altimate-receipts 0.22.0 → 0.22.1

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts","../src/hook/guard.ts","../src/policy/guard.ts","../src/receipt/guardLog.ts","../src/hook/installGitHook.ts","../src/hook/prePush.ts","../src/report/store.ts","../src/hook/settingsMerge.ts","../src/receipt/assert.ts","../src/receipt/externalStateLog.ts","../src/reconcile/reconcile.ts","../src/report/ack.ts","../src/report/badge.ts","../src/report/diff.ts","../src/report/eval.ts","../src/report/fleet.ts","../src/report/log.ts","../src/report/prune.ts","../src/report/stats.ts","../src/report/workVerdict.ts","../src/scanners/semgrep.ts","../src/scanners/sarifIngest.ts","../src/scanners/scanners.ts","../src/share/handoff.ts","../src/sign/witness.ts","../src/trace/subagents.ts"],"sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { createHmac } from \"node:crypto\";\nimport {\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, relative } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { exporterFor, exporterIds } from \"./export/registry.js\";\nimport { computeCompletion } from \"./findings/completionFindings.js\";\nimport { loadCriteria } from \"./findings/criteria.js\";\nimport { deriveFindings } from \"./findings/findings.js\";\nimport type { DerivedSummary } from \"./findings/spans.js\";\nimport { deriveSpans } from \"./findings/spans.js\";\nimport { runGuard } from \"./hook/guard.js\";\nimport { installGitHook, wirePrepareScript } from \"./hook/installGitHook.js\";\nimport { type HookDialect, readStdin, runHookPrePush } from \"./hook/prePush.js\";\nimport { primaryCheckout } from \"./hook/prePush.js\";\nimport {\n  GUARD_HOOK_COMMAND,\n  GUARD_MATCHER,\n  mergeHookIntoSettings,\n  settingsStore,\n} from \"./hook/settingsMerge.js\";\nimport {\n  type Assertion,\n  assertExitCode,\n  evaluateAsserts,\n  loadAsserts,\n  renderAssertResults,\n} from \"./receipt/assert.js\";\nimport { type Receipt, type ReceiptScope, buildReceipt } from \"./receipt/build.js\";\nimport { canonicalize } from \"./receipt/canonical.js\";\nimport { readExternalState } from \"./receipt/externalStateLog.js\";\nimport { readGuardEvents, sessionIdFromPath } from \"./receipt/guardLog.js\";\nimport { ghFetcher, reconcileSession } from \"./reconcile/reconcile.js\";\nimport { type AckEntry, appendAck, readAcks, resolveActor } from \"./report/ack.js\";\nimport { badgeEndpoint } from \"./report/badge.js\";\nimport { renderCard, renderList } from \"./report/card.js\";\nimport { diffReceipts, renderDiff } from \"./report/diff.js\";\nimport {\n  type FieldRow,\n  firedCategories,\n  renderFieldScan,\n  summarizeFieldScan,\n} from \"./report/eval.js\";\nimport { computeFleetFromRepos, renderFleet } from \"./report/fleet.js\";\nimport {\n  collectGuardrails,\n  renderGuardrailsBlock,\n  upsertGuardrailsSection,\n} from \"./report/guardrails.js\";\nimport { loadReceiptHistory, renderLog } from \"./report/log.js\";\nimport { renderPrComment } from \"./report/prComment.js\";\nimport { eventKey, visibleMergeFindings } from \"./report/prComment.js\";\nimport { branchSlug, planPrune } from \"./report/prune.js\";\nimport { toSarif } from \"./report/sarif.js\";\nimport { deriveTargets } from \"./report/sessions.js\";\nimport { computeStats, renderStats } from \"./report/stats.js\";\nimport { listReceiptRefs, readReceiptRef, writeReceiptRef } from \"./report/store.js\";\nimport { computeTrends, renderTrends, upsertTrendsSection } from \"./report/trends.js\";\nimport {\n  DEFAULT_BLOCKABLE,\n  type WorkPolicy,\n  unknownVerdictPrefixes,\n  verdictExitCode,\n  workVerdict,\n} from \"./report/workVerdict.js\";\nimport { runScanners } from \"./scanners/scanners.js\";\nimport { copyToClipboard } from \"./share/clipboard.js\";\nimport { buildHandoff, renderHandoffMarkdown } from \"./share/handoff.js\";\nimport { renderShareMarkdown } from \"./share/markdown.js\";\nimport { redactReceipt } from \"./share/redact.js\";\nimport { toDsseEnvelope } from \"./sign/envelope.js\";\nimport { compareToTranscript, rederiveFromTranscript } from \"./sign/rederive.js\";\nimport { verifyBundle } from \"./sign/verify.js\";\nimport { type WitnessLog, crossCheck, discoverWitness, verifyWitnessSig } from \"./sign/witness.js\";\nimport { authoredBranch, branchShas, shaWindow } from \"./trace/commitMatch.js\";\nimport {\n  applyDiffScope,\n  changedFiles,\n  inDiff,\n  narrowEffort,\n  windowedEffort,\n} from \"./trace/diffScope.js\";\nimport {\n  anyDetected,\n  inRepo,\n  listSessions,\n  loadById,\n  loadSession,\n  rootsHint,\n  selectForBranch,\n  selectSummary,\n} from \"./trace/load.js\";\nimport { agentIds } from \"./trace/registry.js\";\nimport { sliceByBranch } from \"./trace/slice.js\";\nimport { loadSubagentActivity } from \"./trace/subagents.js\";\nimport type { AgentSource, Session, SessionSummary } from \"./trace/types.js\";\nimport { getVersion } from \"./version.js\";\n\nconst HELP = `\n🧾  receipts — proof, not vibes\n\n  A deterministic, cross-agent Report Card of what your coding agent actually did.\n  Reads the agent's own transcript locally. No account, no upload, no model calls.\n\nUsage\n  receipts [selector]           Print the Agent Report Card for a session\n  receipts --list               List recent sessions (then: receipts <n>)\n  receipts --json [selector]    Emit the Receipt object (in-toto Statement)\n  receipts --share [selector]   Print a redacted, paste-ready Markdown summary\n  receipts --handoff [selector]  Print a verifiable handoff brief (done/open/risk/next/verify)\n  receipts guardrails [sel]     Paste-ready prevention rules (AGENTS.md / CLAUDE.md)\n                                from the findings (--last N to aggregate sessions)\n  receipts trends               Cross-session digest: grades, recurring findings,\n                                and evidence over your last N sessions (default 10)\n  receipts preview              Render this branch's work record locally — exactly what CI\n                                will post (RECEIPTS_PREVIEW=1) — and store nothing\n  receipts pr                   Write this PR's redacted Receipt to .receipts/\n                                (diff-scoped: only this change's findings)\n  receipts envelope <receipt>   Wrap a Receipt as an unsigned DSSE envelope\n  receipts verify <bundle>      Verify a Receipt (+ --transcript to prove fidelity;\n                                + --witness <log> to cross-check vs altimate-router)\n  receipts diff [<a> <b>]       What changed between two Receipts (no args: last two; --json)\n  receipts log [dir]            List the committed receipts in .receipts/ (--last N)\n  receipts stats [dir]          Dogfooding scoreboard: how often it ran + what it caught\n  receipts fleet                Cross-repo/agent rollup over refs/receipts/* (RECEIPTS_FLEET=1;\n                                --repos a,b,c · --json) — local-only org record\n  receipts ack [slug]           Record an attributed review of an agent's work\n                                (RECEIPTS_ACK=1; --note · --event <id> · --json) — local-only\n  receipts eval                 Flag-rate of the detectors over your real local sessions (--last N, --json)\n  receipts badge [receipt]      shields.io endpoint JSON for a README/PR badge (--out f)\n  receipts sarif [receipt]      SARIF 2.1.0 for GitHub code-scanning (inline + Security tab; --out f)\n  receipts export --format otel [sel]  Emit the session as OpenTelemetry OTLP/JSON spans (also: --format sarif; --out f)\n  receipts prune [dir]          Remove committed receipts for merged/deleted branches (--dry-run)\n  receipts init                 One-command adopt: PR-check workflow + the repo-committed\n                                agent hook; --pr also branches, commits, pushes + opens the PR\n                                (--prepare wires the git floor; --agents codex too)\n  receipts hook pre-push        (called by hooks, not humans) attach the receipt on push\n                                (--agent claude | codex | git selects the payload dialect)\n  receipts install-hook         Write the self-updating pre-push hook into .git/hooks\n  receipts setup-local          Add the hook to YOUR ~/.claude/settings.json (only fires\n                                in repos that have adopted the Receipts workflow)\n  receipts rederive <file>      Reproduce the canonical Receipt from a transcript\n  receipts assert [selector]    Check the receipt against committed .receipts/asserts.json (CI gate)\n  receipts mcp                  Start the MCP server (stdio) for IDEs/agents\n\n  selector: a list number (e.g. 3), a session id, or part of the title.\n  With no selector, the most recent session is used.\n\nOptions\n  --list                        List recent sessions and exit\n  --agent <name>                Limit to one agent: claude-code | codex | cursor | openclaw\n  --json                        Emit the Receipt as JSON (no card)\n  --compact                     With --json, emit canonical (sorted, minified) JSON\n  --share                       Emit a redacted Markdown summary for sharing\n  --redact                      With --json, redact secrets from the Receipt\n  --out <path>                  With --json, write to a file instead of stdout\n  --base <ref>                  With pr, the diff base to scope against (default: main)\n  --store <mode>                With pr, where the receipt goes: commit (default) | none\n                                (print to stdout, write nothing). Also RECEIPTS_STORE env.\n  --branch <name>               With pr, fall back to a branch slice (default: current)\n  --whole-session               With pr, use the whole session (no scoping)\n  --last <n>                    With guardrails / trends, span the last n sessions\n  --copy                        Also copy --share / --json output to the clipboard\n  --no-color                    Disable ANSI color (also honors NO_COLOR)\n  -v, --version                 Print the version and exit\n  -h, --help                    Print this help and exit\n\nSigning is done in CI by the \"Verified-by: Receipts\" GitHub Action (Sigstore\nkeyless via GitHub Artifact Attestations). See docs/verified-by.md.\n\nReceipts reports what an agent DID — not whether it was correct. Your tests are\nthe oracle for success. Evidence, not judgement.\n\nNote: a Receipt can contain titles, file paths, and command snippets from the\ntranscript (possibly secrets). Plain --json is local only; use --share or\n--json --redact to mask secrets before the output leaves your machine.\n\nDocs: https://github.com/AltimateAI/altimate-receipts\n`;\n\ntype Command =\n  | \"envelope\"\n  | \"verify\"\n  | \"pr\"\n  | \"preview\"\n  | \"mcp\"\n  | \"rederive\"\n  | \"guardrails\"\n  | \"trends\"\n  | \"diff\"\n  | \"log\"\n  | \"stats\"\n  | \"fleet\"\n  | \"ack\"\n  | \"eval\"\n  | \"badge\"\n  | \"sarif\"\n  | \"export\"\n  | \"prune\"\n  | \"init\"\n  | \"assert\"\n  | \"verdict\"\n  | \"hook\"\n  | \"install-hook\"\n  | \"reconcile\"\n  | \"setup-local\";\nconst COMMANDS = new Set<Command>([\n  \"envelope\",\n  \"verify\",\n  \"pr\",\n  \"preview\",\n  \"mcp\",\n  \"rederive\",\n  \"guardrails\",\n  \"trends\",\n  \"diff\",\n  \"log\",\n  \"stats\",\n  \"fleet\",\n  \"ack\",\n  \"eval\",\n  \"badge\",\n  \"prune\",\n  \"sarif\",\n  \"export\",\n  \"init\",\n  \"assert\",\n  \"verdict\",\n  \"hook\",\n  \"install-hook\",\n  \"reconcile\",\n  \"setup-local\",\n]);\n\ninterface ParsedArgs {\n  help: boolean;\n  version: boolean;\n  list: boolean;\n  json: boolean;\n  compact: boolean;\n  share: boolean;\n  handoff: boolean;\n  redact: boolean;\n  copy: boolean;\n  color: boolean;\n  dryRun: boolean;\n  wholeSession: boolean;\n  prepare: boolean;\n  /** `fleet --repos a,b,c` — extra repo working dirs to roll up (M77) */\n  repos?: string[];\n  /** `ack --note \"...\"` / `--event <id>` (M78) */\n  note?: string;\n  eventId?: string;\n  /** `init --agents <list>` — extra agent hook files to write (SPEC-0069) */\n  pr: boolean;\n  /** `init --guard` — also install the live PreToolUse guard (opt-in; off by default) */\n  guard?: boolean;\n  agents?: string[];\n  agent?: AgentSource;\n  /** `hook pre-push --agent <claude|git>` payload dialect (SPEC-0066) */\n  hookDialect?: HookDialect;\n  out?: string;\n  /** `export --format <id>` — the exporter format (e.g. otel, sarif) */\n  format?: string;\n  branchScope?: string;\n  base?: string;\n  /** `pr --criteria <file>` — SPEC-0118 definition-of-done items */\n  criteria?: string;\n  store?: string;\n  transcript?: string;\n  witness?: string;\n  last?: number;\n  command?: Command;\n  file?: string;\n  /** second positional (e.g. the `b` receipt for `receipts diff <a> <b>`) */\n  second?: string;\n  selector?: string;\n}\n\nexport function parseArgs(argv: string[]): ParsedArgs {\n  const args = argv.slice(2);\n  const parsed: ParsedArgs = {\n    help: false,\n    version: false,\n    list: false,\n    json: false,\n    compact: false,\n    share: false,\n    handoff: false,\n    redact: false,\n    copy: false,\n    dryRun: false,\n    wholeSession: false,\n    prepare: false,\n    pr: false,\n    color: !process.env.NO_COLOR && process.stdout.isTTY === true,\n  };\n  const positionals: string[] = [];\n  for (let i = 0; i < args.length; i++) {\n    const a = args[i];\n    if (a === \"-h\" || a === \"--help\") {\n      parsed.help = true;\n    } else if (a === \"-v\" || a === \"--version\") {\n      parsed.version = true;\n    } else if (a === \"--list\") {\n      parsed.list = true;\n    } else if (a === \"--json\") {\n      parsed.json = true;\n    } else if (a === \"--repos\") {\n      const v = args[++i];\n      if (v)\n        parsed.repos = v\n          .split(\",\")\n          .map((x) => x.trim())\n          .filter(Boolean);\n    } else if (a === \"--note\") {\n      parsed.note = args[++i];\n    } else if (a === \"--event\") {\n      parsed.eventId = args[++i];\n    } else if (a === \"--compact\") {\n      parsed.compact = true;\n    } else if (a === \"--share\") {\n      parsed.share = true;\n    } else if (a === \"--handoff\") {\n      parsed.handoff = true;\n    } else if (a === \"--redact\") {\n      parsed.redact = true;\n    } else if (a === \"--copy\") {\n      parsed.copy = true;\n    } else if (a === \"--out\") {\n      parsed.out = args[++i];\n    } else if (a === \"--format\") {\n      parsed.format = args[++i];\n    } else if (a === \"--branch\") {\n      parsed.branchScope = args[++i];\n    } else if (a === \"--base\") {\n      parsed.base = args[++i];\n    } else if (a === \"--criteria\") {\n      parsed.criteria = args[++i];\n    } else if (a === \"--store\") {\n      parsed.store = args[++i];\n    } else if (a === \"--transcript\") {\n      parsed.transcript = args[++i];\n    } else if (a === \"--witness\") {\n      parsed.witness = args[++i];\n    } else if (a === \"--last\") {\n      const n = Number(args[++i]);\n      if (Number.isFinite(n) && n > 0) {\n        parsed.last = Math.floor(n);\n      }\n    } else if (a === \"--dry-run\") {\n      parsed.dryRun = true;\n    } else if (a === \"--whole-session\") {\n      parsed.wholeSession = true;\n    } else if (a === \"--prepare\") {\n      parsed.prepare = true;\n    } else if (a === \"--pr\") {\n      parsed.pr = true;\n    } else if (a === \"--guard\") {\n      parsed.guard = true;\n    } else if (a === \"--agents\") {\n      parsed.agents = (args[++i] ?? \"\").split(\",\").filter(Boolean);\n    } else if (a === \"--agent\") {\n      const next = args[i + 1];\n      if (next && agentIds().includes(next as AgentSource)) {\n        parsed.agent = next as AgentSource;\n        i++;\n      } else if (next === \"claude\" || next === \"codex\" || next === \"git\") {\n        parsed.hookDialect = next; // `hook pre-push --agent <dialect>` (SPEC-0066)\n        i++;\n      }\n    } else if (a === \"--no-color\") {\n      parsed.color = false;\n    } else if (a === \"--color\") {\n      parsed.color = true;\n    } else if (!a.startsWith(\"-\")) {\n      positionals.push(a);\n    }\n  }\n  if (positionals[0] && COMMANDS.has(positionals[0] as Command)) {\n    parsed.command = positionals[0] as Command;\n    parsed.file = positionals[1];\n    parsed.second = positionals[2];\n  } else {\n    parsed.selector = positionals[0];\n  }\n  return parsed;\n}\n\nexport async function run(argv: string[]): Promise<number> {\n  const args = parseArgs(argv);\n\n  if (args.version) {\n    process.stdout.write(`${getVersion()}\\n`);\n    return 0;\n  }\n  if (args.help) {\n    process.stdout.write(`${HELP}\\n`);\n    return 0;\n  }\n\n  if (args.command === \"envelope\") {\n    return runEnvelope(args.file);\n  }\n  if (args.command === \"verify\") {\n    return runVerify(args.file, {\n      transcript: args.transcript,\n      branch: args.branchScope,\n      witness: args.witness,\n    });\n  }\n  if (args.command === \"diff\") {\n    return runDiff(args.file, args.second, { json: args.json, out: args.out });\n  }\n  if (args.command === \"log\") {\n    return runLog(args.file, { json: args.json, last: args.last, out: args.out });\n  }\n  if (args.command === \"stats\") {\n    return runStats(args.file, { json: args.json, out: args.out });\n  }\n  if (args.command === \"fleet\") {\n    return runFleet({ repos: args.repos, json: args.json, out: args.out });\n  }\n  if (args.command === \"ack\") {\n    return runAck(args.file, { note: args.note, eventId: args.eventId, json: args.json });\n  }\n  if (args.command === \"eval\") {\n    return runEval({ json: args.json, limit: args.last, agent: args.agent });\n  }\n  if (args.command === \"badge\") {\n    return runBadge(args.file, { out: args.out });\n  }\n  if (args.command === \"sarif\") {\n    return runSarif(args.file, { out: args.out });\n  }\n  if (args.command === \"export\") {\n    return runExport(args.file, { format: args.format, out: args.out, agent: args.agent });\n  }\n  if (args.command === \"prune\") {\n    return runPrune(args.file, { dryRun: args.dryRun });\n  }\n  if (args.command === \"init\") {\n    return runInit({ prepare: args.prepare, agents: args.agents, pr: args.pr, guard: args.guard });\n  }\n  if (args.command === \"hook\") {\n    return runHook(args.file, args.hookDialect ?? \"claude\");\n  }\n  if (args.command === \"install-hook\") {\n    return runInstallHook();\n  }\n  if (args.command === \"setup-local\") {\n    return runSetupLocal();\n  }\n  if (args.command === \"rederive\") {\n    return runRederive(args.file, {\n      source: args.agent,\n      branch: args.branchScope,\n      redact: args.redact,\n      compact: args.compact,\n    });\n  }\n  if (args.command === \"guardrails\") {\n    // for `guardrails`, the positional (args.file) is a session selector\n    return runGuardrails({\n      selector: args.file,\n      agent: args.agent,\n      last: args.last,\n      out: args.out,\n      copy: args.copy,\n      json: args.json,\n    });\n  }\n  if (args.command === \"trends\") {\n    return runTrends({\n      selector: args.file,\n      agent: args.agent,\n      last: args.last,\n      out: args.out,\n      copy: args.copy,\n      json: args.json,\n      color: args.color,\n    });\n  }\n  if (args.command === \"pr\") {\n    return runPr({\n      out: args.out,\n      branch: args.branchScope,\n      base: args.base,\n      wholeSession: args.wholeSession,\n      store: args.store,\n      criteria: args.criteria,\n    });\n  }\n  if (args.command === \"reconcile\") {\n    return runReconcile({ branch: args.branchScope });\n  }\n  if (args.command === \"preview\") {\n    // M79 — render the work record locally (exactly what CI will post), store nothing.