@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/ci/actions-pipeline.js

@@ -0,0 +1,279 @@
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { createCiPipeline } from "./factories.js";
+import { materializeForgeActions } from "./profiles/catalog.js";
+// One module owns the runtime-catalog resolvers (profiles + publish targets) the
+// operational entrypoints default to, so this file stays the pure compiler.
+import { resolveRuntimeCiCatalogs } from "./runtime-catalogs.js";
+import { getForgeCiPublishTarget } from "./publish-targets.js";
+import { ActionsSchema, DEFAULT_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES, DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE, StepSchema, isPublishStep, isReviewStep, isRunbookStep, isRunStep, isScheduleTrigger } from "../schemas/actions.js";
+export const FORGE_ACTIONS_PIPELINE_ID = 'forge-actions';
+export const FORGE_ACTIONS_PATH = '.forge/actions.yml';
+/**
+ * Resolve public Forge Actions policy once so hashing, persistence, scheduling,
+ * and executor dispatch do not independently reinterpret defaults.
+ */
+export function resolveForgeActionsJobExecutionPolicy(job) {
+    const os = job.runsOn ?? 'linux';
+    const arch = job.arch ?? 'x64';
+    // Placement is authored, never inferred. Silently promoting a deploy job to
+    // the fleet profile changed the machine class under every repository at
+    // once — and for an owner with no enrolled machine it turned a slow deploy
+    // into an immediately failing one. A repository opts in with
+    // `runnerProfile: fleet`.
+    const runnerProfile = job.runnerProfile ?? DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE;
+    const timeoutMinutes = job.timeoutMinutes ?? DEFAULT_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES;
+    const baseRunnerId = `${os}/${arch}`;
+    return {
+        runnerId: runnerProfile === DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE
+            ? baseRunnerId
+            : `${baseRunnerId}/${runnerProfile}`,
+        runnerProfile,
+        runnerLabels: [`os:${os}`, `arch:${arch}`, `profile:${runnerProfile}`],
+        jobTimeoutSeconds: timeoutMinutes * 60
+    };
+}
+function triggers(job) {
+    // A job-level `paths` filter is trigger policy, so it rides every push/pr
+    // trigger it applies to. It is part of the immutable pipeline identity: two
+    // authored pipelines that differ only by path filter must not share a
+    // descriptor hash.
+    const paths = job.paths?.length ? { paths: [...job.paths] } : {};
+    return job.on.map((trigger) => {
+        if (isScheduleTrigger(trigger)) {
+            return { event: 'schedule', schedule: trigger.schedule };
+        }
+        return { event: trigger === 'pr' ? 'pull_request' : 'push', ...paths };
+    });
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * Public CLI installer — the same one `buildFleetCloudInit` curl-installs onto
+ * every fleet-provisioned host. A fleet machine therefore already satisfies
+ * this; re-running it there is a no-op because the guard below short-circuits.
+ */
+/** Where that installer places the binary when VIBES_INSTALL_DIR is unset. */
+export const FORGE_CI_CLI_BIN_DIR = '$HOME/.local/bin';
+/** Bootstrap the binary, then prove the authored command's host is available. */
+function requireCliOrigin(cliOrigin) {
+    if (cliOrigin)
+        return cliOrigin;
+    throw new CapabilityError('Forge Actions command requires the runtime-resolved CLI service origin', 'NOT_FOUND', {
+        reason: 'service-undeclared',
+        details: { kind: 'infra/service', id: 'cli' }
+    });
+}
+/**
+ * The checkout's own declared CLI: the build-executor entry of the
+ * `@vibesdotdev/bin` the checkout installed, run against the checkout root.
+ */
+export const FORGE_CI_CHECKOUT_CLI = 'node_modules/@vibesdotdev/bin/checkout.mjs';
+function withVibesOnPath(invocation, cliOrigin) {
+    // A checkout that declares `@vibesdotdev/bin` runs ITS CLI, rooted at the
+    // checkout (`checkout.mjs <root>`: the checkout's graph, custody and
+    // attestation), never whatever `vibes` the executor's PATH carries; a
+    // runner's preinstalled CLI is a different graph from the one the checkout
+    // locked. `vibes` below is that function. Only a checkout that declares no
+    // CLI falls back to the executor's PATH: prepend the installer directory
+    // when that lookup misses, then install when it is still missing. Qualified
+    // help reaches the real host; top-level --help and --version do not.
