@tiangong-ai/cli 0.0.35 → 0.0.36

package/dist/research/workspace/audit-bundle.js

@@ -0,0 +1,357 @@
+import { randomUUID } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
+import { chmod, copyFile, lstat, mkdir, readFile, rename, rm } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { CliError } from "../../errors.js";
+import { loadEvidenceArtifactRecords } from "./artifacts.js";
+import { verifyCapabilities } from "./capabilities.js";
+import { loadProjectEvidenceReceipts } from "./evidence.js";
+import { readJournal, verifyJournal } from "./journal.js";
+import { loadProject } from "./projects.js";
+import { sanitizeResearchText } from "./sanitization.js";
+import { canonicalJson, ensureDirectory, isObject, pathExists, readJsonFile, regularTreeFiles, resolveContained, safeRelativePath, sha256File, sha256Text, workspacePaths, writeJsonAtomic, } from "./storage.js";
+import { loadWorkspaceConfig, withWorkspaceLock } from "./workspace.js";
+const SHA256 = /^[a-f0-9]{64}$/;
+const MAX_TEXT_SCAN_BYTES = 16 * 1024 * 1024;
+export async function exportProjectAuditBundle(input) {
+    return withWorkspaceLock(input.root, "research.audit.export", async () => {
+        const destination = await validateNewDestination(input.destination);
+        const paths = workspacePaths(input.root);
+        const project = await loadProject(input.root, input.projectId);
+        const journal = await verifyJournal(paths.journal);
+        const temporary = join(dirname(destination), `.${basename(destination)}.${process.pid}.${randomUUID()}.tmp`);
+        await mkdir(temporary, { mode: 0o700 });
+        try {
+            const staged = new Set();
+            const stageFile = async (source, logicalPath) => {
+                const logical = safeRelativePath(logicalPath, "Audit bundle file");
+                if (staged.has(logical))
+                    return;
+                const info = await lstat(source).catch(() => undefined);
+                if (!info?.isFile() || info.isSymbolicLink()) {
+                    throw auditError(`Audit source is not an exact regular file: ${logical}`);
+                }
+                const target = resolveContained(temporary, logical);
+                await ensureDirectory(dirname(target));
+                await copyFile(source, target, fsConstants.COPYFILE_EXCL);
+                await chmod(target, 0o444).catch(() => undefined);
+                staged.add(logical);
+            };
+            const projectRoot = join(paths.projects, project.id);
+            const projectFiles = await regularTreeFiles(projectRoot).catch((error) => {
+                throw auditError("Project tree contains a non-portable entry.", error);
+            });
+            for (const source of projectFiles) {
+                const logical = relative(projectRoot, source).split(sep).join("/");
+                if (logical === "project.json" ||
+                    logical.startsWith("runs/") ||
+                    logical.startsWith("native/")) {
+                    continue;
+                }
+                await stageFile(source, `project/${logical}`);
+            }
+            const portableProject = portableProjectState(project);
+            await writeJsonAtomic(join(temporary, "state", "project.json"), portableProject, 0o444);
+            staged.add("state/project.json");
+            for (const inputRecord of project.inputs) {
+                await assertSourceBinding(inputRecord.path, inputRecord.sha256, inputRecord.bytes);
+                await stageFile(inputRecord.path, `inputs/${inputRecord.sha256}`);
+                if (inputRecord.contextPath && inputRecord.contextSha256 && inputRecord.contextBytes) {
+                    await assertSourceBinding(inputRecord.contextPath, inputRecord.contextSha256, inputRecord.contextBytes);
+                    await stageFile(inputRecord.contextPath, `inputs/${inputRecord.contextSha256}`);
+                }
+            }
+            for (const document of project.publicationPolicy?.documents ?? []) {
+                const source = resolveContained(paths.control, document.objectLocator);
+                await assertSourceBinding(source, document.sha256);
+                await stageFile(source, `workspace-objects/${document.objectLocator}`);
+            }
+            const receipts = await loadProjectEvidenceReceipts(input.root, project.id);
+            for (const receipt of receipts) {
+                await stageFile(resolveContained(paths.control, receipt.locator), `workspace-objects/${receipt.locator}`);
+                await stageFile(resolveContained(paths.control, receipt.contextLocator), `workspace-objects/${receipt.contextLocator}`);
+            }
+            const artifacts = await loadEvidenceArtifactRecords(input.root, project.id);
+            for (const artifact of artifacts) {
+                await assertSourceBinding(resolveContained(paths.control, artifact.locator), artifact.sha256, artifact.bytes);