\n    if (process.env.RECEIPTS_PREVIEW !== \"1\") {\n      process.stderr.write(\n        \"receipts preview is experimental — set RECEIPTS_PREVIEW=1 to enable (render the work record locally before you push).\\n\",\n      );\n      return 1;\n    }\n    return runPr({\n      branch: args.branchScope,\n      base: args.base,\n      wholeSession: args.wholeSession,\n      preview: true,\n      criteria: args.criteria,\n    });\n  }\n  if (args.command === \"assert\") {\n    return runAssert({ selector: args.file, agent: args.agent, json: args.json });\n  }\n  if (args.command === \"verdict\") {\n    return runVerdict({ selector: args.file, agent: args.agent, json: args.json });\n  }\n  if (args.command === \"mcp\") {\n    // Dynamic import keeps the MCP SDK out of every other code path.\n    const { startStdio } = await import(\"./mcp/server.js\");\n    await startStdio();\n    // Stay alive while the transport serves stdio; resolve when the client\n    // closes the input stream (so the process exits cleanly).\n    await new Promise<void>((resolve) => {\n      process.stdin.once(\"close\", resolve);\n      process.stdin.once(\"end\", resolve);\n    });\n    return 0;\n  }\n\n  if (!(await anyDetected())) {\n    process.stderr.write(\n      `No agent transcripts found under ${rootsHint()}.\\nRun a coding-agent session first, then try again.\\n`,\n    );\n    return 1;\n  }\n\n  const sessions = await listSessions(args.agent);\n\n  if (args.list) {\n    process.stdout.write(renderList(sessions, { color: args.color }));\n    return 0;\n  }\n\n  const summary = selectSummary(sessions, args.selector);\n  if (!summary) {\n    process.stderr.write(\n      args.selector\n        ? `No session matched \"${args.selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n\n  const derived = deriveSpans(session);\n  const findings = deriveFindings(derived);\n\n  if (args.json) {\n    let receipt = await buildReceipt(session, derived, findings);\n    if (args.redact) {\n      receipt = redactReceipt(receipt);\n    }\n    const out = args.compact ? canonicalize(receipt) : JSON.stringify(receipt, null, 2);\n    if (args.out) {\n      writeFileSync(args.out, `${out}\\n`);\n      process.stderr.write(`Receipt written to ${args.out}\\n`);\n      return 0;\n    }\n    emit(out, args.copy, \"Receipt\");\n    return 0;\n  }\n\n  if (args.share) {\n    const md = renderShareMarkdown({ summary, session, derived, findings });\n    emit(md.trimEnd(), args.copy, \"Shareable summary\");\n    return 0;\n  }\n\n  if (args.handoff) {\n    const receipt = redactReceipt(await buildReceipt(session, derived, findings));\n    const md = renderHandoffMarkdown(buildHandoff(receipt, findings));\n    emit(md.trimEnd(), args.copy, \"Handoff\");\n    return 0;\n  }\n\n  process.stdout.write(renderCard({ summary, derived, findings }, { color: args.color }));\n  return 0;\n}\n\nfunction git(args: string[]): string {\n  const r = spawnSync(\"git\", args, { encoding: \"utf8\" });\n  return r.status === 0 ? r.stdout.trim() : \"\";\n}\n\n/**\n * `receipts pr` — find the session that built the current git branch (matching\n * gitBranch + repo root from the transcript), and write its redacted Receipt to\n * `.receipts/<branch>.json` so the \"Verified-by: Receipts\" workflow can sign it.\n */\n/** How many recent in-repo sessions to scan when the branch session didn't produce the\n * diff (the integration-branch / squash-merge case). Bounds the cost of the fallback. */\nconst PR_SELECT_SCAN = 150;\n\n/** A loaded session + its derived evidence, returned by the `pr` session picker. */\ninterface PickedSession {\n  summary: SessionSummary;\n  session: Session;\n  derived: DerivedSummary;\n}\n\n/** How many of `files` (the diff) a session's edits touched — the evidence that this\n * session actually produced (part of) the change. */\nexport function diffOverlap(derived: DerivedSummary, files: readonly string[]): number {\n  return derived.filesChanged.filter((f) => inDiff(f.path, files)).length;\n}\n\n/** Earliest author time (epoch ms) of any commit unique to this branch, or null when\n * unknowable (no base, no commits yet, no git). Author time — not commit time — keeps\n * rebases and cherry-picks permissive: carried-over work keeps its old author date, so\n * the old session that produced it stays eligible (SPEC-0068 R3). */\nexport function branchBirthMs(base?: string): number | null {\n  if (!base) {\n    return null;\n  }\n  const out = git([\"log\", \"--reverse\", \"--format=%at\", `${base}..HEAD`]);\n  const first = Number(out.split(\"\\n\")[0]?.trim());\n  return Number.isFinite(first) && first > 0 ? first * 1000 : null;\n}\n\n/** A fallback-scan candidate is stale — and ineligible — when it ended before the\n * branch's first commit was authored: a session that ended before the branch existed\n * cannot have produced its diff (SPEC-0068 R3). Unknown times ⇒ not stale (guard off). */\nexport function staleForBranch(endedAt: number | undefined, birthMs: number | null): boolean {\n  return birthMs != null && endedAt != null && endedAt < birthMs;\n}\n\n/**\n * Pick the session that backs a diff-scoped `receipts pr`. A diff-scoped receipt is about\n * *who produced this change*, so the right session is the one whose edits **overlap the\n * diff** — not merely one carrying the branch tag. The branch-matched session is tried\n * first (cheap, the common feature-branch case); only when it didn't touch the diff (an\n * integration/release branch whose work was merged from feature branches, or a squash\n * workflow — where the branch tag carries only unrelated sessions) do we scan recent\n * in-repo sessions for the real author. Evidence-based: only a session that edited a diff\n * file can win, so this never mis-attributes an unrelated session's work (cf. M56). Returns\n * the branch session (even at 0 overlap) as an honest last resort, or null if none.\n */\nasync function pickForDiff(\n  all: SessionSummary[],\n  branch: string,\n  repoRoot: string | undefined,\n  files: readonly string[],\n  birthMs: number | null = null,\n  shas: readonly string[] = [],\n): Promise<PickedSession | null> {\n  const load = async (sum: SessionSummary): Promise<PickedSession | null> => {\n    const session = await loadSession(sum);\n    if (!session) {\n      return null;\n    }\n    return { summary: sum, session, derived: deriveSpans(session) };\n  };\n\n  // 0) strongest evidence first (SPEC-0069): a session whose `git commit`/`git push`\n  // OUTPUT carries one of this branch's commit SHAs authored the branch — exact and\n  // agent-agnostic (Codex/Cursor record no branch tags and often edit via shell, so\n  // the tag and edit-overlap selectors below can't see them). The pool is NOT\n  // repo-filtered: a commit SHA is globally unique, so a session run from another\n  // checkout (worktree, cross-repo tooling) attributes correctly too. Most-recent\n  // first; the first authored match wins.\n  if (shas.length > 0) {\n    for (const sum of all.slice(0, PR_SELECT_SCAN)) {\n      const cand = await load(sum);\n      if (cand && authoredBranch(cand.derived.spans, shas)) {\n        return cand;\n      }\n    }\n  }\n\n  // 1) cheap path: the branch-matched session, if it actually produced the diff.\n  const primarySum = selectForBranch(all, branch, repoRoot);\n  const primary = primarySum ? await load(primarySum) : null;\n  if (primary && diffOverlap(primary.derived, files) > 0) {\n    return primary;\n  }\n\n  // 2) the branch session didn't touch the diff → find the session that did, among the\n  // most-recent in-repo sessions (bounded). Most-recent-first, so ties keep the newest.\n  // Stale guard (SPEC-0068 R3): unlike the tag-matched primary, a scan candidate's only\n  // evidence is file overlap — and an old session that once edited the same hot file\n  // (.husky/pre-push, cli.ts, README) overlaps every later diff that touches it. A\n  // session that ended before this branch's first commit was authored is excluded.\n  let best: PickedSession | null = null;\n  let bestScore = 0;\n  const recent = all\n    .filter((s) => inRepo(s.projectPath, repoRoot))\n    .filter((s) => !staleForBranch(s.endedAt, birthMs))\n    .slice(0, PR_SELECT_SCAN);\n  for (const sum of recent) {\n    const cand = await load(sum);\n    if (!cand) {\n      continue;\n    }\n    const score = diffOverlap(cand.derived, files);\n    if (score > bestScore) {\n      best = cand;\n      bestScore = score;\n    }\n  }\n  return best ?? primary;\n}\n\n/**\n * SPEC-0120 — the opt-in external-state reconciler CLI step (CI only). Finds the branch's\n * session, parses its external-state claims, calls the authoritative API (`gh`), and writes the\n * reconciliation side-log that `receipts pr` then attaches. Opt-in: a no-op unless\n * `RECEIPTS_RECONCILE` is set. The deterministic `receipts pr`/`verify` core never calls this.\n */\nasync function runReconcile(opts: { branch?: string }): Promise<number> {\n  if (!process.env.RECEIPTS_RECONCILE) {\n    process.stderr.write(\n      \"receipts reconcile: opt-in — set RECEIPTS_RECONCILE=1 to reconcile external-state claims against the GitHub API.\\n\",\n    );\n    return 0;\n  }\n  const branch = opts.branch || git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || undefined;\n  if (!branch || branch === \"HEAD\") {\n    process.stderr.write(\"receipts reconcile: not on a git branch (use --branch <name>).\\n\");\n    return 1;\n  }\n  // Pick the SAME session `receipts pr` will attach to, so the side-log's sessionId matches the\n  // produced receipt (a diff-scoped `pr` uses pickForDiff, not selectForBranch — they can differ).\n  const all = await listSessions();\n  const diff = changedFiles(undefined, {});\n  let session: Awaited<ReturnType<typeof loadSession>> | null = null;\n  if (diff) {\n    const picked = await pickForDiff(\n      all,\n      branch,\n      repoRoot,\n      diff.files,\n      branchBirthMs(diff.base),\n      branchShas(diff.base),\n    );\n    session = picked?.session ?? null;\n  }\n  if (!session) {\n    const summary = selectForBranch(all, branch, repoRoot);\n    session = summary ? await loadSession(summary) : null;\n  }\n  if (!session) {\n    process.stderr.write(`receipts reconcile: no agent session found for branch \"${branch}\".\\n`);\n    return 0;\n  }\n  const finalText =\n    [...session.messages].reverse().find((m) => m.role === \"assistant\" && m.text)?.text ?? \"\";\n  const sessionId = sessionIdFromPath(session.filePath);\n  const res = reconcileSession(sessionId, finalText, ghFetcher, new Date().toISOString());\n  const diverged = res.rows.filter((r) => !r.match).length;\n  process.stdout.write(\n    `receipts reconcile: ${res.claims} claim${res.claims === 1 ? \"\" : \"s\"} parsed · ${res.rows.length} reconciled (${diverged} divergence${diverged === 1 ? \"\" : \"s\"}) → side-log for ${sessionId}.\\n`,\n  );\n  return 0;\n}\n\nasync function runPr(opts: {\n  out?: string;\n  branch?: string;\n  base?: string;\n  store?: string;\n  wholeSession?: boolean;\n  /** M79 — render the work record to the terminal and store nothing (preview). */\n  preview?: boolean;\n  /** the triggering command also carries a `git commit` (compound commit+push):\n   * union the working tree into the diff scope — those files aren't in HEAD yet */\n  pendingCommit?: boolean;\n  /** SPEC-0118 — a `--criteria <file>` of definition-of-done items (one per line), merged\n   * with `.receipts/asserts.json` `criteria`. */\n  criteria?: string;\n}): Promise<number> {\n  const branch = opts.branch || git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]);\n  if (!branch || branch === \"HEAD\") {\n    process.stderr.write(\"receipts pr: not on a git branch (use --branch <name>).\\n\");\n    return 1;\n  }\n\n  // Diff-scope by default: the receipt reflects only this PR's change. The changed\n  // file set is recorded in `predicate.scope` so the receipt stays re-derivable\n  // (SPEC-0013). Fall back to a branch slice, then the whole session, and say which.\n  const diff = opts.wholeSession\n    ? null\n    : changedFiles(opts.base, { includeWorkingTree: opts.pendingCommit });\n  const all = await listSessions();\n  const picked = diff\n    ? await pickForDiff(\n        all,\n        branch,\n        repoRoot || undefined,\n        diff.files,\n        branchBirthMs(diff.base),\n        branchShas(diff.base),\n      )\n    : await (async () => {\n        const sum = selectForBranch(all, branch, repoRoot || undefined);\n        return sum ? { summary: sum, session: await loadSession(sum), derived: null } : null;\n      })();\n\n  if (!picked || !picked.session) {\n    process.stderr.write(\n      `receipts pr: no agent session found for branch \"${branch}\" in this repo.\\nBuild the branch with a coding agent first, or run \\`receipts --list\\`.\\n`,\n    );\n    return 1;\n  }\n  const { summary, session } = picked;\n\n  // SPEC-0118 completion-oracle — load the user's definition-of-done (criteria) once and\n  // attach it to the summary before deriving, so the completion detector can attest\n  // per-criterion artifact coverage. Pure file read; absent ⇒ the detector no-ops.\n  const criteria = loadCriteria(repoRoot || \".\", opts.criteria);\n\n  let scopedSession = session;\n  let derived = picked.derived ?? deriveSpans(session);\n  if (criteria.length) {\n    derived.criteria = criteria;\n  }\n  let findings = deriveFindings(derived);\n  // SPEC-0118 — capture the completion result on the PRE-scope summary (same inputs as the\n  // finding), so the recorded count matches the surviving finding after diff-scoping.\n  let completion = criteria.length\n    ? computeCompletion(derived, [...findings.main, ...findings.minor])\n    : undefined;\n  let scope: ReceiptScope = { kind: \"session\" };\n  let scopeNote = \"whole session\";\n\n  if (diff) {\n    const sd = applyDiffScope(derived, findings, diff.files, session.projectPath);\n    derived = sd.derived;\n    findings = sd.findings;\n    // Record the branch this diff receipt is FOR — used as the receipt title (the session's\n    // first-message title is shared across every branch a long session produces). Recorded in scope\n    // so L1 re-derivation reproduces the same title. (Effort narrowing stays shas-driven, below.)\n    scope = { kind: \"diff\", base: diff.base, files: diff.files, ...(branch ? { branch } : {}) };\n    // M83b — per-repo `generated` coverage globs from env (a repo commits this in its\n    // Claude settings env, like RECEIPTS_STORE). Recorded in scope so rederive re-applies\n    // the same globs (L1). Colon- or comma-separated.\n    const genGlobs = (process.env.RECEIPTS_GENERATED_GLOBS || \"\")\n      .split(/[:,]/)\n      .map((s) => s.trim())\n      .filter(Boolean);\n    if (genGlobs.length) {\n      scope.generatedGlobs = genGlobs;\n    }\n    scopeNote = `diff vs ${diff.base} (${diff.files.length} file${diff.files.length === 1 ? \"\" : \"s\"})`;\n    // Branch-narrowed effort (SPEC-0068 R4): this branch's turns ∩ diff-file edits.\n    // `scope.branch` records the narrowing so rederive reproduces it byte-for-byte.\n    const slice = sliceByBranch(session, branch);\n    let eff = narrowEffort(slice ? deriveSpans(slice) : null, diff.files);\n    if (!eff) {\n      // Tagless session (codex): bound by the branch's commit window instead\n      // (SPEC-0072 R1) — without this, sibling PRs of one marathon session that\n      // share a file each inherit the file's whole edit history. `scope.shas`\n      // records the anchors so rederive reproduces the window.\n      const shas = branchShas(diff.base);\n      const win = shaWindow(derived.spans, shas);\n      if (win) {\n        eff = windowedEffort(derived, diff.files, win);\n        if (eff) {\n          scope.shas = shas;\n        }\n      }\n    }\n    if (eff) {\n      derived = { ...derived, diffCostUsd: eff.cost, diffTokens: eff.tokens, diffTurns: eff.turns };\n      scope.branch = branch;\n    }\n  } else if (!opts.wholeSession) {\n    const slice = sliceByBranch(session, branch);\n    if (slice) {\n      scopedSession = slice;\n      derived = deriveSpans(slice);\n      if (criteria.length) {\n        derived.criteria = criteria;\n      }\n      findings = deriveFindings(derived);\n      completion = criteria.length\n        ? computeCompletion(derived, [...findings.main, ...findings.minor])\n        : undefined;\n      scope = { kind: \"branch\", branch };\n      scopeNote = `branch ${branch} (no git diff)`;\n    } else {\n      scopeNote = \"whole session (no diff / branch tags)\";\n    }\n  }\n\n  // M103 — read the live-guard side-log for this session (the deny/ask/warn decisions the\n  // receipts-guard hook recorded before the calls ran). Attached as a recorded input.\n  const guardEvents = readGuardEvents(sessionIdFromPath(scopedSession.filePath));\n  // M116 — read the external-state reconciliation side-log (the opt-in reconciler's API-vs-claim\n  // rows). Recorded input like guardEvents; absent ⇒ no rows (the reconciler is opt-in, default-off).\n  const externalState = readExternalState(sessionIdFromPath(scopedSession.filePath));\n  // M104 — load + attribute the session's subagent work (separate transcripts the parent never\n  // inlines, so otherwise invisible to the receipt). Recorded input; surfaced merge-relevant only.\n  const subagents = await loadSubagentActivity(scopedSession.filePath, {\n    diffFiles: scope?.kind === \"diff\" ? scope.files : undefined,\n  });\n  // M106b — discover a router-emitted witness log for this session and cross-check the\n  // model-decision surface. Recorded input like guardEvents; absent ⇒ self-reported (no row).\n  const witness = discoverWitness(\n    scopedSession,\n    process.env.RECEIPTS_WITNESS_LOG ??\n      process.env.ALTIMATE_ROUTER_WITNESS_LOG ??\n      join(homedir(), \".altimate-router\", \"witness\"),\n    process.env.RECEIPTS_WITNESS_KEY ?? process.env.ALTIMATE_ROUTER_GATEWAY_KEY,\n  );\n  // M120 — run opt-in L2 scanners over the diff scope (gated by RECEIPTS_EXPERIMENTAL_DETECTORS;\n  // diff-scoped only). A recorded input like guardEvents; absent/disabled ⇒ no rows.\n  const scanners =\n    scope.kind === \"diff\" && scope.files?.length\n      ? runScanners({ scopeFiles: scope.files, base: scope.base, repoRoot: repoRoot || undefined })\n      : [];\n  const receipt = redactReceipt(\n    await buildReceipt(scopedSession, derived, findings, {\n      scope,\n      guardEvents,\n      subagents,\n      witness,\n      scanners,\n      externalState,\n      completion,\n    }),\n  );\n\n  // Prior-receipt accumulation: cumulative PR effort (SPEC-0072 R3) + the append-only\n  // push ledger and cleared-event carry (SPEC-0073 R6/R7). Same-session regeneration\n  // replaces its own snapshot — only carried priors persist.