@telora/daemon 0.22.239 → 0.22.289

package/dist/verify/effect-reconciliation/judge-checkout.js

@@ -0,0 +1,267 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/effect-reconciliation/judge-checkout.test.ts
+// PINNED-BY-END
+/**
+ * What a verify judge reads: an EXPORT of one commit's tree -- files and
+ * directories, no `.git`, no object database -- and the hermetic git the DAEMON
+ * builds it and resolves citations with (verify/effect-reconciliation/judge-workspace.ts
+ * is its one caller).
+ *
+ * The export holds only the judged commit's tree, so no other commit is
+ * reachable from it by any argument: there is nothing to parse and nothing to
+ * confine. It is written from git's OBJECTS, blob by blob (`ls-tree` +
+ * `cat-file`), not through `checkout` or `archive`, which apply the
+ * tree's own attributes (`export-ignore` drops files, `export-subst` rewrites
+ * them) and any smudge filter a config names: every file holds exactly the bytes
+ * the commit records. A symlink is written as a regular file holding its target
+ * (what git records), so nothing in the export points outside it; a submodule
+ * is an empty directory; a path git would never check out (an empty, `.`, `..`
+ * or `.git` segment) is not written. The export is made READ-ONLY on disk for
+ * the judgement and writable again only to be removed.
+ *
+ * No tree is too large to export: memory is bounded by the export's limits, not
+ * by the tree. The recursive listing goes to a file and is read back in chunks,
+ * each entry handed on as it is parsed (no whole-tree listing or entry array is
+ * held); blobs are read in batches bounded in bytes and in entries, flushed as
+ * they fill; a blob larger than a batch is streamed straight into its file.
+ *
+ * `hermeticGitEnv` is the environment of every git the daemon runs for a
+ * judgement -- building an export, resolving the range, resolving a citation or
+ * a ruling's evidence (verify/shortfalls/ruling-evidence-resolution.ts): no
+ * inherited GIT_* variable (another repository, config parameters), no global
+ * or system config, no system attributes, no replacement objects, no hooks and
+ * no pager. The judge itself runs no git.
+ *
+ * @module verify/effect-reconciliation/judge-checkout
+ */
+import { execFileSync } from 'node:child_process';
+import { chmodSync, closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readdirSync, readSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+const GIT_TIMEOUT_MS = 30_000;
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+/** Config every hermetic git run carries on its command line's behalf (GIT_CONFIG_COUNT): no hooks, attributes file, fsmonitor or reflog. */
+const HERMETIC_CONFIG = [
+    ['core.hooksPath', '/dev/null'],
+    ['core.attributesFile', '/dev/null'],
+    ['core.fsmonitor', 'false'],
+    ['core.logAllRefUpdates', 'false'],
+];
+/**
+ * `base` without any GIT_* variable or PAGER, with git's global and system
+ * config, system attributes and replacement objects switched off, and the
+ * HERMETIC_CONFIG set (module header). Pure over its input.
+ */
+export function hermeticGitEnv(base = process.env) {
+    const kept = Object.entries(base).filter(([key]) => !key.startsWith('GIT_') && key !== 'PAGER');
+    const config = HERMETIC_CONFIG.flatMap(([key, value], i) => [[`GIT_CONFIG_KEY_${i}`, key], [`GIT_CONFIG_VALUE_${i}`, value]]);
+    return {
+        ...Object.fromEntries(kept),
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        GIT_ATTR_NOSYSTEM: '1',
+        GIT_NO_REPLACE_OBJECTS: '1',
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_PAGER: 'cat',
+        PAGER: 'cat',
+        GIT_CONFIG_COUNT: String(HERMETIC_CONFIG.length),
+        ...Object.fromEntries(config),
+    };
+}
+/** Run git in `cwd` under hermeticGitEnv. Never throws. */
+export function hermeticGit(args, cwd) {
+    try {
+        const output = execFileSync('git', args, {
+            cwd, env: hermeticGitEnv(), encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER, stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        return { success: true, output };
+    }
+    catch (err) {
+        const e = err;
+        const stderr = typeof e.stderr === 'string' ? e.stderr.trim() : '';
+        return { success: false, output: typeof e.stdout === 'string' ? e.stdout : '', error: stderr !== '' ? stderr : String(e.message ?? err) };
+    }
+}
+/** Where the export of a judgement's BASE tree (the state before the delivery's change) lives: beside the judged one. Pure. */
+export function judgeBaseDir(checkoutPath) {
+    return `${checkoutPath}.base`;
+}
+/** Every file and directory under `root` without (false) or with (true) its owner write bit. Symlinks are skipped. */
+export function setCheckoutWritable(root, writable) {
+    const walk = (p) => {
+        const st = lstatSync(p);
+        if (st.isSymbolicLink())
+            return;
+        const mode = writable ? st.mode | 0o200 : st.mode & ~0o222;
+        if (st.isDirectory()) {
+            if (writable)
+                chmodSync(p, mode);
+            for (const entry of readdirSync(p))
+                walk(join(p, entry));
+            if (!writable)
