@tiangong-ai/cli 0.0.35 → 0.0.37

package/dist/research/workspace/audit-bundle.js

@@ -0,0 +1,357 @@
+import { randomUUID } from "node:crypto";
+import { constants as fsConstants } from "node:fs";
+import { chmod, copyFile, lstat, mkdir, readFile, rename, rm } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { CliError } from "../../errors.js";
+import { loadEvidenceArtifactRecords } from "./artifacts.js";
+import { verifyCapabilities } from "./capabilities.js";
+import { loadProjectEvidenceReceipts } from "./evidence.js";
+import { readJournal, verifyJournal } from "./journal.js";
+import { loadProject } from "./projects.js";
+import { sanitizeResearchText } from "./sanitization.js";
+import { canonicalJson, ensureDirectory, isObject, pathExists, readJsonFile, regularTreeFiles, resolveContained, safeRelativePath, sha256File, sha256Text, workspacePaths, writeJsonAtomic, } from "./storage.js";
+import { loadWorkspaceConfig, withWorkspaceLock } from "./workspace.js";
+const SHA256 = /^[a-f0-9]{64}$/;
+const MAX_TEXT_SCAN_BYTES = 16 * 1024 * 1024;
+export async function exportProjectAuditBundle(input) {
+    return withWorkspaceLock(input.root, "research.audit.export", async () => {
+        const destination = await validateNewDestination(input.destination);
+        const paths = workspacePaths(input.root);
+        const project = await loadProject(input.root, input.projectId);
+        const journal = await verifyJournal(paths.journal);
+        const temporary = join(dirname(destination), `.${basename(destination)}.${process.pid}.${randomUUID()}.tmp`);
+        await mkdir(temporary, { mode: 0o700 });
+        try {
+            const staged = new Set();
+            const stageFile = async (source, logicalPath) => {
+                const logical = safeRelativePath(logicalPath, "Audit bundle file");
+                if (staged.has(logical))
+                    return;
+                const info = await lstat(source).catch(() => undefined);
+                if (!info?.isFile() || info.isSymbolicLink()) {
+                    throw auditError(`Audit source is not an exact regular file: ${logical}`);
+                }
+                const target = resolveContained(temporary, logical);
+                await ensureDirectory(dirname(target));
+                await copyFile(source, target, fsConstants.COPYFILE_EXCL);
+                await chmod(target, 0o444).catch(() => undefined);
+                staged.add(logical);
+            };
+            const projectRoot = join(paths.projects, project.id);
+            const projectFiles = await regularTreeFiles(projectRoot).catch((error) => {
+                throw auditError("Project tree contains a non-portable entry.", error);
+            });
+            for (const source of projectFiles) {
+                const logical = relative(projectRoot, source).split(sep).join("/");
+                if (logical === "project.json" ||
+                    logical.startsWith("runs/") ||
+                    logical.startsWith("native/")) {
+                    continue;
+                }
+                await stageFile(source, `project/${logical}`);
+            }
+            const portableProject = portableProjectState(project);
+            await writeJsonAtomic(join(temporary, "state", "project.json"), portableProject, 0o444);
+            staged.add("state/project.json");
+            for (const inputRecord of project.inputs) {
+                await assertSourceBinding(inputRecord.path, inputRecord.sha256, inputRecord.bytes);
+                await stageFile(inputRecord.path, `inputs/${inputRecord.sha256}`);
+                if (inputRecord.contextPath && inputRecord.contextSha256 && inputRecord.contextBytes) {
+                    await assertSourceBinding(inputRecord.contextPath, inputRecord.contextSha256, inputRecord.contextBytes);
+                    await stageFile(inputRecord.contextPath, `inputs/${inputRecord.contextSha256}`);
+                }
+            }
+            for (const document of project.publicationPolicy?.documents ?? []) {
+                const source = resolveContained(paths.control, document.objectLocator);
+                await assertSourceBinding(source, document.sha256);
+                await stageFile(source, `workspace-objects/${document.objectLocator}`);
+            }
+            const receipts = await loadProjectEvidenceReceipts(input.root, project.id);
+            for (const receipt of receipts) {
+                await stageFile(resolveContained(paths.control, receipt.locator), `workspace-objects/${receipt.locator}`);
+                await stageFile(resolveContained(paths.control, receipt.contextLocator), `workspace-objects/${receipt.contextLocator}`);
