@tokenfactory/acc-runner 0.44.0 → 0.44.2

package/dist/runtime/prompt-substitute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-substitute.d.ts","sourceRoot":"","sources":["../../src/runtime/prompt-substitute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,mCAAoC,CAAC;AAEjF;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGjF;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,CAGR;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACjE,MAAM,CAMR;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GACjE,iBAAiB,EAAE,CAarB;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAI7E"}

package/dist/runtime/prompt-substitute.js

@@ -0,0 +1,124 @@
+/**
+ * S15-FU/REVIEW-1 (AC1) — literal-safe reviewer-prompt placeholder substitution.
+ *
+ * THE FAULT THIS CLOSES (the LEDGER-1 #1933 episode)
+ * ----------------------------------------------------------------------------
+ * `renderReviewerPrompt` interpolated the PR diff into the reviewer prompt with
+ *
+ *     template.replace("{{pr_diff}}", diff)
+ *
+ * `String.prototype.replace` treats a STRING replacement as a pattern: `$$`,
+ * `$&`, `` $` ``, `$'` and `$1`…`$9` are expanded, not copied. So a diff whose
+ * text contains `$'` — which every one of these clean SQL literals does —
+ *
+ *     select seq, slug, sha from acc.applied_migrations where seq ~ '^[0-9]+$' order by 1
+ *                                                                         ^^ $'
+ *
+ * made `replace` splice in "the portion of the template AFTER the match": the
+ * reviewer's OWN instruction text, starting at
+ * "Now answer in this exact JSON shape, with no surrounding prose:". The
+ * reviewer then read that prose INSIDE the SQL literal and — correctly, given
+ * what it was shown — reported "prose spliced into the literal" as a corruption
+ * defect, at 0.75–0.85 confidence, across several independent sessions. The
+ * diff on disk was clean the whole time; the harness corrupted it on the way in.
+ *
+ * (Same root cause as the 3× `gatherAppliedLedger` corruption in
+ * `scripts/ci/migration-lint.mjs`: `$'` expansion in a string replacement, not
+ * context bleed.)
+ *
+ * THE RULE: NEVER pass untrusted text as `replace`'s string replacement. A
+ * FUNCTION replacement is copied verbatim — `$` has no meaning in its return
+ * value — so `substitutePlaceholder` below is the only sanctioned way to put a
+ * diff, PR body, title, description, or acceptance criterion into a prompt.
+ *
+ * Mirrored, byte-for-byte in behaviour, from
+ * `api/_lib/reviewer/prompt-substitute.ts` (the server path). The runner ships as
+ * a published npm package and cannot import from `api/_lib`, so the module is
+ * duplicated and pinned by a cross-implementation parity test.
+ * // keep in sync with api/_lib/reviewer/prompt-substitute.ts
+ */
+/**
+ * The `$`-sequences `String.prototype.replace` expands inside a STRING
+ * replacement. Documented here because the whole module exists to defeat them.
+ *
+ *   `$$`  → a literal `$`
+ *   `$&`  → the matched substring
+ *   ``$` `` → everything BEFORE the match
+ *   `$'`  → everything AFTER the match  ← the #1933 corruption
+ *   `$n`  → capture group n
+ */
+export const REPLACEMENT_EXPANSION_SEQUENCES = ["$$", "$&", "$`", "$'"];
+/**
+ * True when `value` contains a sequence that `String.prototype.replace` would
+ * expand if it were used as a string replacement. Diagnostic only — the
+ * substitution below is safe either way — but it lets the render seam log that a
+ * value was in the dangerous class without ever emitting the value itself.
+ */
+export function hasReplacementExpansion(value) {
+    const text = value ?? "";
+    return /\$[$&`'\d]/.test(text);
+}
+/**
+ * Substitute the FIRST occurrence of `placeholder` with `value`, VERBATIM.
+ *
+ * The replacement is a function, so no `$`-sequence in `value` is expanded and
+ * no template text can bleed into it. An absent placeholder is a no-op (the
+ * template is returned unchanged) — same as the string form it replaces.