+                await stageFile(resolveContained(paths.control, artifact.locator), `workspace-objects/${artifact.locator}`);
+            }
+            const [config, runtimeLock, capabilityVerification, journalEvents] = await Promise.all([
+                loadWorkspaceConfig(input.root),
+                readJsonFile(paths.runtimeLock, "Research runtime lock"),
+                verifyCapabilities(input.root),
+                readJournal(paths.journal),
+            ]);
+            await writeJsonAtomic(join(temporary, "state", "environment.json"), {
+                schemaVersion: 1,
+                mode: config.mode,
+                producer: portableAgentRoute(config.producer),
+                reviewer: portableAgentRoute(config.reviewer),
+                budget: config.budget,
+                runtimeLock,
+                capabilityVerification,
+            }, 0o444);
+            staged.add("state/environment.json");
+            await writeJsonAtomic(join(temporary, "state", "journal-event-proofs.json"), {
+                schemaVersion: 1,
+                workspaceJournalHead: journal.head,
+                events: journalEvents.filter((event) => event.scope === project.id || containsExactString(event.payload, project.id)),
+            }, 0o444);
+            staged.add("state/journal-event-proofs.json");
+            await assertPortableTextFiles(temporary, resolve(input.root));
+            const files = await bundleFileRecords(temporary);
+            const projectStatePath = join(projectRoot, "project.json");
+            const capabilityLockSha256 = (await pathExists(paths.capabilityLock))
+                ? await sha256File(paths.capabilityLock)
+                : null;
+            const manifestCore = {
+                schemaVersion: 1,
+                kind: "tiangong-project-audit-bundle",
+                projectId: project.id,
+                createdAt: new Date().toISOString(),
+                authority: {
+                    status: project.status,
+                    lineageKind: project.lineage.kind,
+                    derivedFrom: project.lineage.derivedFrom,
+                    supersedes: project.lineage.supersedes,
+                    supersededBy: project.lineage.supersededBy,
+                },
+                sourceBindings: {
+                    projectStateSha256: await sha256File(projectStatePath),
+                    workspaceJournalHead: journal.head,
+                    workspaceRuntimeLockSha256: await sha256File(paths.runtimeLock),
+                    capabilityLockSha256,
+                    sourceWorkspacePathSha256: sha256Text(resolve(input.root)),
+                },
+                locatorRoots: {
+                    project: "project",
+                    workspaceObjects: "workspace-objects",
+                    inputs: "inputs",
+                },
+                exclusions: [
+                    "credentials and environment secrets",
+                    "setup sources and browser profiles",
+                    "active native-stage state",
+                    "ephemeral run capsules and raw agent authentication",
+                    "unrelated workspace projects and files",
+                ],
+                files,
+            };
+            const manifest = {
+                ...manifestCore,
+                manifestSha256: sha256Text(canonicalJson(manifestCore)),
+            };
+            await writeJsonAtomic(join(temporary, "manifest.json"), manifest, 0o444);
+            await verifyProjectAuditBundle(temporary);
+            await rename(temporary, destination);
+            return manifest;
+        }
+        catch (error) {
+            await rm(temporary, { recursive: true, force: true }).catch(() => undefined);
+            throw error;
+        }
+    });
+}
+export async function verifyProjectAuditBundle(bundlePath) {
+    if (!isAbsolute(bundlePath) || resolve(bundlePath) !== bundlePath) {
+        throw auditPathError("Audit bundle path must be absolute and normalized.");
+    }
+    const info = await lstat(bundlePath).catch(() => undefined);
+    if (!info?.isDirectory() || info.isSymbolicLink()) {
+        throw auditPathError("Audit bundle must be a regular directory and not a symbolic link.");
+    }
+    const manifestPath = join(bundlePath, "manifest.json");
+    const manifestInfo = await lstat(manifestPath).catch(() => undefined);
+    if (!manifestInfo?.isFile() || manifestInfo.isSymbolicLink()) {
+        throw auditError("Audit manifest is missing or is not a regular file.");
+    }
+    let value;
+    try {
+        value = JSON.parse(await readFile(manifestPath, "utf8"));
+    }
+    catch {
+        throw auditError("Audit manifest is not valid JSON.");
+    }
+    const manifest = parseManifest(value);
+    const { manifestSha256, ...core } = manifest;