+            }
+            const artifacts = await loadEvidenceArtifactRecords(input.root, project.id);
+            for (const artifact of artifacts) {
+                await assertSourceBinding(resolveContained(paths.control, artifact.locator), artifact.sha256, artifact.bytes);
+                await stageFile(resolveContained(paths.control, artifact.locator), `workspace-objects/${artifact.locator}`);
+            }
+            const [config, runtimeLock, capabilityVerification, journalEvents] = await Promise.all([
+                loadWorkspaceConfig(input.root),
+                readJsonFile(paths.runtimeLock, "Research runtime lock"),
+                verifyCapabilities(input.root),
+                readJournal(paths.journal),
+            ]);
+            await writeJsonAtomic(join(temporary, "state", "environment.json"), {
+                schemaVersion: 1,
+                mode: config.mode,
+                producer: portableAgentRoute(config.producer),
+                reviewer: portableAgentRoute(config.reviewer),
+                budget: config.budget,
+                runtimeLock,
+                capabilityVerification,
+            }, 0o444);
+            staged.add("state/environment.json");
+            await writeJsonAtomic(join(temporary, "state", "journal-event-proofs.json"), {
+                schemaVersion: 1,
+                workspaceJournalHead: journal.head,
+                events: journalEvents.filter((event) => event.scope === project.id || containsExactString(event.payload, project.id)),
+            }, 0o444);
+            staged.add("state/journal-event-proofs.json");
+            await assertPortableTextFiles(temporary, resolve(input.root));
+            const files = await bundleFileRecords(temporary);
+            const projectStatePath = join(projectRoot, "project.json");
+            const capabilityLockSha256 = (await pathExists(paths.capabilityLock))
+                ? await sha256File(paths.capabilityLock)
+                : null;
+            const manifestCore = {
+                schemaVersion: 1,
+                kind: "tiangong-project-audit-bundle",
+                projectId: project.id,
+                createdAt: new Date().toISOString(),
+                authority: {
+                    status: project.status,
+                    lineageKind: project.lineage.kind,
+                    derivedFrom: project.lineage.derivedFrom,
+                    supersedes: project.lineage.supersedes,
+                    supersededBy: project.lineage.supersededBy,
+                },
+                sourceBindings: {
+                    projectStateSha256: await sha256File(projectStatePath),
+                    workspaceJournalHead: journal.head,
+                    workspaceRuntimeLockSha256: await sha256File(paths.runtimeLock),
+                    capabilityLockSha256,
+                    sourceWorkspacePathSha256: sha256Text(resolve(input.root)),
+                },
+                locatorRoots: {
+                    project: "project",
+                    workspaceObjects: "workspace-objects",
+                    inputs: "inputs",
+                },
+                exclusions: [
+                    "credentials and environment secrets",
+                    "setup sources and browser profiles",
+                    "active native-stage state",
+                    "ephemeral run capsules and raw agent authentication",
+                    "unrelated workspace projects and files",
+                ],
+                files,
+            };
+            const manifest = {
+                ...manifestCore,
+                manifestSha256: sha256Text(canonicalJson(manifestCore)),
+            };
+            await writeJsonAtomic(join(temporary, "manifest.json"), manifest, 0o444);
+            await verifyProjectAuditBundle(temporary);
+            await rename(temporary, destination);
+            return manifest;
+        }
+        catch (error) {
+            await rm(temporary, { recursive: true, force: true }).catch(() => undefined);
+            throw error;
+        }
+    });
+}
+export async function verifyProjectAuditBundle(bundlePath) {
+    if (!isAbsolute(bundlePath) || resolve(bundlePath) !== bundlePath) {
+        throw auditPathError("Audit bundle path must be absolute and normalized.");
+    }
+    const info = await lstat(bundlePath).catch(() => undefined);
+    if (!info?.isDirectory() || info.isSymbolicLink()) {
+        throw auditPathError("Audit bundle must be a regular directory and not a symbolic link.");
+    }
+    const manifestPath = join(bundlePath, "manifest.json");