+ */
+export function substitutePlaceholder(template, placeholder, value) {
+    const text = value ?? "";
+    return (template ?? "").replace(placeholder, () => text);
+}
+/**
+ * Apply an ORDERED list of `[placeholder, value]` pairs. Order matters only in
+ * that each pass sees the output of the previous one; because values are
+ * inserted verbatim, a value that happens to contain a later placeholder's
+ * literal text (`"{{pr_diff}}"` inside a PR body, say) is NOT re-substituted
+ * away — the later pass still matches the TEMPLATE's own placeholder first,
+ * since it appears earlier in the string only if the template put it there.
+ */
+export function substitutePlaceholders(template, pairs) {
+    let out = template ?? "";
+    for (const [placeholder, value] of pairs) {
+        out = substitutePlaceholder(out, placeholder, value);
+    }
+    return out;
+}
+/**
+ * INTEGRITY CHECK: every value substituted for a placeholder THE TEMPLATE
+ * ACTUALLY CONTAINS must appear VERBATIM in the rendered output. Anything else
+ * means the render mangled file content — the #1933 class — and the review must
+ * NOT proceed on that prompt (the reviewer would be judging text the repo does
+ * not contain).
+ *
+ * `template` is required precisely so a placeholder the template OMITS is not
+ * reported: a prompt that never asks for the PR body was not corrupted by the
+ * body's absence, it simply does not carry it. Only a value the template asked
+ * for and did not receive verbatim is a bleed.
+ *
+ * Pure and allocation-cheap (`includes`, no regex). Values are never echoed into
+ * the result, so a bleed report is safe to log.
+ */
+export function findPromptRenderBleed(template, rendered, pairs) {
+    const out = [];
+    const tpl = template ?? "";
+    const text = rendered ?? "";
+    for (const [placeholder, value] of pairs) {
+        const expected = value ?? "";
+        if (expected.length === 0)
+            continue;
+        if (!tpl.includes(placeholder))
+            continue;
+        if (!text.includes(expected)) {
+            out.push({ placeholder, expected_chars: expected.length });
+        }
+    }
+    return out;
+}
+/** Operator-facing one-liner naming the corrupted placeholders (never the values). */
+export function describePromptRenderBleed(bleeds) {
+    return bleeds
+        .map((b) => `${b.placeholder} (${b.expected_chars} chars did not survive verbatim)`)
+        .join("; ");
+}
+//# sourceMappingURL=prompt-substitute.js.map

package/dist/runtime/prompt-substitute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-substitute.js","sourceRoot":"","sources":["../../src/runtime/prompt-substitute.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAgC;IACtE,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,WAAmB,EACnB,KAAgC;IAEhC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;IACzB,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,KAAkE;IAElE,IAAI,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,QAAgB,EAChB,KAAkE;IAElE,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,SAAS;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,yBAAyB,CAAC,MAA2B;IACnE,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,cAAc,kCAAkC,CAAC;SACnF,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/runtime/quarantine.d.ts

@@ -4,6 +4,10 @@ export interface QuarantineState {
     classifiedAt: string;
     taskId: string;
     detail: string;
+    engineScope?: string;
+    engine_scope?: string;
+    resumeAt?: string | null;
+    resume_at?: string | null;
     /**
      * v0.53 T-53-4: how many consecutive instant-empty (heuristic) claude
      * exits triggered the quarantine. Cache-schema additive — older readers
@@ -15,6 +19,13 @@ export interface QuarantineState {
      */
     consecutive?: number;
 }
+export interface PublishedQuarantineState {
+    entered_at: string;
+    reason: ClaudeExitClass;
+    engine_scope: string;
+    resume_at: string | null;
+}
+export declare function publishedQuarantineState(state: QuarantineState | null, nowMs?: number): PublishedQuarantineState | null;
 /**
  * Path to the quarantine sentinel file. Resolves through the shared
  * `cacheDir()` (honours ACC_RUNNER_CACHE_DIR), so a per-runner cache dir

package/dist/runtime/quarantine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0EAA0E;AAC1E,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQrE;AAED,oEAAoE;AACpE,wBAAsB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;AAED,yEAAyE;AACzE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,eAAe,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,eAAe,GAAG,IAAI,EAC7B,KAAK,GAAE,MAAmB,GACzB,wBAAwB,GAAG,IAAI,CAUjC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0EAA0E;AAC1E,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQrE;AAED,oEAAoE;AACpE,wBAAsB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzE;AAED,yEAAyE;AACzE,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/runtime/quarantine.js

@@ -3,7 +3,9 @@
  * ~/.cache/acc-runner/quarantine.json by the watch loop when the failure
  * classifier flags a machine-level failure (usage_limit | auth_expired |
  * env_broken). The presence of this file blocks pump() from claiming
- * new tasks so no further work is burned.
