agent-bober 0.17.1 → 0.19.0

package/dist/orchestrator/security-knowledge/registry.js

@@ -0,0 +1,114 @@
+/**
+ * Retargets the old 3-entry `STACK_SKILL_MAP` (stack-knowledge.ts) to the 8
+ * `SecurityStackId`s and their `bober.security-<stack>` skill files
+ * (arch-20260712-security-audit-agent-team-architecture.md). Every
+ * `SecurityStackId` — including "generic" — has a real skill name; there is
+ * no `null` skill case anymore (the old resolver's `{skillName: null}`
+ * degrade path is replaced by the generic floor, sc-5-1).
+ */
+// ── Stack -> skill name ─────────────────────────────────────────────
+function skillNameForStackId(stackId) {
+    return `bober.security-${stackId}`;
+}
+const SECURITY_STACK_IDS = [
+    "solidity",
+    "anchor",
+    "react",
+    "node",
+    "payments",
+    "igaming",
+    "dex-backend",
+    "generic",
+];
+/** stackId -> skillName, 8 entries. The index iterates these to load each skill file. */
+export const STACK_SKILL_MAP_ENTRIES = SECURITY_STACK_IDS.map((stackId) => ({ stackId, skillName: skillNameForStackId(stackId) }));
+/**
+ * Substring match, lowercased. Order within this table does not encode
+ * precedence between stacks (a candidate matches at most one pattern in
+ * practice) — the blockchain/language-before-frontend/backend precedence
+ * comes from the candidate ORDER built in `candidatesFor`, ported from
+ * `detectStack` (stack-knowledge.ts:86-98).
+ */
+const STACK_KEYWORDS = [
+    { pattern: "solidity", stackId: "solidity" },
+    { pattern: "evm", stackId: "solidity" },
+    { pattern: "foundry", stackId: "solidity" },
+    { pattern: "hardhat", stackId: "solidity" },
+    { pattern: "anchor", stackId: "anchor" },
+    { pattern: "solana", stackId: "anchor" },
+    { pattern: "react", stackId: "react" },
+    { pattern: "next", stackId: "react" },
+    { pattern: "node", stackId: "node" },
+    { pattern: "express", stackId: "node" },
+    { pattern: "typescript", stackId: "node" },
+    { pattern: "nest", stackId: "node" },
+    { pattern: "fastify", stackId: "node" },
+    { pattern: "payment", stackId: "payments" },
+    { pattern: "stripe", stackId: "payments" },
+    { pattern: "pci", stackId: "payments" },
+    { pattern: "igaming", stackId: "igaming" },
+    { pattern: "casino", stackId: "igaming" },
+    { pattern: "betting", stackId: "igaming" },
+    { pattern: "wager", stackId: "igaming" },
+    { pattern: "dex", stackId: "dex-backend" },
+    { pattern: "amm", stackId: "dex-backend" },
+    { pattern: "orderbook", stackId: "dex-backend" },
+];
+/**
+ * Precedence ported verbatim from `detectStack` (stack-knowledge.ts:86-98):
+ * blockchain and language fields are checked before frontend/backend/testing/
+ * database/other, since blockchain-specific values are more determinative of
+ * the security checklist to use than a generic frontend/backend framework.
+ */
+function candidatesFor(stack) {
+    const candidates = [];
+    if (typeof stack === "string") {
+        if (stack.trim().length > 0)
+            candidates.push(stack);
+    }
+    else if (stack && typeof stack === "object") {
+        const ordered = [
+            stack.blockchain,
+            stack.language,
+            stack.frontend,
+            stack.backend,
+            stack.testing,
+            stack.database,
+            ...(stack.other ?? []),
+        ];
+        for (const value of ordered) {
+            if (typeof value === "string" && value.trim().length > 0) {
+                candidates.push(value);
+            }
+        }
+    }
+    return candidates;
+}
+/**
+ * Resolves a declared/detected stack to one of the 8 `SecurityStackId`s and
+ * its `bober.security-<stack>` skill name. Unknown/absent/null stacks
+ * degrade to `{stackId: "generic", ...}` — never null, never a throw
+ * (sc-5-1).
+ */
+export const SecurityStackRegistry = {
+    resolve(stack) {
+        const candidates = candidatesFor(stack);
+        for (const candidate of candidates) {
+            const lower = candidate.toLowerCase();
+            const match = STACK_KEYWORDS.find((k) => lower.includes(k.pattern));
+            if (match) {
+                return {
+                    stackId: match.stackId,
+                    stackLabel: candidate,
+                    skillName: skillNameForStackId(match.stackId),
+                };
+            }
+        }
+        return {
+            stackId: "generic",
+            stackLabel: candidates[0] ?? "unknown",
+            skillName: skillNameForStackId("generic"),
+        };
+    },
+};
+//# sourceMappingURL=registry.js.map