+    const manifestInfo = await lstat(manifestPath).catch(() => undefined);
+    if (!manifestInfo?.isFile() || manifestInfo.isSymbolicLink()) {
+        throw auditError("Audit manifest is missing or is not a regular file.");
+    }
+    let value;
+    try {
+        value = JSON.parse(await readFile(manifestPath, "utf8"));
+    }
+    catch {
+        throw auditError("Audit manifest is not valid JSON.");
+    }
+    const manifest = parseManifest(value);
+    const { manifestSha256, ...core } = manifest;
+    if (sha256Text(canonicalJson(core)) !== manifestSha256) {
+        throw auditError("Audit manifest failed its hash binding.");
+    }
+    const actualFiles = (await regularTreeFiles(bundlePath))
+        .map((path) => relative(bundlePath, path).split(sep).join("/"))
+        .filter((path) => path !== "manifest.json");
+    const expectedPaths = manifest.files.map((file) => file.path);
+    if (actualFiles.length !== expectedPaths.length ||
+        actualFiles.some((path, index) => path !== expectedPaths[index])) {
+        throw auditError("Audit bundle contains missing, extra, or unordered files.");
+    }
+    for (const record of manifest.files) {
+        const path = resolveContained(bundlePath, record.path);
+        const fileInfo = await lstat(path).catch(() => undefined);
+        if (!fileInfo?.isFile() ||
+            fileInfo.isSymbolicLink() ||
+            fileInfo.size !== record.bytes ||
+            (await sha256File(path)) !== record.sha256) {
+            throw auditError(`Audit file failed its exact binding: ${record.path}`);
+        }
+    }
+    await assertPortableTextFiles(bundlePath);
+    return {
+        status: "verified",
+        projectId: manifest.projectId,
+        manifestSha256,
+        files: manifest.files.length,
+    };
+}
+function portableProjectState(project) {
+    const portable = structuredClone(project);
+    portable.inputs = portable.inputs.map((input) => ({
+        ...input,
+        path: `inputs/${input.sha256}`,
+        ...(input.contextPath && input.contextSha256
+            ? { contextPath: `inputs/${input.contextSha256}` }
+            : {}),
+    }));
+    return portable;
+}
+function portableAgentRoute(route) {
+    return {
+        agent: route.agent,
+        executionMode: route.executionMode,
+        binaryName: basename(route.binary),
+        model: route.model,
+        effort: route.effort ?? null,
+        verbosity: route.verbosity ?? null,
+    };
+}
+async function bundleFileRecords(root) {
+    const files = await regularTreeFiles(root);
+    return Promise.all(files
+        .map((path) => ({ path, logical: relative(root, path).split(sep).join("/") }))
+        .filter((item) => item.logical !== "manifest.json")
+        .map(async ({ path, logical }) => {
+        const info = await lstat(path);
+        return { path: logical, sha256: await sha256File(path), bytes: info.size };
+    }));
+}
+async function assertSourceBinding(path, expectedSha256, expectedBytes) {
+    const info = await lstat(path).catch(() => undefined);
+    if (!info?.isFile() ||
+        info.isSymbolicLink() ||
+        (expectedBytes !== undefined && info.size !== expectedBytes) ||
+        (await sha256File(path)) !== expectedSha256) {
+        throw auditError("An audit source no longer matches its recorded hash and size.");
+    }
+}
+async function assertPortableTextFiles(root, forbiddenRoot) {
+    for (const path of await regularTreeFiles(root)) {
+        const info = await lstat(path);
+        if (info.size > MAX_TEXT_SCAN_BYTES)
+            continue;
+        const bytes = await readFile(path);
+        if (!looksTextual(path, bytes))
+            continue;
+        const text = bytes.toString("utf8");
+        if (forbiddenRoot && text.includes(forbiddenRoot)) {
+            throw new CliError("Audit bundle contains a host-specific workspace path.", {
+                code: "RESEARCH_AUDIT_BUNDLE_NONPORTABLE",
+                exitCode: 3,
+            });
+        }
+        if (sanitizeResearchText(text) !== text) {
+            throw new CliError("Audit bundle contains credential-like or sensitive text.", {
+                code: "RESEARCH_AUDIT_BUNDLE_SENSITIVE",
+                exitCode: 3,
+            });
+        }
+    }
+}
+function looksTextual(path, bytes) {
+    if (bytes.includes(0))
+        return false;
+    if (/\.(?:csv|json|jsonl|md|txt|tsv|ya?ml)$/iu.test(path))
+        return true;
+    const start = bytes.subarray(0, 64).toString("utf8").trimStart();
+    return start.startsWith("{") || start.startsWith("[");
+}
+async function validateNewDestination(value) {