+    return `vibes_ci_checkout_root=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+if [ -f "$vibes_ci_checkout_root/${FORGE_CI_CHECKOUT_CLI}" ]; then
+  vibes() { bun "$vibes_ci_checkout_root/${FORGE_CI_CHECKOUT_CLI}" "$vibes_ci_checkout_root" "$@"; }
+elif ! command -v vibes >/dev/null 2>&1; then
+  export PATH="${FORGE_CI_CLI_BIN_DIR}:$PATH"
+  if ! command -v vibes >/dev/null 2>&1; then
+  (
+    vibes_ci_bootstrap_dir=$(mktemp -d) || exit $?
+    trap 'rm -rf "$vibes_ci_bootstrap_dir"' 0
+    trap 'exit 129' HUP
+    trap 'exit 130' INT
+    trap 'exit 143' TERM
+    if curl --disable --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --connect-timeout 15 --max-time 60 --max-filesize 1048576 --dump-header "$vibes_ci_bootstrap_dir/headers" --output "$vibes_ci_bootstrap_dir/install.sh" ${shellQuote(new URL('install.sh', cliOrigin.replace(/\/$/, '') + '/').href)}; then
+      sh "$vibes_ci_bootstrap_dir/install.sh" || exit $?
+    else
+      vibes_ci_download_status=$?
+      printf '%s\\n' 'Forge CI: CLI installer download failed; public response diagnostics:' >&2
+      LC_ALL=C awk '
+        NR > 64 || count >= 8 { exit }
+        $1 ~ /^HTTP/ && $2 ~ /^[0-9][0-9][0-9]/ { print "HTTP status:", substr($2, 1, 3); count++; next }
+        {
+          name = tolower($1)
+          if (name == "cf-ray:" || name == "cf-mitigated:" || name == "server:") {
+            value = $2
+            gsub(/[^[:alnum:]._-]/, "", value)
+            print name, substr(value, 1, 120)
+            count++
+          }
+        }
+      ' "$vibes_ci_bootstrap_dir/headers" >&2
+      exit "$vibes_ci_download_status"
+    fi
+  ) || exit $?
+  fi
+fi
+${invocation} --help >/dev/null || exit $?
+${invocation}`;
+}
+/**
+ * The argv one validated publish step shells, in the order the publish CLI
+ * expects: the descriptor's command prefix, the package roots (authored, or the
+ * descriptor's defaults), the confirmation flags, then the release contract.
+ *
+ * `step` is the value `PublishStepSchema` returned, so every path is already
+ * proven a safe repository-relative package root (never an option) and
+ * `releaseContractVersion` is the one contract this compiler can lower.
+ */
+function publishArgv(step, publishTargets) {
+    const descriptor = getForgeCiPublishTarget(step.publish, publishTargets?.());
+    const argv = [...descriptor.argv, ...(step.paths ?? descriptor.defaultPaths), '--yes', '--output', 'json'];
+    if (step.releaseContractVersion !== undefined) {
+        argv.push('--release-contract-version', String(step.releaseContractVersion));
+    }
+    return argv;
+}
+/**
+ * The exact shell one VALIDATED step runs.
+ *
+ * `step` must be the value returned by `ActionsSchema` or `StepSchema`; the
+ * public entrypoints validate before lowering, so this helper does not
+ * reinterpret an unvalidated shape.
+ *
+ * Exported because the dispatch payload needs the SAME translation the pipeline
+ * descriptor gets. It did not have it: dispatch kept its own copy that emitted a
+ * bare `vibes infra deploy run …` argv, so every deploy step exited 127 with
+ * `vibes: command not found` while the descriptor — used only for status checks
+ * — carried the prelude that would have prevented it. One translation, one
+ * place, or the two drift exactly this way.