package/dist/orchestrator/security-knowledge/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/registry.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,uEAAuE;AAEvE,SAAS,mBAAmB,CAAC,OAAwB;IACnD,OAAO,kBAAkB,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,kBAAkB,GAA+B;IACrD,UAAU;IACV,QAAQ;IACR,OAAO;IACP,MAAM;IACN,UAAU;IACV,SAAS;IACT,aAAa;IACb,SAAS;CACV,CAAC;AAEF,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAClC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AAS9F;;;;;;GAMG;AACH,MAAM,cAAc,GAA4B;IAC9C,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE;IAC5C,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE;IACvC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE;IAC3C,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE;IAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;IACxC,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;IACxC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;IACtC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;IACrC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;IACpC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE;IACvC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE;IAC1C,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;IACpC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE;IACvC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE;IAC3C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE;IAC1C,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE;IACvC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IAC1C,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;IACzC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IAC1C,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;IACxC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE;IAC1C,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE;IAC1C,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE;CACjD,CAAC;AAEF;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAiC;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,OAAO,GAA8B;YACzC,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,QAAQ;YACd,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;SACvB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,CAAC,KAAiC;QACvC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAExC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACpE,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO;oBACL,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,UAAU,EAAE,SAAS;oBACrB,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS;YACtC,SAAS,EAAE,mBAAmB,CAAC,SAAS,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/orchestrator/security-knowledge/resolver.d.ts

@@ -0,0 +1,48 @@
+import type { Stack } from "../../config/schema.js";
+import type { VulnClass } from "../security-audit-types.js";
+import type { SecuritySignature, SecurityStackId } from "./signature.js";
+import type { SecurityKnowledgeIndex } from "./index.js";
+/**
+ * Replaces the old head-excerpt `StackSecurityContext` (stack-knowledge.ts:20-29,
+ * the G3 defect) with a retrieval-grounded one: `stackId` and `signatures`
+ * are new, `promptFragment` now renders retrieved signatures rather than a
+ * frontmatter/head-excerpt of the skill file.
+ */
+export interface StackSecurityContext {
+    stackId: SecurityStackId;
+    /** The matched candidate string (e.g. "solidity"), or "unknown". */
+    stackLabel: string;
+    /** Always "bober.security-<stackId>" — never null. */
+    skillName: string;
+    /** The canonical vulnerability-class taxonomy — stable across stacks. */
+    taxonomy: VulnClass[];
+    /** The retrieved signatures folded into promptFragment, in rendered order. */
+    signatures: SecuritySignature[];
+    /** Text to inject verbatim into the auditor's prompt. Never empty. */
+    promptFragment: string;
+}
+export interface ResolveStackSecurityContextInput {
+    /** `config.project.stack`, or a plain string (test ergonomics). */
+    stack: Stack | string | undefined;
+    /** Files in scope for the audit — the diff provider lands sprint 6, so this is contract.estimatedFiles for now. */
+    changedPaths: string[];
+    /** Keywords extracted from a real diff — [] until sprint 6 supplies one. */
+    diffKeywords?: string[];
+    /** A loaded (load() already awaited) SecurityKnowledgeIndex. */
+    index: SecurityKnowledgeIndex;
+    /** Max ranked (non-floor) signatures to select. Defaults to 8. */
+    topK?: number;
+    /** Optional threat-model text appended verbatim after the rendered signatures. */
+    threatModelText?: string;
+}
+/**
+ * Resolves the security prompt context for a declared/detected stack via
+ * retrieval over the parsed skill signatures — replacing the head-excerpt
+ * resolver formerly at stack-knowledge.ts:198-225 (G3).
+ *
+ * Never throws: an unrecognised stack resolves to the generic floor; a
+ * wholly missing skills directory resolves to the `resolveLensFocus`
+ * fallback text. `promptFragment` is never empty.
+ */
+export declare function resolveStackSecurityContext(input: ResolveStackSecurityContextInput): Promise<StackSecurityContext>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/orchestrator/security-knowledge/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGzE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAIzD;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,eAAe,CAAC;IACzB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB,8EAA8E;IAC9E,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;CACxB;AAqCD,MAAM,WAAW,gCAAgC;IAC/C,mEAAmE;IACnE,KAAK,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,mHAAmH;IACnH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gEAAgE;IAChE,KAAK,EAAE,sBAAsB,CAAC;IAC9B,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAuB/B"}