+    if (sha256Text(canonicalJson(core)) !== manifestSha256) {
+        throw auditError("Audit manifest failed its hash binding.");
+    }
+    const actualFiles = (await regularTreeFiles(bundlePath))
+        .map((path) => relative(bundlePath, path).split(sep).join("/"))
+        .filter((path) => path !== "manifest.json");
+    const expectedPaths = manifest.files.map((file) => file.path);
+    if (actualFiles.length !== expectedPaths.length ||
+        actualFiles.some((path, index) => path !== expectedPaths[index])) {
+        throw auditError("Audit bundle contains missing, extra, or unordered files.");
+    }
+    for (const record of manifest.files) {
+        const path = resolveContained(bundlePath, record.path);
+        const fileInfo = await lstat(path).catch(() => undefined);
+        if (!fileInfo?.isFile() ||
+            fileInfo.isSymbolicLink() ||
+            fileInfo.size !== record.bytes ||
+            (await sha256File(path)) !== record.sha256) {
+            throw auditError(`Audit file failed its exact binding: ${record.path}`);
+        }
+    }
+    await assertPortableTextFiles(bundlePath);
+    return {
+        status: "verified",
+        projectId: manifest.projectId,
+        manifestSha256,
+        files: manifest.files.length,
+    };
+}
+function portableProjectState(project) {
+    const portable = structuredClone(project);
+    portable.inputs = portable.inputs.map((input) => ({
+        ...input,
+        path: `inputs/${input.sha256}`,
+        ...(input.contextPath && input.contextSha256
+            ? { contextPath: `inputs/${input.contextSha256}` }
+            : {}),
+    }));
+    return portable;
+}
+function portableAgentRoute(route) {
+    return {
+        agent: route.agent,
+        executionMode: route.executionMode,
+        binaryName: basename(route.binary),
+        model: route.model,
+        effort: route.effort ?? null,
+        verbosity: route.verbosity ?? null,
+    };
+}
+async function bundleFileRecords(root) {
+    const files = await regularTreeFiles(root);
+    return Promise.all(files
+        .map((path) => ({ path, logical: relative(root, path).split(sep).join("/") }))
+        .filter((item) => item.logical !== "manifest.json")
+        .map(async ({ path, logical }) => {
+        const info = await lstat(path);
+        return { path: logical, sha256: await sha256File(path), bytes: info.size };
+    }));
+}
+async function assertSourceBinding(path, expectedSha256, expectedBytes) {
+    const info = await lstat(path).catch(() => undefined);
+    if (!info?.isFile() ||
+        info.isSymbolicLink() ||
+        (expectedBytes !== undefined && info.size !== expectedBytes) ||
+        (await sha256File(path)) !== expectedSha256) {
+        throw auditError("An audit source no longer matches its recorded hash and size.");
+    }
+}
+async function assertPortableTextFiles(root, forbiddenRoot) {
+    for (const path of await regularTreeFiles(root)) {
+        const info = await lstat(path);
+        if (info.size > MAX_TEXT_SCAN_BYTES)
+            continue;
+        const bytes = await readFile(path);
+        if (!looksTextual(path, bytes))
+            continue;
+        const text = bytes.toString("utf8");
+        if (forbiddenRoot && text.includes(forbiddenRoot)) {
+            throw new CliError("Audit bundle contains a host-specific workspace path.", {
+                code: "RESEARCH_AUDIT_BUNDLE_NONPORTABLE",
+                exitCode: 3,
+            });
+        }
+        if (sanitizeResearchText(text) !== text) {
+            throw new CliError("Audit bundle contains credential-like or sensitive text.", {
+                code: "RESEARCH_AUDIT_BUNDLE_SENSITIVE",
+                exitCode: 3,
+            });
+        }
+    }
+}
+function looksTextual(path, bytes) {
+    if (bytes.includes(0))
+        return false;
+    if (/\.(?:csv|json|jsonl|md|txt|tsv|ya?ml)$/iu.test(path))
+        return true;
+    const start = bytes.subarray(0, 64).toString("utf8").trimStart();
+    return start.startsWith("{") || start.startsWith("[");
+}
+async function validateNewDestination(value) {
+    if (!isAbsolute(value) || resolve(value) !== value) {
+        throw auditPathError("Audit export destination must be absolute and normalized.");
+    }
+    if (await pathExists(value)) {
+        throw auditPathError("Audit export destination must not already exist.");
+    }
+    const parent = dirname(value);
+    const parentInfo = await lstat(parent).catch(() => undefined);
+    if (!parentInfo?.isDirectory() || parentInfo.isSymbolicLink()) {
+        throw auditPathError("Audit export parent must be an existing regular directory.");
+    }
+    return value;
+}
+function parseManifest(value) {
+    if (!isObject(value) ||
+        value.schemaVersion !== 1 ||
+        value.kind !== "tiangong-project-audit-bundle" ||
+        typeof value.projectId !== "string" ||
+        typeof value.createdAt !== "string" ||