+                chmodSync(p, mode);
+            return;
+        }
+        chmodSync(p, mode);
+    };
+    if (existsSync(root))
+        walk(root);
+}
+/** A full commit sha for `rev` in `repoPath`, or null. */
+export function commitOf(repoPath, rev) {
+    const out = hermeticGit(['rev-parse', '--verify', '--end-of-options', `${rev}^{commit}`], repoPath);
+    const sha = out.success ? out.output.trim() : '';
+    return /^[0-9a-f]{40}$/i.test(sha) ? sha.toLowerCase() : null;
+}
+/** Whether git would check `path` out: no empty, `.`, `..` or `.git` segment. Pure. */
+function exportablePath(path) {
+    return path.split('/').every((s) => s !== '' && s !== '.' && s !== '..' && s.toLowerCase() !== '.git');
+}
+/** Parse one NUL-terminated record of `ls-tree -l`: `<mode> <type> <object> <size>\t<path>`. Pure. */
+function parseTreeRecord(record) {
+    const tab = record.indexOf('\t');
+    const [mode = '', type = '', object = '', size = ''] = record.slice(0, tab).trim().split(/\s+/);
+    return { mode, type, object, size: Number(size) || 0, path: record.slice(tab + 1) };
+}
+/**
+ * Hand each entry of `sha`'s tree, recursively, with its blob size, to `onEntry`
+ * as it is parsed. The listing (`ls-tree -r -l -z`) is written to a file, never
+ * to a buffer, and read back `chunkBytes` at a time: what is held is one chunk
+ * and the unfinished record it ends on. Throws when git cannot read the tree.
+ */
+function forEachTreeEntry(repoPath, sha, chunkBytes, onEntry, onRead) {
+    const scratch = mkdtempSync(join(tmpdir(), 'telora-judge-ls-tree-'));
+    try {
+        const listing = join(scratch, 'listing');
+        const out = openSync(listing, 'w');
+        try {
+            execFileSync('git', ['ls-tree', '-r', '-l', '-z', '--full-tree', sha], {
+                cwd: repoPath, env: hermeticGitEnv(), timeout: GIT_TIMEOUT_MS * 4, stdio: ['ignore', out, 'pipe'],
+            });
+        }
+        finally {
+            closeSync(out);
+        }
+        const fd = openSync(listing, 'r');
+        try {
+            const chunk = Buffer.alloc(chunkBytes);
+            let carry = Buffer.alloc(0);
+            for (let n = readSync(fd, chunk, 0, chunkBytes, null); n > 0; n = readSync(fd, chunk, 0, chunkBytes, null)) {
+                const held = carry.length > 0 ? Buffer.concat([carry, chunk.subarray(0, n)]) : chunk.subarray(0, n);
+                onRead?.('listing', held.length);
+                let at = 0;
+                for (let nul = held.indexOf(0, at); nul !== -1; nul = held.indexOf(0, at)) {
+                    if (nul > at)
+                        onEntry(parseTreeRecord(held.subarray(at, nul).toString('utf8')));
+                    at = nul + 1;
+                }
+                carry = Buffer.from(held.subarray(at));
+            }
+            if (carry.length > 0)
+                onEntry(parseTreeRecord(carry.toString('utf8')));
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/** How many bytes of blob content one `cat-file --batch` read holds at most. */
+export const EXPORT_BATCH_BYTES = 32 * 1024 * 1024;
+/** How many entries one batch holds at most, however small their blobs. */
+export const EXPORT_BATCH_ENTRIES = 10_000;
+/** How many bytes of the tree listing one read holds (plus the record it ends on). */
+export const EXPORT_LISTING_CHUNK_BYTES = 1024 * 1024;
+/** Room per object in a batch read for its `<sha> blob <size>` header and newline. */
+const BATCH_HEADER_BYTES = 128;
+/** Write a file of the export: its content, with the owner's execute bit when git records one. */
+function writeExportFile(target, mode, content) {
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, content, { mode: mode === '100755' ? 0o755 : 0o644 });
+}
+/** Read one batch of blobs (`cat-file --batch`, at most `batchBytes` of content) and write each entry's file. Throws on a failed read. */
+function exportBatch(repoPath, dir, entries, batchBytes, onRead) {
+    const objects = [...new Set(entries.map((e) => e.object))];
+    const out = execFileSync('git', ['cat-file', '--batch'], {
+        cwd: repoPath, env: hermeticGitEnv(), input: `${objects.join('\n')}\n`, timeout: GIT_TIMEOUT_MS * 4,
+        maxBuffer: batchBytes + objects.length * BATCH_HEADER_BYTES, stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    onRead?.('blobs', out.length);
+    const contents = new Map();
+    let at = 0;
+    while (at < out.length) {
+        const eol = out.indexOf(0x0a, at);
+        const [object = '', type = '', size = ''] = out.subarray(at, eol).toString('utf8').split(' ');
+        if (type !== 'blob')
+            throw new Error(`cat-file: ${object} is ${type || 'missing'}, not a blob`);
+        const start = eol + 1;
+        contents.set(object, out.subarray(start, start + Number(size)));
+        at = start + Number(size) + 1;
+    }
+    for (const e of entries)
+        writeExportFile(join(dir, e.path), e.mode, contents.get(e.object) ?? Buffer.alloc(0));
+}
+/** Stream one blob straight into its file (`cat-file blob` with stdout on the file): no byte of it is held in memory. Throws on a failed read. */
+function streamBlob(repoPath, dir, e) {