+ * new tasks so no further work is burned. The live watcher periodically
+ * re-reads this sentinel, so removing it resumes that named instance without a
+ * process restart.
  *
  * Clearing the quarantine (after the operator resolves the underlying issue):
  *   - Delete the file manually, OR
@@ -14,6 +16,19 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { cacheDir } from "./cache-dir.js";
+export function publishedQuarantineState(state, nowMs = Date.now()) {
+    if (!state)
+        return null;
+    const resumeAt = state.resume_at ?? state.resumeAt ?? null;
+    if (resumeAt !== null && Date.parse(resumeAt) <= nowMs)
+        return null;
+    return {
+        entered_at: state.classifiedAt,
+        reason: state.cause,
+        engine_scope: state.engine_scope ?? state.engineScope ?? "all",
+        resume_at: resumeAt,
+    };
+}
 /**
  * Path to the quarantine sentinel file. Resolves through the shared
  * `cacheDir()` (honours ACC_RUNNER_CACHE_DIR), so a per-runner cache dir

package/dist/runtime/quarantine.js.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAoB1C;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC"}
+{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../src/runtime/quarantine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AA+B1C,MAAM,UAAU,wBAAwB,CACtC,KAA6B,EAC7B,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC3D,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,YAAY;QAC9B,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK;QAC9D,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/runtime/review-cost-cap.d.ts

@@ -0,0 +1,167 @@
+/**
+ * REV-COST — runner-side per-review cost cap (size-scaled).
+ *
+ * THE EPISODE (PR #1937). The runner reviewer applied the org's FLAT
+ * `max_cost_usd_per_review` and, the instant the spend crossed it, discarded the
+ * review with `cost_cap_exceeded`. #1937 is a ~1800-line PR: it cost ~$18 against
+ * an $8 flat cap and produced NO verdict at all — the money was spent, the
+ * analysis was done, and the harness threw both away, then re-charged the same
+ * review on the next tick. That is the measured 239-decisions-over-9-tasks loop
+ * AU-5 fixed on the SERVER path (api/_lib/cost-cap.ts) and left unfixed here,
+ * which is why a large PR could still be stranded whenever a runner picked the
+ * broadcast up (the normal case — the server path is the emergency fallback).
+ *
+ * This module is the runner's copy of AU-5's PURE cost-cap core:
+ *
+ *   • `effectiveReviewCostCap` — the cap for THIS review, scaled by assembled
+ *     diff size, FLOORED at the org's flat cap (so a median PR is judged against
+ *     exactly today's number — never inflated) and CLAMPED at
+ *     REVIEW_CAP_MAX_MULTIPLE.
+ *   • `foldReviewCostLedger` — the chargeable-vs-infra split. Only PRODUCTIVE
+ *     attempts (a spawn that returned a readable reviewer envelope) are charged
+ *     to the cap; capacity/auth/tooling faults are reported but never charged.
+ *   • `classifyReviewCost` — within / overrun / runaway. `overrun` keeps the
+ *     verdict (the money is already spent; discarding it only strands the PR);
+ *     `runaway` is the hard backstop that still refuses.
+ *
+ * The runner is a standalone published package and cannot import from api/_lib
+ * (the same convention as the duplicated PRICING / MODEL_ALIASES maps and
+ * review-diff-guard.ts). KEEP IN SYNC with the AU-5 block at the bottom of
+ * api/_lib/cost-cap.ts — the constants and all three functions are pinned
+ * byte-for-behaviour by tests/unit/revcost1-runner-cap-parity.test.ts, which
+ * fails the build the moment the two drift.