package/dist/orchestrator/security-knowledge/resolver.js

@@ -0,0 +1,63 @@
+import { ALL_VULN_CLASSES } from "../stack-knowledge.js";
+import { resolveLensFocus } from "../eval-lenses.js";
+import { SecurityStackRegistry } from "./registry.js";
+import { selectSignatures } from "./selector.js";
+// ── Prompt rendering ───────────────────────────────────────────────
+function renderSignature(signature) {
+    const cweSuffix = signature.cwe ? ` (${signature.cwe})` : "";
+    return [
+        `### ${signature.signatureId} — ${signature.title}${cweSuffix}`,
+        `Invariant: ${signature.invariant}`,
+        "",
+        "Unsafe:",
+        "```ts",
+        signature.unsafeExample,
+        "```",
+        "",
+        "Safe:",
+        "```ts",
+        signature.safeExample,
+        "```",
+    ].join("\n");
+}
+/**
+ * Renders the retrieved signatures into a compact prompt fragment. NEVER
+ * empty: falls back to `resolveLensFocus("security")` when the selected set
+ * is somehow empty (e.g. a wholly missing skills directory), which the
+ * generic floor normally prevents (closes G3).
+ */
+function renderPromptFragment(signatures, threatModelText) {
+    const body = signatures.length > 0 ? signatures.map(renderSignature).join("\n\n") : resolveLensFocus("security");
+    return threatModelText ? `${body}\n\n${threatModelText}` : body;
+}
+/**
+ * Resolves the security prompt context for a declared/detected stack via
+ * retrieval over the parsed skill signatures — replacing the head-excerpt
+ * resolver formerly at stack-knowledge.ts:198-225 (G3).
+ *
+ * Never throws: an unrecognised stack resolves to the generic floor; a
+ * wholly missing skills directory resolves to the `resolveLensFocus`
+ * fallback text. `promptFragment` is never empty.
+ */
+export async function resolveStackSecurityContext(input) {
+    const { stackId, stackLabel, skillName } = SecurityStackRegistry.resolve(input.stack);
+    const stackSignatures = input.index.forStack(stackId);
+    const genericFloor = stackId === "generic" ? stackSignatures : input.index.forStack("generic");
+    const signatures = selectSignatures({
+        stackId,
+        changedPaths: input.changedPaths,
+        diffKeywords: input.diffKeywords ?? [],
+        topK: input.topK ?? 8,
+        stackSignatures,
+        genericFloor,
+    });
+    return {
+        stackId,
+        stackLabel,
+        skillName,
+        taxonomy: [...ALL_VULN_CLASSES],
+        signatures,
+        promptFragment: renderPromptFragment(signatures, input.threatModelText),
+    };
+}
+//# sourceMappingURL=resolver.js.map

package/dist/orchestrator/security-knowledge/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAyBjD,sEAAsE;AAEtE,SAAS,eAAe,CAAC,SAA4B;IACnD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,OAAO;QACL,OAAO,SAAS,CAAC,WAAW,MAAM,SAAS,CAAC,KAAK,GAAG,SAAS,EAAE;QAC/D,cAAc,SAAS,CAAC,SAAS,EAAE;QACnC,EAAE;QACF,SAAS;QACT,OAAO;QACP,SAAS,CAAC,aAAa;QACvB,KAAK;QACL,EAAE;QACF,OAAO;QACP,OAAO;QACP,SAAS,CAAC,WAAW;QACrB,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,UAA+B,EAAE,eAAmC;IAChG,MAAM,IAAI,GACR,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAEtG,OAAO,eAAe,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAuC;IAEvC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEtF,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE/F,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;QACtC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;QACrB,eAAe;QACf,YAAY;KACb,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,UAAU;QACV,SAAS;QACT,QAAQ,EAAE,CAAC,GAAG,gBAAgB,CAAC;QAC/B,UAAU;QACV,cAAc,EAAE,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC;KACxE,CAAC;AACJ,CAAC"}

