@tokenfactory/acc-runner 0.43.0 → 0.44.1

package/dist/provider-auth.js

@@ -29,9 +29,53 @@
 import os from "node:os";
 import path from "node:path";
 import { RUNNER_KEYCHAIN_SERVICE } from "./types.js";
-/** Trimmed ANTHROPIC_API_KEY from `env`, or "" when unset/blank. */
+/**
+ * NS RUN-3: the vault-sourced key cached by hydrateAnthropicApiKey (below),
+ * when ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store resolved one at startup.
+ * Deliberately NOT process.env — the ambient-key guard
+ * (scripts/ci/no-ambient-anthropic-key.mjs) is STRICT for this tree: zero
+ * literal `process.env.ANTHROPIC_API_KEY` reads OR writes, no allowlist. A
+ * module-level cache, consulted only through the parameterised
+ * anthropicApiKey() below, keeps every consumer (resolveAuthMode,
+ * withAnthropicAuth, authPrecedenceHint) on the same sanctioned resolution
+ * path without ever touching the ambient global.
+ */
+let vaultAnthropicApiKey = null;
+/** Test-only: clear the vault-sourced key cache between tests. */
+export function __resetVaultAnthropicApiKeyForTests() {
+    vaultAnthropicApiKey = null;
+}
+/**
+ * RUNNER-SERVING-AUTH: seed the SAME module cache from a source other than
+ * the vault fetcher — specifically the org's serving-auth
+ * broker (`serving-auth/index.ts`), which hands back the sealed BYOK key when
+ * an admin has chosen api_key serving in Settings.
+ *
+ * This is deliberately a second door onto ONE cache rather than a second
+ * mechanism: every consumer (anthropicApiKey → resolveAuthMode →
+ * withAnthropicAuth) keeps resolving through the same sanctioned path, and the
+ * runner still never reads or writes `process.env.ANTHROPIC_API_KEY`, which the
+ * ambient-key guard (scripts/ci/no-ambient-anthropic-key.mjs) forbids outright
+ * in this tree.
+ *
+ * A blank/whitespace key is IGNORED rather than cached: caching "" would make
+ * `anthropicApiKey()` fall through to a stale earlier value, and clearing a key
+ * is not something this function is for (choose subscription for that — the
+ * kind, not the key, is what stops a spawn from being billed).
+ */
+export function cacheServingApiKey(key) {
+    const trimmed = (key ?? "").trim();
+    if (trimmed)
+        vaultAnthropicApiKey = trimmed;
+}
+/**
+ * Trimmed ANTHROPIC_API_KEY from `env`, or the NS RUN-3 vault-sourced key
+ * (see hydrateAnthropicApiKey) when `env` doesn't carry one, or "" when
+ * neither is set. An explicit value in `env` always wins.
+ */
 export function anthropicApiKey(env = process.env) {
-    return (env.ANTHROPIC_API_KEY ?? "").trim();
+    const fromEnv = (env.ANTHROPIC_API_KEY ?? "").trim();
+    return fromEnv || vaultAnthropicApiKey || "";
 }
 /**
  * Opt-in claude-config isolation. Even with ANTHROPIC_API_KEY
@@ -172,6 +216,66 @@ export function authPrecedenceHint(env = process.env) {
     return ("if you still hit 429 session caps, a claude.ai login is shadowing the API key — " +
         "run `claude /logout` or set ACC_RUNNER_ISOLATE_CLAUDE_CONFIG=1");
 }
+export const ANTHROPIC_KEY_SOURCE_ENV = "ACC_RUNNER_ANTHROPIC_KEY_SOURCE";
+/** Vault secret name the operator stores the Anthropic key under. */
+export const ANTHROPIC_API_KEY_SECRET_NAME = "ANTHROPIC_API_KEY";
+/**