\n  const p = receipt.predicate;\n  if (repoRoot && scope.kind === \"diff\") {\n    const slug = branch.replace(/[/\\\\]/g, \"-\");\n    let priorRaw: string | null = null;\n    try {\n      priorRaw = readReceiptRef(slug, repoRoot);\n      if (priorRaw == null) {\n        const f = join(repoRoot, \".receipts\", `${slug}.json`);\n        priorRaw = existsSync(f) ? readFileSync(f, \"utf8\") : null;\n      }\n    } catch {\n      priorRaw = null;\n    }\n    if (priorRaw != null) {\n      try {\n        const prev = (JSON.parse(priorRaw) as Receipt).predicate;\n        const sameSession =\n          prev.session?.startedAt === p.session.startedAt &&\n          prev.session?.agent === p.session.agent;\n        if (p.evidence.diffCostUsd != null) {\n          const priorUsd = sameSession\n            ? (prev.prEffort?.priorUsd ?? 0)\n            : (prev.prEffort?.totalUsd ?? prev.evidence.diffCostUsd ?? 0);\n          const sessions = sameSession\n            ? (prev.prEffort?.sessions ?? 1)\n            : (prev.prEffort?.sessions ?? 1) + 1;\n          if (priorUsd > 0) {\n            p.prEffort = {\n              priorUsd: Math.round(priorUsd * 100) / 100,\n              totalUsd: Math.round((priorUsd + p.evidence.diffCostUsd) * 100) / 100,\n              sessions,\n            };\n          }\n        }\n        // SPEC-0073 R6/R7 — event-state diff vs the prior receipt's VISIBLE events\n        // (same predicate as the renderer, so cleared rows only reference events that\n        // were shown), then append/replace the push-ledger entry.\n        const prevVisible = visibleMergeFindings(prev.findings ?? []);\n        const currVisible = visibleMergeFindings(p.findings);\n        const currKeys = new Set(currVisible.map(eventKey));\n        const prevKeys = new Set(prevVisible.map(eventKey));\n        const clearedNow = prevVisible\n          .filter((f) => !currKeys.has(eventKey(f)))\n          .map((f) => ({ title: f.title, ...(f.filePath ? { filePath: f.filePath } : {}) }));\n        const newCount = currVisible.filter((f) => !prevKeys.has(eventKey(f))).length;\n        const base = prev.prHistory?.length\n          ? prev.prHistory\n          : [\n              {\n                push: 1,\n                ...(prev.session?.endedAt ? { endedAt: prev.session.endedAt } : {}),\n                new: prevVisible.length,\n                cleared: 0,\n                open: prevVisible.length,\n                ...(prev.evidence.diffCostUsd != null\n                  ? { costUsd: prev.evidence.diffCostUsd }\n                  : {}),\n              },\n            ];\n        // Per-COMMIT rows (field ask: \"show commit-level spend\"): a new HEAD sha\n        // appends a row even within one session; regenerating on the same sha\n        // replaces the row (the hook re-runs per push attempt).\n        const sha = git([\"rev-parse\", \"--short=7\", \"HEAD\"]) || undefined;\n        const last = base[base.length - 1];\n        const sameHead = !!sha && last.sha === sha;\n        const entry = {\n          push: sameHead ? last.push : last.push + 1,\n          ...(sha ? { sha } : {}),\n          ...(p.session.endedAt ? { endedAt: p.session.endedAt } : {}),\n          new: newCount,\n          cleared: clearedNow.length,\n          open: currVisible.length,\n          ...(p.evidence.diffCostUsd != null ? { costUsd: p.evidence.diffCostUsd } : {}),\n        };\n        p.prHistory = [...(sameHead ? base.slice(0, -1) : base), entry].slice(-10);\n        if (clearedNow.length) {\n          p.prCleared = clearedNow;\n        }\n      } catch {\n        // unreadable prior — honest under-claim: no accumulation\n      }\n    }\n  }\n\n  // M79 — preview: render the EXACT Agent Work Record a reviewer will see (the same\n  // renderPrComment the CI Action mirrors), to the terminal, and store nothing. Runs\n  // the full build above (scope, effort, prEffort/prHistory) so the preview is\n  // byte-identical to the eventual comment. Adoption lever: see it before you push.\n  if (opts.preview) {\n    process.stdout.write(\n      renderPrComment(receipt, { nextAction: process.env.RECEIPTS_NEXT_ACTION !== \"0\" }),\n    );\n    process.stderr.write(\n      `receipts preview: rendered the work record (${scopeNote}); wrote nothing. This is exactly what CI will post.\\n`,\n    );\n    return 0;\n  }\n\n  const json = `${JSON.stringify(receipt, null, 2)}\\n`;\n\n  // M65 (SPEC-0064): where the receipt lives is configurable; default `commit` keeps today's\n  // behavior. `none` emits to stdout and writes nothing; `ref` (SPEC-0070) stores it at\n  // refs/receipts/<slug> with no tree files. `ephemeral`/`upload` remain unbuilt — they fall\n  // back to `commit` with a notice so nothing silently changes.\n  const store = (\n    opts.store ||\n    process.env.RECEIPTS_STORE ||\n    (repoRoot\n      ? (settingsStore(repoRoot) ?? settingsStore(primaryCheckout(repoRoot) ?? \"\"))\n      : undefined) ||\n    \"commit\"\n  ).toLowerCase();\n  if (store === \"none\") {\n    process.stdout.write(json);\n    process.stderr.write(\n      `receipts pr: store=none — printed the receipt (Grade ${receipt.predicate.grade}, ${scopeNote}); wrote nothing.\\n`,\n    );\n    return 0;\n  }\n  if ([\"ephemeral\", \"notes\", \"upload\"].includes(store)) {\n    process.stderr.write(\n      `receipts pr: store=${store} not yet implemented (SPEC-0064) — using \\`commit\\`.\\n`,\n    );\n  } else if (store !== \"commit\" && store !== \"ref\") {\n    process.stderr.write(`receipts pr: unknown store=${store} — using \\`commit\\`.\\n`);\n  }\n\n  const safe = branch.replace(/[/\\\\]/g, \"-\");\n\n  // store=ref (SPEC-0070): the receipt lives at refs/receipts/<slug> — no tree\n  // files, no PR-diff entry, nothing on main. The hook pushes the ref alongside\n  // the branch; CI fetches it. Falls back to `commit` if the plumbing fails.\n  if (store === \"ref\") {\n    const w = writeReceiptRef(safe, branch, json, summary.endedAt, repoRoot || undefined);\n    if (w.ok) {\n      process.stderr.write(\n        `receipts pr: wrote ${w.ref} (Grade ${receipt.predicate.grade}, ${scopeNote}) from \"${summary.title ?? \"untitled\"}\" — no tree files.\\n`,\n      );\n      return 0;\n    }\n    process.stderr.write(`receipts pr: store=ref failed (${w.reason}) — using \\`commit\\`.\\n`);\n  }\n\n  const dir = join(repoRoot || \".\", \".receipts\");\n  const out = opts.out ?? join(dir, `${safe}.json`);\n  mkdirSync(dir, { recursive: true });\n  // Mark receipts linguist-generated so GitHub collapses them in PR diffs (the\n  // \"one more JSON in every PR\" complaint — docs/research/receipt-transport-options.md).\n  // Written here, not just in init, so existing adopters pick it up on their next receipt.\n  const attrs = join(dir, \".gitattributes\");\n  if (!existsSync(attrs)) {\n    writeFileSync(attrs, \"* linguist-generated\\n\");\n    git([\"add\", attrs]);\n  }\n  writeFileSync(out, json);\n  git([\"add\", out]); // best-effort stage\n\n  const rel = repoRoot ? relative(repoRoot, out) : out;\n  process.stderr.write(\n    `receipts pr: wrote ${rel} (Grade ${receipt.predicate.grade}, ${scopeNote}) from \"${summary.title ?? \"untitled\"}\".\\n`,\n  );\n  return 0;\n}\n\n/**\n * `receipts guardrails [selector] [--last N]` — turn findings into a paste-ready\n * prevention block (AGENTS.md / CLAUDE.md). Aggregates the deduped guardrailRules.\n */\nasync function runGuardrails(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  last?: number;\n  out?: string;\n  copy?: boolean;\n  json?: boolean;\n}): Promise<number> {\n  if (!(await anyDetected())) {\n    process.stderr.write(`No agent transcripts found under ${rootsHint()}.\\n`);\n    return 1;\n  }\n\n  const derivations = await deriveTargets({\n    agent: opts.agent,\n    last: opts.last,\n    selector: opts.selector,\n  });\n  if (derivations.length === 0) {\n    process.stderr.write(\"guardrails: no matching session.\\n\");\n    return 1;\n  }\n  const findingSets = derivations.map((d) => d.findings);\n\n  const rules = collectGuardrails(findingSets);\n  const block = renderGuardrailsBlock(rules, opts.json ? \"json\" : \"md\");\n\n  if (opts.out) {\n    const existing = existsSync(opts.out) ? readFileSync(opts.out, \"utf8\") : \"\";\n    writeFileSync(opts.out, upsertGuardrailsSection(existing, block));\n    process.stderr.write(\n      `guardrails: wrote ${rules.length} rule(s) to ${opts.out} (from ${findingSets.length} session${findingSets.length === 1 ? \"\" : \"s\"}).\\n`,\n    );\n    return 0;\n  }\n\n  emit(block, opts.copy ?? false, \"Guardrails\");\n  if (opts.last) {\n    process.stderr.write(`(from the last ${findingSets.length} sessions)\\n`);\n  }\n  return 0;\n}\n\n/**\n * `receipts trends [--last N]` — a cross-session digest: grade movement, the finding\n * kinds that recur most, and evidence totals over your last N sessions. Reuses the\n * same per-session derivation as the Report Card; deterministic, zero model calls.\n */\nasync function runTrends(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  last?: number;\n  out?: string;\n  copy?: boolean;\n  json?: boolean;\n  color?: boolean;\n}): Promise<number> {\n  if (!(await anyDetected())) {\n    process.stderr.write(`No agent transcripts found under ${rootsHint()}.\\n`);\n    return 1;\n  }\n\n  // A trend needs a window: default to the last 10 sessions. An explicit selector\n  // pins a single session; --last N overrides both.\n  const requested = opts.last && opts.last > 0 ? opts.last : opts.selector ? 1 : 10;\n  const derivations = await deriveTargets(\n    opts.last && opts.last > 0\n      ? { agent: opts.agent, last: opts.last }\n      : opts.selector\n        ? { agent: opts.agent, selector: opts.selector }\n        : { agent: opts.agent, last: 10 },\n  );\n  if (derivations.length === 0) {\n    process.stderr.write(\"trends: no matching sessions.\\n\");\n    return 1;\n  }\n\n  // deriveTargets is most-recent-first; the digest reads oldest → newest.\n  const inputs = derivations\n    .slice()\n    .reverse()\n    .map((d) => ({ derived: d.derived, findings: d.findings }));\n  const trends = computeTrends(inputs, requested);\n\n  if (opts.out) {\n    const block = renderTrends(trends, \"md\");\n    const existing = existsSync(opts.out) ? readFileSync(opts.out, \"utf8\") : \"\";\n    writeFileSync(opts.out, upsertTrendsSection(existing, block));\n    process.stderr.write(\n      `trends: wrote section to ${opts.out} (from ${trends.window.used} sessions).\\n`,\n    );\n    return 0;\n  }\n\n  if (opts.json) {\n    emit(renderTrends(trends, \"json\"), opts.copy ?? false, \"Trends\");\n    return 0;\n  }\n\n  process.stdout.write(renderTrends(trends, \"card\", { color: opts.color }));\n  if (opts.copy) {\n    const ok = copyToClipboard(renderTrends(trends, \"card\", { color: false }));\n    process.stderr.write(\n      ok ? \"Trends copied to clipboard.\\n\" : \"Clipboard unavailable — copy the output above.\\n\",\n    );\n  }\n  return 0;\n}\n\n/** `receipts envelope <receipt.json>` — wrap a Receipt as an unsigned DSSE envelope. */\nfunction runEnvelope(file?: string): number {\n  if (!file) {\n    process.stderr.write(\"Usage: receipts envelope <receipt.json>\\n\");\n    return 1;\n  }\n  try {\n    const receipt = JSON.parse(readFileSync(file, \"utf8\"));\n    process.stdout.write(`${JSON.stringify(toDsseEnvelope(receipt), null, 2)}\\n`);\n    return 0;\n  } catch (err) {\n    process.stderr.write(`Could not read ${file}: ${err instanceof Error ? err.message : err}\\n`);\n    return 1;\n  }\n}\n\n/** `receipts verify <bundle> [--transcript <t> --branch b]` — structural + re-derivation. */\nasync function runVerify(\n  file?: string,\n  opts: { transcript?: string; branch?: string; witness?: string } = {},\n): Promise<number> {\n  if (!file) {\n    process.stderr.write(\"Usage: receipts verify <bundle.json> [--transcript <t> [--branch b]]\\n\");\n    return 1;\n  }\n  let input: unknown;\n  try {\n    input = JSON.parse(readFileSync(file, \"utf8\"));\n  } catch (err) {\n    process.stderr.write(`Could not read ${file}: ${err instanceof Error ? err.message : err}\\n`);\n    return 1;\n  }\n  const result = verifyBundle(input);\n  if (!result.ok) {\n    process.stderr.write(\"✗ Invalid Receipt:\\n\");\n    for (const e of result.errors) {\n      process.stderr.write(`  - ${e}\\n`);\n    }\n    return 1;\n  }\n\n  const sig = result.signed\n    ? `signed${result.rekorLogIndex !== undefined ? ` · Rekor #${result.rekorLogIndex}` : \"\"}`\n    : \"unsigned\";\n  process.stdout.write(`✓ Valid Receipt — Grade ${result.grade} · ${sig}\\n`);\n  if (result.signer) {\n    process.stdout.write(`  signer: ${result.signer}\\n`);\n  }\n\n  // Witness cross-check (M106): independently confirm the transcript's model-decision\n  // surface against a router-emitted witness log. Needs the transcript to load the session.\n  if (opts.witness) {\n    if (!opts.transcript) {\n      process.stderr.write(\"  ✗ --witness needs --transcript (to load the session to check)\\n\");\n      return 1;\n    }\n    const wres = await runWitnessCheck(opts.transcript, opts.witness);\n    if (wres !== 0) {\n      return wres;\n    }\n  }\n\n  // Re-derivation: prove the Receipt is faithful to its transcript (L1).\n  if (opts.transcript && result.receipt) {\n    const cmp = await compareToTranscript(result.receipt, opts.transcript, { branch: opts.branch });\n    if (!cmp.rederived) {\n      process.stderr.write(\"  ✗ could not re-derive from the supplied transcript\\n\");\n      return 1;\n    }\n    if (!cmp.matches) {\n      process.stderr.write(\n        \"  ✗ re-derivation MISMATCH — the Receipt does not match its transcript (possibly hand-edited)\\n\",\n      );\n      return 1;\n    }\n    process.stdout.write(\"  ✓ re-derived — faithful to the transcript (L1)\\n\");\n    return 0;\n  }\n\n  process.stdout.write(\n    \"  Note: structural check only. Pass --transcript to prove fidelity (L1); `gh attestation verify` for full Sigstore/Rekor.\\n\",\n  );\n  return 0;\n}\n\n/** Read a {@link WitnessLog} from a raw `{blocks}` file or a DSSE envelope wrapping one. */\nfunction readWitnessLog(path: string): WitnessLog | null {\n  let v: unknown;\n  try {\n    v = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    return null;\n  }\n  if (v && typeof v === \"object\" && Array.isArray((v as WitnessLog).blocks)) {\n    return v as WitnessLog;\n  }\n  // DSSE-wrapped: payload is base64 of the canonical WitnessLog JSON.\n  const payload = (v as { payload?: unknown })?.payload;\n  if (typeof payload === \"string\") {\n    try {\n      const inner = JSON.parse(Buffer.from(payload, \"base64\").toString(\"utf8\"));\n      if (inner && Array.isArray(inner.blocks)) {\n        return inner as WitnessLog;\n      }\n    } catch {\n      /* fall through */\n    }\n  }\n  return null;\n}\n\n/**\n * `verify --witness <log>` (M106): cross-check the transcript's model-decision blocks\n * against a router-emitted witness log. Returns the process exit code (0 = witnessed or\n * partial; 1 = divergence, bad signature, or load error). Non-blocking by nature — this only\n * runs when the user explicitly passes a witness log.\n */\nasync function runWitnessCheck(transcript: string, witnessPath: string): Promise<number> {\n  const log = readWitnessLog(witnessPath);\n  if (!log) {\n    process.stderr.write(`  ✗ could not read a witness log from ${witnessPath}\\n`);\n    return 1;\n  }\n  const sigKey = process.env.RECEIPTS_WITNESS_KEY ?? process.env.ALTIMATE_ROUTER_GATEWAY_KEY;\n  const sigState = verifyWitnessSig(log as unknown as Record<string, unknown>, sigKey);\n  if (sigState === \"bad\") {\n    process.stderr.write(\n      \"  ✗ witness log SIGNATURE INVALID — the log itself was altered after the router signed it. Refusing to trust it.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadById(\"claude-code\", transcript);\n  if (!session) {\n    process.stderr.write(`  ✗ could not load the transcript ${transcript}\\n`);\n    return 1;\n  }\n  const r = crossCheck(session, log);\n  if (r.tier === \"witness-divergence\") {\n    process.stderr.write(\n      `  ✗ witness divergence — ${r.missing} of ${r.witnessed} model decisions the router saw are missing from the transcript (first at block ${r.firstMissingIndex}). The submitted transcript does not match what altimate-router independently recorded.\\n`,\n    );\n    return 1;\n  }\n  const cov = r.witnessed === 0 ? \"\" : ` — ${r.present}/${r.witnessed} model decisions intact`;\n  const sigNote =\n    sigState === \"verified\"\n      ? \" · signature verified\"\n      : sigState === \"no-key\"\n        ? \" · signed (set RECEIPTS_WITNESS_KEY to verify)\"\n        : \"\";\n  process.stdout.write(`  ✓ witnessed by altimate-router${cov}${sigNote}\\n`);\n  return 0;\n}\n\n/** `receipts diff <a.json> <b.json>` — what changed between two receipts (M51). */\nfunction runDiff(\n  fileA?: string,\n  fileB?: string,\n  opts: { json?: boolean; out?: string } = {},\n): number {\n  let pathA = fileA;\n  let pathB = fileB;\n  // No args → \"what changed since the last run\": diff the two most recent committed\n  // receipts in .receipts/ (composes `log`'s history with `diff`). A = older, B = newest.\n  if (!pathA && !pathB) {\n    const hist = loadReceiptHistory(\".receipts\");\n    if (hist.length < 2) {\n      process.stderr.write(\n        `receipts diff: need two receipts. Found ${hist.length} in .receipts/ — pass two explicitly: receipts diff <a.json> <b.json>.\\n`,\n      );\n      return 1;\n    }\n    // `<slug>@ref` entries are ref-stored (SPEC-0070) — resolved by `read` below.\n    const sourceOf = (name: string): string =>\n      name.endsWith(\"@ref\") ? name : join(\".receipts\", `${name}.json`);\n    pathA = sourceOf(hist[1].name); // second-newest = baseline\n    pathB = sourceOf(hist[0].name); // newest = new\n    process.stdout.write(`receipts diff: ${hist[1].name} → ${hist[0].name} (most recent two)\\n\\n`);\n  }\n  if (!pathA || !pathB) {\n    process.stderr.write(\n      \"Usage: receipts diff [<receiptA.json> <receiptB.json>] [--json] [--out <f>]\\n\" +\n        \"  with no args, diffs the two most recent receipts in .receipts/\\n\",\n    );\n    return 1;\n  }\n  const read = (f: string): Receipt | null => {\n    let input: unknown;\n    try {\n      const raw = f.endsWith(\"@ref\") ? readReceiptRef(f.slice(0, -\"@ref\".length)) : null;\n      input = JSON.parse(raw ?? readFileSync(f, \"utf8\"));\n    } catch (err) {\n      process.stderr.write(`Could not read ${f}: ${err instanceof Error ? err.message : err}\\n`);\n      return null;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) {\n      process.stderr.write(`✗ ${f} is not a valid Receipt:\\n`);\n      for (const e of res.errors) process.stderr.write(`  - ${e}\\n`);\n      return null;\n    }\n    return res.receipt;\n  };\n  const a = read(pathA);\n  const b = read(pathB);\n  if (!a || !b) return 1;\n\n  const delta = diffReceipts(a, b);\n  const output = opts.json ? `${JSON.stringify(delta, null, 2)}\\n` : renderDiff(delta);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts diff: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts ack [slug]` (M78) — record an attributed human acknowledgment that a\n * reviewer looked at the agent's work, into an append-only local ledger\n * (refs/receipts-acks/<slug>). The active gesture + the audit signal; local-only (the\n * outward comment-write half is deferred). Gated behind `RECEIPTS_ACK=1`. */\nfunction runAck(\n  slugArg?: string,\n  opts: { note?: string; eventId?: string; json?: boolean } = {},\n): number {\n  if (process.env.RECEIPTS_ACK !