package/dist/orchestrator/security-knowledge/selector.d.ts

@@ -0,0 +1,18 @@
+import type { SecuritySignature, SecurityStackId } from "./signature.js";
+export interface SelectInput {
+    stackId: SecurityStackId;
+    changedPaths: string[];
+    diffKeywords: string[];
+    topK: number;
+    /** Typically index.forStack(stackId). */
+    stackSignatures: SecuritySignature[];
+    /** Typically index.forStack("generic") — ALWAYS included in the result. */
+    genericFloor: SecuritySignature[];
+}
+/**
+ * Pure and total: ranks `stackSignatures` by score, caps at `topK`, then
+ * ALWAYS concatenates `genericFloor` (deduped by `signatureId`) so the floor
+ * is present even when it did not rank into the top-K on its own merit.
+ */
+export declare function selectSignatures(input: SelectInput): SecuritySignature[];
+//# sourceMappingURL=selector.d.ts.map

package/dist/orchestrator/security-knowledge/selector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selector.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/selector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEzE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,eAAe,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,eAAe,EAAE,iBAAiB,EAAE,CAAC;IACrC,2EAA2E;IAC3E,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC;AA0BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,iBAAiB,EAAE,CAqBxE"}

package/dist/orchestrator/security-knowledge/selector.js

@@ -0,0 +1,46 @@
+/** score = stack membership + keyword overlap (signature.keywords vs diffKeywords) + path hints. */
+function scoreSignature(signature, input) {
+    let score = 0;
+    if (signature.stackId === input.stackId)
+        score += 3;
+    const diffKeywordSet = new Set(input.diffKeywords.map((k) => k.toLowerCase()));
+    for (const keyword of signature.keywords) {
+        if (diffKeywordSet.has(keyword.toLowerCase()))
+            score += 2;
+    }
+    const basenames = input.changedPaths
+        .map((path) => path.split("/").pop()?.toLowerCase() ?? "")
+        .filter((base) => base.length > 0);
+    const idLower = signature.signatureId.toLowerCase();
+    for (const base of basenames) {
+        const hint = idLower.includes(base) || signature.keywords.some((keyword) => base.includes(keyword.toLowerCase()));
+        if (hint)
+            score += 1;
+    }
+    return score;
+}
+/**
+ * Pure and total: ranks `stackSignatures` by score, caps at `topK`, then
+ * ALWAYS concatenates `genericFloor` (deduped by `signatureId`) so the floor
+ * is present even when it did not rank into the top-K on its own merit.
+ */
+export function selectSignatures(input) {
+    const stackSignatures = Array.isArray(input.stackSignatures) ? input.stackSignatures : [];
+    const genericFloor = Array.isArray(input.genericFloor) ? input.genericFloor : [];
+    const topK = Number.isFinite(input.topK) ? Math.max(0, Math.trunc(input.topK)) : 0;
+    const ranked = stackSignatures
+        .map((signature) => ({ signature, score: scoreSignature(signature, input) }))
+        .sort((a, b) => b.score - a.score)
+        .slice(0, topK)
+        .map((r) => r.signature);
+    const selected = [...ranked];
+    const seen = new Set(selected.map((s) => s.signatureId));
+    for (const floorSignature of genericFloor) {
+        if (!seen.has(floorSignature.signatureId)) {
+            seen.add(floorSignature.signatureId);
+            selected.push(floorSignature);
+        }
+    }
+    return selected;
+}
+//# sourceMappingURL=selector.js.map

package/dist/orchestrator/security-knowledge/selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selector.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/selector.ts"],"names":[],"mappings":"AAaA,oGAAoG;AACpG,SAAS,cAAc,CAAC,SAA4B,EAAE,KAAkB;IACtE,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAAE,KAAK,IAAI,CAAC,CAAC;IAEpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY;SACjC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;SACzD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACvG,IAAI,IAAI;YAAE,KAAK,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnF,MAAM,MAAM,GAAG,eAAe;SAC3B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;SAC5E,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3B,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,cAAc,IAAI,YAAY,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/orchestrator/security-knowledge/signature.d.ts