+ * Resolve which source ANTHROPIC_API_KEY should come from. Defaults to
+ * "env" (today's behaviour, unchanged) so existing desktop runners and
+ * containers with the key baked into their launch env see no change — the
+ * secret-store path is opt-in via ACC_RUNNER_ANTHROPIC_KEY_SOURCE=secret-store.
+ */
+export function resolveAnthropicKeySource(env = process.env) {
+    const v = (env[ANTHROPIC_KEY_SOURCE_ENV] ?? "").trim().toLowerCase();
+    return v === "secret-store" || v === "secret_store" || v === "vault" ? "secret-store" : "env";
+}
+/**
+ * Fetch ANTHROPIC_API_KEY from the vault via the supplied fetcher and trim
+ * it. Propagates the fetcher's `secret_unavailable: …` error verbatim on
+ * failure — never adds the plaintext to a message.
+ */
+export async function anthropicApiKeyFromSecretStore(opts) {
+    const plaintext = await opts.fetcher(ANTHROPIC_API_KEY_SECRET_NAME, opts.agentId, opts.toolName);
+    return plaintext.trim();
+}
+/**
+ * Startup-time env hydration: when ACC_RUNNER_ANTHROPIC_KEY_SOURCE is
+ * "secret-store", resolves ANTHROPIC_API_KEY from the vault, caches it (see
+ * vaultAnthropicApiKey above) so anthropicApiKey()'s fallback picks it up for
+ * every later call, and returns `base` with it set too; otherwise returns
+ * `base` unchanged. An ANTHROPIC_API_KEY already present in `base` always
+ * wins and is never clobbered, so a local override for debugging still works
+ * even with the source flag flipped. Never mutates `base`.
+ *
+ * Wired into watch.ts's and companion-run.ts's startup paths (both call this
+ * ONCE at process startup, before the first withAnthropicAuth call / claude
+ * spawn, and rely on the module cache rather than assigning the result to
+ * process.env — see the ambient-key guard note above anthropicApiKey()).
+ */
+export async function hydrateAnthropicApiKey(base = process.env, storeOpts) {
+    if (resolveAnthropicKeySource(base) !== "secret-store")
+        return base;
+    // Local-override check: base's OWN property, not the vault-cache fallback
+    // anthropicApiKey() also consults — an explicit env value always wins here,
+    // regardless of anything already cached from a prior hydration.
+    if ((base.ANTHROPIC_API_KEY ?? "").trim())
+        return base;
+    if (!storeOpts) {
+        throw new Error(`${ANTHROPIC_KEY_SOURCE_ENV}=secret-store requires a vault fetcher at startup (agentId + fetcher)`);
+    }
+    const key = await anthropicApiKeyFromSecretStore(storeOpts);
+    if (!key) {
+        throw new Error(`anthropic_secret_unavailable: ${ANTHROPIC_API_KEY_SECRET_NAME} resolved to an empty value`);
+    }
+    // NS RUN-3: cache it for anthropicApiKey()'s fallback so downstream
+    // consumers (withAnthropicAuth, resolveAuthMode, …) resolve the vault key
+    // WITHOUT the runner ever writing process.env.ANTHROPIC_API_KEY directly
+    // (see the module-cache doc comment above anthropicApiKey()). The returned
+    // env object still carries it explicitly too, for a caller that reads the
+    // return value directly.
+    vaultAnthropicApiKey = key;
+    return { ...base, ANTHROPIC_API_KEY: key };
+}
 /**
  * The per-provider keychain account under the frozen `acc-runner` service.
  * FROZEN-CONTRACT EXTENSION (Track-A note): this ADDS a namespaced account