+    if (!isAbsolute(value) || resolve(value) !== value) {
+        throw auditPathError("Audit export destination must be absolute and normalized.");
+    }
+    if (await pathExists(value)) {
+        throw auditPathError("Audit export destination must not already exist.");
+    }
+    const parent = dirname(value);
+    const parentInfo = await lstat(parent).catch(() => undefined);
+    if (!parentInfo?.isDirectory() || parentInfo.isSymbolicLink()) {
+        throw auditPathError("Audit export parent must be an existing regular directory.");
+    }
+    return value;
+}
+function parseManifest(value) {
+    if (!isObject(value) ||
+        value.schemaVersion !== 1 ||
+        value.kind !== "tiangong-project-audit-bundle" ||
+        typeof value.projectId !== "string" ||
+        typeof value.createdAt !== "string" ||
+        !isObject(value.authority) ||
+        !isObject(value.sourceBindings) ||
+        !isObject(value.locatorRoots) ||
+        value.locatorRoots.project !== "project" ||
+        value.locatorRoots.workspaceObjects !== "workspace-objects" ||
+        value.locatorRoots.inputs !== "inputs" ||
+        !Array.isArray(value.exclusions) ||
+        value.exclusions.some((item) => typeof item !== "string") ||
+        !Array.isArray(value.files) ||
+        typeof value.manifestSha256 !== "string" ||
+        !SHA256.test(value.manifestSha256)) {
+        throw auditError("Audit manifest shape is invalid.");
+    }
+    const files = value.files;
+    if (files.some((file) => !isObject(file) ||
+        typeof file.path !== "string" ||
+        safePathOrNull(file.path) === null ||
+        typeof file.sha256 !== "string" ||
+        !SHA256.test(file.sha256) ||
+        !Number.isSafeInteger(file.bytes) ||
+        Number(file.bytes) < 0)) {
+        throw auditError("Audit manifest file records are invalid.");
+    }
+    const paths = files.map((file) => String(file.path));
+    if (new Set(paths).size !== paths.length ||
+        paths.some((path, index) => index > 0 && paths[index - 1] >= path)) {
+        throw auditError("Audit manifest file paths must be unique and byte-order sorted.");
+    }
+    return value;
+}
+function safePathOrNull(value) {
+    try {
+        return safeRelativePath(value, "Audit manifest path");
+    }
+    catch {
+        return null;
+    }
+}
+function containsExactString(value, target) {
+    if (value === target)
+        return true;
+    if (Array.isArray(value))
+        return value.some((item) => containsExactString(item, target));
+    if (!isObject(value))
+        return false;
+    return Object.values(value).some((item) => containsExactString(item, target));
+}
+function auditError(message, cause) {
+    return new CliError(message, {
+        code: "RESEARCH_AUDIT_BUNDLE_INVALID",
+        exitCode: 3,
+        details: cause ? { cause: cause instanceof Error ? cause.message : String(cause) } : undefined,
+    });
+}
+function auditPathError(message) {
+    return new CliError(message, {
+        code: "RESEARCH_AUDIT_BUNDLE_PATH_INVALID",
+        exitCode: 2,
+    });
+}
+//# sourceMappingURL=audit-bundle.js.map

package/dist/research/workspace/audit-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-bundle.js","sourceRoot":"","sources":["../../../src/research/workspace/audit-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExF,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EACL,aAAa,EACb,eAAe,EACf,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AA+B7C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAI9C;IACC,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,IAAI,CACpB,OAAO,CAAC,WAAW,CAAC,EACpB,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAC/D,CAAC;QACF,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;YACjC,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,WAAmB,EAAiB,EAAE;gBAC7E,MAAM,OAAO,GAAG,gBAAgB,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;oBAAE,OAAO;gBAChC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC7C,MAAM,UAAU,CAAC,8CAA8C,OAAO,EAAE,CAAC,CAAC;gBAC5E,CAAC;gBACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpD,MAAM,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;gBAC1D,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC,CAAC;YAEF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvE,MAAM,UAAU,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACzE,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnE,IACE,OAAO,KAAK,cAAc;oBAC1B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;oBAC3B,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,EAC7B,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACtD,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