+        !isObject(value.authority) ||
+        !isObject(value.sourceBindings) ||
+        !isObject(value.locatorRoots) ||
+        value.locatorRoots.project !== "project" ||
+        value.locatorRoots.workspaceObjects !== "workspace-objects" ||
+        value.locatorRoots.inputs !== "inputs" ||
+        !Array.isArray(value.exclusions) ||
+        value.exclusions.some((item) => typeof item !== "string") ||
+        !Array.isArray(value.files) ||
+        typeof value.manifestSha256 !== "string" ||
+        !SHA256.test(value.manifestSha256)) {
+        throw auditError("Audit manifest shape is invalid.");
+    }
+    const files = value.files;
+    if (files.some((file) => !isObject(file) ||
+        typeof file.path !== "string" ||
+        safePathOrNull(file.path) === null ||
+        typeof file.sha256 !== "string" ||
+        !SHA256.test(file.sha256) ||
+        !Number.isSafeInteger(file.bytes) ||
+        Number(file.bytes) < 0)) {
+        throw auditError("Audit manifest file records are invalid.");
+    }
+    const paths = files.map((file) => String(file.path));
+    if (new Set(paths).size !== paths.length ||
+        paths.some((path, index) => index > 0 && paths[index - 1] >= path)) {
+        throw auditError("Audit manifest file paths must be unique and byte-order sorted.");
+    }
+    return value;
+}
+function safePathOrNull(value) {
+    try {
+        return safeRelativePath(value, "Audit manifest path");
+    }
+    catch {
+        return null;
+    }
+}
+function containsExactString(value, target) {
+    if (value === target)
+        return true;
+    if (Array.isArray(value))
+        return value.some((item) => containsExactString(item, target));
+    if (!isObject(value))
+        return false;
+    return Object.values(value).some((item) => containsExactString(item, target));
+}
+function auditError(message, cause) {
+    return new CliError(message, {
+        code: "RESEARCH_AUDIT_BUNDLE_INVALID",
+        exitCode: 3,
+        details: cause ? { cause: cause instanceof Error ? cause.message : String(cause) } : undefined,
+    });
+}
+function auditPathError(message) {
+    return new CliError(message, {
+        code: "RESEARCH_AUDIT_BUNDLE_PATH_INVALID",
+        exitCode: 2,
+    });
+}
+//# sourceMappingURL=audit-bundle.js.map

package/dist/research/workspace/audit-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-bundle.js","sourceRoot":"","sources":["../../../src/research/workspace/audit-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EACL,aAAa,EACb,eAAe,EACf,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AA+B7C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CACpB,OAAO,CAAC,WAAW,CAAC,EACpB,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAC/D,CAAC;QACF,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAAiB,EAAE;gBAC7E,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,OAAO;gBAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC7C,MAAM,UAAU,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;gBAC1D,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvE,MAAM,UAAU,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,IACE,OAAO,KAAK,cAAc;oBAC1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3B,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAC7B,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;YACxF,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAEjC,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;gBACnF,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,IAAI,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,aAAa,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrF,MAAM,mBAAmB,CACvB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,YAAY,CACzB,CAAC;oBACF,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,UAAU,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,iBAAiB,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;gBAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACvE,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,MAAM,SAAS,CAAC,MAAM,EAAE,qBAAqB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,SAAS,CACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAChD,qBAAqB,OAAO,CAAC,OAAO,EAAE,CACvC,CAAC;gBACF,MAAM,SAAS,CACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,EACvD,qBAAqB,OAAO,CAAC,cAAc,EAAE,CAC9C,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,mBAAmB,CACvB,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EACjD,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,CACf,CAAC;gBACF,MAAM,SAAS,CACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EACjD,qBAAqB,QAAQ,CAAC,OAAO,EAAE,CACxC,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrF,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/B,YAAY,CAAc,KAAK,CAAC,WAAW,EAAE,uBAAuB,CAAC;gBACrE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9B,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC;YACH,MAAM,eAAe,CACnB,