package/dist/provider-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth.js","sourceRoot":"","sources":["../src/provider-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAIrD,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAAuC,CAAC;AAU7E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACrE,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,IAAqB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,OAAO;YACV,OAAO,0EAA0E,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,gFAAgF,CAAC;QAC1F,KAAK,MAAM;YACT,OAAO,wEAAwE,CAAC;QAClF;YACE,OAAO,8EAA8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B,OAAO,CAAC,GAAG;IACrE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,8EAA8E;IAC9E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IACpE,6DAA6D;IAC7D,sEAAsE;IACtE,6EAA6E;IAC7E,IACE,4BAA4B,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EACtC,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,0EAA0E,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,6BAA6B,uBAAuB,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACtF,CAAC;IACD,OAAO,CACL,kFAAkF;QAClF,gEAAgE,CACjE,CAAC;AACJ,CAAC;AA6BD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAA0B,CAAC;AAElE,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAGlC,CAAC;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAA8B;IAE9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA+B,EAC/B,SAAkB;IAElB,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAmB,EACnB,OAA0B,OAAO,CAAC,GAAG;IAErC,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG;YAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"provider-auth.js","sourceRoot":"","sources":["../src/provider-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAKrD;;;;;;;;;;GAUG;AACH,IAAI,oBAAoB,GAAkB,IAAI,CAAC;AAE/C,kEAAkE;AAClE,MAAM,UAAU,mCAAmC;IACjD,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,OAAO;QAAE,oBAAoB,GAAG,OAAO,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,OAAO,IAAI,oBAAoB,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CACrC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,8BAAuC,CAAC;AAU7E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACrE,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACrE,OAAO,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,IAAqB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,OAAO;YACV,OAAO,0EAA0E,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,gFAAgF,CAAC;QAC1F,KAAK,MAAM;YACT,OAAO,wEAAwE,CAAC;QAClF;YACE,OAAO,8EAA8E,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA0B,OAAO,CAAC,GAAG;IACrE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,wEAAwE;QACxE,IAAI,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,MAAM,QAAQ,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;QAChD,OAAO,QAAQ,CAAC,iBAAiB,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,8EAA8E;IAC9E,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;IACpE,6DAA6D;IAC7D,sEAAsE;IACtE,6EAA6E;IAC7E,IACE,4BAA4B,CAAC,IAAI,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EACtC,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,kDAAkD;QACpD,CAAC,CAAC,0EAA0E,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,4BAA4B,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,6BAA6B,uBAAuB,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACtF,CAAC;IACD,OAAO,CACL,kFAAkF;QAClF,gEAAgE,CACjE,CAAC;AACJ,CAAC;AA2BD,MAAM,CAAC,MAAM,wBAAwB,GAAG,iCAA0C,CAAC;AAEnF,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,mBAA4B,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;AAChG,CAAC;AAcD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAiC;IAEjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAClC,6BAA6B,EAC7B,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,CACd,CAAC;IACF,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA0B,OAAO,CAAC,GAAG,EACrC,SAAuC;IAEvC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACpE,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,GAAG,wBAAwB,uEAAuE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iCAAiC,6BAA6B,6BAA6B,CAC5F,CAAC;IACJ,CAAC;IACD,oEAAoE;IACpE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,yBAAyB;IACzB,oBAAoB,GAAG,GAAG,CAAC;IAC3B,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC;AAC7C,CAAC;AA6BD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iBAA0B,CAAC;AAElE,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAGlC,CAAC;QACF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAA8B;IAE9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACtE,OAAO,eAAe,CAAC;IACzB,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA+B,EAC/B,SAAkB;IAElB,IAAI,UAAU,KAAK,eAAe;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC;IAClF,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,IAAmB;IACvD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,2EAA2E;QAC7E,CAAC,CAAC,2EAA2E,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAmB,EACnB,OAA0B,OAAO,CAAC,GAAG;IAErC,MAAM,IAAI,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG;YAAE,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/cache-dir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-dir.d.ts","sourceRoot":"","sources":["../../src/runtime/cache-dir.ts"],"names":[],"mappings":"AAmBA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAM3E;AAED,wBAAgB,QAAQ,IAAI,MAAM,CAMjC"}
+{"version":3,"file":"cache-dir.d.ts","sourceRoot":"","sources":["../../src/runtime/cache-dir.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAU3E;AAED,wBAAgB,QAAQ,IAAI,MAAM,CAMjC"}