+ */
+/**
+ * Assembled-diff size the flat cap is treated as calibrated for: the measured
+ * p50 production churn (750 changed lines ≈ 30k chars of unified diff). At or
+ * below this the effective cap is EXACTLY `max_cost_usd_per_review`.
+ * Mirrors api/_lib/cost-cap.ts. // keep in sync
+ */
+export declare const REVIEW_CAP_REFERENCE_DIFF_CHARS = 30000;
+/** Fraction of the base cap added per reference-diff-worth of EXCESS size. */
+export declare const REVIEW_CAP_SIZE_SLOPE = 0.5;
+/**
+ * Ceiling on the scaled cap as a multiple of the base cap. Deliberately tight
+ * (1.5× → $3.00 at a $2 base) because the measured size↔cost correlation is
+ * weak (Pearson r = 0.100): a bigger ramp would be unjustified by the data.
+ */
+export declare const REVIEW_CAP_MAX_MULTIPLE = 1.5;
+/**
+ * Multiple of the effective cap above which an already-PAID review is still
+ * discarded as a runaway — the hard backstop that survives this change. Between
+ * 1× and this, the verdict is KEPT and flagged (`cost_overrun`) instead of
+ * stranding the PR.
+ */
+export declare const REVIEW_COST_OVERRUN_TOLERANCE = 3;
+export interface ReviewCostCapDecision {
+    /** The cap to enforce for THIS review. */
+    cap_usd: number;
+    /** The org's flat `max_cost_usd_per_review` — the floor. */
+    base_cap_usd: number;
+    /** false when the base cap is 0/negative/non-finite (cap disabled). */
+    enabled: boolean;
+    /** Assembled-diff chars the scale was computed from. */
+    diff_chars: number;
+    /** cap_usd / base_cap_usd — 1 when the flat floor applied. */
+    scale: number;
+    /** True when the size ramp hit REVIEW_CAP_MAX_MULTIPLE. */
+    ceiling_applied: boolean;
+    /** Spend above which an already-paid verdict is discarded as a runaway. */
+    runaway_usd: number;
+}
+/**
+ * The size-scaled per-review cost cap. Monotone non-decreasing in `diffChars`,
+ * floored at `baseCapUsd` (so it can only ever LOOSEN relative to the flat cap —
+ * a small PR's effective cap is unchanged) and clamped at
+ * `REVIEW_CAP_MAX_MULTIPLE × baseCapUsd`. Pure.
+ *
+ * A base cap of 0 (or a non-finite/negative one) means "cap disabled" — the
+ * existing `max_cost_usd_per_review > 0` semantics — and is returned verbatim.
+ *
+ * Mirrors api/_lib/cost-cap.ts `effectiveReviewCostCap`. // keep in sync
+ */
+export declare function effectiveReviewCostCap(baseCapUsd: number, diffChars: number): ReviewCostCapDecision;
+/**
+ * How one reviewer attempt is classified for BUDGET purposes. Only `productive`
+ * attempts (a spawn that returned a reviewer envelope we can read a verdict out
+ * of) are charged to the per-review cap. Every other class is an INFRA fault: it
+ * is still reported in the review's total spend so the accounting stays honest,
+ * but it must never consume the budget set aside for reviewing this PR.
+ *
+ * Mirrors api/_lib/cost-cap.ts `ReviewAttemptClass`. // keep in sync
+ */
+export type ReviewAttemptClass = "productive"
+/** Parse-repair re-prompt — a harness cost, not review work. */
+ | "parse_repair"
+/** 429 / overloaded / rate-limit brownout (budget-exempt). */
+ | "infra_capacity"
+/** Hard billing/quota wall. */
+ | "infra_billing"
+/** Account-level spend cap. */
+ | "infra_billing_capped"
+/** Missing/invalid credential — env broken. */
+ | "infra_auth"
+/** Verification-tooling failure (unread file / truncated diff). */
+ | "infra_tooling";
+export interface ReviewCostAttempt {
+    /** 1-based attempt ordinal within this review. */
+    attempt: number;
+    model_id: string;
+    attempt_class: ReviewAttemptClass;
+    /** Spend this attempt actually incurred (0 for a throw before any tokens). */
+    cost_usd: number;
+}
+export interface ReviewCostLedger {
+    attempts: ReviewCostAttempt[];
+    /** Sum of PRODUCTIVE attempt cost — the only figure the cap is checked against. */
+    chargeable_usd: number;
+    /** Sum of every non-productive attempt cost (reported, never charged). */
+    infra_usd: number;
+    /** chargeable + infra — what the review truly cost (stored on the queue row). */
+    total_usd: number;
+    productive_attempts: number;
+    infra_attempts: number;
+}
+/**
+ * Fold an attempt list into the chargeable / infra split. Pure.
