDeps, } from './security-rescan-resolution.js';
-import { clearOsvCache } from './feeds/osv.js';
-import { clearGhsaCache } from './feeds/ghsa.js';
-import { createLogger } from './log.js';
-const log = createLogger({ module: 'security-scan-engine' });
-// ---------------------------------------------------------------------------
-// Default registry -- scanners self-register here in their own modules
-// ---------------------------------------------------------------------------
-const DEFAULT_REGISTRY = new Map();
-export function registerScanner(scanner) {
-    DEFAULT_REGISTRY.set(scanner.iocClass, scanner);
-}
-export function getRegisteredScanners() {
-    return [...DEFAULT_REGISTRY.values()];
-}
-function makeMemoSlot(fn, onResolve) {
-    let cached = null;
-    return (input) => {
-        if (!cached) {
-            cached = fn(input).then((result) => {
-                onResolve?.(result);
-                return result;
-            }, (err) => {
-                cached = null;
-                throw err;
-            });
-        }
-        return cached;
-    };
-}
-export function wrapAutoInjectForScanRun(inner) {
-    if (!inner)
-        return undefined;
-    let resolvedFocusId = null;
-    const focusFn = makeMemoSlot((input) => inner.createSecurityRemediationFocus(input.productId, input.organizationId), (result) => {
-        resolvedFocusId = result.focusId;
-    });
-    const entityFn = makeMemoSlot(inner.upsertEntityNode);
-    const injectionFn = makeMemoSlot(inner.createInjection);
-    const deliveryFn = makeMemoSlot(inner.createDelivery);
-    const wrapped = {
-        ...inner,
-        createSecurityRemediationFocus: (productId, organizationId) => focusFn({ productId, organizationId }),
-        upsertEntityNode: entityFn,
-        createInjection: injectionFn,
-        createDelivery: deliveryFn,
-    };
-    return {
-        deps: wrapped,
-        peekFocusId: () => resolvedFocusId,
-    };
-}
-export async function runScanForConfig(config, trigger, deps) {
-    // Manual triggers carry the "Refresh feeds" intent: flush the OSV/GHSA
-    // TTL caches so this scan pulls fresh advisory data instead of replaying
-    // the 15-minute window. Scheduled triggers honour the cache to keep
-    // upstream load proportional to scan cadence.
-    if (trigger === 'manual') {
-        deps.clearFeedCaches();
-    }
-    // Fail-closed product gate. Scan configs exist per product ORG-WIDE, but this
-    // daemon only manages the products it was started with. Scanning a product we
-    // have no checkout for can only produce findings about some OTHER repo, so we
-    // scan nothing rather than scan the wrong tree. Skipping without stamping
-    // last_run_at is deliberate: the config stays due, so the daemon that DOES
-    // manage this product still picks it up on its own tick.
-    const repoPath = deps.resolveCwd(config.productId);
-    if (repoPath === null) {
-        log.debug(`Skipping security scan for product ${config.productId}: not managed by this daemon ` +
-            `(no repo checkout here). Leaving the config due for a daemon that manages it.`);
-        return;
-    }
-    // Per-scan-run focus memoization. The server handler always creates a new
-    // focus, so without this wrapper each finding in a scan would land in its
-    // own focus. The first finding in this run triggers focus creation; every
-    // subsequent finding shares the same focus. Next scan run gets a fresh
-    // closure -> fresh focus = fresh batch.
-    const scanScopedAutoInject = wrapAutoInjectForScanRun(deps.autoInjectDeps);
-    let injectedCount = 0;
-    const enabledScanners = deps.scanners.filter((s) => config.enabledIocClasses.includes(s.iocClass));
-    // Per-class observed identifier sets for re-scan resolution. Only
-    // classes whose scanner ran without error contribute -- a failed
-    // scanner can't claim coverage for its class.
-    const observedByClass = new Map();
-    for (const scanner of enabledScanners) {
-        try {
-            const result = await scanner.scan({
-                config,
-                repoPath,
-            });
-            const observed = new Set();
-            for (const finding of result.findings) {
-                const upsert = await deps.upsertFinding(config.productId, config.organizationId, finding);
-                observed.add(finding.identifier);
-                // Trigger auto-inject when:
-                //   * the finding is brand new, OR
-                //   * the existing finding is open with no remediation in flight
-                //     (e.g. previous delivery was cancelled).