+ */
+export function forgeStepShellCommand(step, cliOrigin, publishTargets) {
+    if (isRunStep(step))
+        return step.run;
+    if (isRunbookStep(step)) {
+        const argv = ['vibes', 'dev', 'runbooks', 'run', step.runbook];
+        if (step.input)
+            argv.push('--input', JSON.stringify(step.input));
+        return withVibesOnPath(argv.map(shellQuote).join(' '), requireCliOrigin(cliOrigin));
+    }
+    if (isReviewStep(step)) {
+        // A review is not a shell step: the Forge control plane enqueues the independent PR review
+        // (dispatch routes review jobs to it). The descriptor records what runs, never a fake command.
+        const scope = step.capabilities?.length ? ` (${step.capabilities.join(', ')})` : '';
+        return `echo ${shellQuote(`Forge control-plane review: ${step.review}${scope}`)}`;
+    }
+    if (isPublishStep(step)) {
+        // The command a publish target shells is descriptor data, never a branch
+        // here: a plugin registers a `ci/publish-target` and this compiles it.
+        return withVibesOnPath(publishArgv(step, publishTargets).map(shellQuote).join(' '), requireCliOrigin(cliOrigin));
+    }
+    const argv = ['vibes', 'infra', 'deploy', 'run', step.deploy];
+    if (step.environment)
+        argv.push('--environment', step.environment);
+    argv.push('--output', 'json');
+    return withVibesOnPath(argv.map(shellQuote).join(' '), requireCliOrigin(cliOrigin));
+}
+/**
+ * The exact shell one authored step runs, validated through `StepSchema` first.
+ *
+ * A step that reaches this from a caller the compiler did not validate (a
+ * dispatch payload, a hand-built call) is validated here, so a malformed publish
+ * path or an unsupported release contract refuses before any command exists.
+ */
+export function forgeStepCommand(step, cliOrigin, publishTargets) {
+    return forgeStepShellCommand(StepSchema.parse(step), cliOrigin, publishTargets);
+}
+function command(step, index, cliOrigin, publishTargets) {
+    return { name: `step-${index + 1}`, run: forgeStepShellCommand(step, cliOrigin, publishTargets) };
+}
+/**
+ * Compile repository-authored Forge Actions into a provider-neutral CI descriptor.
+ *
+ * `ActionsSchema` validates the authored document, including each nested job
+ * and step, before lowering. Profile jobs are parsed through `JobSchema` when
+ * materialized. A malformed `paths: ['--dry-run']` or
+ * `releaseContractVersion: 1` therefore refuses before it can compile into a
+ * command.
+ */
+export function compileForgeActionsPipeline(input) {
+    const authored = ActionsSchema.parse(input.actions);
+    const actions = materializeForgeActions(authored, input.profiles);
+    const jobs = actions.jobs ?? {};
+    const runners = new Map();
+    for (const job of Object.values(jobs)) {
+        const execution = resolveForgeActionsJobExecutionPolicy(job);
+        const runner = runners.get(execution.runnerId);
+        if (!runner) {
+            runners.set(execution.runnerId, {
+                id: execution.runnerId,
+                provider: 'vibes-forge-runtime',
+                concurrency: 1,
+                timeoutSeconds: execution.jobTimeoutSeconds,
+                labels: execution.runnerLabels,
+                config: { profile: execution.runnerProfile }
+            });
+        }
+        else if (execution.jobTimeoutSeconds > runner.timeoutSeconds) {
+            // A pool may serve jobs with different deadlines. Its descriptor carries
+            // the largest requested budget while each suite retains its exact deadline.
+            runner.timeoutSeconds = execution.jobTimeoutSeconds;
+        }
+    }
+    return createCiPipeline({
+        id: FORGE_ACTIONS_PIPELINE_ID,
+        name: 'Forge Actions',
+        source: {
+            provider: 'vibes-forge',
+            repository: input.repository,
+            defaultBranch: input.defaultBranch,
+            config: { format: 'forge-actions/v1', path: FORGE_ACTIONS_PATH }
+        },
+        controlPlane: { provider: 'vibes-runtime' },
+        reporting: {
+            provider: 'vibes-forge-statuses',
+            // A job with `required: false` reports advisory status: not a required context.