+ * Mirrors api/_lib/cost-cap.ts `foldReviewCostLedger`. // keep in sync
+ */
+export declare function foldReviewCostLedger(attempts: ReviewCostAttempt[]): ReviewCostLedger;
+/**
+ * Verdict on this review's chargeable spend:
+ *   • `within`  — at or under the effective cap. Nothing changes.
+ *   • `overrun` — over the cap but under the runaway threshold. The money is
+ *     ALREADY SPENT, so discarding the verdict buys nothing and strands the PR
+ *     (#1937). Keep the verdict and flag it.
+ *   • `runaway` — past the tolerance band. Refuse the verdict; something is
+ *     pathological and the operator must see it.
+ *
+ * Mirrors api/_lib/cost-cap.ts `classifyReviewCost`. // keep in sync
+ */
+export type ReviewCostVerdict = "within" | "overrun" | "runaway";
+export declare function classifyReviewCost(chargeableUsd: number, cap: ReviewCostCapDecision): ReviewCostVerdict;
+/** Mutable cost state for ONE review, shared by every pass it runs. */
+export interface ReviewCostContext {
+    cap: ReviewCostCapDecision;
+    attempts: ReviewCostAttempt[];
+}
+/** Open a cost context for a review over `diffChars` of assembled diff. */
+export declare function openReviewCostContext(baseCapUsd: number, diffChars: number): ReviewCostContext;
+/** Record one attempt and return the folded ledger. */
+export declare function chargeReviewAttempt(ctx: ReviewCostContext, modelId: string, attemptClass: ReviewAttemptClass, costUsd: number): ReviewCostLedger;
+/** The current folded ledger without recording anything. */
+export declare function reviewCostLedger(ctx: ReviewCostContext): ReviewCostLedger;
+/**
+ * Advisory reason for an ACCEPTED overrun. Deliberately phrased to match none of
+ * the absence-claim patterns in review-chunking.ts (asserted by this wave's
+ * test), so an audit line can never be re-read as a read-coverage claim.
+ */
+export declare function reviewCostOverrunReason(cap: ReviewCostCapDecision, ledger: ReviewCostLedger): string;
+/**
+ * Refusal reason for a RUNAWAY — the backstop above the scaled cap. Carries the
+ * PRODUCTIVE attempt count, which is what distinguishes a single-pass runaway
+ * from a chunked review that accumulated past the tolerance over several part
+ * passes (the old chunked-only reason string), without needing two call sites.
+ */
+export declare function reviewCostRunawayReason(cap: ReviewCostCapDecision, ledger: ReviewCostLedger): string;
+//# sourceMappingURL=review-cost-cap.d.ts.map

package/dist/runtime/review-cost-cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-cost-cap.d.ts","sourceRoot":"","sources":["../../src/runtime/review-cost-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,QAAS,CAAC;AACtD,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;IACjB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,eAAe,EAAE,OAAO,CAAC;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,qBAAqB,CAiCvB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B,YAAY;AACd,gEAAgE;GAC9D,cAAc;AAChB,8DAA8D;GAC5D,gBAAgB;AAClB,+BAA+B;GAC7B,eAAe;AACjB,+BAA+B;GAC7B,sBAAsB;AACxB,+CAA+C;GAC7C,YAAY;AACd,mEAAmE;GACjE,eAAe,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,kBAAkB,CAAC;IAClC,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,iBAAiB,EAAE,GAC5B,gBAAgB,CAuBlB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjE,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,qBAAqB,GACzB,iBAAiB,CAKnB;AASD,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,qBAAqB,CAAC;IAC3B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAEnB;AAED,uDAAuD;AACvD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,iBAAiB,EACtB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,kBAAkB,EAChC,OAAO,EAAE,MAAM,GACd,gBAAgB,CAQlB;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,GAAG,gBAAgB,CAEzE;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,gBAAgB,GACvB,MAAM,CAOR;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,qBAAqB,EAC1B,MAAM,EAAE,gBAAgB,GACvB,MAAM,CASR"}

package/dist/runtime/review-cost-cap.js

@@ -0,0 +1,182 @@
+/**
+ * REV-COST — runner-side per-review cost cap (size-scaled).