-                const shouldRemediate = upsert.wasNew || (upsert.status === 'open' && upsert.linkedInjectionId === null);
-                if (scanScopedAutoInject && shouldRemediate) {
-                    try {
-                        const forInjection = {
-                            id: upsert.findingId,
-                            organizationId: config.organizationId,
-                            productId: config.productId,
-                            iocClass: finding.iocClass,
-                            severity: finding.severity,
-                            identifier: finding.identifier,
-                            payload: finding.payload,
-                            status: upsert.status,
-                            linkedInjectionId: upsert.linkedInjectionId,
-                        };
-                        const injectResult = await processNewFinding(forInjection, {}, scanScopedAutoInject.deps);
-                        if (injectResult.status === 'injected') {
-                            injectedCount++;
-                        }
-                    }
-                    catch (err) {
-                        log.warn(`[security-scan-engine] auto-inject ${finding.identifier}:`, err.message);
-                    }
-                }
-            }
-            observedByClass.set(scanner.iocClass, observed);
-        }
-        catch (err) {
-            log.warn(`[security-scan-engine] scanner ${scanner.iocClass} failed:`, err.message);
-        }
-    }
-    // Re-scan resolution: previously-open findings whose class was
-    // covered by this run but whose identifier did not re-appear are
-    // flipped to 'resolved'. Failures here are non-fatal.
-    if (deps.resolutionDeps && observedByClass.size > 0) {
-        try {
-            const observedSets = Array.from(observedByClass.entries()).map(([iocClass, identifiers]) => ({ iocClass, identifiers }));
-            await resolveStaleFindings(config.productId, observedSets, deps.resolutionDeps);
-        }
-        catch (err) {
-            log.warn('resolution sweep failed:', err.message);
-        }
-    }
-    // Finalize the security remediation focus name with the batch finding count
-    // so dashboard names like "Security Remediation 2026-05-21 19:44 UTC" become
-    // "... (3 findings)". Best-effort -- no-op when no focus was created or the
-    // dep is not wired (tests).
-    if (scanScopedAutoInject && injectedCount > 0) {
-        const focusId = scanScopedAutoInject.peekFocusId();
-        if (focusId && deps.autoInjectDeps?.finalizeSecurityRemediationFocusName) {
-            try {
-                await deps.autoInjectDeps.finalizeSecurityRemediationFocusName(focusId, injectedCount);
-            }
-            catch (err) {
-                log.warn('[security-scan-engine] finalizeSecurityRemediationFocusName failed:', err.message);
-            }
-        }
-    }
-    // Stamp config.last_run_at so cadence recomputes.
-    try {
-        await deps.updateConfigLastRun(config.id);
-    }
-    catch (err) {
-        log.warn('updateConfigLastRun failed:', err.message);
-    }
-    if (trigger === 'manual') {
-        await deps.clearManualRunRequest(config.id);
-    }
-}
-// ---------------------------------------------------------------------------
-// Loop tick -- invoked by unified-shell on a fixed cadence
-// ---------------------------------------------------------------------------
-// Per-process re-entry guard. A slow scan run (rate-limited retries,
-// many findings) can take longer than the 30s manual-drain tick interval;
-// without this, the same config gets picked up again and a second
-// runScanForConfig runs in parallel, producing duplicate Security
-// remediation focuses for the same scan batch.
-const inFlightConfigs = new Set();
-export async function runSecurityScanTick(deps, opts = {}) {
-    const configs = await deps.getDueScanConfigs(opts);
-    for (const config of configs) {
-        if (!config.enabled)
-            continue;
-        if (inFlightConfigs.has(config.id))
-            continue;
-        const trigger = config.manualRunRequestedAt ? 'manual' : 'schedule';
-        inFlightConfigs.add(config.id);
-        try {
-            await runScanForConfig(config, trigger, deps);
-        }
-        catch (err) {
-            // Per-config failures are swallowed so a single broken product
-            // does not stop the engine from servicing others.
-            log.debug('Per-config failures are swallowed so a single broken product', { error: String(err?.message ?? err) });
-        }
-        finally {
-            inFlightConfigs.delete(config.id);
-        }
-    }
-}
-// ---------------------------------------------------------------------------
-// Default Deps -- daemon-side wiring via callApi
-// ---------------------------------------------------------------------------
-export function buildDefaultSecurityScanDeps(config) {
-    const resolveCwd = (productId) => {
-        const product = config.products.find((p) => p.id === productId);
-        // Fail CLOSED. This previously returned config.repoPath -- the daemon's own
-        // primary repo -- for any product this daemon does not manage. A scan config
-        // exists per product org-wide, but config.products holds only the products
-        // THIS daemon was started with, so every unmanaged product was scanned
-        // against the daemon's own tree: `npm audit` passed its Node-project gate
-        // legitimately (the daemon's repo IS a Node project) and reported the
-        // DAEMON's dependency advisories as findings on an unrelated product.
-        // Observed 2026-07-24: @modelcontextprotocol/sdk, @hono/node-server,
-        // fast-uri and dompurify -- all Telora's own deps -- filed against a Quarto
-        // book, a Rust/Godot workspace, and a Python+Vite app, each spawning a
-        // Security Remediation focus whose team found nothing and escalated.