+            requiredContexts: Object.entries(jobs).filter(([, job]) => job.required).map(([id]) => `forge/${id}`)
+        },
+        runners: [...runners.values()],
+        suites: Object.entries(jobs).map(([id, job]) => {
+            const execution = resolveForgeActionsJobExecutionPolicy(job);
+            const commands = job.steps.map((step, index) => command(step, index, input.cliOrigin, input.publishTargets));
+            return {
+                id,
+                context: `forge/${id}`,
+                runner: execution.runnerId,
+                triggers: triggers(job),
+                condition: job.if,
+                needs: job.needs ?? [],
+                commands,
+                allowFailures: [],
+                timeoutSeconds: execution.jobTimeoutSeconds,
+                artifacts: job.artifacts ?? []
+            };
+        })
+    });
+}
+/** Operational entrypoint: retain the pure compiler while resolving the host's CLI target, profile catalog, and publish targets. */
+export async function compileForgeActionsPipelineForRuntime(runtime, input) {
+    const catalogs = resolveRuntimeCiCatalogs(runtime);
+    const cliOrigin = input.cliOrigin ?? (await serviceOrigin(runtime, 'cli'));
+    // A host with a runtime materializes from what it registers: a plugin
+    // that replaces `ci.profile.web` or adds a publish target changes this
+    // output without the caller supplying a resolver. An explicitly supplied
+    // resolver still wins over the runtime catalog.
+    const resolved = {
+        ...input,
+        cliOrigin,
+        profiles: input.profiles ?? catalogs.profiles,
+        publishTargets: input.publishTargets ?? catalogs.publishTargets
+    };
+    return compileForgeActionsPipeline(resolved);
+}
+/** Operational dispatch uses the same installer, step validation, and publish-target selection as pipeline compilation. */
+export async function forgeStepShellCommandForRuntime(runtime, step) {
+    const validated = StepSchema.parse(step);
+    const publishTargets = isPublishStep(validated) ? resolveRuntimeCiCatalogs(runtime).publishTargets : undefined;
+    return forgeStepShellCommand(validated, await serviceOrigin(runtime, 'cli'), publishTargets);
+}
+//# sourceMappingURL=actions-pipeline.js.map

package/dist/ci/actions-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-pipeline.js","sourceRoot":"","sources":["../../src/ci/actions-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAwB,MAAM,uBAAuB,CAAC;AACtF,iFAAiF;AACjF,4EAA4E;AAC5E,OAAO,EAAE,wBAAwB,EAA8B,MAAM,uBAAuB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE/D,OAAO,EACN,aAAa,EACb,yCAAyC,EACzC,oCAAoC,EACpC,UAAU,EACV,aAAa,EACb,YAAY,EACZ,aAAa,EACb,SAAS,EACT,iBAAiB,EAOjB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AA2BvD;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CACpD,GAAa;IAEb,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC;IAC/B,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,6DAA6D;IAC7D,0BAA0B;IAC1B,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,IAAI,oCAAoC,CAAC;IAChF,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,yCAAyC,CAAC;IACvF,MAAM,YAAY,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IACrC,OAAO;QACN,QAAQ,EACP,aAAa,KAAK,oCAAoC;YACrD,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,GAAG,YAAY,IAAI,aAAa,EAAE;QACtC,aAAa;QACb,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,IAAI,EAAE,EAAE,WAAW,aAAa,EAAE,CAAC;QACtE,iBAAiB,EAAE,cAAc,GAAG,EAAE;KACtC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACzB,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,mBAAmB;IACnB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,SAA6B;IACtD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,IAAI,eAAe,CAAC,wEAAwE,EAAE,WAAW,EAAE;QAChH,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,KAAK,EAAE;KAC7C,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,4CAA4C,CAAC;AAElF,SAAS,eAAe,CAAC,UAAkB,EAAE,SAAiB;IAC7D,0EAA0E;IAC1E,qEAAqE;IACrE,