+ *
+ * THE EPISODE (PR #1937). The runner reviewer applied the org's FLAT
+ * `max_cost_usd_per_review` and, the instant the spend crossed it, discarded the
+ * review with `cost_cap_exceeded`. #1937 is a ~1800-line PR: it cost ~$18 against
+ * an $8 flat cap and produced NO verdict at all — the money was spent, the
+ * analysis was done, and the harness threw both away, then re-charged the same
+ * review on the next tick. That is the measured 239-decisions-over-9-tasks loop
+ * AU-5 fixed on the SERVER path (api/_lib/cost-cap.ts) and left unfixed here,
+ * which is why a large PR could still be stranded whenever a runner picked the
+ * broadcast up (the normal case — the server path is the emergency fallback).
+ *
+ * This module is the runner's copy of AU-5's PURE cost-cap core:
+ *
+ *   • `effectiveReviewCostCap` — the cap for THIS review, scaled by assembled
+ *     diff size, FLOORED at the org's flat cap (so a median PR is judged against
+ *     exactly today's number — never inflated) and CLAMPED at
+ *     REVIEW_CAP_MAX_MULTIPLE.
+ *   • `foldReviewCostLedger` — the chargeable-vs-infra split. Only PRODUCTIVE
+ *     attempts (a spawn that returned a readable reviewer envelope) are charged
+ *     to the cap; capacity/auth/tooling faults are reported but never charged.
+ *   • `classifyReviewCost` — within / overrun / runaway. `overrun` keeps the
+ *     verdict (the money is already spent; discarding it only strands the PR);
+ *     `runaway` is the hard backstop that still refuses.
+ *
+ * The runner is a standalone published package and cannot import from api/_lib
+ * (the same convention as the duplicated PRICING / MODEL_ALIASES maps and
+ * review-diff-guard.ts). KEEP IN SYNC with the AU-5 block at the bottom of
+ * api/_lib/cost-cap.ts — the constants and all three functions are pinned
+ * byte-for-behaviour by tests/unit/revcost1-runner-cap-parity.test.ts, which
+ * fails the build the moment the two drift.
+ */
+/**
+ * Assembled-diff size the flat cap is treated as calibrated for: the measured
+ * p50 production churn (750 changed lines ≈ 30k chars of unified diff). At or
+ * below this the effective cap is EXACTLY `max_cost_usd_per_review`.
+ * Mirrors api/_lib/cost-cap.ts. // keep in sync
+ */
+export const REVIEW_CAP_REFERENCE_DIFF_CHARS = 30_000;
+/** Fraction of the base cap added per reference-diff-worth of EXCESS size. */
+export const REVIEW_CAP_SIZE_SLOPE = 0.5;
+/**
+ * Ceiling on the scaled cap as a multiple of the base cap. Deliberately tight
+ * (1.5× → $3.00 at a $2 base) because the measured size↔cost correlation is
+ * weak (Pearson r = 0.100): a bigger ramp would be unjustified by the data.
+ */
+export const REVIEW_CAP_MAX_MULTIPLE = 1.5;
+/**
+ * Multiple of the effective cap above which an already-PAID review is still
+ * discarded as a runaway — the hard backstop that survives this change. Between
+ * 1× and this, the verdict is KEPT and flagged (`cost_overrun`) instead of
+ * stranding the PR.