package/dist/runtime/cache-dir.js

@@ -16,6 +16,7 @@
  */
 import os from "node:os";
 import path from "node:path";
+import { resolveInstance } from "../instance.js";
 /**
  * The filesystem-safe slug that namespaces the default cache root. Returns
  * the sanitised ACC_RUNNER_ID when set, else "" (no namespacing). A minted
@@ -25,11 +26,15 @@ import path from "node:path";
  */
 export function cacheNamespace(env = process.env) {
     const id = env.ACC_RUNNER_ID?.trim();
-    if (!id)
-        return "";
     // Keep the id readable on disk but strip anything that could escape the
     // directory or trip a shell (/, .., spaces, etc.).
-    return id.replace(/[^A-Za-z0-9._-]/g, "_");
+    if (id)
+        return id.replace(/[^A-Za-z0-9._-]/g, "_");
+    // NAMED-INSTANCES-1: a named instance namespaces the root too (isolated
+    // locks/worktrees/quarantine, no hand-assigned id/dir). ACC_RUNNER_ID still
+    // wins; unnamed stays "". Name is path-safe; `instance-` avoids id slugs.
+    const instance = resolveInstance(env);
+    return instance ? `instance-${instance}` : "";
 }
 export function cacheDir() {
     const override = process.env.ACC_RUNNER_CACHE_DIR?.trim();

package/dist/runtime/cache-dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache-dir.js","sourceRoot":"","sources":["../../src/runtime/cache-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACnB,wEAAwE;IACxE,mDAAmD;IACnD,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}
+{"version":3,"file":"cache-dir.js","sourceRoot":"","sources":["../../src/runtime/cache-dir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACrC,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACnD,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,CAAC,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}