+    const target = join(dir, e.path);
+    mkdirSync(dirname(target), { recursive: true });
+    const fd = openSync(target, 'w', e.mode === '100755' ? 0o755 : 0o644);
+    try {
+        execFileSync('git', ['cat-file', 'blob', e.object], {
+            cwd: repoPath, env: hermeticGitEnv(), timeout: GIT_TIMEOUT_MS * 4, stdio: ['ignore', fd, 'pipe'],
+        });
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * Write the tree of `sha` in `repoPath` to the new directory `dir` (module
+ * header), then make it read-only. Entries are exported as the listing is read:
+ * a submodule becomes a directory, a blob larger than a batch is streamed, and
+ * every other blob joins the pending batch, which is read and written once it
+ * would exceed `batchBytes` of content or `batchEntries` entries. Returns the
+ * failure, or null.
+ */
+export function exportCommitTree(repoPath, sha, dir, limits = {}, onRead) {
+    const batchBytes = limits.batchBytes ?? EXPORT_BATCH_BYTES;
+    const batchEntries = limits.batchEntries ?? EXPORT_BATCH_ENTRIES;
+    const listingChunkBytes = limits.listingChunkBytes ?? EXPORT_LISTING_CHUNK_BYTES;
+    try {
+        mkdirSync(dir, { recursive: true });
+        let pending = [];
+        let pendingBytes = 0;
+        const flush = () => {
+            if (pending.length > 0)
+                exportBatch(repoPath, dir, pending, batchBytes, onRead);
+            pending = [];
+            pendingBytes = 0;
+        };
+        forEachTreeEntry(repoPath, sha, listingChunkBytes, (e) => {
+            if (!exportablePath(e.path))
+                return;
+            // A submodule: its commit is not in this repository's tree.
+            if (e.type !== 'blob') {
+                mkdirSync(join(dir, e.path), { recursive: true });
+                return;
+            }
+            if (e.size > batchBytes) {
+                streamBlob(repoPath, dir, e);
+                return;
+            }
+            if (pendingBytes + e.size > batchBytes || pending.length >= batchEntries)
+                flush();
+            pending.push(e);
+            pendingBytes += e.size;
+        }, onRead);
+        flush();
+        setCheckoutWritable(dir, false);
+        return null;
+    }
+    catch (err) {
+        return `export of ${sha.slice(0, 12)}: ${err.message.split('\n')[0] ?? ''}`;
+    }
+}
+//# sourceMappingURL=judge-checkout.js.map

package/dist/verify/effect-reconciliation/judge-checkout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge-checkout.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/judge-checkout.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qFAAqF;AACrF,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtJ,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,6IAA6I;AAC7I,MAAM,eAAe,GAA6C;IAChE,CAAC,gBAAgB,EAAE,WAAW,CAAC;IAC/B,CAAC,qBAAqB,EAAE,WAAW,CAAC;IACpC,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAC3B,CAAC,uBAAuB,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAA0B,OAAO,CAAC,GAAG;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9H,OAAO;QACL,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;QAC3B,mBAAmB,EAAE,GAAG;QACxB,iBAAiB,EAAE,WAAW;QAC9B,iBAAiB,EAAE,GAAG;QACtB,sBAAsB,EAAE,GAAG;QAC3B,mBAAmB,EAAE,GAAG;QACxB,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,KAAK;QACZ,gBAAgB,EAAE,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC;QAChD,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AASD,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,GAAW;IAC9D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;YACvC,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACpI,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAgE,CAAC;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;IAC5I,CAAC;AACH,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,YAAY,CAAC,YAAoB;IAC/C,OAAO,GAAG,YAAY,OAAO,CAAC;AAChC,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IACjE,MAAM,IAAI,GAAG,CAAC,CAAS,EAAQ,EAAE;QAC/B,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC,cAAc,EAAE;YAAE,OAAO;QAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;QAC3D,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YACrB,IAAI,QAAQ;gBAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,GAAW;IACpD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAYD,uFAAuF;AACvF,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AACzG,CAAC;AAED,sGAAsG;AACtG,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,QAAgB,EAChB,GAAW,EACX,UAAkB,EAClB,OAA+B,EAC/B,MAA2B;IAE3B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE;gBACrE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAClG,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3G,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpG,MAAM,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACX,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBAC1E,IAAI,GAAG,GAAG,EAAE;wBAAE,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAChF,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;gBACf,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,kGAAkG;AAClG,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;IACpE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC;AAYD,0IAA0I;AAC1I,SAAS,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,OAA6B,EAAE,UAAkB,EAAE,MAA2B;IAChI,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE;QACvD,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC;QACnG,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,kBAAkB,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAC7F,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9F,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,OAAO,IAAI,IAAI,SAAS,cAAc,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,EAAE,GAAG,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,kJAAkJ;AAClJ,SAAS,UAAU,CAAC,QAAgB,EAAE,GAAW,EAAE,CAAY;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;YAClD,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC;SACjG,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,GAAW,EACX,GAAW,EACX,SAAuB,EAAE,EACzB,MAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,kBAAkB,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACjE,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,0BAA0B,CAAC;IACjF,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAI,OAAO,GAAgB,EAAE,CAAC;QAC9B,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC;QACF,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE;YACvD,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO;YACpC,4DAA4D;YAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACtB,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;gBACxB,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,IAAI,YAAY,GAAG,CAAC,CAAC,IAAI,GAAG,UAAU,IAAI,OAAO,CAAC,MAAM,IAAI,YAAY;gBAAE,KAAK,EAAE,CAAC;YAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC;QACzB,CAAC,EAAE,MAAM,CAAC,CAAC;QACX,KAAK,EAAE,CAAC;QACR,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,aAAa,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAM,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;AACH,CAAC"}

package/dist/verify/effect-reconciliation/judge-invoker.d.ts

@@ -0,0 +1,82 @@
+import { type OneShotModelProcess } from '../../backends/claude/one-shot-model.js';
+import type { JudgeCheckout } from './judge-workspace.js';
+/** The tools the judge session may use at all. */
+export declare const JUDGE_TOOLS = "Read,Grep,Glob";
+/** The tool uses pre-approved for the judge: the same reads. */
+export declare const JUDGE_ALLOWED_TOOLS: readonly string[];
+/** The judge's turn cap. */
+export declare const JUDGE_MAX_TURNS = 40;
+/** The judge's timeout. */
+export declare const JUDGE_TIMEOUT_MS: number;
+/** What a judge session reads: the judged tree's export and the base tree's. */
+export type JudgeReadDirs = Pick<JudgeCheckout, 'checkoutPath' | 'basePath'>;
+/**
+ * The guard hook's command line for a checkout: this build's node running the
+ * guard CLI beside this module (compiled, or through tsx when the daemon runs
+ * from source), told the exports its file tools may read.
+ */
+export declare function judgeGuardCommand(checkout: JudgeReadDirs): string;
+/** The session settings that route every tool call through the guard. Pure over its input. */
+export declare function judgeGuardSettings(checkout: JudgeReadDirs): string;
+/** The environment a judge session has: the daemon's, with the export's CLAUDE.md files not loaded. */
+export declare function judgeEnv(base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * The claude CLI version the judge isolation was PROVEN against by a live run
+ * (judge-isolation.live.test.ts refuses to record a proof for any other). A new
+ * CLI can read the same flags differently, so moving to one means bumping this,
+ * which moves the fingerprint, which keeps the routine suite red until the live
+ * test has proved the isolation on it.
+ */
+export declare const JUDGE_PROVEN_CLAUDE_VERSION = "2.1.284";
+/**
+ * Whether a `claude --version` line names EXACTLY the proven version: its
+ * leading `x.y.z` token equals JUDGE_PROVEN_CLAUDE_VERSION (`2.1.2840` is not
+ * `2.1.284`). Pure.
+ */
+export declare function isProvenCliVersion(version: string | null | undefined): boolean;
+/** What the CLI a judge runs on says it is, and whether the isolation was proven on it. */
+export interface JudgeCliAttestation {
+    /** `claude --version`'s first line, or null when it could not be read. */
+    version: string | null;
+    proven: boolean;
+}
+/** Read a CLI's version line (production: `<bin> --version`). Throws when it cannot. */
+export type CliVersionReader = (claudeBin: string) => string;
+/** The production CliVersionReader, bound at the composition root. */
+export declare const readCliVersion: CliVersionReader;
+/**
+ * ATTEST the CLI a judge session is about to run on, once per binary per
+ * process: read its version and say, in the daemon log, whether the judge
+ * isolation was proven on it (JUDGE_PROVEN_CLAUDE_VERSION) -- a warning naming
+ * both versions and the live test that proves a new one when it was not. The
+ * judge still runs: the CLI updates far more often than a live proof can be
+ * re-recorded, and holding every delivery's verify on each release would trade
+ * one unproven boundary for a fleet-wide stop. The attestation makes the
+ * unproven run visible instead of silent. Never throws.