== \"1\") {\n    process.stderr.write(\n      \"receipts ack is experimental — set RECEIPTS_ACK=1 to enable (record an attributed review; local-only).\\n\",\n    );\n    return 1;\n  }\n  const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const slug = (slugArg || branch || \"\").replace(/[/\\\\]/g, \"-\");\n  if (!slug) {\n    process.stderr.write(\"receipts ack: no slug and not on a git branch — pass a receipt slug.\\n\");\n    return 1;\n  }\n  const entry: AckEntry = {\n    actor: resolveActor(),\n    ts: Date.now(),\n    ...(opts.note ? { note: opts.note } : {}),\n    ...(opts.eventId ? { eventId: opts.eventId } : {}),\n  };\n  const res = appendAck(slug, entry);\n  if (!res.ok) {\n    process.stderr.write(`receipts ack: ${res.reason}.\\n`);\n    return 1;\n  }\n  if (opts.json) {\n    process.stdout.write(\n      `${JSON.stringify({ slug, ref: res.ref, total: res.total, entry }, null, 2)}\\n`,\n    );\n    return 0;\n  }\n  const who = entry.actor;\n  const what = entry.eventId ? `event \\`${entry.eventId}\\`` : `the work record for \\`${slug}\\``;\n  process.stdout.write(\n    `Acknowledged ${what} as ${who}${entry.note ? ` — \"${entry.note}\"` : \"\"} · ${res.total} ack${res.total === 1 ? \"\" : \"s\"} on record (local; refs/receipts-acks/${slug}).\\n`,\n  );\n  return 0;\n}\n\n/** `receipts fleet` (M77) — local cross-repo / cross-agent rollup over `refs/receipts/*`\n * (+ `.receipts/*.json`). Gated behind `RECEIPTS_FLEET=1` (experimental): the seed data\n * layer of the org dashboard, proving the org-record value with no server, no upload.\n * Deterministic, local-only, counts-not-verdict (R1/R2/R4). */\nfunction runFleet(opts: { repos?: string[]; json?: boolean; out?: string } = {}): number {\n  if (process.env.RECEIPTS_FLEET !== \"1\") {\n    process.stderr.write(\n      \"receipts fleet is experimental — set RECEIPTS_FLEET=1 to enable (cross-repo agent-work rollup, local-only).\\n\",\n    );\n    return 1;\n  }\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const repos = opts.repos && opts.repos.length > 0 ? opts.repos : [repoRoot];\n  const fleet = computeFleetFromRepos(repos);\n  const body = opts.json ? `${JSON.stringify(fleet, null, 2)}\\n` : renderFleet(fleet);\n  if (opts.out) {\n    writeFileSync(opts.out, body);\n    process.stdout.write(`receipts fleet: wrote ${opts.out}\\n`);\n    return 0;\n  }\n  process.stdout.write(body);\n  return 0;\n}\n\n/** `receipts log [dir]` — list the committed receipts in `.receipts/` (M52). */\nfunction runLog(dir?: string, opts: { json?: boolean; last?: number; out?: string } = {}): number {\n  const all = loadReceiptHistory(dir ?? \".receipts\");\n  const shown = opts.last ? all.slice(0, opts.last) : all;\n  const output = opts.json ? `${JSON.stringify(shown, null, 2)}\\n` : renderLog(shown, all.length);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts log: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts stats [dir]` — dogfooding scoreboard over the committed receipts (M53). */\nfunction runStats(dir?: string, opts: { json?: boolean; out?: string } = {}): number {\n  const stats = computeStats(dir ?? \".receipts\");\n  const output = opts.json ? `${JSON.stringify(stats, null, 2)}\\n` : renderStats(stats);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts stats: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts badge` (M59) — emit a shields.io endpoint JSON for a committed receipt (the\n * branch receipt by default), an at-a-glance factual state for a README/PR badge. States the\n * finding count, colors by worst severity; never a quality verdict (R2). Deterministic. */\nfunction runBadge(file?: string, opts: { out?: string } = {}): number {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const path =\n    file ??\n    (branch && branch !== \"HEAD\"\n      ? join(repoRoot, \".receipts\", `${branch.replace(/[/\\\\]/g, \"-\")}.json`)\n      : undefined);\n  if (!path || !existsSync(path)) {\n    process.stderr.write(\n      `receipts badge: no receipt found${path ? ` at ${path}` : \"\"}. Run \\`receipts pr\\` first, or pass a receipt path.\\n`,\n    );\n    return 1;\n  }\n  let input: unknown;\n  try {\n    input = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    process.stderr.write(`receipts badge: could not parse ${path}\\n`);\n    return 1;\n  }\n  const res = verifyBundle(input);\n  if (!res.ok || !res.receipt) {\n    process.stderr.write(`receipts badge: ${path} is not a valid Receipt.\\n`);\n    return 1;\n  }\n  const output = `${JSON.stringify(badgeEndpoint(res.receipt.predicate), null, 2)}\\n`;\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts badge: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts sarif` (M63) — emit SARIF 2.1.0 for a committed receipt (the branch receipt by\n * default) so GitHub code-scanning can post findings inline + in the Security tab. Pure\n * transform; uploading is the user's CI step (see docs/sarif.md). */\nfunction runSarif(file?: string, opts: { out?: string } = {}): number {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const path =\n    file ??\n    (branch && branch !== \"HEAD\"\n      ? join(repoRoot, \".receipts\", `${branch.replace(/[/\\\\]/g, \"-\")}.json`)\n      : undefined);\n  if (!path || !existsSync(path)) {\n    process.stderr.write(\n      `receipts sarif: no receipt found${path ? ` at ${path}` : \"\"}. Run \\`receipts pr\\` first, or pass a receipt path.\\n`,\n    );\n    return 1;\n  }\n  let input: unknown;\n  try {\n    input = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    process.stderr.write(`receipts sarif: could not parse ${path}\\n`);\n    return 1;\n  }\n  const res = verifyBundle(input);\n  if (!res.ok || !res.receipt) {\n    process.stderr.write(`receipts sarif: ${path} is not a valid Receipt.\\n`);\n    return 1;\n  }\n  const output = `${JSON.stringify(toSarif(res.receipt), null, 2)}\\n`;\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts sarif: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts export --format <id> [selector]` (M114) — serialize a session's Receipt to an external\n * format via the EXPORTERS registry. Resolves the session (like the default card), derives spans +\n * findings + receipt, and hands both to the exporter (otel needs the span tree; sarif ignores it).\n * Facts only — the exporters never emit a grade/score/verdict. */\nasync function runExport(\n  selector: string | undefined,\n  opts: { format?: string; out?: string; agent?: AgentSource } = {},\n): Promise<number> {\n  const exporter = opts.format ? exporterFor(opts.format) : undefined;\n  if (!exporter) {\n    process.stderr.write(\n      `receipts export: ${opts.format ? `unknown --format \"${opts.format}\"` : \"missing --format\"}. ` +\n        `Available: ${exporterIds().join(\", \")}.\\n`,\n    );\n    return 1;\n  }\n  const summary = selectSummary(await listSessions(opts.agent), selector);\n  if (!summary) {\n    process.stderr.write(\n      selector\n        ? `No session matched \"${selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n  const derived = deriveSpans(session);\n  const receipt = redactReceipt(await buildReceipt(session, derived, deriveFindings(derived)));\n  const output = exporter.export(receipt, derived);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts export: wrote ${opts.out} (${exporter.id})\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts prune` (M65b) — the committed-receipt clutter reducer: remove\n * `.receipts/<branch>.json` files whose branch no longer exists on the remote (merged/deleted),\n * keeping live-branch receipts + the example files. Live branches come from `git ls-remote`; if\n * that can't be read, it aborts and removes nothing. `--dry-run` previews. */\nfunction runPrune(dir?: string, opts: { dryRun?: boolean } = {}): number {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const dpath = dir ?? join(repoRoot, \".receipts\");\n  let files: string[];\n  try {\n    files = readdirSync(dpath).filter((f) => f.endsWith(\".json\"));\n  } catch {\n    process.stderr.write(`receipts prune: no ${dpath} directory.\\n`);\n    return 0;\n  }\n  const ls = git([\"ls-remote\", \"--heads\", \"origin\"]);\n  if (ls === null) {\n    process.stderr.write(\n      \"receipts prune: could not list remote branches (offline / no 'origin'?) — aborting, nothing removed.\\n\",\n    );\n    return 1;\n  }\n  const liveSlugs = new Set(\n    ls\n      .split(\"\\n\")\n      .map((l) => l.split(\"refs/heads/\")[1])\n      .filter(Boolean)\n      .map((b) => branchSlug(b.trim())),\n  );\n  const { keep, remove } = planPrune(files, liveSlugs);\n  if (remove.length === 0) {\n    const prunedRefs = pruneReceiptRefs(liveSlugs, opts.dryRun ?? false);\n    if (prunedRefs === 0) {\n      process.stdout.write(`receipts prune: nothing to prune (${keep.length} receipt(s) kept).\\n`);\n    }\n    return 0;\n  }\n  if (opts.dryRun) {\n    process.stdout.write(\n      `receipts prune (dry-run): would remove ${remove.length}/${files.length} receipt(s), keep ${keep.length}:\\n`,\n    );\n    for (const f of remove) {\n      process.stdout.write(`  - ${f}\\n`);\n    }\n    pruneReceiptRefs(liveSlugs, true);\n    return 0;\n  }\n  pruneReceiptRefs(liveSlugs, false);\n  for (const f of remove) {\n    const p = join(dpath, f);\n    if (git([\"rm\", \"-f\", \"--\", p]) === null) {\n      try {\n        unlinkSync(p);\n      } catch {\n        /* already gone */\n      }\n    }\n  }\n  process.stdout.write(\n    `receipts prune: removed ${remove.length} receipt(s) for merged/deleted branches; kept ${keep.length}.\\n`,\n  );\n  return 0;\n}\n\n/** Prune ref-stored receipts (SPEC-0070): a refs/receipts/<slug> whose branch is\n * gone from origin is deleted locally and on the remote. Shares runPrune's\n * liveness basis (origin's heads) and dry-run semantics. */\nfunction pruneReceiptRefs(liveSlugs: Set<string>, dryRun: boolean): number {\n  const refs = listReceiptRefs().filter(({ slug }) => !liveSlugs.has(slug));\n  if (refs.length === 0) {\n    return 0;\n  }\n  for (const { ref, slug } of refs) {\n    if (dryRun) {\n      process.stdout.write(`  - ${ref}\\n`);\n      continue;\n    }\n    git([\"update-ref\", \"-d\", ref]);\n    git([\"push\", \"origin\", `:${ref}`]); // best-effort remote cleanup\n    process.stdout.write(`receipts prune: removed ${ref} (branch ${slug} gone).\\n`);\n  }\n  return refs.length;\n}\n\n/** `receipts eval` — field scan (M57): run the work-account detectors over your own real\n * local agent sessions and report how often each merge-surface category fires. A flag rate\n * the human interprets (a flag may be a true finding or an FP), never a verdict. Local-first\n * (reads only local sessions), deterministic, 0 model calls. `--last N` bounds the scan\n * (default 200, most-recent first). The labeled precision/recall corpus is a dev/CI artifact\n * (see `eval/corpus.json` + `test/eval.test.ts`), not shipped through this command. */\nasync function runEval(\n  opts: { json?: boolean; limit?: number; agent?: AgentSource } = {},\n): Promise<number> {\n  const limit = opts.limit && opts.limit > 0 ? opts.limit : 200;\n  const summaries = (await listSessions(opts.agent)).slice(0, limit);\n  const rows: FieldRow[] = [];\n  for (const summary of summaries) {\n    const session = await loadSession(summary);\n    if (!session) {\n      continue;\n    }\n    const { main, minor } = deriveFindings(deriveSpans(session));\n    rows.push({\n      title: summary.title ?? summary.id,\n      categories: [...firedCategories([...main, ...minor])],\n    });\n  }\n  const scan = summarizeFieldScan(rows);\n  process.stdout.write(opts.json ? `${JSON.stringify(scan, null, 2)}\\n` : renderFieldScan(scan));\n  return 0;\n}\n\n/** `receipts init` — one-command integration (SPEC-0066): scaffold the quiet-mode\n * \"Verified by Receipts\" PR-check workflow AND the repo-committed Claude Code hook\n * (a frozen npx one-liner in .claude/settings.json — every contributor gets it on\n * clone, behavior updates ship via npm). `--prepare` additionally wires the git-hook\n * floor into package.json. Each artifact is independently idempotent. `--pr` then\n * does the ceremony too: branch, commit (only the generated files), push, open the\n * PR — each step best-effort, degrading to printed instructions. */\nfunction runInit(\n  opts: { prepare?: boolean; agents?: string[]; pr?: boolean; guard?: boolean } = {},\n): number {\n  const lines: string[] = [];\n  /** files this run actually created or changed — the exact commit for `--pr` */\n  const written: string[] = [];\n\n  const v = getVersion();\n  // Float the major tag (`v0`, `v1` — the `actions/checkout@v4` pattern) so adopters get new\n  // minor/patch features automatically on the next CI run; only a major bump needs a workflow\n  // edit. Security-strict adopters can pin a full version (vX.Y.Z) or a commit SHA instead.\n  const major = /^(\\d+)\\.\\d+\\.\\d+/.exec(v)?.[1];\n  const tag = major ? `v${major}` : \"v0\";\n  const dir = \".github/workflows\";\n  const path = `${dir}/receipts.yml`;\n  if (existsSync(path)) {\n    lines.push(`receipts init: ${path} already exists — leaving it untouched.`);\n  } else {\n    mkdirSync(dir, { recursive: true });\n    writeFileSync(path, workflowContent(tag, v));\n    written.push(path);\n    lines.push(`receipts init: wrote ${path} (tracking ${tag}, quiet + non-blocking).`);\n  }\n\n  // The agent-embedded trigger: generation fires inside any Claude Code session\n  // that pushes — repo state, not machine state, so there is nothing to install.\n  const settingsPath = join(\".claude\", \"settings.json\");\n  const merged = mergeHookIntoSettings(settingsPath, undefined, { defaultStoreRef: true });\n  if (!merged.ok) {\n    lines.push(`receipts init: ${merged.reason}.`);\n  } else if (merged.changed) {\n    written.push(settingsPath);\n    lines.push(\n      `receipts init: added the receipts pre-push hook to ${settingsPath} (store=ref — receipts live at refs/receipts/<branch>, no files in the tree).`,\n    );\n  } else {\n    lines.push(`receipts init: ${settingsPath} already has the receipts hook.`);\n  }\n  // Opt-in live guard (M103): classifies tool calls BEFORE they run (deny/ask/warn) and records the\n  // decision for the receipt. Off by default — active gating is the user's choice; turn it off any\n  // time with `RECEIPTS_GUARD=0` (no un-install needed).\n  if (opts.guard) {\n    const g = mergeHookIntoSettings(settingsPath, GUARD_HOOK_COMMAND, { matcher: GUARD_MATCHER });\n    if (!g.ok) {\n      lines.push(`receipts init: ${g.reason} (live guard).`);\n    } else if (g.changed) {\n      if (!written.includes(settingsPath)) written.push(settingsPath);\n      lines.push(\n        `receipts init: added the live guard (PreToolUse) to ${settingsPath} — deny/ask/warn before a tool runs. Opt out any time with RECEIPTS_GUARD=0.`,\n      );\n    } else {\n      lines.push(`receipts init: ${settingsPath} already has the live guard.`);\n    }\n  }\n  const ignorePath = join(\".claude\", \".gitignore\");\n  if (!existsSync(ignorePath)) {\n    writeFileSync(ignorePath, \"*\\n!settings.json\\n!.gitignore\\n\");\n    written.push(ignorePath);\n    lines.push(`receipts init: wrote ${ignorePath} (commit settings.json, ignore the rest).`);\n  }\n  // Codex native trigger (SPEC-0069 R4): same schema as Claude's settings hooks,\n  // different file + dialect. Written when asked for (--agents codex) or when the\n  // repo already carries a .codex/ dir (the team clearly uses Codex).\n  if (opts.agents?.includes(\"codex\") || existsSync(\".codex\")) {\n    const codexPath = join(\".codex\", \"hooks.json\");\n    const m = mergeHookIntoSettings(\n      codexPath,\n      \"npx -y altimate-receipts@latest hook pre-push --agent codex\",\n      { defaultStoreRef: true },\n    );\n    if (!m.ok) {\n      lines.push(`receipts init: ${m.reason}.`);\n    } else if (m.changed) {\n      written.push(codexPath);\n      lines.push(`receipts init: added the receipts pre-push hook to ${codexPath}.`);\n    } else {\n      lines.push(`receipts init: ${codexPath} already has the receipts hook.`);\n    }\n  }\n\n  // Receipts are linguist-generated: GitHub collapses them in PR diffs, so the\n  // committed .receipts/<branch>.json never adds review noise.\n  const attrsPath = join(\".receipts\", \".gitattributes\");\n  if (!existsSync(attrsPath)) {\n    mkdirSync(\".receipts\", { recursive: true });\n    writeFileSync(attrsPath, \"* linguist-generated\\n\");\n    written.push(attrsPath);\n    lines.push(`receipts init: wrote ${attrsPath} (receipts collapse in PR diffs).`);\n  }\n\n  if (opts.prepare) {\n    const wired = wirePrepareScript(\"package.json\");\n    if (!wired.ok) {\n      lines.push(`receipts init: ${wired.reason}.`);\n    } else if (wired.changed) {\n      written.push(\"package.json\");\n      lines.push(\n        \"receipts init: wired `prepare` in package.json — `npm install` now self-installs the git hook.\",\n      );\n    } else {\n      lines.push(\"receipts init: package.json `prepare` already wired.\");\n    }\n  }\n\n  if (opts.pr) {\n    openAdoptionPr(written, lines);\n  } else {\n    lines.push(\"  Commit these, open a PR, and receipts attach themselves from then on.\");\n    lines.push(\"  (Or let init do that too: `npx altimate-receipts init --pr`.)\");\n  }\n  if (written.includes(settingsPath)) {\n    // Field-observed: a session that ran init then pushed got no receipt — agent\n    // runtimes snapshot project hooks at session START, so the hook arms next session.\n    lines.push(\"  Note: agent sessions load hooks at startup — restart any running session once.\");\n  }\n  process.stdout.write(`${lines.join(\"\\n\")}\\n`);\n  return 0;\n}\n\nconst ADOPT_BRANCH = \"chore/adopt-receipts\";\n\n/** `init --pr` — finish the ceremony: branch, commit ONLY the files init generated,\n * push, open the PR (gh when available, else the GitHub compare URL). Every step is\n * best-effort: a failure prints what to do by hand and never loses the files. */\nfunction openAdoptionPr(written: string[], lines: string[]): void {\n  if (written.length === 0) {\n    lines.push(\"receipts init: nothing new to commit — the repo is already integrated.