@@ -0,0 +1,37 @@
+import type { VulnClass, FindingSeverity } from "../security-audit-types.js";
+/**
+ * The eight security-stack identifiers a signature can belong to
+ * (arch-20260712-security-audit-agent-team-architecture.md). "generic" is
+ * the shared OWASP/CWE library every other stack skill supplements.
+ */
+export type SecurityStackId = "solidity" | "anchor" | "react" | "node" | "payments" | "igaming" | "dex-backend" | "generic";
+/**
+ * One parsed vulnerable/safe signature from a security skill file.
+ * Shape is quoted verbatim from the architecture (sc-2-1) — SecuritySignatureParser
+ * (./parser.ts) is the only producer of these records.
+ */
+export interface SecuritySignature {
+    /** The security stack this signature was authored for. */
+    stackId: SecurityStackId;
+    /** Stable id — the "### <signatureId>" heading text in the source skill file. */
+    signatureId: string;
+    /** Human-readable title. */
+    title: string;
+    /** CWE identifier, e.g. "CWE-89"; null when the source block omits it. */
+    cwe: string | null;
+    /** Severity rating for a finding matching this signature. */
+    severity: FindingSeverity;
+    /** MUST be a member of the widened VulnClass union (stack-knowledge.ts ALL_VULN_CLASSES). */
+    vulnClass: VulnClass;
+    /** The safety invariant this signature protects (the "why" behind the safe example). */
+    invariant: string;
+    /** A short vulnerable-code example. */
+    unsafeExample: string;
+    /** The corresponding fixed/safe-code example. */
+    safeExample: string;
+    /** Free-text keywords for future retrieval (sprint 5 index/selector). */
+    keywords: string[];
+    /** The skillRelPath passed to SecuritySignatureParser.parse() — provenance. */
+    skillRef: string;
+}
+//# sourceMappingURL=signature.d.ts.map

package/dist/orchestrator/security-knowledge/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/signature.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAI7E;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,QAAQ,GACR,OAAO,GACP,MAAM,GACN,UAAU,GACV,SAAS,GACT,aAAa,GACb,SAAS,CAAC;AAId;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,OAAO,EAAE,eAAe,CAAC;IACzB,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,EAAE,eAAe,CAAC;IAC1B,6FAA6F;IAC7F,SAAS,EAAE,SAAS,CAAC;IACrB,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/orchestrator/security-knowledge/signature.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signature.js.map

package/dist/orchestrator/security-knowledge/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/signature.ts"],"names":[],"mappings":""}

package/dist/orchestrator/security-knowledge/supply-chain-inspector.d.ts

@@ -0,0 +1,29 @@
+import type { AuditDiff } from "./diff-provider.js";
+import type { SecurityFinding } from "../security-audit-types.js";
+/**
+ * OFFLINE, zero-network supply-chain diff inspector (spec-20260714 sprint 7,
+ * G5, ADR-4). Scoped to `diff.changedFiles`; every check operates purely on
+ * the hunk text already captured by the diff provider (Pattern B — no
+ * `node:fs` reads, no child processes, no network). NEVER throws: any
+ * per-file check failure is caught and skips that file only (Pattern A,
+ * mirrors `diff-provider.ts`'s `collectGraphNeighborhood`), so one malformed
+ * hunk can never drop the rest of the audit's findings.
+ *
+ * Findings feed the finder as PRIORS (the "ground truth priors" prompt
+ * section rendered by `security-auditor-agent.ts`) — this is NOT a new LLM
+ * role or sub-auditor (nonGoals[3]).
+ */
+export interface SupplyChainInspectInput {
+    projectRoot: string;
+    diff: AuditDiff;
+    signal: AbortSignal;
+}
+/**
+ * Runs all six offline supply-chain checks over `diff.changedFiles` and
+ * returns the combined findings. Pure fold over hunk text — no fs reads, no
+ * child processes, no network. Honours `signal.aborted` between files.
+ * NEVER throws: a per-file exception is logged and skipped, never
+ * propagated (Pattern A).
+ */
+export declare function inspectSupplyChain(input: SupplyChainInspectInput): Promise<SecurityFinding[]>;
+//# sourceMappingURL=supply-chain-inspector.d.ts.map