package/dist/runtime/decision-provenance.d.ts

@@ -0,0 +1,63 @@
+/**
+ * REVIEW-DECISION-PROVENANCE (runner half; mirrors
+ * api/_lib/reviewer/decision-provenance.ts, which carries the full rationale).
+ *
+ * MEASURED FAULT (PR #1913): `decision = "reject"` was persisted while every
+ * entry in `reasons[]` concluded "Met." — a full-pass analysis — with nothing on
+ * the row explaining the disagreement. That verdict was not asserted by the
+ * reviewer; the prose fallback in `extractReviewerDecision` SYNTHESIZED it from
+ * the first approve/reject keyword when the model answered in markdown, and left
+ * no trace. The contrast case (PR #1911) was a legitimate forced reject that
+ * named its rationale in `reasons[]`.
+ *
+ * INVARIANT: a forced or synthesized decision carries its justification in
+ * `reasons[]` plus a machine-readable marker naming the override source. The
+ * runner is the hot-path writer (acc.submit_review), so the guard runs here,
+ * immediately before the row is persisted.
+ *
+ * JUDGEMENT IS NEVER ALTERED — nothing here flips approve↔reject. `reasons[]` is
+ * the only channel (acc.review_queue stores `reasons text[]` and submit_review
+ * takes no extra argument), so the marker rides there in a parseable form, the
+ * same way the read-coverage telemetry line does.
+ *
+ * PURE. No I/O, no clock, no client.
+ */
+/** Where a decision came from when it was not asserted by the analysis itself. */
+export type DecisionSource = "prose_keyword" | "reconciled_contradiction";
+export interface DecisionProvenance {
+    decision_source: DecisionSource;
+    override_reason: string;
+}
+/** Stable prefix for cheap row detection. */
+export declare const DECISION_PROVENANCE_PREFIX = "decision_provenance:";
+/** Rationale stamped when the prose fallback synthesizes the verdict. */
+export declare const PROSE_KEYWORD_OVERRIDE_REASON: string;
+/** Rationale stamped when a reject is contradicted by its own reasons. */
+export declare const CONTRADICTION_OVERRIDE_REASON: string;
+/** Render a provenance record as the reasons[] line that persists it. */
+export declare function decisionProvenanceReason(p: DecisionProvenance): string;
+/** True when a single reason IS the provenance marker (never a finding). */
+export declare function isDecisionProvenanceReason(reason: string | null | undefined): boolean;
+/** The first provenance marker carried by a verdict's reasons, or null. */
+export declare function parseDecisionProvenance(reasons: readonly (string | null | undefined)[] | null | undefined): DecisionProvenance | null;
+/**
+ * True when a verdict's reasons read as a FULL-PASS analysis: at least one
+ * criterion recorded as met and no defect language anywhere. Lines that are
+ * neither (telemetry such as the coverage line) are tolerated.
+ */
+export declare function allCriteriaMet(reasons: readonly (string | null | undefined)[] | null | undefined): boolean;
+/**
+ * The submit-seam guard. A reject whose reasons record a clean full pass and
+ * which carries no provenance marker gets one appended, so the #1913 shape can
+ * never be persisted unexplained. Every other verdict is returned untouched and
+ * the DECISION IS NEVER CHANGED. Idempotent.
+ */
+export declare function reconcileReviewDecision<D extends string>(verdict: {
+    decision: D;
+    reasons?: readonly (string | null | undefined)[] | null;
+}): {
+    decision: D;
+    reasons: string[];
+    provenance: DecisionProvenance | null;
+};
+//# sourceMappingURL=decision-provenance.d.ts.map

package/dist/runtime/decision-provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-provenance.d.ts","sourceRoot":"","sources":["../../src/runtime/decision-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,kFAAkF;AAClF,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG,0BAA0B,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,cAAc,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,6CAA6C;AAC7C,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAKjE,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,QAGe,CAAC;AAE1D,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,QAGK,CAAC;AAEhD,yEAAyE;AACzE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAGtE;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErF;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,IAAI,GAAG,SAAS,GACjE,kBAAkB,GAAG,IAAI,CAS3B;AAeD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,IAAI,GAAG,SAAS,GACjE,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,EAAE,OAAO,EAAE;IACjE,QAAQ,EAAE,CAAC,CAAC;IACZ,OAAO,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC;CACzD,GAAG;IAAE,QAAQ,EAAE,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI,CAAA;CAAE,CAiB5E"}