+ */
+export declare function attestJudgeCli(claudeBin: string, read: CliVersionReader): JudgeCliAttestation;
+/** Test seam: forget attested CLIs. */
+export declare function __resetJudgeCliAttestationForTests(): void;
+/**
+ * The guard hook's command line with only its host-specific parts replaced: the
+ * node binary, the two exports, and the install prefix of the loader
+ * and guard CLI. What loads the guard -- the `--import` loader and which package
+ * file it is, the CLI's file name and extension -- stays in, so a change to how
+ * the hook is loaded moves the fingerprint. Pure over its input.
+ */
+export declare function normalizedGuardCommand(command: string, checkout: JudgeReadDirs): string;
+/**
+ * A fingerprint of everything that isolates a judge session: the argv flags,
+ * the guard hook's command line (normalized: which program it runs, with which
+ * arguments), the guard's and the checkout's implementation, the environment judgeEnv sets, and
+ * the CLI version the isolation was proven on. The recorded live isolation run
+ * (docs/daemon/judge-isolation-live-run.json, written by
+ * judge-isolation.live.test.ts) names the fingerprint it proved; a routine test
+ * fails when any of these changes without a new live proof.
+ */
+export declare function judgeIsolationFingerprint(): string;
+/** The argv a judge session appends to the one-shot argv. */
+export declare function buildJudgeArgs(workspace: JudgeReadDirs): string[];
+/** A judge invoker over the one-shot wrapper, bound at the composition root. */
+export declare function claudeJudgeInvoker(label: string, process: OneShotModelProcess, readVersion: CliVersionReader): (systemPrompt: string, userMessage: string, workspace: JudgeCheckout) => Promise<string>;
+//# sourceMappingURL=judge-invoker.d.ts.map

package/dist/verify/effect-reconciliation/judge-invoker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge-invoker.d.ts","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/judge-invoker.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAK1D,kDAAkD;AAClD,eAAO,MAAM,WAAW,mBAAmB,CAAC;AAC5C,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAA6B,CAAC;AAC/E,4BAA4B;AAC5B,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,2BAA2B;AAC3B,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAE/C,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,GAAG,UAAU,CAAC,CAAC;AAO7E;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAMjE;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAIlE;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAEjF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAG9E;AAED,2FAA2F;AAC3F,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;AAE7D,sEAAsE;AACtE,eAAO,MAAM,cAAc,EAAE,gBACqH,CAAC;AAEnJ;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,mBAAmB,CAsB7F;AAED,uCAAuC;AACvC,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAQvF;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAclD;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,SAAS,EAAE,aAAa,GAAG,MAAM,EAAE,CAUjE;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,IAC7F,cAAc,MAAM,EAAE,aAAa,MAAM,EAAE,WAAW,aAAa,KAAG,OAAO,CAAC,MAAM,CAAC,CAapG"}

package/dist/verify/effect-reconciliation/judge-invoker.js

@@ -0,0 +1,232 @@
+// PINNED-BY-BEGIN (generated by gen:pinned-by -- do not hand-edit; checked by lint:pinned-by)
+// Pinned by: packages/daemon/src/verify/effect-reconciliation/judge-invoker.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-isolation-record.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-isolation.live.test.ts,
+//   packages/daemon/src/verify/effect-reconciliation/judge-tool-guard.test.ts,
+//   packages/daemon/src/verify/inspection-strategies/ai-inspection-runner.test.ts
+// PINNED-BY-END
+/**
+ * How a verify judge runs: one BOUNDED, READ-ONLY `claude --print` session in the
+ * export of the judged commit's tree, with the base tree's export beside it
+ * (verify/effect-reconciliation/judge-workspace.ts). The exports hold files
+ * only -- no `.git`, no object database -- so no other commit is reachable.
+ *
+ *   - The tool SET is restricted with `--tools` to Read, Grep and Glob --
+ *     `--allowed-tools` alone only pre-approves and restricts nothing. No shell
+ *     and no git: the commit range, changed files and diff stat arrive in the
+ *     question. No MCP server is loaded (`--strict-mcp-config` with none named).