;YACxF,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAEjC,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,mBAAmB,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;gBACnF,MAAM,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,IAAI,WAAW,CAAC,WAAW,IAAI,WAAW,CAAC,aAAa,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBACrF,MAAM,mBAAmB,CACvB,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,aAAa,EACzB,WAAW,CAAC,YAAY,CACzB,CAAC;oBACF,MAAM,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,UAAU,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC;gBAClF,CAAC;YACH,CAAC;YAED,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,iBAAiB,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;gBAClE,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACvE,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnD,MAAM,SAAS,CAAC,MAAM,EAAE,qBAAqB,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,SAAS,CACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAChD,qBAAqB,OAAO,CAAC,OAAO,EAAE,CACvC,CAAC;gBACF,MAAM,SAAS,CACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,EACvD,qBAAqB,OAAO,CAAC,cAAc,EAAE,CAC9C,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,mBAAmB,CACvB,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EACjD,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,KAAK,CACf,CAAC;gBACF,MAAM,SAAS,CACb,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EACjD,qBAAqB,QAAQ,CAAC,OAAO,EAAE,CACxC,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrF,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC/B,YAAY,CAAc,KAAK,CAAC,WAAW,EAAE,uBAAuB,CAAC;gBACrE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC9B,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC;YACH,MAAM,eAAe,CACnB,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC,EAC5C;gBACE,aAAa,EAAE,CAAC;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC7C,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW;gBACX,sBAAsB;aACvB,EACD,KAAK,CACN,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YACrC,MAAM,eAAe,CACnB,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,2BAA2B,CAAC,EACrD;gBACE,aAAa,EAAE,CAAC;gBAChB,oBAAoB,EAAE,OAAO,CAAC,IAAI;gBAClC,MAAM,EAAE,aAAa,CAAC,MAAM,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,IAAI,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CACxF;aACF,EACD,KAAK,CACN,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAE9C,MAAM,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAC3D,MAAM,oBAAoB,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBACnE,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC;gBACxC,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,YAAY,GAAG;gBACnB,aAAa,EAAE,CAAU;gBACzB,IAAI,EAAE,+BAAwC;gBAC9C,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE;oBACT,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;oBACjC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW;oBACxC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;oBACtC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY;iBAC3C;gBACD,cAAc,EAAE;oBACd,kBAAkB,EAAE,MAAM,UAAU,CAAC,gBAAgB,CAAC;oBACtD,oBAAoB,EAAE,OAAO,CAAC,IAAI;oBAClC,0BAA0B,EAAE,MAAM,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;oBAC/D,oBAAoB;oBACpB,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;iBAC3D;gBACD,YAAY,EAAE;oBACZ,OAAO,EAAE,SAAkB;oBAC3B,gBAAgB,EAAE,mBAA4B;oBAC9C,MAAM,EAAE,QAAiB;iBAC1B;gBACD,UAAU,EAAE;oBACV,qCAAqC;oBACrC,oCAAoC;oBACpC,2BAA2B;oBAC3B,qDAAqD;oBACrD,wCAAwC;iBACzC;gBACD,KAAK;aACN,CAAC;YACF,MAAM,QAAQ,GAAyB;gBACrC,GAAG,YAAY;gBACf,cAAc,EAAE,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;aACxD,CAAC;YACF,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACrC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7E,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAkB;IAElB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;QAClE,MAAM,cAAc,CAAC,oDAAoD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAClD,MAAM,cAAc,CAAC,mEAAmE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7D,MAAM,UAAU,CAAC,qDAAqD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAY,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,CAAC,mCAAmC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC7C,IAAI,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACvD,MAAM,UAAU,CAAC,yCAAyC,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IACE,WAAW,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;QAC3C,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC,KAAK,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,UAAU,CAAC,2DAA2D,CAAC,CAAC;IAChF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1D,IACE,CAAC,QAAQ,EAAE,MAAM,EAAE;YACnB,QAAQ,CAAC,cAAc,EAAE;YACzB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK;YAC9B,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAC1C,CAAC;YACD,MAAM,UAAU,CAAC,wCAAwC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc;QACd,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAqB;IACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChD,GAAG,KAAK;QACR,IAAI,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;QAC9B,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,aAAa;YAC1C,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,KAAK,CAAC,aAAa,EAAE,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK;SACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC7E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,eAAe,CAAC;SAClD,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC,CAAC,CACL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,IAAY,EACZ,cAAsB,EACtB,aAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtD,IACE,CAAC,IAAI,EAAE,MAAM,EAAE;QACf,IAAI,CAAC,cAAc,EAAE;QACrB,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,CAAC;QAC5D,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,cAAc,EAC3C,CAAC;QACD,MAAM,UAAU,CAAC,+DAA+D,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,aAAsB;IACzE,KAAK,MAAM,IAAI,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,SAAS;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE;gBAC1E,IAAI,EAAE,mCAAmC;gBACzC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,QAAQ,CAAC,0DAA0D,EAAE;gBAC7E,IAAI,EAAE,iCAAiC;gBACvC,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;IACjE,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,KAAa;IACjD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACnD,MAAM,cAAc,CAAC,2DAA2D,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,cAAc,CAAC,kDAAkD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;QAC9D,MAAM,cAAc,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,KAAK,CAAC,aAAa,KAAK,CAAC;QACzB,KAAK,CAAC,IAAI,KAAK,+BAA+B;QAC9C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;QAC1B,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/B,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;QAC7B,KAAK,CAAC,YAAY,CAAC,OAAO,KAAK,SAAS;QACxC,KAAK,CAAC,YAAY,CAAC,gBAAgB,KAAK,mBAAmB;QAC3D,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,QAAQ;QACtC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAChC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QACzD,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC3B,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAClC,CAAC;QACD,MAAM,UAAU,CAAC,kCAAkC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAkB,CAAC;IACvC,IACE,KAAK,CAAC,IAAI,CACR,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,QAAQ,CAAC,IAAI,CAAC;QACf,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI;QAClC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC/B,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CACzB,EACD,CAAC;QACD,MAAM,UAAU,CAAC,0CAA0C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,IACE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACpC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,IAAI,IAAI,CAAC,EACnE,CAAC;QACD,MAAM,UAAU,CAAC,iEAAiE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAwC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,MAAc;IACzD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,KAAe;IAClD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;KAC/F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,oCAAoC;QAC1C,QAAQ,EAAE,CAAC;KACZ,CAAC,CAAC;AACL,CAAC"}

package/dist/research/workspace/broker.js

@@ -3,6 +3,7 @@ import { createServer } from "node:http";
 import { readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { CliError } from "../../errors.js";
+import { resolveAgentAcquisitionRoute } from "./acquisition-routes.js";
 import { loadCapabilityDeclarations, verifyCapabilities } from "./capabilities.js";
 import { loadCapabilityCredentialMap } from "./credentials.js";
 import { loadBrokerEvidenceCache, loadProjectEvidenceReceipts, persistBrokerEvidence, storeBrokerEvidenceCache, } from "./evidence.js";
@@ -109,6 +110,7 @@ export async function startCapabilityBroker(root, projectId, capsuleProject) {
             workspaceContextTokens: config.budget.maxBrokerContextTokens,
             workspaceMaxItems: config.budget.maxBrokerItems,
             callBudget,
+            requireAcquisitionRoute: Boolean(project?.scientificDesign),
         });
     });
     await new Promise((resolvePromise, reject) => {
@@ -164,8 +166,16 @@ async function handleMcpRequest(input) {
                         inputSchema: {
                             type: "object",
                             additionalProperties: false,