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,EAC5C;gBACE,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC7C,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW;gBACX,sBAAsB;aACvB,EACD,KAAK,CACN,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACrC,MAAM,eAAe,CACnB,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,2BAA2B,CAAC,EACrD;gBACE,aAAa,EAAE,CAAC;gBAChB,oBAAoB,EAAE,OAAO,CAAC,IAAI;gBAClC,MAAM,EAAE,aAAa,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CACxF;aACF,EACD,KAAK,CACN,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAE9C,MAAM,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC3D,MAAM,oBAAoB,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACnE,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,YAAY,GAAG;gBACnB,aAAa,EAAE,CAAU;gBACzB,IAAI,EAAE,+BAAwC;gBAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;oBACjC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;oBACxC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;oBACtC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;iBAC3C;gBACD,cAAc,EAAE;oBACd,kBAAkB,EAAE,MAAM,UAAU,CAAC,gBAAgB,CAAC;oBACtD,oBAAoB,EAAE,OAAO,CAAC,IAAI;oBAClC,0BAA0B,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC/D,oBAAoB;oBACpB,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;iBAC3D;gBACD,YAAY,EAAE;oBACZ,OAAO,EAAE,SAAkB;oBAC3B,gBAAgB,EAAE,mBAA4B;oBAC9C,MAAM,EAAE,QAAiB;iBAC1B;gBACD,UAAU,EAAE;oBACV,qCAAqC;oBACrC,oCAAoC;oBACpC,2BAA2B;oBAC3B,qDAAqD;oBACrD,wCAAwC;iBACzC;gBACD,KAAK;aACN,CAAC;YACF,MAAM,QAAQ,GAAyB;gBACrC,GAAG,YAAY;gBACf,cAAc,EAAE,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;aACxD,CAAC;YACF,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACrC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkB;IAElB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,cAAc,CAAC,oDAAoD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAClD,MAAM,cAAc,CAAC,mEAAmE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAY,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC,mCAAmC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC7C,IAAI,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,UAAU,CAAC,yCAAyC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IACE,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QAC3C,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,UAAU,CAAC,2DAA2D,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,IACE,CAAC,QAAQ,EAAE,MAAM,EAAE;YACnB,QAAQ,CAAC,cAAc,EAAE;YACzB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK;YAC9B,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAC1C,CAAC;YACD,MAAM,UAAU,CAAC,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc;QACd,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAqB;IACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,GAAG,KAAK;QACR,IAAI,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;QAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,aAAa;YAC1C,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,KAAK,CAAC,aAAa,EAAE,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC7E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,eAAe,CAAC;SAClD,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,cAAsB,EACtB,aAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,IACE,CAAC,IAAI,EAAE,MAAM,EAAE;QACf,IAAI,CAAC,cAAc,EAAE;QACrB,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC;QAC5D,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,cAAc,EAC3C,CAAC;QACD,MAAM,UAAU,CAAC,+DAA+D,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,aAAsB;IACzE,KAAK,MAAM,IAAI,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE;gBAC1E,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAAC,0DAA0D,EAAE;gBAC7E,IAAI,EAAE,iCAAiC;gBACvC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;IACjE,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACjD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,cAAc,CAAC,2DAA2D,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,cAAc,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC9D,MAAM,cAAc,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,KAAK,CAAC,IAAI,KAAK,+BAA+B;QAC9C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1B,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/B,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QAC7B,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS;QACxC,KAAK,CAAC,YAAY,CAAC,gBAAgB,KAAK,mBAAmB;QAC3D,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAChC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAClC,CAAC;QACD,MAAM,UAAU,CAAC,kCAAkC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAkB,CAAC;IACvC,IACE,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;QAClC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,EACD,CAAC;QACD,MAAM,UAAU,CAAC,0CAA0C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,IACE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,IAAI,IAAI,CAAC,EACnE,CAAC;QACD,MAAM,UAAU,CAAC,iEAAiE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAwC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,MAAc;IACzD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,KAAe;IAClD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KAC/F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;AACL,CAAC"}