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,OAAO;mCAC2B,qBAAqB;2CACb,qBAAqB;;iBAE/C,oBAAoB;;;;;;;;gQAQ2N,UAAU,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;EAuBxU,UAAU;EACV,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,IAAiB,EAAE,cAA4C;IACnF,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3G,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACpC,IAAU,EACV,SAAkB,EAClB,cAA4C;IAE5C,IAAI,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,2FAA2F;QAC3F,+FAA+F;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,QAAQ,UAAU,CAAC,+BAA+B,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,eAAe,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,WAAW;QAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC/B,IAAa,EACb,SAAkB,EAClB,cAA4C;IAE5C,OAAO,qBAAqB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,IAAU,EAAE,KAAa,EAAE,SAAkB,EAAE,cAA4C;IAC3G,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;AACnG,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAC1C,KAAuC;IAEvC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,qCAAqC,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAC/B,EAAE,EAAE,SAAS,CAAC,QAAQ;gBACtB,QAAQ,EAAE,qBAAqB;gBAC/B,WAAW,EAAE,CAAC;gBACd,cAAc,EAAE,SAAS,CAAC,iBAAiB;gBAC3C,MAAM,EAAE,SAAS,CAAC,YAAY;gBAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,aAAa,EAAE;aAC5C,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,CAAC,iBAAiB,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;YAChE,yEAAyE;YACzE,4EAA4E;YAC5E,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC,iBAAiB,CAAC;QACrD,CAAC;IACF,CAAC;IAED,OAAO,gBAAgB,CAAC;QACvB,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE;YACP,QAAQ,EAAE,aAAa;YACvB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,kBAAkB,EAAE;SAChE;QACD,YAAY,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE;QAC3C,SAAS,EAAE;YACV,QAAQ,EAAE,sBAAsB;YAChC,gFAAgF;YAChF,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC;SACrG;QACD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YAC9C,MAAM,SAAS,GAAG,qCAAqC,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9C,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,cAAc,CAAC,CAC3D,CAAC;YACF,OAAO;gBACN,EAAE;gBACF,OAAO,EAAE,SAAS,EAAE,EAAE;gBACtB,MAAM,EAAE,SAAS,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACvB,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtB,QAAQ;gBACR,aAAa,EAAE,EAAE;gBACjB,cAAc,EAAE,SAAS,CAAC,iBAAiB;gBAC3C,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;aAC9B,CAAC;QACH,CAAC,CAAC;KACF,CAAC,CAAC;AACJ,CAAC;AAED,oIAAoI;AACpI,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAC1D,OAAmB,EACnB,KAAuC;IAEvC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,sEAAsE;IACtE,uEAAuE;IACvE,yEAAyE;IACzE,gDAAgD;IAChD,MAAM,QAAQ,GAAqC;QAClD,GAAG,KAAK;QACR,SAAS;QACT,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QAC7C,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;KAC/D,CAAC;IACF,OAAO,2BAA2B,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,2HAA2H;AAC3H,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,OAAmB,EAAE,IAAa;IACvF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/G,OAAO,qBAAqB,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;AAC9F,CAAC"}

package/dist/ci/cache-plan.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Canonical per-job cache plans.
+ *
+ * A `.forge/actions.yml` cache declaration is author intent only. This module
+ * is the one place where intent meets policy facts: `deriveCiCachePolicy`
+ * decides effective sensitivity and access tiers, `deriveCiCacheTaskHash`
+ * fixes the cache-miss identity, and the resulting `ForgeCiJobCachePlan` is
+ * the typed material an execution payload carries so a worker can restore and
+ * publish without re-deriving trust.
+ *
+ * A declaration that fails policy throws `CiCachePlanError`; nothing here
+ * downgrades a rejected declaration into a silent cache miss. A declaration
+ * with no classification yields effective `disabled` (the policy default) and
+ * therefore no plan.