+ *   - EVERY tool call first passes the daemon's guard, a PreToolUse hook the
+ *     session is started with (`--settings`):
+ *     verify/effect-reconciliation/judge-tool-guard.ts keeps each path inside
+ *     the exports, and a refused call never runs. The exports are read-only on
+ *     disk as well.
+ *   - The session is ISOLATED from everything the judged commit or the host user
+ *     could configure: `--restricted` ignores the user, project and local
+ *     settings files (so a hook committed in the checkout's `.claude/settings.json`
+ *     never loads, while the daemon's own `--settings` still applies) and
+ *     confines the file tools to the working directories, and
+ *     CLAUDE_CODE_DISABLE_CLAUDE_MDS keeps the checkout's CLAUDE.md out of the
+ *     judge's instructions (`judgeEnv`).
+ *   - The session runs IN the judged tree's export (its cwd); the base export is
+ *     its one other readable dir.
+ *   - A turn cap and a timeout bound its cost. Using every turn is
+ *     `session_exhausted` (backends/claude/one-shot-model.ts maxTurns), a kind
+ *     retrying cannot cure: the same input waits for new input instead of paying
+ *     a full session every tick (verify/outcome-routing/incurable-model-hold.ts).
+ *     A timeout stays a `timeout` and is retried: a slow answer is not a
+ *     property of the input.
+ *
+ * @module verify/effect-reconciliation/judge-invoker
+ */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { dirname, extname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { invokeOneShotModel } from '../../backends/claude/one-shot-model.js';
+import { createLogger } from '../../log/daemon-log.js';
+const log = createLogger({ module: 'verification' });
+/** The tools the judge session may use at all. */
+export const JUDGE_TOOLS = 'Read,Grep,Glob';
+/** The tool uses pre-approved for the judge: the same reads. */
+export const JUDGE_ALLOWED_TOOLS = ['Read', 'Grep', 'Glob'];
+/** The judge's turn cap. */
+export const JUDGE_MAX_TURNS = 40;
+/** The judge's timeout. */
+export const JUDGE_TIMEOUT_MS = 10 * 60 * 1000;
+/** One shell word, single-quoted. Pure. */
+function shellWord(word) {
+    return `'${word.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * The guard hook's command line for a checkout: this build's node running the
+ * guard CLI beside this module (compiled, or through tsx when the daemon runs
+ * from source), told the exports its file tools may read.
+ */
+export function judgeGuardCommand(checkout) {
+    const here = fileURLToPath(import.meta.url);
+    const ext = extname(here);
+    const cli = join(dirname(here), `judge-tool-guard-cli${ext}`);
+    const loader = ext === '.ts' ? ['--import', typeof import.meta.resolve === 'function' ? import.meta.resolve('tsx') : 'tsx'] : [];
+    return [process.execPath, ...loader, cli, checkout.checkoutPath, ...(checkout.basePath ? [checkout.basePath] : [])].map(shellWord).join(' ');
+}
+/** The session settings that route every tool call through the guard. Pure over its input. */
+export function judgeGuardSettings(checkout) {
+    return JSON.stringify({
+        hooks: { PreToolUse: [{ matcher: '*', hooks: [{ type: 'command', command: judgeGuardCommand(checkout) }] }] },
+    });
+}
+/** The environment a judge session has: the daemon's, with the export's CLAUDE.md files not loaded. */
+export function judgeEnv(base = process.env) {
+    return { ...base, CLAUDE_CODE_DISABLE_CLAUDE_MDS: '1' };
+}
+/**
+ * The claude CLI version the judge isolation was PROVEN against by a live run
+ * (judge-isolation.live.test.ts refuses to record a proof for any other). A new
+ * CLI can read the same flags differently, so moving to one means bumping this,
+ * which moves the fingerprint, which keeps the routine suite red until the live
+ * test has proved the isolation on it.
+ */
+export const JUDGE_PROVEN_CLAUDE_VERSION = '2.1.284';
+/**
+ * Whether a `claude --version` line names EXACTLY the proven version: its
+ * leading `x.y.z` token equals JUDGE_PROVEN_CLAUDE_VERSION (`2.1.2840` is not
+ * `2.1.284`). Pure.
+ */
+export function isProvenCliVersion(version) {
+    const token = /^v?(\d+\.\d+\.\d+)(?![\d.])/.exec((version ?? '').trim())?.[1];
+    return token === JUDGE_PROVEN_CLAUDE_VERSION;
+}
+const attested = new Map();
+/** The production CliVersionReader, bound at the composition root. */
+export const readCliVersion = (claudeBin) => (execFileSync(claudeBin, ['--version'], { encoding: 'utf8', timeout: 15_000, stdio: ['ignore', 'pipe', 'ignore'] }).split('\n')[0] ?? '').trim();
+/**
+ * ATTEST the CLI a judge session is about to run on, once per binary per
+ * process: read its version and say, in the daemon log, whether the judge
+ * isolation was proven on it (JUDGE_PROVEN_CLAUDE_VERSION) -- a warning naming
+ * both versions and the live test that proves a new one when it was not. The
+ * judge still runs: the CLI updates far more often than a live proof can be
+ * re-recorded, and holding every delivery's verify on each release would trade
+ * one unproven boundary for a fleet-wide stop. The attestation makes the
+ * unproven run visible instead of silent. Never throws.