+ */
+export const REVIEW_COST_OVERRUN_TOLERANCE = 3;
+/**
+ * The size-scaled per-review cost cap. Monotone non-decreasing in `diffChars`,
+ * floored at `baseCapUsd` (so it can only ever LOOSEN relative to the flat cap —
+ * a small PR's effective cap is unchanged) and clamped at
+ * `REVIEW_CAP_MAX_MULTIPLE × baseCapUsd`. Pure.
+ *
+ * A base cap of 0 (or a non-finite/negative one) means "cap disabled" — the
+ * existing `max_cost_usd_per_review > 0` semantics — and is returned verbatim.
+ *
+ * Mirrors api/_lib/cost-cap.ts `effectiveReviewCostCap`. // keep in sync
+ */
+export function effectiveReviewCostCap(baseCapUsd, diffChars) {
+    const base = typeof baseCapUsd === "number" && Number.isFinite(baseCapUsd) && baseCapUsd > 0
+        ? baseCapUsd
+        : 0;
+    const chars = typeof diffChars === "number" && Number.isFinite(diffChars) && diffChars > 0
+        ? diffChars
+        : 0;
+    if (base === 0) {
+        return {
+            cap_usd: 0,
+            base_cap_usd: 0,
+            enabled: false,
+            diff_chars: chars,
+            scale: 1,
+            ceiling_applied: false,
+            runaway_usd: 0,
+        };
+    }
+    const excess = Math.max(0, chars - REVIEW_CAP_REFERENCE_DIFF_CHARS);
+    const raw = 1 + (REVIEW_CAP_SIZE_SLOPE * excess) / REVIEW_CAP_REFERENCE_DIFF_CHARS;
+    const scale = Math.min(raw, REVIEW_CAP_MAX_MULTIPLE);
+    const cap = base * scale;
+    return {
+        cap_usd: cap,
+        base_cap_usd: base,
+        enabled: true,
+        diff_chars: chars,
+        scale,
+        ceiling_applied: raw > REVIEW_CAP_MAX_MULTIPLE,
+        runaway_usd: cap * REVIEW_COST_OVERRUN_TOLERANCE,
+    };
+}
+function usableUsd(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+/**
+ * Fold an attempt list into the chargeable / infra split. Pure.
+ * Mirrors api/_lib/cost-cap.ts `foldReviewCostLedger`. // keep in sync
+ */
+export function foldReviewCostLedger(attempts) {
+    let chargeable = 0;
+    let infra = 0;
+    let productiveN = 0;
+    let infraN = 0;
+    for (const a of attempts) {
+        const cost = usableUsd(a.cost_usd);
+        if (a.attempt_class === "productive") {
+            chargeable += cost;
+            productiveN += 1;
+        }
+        else {
+            infra += cost;
+            infraN += 1;
+        }
+    }
+    return {
+        attempts,
+        chargeable_usd: chargeable,
+        infra_usd: infra,
+        total_usd: chargeable + infra,
+        productive_attempts: productiveN,
+        infra_attempts: infraN,
+    };
+}
+export function classifyReviewCost(chargeableUsd, cap) {
+    if (!cap.enabled)
+        return "within";
+    const spent = usableUsd(chargeableUsd);
+    if (spent <= cap.cap_usd)
+        return "within";
+    return spent > cap.runaway_usd ? "runaway" : "overrun";
+}
+/** Open a cost context for a review over `diffChars` of assembled diff. */
+export function openReviewCostContext(baseCapUsd, diffChars) {
+    return { cap: effectiveReviewCostCap(baseCapUsd, diffChars), attempts: [] };
+}
+/** Record one attempt and return the folded ledger. */
+export function chargeReviewAttempt(ctx, modelId, attemptClass, costUsd) {
+    ctx.attempts.push({
+        attempt: ctx.attempts.length + 1,
+        model_id: modelId,
+        attempt_class: attemptClass,
+        cost_usd: costUsd,
+    });
+    return foldReviewCostLedger(ctx.attempts);
+}
+/** The current folded ledger without recording anything. */
+export function reviewCostLedger(ctx) {
+    return foldReviewCostLedger(ctx.attempts);
+}
+/**
+ * Advisory reason for an ACCEPTED overrun. Deliberately phrased to match none of
+ * the absence-claim patterns in review-chunking.ts (asserted by this wave's
+ * test), so an audit line can never be re-read as a read-coverage claim.