\");\n    return;\n  }\n  if (!git([\"rev-parse\", \"--git-dir\"])) {\n    lines.push(\"receipts init: not a git repository — commit the files above manually.\");\n    return;\n  }\n  if (git([\"rev-parse\", \"--verify\", \"--quiet\", ADOPT_BRANCH]) !== \"\") {\n    lines.push(\n      `receipts init: branch ${ADOPT_BRANCH} already exists — commit the files above to it manually.`,\n    );\n    return;\n  }\n  if (spawnSync(\"git\", [\"checkout\", \"-b\", ADOPT_BRANCH], { encoding: \"utf8\" }).status !== 0) {\n    lines.push(`receipts init: could not create branch ${ADOPT_BRANCH} — commit manually.`);\n    return;\n  }\n  spawnSync(\"git\", [\"add\", \"--\", ...written], { encoding: \"utf8\" });\n  // No --no-verify: the repo's own pre-commit checks should see the change. If they\n  // reject it, the files stay staged on the branch for the owner to finish.\n  const commit = spawnSync(\n    \"git\",\n    [\"commit\", \"-m\", \"chore: adopt receipts — zero-install agent-work verification\"],\n    { encoding: \"utf8\" },\n  );\n  if (commit.status !== 0) {\n    lines.push(\n      `receipts init: commit failed (pre-commit hooks?) — files are staged on ${ADOPT_BRANCH}; finish manually.`,\n    );\n    return;\n  }\n  lines.push(`receipts init: committed ${written.length} file(s) on ${ADOPT_BRANCH}.`);\n  const push = spawnSync(\"git\", [\"push\", \"-u\", \"origin\", ADOPT_BRANCH], { encoding: \"utf8\" });\n  if (push.status !== 0) {\n    lines.push(\n      \"receipts init: push failed (no remote / auth?) — push the branch and open a PR manually.\",\n    );\n    return;\n  }\n  lines.push(`receipts init: pushed ${ADOPT_BRANCH}.`);\n  const gh = spawnSync(\n    \"gh\",\n    [\n      \"pr\",\n      \"create\",\n      \"--title\",\n      \"chore: adopt receipts — zero-install agent-work verification\",\n      \"--body\",\n      \"Adds the Verified-by-Receipts PR check and the repo-committed agent hook (generated by `npx altimate-receipts init --pr`). Contributors install nothing — see https://github.com/AltimateAI/altimate-receipts/blob/main/docs/onboarding.md\",\n    ],\n    { encoding: \"utf8\" },\n  );\n  if (gh.status === 0) {\n    lines.push(`receipts init: opened the PR — ${gh.stdout.trim().split(\"\\n\").pop()}`);\n    return;\n  }\n  const remote = git([\"remote\", \"get-url\", \"origin\"]);\n  const slug = remote ? /github\\.com[:/]([^/]+\\/[^/.]+)/.exec(remote)?.[1] : undefined;\n  lines.push(\n    slug\n      ? `receipts init: open the PR here — https://github.com/${slug}/pull/new/${ADOPT_BRANCH}`\n      : \"receipts init: branch pushed — open a PR from it in your forge.\",\n  );\n}\n\nfunction workflowContent(tag: string, v: string): string {\n  return `name: Verified by Receipts\n\n# Deterministic \"what did the coding agent actually do?\" check on PRs. Quiet + non-blocking\n# pilot: acts only when a branch commits an agent Receipt (.receipts/<branch>.json);\n# otherwise silent. Adds a new \"Receipts\" check only — touches no existing workflow.\n# Docs: https://github.com/AltimateAI/altimate-receipts/blob/main/docs/onboarding-internal.md\n\non:\n  pull_request:\n\npermissions:\n  contents: read\n  id-token: write # Sigstore keyless signing of the receipt\n  attestations: write # record the attestation\n  pull-requests: write # post the Receipts comment\n  checks: write # post the Receipts check\n\njobs:\n  receipts:\n    # Tracks the ${tag} major tag (auto-gets minor/patch features). Pin a full version\n    # (e.g. @v${v}) or a commit SHA for immutability.\n    uses: AltimateAI/altimate-receipts/.github/workflows/receipts.reusable.yml@${tag}\n    with:\n      require-receipt: false # never fail a PR that has no receipt (soft pilot)\n      notify-when-missing: false # stay silent unless a receipt is present\n      # block-on: \"\"          # informational check; never blocks a merge\n`;\n}\n\n/** `receipts hook pre-push --agent <claude|git>` — the agent-embedded trigger\n * (SPEC-0066 R1). Reads one payload from stdin, decides, and at most adds a\n * receipt commit. Never blocks: see src/hook/prePush.ts. */\nasync function runHook(kind: string | undefined, dialect: HookDialect): Promise<number> {\n  // `receipts hook guard` — the live PreToolUse guard (M103). Reads a PreToolUse event on stdin,\n  // classifies it (deny/ask/warn/allow), records non-allow decisions for the receipt, and writes the\n  // decision JSON to stdout. Fail-open by contract (see src/hook/guard.ts).\n  if (kind === \"guard\") {\n    const stdin = await readStdin();\n    const out = runGuard(stdin);\n    if (out.stdout) process.stdout.write(out.stdout);\n    return out.exit;\n  }\n  if (kind !== \"pre-push\") {\n    process.stderr.write(\"Usage: receipts hook pre-push | guard [--agent claude|git]\\n\");\n    return 1;\n  }\n  const stdin = await readStdin();\n  const res = await runHookPrePush(dialect, stdin, async (o) =>\n    runPr({ pendingCommit: o?.pendingCommit }),\n  );\n  if (res.message) {\n    process.stderr.write(`${res.message}\\n`);\n  }\n  return res.exit;\n}\n\n/** `receipts install-hook` — write the npx-shim pre-push hook into .git/hooks\n * (the universal floor; SPEC-0066 R6). */\nfunction runInstallHook(): number {\n  const res = installGitHook();\n  if (!res.ok) {\n    process.stderr.write(`receipts install-hook: ${res.reason}.\\n`);\n    return 1;\n  }\n  const note = {\n    installed: `installed ${res.path}`,\n    unchanged: `${res.path} already installed`,\n    chained: `installed ${res.path} (existing hook preserved as pre-push.local, runs first)`,\n  }[res.action];\n  process.stdout.write(`receipts install-hook: ${note}.\\n`);\n  return 0;\n}\n\n/** `receipts setup-local` — merge the self-gated hook into the USER's\n * ~/.claude/settings.json (SPEC-0066 R8), for repos that commit only the\n * workflow file. Inert outside integrated repos (the R4 gate). */\nfunction runSetupLocal(): number {\n  const path = join(homedir(), \".claude\", \"settings.json\");\n  const res = mergeHookIntoSettings(path);\n  if (!res.ok) {\n    process.stderr.write(`receipts setup-local: ${res.reason}.\\n`);\n    return 1;\n  }\n  process.stdout.write(\n    res.changed\n      ? `receipts setup-local: added the receipts hook to ${path} — active only in repos with the Receipts workflow.\\n`\n      : `receipts setup-local: ${path} already has the receipts hook.\\n`,\n  );\n  return 0;\n}\n\n/** `receipts rederive <transcript>` — reproduce the canonical Receipt from a transcript. */\nasync function runRederive(\n  file?: string,\n  opts: { source?: AgentSource; branch?: string; redact?: boolean; compact?: boolean } = {},\n): Promise<number> {\n  if (!file) {\n    process.stderr.write(\n      \"Usage: receipts rederive <transcript.jsonl> [--agent a] [--branch b] [--redact]\\n\",\n    );\n    return 1;\n  }\n  const receipt = await rederiveFromTranscript(file, {\n    source: opts.source,\n    branch: opts.branch,\n    redact: opts.redact,\n  });\n  if (!receipt) {\n    process.stderr.write(`receipts rederive: could not read a session from ${file}\\n`);\n    return 1;\n  }\n  const out = opts.compact ? canonicalize(receipt) : JSON.stringify(receipt, null, 2);\n  process.stdout.write(`${out}\\n`);\n  return 0;\n}\n\n/** `receipts assert [selector]` — evaluate `.receipts/asserts.json` against the receipt\n * (a local CI gate the user controls). Exit non-zero iff an error-severity assertion fails\n * or the asserts file is malformed; a missing file is a clean no-op. */\nasync function runAssert(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  json?: boolean;\n}): Promise<number> {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  let asserts: Assertion[];\n  try {\n    asserts = loadAsserts(repoRoot);\n  } catch (e) {\n    process.stderr.write(`receipts assert: ${(e as Error).message}\\n`);\n    return 2; // config error — distinct from an assertion failure\n  }\n  if (asserts.length === 0) {\n    process.stdout.write(`${renderAssertResults([])}\\n`);\n    return 0; // absent file ⇒ no-op\n  }\n\n  const summary = selectSummary(await listSessions(opts.agent), opts.selector);\n  if (!summary) {\n    process.stderr.write(\n      opts.selector\n        ? `No session matched \"${opts.selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n  const derived = deriveSpans(session);\n  const receipt = await buildReceipt(session, derived, deriveFindings(derived));\n  const results = evaluateAsserts(receipt, asserts);\n\n  if (opts.json) {\n    process.stdout.write(`${JSON.stringify(results, null, 2)}\\n`);\n  } else {\n    process.stdout.write(`${renderAssertResults(results)}\\n`);\n  }\n  return assertExitCode(results);\n}\n\n/**\n * SPEC-0121 — `receipts verdict`: compute the work-verdict (VERIFIED/INCOMPLETE/WRONG/ESCALATE)\n * from the receipt's already-attested facts + an opt-in policy (`.receipts/asserts.json`). The\n * verdict is a policy decision OUTSIDE the receipt (R2) — it never mutates the predicate. No\n * asserts.json ⇒ UNJUDGED (default-off). Exits non-zero on WRONG/INCOMPLETE (like `assert`).\n */\nasync function runVerdict(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  json?: boolean;\n}): Promise<number> {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  // The policy is opt-in: it exists iff `.receipts/asserts.json` is present. Its optional\n  // `verdict` block overrides the default blockable/escalate sets and the test-outcome gate.\n  let asserts: Assertion[];\n  let cfg: { blockable?: string[]; escalateOn?: string[]; gateTestOutcome?: boolean } = {};\n  let havePolicy = false;\n  const assertsPath = join(repoRoot, \".receipts\", \"asserts.json\");\n  if (existsSync(assertsPath)) {\n    havePolicy = true;\n    try {\n      asserts = loadAsserts(repoRoot);\n      const raw = JSON.parse(readFileSync(assertsPath, \"utf8\"));\n      const v = raw && typeof raw === \"object\" && !Array.isArray(raw) ? raw.verdict : undefined;\n      if (v !== undefined) {\n        // Validate the optional `verdict` block: a non-null object with string[]/boolean fields, so\n        // a `verdict: null` (typeof \"object\"!), a typo'd field, or a wrong type is a config error —\n        // never a crash or a silent fall-back to defaults.\n        const isStrArr = (x: unknown): x is string[] =>\n          Array.isArray(x) && x.every((s) => typeof s === \"string\");\n        if (\n          !v ||\n          typeof v !== \"object\" ||\n          Array.isArray(v) ||\n          (v.blockable !== undefined && !isStrArr(v.blockable)) ||\n          (v.escalateOn !== undefined && !isStrArr(v.escalateOn)) ||\n          (v.gateTestOutcome !== undefined && typeof v.gateTestOutcome !== \"boolean\")\n        ) {\n          process.stderr.write(\n            \"receipts verdict: .receipts/asserts.json `verdict` must be an object with optional `blockable`/`escalateOn` (string arrays) and `gateTestOutcome` (boolean).\\n\",\n          );\n          return 2;\n        }\n        // Each blockable/escalateOn entry must be a CANONICAL finding-id prefix. A typo\n        // (`flake-green`) or an over-broad string (`test`) would otherwise silently gate nothing\n        // — or, worse, silently match several families the user didn't intend (codex review).\n        // Reject unknown prefixes loudly so the policy fails closed, not silent.\n        const unknown = unknownVerdictPrefixes(v);\n        if (unknown.length > 0) {\n          process.stderr.write(\n            `receipts verdict: unknown finding-id prefix(es) in \\`verdict\\`: ${unknown.join(\", \")}. Use a canonical prefix (e.g. ${DEFAULT_BLOCKABLE.slice(0, 3).join(\", \")}, …); see the check catalog.\\n`,\n          );\n          return 2;\n        }\n        cfg = v;\n      }\n    } catch (e) {\n      process.stderr.write(`receipts verdict: ${(e as Error).message}\\n`);\n      return 2;\n    }\n  } else {\n    asserts = [];\n  }\n\n  const summary = selectSummary(await listSessions(opts.agent), opts.selector);\n  if (!summary) {\n    process.stderr.write(\n      opts.selector\n        ? `No session matched \"${opts.selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n  const derived = deriveSpans(session);\n  // Redact before computing the verdict: `reasons[]` cite `finding.filePath`/`evidenceRef`, which\n  // are printed in both --json and text mode and could carry a secret-bearing path (codex review).\n  // Redaction masks only free-text values (numbers/booleans/ids untouched), so the verdict logic\n  // and every assert evaluation are identical — just the printed facts are safe.\n  const receipt = redactReceipt(await buildReceipt(session, derived, deriveFindings(derived)));\n  const policy: WorkPolicy | undefined = havePolicy\n    ? {\n        asserts: evaluateAsserts(receipt, asserts),\n        ...(Array.isArray(cfg.blockable) ? { blockable: cfg.blockable } : {}),\n        ...(Array.isArray(cfg.escalateOn) ? { escalateOn: cfg.escalateOn } : {}),\n        ...(cfg.gateTestOutcome ? { gateTestOutcome: true } : {}),\n      }\n    : undefined;\n  const result = workVerdict(receipt.predicate, policy);\n\n  if (opts.json) {\n    process.stdout.write(`${JSON.stringify(result, null, 2)}\\n`);\n  } else {\n    const head =\n      result.verdict === \"UNJUDGED\"\n        ? \"receipts verdict: UNJUDGED — no policy supplied (add .receipts/asserts.json)\"\n        : `receipts verdict: ${result.verdict} by policy`;\n    const lines = result.reasons.map((r) => `  · [${r.axis}] ${r.fact}`);\n    process.stdout.write(`${[head, ...lines].join(\"\\n\")}\\n`);\n  }\n  return verdictExitCode(result.verdict);\n}\n\n/** Write `text` to stdout; if `copy`, also try the clipboard and note the result. */\nfunction emit(text: string, copy: boolean, label: string): void {\n  process.stdout.write(`${text}\\n`);\n  if (copy) {\n    const ok = copyToClipboard(text);\n    process.stderr.write(\n      ok\n        ? `\\n${label} copied to clipboard.\\n`\n        : \"\\nClipboard unavailable — copy the output above.\\n\",\n    );\n  }\n}\n\n// Run only when executed directly as the CLI — not when imported by a test.\n// Resolve symlinks on argv[1] before comparing: Node sets import.meta.url to the\n// realpath of this module, but process.argv[1] is the path as invoked. When the CLI\n// runs through a symlink — e.g. the global npm bin (/usr/local/bin/receipts ->\n// …/dist/cli.js), or under macOS /tmp -> /private/tmp — the two differ and the guard\n// would wrongly treat the entrypoint as an import, running nothing (exit 0, no output).\nfunction resolveEntry(p: string | undefined): string | undefined {\n  if (p === undefined) return undefined;\n  try {\n    return realpathSync(p);\n  } catch {\n    return p;\n  }\n}\nconst entry = resolveEntry(process.argv[1]);\nconst isMain = entry !== undefined && import.meta.url === pathToFileURL(entry).href;\nif (isMain) {\n  // Set process.exitCode rather than calling process.exit(): process.exit()\n  // terminates before pending async writes to stdout/stderr flush, which silently\n  // truncates output when stdout is a pipe/file/redirect (not a TTY). Every command\n  // resolves cleanly with no lingering handles, so the process exits naturally once\n  // the event loop drains — after the output has flushed.\n  run(process.argv)\n    .then((code) => {\n      process.exitCode = code;\n    })\n    .catch((err: unknown) => {\n      process.stderr.write(`receipts: ${err instanceof Error ? err.message : String(err)}\\n`);\n      process.exitCode = 1;\n    });\n}\n","import { appendFileSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type GuardHit, type HookInput, evaluate } from \"../policy/guard.js\";\nimport { guardDir } from \"../receipt/guardLog.js\";\n\n// The `receipts hook guard` PreToolUse command — the live arm of the trust layer. Reads a Claude\n// Code / Codex PreToolUse event on stdin, classifies it with the shared FP-aware evaluator\n// (src/policy/guard.ts), and:\n//   deny  → block the call (permissionDecision \"deny\")  — never-legit catastrophe\n//   ask   → route to the user's confirmation prompt      — ambiguous-but-dangerous\n//   warn  → surface only, do not block                   — record-worthy, intent unknown pre-exec\n// Every non-allow decision is recorded to the per-session guard log that `receipts pr` ingests, so\n// the BLOCKED call (which never reaches the transcript) still shows up in the receipt (M103).\n//\n// FAIL-OPEN by contract: any error, or the RECEIPTS_GUARD=0 / RECEIPTS_HOOK=0 opt-out, allows the\n// call silently. A guard that breaks the agent or can't be turned off would just get uninstalled —\n// receipts' post-hoc detector is the backstop, so live enforcement can afford to favor allow.\n\n/**\n * The guard's enforcement posture (M106 watch mode):\n *  - `off`   — `RECEIPTS_GUARD=0` / `RECEIPTS_HOOK=0`: do nothing, allow silently.\n *  - `watch` — `RECEIPTS_GUARD=watch|shadow|observe`: evaluate + record, but NEVER block —\n *              narrate what it WOULD have blocked. The on-ramp: see the policy on your real\n *              traffic, build trust, then flip enforcement on.\n *  - `on`    — default: enforce (deny/ask) as configured.\n */\nfunction guardMode(): \"off\" | \"watch\" | \"on\" {\n  if (process.env.RECEIPTS_GUARD === \"0\" || process.env.RECEIPTS_HOOK === \"0\") return \"off\";\n  const m = (process.env.RECEIPTS_GUARD ?? \"\").trim().toLowerCase();\n  if (m === \"watch\" || m === \"shadow\" || m === \"observe\") return \"watch\";\n  return \"on\";\n}\n\nfunction subjectOf(i: HookInput): string {\n  if (i.tool_name === \"Bash\") return `\\`${String(i.tool_input?.command ?? \"\").slice(0, 200)}\\``;\n  return `\\`${String(i.tool_input?.file_path ?? i.tool_input?.path ?? \"\")}\\``;\n}\n\n/** Persist a non-allow decision so the post-hoc receipt can surface it (the blocked call never\n * reaches the transcript). Best-effort — a recording failure must never break the agent. */\nfunction recordDecision(i: HookInput, hit: GuardHit, subject: string): void {\n  try {\n    const sessionId = String(i.session_id ?? i.sessionId ?? \"\").trim();\n    if (!sessionId) return; // nothing to bind the record to\n    const dir = guardDir();\n    mkdirSync(dir, { recursive: true });\n    const line = JSON.stringify({\n      ts: Date.now(),\n      action: hit.action,\n      ruleId: hit.rule.id,\n      tool: String(i.tool_name ?? \"\"),\n      subject: subject.replace(/^`|`$/g, \"\").slice(0, 200),\n      guardrail: hit.rule.guardrail,\n      ...(hit.rule.fix ? { fix: hit.rule.fix } : {}),\n    });\n    appendFileSync(join(dir, `${sessionId}.jsonl`), `${line}\\n`);\n  } catch {\n    // swallow — recording is a bonus, never a hard dependency\n  }\n}\n\n/**\n * Run the guard against a PreToolUse stdin payload. Returns the JSON to write to stdout (the hook's\n * decision; empty = allow silently) and the process exit code (always 0 — the decision is in the\n * JSON, not the exit status).