package/dist/orchestrator/security-knowledge/supply-chain-inspector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain-inspector.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/supply-chain-inspector.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;CACrB;AA2OD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAyBnG"}

package/dist/orchestrator/security-knowledge/supply-chain-inspector.js

@@ -0,0 +1,211 @@
+import { basename } from "node:path";
+import { logger } from "../../utils/logger.js";
+const REGISTRY_HOSTS = new Set(["registry.npmjs.org", "registry.yarnpkg.com"]);
+const LIFECYCLE_SCRIPT_KEYS = ["preinstall", "install", "postinstall", "prepare"];
+// bober: substring/regex heuristics over the diff's added lines, not a full
+// JSON/YAML grammar — cheap and total, mirrors extractDiffKeywords's
+// NOTABLE_SUBSTRINGS precedent in diff-provider.ts; good enough to ground
+// the finder's priors, not a guarantee of zero false positives/negatives.
+const OBFUSCATION_PATTERN = /(base64|Buffer\.from\([^)]*base64|eval\(|\\x[0-9a-f]{2}|atob\(|child_process|curl\s|wget\s|node\s+-e)/i;
+const LONG_BLOB_PATTERN = /[A-Za-z0-9+/]{80,}={0,2}/;
+const PACKAGE_JSON_METADATA_KEYS = new Set([
+    "name",
+    "version",
+    "description",
+    "main",
+    "types",
+    "typings",
+    "license",
+    "author",
+    "private",
+    "type",
+    "module",
+    "bin",
+    "homepage",
+    "repository",
+    "bugs",
+    "keywords",
+    "engines",
+    "scripts",
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies",
+    "files",
+    "exports",
+    "sideEffects",
+    "workspaces",
+]);
+function addedLines(hunks) {
+    const lines = [];
+    if (!Array.isArray(hunks))
+        return lines;
+    for (const hunk of hunks) {
+        const content = typeof hunk?.content === "string" ? hunk.content : "";
+        if (!content)
+            continue;
+        for (const line of content.split("\n")) {
+            if (line.startsWith("+++") || line.startsWith("---"))
+                continue;
+            if (line.startsWith("+"))
+                lines.push(line.slice(1));
+        }
+    }
+    return lines;
+}
+function isLockfile(path) {
+    const name = basename(path);
+    return name === "package-lock.json" || name === "yarn.lock" || name === "pnpm-lock.yaml";
+}
+function isCiWorkflow(path) {
+    return /\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
+}
+function makeFinding(description, path, snippet) {
+    return {
+        description,
+        evidence: [{ path, line: 0, snippet: snippet.slice(0, 300) }],
+        source: "supply-chain-inspector",
+        vulnClass: "supply-chain",
+    };
+}
+// ── Check 1: malicious lifecycle script (package.json) ────────────────
+function checkLifecycleScripts(file) {
+    if (basename(file.path) !== "package.json")
+        return [];
+    const findings = [];
+    for (const line of addedLines(file.hunks)) {
+        const scriptKey = LIFECYCLE_SCRIPT_KEYS.find((key) => line.includes(`"${key}"`));
+        if (!scriptKey)
+            continue;
+        if (OBFUSCATION_PATTERN.test(line) || LONG_BLOB_PATTERN.test(line)) {
+            findings.push(makeFinding(`package.json lifecycle script "${scriptKey}" added/changed with obfuscated content (base64/hex/eval)`, file.path, line.trim()));
+        }
+    }
+    return findings;
+}
+// ── Check 2: lockfile "resolved" host mismatch ─────────────────────────
+function checkLockfileHost(file) {
+    if (!isLockfile(file.path))
+        return [];
+    const findings = [];
+    const resolvedPattern = /resolved"?\s*:?\s*"https?:\/\/([^/"]+)/;
+    for (const line of addedLines(file.hunks)) {
+        const match = resolvedPattern.exec(line);
+        if (!match)
+            continue;
+        const host = match[1];
+        if (!REGISTRY_HOSTS.has(host)) {
+            findings.push(makeFinding(`Lockfile "resolved" host "${host}" is not a known registry (expected one of: ${Array.from(REGISTRY_HOSTS).join(", ")})`, file.path, line.trim()));
+        }
+    }
+    return findings;
+}
+// ── Check 3: .npmrc registry override / ignore-scripts disabled ────────
+function checkNpmrc(file) {
+    if (basename(file.path) !== ".npmrc")
+        return [];
+    const findings = [];
+    for (const line of addedLines(file.hunks)) {
+        const trimmed = line.trim();
+        if (/^registry\s*=/.test(trimmed) || /^@[\w-]+:registry\s*=/.test(trimmed)) {
+            findings.push(makeFinding(".npmrc adds/changes a custom registry override", file.path, trimmed));