-                            required: ["capability_id", "url"],
+                            required: [
+                                ...(input.requireAcquisitionRoute ? ["acquisition_route_id"] : []),
+                                "capability_id",
+                                "url",
+                            ],
                             properties: {
+                                acquisition_route_id: {
+                                    type: "string",
+                                    description: "Exact broker-capability route ID from the frozen scientific design. Required for scientific projects.",
+                                },
                                 capability_id: { type: "string" },
                                 credential_id: {
                                     type: "string",
@@ -262,6 +272,7 @@ async function handleMcpRequest(input) {
 }
 async function fetchCandidateSource(input) {
     const capabilityId = input.arguments.capability_id;
+    const requestedAcquisitionRouteId = input.arguments.acquisition_route_id;
     const credentialId = input.arguments.credential_id;
     const rawUrl = input.arguments.url;
     const requestBody = input.arguments.request_body;
@@ -275,6 +286,10 @@ async function fetchCandidateSource(input) {
     if (credentialId !== undefined && typeof credentialId !== "string") {
         throw new Error("credential_id must be a string when provided");
     }
+    if (requestedAcquisitionRouteId !== undefined &&
+        typeof requestedAcquisitionRouteId !== "string") {
+        throw new Error("acquisition_route_id must be a string when provided");
+    }
     if (jsonPointer !== undefined &&
         (typeof jsonPointer !== "string" || !validJsonPointer(jsonPointer))) {
         throw new Error("json_pointer must be an RFC 6901 JSON Pointer when provided");
@@ -302,6 +317,26 @@ async function fetchCandidateSource(input) {
     if (!capability.http) {
         throw brokerDiagnosticError("CAPABILITY_NOT_DECLARED", "The requested capability has no locked broker HTTP policy.", false, "Replace the capability declaration with a reviewed brokered-network capability and rebuild the lock.", { capabilityId });
     }
+    const projectPath = join(workspacePaths(input.root).projects, input.projectId, "project.json");
+    const project = (await pathExists(projectPath))
+        ? await loadProject(input.root, input.projectId)
+        : null;
+    if (!project && requestedAcquisitionRouteId !== undefined) {
+        throw new CliError("A broker acquisition route requires an initialized research project.", {
+            code: "RESEARCH_EVIDENCE_ACQUISITION_ROUTE_INVALID",
+            exitCode: 3,
+        });
+    }
+    const acquisitionRoute = project
+        ? await resolveAgentAcquisitionRoute({
+            root: input.root,
+            project,
+            routeId: requestedAcquisitionRouteId,
+            routeClasses: ["broker-capability"],
+            capabilityId,
+        })
+        : null;
+    const acquisitionRouteId = acquisitionRoute?.id ?? null;
     let target;
     let encodedRequestBody;
     try {
@@ -349,6 +384,7 @@ async function fetchCandidateSource(input) {
     await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.requested", input.projectId, {
         attemptId,
         projectId: input.projectId,
+        acquisitionRouteId,
         capabilityId,
         credentialId: effectiveCredentialId,
         targetSha256: sha256Text(target.toString()),
@@ -393,6 +429,7 @@ async function fetchCandidateSource(input) {
             attemptId,
             reusedAttemptId: projectReuse.attemptId,
             projectId: input.projectId,
+            acquisitionRouteId,
             capabilityId,
             credentialId: effectiveCredentialId,
             cacheKeySha256,
@@ -400,12 +437,13 @@ async function fetchCandidateSource(input) {
             contextItems: context.items,
             candidateCount: candidates.length,
         });
-        await appendCompletedReceipt(input.root, input.projectId, receipt, cacheKeySha256, candidates.length, false, "project");
-        return brokerToolResult(receipt, context.bytes, projectReuse.contentType, candidates, "project");
+        await appendCompletedReceipt(input.root, input.projectId, receipt, cacheKeySha256, candidates.length, false, "project", acquisitionRouteId);
+        return brokerToolResult(receipt, context.bytes, projectReuse.contentType, candidates, "project", acquisitionRouteId);
     }
     await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.attempted", input.projectId, {
         attemptId,
         projectId: input.projectId,