package/dist/runtime/decision-provenance.js

@@ -0,0 +1,107 @@
+/**
+ * REVIEW-DECISION-PROVENANCE (runner half; mirrors
+ * api/_lib/reviewer/decision-provenance.ts, which carries the full rationale).
+ *
+ * MEASURED FAULT (PR #1913): `decision = "reject"` was persisted while every
+ * entry in `reasons[]` concluded "Met." — a full-pass analysis — with nothing on
+ * the row explaining the disagreement. That verdict was not asserted by the
+ * reviewer; the prose fallback in `extractReviewerDecision` SYNTHESIZED it from
+ * the first approve/reject keyword when the model answered in markdown, and left
+ * no trace. The contrast case (PR #1911) was a legitimate forced reject that
+ * named its rationale in `reasons[]`.
+ *
+ * INVARIANT: a forced or synthesized decision carries its justification in
+ * `reasons[]` plus a machine-readable marker naming the override source. The
+ * runner is the hot-path writer (acc.submit_review), so the guard runs here,
+ * immediately before the row is persisted.
+ *
+ * JUDGEMENT IS NEVER ALTERED — nothing here flips approve↔reject. `reasons[]` is
+ * the only channel (acc.review_queue stores `reasons text[]` and submit_review
+ * takes no extra argument), so the marker rides there in a parseable form, the
+ * same way the read-coverage telemetry line does.
+ *
+ * PURE. No I/O, no clock, no client.
+ */
+/** Stable prefix for cheap row detection. */
+export const DECISION_PROVENANCE_PREFIX = "decision_provenance:";
+const PROVENANCE_RE = /^decision_provenance:\s*decision_source=(\S+)\s+override_reason=([\s\S]*)$/i;
+/** Rationale stamped when the prose fallback synthesizes the verdict. */
+export const PROSE_KEYWORD_OVERRIDE_REASON = "the reviewer answered in prose instead of the structured verdict object, so " +
+    "this decision was synthesized by the parser from the first approve/reject " +
+    "keyword in the text rather than asserted as a verdict";
+/** Rationale stamped when a reject is contradicted by its own reasons. */
+export const CONTRADICTION_OVERRIDE_REASON = "the analysis recorded every acceptance criterion as met, yet the verdict is " +
+    "reject and the row states no override rationale — the verdict is kept as " +
+    "submitted and flagged here for the operator";
+/** Render a provenance record as the reasons[] line that persists it. */
+export function decisionProvenanceReason(p) {
+    const rationale = p.override_reason.replace(/\s+/g, " ").trim() || "(unstated)";
+    return `${DECISION_PROVENANCE_PREFIX} decision_source=${p.decision_source} override_reason=${rationale}`;
+}
+/** True when a single reason IS the provenance marker (never a finding). */
+export function isDecisionProvenanceReason(reason) {
+    return typeof reason === "string" && PROVENANCE_RE.test(reason.trim());
+}
+/** The first provenance marker carried by a verdict's reasons, or null. */
+export function parseDecisionProvenance(reasons) {
+    for (const raw of reasons ?? []) {
+        if (typeof raw !== "string")
+            continue;
+        const m = PROVENANCE_RE.exec(raw.trim());
+        if (m) {
+            return { decision_source: m[1], override_reason: m[2].trim() };
+        }
+    }
+    return null;
+}
+/** Severity tag the server-side calibrator stamps on stored findings. */
+const SEVERITY_TAG_RE = /^\s*\[(?:blocking|advisory)\]\s*/i;
+/** A finding that concludes the criterion it names was satisfied. */
+const MET_RE = /\bmet\b\s*[.)\]]?\s*$/i;
+/**
+ * Defect / non-satisfaction language. Present anywhere ⇒ the analysis is not a
+ * clean full pass and the guard stands down — deliberately biased toward NOT
+ * stamping, since a missed stamp is an audit gap while a wrong one would
+ * editorialize a real reject.
+ */
+const DEFECT_RE = /\b(?:not\s+met|unmet|partially\s+met|fail(?:s|ed|ing|ure)?|missing|absent|violat\w*|blocking|defect|regression|broken|incorrect|unsafe|does\s+not|is\s+not|are\s+not|was\s+not|cannot|can['’]?t)\b/i;
+/**
+ * True when a verdict's reasons read as a FULL-PASS analysis: at least one
+ * criterion recorded as met and no defect language anywhere. Lines that are
+ * neither (telemetry such as the coverage line) are tolerated.
+ */
+export function allCriteriaMet(reasons) {
+    const findings = (reasons ?? [])
+        .filter((r) => typeof r === "string")
+        .filter((r) => !isDecisionProvenanceReason(r))
+        .map((r) => r.replace(SEVERITY_TAG_RE, "").trim())
+        .filter((r) => r.length > 0);
+    if (findings.length === 0)
+        return false;
+    if (findings.some((r) => DEFECT_RE.test(r)))
+        return false;
+    return findings.some((r) => MET_RE.test(r));
+}
+/**
+ * The submit-seam guard. A reject whose reasons record a clean full pass and
+ * which carries no provenance marker gets one appended, so the #1913 shape can
+ * never be persisted unexplained. Every other verdict is returned untouched and
+ * the DECISION IS NEVER CHANGED. Idempotent.
+ */
+export function reconcileReviewDecision(verdict) {
+    const reasons = (verdict.reasons ?? []).filter((r) => typeof r === "string");
+    const existing = parseDecisionProvenance(reasons);
+    if (verdict.decision !== "reject" || existing !== null || !allCriteriaMet(reasons)) {
+        return { decision: verdict.decision, reasons, provenance: existing };
+    }
+    const provenance = {
+        decision_source: "reconciled_contradiction",
+        override_reason: CONTRADICTION_OVERRIDE_REASON,
+    };
+    return {
+        decision: verdict.decision,
+        reasons: [...reasons, decisionProvenanceReason(provenance)],
+        provenance,
+    };
+}
+//# sourceMappingURL=decision-provenance.js.map