+        }
+        if (/ignore-scripts\s*=\s*false/.test(trimmed)) {
+            findings.push(makeFinding(".npmrc re-enables lifecycle scripts (ignore-scripts=false)", file.path, trimmed));
+        }
+    }
+    return findings;
+}
+// ── Check 4: new dependency with no matching import in the diff ────────
+function checkNewDependencyImport(file, allFiles) {
+    if (basename(file.path) !== "package.json")
+        return [];
+    const findings = [];
+    // A dependency entry: `"name": "^1.2.3"` — the leading digit/^/~ on the
+    // value side distinguishes a semver range from an arbitrary metadata
+    // string value (e.g. "name": "my-package"), which is skipped via the
+    // metadata-key set below anyway (belt-and-suspenders).
+    const depLinePattern = /^\s*"([\w@][\w./-]*)"\s*:\s*"[~^]?\d[^"]*"\s*,?\s*$/;
+    for (const line of addedLines(file.hunks)) {
+        const match = depLinePattern.exec(line);
+        if (!match)
+            continue;
+        const depName = match[1];
+        if (PACKAGE_JSON_METADATA_KEYS.has(depName))
+            continue;
+        const referenced = allFiles.some((f) => f.path !== file.path &&
+            addedLines(f.hunks).some((l) => l.includes(`from "${depName}`) ||
+                l.includes(`from '${depName}`) ||
+                l.includes(`require("${depName}`) ||
+                l.includes(`require('${depName}`)));
+        if (!referenced) {
+            findings.push(makeFinding(`New dependency "${depName}" added to package.json with no matching import/require found in this diff ` +
+                "(heuristic — may be a false positive if the import lives outside the diffed hunks)", file.path, line.trim()));
+        }
+    }
+    return findings;
+}
+// ── Check 5: CI uses "npm install" instead of "npm ci" ──────────────────
+function checkCiNpmInstall(file) {
+    if (!isCiWorkflow(file.path))
+        return [];
+    const findings = [];
+    for (const line of addedLines(file.hunks)) {
+        if (/\bnpm\s+ci\b/.test(line))
+            continue;
+        if (/\bnpm\s+install\b/.test(line)) {
+            findings.push(makeFinding('CI workflow uses "npm install" instead of the reproducible, lockfile-enforcing "npm ci"', file.path, line.trim()));
+        }
+    }
+    return findings;
+}
+// ── Check 6: GitHub Action pinned by tag/branch instead of full SHA ─────
+function checkActionPinning(file) {
+    if (!isCiWorkflow(file.path))
+        return [];
+    const findings = [];
+    const usesPattern = /uses:\s*([\w.-]+\/[\w.-]+)@([\w.-]+)/;
+    for (const line of addedLines(file.hunks)) {
+        const match = usesPattern.exec(line);
+        if (!match)
+            continue;
+        const [, action, ref] = match;
+        const isFullSha = /^[0-9a-f]{40}$/i.test(ref);
+        if (!isFullSha) {
+            findings.push(makeFinding(`GitHub Action "${action}" is pinned by tag/branch "${ref}" instead of a full commit SHA (supply-chain-tampering risk, cf. tj-actions CVE-2025-30066)`, file.path, line.trim()));
+        }
+    }
+    return findings;
+}
+// ── Entry point ─────────────────────────────────────────────────────
+/**
+ * Runs all six offline supply-chain checks over `diff.changedFiles` and
+ * returns the combined findings. Pure fold over hunk text — no fs reads, no
+ * child processes, no network. Honours `signal.aborted` between files.
+ * NEVER throws: a per-file exception is logged and skipped, never
+ * propagated (Pattern A).
+ */
+export async function inspectSupplyChain(input) {
+    const { diff, signal } = input;
+    const changedFiles = Array.isArray(diff?.changedFiles) ? diff.changedFiles : [];
+    const findings = [];
+    for (const file of changedFiles) {
+        if (signal.aborted)
+            break;
+        if (!file || typeof file.path !== "string")
+            continue;
+        try {
+            findings.push(...checkLifecycleScripts(file));
+            findings.push(...checkLockfileHost(file));
+            findings.push(...checkNpmrc(file));
+            findings.push(...checkNewDependencyImport(file, changedFiles));
+            findings.push(...checkCiNpmInstall(file));
+            findings.push(...checkActionPinning(file));
+        }
+        catch (err) {
+            logger.debug(`[supply-chain-inspector] check on "${file.path}" threw: ${err instanceof Error ? err.message : String(err)} — skipping this file`);
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=supply-chain-inspector.js.map