package/dist/research/workspace/preflight.d.ts

@@ -1,4 +1,5 @@
-import type { AgentPackageStage, AgentRoute, ProjectEvidenceRequirements, VerifiedProjectInputPlan, WorkspaceConfig } from "./types.js";
+import { type VerifiedScientificDesign } from "./scientific-design.js";
+import type { AgentPackageStage, AgentRoute, ProjectEvidenceRequirements, ResearchPolicyBinding, VerifiedProjectInputPlan, WorkspaceConfig } from "./types.js";
 export declare const RESEARCH_AGENT_PROTOCOL_OVERHEAD_TOKENS: Record<AgentRoute["agent"], number>;
 export declare const RESEARCH_ESTIMATED_BYTES_PER_TOKEN = 3;
 export declare const RESEARCH_MAX_REPAIR_SOURCE_BYTES = 32000;
@@ -14,12 +15,20 @@ export interface EvidenceCoverageGap {
     alternativeCanSatisfyMinimumCoverage: boolean;
     minimumAction: string;
 }
-export declare function evaluateProjectPreflight(root: string, question: string, requirements: ProjectEvidenceRequirements | null, inputPlan: VerifiedProjectInputPlan | null): Promise<{
+export declare function evaluateProjectPreflight(root: string, question: string, requirements: ProjectEvidenceRequirements | null, inputPlan: VerifiedProjectInputPlan | null, options?: {
+    publicationPolicy?: ResearchPolicyBinding | null;
+    scientificDesign?: VerifiedScientificDesign | null;
+}): Promise<{
     preflightSha256: string;
     schemaVersion: 1;
     mode: import("./types.js").ResearchMode;
     questionSha256: string;
     evidenceRequirements: ProjectEvidenceRequirements | null;
+    scientificDesign: {
+        sha256: string;
+        projectId: string;
+        evaluation: import("./scientific-design.js").ScientificDesignEvaluation | null;
+    } | null;
     capabilities: {
         id: string;
         allowedHosts: string[];
@@ -122,6 +131,29 @@ export declare function evaluateProjectPreflight(root: string, question: string,
             review: number;
             repair: number;
         };
+        lifecycleReservation: {
+            enabled: boolean;
+            reviewCounts: {
+                earlyScientific: number;
+                finalPublication: number;
+                revisions: number;
+            };
+            phaseTokens: {
+                baseResearch: number;
+                earlyScientificReviews: number;
+                finalPublicationReviews: number;
+                revision: number;
+            };
+            phaseWallSeconds: {
+                baseResearch: number;
+                earlyScientificReviews: number;
+                finalPublicationReviews: number;
+                revision: number;
+            };
+            totalTokens: number;
+            totalWallSeconds: number;
+            estimatedMaxCostUsd: number | null;
+        };
     };
     executionPolicy: {
         producer: {

package/dist/research/workspace/preflight.js

@@ -1,6 +1,7 @@
 import { loadCapabilityDeclarations, verifyCapabilities } from "./capabilities.js";
 import { hasPublicInternetCapability } from "./external-skills.js";
 import { deriveDiscoveryPlan } from "./discovery-planning.js";
+import { evaluateScientificDesign, scientificDesignPolicyGaps, } from "./scientific-design.js";
 import { schemaForStage } from "./schemas.js";
 import { canonicalJson, sha256Text } from "./storage.js";
 import { loadWorkspaceConfig, verifyDoctorAttestation } from "./workspace.js";
@@ -16,7 +17,7 @@ export const RESEARCH_CLAUDE_STRUCTURED_OUTPUT_MAX_TURNS = 3;
 export const RESEARCH_BROKER_MAX_TURNS = 6;
 export const RESEARCH_REPAIR_MAX_TURNS = 1;
 const RESEARCH_PREFLIGHT_PROMPT_ALLOWANCE_TOKENS = 3_000;
-export async function evaluateProjectPreflight(root, question, requirements, inputPlan) {
+export async function evaluateProjectPreflight(root, question, requirements, inputPlan, options = {}) {
     const config = await loadWorkspaceConfig(root);
     const capabilities = await loadCapabilityDeclarations(root);
     const capabilityVerification = await verifyCapabilities(root);
@@ -47,8 +48,57 @@ export async function evaluateProjectPreflight(root, question, requirements, inp
             reservedAgentPackageCost(config.producer, packageTokens.synthesize, config) +
             reservedAgentPackageCost(config.reviewer, packageTokens.review, config))
         : null;
+    const lifecycleEnabled = Boolean(options.publicationPolicy);
+    const earlyScientificReviewCount = lifecycleEnabled ? 3 : 0;
+    const finalPublicationReviewCount = lifecycleEnabled ? 4 : 0;
+    const revisionCount = lifecycleEnabled ? 1 : 0;
+    const lifecycleTokenReservation = tokenReservation +
+        earlyScientificReviewCount * config.budget.earlyScientificReviewMaxTokens +