+ */
+export function attestJudgeCli(claudeBin, read) {
+    const known = attested.get(claudeBin);
+    if (known)
+        return known;
+    let version;
+    try {
+        version = read(claudeBin) || null;
+    }
+    catch {
+        version = null;
+    }
+    const attestation = { version, proven: isProvenCliVersion(version) };
+    attested.set(claudeBin, attestation);
+    if (attestation.proven) {
+        log.info(`judge CLI attested: ${claudeBin} is ${version}, the version the judge isolation was proven on`);
+    }
+    else {
+        log.warn(`judge CLI UNPROVEN: ${claudeBin} is ${version ?? '(version unreadable)'}, but the judge isolation was proven on `
+            + `${JUDGE_PROVEN_CLAUDE_VERSION} -- verify judges run on an isolation not yet proven on this CLI. Prove it: `
+            + 'TELORA_LIVE_JUDGE_TEST=1 npm test -- src/verify/effect-reconciliation/judge-isolation.live.test.ts, '
+            + 'after bumping JUDGE_PROVEN_CLAUDE_VERSION');
+    }
+    return attestation;
+}
+/** Test seam: forget attested CLIs. */
+export function __resetJudgeCliAttestationForTests() {
+    attested.clear();
+}
+/**
+ * The guard hook's command line with only its host-specific parts replaced: the
+ * node binary, the two exports, and the install prefix of the loader
+ * and guard CLI. What loads the guard -- the `--import` loader and which package
+ * file it is, the CLI's file name and extension -- stays in, so a change to how
+ * the hook is loaded moves the fingerprint. Pure over its input.
+ */
+export function normalizedGuardCommand(command, checkout) {
+    const words = command.match(/'(?:[^']|'\\'')*'/g) ?? [];
+    return words.map((w) => w.slice(1, -1).replace(/'\\''/g, "'")).map((w) => {
+        if (w === process.execPath)
+            return '<node>';
+        if (w === checkout.checkoutPath)
+            return '<checkout>';
+        if (w === checkout.basePath)
+            return '<base>';
+        return w.replace(/^(?:file:\/\/)?\/.*\/(node_modules\/.+)$/, '$1').replace(/^\/.*\/(judge-tool-guard-cli\.[jt]s)$/, '$1');
+    }).join(' ');
+}
+/**
+ * The isolation's implementation as this build runs it: the source of this
+ * invoker (the argv, environment and hook command it builds), the guard, its hook
+ * entry point and the export (judge-checkout.ts: how the judged tree is
+ * written, and what is left out of it), without
+ * the generated PINNED-BY block (which names the tests that import a module, not
+ * what it does).
+ */
+function isolationImplementationDigest() {
+    const here = fileURLToPath(import.meta.url);
+    const ext = extname(here);
+    const hash = createHash('sha256');
+    for (const name of ['judge-invoker', 'judge-tool-guard', 'judge-tool-guard-cli', 'judge-checkout']) {
+        const source = readFileSync(join(dirname(here), `${name}${ext}`), 'utf8');
+        hash.update(source.replace(/^\/\/ PINNED-BY-BEGIN[\s\S]*?\/\/ PINNED-BY-END\n/m, ''));
+    }
+    return hash.digest('hex');
+}
+/**
+ * A fingerprint of everything that isolates a judge session: the argv flags,
+ * the guard hook's command line (normalized: which program it runs, with which
+ * arguments), the guard's and the checkout's implementation, the environment judgeEnv sets, and
+ * the CLI version the isolation was proven on. The recorded live isolation run
+ * (docs/daemon/judge-isolation-live-run.json, written by
+ * judge-isolation.live.test.ts) names the fingerprint it proved; a routine test
+ * fails when any of these changes without a new live proof.