+ */
+export function reviewCostOverrunReason(cap, ledger) {
+    return (`cost_overrun: review cost $${ledger.chargeable_usd.toFixed(4)} exceeded the ` +
+        `effective cap $${cap.cap_usd.toFixed(2)} (base $${cap.base_cap_usd.toFixed(2)}, ` +
+        `scale ${cap.scale.toFixed(2)}×, ${cap.diff_chars} chars of assembled changes) — ` +
+        `verdict KEPT (already paid) and escalated for cap ratification`);
+}
+/**
+ * Refusal reason for a RUNAWAY — the backstop above the scaled cap. Carries the
+ * PRODUCTIVE attempt count, which is what distinguishes a single-pass runaway
+ * from a chunked review that accumulated past the tolerance over several part
+ * passes (the old chunked-only reason string), without needing two call sites.
+ */
+export function reviewCostRunawayReason(cap, ledger) {
+    const n = ledger.productive_attempts;
+    return (`reviewer cost $${ledger.chargeable_usd.toFixed(4)} across ${n} productive ` +
+        `${n === 1 ? "attempt" : "attempts"} exceeded cap $${cap.cap_usd.toFixed(2)} ` +
+        `(base $${cap.base_cap_usd.toFixed(2)}, scale ${cap.scale.toFixed(2)}×) by more ` +
+        `than the ${REVIEW_COST_OVERRUN_TOLERANCE}× runaway tolerance ` +
+        `($${cap.runaway_usd.toFixed(2)}) — verdict refused`);
+}
+//# sourceMappingURL=review-cost-cap.js.map

package/dist/runtime/review-cost-cap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-cost-cap.js","sourceRoot":"","sources":["../../src/runtime/review-cost-cap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,MAAM,CAAC;AACtD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAmB/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,IAAI,GACR,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAC7E,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QAC1E,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,CAAC;IACR,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,CAAC;YACR,eAAe,EAAE,KAAK;YACtB,WAAW,EAAE,CAAC;SACf,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,+BAA+B,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,qBAAqB,GAAG,MAAM,CAAC,GAAG,+BAA+B,CAAC;IACnF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,KAAK,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,YAAY,EAAE,IAAI;QAClB,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,KAAK;QACjB,KAAK;QACL,eAAe,EAAE,GAAG,GAAG,uBAAuB;QAC9C,WAAW,EAAE,GAAG,GAAG,6BAA6B;KACjD,CAAC;AACJ,CAAC;AA+CD,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA6B;IAE7B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YACrC,UAAU,IAAI,IAAI,CAAC;YACnB,WAAW,IAAI,CAAC,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,IAAI,CAAC;YACd,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ;QACR,cAAc,EAAE,UAAU;QAC1B,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,UAAU,GAAG,KAAK;QAC7B,mBAAmB,EAAE,WAAW;QAChC,cAAc,EAAE,MAAM;KACvB,CAAC;AACJ,CAAC;AAeD,MAAM,UAAU,kBAAkB,CAChC,aAAqB,EACrB,GAA0B;IAE1B,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAeD,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,SAAiB;IAEjB,OAAO,EAAE,GAAG,EAAE,sBAAsB,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC9E,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CACjC,GAAsB,EACtB,OAAe,EACf,YAAgC,EAChC,OAAe;IAEf,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAChC,QAAQ,EAAE,OAAO;QACjB,aAAa,EAAE,YAAY;QAC3B,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAC;IACH,OAAO,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,OAAO,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAA0B,EAC1B,MAAwB;IAExB,OAAO,CACL,8BAA8B,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB;QAC9E,kBAAkB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAClF,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,iCAAiC;QAClF,gEAAgE,CACjE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAA0B,EAC1B,MAAwB;IAExB,MAAM,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACrC,OAAO,CACL,kBAAkB,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc;QAC5E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,kBAAkB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG;QAC9E,UAAU,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;QACjF,YAAY,6BAA6B,sBAAsB;QAC/D,KAAK,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CACrD,CAAC;AACJ,CAAC"}