+        finalPublicationReviewCount * config.budget.finalPublicationReviewMaxTokens +
+        revisionCount * config.budget.revisionReserveTokens;
+    const lifecycleWallReservation = wallReservation +
+        earlyScientificReviewCount * config.budget.earlyScientificReviewMaxWallSeconds +
+        finalPublicationReviewCount * config.budget.finalPublicationReviewMaxWallSeconds +
+        revisionCount * config.budget.revisionReserveWallSeconds;
+    const lifecycleEstimatedMaxCostUsd = !lifecycleEnabled || estimatedMaxCostUsd === null
+        ? estimatedMaxCostUsd
+        : roundMoney(estimatedMaxCostUsd +
+            earlyScientificReviewCount *
+                reservedAgentPackageCost(config.reviewer, config.budget.earlyScientificReviewMaxTokens, config) +
+            finalPublicationReviewCount *
+                reservedAgentPackageCost(config.reviewer, config.budget.finalPublicationReviewMaxTokens, config) +
+            revisionCount *
+                Math.max(reservedAgentPackageCost(config.producer, config.budget.revisionReserveTokens, config), reservedAgentPackageCost(config.reviewer, config.budget.revisionReserveTokens, config)));
     const gaps = [];
     const coverageGaps = [];
+    const designEvaluation = options.scientificDesign
+        ? evaluateScientificDesign(options.scientificDesign.contract)
+        : null;
+    if (options.publicationPolicy && !options.scientificDesign) {
+        gaps.push("scientific-design-missing");
+    }
+    if (options.scientificDesign && !options.publicationPolicy) {
+        gaps.push("scientific-design-policy-missing");
+    }
+    if (options.publicationPolicy &&
+        options.scientificDesign &&
+        options.publicationPolicy.projectId !== options.scientificDesign.contract.projectId) {
+        gaps.push("scientific-design-policy-project-mismatch");
+    }
+    if (options.publicationPolicy?.targetJournal &&
+        options.scientificDesign &&
+        options.publicationPolicy.targetJournal.trim().toLocaleLowerCase("en-US") !==
+            options.scientificDesign.contract.identity.targetJournals.primary
+                .trim()
+                .toLocaleLowerCase("en-US")) {
+        gaps.push("scientific-design-policy-journal-mismatch");
+    }
+    if (designEvaluation) {
+        gaps.push(...designEvaluation.issueCodes.map((code) => `scientific-design:${code}`));
+    }
+    if (options.publicationPolicy && options.scientificDesign) {
+        appendScientificDesignContractGaps(gaps, options.scientificDesign.contract, options.publicationPolicy, requirements);
+    }
     if (config.mode === "production-research" && !requirements) {
         gaps.push("explicit-evidence-requirements-missing");
     }
@@ -94,6 +144,17 @@ export async function evaluateProjectPreflight(root, question, requirements, inp
     if (estimatedMaxCostUsd !== null && estimatedMaxCostUsd > config.budget.maxCostUsd) {
         gaps.push(`package-cost-reservations-exceed-total:${estimatedMaxCostUsd}/${config.budget.maxCostUsd}`);
     }
+    if (lifecycleEnabled && lifecycleTokenReservation > config.budget.maxTokens) {
+        gaps.push(`full-lifecycle-token-reservation-exceeds-total:${lifecycleTokenReservation}/${config.budget.maxTokens}`);
+    }
+    if (lifecycleEnabled && lifecycleWallReservation > config.budget.maxWallSeconds) {
+        gaps.push(`full-lifecycle-wall-reservation-exceeds-total:${lifecycleWallReservation}/${config.budget.maxWallSeconds}`);
+    }
+    if (lifecycleEnabled &&
+        lifecycleEstimatedMaxCostUsd !== null &&
+        lifecycleEstimatedMaxCostUsd > config.budget.maxCostUsd) {
+        gaps.push(`full-lifecycle-cost-reservation-exceeds-total:${lifecycleEstimatedMaxCostUsd}/${config.budget.maxCostUsd}`);
+    }
     const discoverOutputTokens = discoveryPlan?.recommendedOutputTokens ?? config.budget.maxOutputTokens;
     const stageOutputReservations = {
         discover: discoverOutputTokens,
@@ -169,6 +230,13 @@ export async function evaluateProjectPreflight(root, question, requirements, inp
         mode: config.mode,
         questionSha256: sha256Text(question),
         evidenceRequirements: requirements,
+        scientificDesign: options.scientificDesign === null || options.scientificDesign === undefined
+            ? null
+            : {
+                sha256: options.scientificDesign.sha256,
+                projectId: options.scientificDesign.contract.projectId,
+                evaluation: designEvaluation,
+            },
         capabilities: networkCapabilities,
         inputPlan: inputPlan === null
             ? null
@@ -228,6 +296,29 @@ export async function evaluateProjectPreflight(root, question, requirements, inp
             },
             preCallTokenReservations,
             maxTurns,
+            lifecycleReservation: {
+                enabled: lifecycleEnabled,
+                reviewCounts: {
+                    earlyScientific: earlyScientificReviewCount,