\n */\nexport function runGuard(stdin: string): { stdout: string; exit: number } {\n  const mode = guardMode();\n  if (mode === \"off\") return { stdout: \"\", exit: 0 };\n  let input: HookInput;\n  try {\n    input = JSON.parse(stdin || \"{}\") as HookInput;\n  } catch {\n    return { stdout: \"\", exit: 0 }; // unparseable → fail open\n  }\n  let hit: GuardHit | null;\n  try {\n    hit = evaluate(input);\n  } catch {\n    return { stdout: \"\", exit: 0 }; // any classifier error → fail open\n  }\n  if (!hit) return { stdout: \"\", exit: 0 }; // clean / regenerable target → allow silently\n\n  const subject = subjectOf(input);\n  recordDecision(input, hit, subject);\n  const reason = `${hit.rule.guardrail}  (guardrail: ${hit.rule.id})  ${hit.rule.fix}`;\n\n  // Watch mode: evaluate + record, but NEVER block. Narrate what enforcement WOULD do so a\n  // user can dogfood the policy on real traffic before flipping it on. `warn` is already\n  // non-blocking, so it reads the same in both modes.\n  if (mode === \"watch\") {\n    const verb = hit.action === \"deny\" ? \"BLOCK\" : hit.action === \"ask\" ? \"confirm\" : null;\n    const msg = verb\n      ? `👁️ receipts-guard (watch): WOULD ${verb} ${subject} — ${hit.rule.guardrail} (allowed; set RECEIPTS_GUARD=on to enforce)`\n      : `👁️ receipts-guard (watch): ${subject} — ${hit.rule.guardrail} (allowed; recorded)`;\n    return { stdout: JSON.stringify({ systemMessage: msg }), exit: 0 };\n  }\n\n  if (hit.action === \"deny\") {\n    return {\n      stdout: JSON.stringify({\n        systemMessage: `🛡️ receipts-guard BLOCKED ${subject} — ${hit.rule.guardrail}`,\n        hookSpecificOutput: {\n          hookEventName: \"PreToolUse\",\n          permissionDecision: \"deny\",\n          permissionDecisionReason: reason,\n        },\n      }),\n      exit: 0,\n    };\n  }\n  if (hit.action === \"ask\") {\n    return {\n      stdout: JSON.stringify({\n        systemMessage: `🛡️ receipts-guard: confirm ${subject} — ${hit.rule.guardrail}`,\n        hookSpecificOutput: {\n          hookEventName: \"PreToolUse\",\n          permissionDecision: \"ask\",\n          permissionDecisionReason: reason,\n        },\n      }),\n      exit: 0,\n    };\n  }\n  // warn: surface it (user + record see it) but DO NOT block or prompt.\n  return {\n    stdout: JSON.stringify({\n      systemMessage: `⚠️ receipts-guard: ${subject} — ${hit.rule.guardrail} (allowed; recorded for review)`,\n    }),\n    exit: 0,\n  };\n}\n","import {\n  isEphemeralTarget,\n  isRegenerableBuildDir,\n  splitStatements,\n  stripHeredocs,\n} from \"./classify.js\";\n// The LIVE-GUARD evaluator — the pre-execution composition layer over the shared FP-aware\n// primitives (src/policy/classify.ts). Classifies a PreToolUse tool call into deny | ask | warn |\n// allow BEFORE it runs. This is the TS home of what used to be the standalone hooks/guard-policy.mjs\n// island; it now ships in `dist` and runs via the `altimate-receipts hook guard` CLI command, so the\n// guard's decisions finally reach the receipt (`guardEvents`). The post-hoc detector and this guard\n// share ONE classifier — the dogfood audit found the same FP fixed twice when they were separate.\nimport { EPHEMERAL, G, PROTECTED_BRANCHES } from \"./load.js\";\n\nexport type GuardAction = \"deny\" | \"ask\" | \"warn\";\n\nexport interface HookInput {\n  tool_name?: string;\n  tool_input?: Record<string, unknown>;\n  cwd?: string;\n  session_id?: string;\n  sessionId?: string;\n}\n\ninterface GuardrailMeta {\n  severity?: string;\n  guardrail: string;\n  fix: string;\n  action?: GuardAction;\n}\n\ninterface Rule extends Omit<GuardrailMeta, \"action\"> {\n  id: string;\n  match: (i: HookInput) => boolean;\n  action?: GuardAction | ((i: HookInput) => GuardAction | null);\n}\n\nexport interface GuardHit {\n  rule: Rule;\n  action: GuardAction;\n}\n\nconst deQuote = (s: string): string => s.replace(/'[^']*'/g, \"''\").replace(/\"[^\"]*\"/g, '\"\"');\nconst bashCmd = (i: HookInput): string =>\n  i.tool_name === \"Bash\" ? deQuote(stripHeredocs(String(i.tool_input?.command ?? \"\"))) : \"\";\nconst rawBash = (i: HookInput): string =>\n  i.tool_name === \"Bash\" ? stripHeredocs(String(i.tool_input?.command ?? \"\")) : \"\";\nconst editPath = (i: HookInput): string =>\n  i.tool_name === \"Edit\" || i.tool_name === \"Write\" || i.tool_name === \"MultiEdit\"\n    ? String(i.tool_input?.file_path ?? i.tool_input?.path ?? \"\")\n    : \"\";\n\n/** A single rm operand is regenerable iff a path segment is a known build dir, or it's scratch. */\nconst regenerableTarget = (t: string): boolean => isRegenerableBuildDir(t) || isEphemeralTarget(t);\n\n// Never-legitimate destructive targets → hard deny. REQUIRES the recursive flag (-r): the\n// catastrophe is wiping a whole tree (rm -rf ~, rm -rf .git, rm -rf .receipts), not removing one\n// file under a protected prefix (rm -f ~/.local/bin/foo — an uninstall → ask).\nconst CATASTROPHE_RM =\n  /\\brm\\s+(-\\S*\\s+)*-\\S*r\\S*\\s+(-\\S*\\s+)*(\\/(\\s|$|\\*)|~\\/?(\\s|$|\\*)|\\$HOME\\/?(\\s|$|\\*)|\\.(\\s|$)|\\*(\\s|$)|\\S*\\.git\\/?(\\s|$)|\\S*\\.receipts\\/?(\\s|$))/i;\n\n/** Targets of an `rm` command (tokens after the command that aren't flags). */\nfunction rmTargets(cmd: string): string[] {\n  const m = cmd.match(/\\brm\\b(.*)/i);\n  if (!m) return [];\n  return m[1].split(/\\s+/).filter((t) => t && !t.startsWith(\"-\") && t !== \"''\" && t !== '\"\"');\n}\n\n/**\n * Classify a Bash command's destructive risk → \"deny\" | \"ask\" | null(allow). The FP-aware core.\n * `cmd` is de-quoted (so a *mentioned* token like `grep 'rm -rf'` isn't read as executed). `raw` is\n * the original — used for SQL, where the quoted string IS the executed payload (`psql -c 'DROP\n * DATABASE'`). Git push (force / force-with-lease) is owned by its own rules.\n */\nfunction classifyDestructive(cmd: string, raw: string = cmd): GuardAction | null {\n  if (\n    CATASTROPHE_RM.test(cmd) ||\n    /\\bmkfs\\b/i.test(cmd) ||\n    /\\bdd\\b[^|]*\\bof=\\/dev\\//i.test(cmd) ||\n    /\\bDROP\\s+DATABASE\\b/i.test(raw)\n  ) {\n    return \"deny\";\n  }\n  const targets = rmTargets(cmd);\n  if (/\\brm\\b/i.test(cmd) && targets.length && targets.every(regenerableTarget)) {\n    return null; // every rm target regenerable → allow\n  }\n  if (\n    /\\brm\\s+(-[a-z]*\\s+)*-?[a-z]*f[a-z]*\\b/i.test(cmd) ||\n    /\\bgit\\s+reset\\s+--hard\\b/i.test(cmd) ||\n    /\\bgit\\s+clean\\s+-[a-z]*f/i.test(cmd) ||\n    /\\b(DROP|TRUNCATE)\\s+(TABLE|SCHEMA)\\b/i.test(raw) ||\n    /\\bDELETE\\s+FROM\\b(?![\\s\\S]*\\bWHERE\\b)/i.test(raw)\n  ) {\n    return \"ask\";\n  }\n  return null;\n}\n\n/** Destructive verdict over a whole Bash command = the MAX over its statements (deny > ask). Each\n * statement is classified on its own, so a benign statement never inherits a sibling's `rm`/`DROP`.\n * A var rebound to an ephemeral path in the same command (`export HOME=/tmp/x`) is substituted so\n * `rm -rf $HOME` reads as scratch, not the home dir. */\nfunction destructiveAction(i: HookInput): GuardAction | null {\n  if (i.tool_name !== \"Bash\") return null;\n  const full = rawBash(i);\n  const rebind = new Map<string, string>();\n  for (const m of full.matchAll(\n    /(?:^|[\\s;&|(])(?:export\\s+)?([A-Za-z_]\\w*)=(\"[^\"]*\"|'[^']*'|\\S+)/g,\n  )) {\n    const val = m[2].replace(/^[\"']|[\"']$/g, \"\");\n    if (EPHEMERAL.test(val)) rebind.set(m[1], val);\n  }\n  let best: GuardAction | null = null;\n  for (const st of splitStatements(full)) {\n    let s = st;\n    for (const [v, val] of rebind)\n      s = s.replace(new RegExp(`\\\\$\\\\{?${v}\\\\}?(?![A-Za-z0-9_])`, \"g\"), val);\n    const a = classifyDestructive(deQuote(s), s);\n    if (a === \"deny\") return \"deny\";\n    if (a === \"ask\") best = \"ask\";\n  }\n  return best;\n}\n\n/** Force-push verdict. Denied ONLY when the push's OWN target ref is protected — read from the `git\n * push … -f` statement itself, not from `main` appearing anywhere. A merge-loop that fetches `origin\n * main` and force-pushes a *feature* branch confirms (ask). A bare `git push -f` (unknown ref) → ask. */\nfunction forcePushAction(i: HookInput): GuardAction | null {\n  if (i.tool_name !== \"Bash\") return null;\n  let verdict: GuardAction | null = null;\n  for (const st of splitStatements(bashCmd(i))) {\n    if (!/\\bgit\\s+push\\b/.test(st)) continue;\n    if (!/(--force\\b(?!-with-lease)|\\s-f\\b)/.test(st)) continue;\n    const after = st.replace(/^[\\s\\S]*?\\bgit\\s+push\\b/, \"\");\n    const target =\n      after\n        .split(/\\s+/)\n        .filter((t) => t && !t.startsWith(\"-\"))\n        .pop() || \"\";\n    const dst = target.includes(\":\") ? (target.split(\":\").pop() ?? \"\") : target;\n    if (dst && PROTECTED_BRANCHES.test(dst)) return \"deny\";\n    verdict = \"ask\";\n  }\n  return verdict;\n}\n\n// Each rule: a matcher + action; severity/guardrail/fix come from the canonical policy (G[id]).\nexport const POLICY: Rule[] = [\n  {\n    id: \"destructive-op\",\n    ...G[\"destructive-op\"],\n    action: destructiveAction,\n    match: (i) => destructiveAction(i) != null,\n  },\n  {\n    id: \"force-push\",\n    ...G[\"force-push\"],\n    action: forcePushAction,\n    match: (i) => forcePushAction(i) != null,\n  },\n  { id: \"hook-bypass\", ...G[\"hook-bypass\"], match: (i) => /--no-verify\\b/.test(bashCmd(i)) },\n  {\n    id: \"pipe-from-internet\",\n    ...G[\"pipe-from-internet\"],\n    // Danger = the interpreter executes the FETCHED STREAM as its program. `| sh|bash` always does;\n    // bare `| python|node` does; `| python -c '…'` / `node -e '…'` run the inline arg, stdin is DATA.\n    match: (i) => {\n      const c = bashCmd(i);\n      if (/\\b(curl|wget|fetch)\\b[^|]*\\|\\s*(sudo\\s+)?(sh|bash|zsh)\\b/i.test(c)) return true;\n      const m = c.match(/\\b(curl|wget|fetch)\\b[^|]*\\|\\s*(sudo\\s+)?(python3?|node)\\b([^|]*)/i);\n      return !!m && !/\\s-[ce]\\b/.test(m[4]);\n    },\n  },\n  {\n    id: \"force-with-lease\",\n    ...G[\"force-with-lease\"],\n    match: (i) => /\\bgit\\s+push\\b[\\s\\S]*--force-with-lease\\b/i.test(bashCmd(i)),\n  },\n  {\n    id: \"grader-harness-edit\",\n    ...G[\"grader-harness-edit\"],\n    match: (i) =>\n      /(^|\\/)(grader|conftest|harness)\\b|(^|\\/)[^/]*test[_-]?harness/i.test(editPath(i)),\n  },\n  {\n    id: \"cicd-edit\",\n    ...G[\"cicd-edit\"],\n    match: (i) => {\n      const p = editPath(i);\n      return (\n        /(^|\\/)\\.github\\/workflows\\/|\\.gitlab-ci|(^|\\/)\\.circleci\\/|(^|\\/)Dockerfile$|(^|\\/)[^/]*\\.(ya?ml)$/i.test(\n          p,\n        ) && /(workflow|pipeline|ci|cd|deploy|release|\\.github)/i.test(p)\n      );\n    },\n  },\n  {\n    id: \"secret-exposure\",\n    ...G[\"secret-exposure\"],\n    match: (i) => {\n      const c = bashCmd(i);\n      const p = editPath(i);\n      // `.env.example` / `.env.sample` / `.env.template` are committed templates, not secrets.\n      const isTemplate = /\\.(example|sample|template)$/i.test(p);\n      return (\n        /(cat|echo|printenv|env)\\b[\\s\\S]*(\\.env\\b|secret|credential|\\.aws\\/credentials|id_rsa)/i.test(\n          c,\n        ) ||\n        (!isTemplate && /(^|\\/)\\.env($|\\.)|(^|\\/)\\.aws\\/credentials|(^|\\/)id_rsa\\b/i.test(p))\n      );\n    },\n  },\n];\n\n/** The action of a rule for a given input — supports a fixed string or a function. */\nfunction actionOf(rule: Rule, input: HookInput): GuardAction | null {\n  try {\n    return typeof rule.action === \"function\" ? rule.action(input) : (rule.action ?? null);\n  } catch {\n    return null; // a broken rule must never break the agent\n  }\n}\n\nconst RANK: Record<GuardAction, number> = { deny: 3, ask: 2, warn: 1 };\n\n/**\n * Evaluate the policy against a PreToolUse input. Returns { rule, action } for the highest-severity\n * hit (deny > ask > warn), or null when nothing fires (allow).\n */\nexport function evaluate(input: HookInput): GuardHit | null {\n  let best: GuardHit | null = null;\n  for (const rule of POLICY) {\n    let hit = false;\n    try {\n      hit = rule.match(input);\n    } catch {\n      hit = false;\n    }\n    if (!hit) continue;\n    const action = actionOf(rule, input);\n    if (!action) continue; // classified as allow\n    if (!best || RANK[action] > RANK[best.action]) best = { rule, action };\n    if (best.action === \"deny\") break; // can't beat deny\n  }\n  return best;\n}\n","import { readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { basename, join } from \"node:path\";\nimport type { GuardEvent } from \"../findings/guardEvents.js\";\n\n/**\n * Reader for the live-guard event side-log (SPEC-0095 / M103). The `receipts hook guard` PreToolUse\n * command (src/hook/guard.ts) appends one JSON line per non-allow decision to\n * `${RECEIPTS_GUARD_DIR || ~/.claude/receipts/guard}/<sessionId>.jsonl`. `receipts pr` reads the\n * log for the session it is building and attaches the events as a recorded input (exempt from the\n * L1 byte-compare; envelope-covered). Crash-safe: a missing or garbled log yields `[]` — guard\n * events are a bonus, never a hard dependency, so a read failure must never break a receipt.\n *\n * The producer (src/hook/guard.ts) imports `guardDir()` from here, so the write path and this read\n * path share one source — they cannot drift. `<sessionId>` is the PreToolUse payload's `session_id`,\n * which equals the transcript file's basename, so `sessionIdFromPath()` resolves the same key.\n */\nexport function guardDir(): string {\n  return process.env.RECEIPTS_GUARD_DIR || join(homedir(), \".claude\", \"receipts\", \"guard\");\n}\n\n/** The Claude Code session id is the transcript file's basename (e.g. `<uuid>.jsonl`). */\nexport function sessionIdFromPath(transcriptPath: string): string {\n  return basename(transcriptPath).replace(/\\.jsonl$/i, \"\");\n}\n\nfunction isGuardEvent(v: unknown): v is GuardEvent {\n  if (!v || typeof v !== \"object\") {\n    return false;\n  }\n  const o = v as Record<string, unknown>;\n  return (\n    (o.action === \"deny\" || o.action === \"ask\" || o.action === \"warn\") &&\n    typeof o.ruleId === \"string\" &&\n    typeof o.tool === \"string\" &&\n    typeof o.subject === \"string\" &&\n    typeof o.guardrail === \"string\"\n  );\n}\n\n/**\n * Read + validate the guard events for a session id. Returns the well-formed events in file order;\n * skips malformed lines. Returns `[]` when the log is absent or unreadable.\n */\nexport function readGuardEvents(sessionId: string): GuardEvent[] {\n  if (!sessionId) {\n    return [];\n  }\n  let raw: string;\n  try {\n    raw = readFileSync(join(guardDir(), `${sessionId}.jsonl`), \"utf8\");\n  } catch {\n    return []; // no log for this session — the common case\n  }\n  const out: GuardEvent[] = [];\n  for (const line of raw.split(\"\\n\")) {\n    const t = line.trim();\n    if (!t) {\n      continue;\n    }\n    try {\n      const v = JSON.parse(t);\n      if (isGuardEvent(v)) {\n        out.push({\n          action: v.action,\n          ruleId: v.ruleId,\n          tool: v.tool,\n          subject: v.subject,\n          guardrail: v.guardrail,\n          ...(typeof v.fix === \"string\" ? { fix: v.fix } : {}),\n          ...(typeof v.ts === \"number\" ? { ts: v.ts } : {}),\n        });\n      }\n    } catch {\n      // skip a malformed line; a partial/corrupt log still yields its good events\n    }\n  }\n  return out;\n}\n","import { spawnSync } from \"node:child_process\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { isAbsolute, join } from \"node:path\";\n\n/**\n * `receipts install-hook` (SPEC-0066 R6, hardened by SPEC-0068 R1/R2) — the\n * universal floor: a git pre-push hook for humans pushing agent work from a\n * terminal and for agents without a hook system. The script is a frozen npx\n * shim; behavior updates ship via npm. The write location honors the repo's\n * actual hook manager: `.git/hooks` by default, the user-hook dir for husky\n * repos, or a custom `core.hooksPath`.\n */\n\n/** Marker that identifies a pre-push script as ours (idempotency + upgrades). */\nconst MARKER = \"altimate-receipts\";\n\n/** The set-`e`-proof shim body (SPEC-0068 R2). Hook runners (husky among them)\n * may execute hooks under `set -e`, where a bare non-zero npx exit would abort\n * the script — and block the push — before the exit-code check runs. The\n * `|| code=$?` capture keeps every failure path non-blocking; exit 42\n * (REPUSH_EXIT) is the only code that stops the push. */\nconst SHIM_BODY = `command -v npx >/dev/null 2>&1 || exit 0\ncode=0\nnpx -y altimate-receipts@latest hook pre-push --agent git || code=$?\nif [ \"$code\" -eq 42 ]; then exit 1; fi\nexit 0\n`;\n\n/** The git-hooks-dir variant: chains a preserved pre-existing hook first (it\n * gets no stdin refs — pre-push hooks rarely read them — and its failure still\n * blocks, it's the user's gate). */\nconst HOOK_SCRIPT = `#!/bin/sh\n# Verified-by-Receipts pre-push hook — generated by \\`receipts install-hook\\` (altimate-receipts).\n# Attaches this branch's agent receipt before pushing. Best-effort: only the\n# deliberate \"receipt attached, push again\" signal (exit 42) ever stops a push.\nhookdir=$(dirname \"$0\")\nif [ -x \"$hookdir/pre-push.local\" ]; then\n  \"$hookdir/pre-push.local\" \"$@\" </dev/null || exit $?\nfi\n${SHIM_BODY}`;\n\n/** The husky variant: husky runs each .husky/<hook> file itself (no shebang,\n * no pre-push.local convention) and is the chaining layer already. */\nconst HUSKY_SCRIPT = `# Verified-by-Receipts pre-push hook — generated by \\`receipts install-hook\\` (altimate-receipts).\n# Attaches this branch's agent receipt before pushing. Best-effort: only the\n# deliberate \"receipt attached, push again\" signal (exit 42) ever stops a push.\n${SHIM_BODY}`;\n\nexport type InstallResult =\n  | { ok: true; action: \"installed\" | \"unchanged\" | \"chained\"; path: string }\n  | { ok: false; reason: string };\n\nfunction git(args: string[], cwd?: string): string | null {\n  const r = spawnSync(\"git\", args, { encoding: \"utf8\", cwd });\n  return r.status === 0 ? r.stdout.trim() : null;\n}\n\nconst abs = (p: string, cwd?: string): string =>\n  isAbsolute(p) ? p : join(cwd ?? process.cwd(), p);\n\n/** Where this repo actually executes pre-push hooks (SPEC-0068 R1).