+ */
+import * as z from 'zod/v4';
+import type { Actions, Job } from '../schemas/actions.ts';
+import type { CiCredentialReference } from './schemas.ts';
+/**
+ * The typed per-job cache plan carried by an execution payload.
+ *
+ * It holds exactly what is deterministic at compile time: policy identity,
+ * the task hash, and the envelope/key material the worker needs. Runtime
+ * facts — `bodyDigest`, `producerCommit`, `trustTier`, `signature`,
+ * `createdAt` — stay with the worker and the trusted control plane.
+ */
+export declare const ForgeCiJobCachePlanSchema: z.ZodObject<{
+    jobId: z.ZodString;
+    repository: z.ZodString;
+    namespace: z.ZodString;
+    taskId: z.ZodString;
+    taskHash: z.ZodString;
+    sensitivity: z.ZodEnum<{
+        "public-reproducible": "public-reproducible";
+        "trusted-only": "trusted-only";
+    }>;
+    toolchain: z.ZodString;
+    signatureAlgorithm: z.ZodLiteral<"ed25519">;
+    artifactKey: z.ZodString;
+}, z.core.$strict>;
+export type ForgeCiJobCachePlan = z.infer<typeof ForgeCiJobCachePlanSchema>;
+export type ForgeCiJobCachePlanInput = z.input<typeof ForgeCiJobCachePlanSchema>;
+/**
+ * Policy facts resolved from the job/run. These are never author-granted: the
+ * declaration schema is strict and has no fields for them.
+ */
+export interface ForgeJobCachePolicyFacts {
+    credentialReferences?: readonly CiCredentialReference[];
+    secretBindings?: readonly string[];
+    privileged?: boolean;
+}
+export interface CompileJobCachesInput {
+    /** Parsed `.forge/actions.yml`; profile jobs are materialized first. */
+    actions: Actions;
+    /** Normalized owner/repository identity. */
+    repository: string;
+    /** Toolchain identity that participates in the task hash. */
+    toolchain: string;
+    /**
+     * Per-job toolchain identity, evaluated after profile materialization. The
+     * executor that will run a job owns its toolchain identity, and the identity
+     * participates in the task hash: a job executed on another substrate (an
+     * enrolled fleet host vs the isolated sandbox image) must not inherit a
+     * toolchain it never runs on. Returning `undefined` falls back to
+     * `toolchain`.
+     */
+    toolchainForJob?: (input: {
+        jobId: string;
+        job: Job;
+    }) => string | undefined;
+    /** Default runner platform for jobs that do not declare `runsOn`. */
+    platform: string;
+    /** Default runner CPU architecture for jobs that do not declare `arch`. */
+    arch: string;
+    /** Resolved SHA-256 digests of declared key files, by job id and path. */
+    keyFileDigests?: Readonly<Record<string, Readonly<Record<string, string>>>>;
+    /** Policy facts derived from each job/run, by job id. */
+    policyFacts?: Readonly<Record<string, ForgeJobCachePolicyFacts>>;
+}
+/**
+ * Compile every authored cache declaration into a typed plan.
+ *
+ * Jobs without a declaration produce nothing. A declaration with no
+ * classification is the policy's disabled default: it also produces nothing.
+ * A declaration whose declared sensitivity conflicts with a policy fact (for
+ * example `public-reproducible` on a privileged or secret-bearing run) throws
+ * `CiCachePlanError` with the policy's reasons. A declared key file without a
+ * resolved digest is a compile error, because hashing a missing file would
+ * otherwise mint a cache identity for unknown content. The toolchain identity
+ * is resolved per materialized job through `toolchainForJob` when provided, so
+ * a job executed by another substrate does not compile the context toolchain.
+ */
+export declare function compileJobCaches(input: CompileJobCachesInput): Promise<ForgeCiJobCachePlan[]>;
+//# sourceMappingURL=cache-plan.d.ts.map

package/dist/ci/cache-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-plan.d.ts","sourceRoot":"","sources":["../../src/ci/cache-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAgB1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;kBAqB5B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,oBAAoB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACrC,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,KAAK,MAAM,GAAG,SAAS,CAAC;IAC7E,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,yDAAyD;IACzD,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;CACjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,qBAAqB,GAC1B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAgEhC"}

package/dist/ci/cache-plan.js

@@ -0,0 +1,128 @@
+/**
+ * Canonical per-job cache plans.