package/dist/orchestrator/security-knowledge/supply-chain-inspector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain-inspector.js","sourceRoot":"","sources":["../../../src/orchestrator/security-knowledge/supply-chain-inspector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAIrC,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAsB/C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAE/E,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAElF,4EAA4E;AAC5E,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,MAAM,mBAAmB,GACvB,wGAAwG,CAAC;AAC3G,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAErD,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACzC,MAAM;IACN,SAAS;IACT,aAAa;IACb,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS;IACT,QAAQ;IACR,SAAS;IACT,MAAM;IACN,QAAQ;IACR,KAAK;IACL,UAAU;IACV,YAAY;IACZ,MAAM;IACN,UAAU;IACV,SAAS;IACT,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,sBAAsB;IACtB,OAAO;IACP,SAAS;IACT,aAAa;IACb,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,KAAiB;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,KAAK,mBAAmB,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,gBAAgB,CAAC;AAC3F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,WAAmB,EAAE,IAAY,EAAE,OAAe;IACrE,OAAO;QACL,WAAW;QACX,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,wBAAwB;QAChC,SAAS,EAAE,cAAc;KAC1B,CAAC;AACJ,CAAC;AAED,yEAAyE;AAEzE,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,kCAAkC,SAAS,2DAA2D,EACtG,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAE1E,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,eAAe,GAAG,wCAAwC,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,6BAA6B,IAAI,+CAA+C,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACxH,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAE1E,SAAS,UAAU,CAAC,IAAiB;IACnC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEhD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,gDAAgD,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC,4DAA4D,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAE1E,SAAS,wBAAwB,CAAC,IAAiB,EAAE,QAAuB;IAC1E,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,EAAE,CAAC;IAEtD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,wEAAwE;IACxE,qEAAqE;IACrE,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,cAAc,GAAG,qDAAqD,CAAC;IAE7E,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,0BAA0B,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAEtD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YACpB,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,QAAQ,CAAC,SAAS,OAAO,EAAE,CAAC;gBAC9B,CAAC,CAAC,QAAQ,CAAC,SAAS,OAAO,EAAE,CAAC;gBAC9B,CAAC,CAAC,QAAQ,CAAC,YAAY,OAAO,EAAE,CAAC;gBACjC,CAAC,CAAC,QAAQ,CAAC,YAAY,OAAO,EAAE,CAAC,CACpC,CACJ,CAAC;QAEF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,mBAAmB,OAAO,6EAA6E;gBACrG,oFAAoF,EACtF,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAE3E,SAAS,iBAAiB,CAAC,IAAiB;IAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,yFAAyF,EACzF,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAE3E,SAAS,kBAAkB,CAAC,IAAiB;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,sCAAsC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;QAC9B,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,WAAW,CACT,kBAAkB,MAAM,8BAA8B,GAAG,6FAA6F,EACtJ,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uEAAuE;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA8B;IACrE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM;QAC1B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAS;QAErD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;YAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,sCAAsC,IAAI,CAAC,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}