\n * `--git-path hooks` follows `core.hooksPath`, so a husky repo would resolve to\n * `.husky/_` — a directory husky regenerates, where a written hook silently\n * dies. Inspect `core.hooksPath` explicitly instead. */\nexport function resolveHookTarget(\n  cwd?: string,\n): { kind: \"git\" | \"custom\" | \"husky\"; dir: string } | null {\n  if (git([\"rev-parse\", \"--git-dir\"], cwd) === null) {\n    return null;\n  }\n  const hooksPath = git([\"config\", \"core.hooksPath\"], cwd);\n  if (hooksPath) {\n    const parts = hooksPath.split(/[\\\\/]/);\n    if (parts.includes(\".husky\")) {\n      // husky owns hook dispatch; user hooks live in <repo>/.husky, never `_`\n      const root = git([\"rev-parse\", \"--show-toplevel\"], cwd) ?? cwd ?? process.cwd();\n      return { kind: \"husky\", dir: join(root, \".husky\") };\n    }\n    return { kind: \"custom\", dir: abs(hooksPath, cwd) };\n  }\n  const p = git([\"rev-parse\", \"--git-path\", \"hooks\"], cwd);\n  return p ? { kind: \"git\", dir: abs(p, cwd) } : null;\n}\n\n/** Back-compat export: the resolved hooks dir (tests + older callers). */\nexport function hooksDir(cwd?: string): string | null {\n  return resolveHookTarget(cwd)?.dir ?? null;\n}\n\nexport function installGitHook(cwd?: string): InstallResult {\n  const target = resolveHookTarget(cwd);\n  if (!target) {\n    return { ok: false, reason: \"not a git repository\" };\n  }\n  const script = target.kind === \"husky\" ? HUSKY_SCRIPT : HOOK_SCRIPT;\n  mkdirSync(target.dir, { recursive: true });\n  const hookPath = join(target.dir, \"pre-push\");\n  const local = join(target.dir, \"pre-push.local\");\n\n  if (existsSync(hookPath)) {\n    const current = readFileSync(hookPath, \"utf8\");\n    if (current.includes(MARKER)) {\n      if (current === script) {\n        return { ok: true, action: \"unchanged\", path: hookPath };\n      }\n      // ours but an older revision — rewrite in place\n      writeFileSync(hookPath, script);\n      chmodSync(hookPath, 0o755);\n      return { ok: true, action: \"installed\", path: hookPath };\n    }\n    if (target.kind === \"husky\") {\n      // husky runs exactly one file per hook and it's the user's; don't edit it\n      // (SPEC-0068 NG5) — tell them what to append instead.\n      return {\n        ok: false,\n        reason: `${hookPath} already exists — append this to it:\\n${SHIM_BODY}`,\n      };\n    }\n    // a foreign hook: preserve it as pre-push.local (invoked first by ours)\n    if (existsSync(local)) {\n      return {\n        ok: false,\n        reason: `${hookPath} and ${local} both exist and aren't receipts hooks — resolve manually`,\n      };\n    }\n    renameSync(hookPath, local);\n    writeFileSync(hookPath, script);\n    chmodSync(hookPath, 0o755);\n    return { ok: true, action: \"chained\", path: hookPath };\n  }\n\n  writeFileSync(hookPath, script);\n  chmodSync(hookPath, 0o755);\n  return { ok: true, action: \"installed\", path: hookPath };\n}\n\n/**\n * `receipts init --prepare` (R7): wire `install-hook` into package.json's\n * `prepare` script so `npm install` self-installs the floor for every\n * contributor. Append with `&&` if a prepare exists; never clobber; idempotent.\n */\nexport type PrepareResult = { ok: true; changed: boolean } | { ok: false; reason: string };\n\nconst PREPARE_CMD = \"npx -y altimate-receipts@latest install-hook\";\n\nexport function wirePrepareScript(pkgPath: string): PrepareResult {\n  if (!existsSync(pkgPath)) {\n    return { ok: false, reason: `${pkgPath} not found — \\`--prepare\\` needs a package.json` };\n  }\n  const raw = readFileSync(pkgPath, \"utf8\");\n  let pkg: Record<string, unknown>;\n  try {\n    pkg = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    return { ok: false, reason: `${pkgPath} is not valid JSON — leaving it untouched` };\n  }\n  if (pkg.scripts === undefined) {\n    pkg.scripts = {};\n  }\n  const scripts = pkg.scripts as Record<string, string>;\n  const prepare = scripts.prepare;\n  if (prepare?.includes(PREPARE_CMD)) {\n    return { ok: true, changed: false };\n  }\n  scripts.prepare = prepare ? `${prepare} && ${PREPARE_CMD}` : PREPARE_CMD;\n  // keep the file's indentation (npm writes 2 spaces; some repos use 4 or tabs)\n  const indent = raw.match(/^(\\s+)\"/m)?.[1] ?? \"  \";\n  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, indent)}\\n`);\n  return { ok: true, changed: true };\n}\n","import { spawnSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { cwdAtFirstGit } from \"../findings/gitParse.js\";\nimport { pushReceiptRef, readReceiptRef } from \"../report/store.js\";\nimport { gitInvocations } from \"../trace/gitCommand.js\";\nimport { settingsStore } from \"./settingsMerge.js\";\n\n/**\n * `receipts hook pre-push` (SPEC-0066) — the agent-embedded trigger. One frozen\n * command line, two payload dialects:\n *\n *   --agent claude  Claude Code PreToolUse stdin JSON; fires only when the Bash\n *                   tool is about to run a real `git push`, and commits the\n *                   receipt BEFORE the push so it rides the agent's own push.\n *   --agent git     the git pre-push stdin protocol; fires on a branch push and\n *                   keeps the capped commit-then-re-push flow (a pre-push hook\n *                   cannot add commits to the in-flight push).\n *\n * Everything here is best-effort: every failure path exits 0 with at most one\n * stderr line. The hook may only ever add a commit — it must never block the\n * agent's tool call or fail a push.\n */\n\n/** `codex` shares Claude's payload shape exactly (same hooks.json schema, same\n * `tool_name`/`tool_input.command`/`cwd` stdin fields, exit-0-allows) — verified\n * against the Codex hooks docs + a live capture (SPEC-0069 R4). */\nexport type HookDialect = \"claude\" | \"codex\" | \"git\";\n\n/** Exit code the generated git hook script maps to \"stop this push, re-push\" —\n * deliberately distinctive so an npx/registry failure (exit 1) is never mistaken\n * for the intentional signal and can never block a push. */\nexport const REPUSH_EXIT = 42;\n\nconst ATTACH_SUBJECT = (branch: string) => `chore(receipts): attach agent receipt for ${branch}`;\n\nfunction git(args: string[], cwd?: string): string {\n  const r = spawnSync(\"git\", args, { encoding: \"utf8\", cwd });\n  return r.status === 0 ? r.stdout.trim() : \"\";\n}\n\n/* ------------------------------------------------------------------ matcher */\n\n/** A refspec that names a tag (tag-only pushes carry no branch work). */\nconst TAG_REFSPEC = /^(refs\\/tags\\/|v\\d+(\\.\\d+)*$)/;\n\n/**\n * Does this Bash command string contain a real branch `git push`? (SPEC-0066 R2.)\n * Token scan via the shared `gitInvocations` (quote-blanked, simple-command-anchored\n * — `echo \"git push\"`, `git pushup`, message text never fire; under-fires on exotic\n * quoting by design, Q3), plus push-specific exclusions: dry runs and tag-only\n * pushes carry no branch work.\n */\nexport function isGitPush(command: string): boolean {\n  for (const { sub, rest } of gitInvocations(command)) {\n    if (sub !== \"push\") {\n      continue;\n    }\n    if (rest.includes(\"--dry-run\") || rest.includes(\"-n\") || rest.includes(\"--tags\")) {\n      continue;\n    }\n    // refspec analysis: `git push origin v1.2.3` (tag-only) must not fire; a\n    // pure-flag or remote-only push targets the current branch and does fire.\n    const refspecs = rest.filter((t) => !t.startsWith(\"-\")).slice(1); // first positional = remote\n    if (refspecs.length > 0 && refspecs.every((r) => TAG_REFSPEC.test(r))) {\n      continue;\n    }\n    return true;\n  }\n  return false;\n}\n\n/** Same tokenizer discipline as `isGitPush`: true iff the command also carries a\n * real `git commit` — the compound `git commit … && git push` pattern. An agent\n * hook fires BEFORE the command runs, so that commit's files are still\n * working-tree-only; the diff scope must union them or the receipt falls back to\n * branch scope with no per-change cost (field-observed in a dogfooding repo).\n * `--dry-run` doesn't count; note `-n` on commit is `--no-verify`, not a dry run. */\nexport function isGitCommit(command: string): boolean {\n  for (const { sub, rest } of gitInvocations(command)) {\n    if (sub === \"commit\" && !rest.includes(\"--dry-run\")) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/** The git pre-push stdin protocol: `<local_ref> <sha> <remote_ref> <sha>` lines.\n * True iff at least one pushed ref is a branch (tag-only pushes don't trigger). */\nexport function gitStdinPushesBranch(stdin: string): boolean {\n  return stdin.split(\"\\n\").some((line) => line.trim().startsWith(\"refs/heads/\"));\n}\n\n/* ----------------------------------------------------------------- gate/cap */\n\nconst hasMarker = (root: string): boolean =>\n  existsSync(join(root, \".github\", \"workflows\", \"receipts.yml\")) ||\n  existsSync(join(root, \".receipts\"));\n\n/**\n * The universal self-gate (SPEC-0066 R4): the hook is inert unless this repo has\n * opted in — `receipts init`'s workflow file or an existing `.receipts/`. One\n * frozen one-liner therefore works committed in a repo's settings AND in a\n * user's ~/.claude/settings.json without ever firing in non-integrated repos.\n *\n * Worktrees (field-observed): a worktree created before\n * adoption has neither marker in its checkout even though the repo opted in —\n * so also accept the marker in the PRIMARY checkout (the git common dir's\n * parent). Old worktrees then stay covered by the git floor and user-level\n * hooks instead of going silent.\n */\nexport function repoOptedIn(repoRoot: string): boolean {\n  if (hasMarker(repoRoot)) {\n    return true;\n  }\n  const primary = primaryCheckout(repoRoot);\n  return primary ? hasMarker(primary) : false;\n}\n\n/** The primary checkout behind a worktree (git common dir's parent), or null. */\nexport function primaryCheckout(repoRoot: string): string | null {\n  const common = git([\"rev-parse\", \"--git-common-dir\"], repoRoot);\n  if (common.endsWith(\"/.git\")) {\n    const primary = common.slice(0, -\"/.git\".length);\n    if (primary && primary !== repoRoot) {\n      return primary;\n    }\n  }\n  return null;\n}\n\n/** Is HEAD already this branch's receipt-attach commit? The git-mode cap (R6):\n * one auto-commit per push attempt, so a live, still-growing session can never\n * re-push-loop — at worst the receipt is one snapshot behind, honestly. */\nexport function headIsAttachCommit(branch: string, cwd?: string): boolean {\n  return git([\"log\", \"-1\", \"--format=%s\"], cwd) === ATTACH_SUBJECT(branch);\n}\n\n/**\n * Receipts are per-PR artifacts; a push to the DEFAULT branch must not attach one\n * (field-observed: a `git push` while on main committed a whole-session Grade-F\n * `main.json` onto the repo's trunk). Resolve the default from\n * origin/HEAD; fall back to the conventional names when the remote head is\n * unset locally.\n */\nexport function isDefaultBranch(branch: string, cwd?: string): boolean {\n  const head = git([\"symbolic-ref\", \"--short\", \"refs/remotes/origin/HEAD\"], cwd);\n  if (head) {\n    return head === `origin/${branch}`;\n  }\n  return branch === \"main\" || branch === \"master\";\n}\n\n/* ------------------------------------------------------------------- runner */\n\n/** Claude Code PreToolUse payload — only the fields we read; extras tolerated. */\ninterface ClaudePayload {\n  tool_name?: string;\n  tool_input?: { command?: string };\n  cwd?: string;\n}\n\nexport async function readStdin(stream: NodeJS.ReadableStream = process.stdin): Promise<string> {\n  let data = \"\";\n  for await (const chunk of stream) {\n    data += chunk;\n  }\n  return data;\n}\n\nexport interface HookResult {\n  exit: number;\n  /** single stderr line, when there's something worth saying */\n  message?: string;\n}\n\n/**\n * Decide + act for one hook invocation. `generate` is the existing `receipts pr`\n * pipeline (injected to keep this module free of the CLI's session machinery).\n */\nexport async function runHookPrePush(\n  dialect: HookDialect,\n  stdin: string,\n  generate: (opts?: { pendingCommit?: boolean }) => Promise<number>,\n): Promise<HookResult> {\n  let pendingCommit = false;\n  try {\n    if (process.env.RECEIPTS_HOOK === \"0\") {\n      return { exit: 0 };\n    }\n    // Honor the storage opt-out (SPEC-0064): store=none means \"no committed\n    // receipts\", so the hook has nothing to attach and stays silent.\n    if ((process.env.RECEIPTS_STORE || \"commit\").toLowerCase() === \"none\") {\n      return { exit: 0 };\n    }\n\n    if (dialect === \"claude\" || dialect === \"codex\") {\n      let payload: ClaudePayload;\n      try {\n        payload = JSON.parse(stdin) as ClaudePayload;\n      } catch {\n        return { exit: 0 };\n      }\n      if (payload.tool_name !== \"Bash\" || !payload.tool_input?.command) {\n        return { exit: 0 };\n      }\n      if (payload.cwd && existsSync(payload.cwd)) {\n        process.chdir(payload.cwd); // generate against the session's repo\n      }\n      if (!isGitPush(payload.tool_input.command)) {\n        return { exit: 0 };\n      }\n      // Sibling-checkout pushes (field-observed in qa-autopilot's Actions runs):\n      // the agent pushes a repo it checked out NEXT TO the session root —\n      // `cd altimate-backend && git push`. Generate against the repo the push\n      // actually targets by tracking `cd` clauses, same as diff scoping does.\n      const locus = cwdAtFirstGit(payload.tool_input.command, process.cwd());\n      if (locus.kind === \"known\" && existsSync(locus.path)) {\n        process.chdir(locus.path);\n      }\n      pendingCommit = isGitCommit(payload.tool_input.command);\n    } else if (!gitStdinPushesBranch(stdin)) {\n      return { exit: 0 };\n    }\n\n    const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]);\n    if (!repoRoot || !repoOptedIn(repoRoot)) {\n      return { exit: 0 };\n    }\n    const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n    if (!branch || branch === \"HEAD\" || isDefaultBranch(branch)) {\n      return { exit: 0 };\n    }\n\n    // Store resolution (SPEC-0070 R3): process env beats the repo-committed\n    // default in .claude/settings.json (worktree-aware via the primary checkout).\n    const store = (\n      process.env.RECEIPTS_STORE ||\n      settingsStore(repoRoot) ||\n      settingsStore(primaryCheckout(repoRoot) ?? \"\") ||\n      \"commit\"\n    ).toLowerCase();\n    if (store === \"none\") {\n      return { exit: 0 };\n    }\n    process.env.RECEIPTS_STORE = store; // the pipeline below resolves identically\n\n    if (store !== \"ref\" && dialect === \"git\" && headIsAttachCommit(branch)) {\n      return { exit: 0 }; // cap: already attached this push attempt — let it through\n    }\n\n    // Run the pipeline with stderr muted: a human pushing a hand-written branch\n    // must not see \"no agent session found\" on every push (R3: one line max,\n    // and only when we actually attach something).\n    const write = process.stderr.write.bind(process.stderr);\n    process.stderr.write = (() => true) as typeof process.stderr.write;\n    let generated: number;\n    try {\n      generated = await generate({ pendingCommit });\n    } finally {\n      process.stderr.write = write;\n    }\n    if (generated !== 0) {\n      return { exit: 0 }; // no matching session / generation declined — never block\n    }\n\n    // store=ref (SPEC-0070): the receipt is a sibling ref, not a branch commit —\n    // push it ourselves and let the branch push proceed untouched. No re-push\n    // dance in either dialect: a ref push never modifies the in-flight branch.\n    if (store === \"ref\") {\n      const slug = branch.replace(/[/\\\\]/g, \"-\");\n      if (readReceiptRef(slug) == null) {\n        return { exit: 0 };\n      }\n      const pushed = pushReceiptRef(slug);\n      return {\n        exit: 0,\n        message: pushed\n          ? `receipts: receipt at refs/receipts/${slug} — travels alongside this push.`\n          : `receipts: wrote refs/receipts/${slug}; pushing it failed — push the ref manually.`,\n      };\n    }\n\n    if (!git([\"status\", \"--porcelain\", \".receipts/\"])) {\n      return { exit: 0 }; // receipt unchanged — push proceeds untouched\n    }\n    spawnSync(\"git\", [\"add\", \".receipts/\"], { encoding: \"utf8\" });\n    // Pathspec commit: only .receipts/ lands, whatever else is staged stays staged.\n    const commit = spawnSync(\n      \"git\",\n      [\"commit\", \"--no-verify\", \"-m\", ATTACH_SUBJECT(branch), \"--\", \".receipts/\"],\n      { encoding: \"utf8\" },\n    );\n    if (commit.status !== 0) {\n      return { exit: 0 };\n    }\n    if (dialect === \"git\") {\n      return {\n        exit: REPUSH_EXIT,\n        message: `📎 Receipts: attached an agent receipt for '${branch}' — rerun the same \\`git push\\` command to include it.`,\n      };\n    }\n    return {\n      exit: 0,\n      message: `receipts: attached an agent receipt for '${branch}' — it rides this push.`,\n    };\n  } catch {\n    return { exit: 0 }; // SPEC-0066 R3: any failure → silent allow\n  }\n}\n","import { spawnSync } from \"node:child_process\";\n\n/**\n * `store=ref` (SPEC-0070 / M71): receipts as git objects on\n * `refs/receipts/<slug>` — zero files in the working tree, nothing in PR diffs,\n * nothing accumulating on main. Pure plumbing (hash-object → mktree →\n * commit-tree → update-ref): no index, no checkout, no worktree contact.\n *\n * The wrapping commit (rather than a bare blob ref) keeps the object GC-rooted\n * on every host, `git show`-friendly, and carries the branch name in its\n * message so `prune --refs` can recover it. Determinism: fixed identity and the\n * session's own end time as both dates — same receipt bytes ⇒ same commit SHA.\n */\n\nconst IDENT = [\"-c\", \"user.name=receipts\", \"-c\", \"user.email=receipts@altimate.ai\"];\n\nexport const RECEIPT_REF_PREFIX = \"refs/receipts/\";\nexport const receiptRef = (slug: string): string => `${RECEIPT_REF_PREFIX}${slug}`;\n\ninterface GitResult {\n  out: string;\n  ok: boolean;\n  err?: string;\n}\n\nfunction git(\n  args: string[],\n  opts: { cwd?: string; input?: string; env?: NodeJS.ProcessEnv } = {},\n): GitResult {\n  const r = spawnSync(\"git\", args, {\n    encoding: \"utf8\",\n    cwd: opts.cwd,\n    input: opts.input,\n    env: opts.env ? { ...process.env, ...opts.env } : process.env,\n  });\n  return { out: (r.stdout ?? \"\").trim(), ok: r.status === 0, err: (r.stderr ?? \"\").trim() };\n}\n\nexport type WriteRefResult =\n  | { ok: true; ref: string; commit: string }\n  | { ok: false; reason: string };\n\n/** Write `json` as refs/receipts/<slug> (force-updates an existing ref). */\nexport function writeReceiptRef(\n  slug: string,\n  branch: string,\n  json: string,\n  endedAtMs: number | undefined,\n  cwd?: string,\n): WriteRefResult {\n  const blob = git([\"hash-object\", \"-w\", \"--stdin\"], { cwd, input: json });\n  if (!blob.ok) {\n    return { ok: false, reason: \"hash-object failed (not a git repository?)\" };\n  }\n  const tree = git([\"mktree\"], { cwd, input: `100644 blob ${blob.out}\\treceipt.json\\n` });\n  if (!tree.ok) {\n    return { ok: false, reason: \"mktree failed\" };\n  }\n  // Deterministic commit: fixed identity, the session's end time as both dates\n  // (clamped to epoch second 1 — git rejects a raw timestamp of 0).\n  const when = `@${Math.max(1, Math.floor((endedAtMs ?? 0) / 1000))} +0000`;\n  const commit = git([...IDENT, \"commit-tree\", tree.out, \"-m\", `receipt: ${branch}`], {\n    cwd,\n    env: { GIT_AUTHOR_DATE: when, GIT_COMMITTER_DATE: when },\n  });\n  if (!commit.ok) {\n    return { ok: false, reason: `commit-tree failed: ${commit.err}` };\n  }\n  const ref = receiptRef(slug);\n  const upd = git([\"update-ref\", ref, commit.out], { cwd });\n  if (!upd.ok) {\n    return { ok: false, reason: `update-ref ${ref} failed` };\n  }\n  return { ok: true, ref, commit: commit.out };\n}\n\n/** Read the receipt JSON stored at refs/receipts/<slug>, or null. */\nexport function readReceiptRef(slug: string, cwd?: string): string | null {\n  const r = git([\"cat-file\", \"blob\", `${receiptRef(slug)}:receipt.json`], { cwd });\n  return r.ok ? r.out : null;\n}\n\n/** The branch a receipt ref was written for (recovered from the commit message). */\nexport function refBranch(ref: string, cwd?: string): string | null {\n  const r = git([\"log\", \"-1\", \"--format=%s\", ref], { cwd });\n  const m = r.ok ? /^receipt: (.