+ *
+ * A `.forge/actions.yml` cache declaration is author intent only. This module
+ * is the one place where intent meets policy facts: `deriveCiCachePolicy`
+ * decides effective sensitivity and access tiers, `deriveCiCacheTaskHash`
+ * fixes the cache-miss identity, and the resulting `ForgeCiJobCachePlan` is
+ * the typed material an execution payload carries so a worker can restore and
+ * publish without re-deriving trust.
+ *
+ * A declaration that fails policy throws `CiCachePlanError`; nothing here
+ * downgrades a rejected declaration into a silent cache miss. A declaration
+ * with no classification yields effective `disabled` (the policy default) and
+ * therefore no plan.
+ */
+import * as z from 'zod/v4';
+import { CiCacheBodyDigestSchema, CiCacheNamespaceSchema, CiCachePlanError, CiCacheRepositorySchema, CiCacheSensitivitySchema, CiCacheTaskHashSchema, CiCacheTaskIdSchema, CiCacheToolchainSchema, cacheArtifactKey, deriveCiCachePolicy, deriveCiCacheTaskHash } from "./cache-policy.js";
+import { materializeForgeActions } from "./profiles/catalog.js";
+/**
+ * The typed per-job cache plan carried by an execution payload.
+ *
+ * It holds exactly what is deterministic at compile time: policy identity,
+ * the task hash, and the envelope/key material the worker needs. Runtime
+ * facts — `bodyDigest`, `producerCommit`, `trustTier`, `signature`,
+ * `createdAt` — stay with the worker and the trusted control plane.
+ */
+export const ForgeCiJobCachePlanSchema = z
+    .object({
+    jobId: z.string().min(1).max(128),
+    repository: CiCacheRepositorySchema,
+    namespace: CiCacheNamespaceSchema,
+    taskId: CiCacheTaskIdSchema,
+    taskHash: CiCacheTaskHashSchema,
+    /** Effective policy sensitivity; `disabled` never emits a plan. */
+    sensitivity: CiCacheSensitivitySchema.exclude(['disabled']),
+    /** Envelope material: the toolchain identity the task hash was built with. */
+    toolchain: CiCacheToolchainSchema,
+    /** Envelope material: the signing algorithm the worker must present. */
+    signatureAlgorithm: z.literal('ed25519'),
+    /**
+     * Canonical artifact key for restore and publish
+     * (`public/<repository>/<namespace>/<taskHash>` from `cacheArtifactKey`).
+     * An untrusted PR writes to its run-scoped quarantine key derived from
+     * the same tuple plus the run id; that key is never persisted here.
+     */
+    artifactKey: z.string().min(1).max(512)
+})
+    .strict();
+/**
+ * Compile every authored cache declaration into a typed plan.
+ *
+ * Jobs without a declaration produce nothing. A declaration with no
+ * classification is the policy's disabled default: it also produces nothing.
+ * A declaration whose declared sensitivity conflicts with a policy fact (for
+ * example `public-reproducible` on a privileged or secret-bearing run) throws
+ * `CiCachePlanError` with the policy's reasons. A declared key file without a
+ * resolved digest is a compile error, because hashing a missing file would
+ * otherwise mint a cache identity for unknown content. The toolchain identity
+ * is resolved per materialized job through `toolchainForJob` when provided, so
+ * a job executed by another substrate does not compile the context toolchain.