+ */
+export function judgeIsolationFingerprint() {
+    const placeholder = { checkoutPath: '/judge/checkout', basePath: '/judge/checkout.base' };
+    const args = buildJudgeArgs(placeholder).map((arg, i, all) => {
+        if (all[i - 1] === '--add-dir')
+            return arg === placeholder.basePath ? '<base>' : '<checkout>';
+        if (all[i - 1] !== '--settings')
+            return arg;
+        const hooks = JSON.parse(arg).hooks;
+        return JSON.stringify(Object.entries(hooks).map(([event, entries]) => [
+            event, entries.map((e) => [e.matcher, e.hooks.map((h) => [h.type, normalizedGuardCommand(h.command, placeholder)])]),
+        ]));
+    });
+    const env = Object.entries(judgeEnv({})).sort(([a], [b]) => a.localeCompare(b));
+    return createHash('sha256')
+        .update(JSON.stringify({ args, env, implementation: isolationImplementationDigest(), claude: JUDGE_PROVEN_CLAUDE_VERSION }))
+        .digest('hex');
+}
+/** The argv a judge session appends to the one-shot argv. */
+export function buildJudgeArgs(workspace) {
+    return [
+        '--restricted',
+        '--tools', JUDGE_TOOLS,
+        '--allowed-tools', ...JUDGE_ALLOWED_TOOLS,
+        '--add-dir', workspace.checkoutPath,
+        ...(workspace.basePath ? ['--add-dir', workspace.basePath] : []),
+        '--strict-mcp-config',
+        '--settings', judgeGuardSettings(workspace),
+    ];
+}
+/** A judge invoker over the one-shot wrapper, bound at the composition root. */
+export function claudeJudgeInvoker(label, process, readVersion) {
+    return async (systemPrompt, userMessage, workspace) => {
+        attestJudgeCli('claude', readVersion);
+        const result = await invokeOneShotModel(systemPrompt, userMessage, {
+            label,
+            ...process,
+            cwd: workspace.checkoutPath,
+            env: judgeEnv(),
+            extraArgs: buildJudgeArgs(workspace),
+            timeoutMs: JUDGE_TIMEOUT_MS,
+            maxTurns: JUDGE_MAX_TURNS,
+        });
+        return result.text;
+    };
+}
+//# sourceMappingURL=judge-invoker.js.map

package/dist/verify/effect-reconciliation/judge-invoker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge-invoker.js","sourceRoot":"","sources":["../../../src/verify/effect-reconciliation/judge-invoker.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,qFAAqF;AACrF,qFAAqF;AACrF,mFAAmF;AACnF,+EAA+E;AAC/E,kFAAkF;AAClF,gBAAgB;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAA4B,MAAM,yCAAyC,CAAC;AAEvG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAErD,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAC5C,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC/E,4BAA4B;AAC5B,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAClC,2BAA2B;AAC3B,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAK/C,2CAA2C;AAC3C,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuB;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,uBAAuB,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/I,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,QAAuB;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;KAC9G,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,QAAQ,CAAC,OAA0B,OAAO,CAAC,GAAG;IAC5D,OAAO,EAAE,GAAG,IAAI,EAAE,8BAA8B,EAAE,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,KAAK,2BAA2B,CAAC;AAC/C,CAAC;AASD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;AAKxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAqB,CAAC,SAAS,EAAE,EAAE,CAC5D,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAEnJ;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,IAAsB;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,MAAM,WAAW,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,uBAAuB,SAAS,OAAO,OAAO,iDAAiD,CAAC,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CACN,uBAAuB,SAAS,OAAO,OAAO,IAAI,sBAAsB,0CAA0C;cAChH,GAAG,2BAA2B,8EAA8E;cAC5G,sGAAsG;cACtG,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,kCAAkC;IAChD,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,QAAuB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvE,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC5C,IAAI,CAAC,KAAK,QAAQ,CAAC,YAAY;YAAE,OAAO,YAAY,CAAC;QACrD,IAAI,CAAC,KAAK,QAAQ,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC7C,OAAO,CAAC,CAAC,OAAO,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,6BAA6B;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACnG,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,oDAAoD,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,WAAW,GAAkB,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACzG,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE;QAC3D,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,WAAW;YAAE,OAAO,GAAG,KAAK,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;QAC9F,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,YAAY;YAAE,OAAO,GAAG,CAAC;QAC5C,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4G,CAAC,KAAK,CAAC;QAChJ,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YACpE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;SACrH,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,6BAA6B,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;SAC3H,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,SAAwB;IACrD,OAAO;QACL,cAAc;QACd,SAAS,EAAE,WAAW;QACtB,iBAAiB,EAAE,GAAG,mBAAmB;QACzC,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,qBAAqB;QACrB,YAAY,EAAE,kBAAkB,CAAC,SAAS,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,OAA4B,EAAE,WAA6B;IAC3G,OAAO,KAAK,EAAE,YAAoB,EAAE,WAAmB,EAAE,SAAwB,EAAmB,EAAE;QACpG,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,WAAW,EAAE;YACjE,KAAK;YACL,GAAG,OAAO;YACV,GAAG,EAAE,SAAS,CAAC,YAAY;YAC3B,GAAG,EAAE,QAAQ,EAAE;YACf,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC;YACpC,SAAS,EAAE,gBAAgB;YAC3B,QAAQ,EAAE,eAAe;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC"}