package/dist/runtime/decision-provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-provenance.js","sourceRoot":"","sources":["../../src/runtime/decision-provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE,MAAM,aAAa,GACjB,6EAA6E,CAAC;AAEhF,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E;IAC9E,4EAA4E;IAC5E,uDAAuD,CAAC;AAE1D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GACxC,8EAA8E;IAC9E,2EAA2E;IAC3E,6CAA6C,CAAC;AAEhD,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CAAC,CAAqB;IAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC;IAChF,OAAO,GAAG,0BAA0B,oBAAoB,CAAC,CAAC,eAAe,oBAAoB,SAAS,EAAE,CAAC;AAC3G,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,MAAiC;IAC1E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CACrC,OAAkE;IAElE,KAAK,MAAM,GAAG,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC;YACN,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAmB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAC5D,qEAAqE;AACrE,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC;;;;;GAKG;AACH,MAAM,SAAS,GACb,qMAAqM,CAAC;AAExM;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAkE;IAElE,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAmB,OAGzD;IACC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,UAAU,GAAuB;QACrC,eAAe,EAAE,0BAA0B;QAC3C,eAAe,EAAE,6BAA6B;KAC/C,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC3D,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/runtime/prompt-substitute.d.ts

@@ -0,0 +1,100 @@
+/**
+ * S15-FU/REVIEW-1 (AC1) — literal-safe reviewer-prompt placeholder substitution.
+ *
+ * THE FAULT THIS CLOSES (the LEDGER-1 #1933 episode)
+ * ----------------------------------------------------------------------------
+ * `renderReviewerPrompt` interpolated the PR diff into the reviewer prompt with
+ *
+ *     template.replace("{{pr_diff}}", diff)
+ *
+ * `String.prototype.replace` treats a STRING replacement as a pattern: `$$`,
+ * `$&`, `` $` ``, `$'` and `$1`…`$9` are expanded, not copied. So a diff whose
+ * text contains `$'` — which every one of these clean SQL literals does —
+ *
+ *     select seq, slug, sha from acc.applied_migrations where seq ~ '^[0-9]+$' order by 1
+ *                                                                         ^^ $'
+ *
+ * made `replace` splice in "the portion of the template AFTER the match": the
+ * reviewer's OWN instruction text, starting at
+ * "Now answer in this exact JSON shape, with no surrounding prose:". The
+ * reviewer then read that prose INSIDE the SQL literal and — correctly, given
+ * what it was shown — reported "prose spliced into the literal" as a corruption
+ * defect, at 0.75–0.85 confidence, across several independent sessions. The
+ * diff on disk was clean the whole time; the harness corrupted it on the way in.
+ *
+ * (Same root cause as the 3× `gatherAppliedLedger` corruption in
+ * `scripts/ci/migration-lint.mjs`: `$'` expansion in a string replacement, not
+ * context bleed.)
+ *
+ * THE RULE: NEVER pass untrusted text as `replace`'s string replacement. A
+ * FUNCTION replacement is copied verbatim — `$` has no meaning in its return
+ * value — so `substitutePlaceholder` below is the only sanctioned way to put a
+ * diff, PR body, title, description, or acceptance criterion into a prompt.
+ *
+ * Mirrored, byte-for-byte in behaviour, from
+ * `api/_lib/reviewer/prompt-substitute.ts` (the server path). The runner ships as
+ * a published npm package and cannot import from `api/_lib`, so the module is
+ * duplicated and pinned by a cross-implementation parity test.
+ * // keep in sync with api/_lib/reviewer/prompt-substitute.ts
+ */
+/**
+ * The `$`-sequences `String.prototype.replace` expands inside a STRING
+ * replacement. Documented here because the whole module exists to defeat them.
+ *
+ *   `$$`  → a literal `$`
+ *   `$&`  → the matched substring
+ *   ``$` `` → everything BEFORE the match
+ *   `$'`  → everything AFTER the match  ← the #1933 corruption
+ *   `$n`  → capture group n
+ */
+export declare const REPLACEMENT_EXPANSION_SEQUENCES: readonly ["$$", "$&", "$`", "$'"];
+/**
+ * True when `value` contains a sequence that `String.prototype.replace` would
+ * expand if it were used as a string replacement. Diagnostic only — the
+ * substitution below is safe either way — but it lets the render seam log that a
+ * value was in the dangerous class without ever emitting the value itself.
+ */
+export declare function hasReplacementExpansion(value: string | null | undefined): boolean;
+/**
+ * Substitute the FIRST occurrence of `placeholder` with `value`, VERBATIM.
+ *
+ * The replacement is a function, so no `$`-sequence in `value` is expanded and
+ * no template text can bleed into it. An absent placeholder is a no-op (the
+ * template is returned unchanged) — same as the string form it replaces.
+ */
+export declare function substitutePlaceholder(template: string, placeholder: string, value: string | null | undefined): string;
+/**
+ * Apply an ORDERED list of `[placeholder, value]` pairs. Order matters only in
+ * that each pass sees the output of the previous one; because values are
+ * inserted verbatim, a value that happens to contain a later placeholder's
+ * literal text (`"{{pr_diff}}"` inside a PR body, say) is NOT re-substituted
+ * away — the later pass still matches the TEMPLATE's own placeholder first,
+ * since it appears earlier in the string only if the template put it there.
+ */
+export declare function substitutePlaceholders(template: string, pairs: ReadonlyArray<readonly [string, string | null | undefined]>): string;
+/** One value that did not survive substitution verbatim. */
+export interface PromptRenderBleed {
+    /** The placeholder whose value was corrupted (e.g. `{{pr_diff}}`). */
+    placeholder: string;
+    /** Length of the value we expected to find verbatim (never the value itself). */
+    expected_chars: number;
+}
+/**
+ * INTEGRITY CHECK: every value substituted for a placeholder THE TEMPLATE
+ * ACTUALLY CONTAINS must appear VERBATIM in the rendered output. Anything else
+ * means the render mangled file content — the #1933 class — and the review must
+ * NOT proceed on that prompt (the reviewer would be judging text the repo does
+ * not contain).
+ *
+ * `template` is required precisely so a placeholder the template OMITS is not
+ * reported: a prompt that never asks for the PR body was not corrupted by the
+ * body's absence, it simply does not carry it. Only a value the template asked
+ * for and did not receive verbatim is a bleed.
+ *
+ * Pure and allocation-cheap (`includes`, no regex). Values are never echoed into
+ * the result, so a bleed report is safe to log.
+ */
+export declare function findPromptRenderBleed(template: string, rendered: string, pairs: ReadonlyArray<readonly [string, string | null | undefined]>): PromptRenderBleed[];
+/** Operator-facing one-liner naming the corrupted placeholders (never the values). */
+export declare function describePromptRenderBleed(bleeds: PromptRenderBleed[]): string;
+//# sourceMappingURL=prompt-substitute.d.ts.map