+        acquisitionRouteId,
         capabilityId,
         credentialId: effectiveCredentialId,
         targetSha256: sha256Text(target.toString()),
@@ -448,8 +486,8 @@ async function fetchCandidateSource(input) {
                     selectedJsonPointer: context.selectedJsonPointer,
                     itemOffset: context.offset,
                 });
-                await appendCompletedReceipt(input.root, input.projectId, receipt, cacheKeySha256, candidates.length, false, "workspace");
-                return brokerToolResult(receipt, context.bytes, cached.contentType, candidates, "workspace");
+                await appendCompletedReceipt(input.root, input.projectId, receipt, cacheKeySha256, candidates.length, false, "workspace", acquisitionRouteId);
+                return brokerToolResult(receipt, context.bytes, cached.contentType, candidates, "workspace", acquisitionRouteId);
             }
         }
         const headers = new Headers(capability.http.staticHeaders);
@@ -482,6 +520,8 @@ async function fetchCandidateSource(input) {
             rateLimitRetries += 1;
             await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.retry.scheduled", input.projectId, {
                 attemptId,
+                projectId: input.projectId,
+                acquisitionRouteId,
                 capabilityId,
                 credentialId: effectiveCredentialId,
                 status: response.status,
@@ -571,8 +611,8 @@ async function fetchCandidateSource(input) {
             selectedJsonPointer: context.selectedJsonPointer,
             itemOffset: context.offset,
         });
-        await appendCompletedReceipt(input.root, input.projectId, receipt, cacheKeySha256, candidates.length, true, null);
-        return brokerToolResult(receipt, context.bytes, contentType, candidates, null);
+        await appendCompletedReceipt(input.root, input.projectId, receipt, cacheKeySha256, candidates.length, true, null, acquisitionRouteId);
+        return brokerToolResult(receipt, context.bytes, contentType, candidates, null, acquisitionRouteId);
     }
     catch (error) {
         const reportedError = structuredBrokerFailure(error, capabilityId, effectiveCredentialId);
@@ -581,6 +621,8 @@ async function fetchCandidateSource(input) {
             : {};
         await appendJournalEvent(workspacePaths(input.root).journal, "capability.fetch.failed", input.projectId, {
             attemptId,
+            projectId: input.projectId,
+            acquisitionRouteId,
             capabilityId,
             credentialId: effectiveCredentialId,
             error: bounded(sanitizeResearchText(reportedError.message, [...input.credentialMap.values()]), 500),
@@ -614,7 +656,7 @@ function structuredBrokerFailure(error, capabilityId, credentialId) {
         },
     });
 }
-function brokerToolResult(receipt, context, contentType, candidates, reuseScope) {
+function brokerToolResult(receipt, context, contentType, candidates, reuseScope, acquisitionRouteId) {
     const inline = contentType.includes("json") || contentType.startsWith("text/");
     return {
         ...Object.fromEntries(Object.entries(receipt)),
@@ -623,6 +665,7 @@ function brokerToolResult(receipt, context, contentType, candidates, reuseScope)
             text: inline ? context.toString("utf8") : null,
         },
         candidates,
+        acquisitionRouteId,
         networkAttempted: reuseScope === null,
         reuseScope,
     };
@@ -731,10 +774,11 @@ async function stageContextObject(capsuleProject, locator, bytes) {
         }
     }
 }
-async function appendCompletedReceipt(root, projectId, receipt, cacheKeySha256, candidateCount, networkAttempted, reuseScope) {
+async function appendCompletedReceipt(root, projectId, receipt, cacheKeySha256, candidateCount, networkAttempted, reuseScope, acquisitionRouteId) {
     await appendJournalEvent(workspacePaths(root).journal, "capability.fetch.completed", projectId, {
         attemptId: receipt.attemptId,
         projectId: receipt.projectId,
+        acquisitionRouteId,
         capabilityId: receipt.capabilityId,
         credentialId: receipt.credentialId,
         status: receipt.status,
@@ -1099,7 +1143,7 @@ function brokerDiagnosticError(code, message, networkAttempted, minimumAction, e
 }
 function brokerFailureKind(error) {
     if (error instanceof CliError && error.code === "PROVIDER_AUTHENTICATION_FAILED") {
-        return "deterministic";
+        return "authentication";
     }
     if (error instanceof CliError && error.code === "RESEARCH_BROKER_HTTP_ERROR") {
         const status = isObject(error.details) ? error.details.status : undefined;