-        if (!product)
-            return null;
-        return configForProduct(config, product).repoPath;
-    };
-    return {
-        getDueScanConfigs: async (opts) => {
-            const res = await callApi('daemon_get_due_security_scan_configs', opts?.manualOnly ? { manualOnly: true } : {});
-            return res.items ?? [];
-        },
-        upsertFinding: async (productId, organizationId, finding) => {
-            const res = await callApi('daemon_upsert_security_finding', {
-                productId,
-                organizationId,
-                ...finding,
-            });
-            return res;
-        },
-        updateConfigLastRun: async (configId) => {
-            await callApi('daemon_update_scan_config_last_run', { configId });
-        },
-        clearManualRunRequest: async (configId) => {
-            await callApi('daemon_clear_manual_scan_request', { configId });
-        },
-        resolveCwd,
-        clearFeedCaches: () => {
-            clearOsvCache();
-            clearGhsaCache();
-        },
-        scanners: getRegisteredScanners(),
-        autoInjectDeps: buildDefaultAutoInjectDeps(),
-        resolutionDeps: buildDefaultResolutionDeps(),
-    };
-}
-//# sourceMappingURL=security-scan-engine.js.map

package/dist/security-scan-engine.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-scan-engine.js","sourceRoot":"","sources":["../src/security-scan-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAkD7D,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,gBAAgB,GAAyB,IAAI,GAAG,EAAE,CAAC;AAEzD,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AA4FD,SAAS,YAAY,CACnB,EAAuC,EACvC,SAAqC;IAErC,IAAI,MAAM,GAA4B,IAAI,CAAC;IAC3C,OAAO,CAAC,KAAa,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,MAAM,EAAE,EAAE;gBACT,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO,MAAM,CAAC;YAChB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM,GAAG,CAAC;YACZ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,YAAY,CAC1B,CAAC,KAAoD,EAAE,EAAE,CACvD,KAAK,CAAC,8BAA8B,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,EAC7E,CAAC,MAAM,EAAE,EAAE;QACT,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC;IACnC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAmB;QAC9B,GAAG,KAAK;QACR,8BAA8B,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAC5D,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;QACxC,gBAAgB,EAAE,QAAQ;QAC1B,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,UAAU;KAC3B,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,OAA8B,EAC9B,IAAsB;IAEtB,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CACP,sCAAsC,MAAM,CAAC,SAAS,+BAA+B;YACrF,+EAA+E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnG,kEAAkE;IAClE,iEAAiE;IACjE,8CAA8C;IAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAuB,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CACrC,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,OAAO,CACR,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAEjC,4BAA4B;gBAC5B,mCAAmC;gBACnC,iEAAiE;gBACjE,8CAA8C;gBAC9C,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;gBACnF,IAAI,oBAAoB,IAAI,eAAe,EAAE,CAAC;oBAC5C,IAAI,CAAC;wBACH,MAAM,YAAY,GAAwB;4BACxC,EAAE,EAAE,MAAM,CAAC,SAAS;4BACpB,cAAc,EAAE,MAAM,CAAC,cAAc;4BACrC,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;4BAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;yBAC5C,CAAC;wBACF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;wBAC1F,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;4BACvC,aAAa,EAAE,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,GAAG,CAAC,IAAI,CACN,sCAAsC,OAAO,CAAC,UAAU,GAAG,EAC1D,GAAa,CAAC,OAAO,CACvB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACN,kCAAkC,OAAO,CAAC,QAAQ,UAAU,EAC3D,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,iEAAiE;IACjE,sDAAsD;IACtD,IAAI,IAAI,CAAC,cAAc,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAwB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CACjF,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CACzD,CAAC;YACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4BAA4B;IAC5B,IAAI,oBAAoB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,oCAAoC,EAAE,CAAC;YACzE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,oCAAoC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN,qEAAqE,EACpE,GAAa,CAAC,OAAO,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,qEAAqE;AACrE,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,+CAA+C;AAC/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;AAE1C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAsB,EACtB,OAA8B,EAAE;IAEhC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC7C,MAAM,OAAO,GAA0B,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;QAC3F,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACnB,+DAA+D;YACzD,kDAAkD;YAClD,GAAG,CAAC,KAAK,CAAC,8DAA8D,EAAE,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,CAAC;gBAAS,CAAC;YACT,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,4BAA4B,CAAC,MAAoB;IAC/D,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAiB,EAAE;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAChE,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,4EAA4E;QAC5E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpD,CAAC,CAAC;IAEF,OAAO;QACL,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,sCAAsC,EACtC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAC7C,CAAC;YACF,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAsB,gCAAgC,EAAE;gBAC/E,SAAS;gBACT,cAAc;gBACd,GAAG,OAAO;aACX,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QACD,mBAAmB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACtC,MAAM,OAAO,CAAC,oCAAoC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,UAAU;QACV,eAAe,EAAE,GAAG,EAAE;YACpB,aAAa,EAAE,CAAC;YAChB,cAAc,EAAE,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,qBAAqB,EAAE;QACjC,cAAc,EAAE,0BAA0B,EAAE;QAC5C,cAAc,EAAE,0BAA0B,EAAE;KAC7C,CAAC;AACJ,CAAC"}