+ */
+export async function compileJobCaches(input) {
+    const actions = materializeForgeActions(input.actions);
+    const jobs = actions.jobs ?? {};
+    const plans = [];
+    for (const [jobId, job] of Object.entries(jobs)) {
+        const declaration = job.cache;
+        if (!declaration)
+            continue;
+        const facts = input.policyFacts?.[jobId] ?? {};
+        const policyInput = {
+            repository: input.repository,
+            taskId: declaration.taskId,
+            namespace: declaration.namespace ?? declaration.taskId,
+            credentialReferences: [...(facts.credentialReferences ?? [])],
+            secretBindings: [...(facts.secretBindings ?? [])],
+            privileged: facts.privileged ?? false
+        };
+        if (declaration.sensitivity)
+            policyInput.declaredSensitivity = declaration.sensitivity;
+        const policy = deriveCiCachePolicy(policyInput);
+        if (policy.effectiveSensitivity === 'disabled')
+            continue;
+        // The executing executor owns the toolchain identity; the context value is
+        // the default only for jobs it does not resolve.
+        const toolchain = input.toolchainForJob?.({ jobId, job }) ?? input.toolchain;
+        const resolved = input.keyFileDigests?.[jobId] ?? {};
+        const keyFiles = (declaration.keyFiles ?? []).map((path) => {
+            const digest = resolved[path];
+            if (digest === undefined) {
+                throw new CiCachePlanError(['missing-key-file-digest', path]);
+            }
+            if (!CiCacheBodyDigestSchema.safeParse(digest).success) {
+                throw new CiCachePlanError(['invalid-key-file-digest', path]);
+            }
+            return { path, digest };
+        });
+        const taskHash = await deriveCiCacheTaskHash({
+            taskId: policy.taskId,
+            namespace: policy.namespace,
+            toolchain,
+            // A job that declares its runner axes owns the hash inputs: a macOS
+            // job in an otherwise linux pipeline must never inherit the linux
+            // cache identity. The context is the default only for undeclared axes.
+            platform: job.runsOn ?? input.platform,
+            arch: job.arch ?? input.arch,
+            keyFiles
+        });
+        plans.push(ForgeCiJobCachePlanSchema.parse({
+            jobId,
+            repository: policy.repository,
+            namespace: policy.namespace,
+            taskId: policy.taskId,
+            taskHash,
+            sensitivity: policy.effectiveSensitivity,
+            toolchain,
+            signatureAlgorithm: 'ed25519',
+            artifactKey: cacheArtifactKey({
+                mode: 'public',
+                repository: policy.repository,
+                namespace: policy.namespace,
+                taskHash
+            })
+        }));
+    }
+    return plans;
+}
+//# sourceMappingURL=cache-plan.js.map

package/dist/ci/cache-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-plan.js","sourceRoot":"","sources":["../../src/ci/cache-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EAErB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGhE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACxC,MAAM,CAAC;IACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,UAAU,EAAE,uBAAuB;IACnC,SAAS,EAAE,sBAAsB;IACjC,MAAM,EAAE,mBAAmB;IAC3B,QAAQ,EAAE,qBAAqB;IAC/B,mEAAmE;IACnE,WAAW,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,SAAS,EAAE,sBAAsB;IACjC,wEAAwE;IACxE,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC;;;;;OAKG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAwCX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,KAA4B;IAE5B,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,WAAW,GAA2B;YAC3C,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,MAAM;YACtD,oBAAoB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAC7D,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;YACjD,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK;SACrC,CAAC;QACF,IAAI,WAAW,CAAC,WAAW;YAAE,WAAW,CAAC,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC;QACvF,MAAM,MAAM,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,oBAAoB,KAAK,UAAU;YAAE,SAAS;QACzD,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC;QAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,gBAAgB,CAAC,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;YAC5C,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS;YACT,oEAAoE;YACpE,kEAAkE;YAClE,uEAAuE;YACvE,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ;YACtC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;YAC5B,QAAQ;SACR,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CACT,yBAAyB,CAAC,KAAK,CAAC;YAC/B,KAAK;YACL,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ;YACR,WAAW,EAAE,MAAM,CAAC,oBAAoB;YACxC,SAAS;YACT,kBAAkB,EAAE,SAAS;YAC7B,WAAW,EAAE,gBAAgB,CAAC;gBAC7B,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ;aACR,CAAC;SACF,CAAC,CACF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}