+                    finalPublication: finalPublicationReviewCount,
+                    revisions: revisionCount,
+                },
+                phaseTokens: {
+                    baseResearch: tokenReservation,
+                    earlyScientificReviews: earlyScientificReviewCount * config.budget.earlyScientificReviewMaxTokens,
+                    finalPublicationReviews: finalPublicationReviewCount * config.budget.finalPublicationReviewMaxTokens,
+                    revision: revisionCount * config.budget.revisionReserveTokens,
+                },
+                phaseWallSeconds: {
+                    baseResearch: wallReservation,
+                    earlyScientificReviews: earlyScientificReviewCount * config.budget.earlyScientificReviewMaxWallSeconds,
+                    finalPublicationReviews: finalPublicationReviewCount * config.budget.finalPublicationReviewMaxWallSeconds,
+                    revision: revisionCount * config.budget.revisionReserveWallSeconds,
+                },
+                totalTokens: lifecycleTokenReservation,
+                totalWallSeconds: lifecycleWallReservation,
+                estimatedMaxCostUsd: lifecycleEstimatedMaxCostUsd,
+            },
         },
         executionPolicy: {
             producer: {
@@ -374,6 +465,59 @@ function appendEvidencePlanGaps(gaps, coverageGaps, requirements, inputPlan, net
         gaps.push(`evidence-plan-dated-sources-insufficient:${plannedDatedCount}/${requirements.minDatedSources}`);
     }
 }
+function appendScientificDesignContractGaps(gaps, design, policy, requirements) {
+    const prefix = "scientific-design-contract:";
+    gaps.push(...scientificDesignPolicyGaps(design, policy).map((gap) => `${prefix}${gap}`));
+    if (policy.targetJournal) {
+        if (design.identity.targetJournals.approvalStatus !== "policy-approved") {
+            gaps.push(`${prefix}policy-journal-unapproved`);
+        }
+    }
+    else if (design.identity.targetJournals.approvalStatus !== "candidate-only") {
+        gaps.push(`${prefix}policy-journal-approval-unbound`);
+    }
+    const requiredRoles = design.evidenceRoles.filter((role) => role.required);
+    if (requirements) {
+        const mappedDimensions = new Set(requiredRoles.flatMap((role) => role.coverageDimensionIds));
+        const mappedSourceTypes = new Set(requiredRoles.flatMap((role) => role.sourceTypeRequirements));
+        for (const dimension of requirements.dimensions) {
+            if (!mappedDimensions.has(dimension)) {
+                gaps.push(`${prefix}evidence-dimension-uncovered:${dimension}`);
+            }
+        }
+        for (const sourceType of requirements.sourceTypes) {
+            if (!mappedSourceTypes.has(sourceType)) {
+                gaps.push(`${prefix}evidence-source-type-uncovered:${sourceType}`);
+            }
+        }
+        const independentFloor = requiredRoles.reduce((sum, role) => sum + role.minimumIndependentSources, 0);
+        const fullTextFloor = requiredRoles.reduce((sum, role) => sum + role.minimumFullText, 0);
+        const datedFloor = requiredRoles.reduce((sum, role) => sum + role.minimumDatedSources, 0);
+        if (independentFloor < requirements.minSources) {
+            gaps.push(`${prefix}evidence-source-floor-insufficient:${independentFloor}/${requirements.minSources}`);
+        }
+        if (fullTextFloor < requirements.minFullTextSources) {
+            gaps.push(`${prefix}evidence-fulltext-floor-insufficient:${fullTextFloor}/${requirements.minFullTextSources}`);
+        }
+        if (datedFloor < requirements.minDatedSources) {
+            gaps.push(`${prefix}evidence-dated-floor-insufficient:${datedFloor}/${requirements.minDatedSources}`);
+        }
+    }
+    if (policy.resolvedRules.includes("independent-validation-required")) {
+        const centralClaimIds = new Set(design.claims.filter((claim) => claim.role === "central").map((claim) => claim.id));
+        const centralPlans = design.validationPlans.filter((plan) => plan.claimIds.some((claimId) => centralClaimIds.has(claimId)));
+        for (const plan of centralPlans) {
+            if (!["available", "unavailable-scope-bounded"].includes(plan.independentValidation.status)) {
+                gaps.push(`${prefix}independent-validation-undispositioned:${plan.id}`);
+            }
+        }
+        for (const claimId of centralClaimIds) {
+            if (!centralPlans.some((plan) => plan.claimIds.includes(claimId))) {
+                gaps.push(`${prefix}independent-validation-unplanned:${claimId}`);
+            }
+        }
+    }
+}
 function capabilityMinimumAction(capabilityId) {
     if (capabilityId === "database.tiangong.report-search") {
         return "Rerun the setup Wizard, select tiangong.kb-report-search, review its license and exact endpoint, securely configure tiangong.report.api-key, apply the replacement immutable plan, and pass capability live doctor.";