package/dist/runtime/prompt-substitute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-substitute.d.ts","sourceRoot":"","sources":["../../src/runtime/prompt-substitute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,mCAAoC,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGjF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACjE,MAAM,CAMR;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACjE,iBAAiB,EAAE,CAarB;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAI7E"}

package/dist/runtime/prompt-substitute.js

@@ -0,0 +1,124 @@
+/**
+ * S15-FU/REVIEW-1 (AC1) — literal-safe reviewer-prompt placeholder substitution.
+ *
+ * THE FAULT THIS CLOSES (the LEDGER-1 #1933 episode)
+ * ----------------------------------------------------------------------------
+ * `renderReviewerPrompt` interpolated the PR diff into the reviewer prompt with
+ *
+ *     template.replace("{{pr_diff}}", diff)
+ *
+ * `String.prototype.replace` treats a STRING replacement as a pattern: `$$`,
+ * `$&`, `` $` ``, `$'` and `$1`…`$9` are expanded, not copied. So a diff whose
+ * text contains `$'` — which every one of these clean SQL literals does —
+ *
+ *     select seq, slug, sha from acc.applied_migrations where seq ~ '^[0-9]+$' order by 1
+ *                                                                         ^^ $'
+ *
+ * made `replace` splice in "the portion of the template AFTER the match": the
+ * reviewer's OWN instruction text, starting at
+ * "Now answer in this exact JSON shape, with no surrounding prose:". The
+ * reviewer then read that prose INSIDE the SQL literal and — correctly, given
+ * what it was shown — reported "prose spliced into the literal" as a corruption
+ * defect, at 0.75–0.85 confidence, across several independent sessions. The
+ * diff on disk was clean the whole time; the harness corrupted it on the way in.
+ *
+ * (Same root cause as the 3× `gatherAppliedLedger` corruption in
+ * `scripts/ci/migration-lint.mjs`: `$'` expansion in a string replacement, not
+ * context bleed.)
+ *
+ * THE RULE: NEVER pass untrusted text as `replace`'s string replacement. A
+ * FUNCTION replacement is copied verbatim — `$` has no meaning in its return
+ * value — so `substitutePlaceholder` below is the only sanctioned way to put a
+ * diff, PR body, title, description, or acceptance criterion into a prompt.
+ *
+ * Mirrored, byte-for-byte in behaviour, from
+ * `api/_lib/reviewer/prompt-substitute.ts` (the server path). The runner ships as
+ * a published npm package and cannot import from `api/_lib`, so the module is
+ * duplicated and pinned by a cross-implementation parity test.
+ * // keep in sync with api/_lib/reviewer/prompt-substitute.ts
+ */
+/**
+ * The `$`-sequences `String.prototype.replace` expands inside a STRING
+ * replacement. Documented here because the whole module exists to defeat them.
+ *
+ *   `$$`  → a literal `$`
+ *   `$&`  → the matched substring
+ *   ``$` `` → everything BEFORE the match
+ *   `$'`  → everything AFTER the match  ← the #1933 corruption
+ *   `$n`  → capture group n
+ */
+export const REPLACEMENT_EXPANSION_SEQUENCES = ["$$", "$&", "$`", "$'"];
+/**
+ * True when `value` contains a sequence that `String.prototype.replace` would
+ * expand if it were used as a string replacement. Diagnostic only — the
+ * substitution below is safe either way — but it lets the render seam log that a
+ * value was in the dangerous class without ever emitting the value itself.
+ */
+export function hasReplacementExpansion(value) {
+    const text = value ?? "";
+    return /\$[$&`'\d]/.test(text);
+}
+/**
+ * Substitute the FIRST occurrence of `placeholder` with `value`, VERBATIM.
+ *
+ * The replacement is a function, so no `$`-sequence in `value` is expanded and
+ * no template text can bleed into it. An absent placeholder is a no-op (the
+ * template is returned unchanged) — same as the string form it replaces.
+ */
+export function substitutePlaceholder(template, placeholder, value) {
+    const text = value ?? "";
+    return (template ?? "").replace(placeholder, () => text);
+}
+/**
+ * Apply an ORDERED list of `[placeholder, value]` pairs. Order matters only in
+ * that each pass sees the output of the previous one; because values are
+ * inserted verbatim, a value that happens to contain a later placeholder's
+ * literal text (`"{{pr_diff}}"` inside a PR body, say) is NOT re-substituted
+ * away — the later pass still matches the TEMPLATE's own placeholder first,
+ * since it appears earlier in the string only if the template put it there.
+ */
+export function substitutePlaceholders(template, pairs) {
+    let out = template ?? "";
+    for (const [placeholder, value] of pairs) {
+        out = substitutePlaceholder(out, placeholder, value);
+    }
+    return out;
+}
+/**
+ * INTEGRITY CHECK: every value substituted for a placeholder THE TEMPLATE
+ * ACTUALLY CONTAINS must appear VERBATIM in the rendered output. Anything else
+ * means the render mangled file content — the #1933 class — and the review must
+ * NOT proceed on that prompt (the reviewer would be judging text the repo does
+ * not contain).
+ *
+ * `template` is required precisely so a placeholder the template OMITS is not
+ * reported: a prompt that never asks for the PR body was not corrupted by the
+ * body's absence, it simply does not carry it. Only a value the template asked
+ * for and did not receive verbatim is a bleed.
+ *
+ * Pure and allocation-cheap (`includes`, no regex). Values are never echoed into
+ * the result, so a bleed report is safe to log.
+ */
+export function findPromptRenderBleed(template, rendered, pairs) {
+    const out = [];
+    const tpl = template ?? "";
+    const text = rendered ?? "";
+    for (const [placeholder, value] of pairs) {
+        const expected = value ?? "";
+        if (expected.length === 0)
+            continue;
+        if (!tpl.includes(placeholder))
+            continue;
+        if (!text.includes(expected)) {
+            out.push({ placeholder, expected_chars: expected.length });
+        }
+    }
+    return out;
+}
+/** Operator-facing one-liner naming the corrupted placeholders (never the values). */
+export function describePromptRenderBleed(bleeds) {
+    return bleeds
+        .map((b) => `${b.placeholder} (${b.expected_chars} chars did not survive verbatim)`)
+        .join("; ");
+}
+//# sourceMappingURL=prompt-substitute.js.map

package/dist/runtime/prompt-substitute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-substitute.js","sourceRoot":"","sources":["../../src/runtime/prompt-substitute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,WAAmB,EACnB,KAAgC;IAEhC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,KAAkE;IAElE,IAAI,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,QAAgB,EAChB,KAAkE;IAElE,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,yBAAyB,CAAC,MAA2B;IACnE,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,cAAc,kCAAkC,CAAC;SACnF,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}