+)$/.exec(r.out) : null;\n  return m ? m[1] : null;\n}\n\n/** All local receipt refs: [{ref, slug}]. */\nexport function listReceiptRefs(cwd?: string): Array<{ ref: string; slug: string }> {\n  const r = git([\"for-each-ref\", RECEIPT_REF_PREFIX, \"--format=%(refname)\"], { cwd });\n  if (!r.ok || !r.out) {\n    return [];\n  }\n  return r.out\n    .split(\"\\n\")\n    .filter(Boolean)\n    .map((ref) => ({ ref, slug: ref.slice(RECEIPT_REF_PREFIX.length) }));\n}\n\n/** Push the receipt ref to `remote` (force — receipts regenerate). Best-effort. */\nexport function pushReceiptRef(slug: string, remote = \"origin\", cwd?: string): boolean {\n  const ref = receiptRef(slug);\n  return git([\"push\", remote, `+${ref}:${ref}`], { cwd }).ok;\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Deep-merge the Receipts hook entry into a Claude Code settings.json — used by\n * `receipts init` (the repo's .claude/settings.json) and `receipts setup-local`\n * (the user's ~/.claude/settings.json). SPEC-0066 R5/R8: preserve every existing\n * key and hook, be idempotent, and back off (never clobber) on a malformed file.\n *\n * The command is a FROZEN one-liner: all behavior lives behind npx, so published\n * updates reach every contributor with no re-commit and — because agent runtimes\n * record hook trust against the command text — no re-approval.\n */\nexport const HOOK_COMMAND = \"npx -y altimate-receipts@latest hook pre-push\";\n\n/** The live-guard PreToolUse command (opt-in; installed by `receipts init --guard`). It classifies a\n * tool call BEFORE it runs (deny/ask/warn) and records the decision for the receipt. A user can turn\n * it off without un-installing via `RECEIPTS_GUARD=0`. Matches Bash + file-edit tools. */\nexport const GUARD_HOOK_COMMAND = \"npx -y altimate-receipts@latest hook guard\";\nexport const GUARD_MATCHER = \"Bash|Edit|Write|MultiEdit\";\n\ninterface HookEntry {\n  matcher?: string;\n  hooks?: Array<{ type?: string; command?: string }>;\n}\n\nexport type MergeResult = { ok: true; changed: boolean } | { ok: false; reason: string };\n\n/**\n * The repo-committed store default (SPEC-0070 R3): `.claude/settings.json` →\n * `env.RECEIPTS_STORE`. Claude Code exports project env to sessions natively;\n * the hook reads the same key here so the git/codex dialects honor it too.\n * No new config file — the knob lives in the file adopters already commit.\n */\nexport function settingsStore(root: string): string | undefined {\n  try {\n    const s = JSON.parse(readFileSync(join(root, \".claude\", \"settings.json\"), \"utf8\")) as {\n      env?: Record<string, unknown>;\n    };\n    const v = s?.env?.RECEIPTS_STORE;\n    return typeof v === \"string\" && v ? v : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Add a PreToolUse→Bash→command entry to `path`, creating the file if absent.\n * Anything already in the file survives byte-meaning-identically. Codex's\n * hooks.json uses the exact same schema as Claude Code's settings hooks\n * (SPEC-0069 R4), so one merger serves both — `command` defaults to Claude's. */\nexport function mergeHookIntoSettings(\n  path: string,\n  command: string = HOOK_COMMAND,\n  opts: {\n    /** SPEC-0074/M75 (R1/R2): also write `env.RECEIPTS_STORE = \"ref\"` when the file\n     * doesn't already pin a store. REPO-level settings only — never set for the\n     * user-level merge (setup-local), where it would flip every repo they touch. */\n    defaultStoreRef?: boolean;\n    /** PreToolUse matcher (tool-name regex). Defaults to \"Bash\"; the live guard passes\n     * GUARD_MATCHER so it also sees file edits. */\n    matcher?: string;\n  } = {},\n): MergeResult {\n  let settings: Record<string, unknown> = {};\n  if (existsSync(path)) {\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(readFileSync(path, \"utf8\"));\n    } catch {\n      return { ok: false, reason: `${path} is not valid JSON — leaving it untouched` };\n    }\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n      return { ok: false, reason: `${path} is not a JSON object — leaving it untouched` };\n    }\n    settings = parsed as Record<string, unknown>;\n  }\n\n  if (settings.hooks === undefined) {\n    settings.hooks = {};\n  }\n  const hooks = settings.hooks as Record<string, unknown>;\n  if (typeof hooks !== \"object\" || hooks === null || Array.isArray(hooks)) {\n    return { ok: false, reason: `${path} has a non-object \"hooks\" key — leaving it untouched` };\n  }\n  if (hooks.PreToolUse === undefined) {\n    hooks.PreToolUse = [];\n  }\n  const pre = hooks.PreToolUse as HookEntry[];\n  if (!Array.isArray(pre)) {\n    return { ok: false, reason: `${path} has a non-array hooks.PreToolUse — leaving it untouched` };\n  }\n  const present = pre.some((e) => e?.hooks?.some((h) => h?.command === command));\n\n  // M75 R1/R2: receipts-as-refs is the adoption default — but an explicit choice\n  // (any existing env.RECEIPTS_STORE value, including \"commit\") always survives.\n  let envChanged = false;\n  if (opts.defaultStoreRef) {\n    if (settings.env === undefined) {\n      settings.env = {};\n    }\n    const env = settings.env as Record<string, unknown>;\n    if (typeof env !== \"object\" || env === null || Array.isArray(env)) {\n      return { ok: false, reason: `${path} has a non-object \"env\" key — leaving it untouched` };\n    }\n    if (env.RECEIPTS_STORE === undefined) {\n      env.RECEIPTS_STORE = \"ref\";\n      envChanged = true;\n    }\n  }\n\n  if (present && !envChanged) {\n    return { ok: true, changed: false };\n  }\n  if (!present) {\n    pre.push({ matcher: opts.matcher ?? \"Bash\", hooks: [{ type: \"command\", command }] });\n  }\n\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(settings, null, 2)}\\n`);\n  return { ok: true, changed: true };\n}\n","import { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { Receipt, ReceiptPredicate } from \"./build.js\";\n\n/**\n * Receipt assertions (M34, SPEC-0036) — eval-as-code WITHOUT the model judge. A committed\n * `.receipts/asserts.json` of deterministic `{path, op, value}` checks is evaluated\n * mechanically against the just-derived receipt: the **user** supplies the oracle, and\n * Receipts only does exact comparison over evidence it already attests. Pure function of\n * the receipt + the committed file ⇒ re-derivable; zero model calls; no quality verdict.\n */\n\nexport type AssertOp =\n  | \"eq\"\n  | \"ne\"\n  | \"lt\"\n  | \"lte\"\n  | \"gt\"\n  | \"gte\"\n  | \"matches\"\n  | \"in\"\n  | \"empty\"\n  | \"exists\";\n\nconst OPS = new Set<AssertOp>([\n  \"eq\",\n  \"ne\",\n  \"lt\",\n  \"lte\",\n  \"gt\",\n  \"gte\",\n  \"matches\",\n  \"in\",\n  \"empty\",\n  \"exists\",\n]);\n\nexport interface Assertion {\n  /** dotted accessor into `predicate` (e.g. `evidence.costUsd`, `grade`) or a finding\n   * selector (`findings.<id>` count, `findings.severity.<level>` count). */\n  path: string;\n  op: AssertOp;\n  value?: unknown;\n  /** `error` (default) gates the exit code; `warn` reports but does not fail. */\n  severity?: \"error\" | \"warn\";\n}\n\nexport interface AssertResult {\n  assertion: Assertion;\n  pass: boolean;\n  actual: unknown;\n  /** a config/usage error (bad op, missing field for a comparison, …) — never a silent pass */\n  error?: string;\n}\n\n/** Resolve a dotted `path` into the receipt predicate, with finding selectors. */\nexport function resolvePath(predicate: ReceiptPredicate, path: string): unknown {\n  if (path === \"findings\" || path.startsWith(\"findings.\")) {\n    const rest = path === \"findings\" ? \"\" : path.slice(\"findings.\".length);\n    if (rest === \"\") {\n      return predicate.findings.length;\n    }\n    if (rest.startsWith(\"severity.\")) {\n      const level = rest.slice(\"severity.\".length);\n      return predicate.findings.filter((f) => f.severity === level).length;\n    }\n    // `findings.<id>` → count of findings whose id equals or is prefixed by it (so a\n    // category like `destructive-git` matches `destructive-git-<span>`).\n    return predicate.findings.filter((f) => f.id === rest || f.id.startsWith(`${rest}-`)).length;\n  }\n  // dotted get into the predicate (evidence.*, grade, scope.*, session.*)\n  let cur: unknown = predicate;\n  for (const key of path.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") {\n      return undefined;\n    }\n    cur = (cur as Record<string, unknown>)[key];\n  }\n  return cur;\n}\n\nconst isNum = (v: unknown): v is number => typeof v === \"number\" && Number.isFinite(v);\nconst isEmpty = (v: unknown): boolean =>\n  v == null ||\n  v === \"\" ||\n  v === 0 ||\n  (Array.isArray(v) && v.length === 0) ||\n  (typeof v === \"object\" && Object.keys(v as object).length === 0);\n\n/** Apply one operator; returns `{pass}` or `{error}` for a config/type misuse. */\nfunction applyOp(\n  op: AssertOp,\n  actual: unknown,\n  value: unknown,\n): { pass: boolean } | { error: string } {\n  const needNum = (): { error: string } | null =>\n    isNum(actual) && isNum(value)\n      ? null\n      : { error: `op '${op}' needs a numeric field and value (got ${JSON.stringify(actual)})` };\n  switch (op) {\n    case \"exists\":\n      return { pass: actual !== undefined && actual !== null };\n    case \"empty\":\n      return { pass: isEmpty(actual) };\n    case \"eq\":\n      return { pass: actual === value };\n    case \"ne\":\n      return { pass: actual !== value };\n    case \"lt\":\n      return needNum() ?? { pass: (actual as number) < (value as number) };\n    case \"lte\":\n      return needNum() ?? { pass: (actual as number) <= (value as number) };\n    case \"gt\":\n      return needNum() ?? { pass: (actual as number) > (value as number) };\n    case \"gte\":\n      return needNum() ?? { pass: (actual as number) >= (value as number) };\n    case \"matches\": {\n      if (typeof actual !== \"string\" || typeof value !== \"string\") {\n        return { error: `op 'matches' needs a string field and a string pattern` };\n      }\n      try {\n        return { pass: new RegExp(value).test(actual) };\n      } catch (e) {\n        return { error: `invalid regex '${value}': ${(e as Error).message}` };\n      }\n    }\n    case \"in\":\n      return Array.isArray(value)\n        ? { pass: value.includes(actual) }\n        : { error: `op 'in' needs an array value` };\n    default:\n      return { error: `unknown op '${op}'` };\n  }\n}\n\n/** Validate + normalise one raw assertion entry; returns an error string when malformed. */\nfunction validateAssertion(raw: unknown): { assertion: Assertion } | { error: string } {\n  if (!raw || typeof raw !== \"object\") {\n    return { error: \"assertion must be an object\" };\n  }\n  const r = raw as Record<string, unknown>;\n  if (typeof r.path !== \"string\" || !r.path) {\n    return { error: \"assertion.path must be a non-empty string\" };\n  }\n  if (typeof r.op !== \"string\" || !OPS.has(r.op as AssertOp)) {\n    return { error: `assertion.op '${String(r.op)}' is not one of ${[...OPS].join(\"|\")}` };\n  }\n  if (r.severity !== undefined && r.severity !== \"error\" && r.severity !== \"warn\") {\n    return { error: \"assertion.severity must be 'error' or 'warn'\" };\n  }\n  return {\n    assertion: {\n      path: r.path,\n      op: r.op as AssertOp,\n      value: r.value,\n      severity: (r.severity as \"error\" | \"warn\") ?? \"error\",\n    },\n  };\n}\n\n/** Read `.receipts/asserts.json` (JSON-only v1, no new dependency). Returns `[]` when\n * absent (the command is then a no-op). Throws on malformed JSON / wrong shape. */\nexport function loadAsserts(repoRoot: string): Assertion[] {\n  const path = join(repoRoot, \".receipts\", \"asserts.json\");\n  let text: string;\n  try {\n    text = readFileSync(path, \"utf8\");\n  } catch {\n    return []; // absent ⇒ no-op\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch (e) {\n    throw new Error(`.receipts/asserts.json is not valid JSON: ${(e as Error).message}`);\n  }\n  const list = Array.isArray(parsed)\n    ? parsed\n    : parsed &&\n        typeof parsed === \"object\" &&\n        Array.isArray((parsed as { asserts?: unknown }).asserts)\n      ? (parsed as { asserts: unknown[] }).asserts\n      : null;\n  if (!list) {\n    throw new Error(\".receipts/asserts.json must be an array or { asserts: [...] }\");\n  }\n  const out: Assertion[] = [];\n  for (const raw of list) {\n    const v = validateAssertion(raw);\n    if (\"error\" in v) {\n      throw new Error(`invalid assertion: ${v.error} (${JSON.stringify(raw)})`);\n    }\n    out.push(v.assertion);\n  }\n  return out;\n}\n\n/** Evaluate every assertion against the receipt — pure, total, no model. */\nexport function evaluateAsserts(receipt: Receipt, asserts: readonly Assertion[]): AssertResult[] {\n  return asserts.map((assertion) => {\n    const actual = resolvePath(receipt.predicate, assertion.path);\n    // a comparison op on a missing field is a config error, never a silent pass.\n    if (\n      actual === undefined &&\n      assertion.op !== \"exists\" &&\n      assertion.op !== \"empty\" &&\n      assertion.op !== \"ne\"\n    ) {\n      return { assertion, pass: false, actual, error: `path '${assertion.path}' not found` };\n    }\n    const res = applyOp(assertion.op, actual, assertion.value);\n    return \"error\" in res\n      ? { assertion, pass: false, actual, error: res.error }\n      : { assertion, pass: res.pass, actual };\n  });\n}\n\n/** Exit code: non-zero iff an error-severity assertion failed or hit a config error. */\nexport function assertExitCode(results: readonly AssertResult[]): number {\n  return results.some((r) => (!r.pass || r.error) && (r.assertion.severity ?? \"error\") === \"error\")\n    ? 1\n    : 0;\n}\n\n/** Human-readable report of the assertion run. */\nexport function renderAssertResults(results: readonly AssertResult[]): string {\n  if (results.length === 0) {\n    return \"receipts assert: no assertions (.receipts/asserts.json absent) — nothing to check.\";\n  }\n  const lines = results.map((r) => {\n    const { path, op, value, severity } = r.assertion;\n    const expr = `${path} ${op}${value === undefined ? \"\" : ` ${JSON.stringify(value)}`}`;\n    if (r.error) {\n      return `  ⚠️  ERROR  ${expr} — ${r.error}`;\n    }\n    const tag = r.pass ? \"  ✅ PASS \" : severity === \"warn\" ? \"  🟡 WARN \" : \"  ❌ FAIL \";\n    return `${tag} ${expr}  (actual: ${JSON.stringify(r.actual)})`;\n  });\n  const failed = results.filter(\n    (r) => !r.pass && (r.assertion.severity ?? \"error\") === \"error\",\n  ).length;\n  const warned = results.filter((r) => !r.pass && r.assertion.severity === \"warn\").length;\n  const passed = results.filter((r) => r.pass).length;\n  lines.push(\n    `  ${passed} passed · ${failed} failed${warned ? ` · ${warned} warned` : \"\"} of ${results.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n","import { readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { ExternalStateRow } from \"../findings/externalState.js\";\n\n/**\n * Reader for the external-state reconciliation side-log (SPEC-0120 / external-state-reconciler).\n * The opt-in `receipts reconcile` CI step (src/reconcile/reconcile.ts) calls the authoritative\n * API (`gh pr view` / `gh pr checks`) and appends one JSON line per reconciliation to\n * `${RECEIPTS_RECONCILE_DIR || ~/.claude/receipts/reconcile}/<sessionId>.jsonl`. `receipts pr`\n * reads the log for the session it is building and attaches the rows as a recorded input (exempt\n * from the L1 byte-compare; envelope-covered). Crash-safe: a missing or garbled log yields `[]` —\n * the reconciler is a bonus, never a hard dependency, so a read failure must never break a receipt.\n *\n * The producer (the reconciler) imports `reconcileDir()` from here, so the write path and this read\n * path share one source — they cannot drift. `<sessionId>` is the transcript file's basename, the\n * same key `sessionIdFromPath()` (guardLog.ts) resolves.\n */\nexport function reconcileDir(): string {\n  return process.env.RECEIPTS_RECONCILE_DIR || join(homedir(), \".claude\", \"receipts\", \"reconcile\");\n}\n\nfunction isExternalStateRow(v: unknown): v is ExternalStateRow {\n  if (!v || typeof v !== \"object\") {\n    return false;\n  }\n  const o = v as Record<string, unknown>;\n  return (\n    (o.kind === \"merged\" || o.kind === \"ci-green\") &&\n    typeof o.target === \"string\" &&\n    typeof o.claimed === \"string\" &&\n    typeof o.actual === \"string\" &&\n    typeof o.match === \"boolean\"\n  );\n}\n\n/**\n * Read + validate the reconciliation rows for a session id. Returns the well-formed rows in file\n * order; skips malformed lines. Returns `[]` when the log is absent or unreadable.\n */\nexport function readExternalState(sessionId: string): ExternalStateRow[] {\n  if (!sessionId) {\n    return [];\n  }\n  let raw: string;\n  try {\n    raw = readFileSync(join(reconcileDir(), `${sessionId}.jsonl`), \"utf8\");\n  } catch {\n    return []; // no log for this session — the common case (reconciler is opt-in)\n  }\n  const out: ExternalStateRow[] = [];\n  for (const line of raw.split(\"\\n\")) {\n    const t = line.trim();\n    if (!t) {\n      continue;\n    }\n    try {\n      const v = JSON.parse(t);\n      if (isExternalStateRow(v)) {\n        out.push({\n          kind: v.kind,\n          target: v.target,\n          claimed: v.claimed,\n          actual: v.actual,\n          match: v.match,\n          ...(typeof v.actor === \"string\" ? { actor: v.actor } : {}),\n          ...(typeof v.ts === \"string\" ? { ts: v.ts } : {}),\n          ...(typeof v.fetchedAt === \"string\" ? { fetchedAt: v.fetchedAt } : {}),\n          ...(typeof v.url === \"string\" ? { url: v.url } : {}),\n        });\n      }\n    } catch {\n      // skip a malformed line; a partial/corrupt log still yields its good rows\n    }\n  }\n  return out;\n}\n","import { execFileSync } from \"node:child_process\";\nimport { mkdirSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n  type ExternalClaim,\n  type ExternalStateRow,\n  parseExternalClaims,\n} from \"../findings/externalState.js\";\nimport { reconcileDir } from \"../receipt/externalStateLog.js\";\n\n/**\n * The external-state reconciler (SPEC-0120 / external-state-reconciler — THE WEDGE). The ONLY\n * place network + creds enter the system, and it is OPT-IN (gated by `RECEIPTS_RECONCILE`) and\n * runs in CI — the deterministic `receipts` core never imports this. It parses the agent's\n * external-state claims, calls the authoritative API (`gh`), does an EXACT enum comparison, and\n * appends the result to the side-log `receipts pr` reads. Abstain-on-doubt (R3): any ambiguity —\n * no parseable target, API unreachable / 403 / rate-limited, a pending check — yields NO row.\n * Evidence, not judgement: a row attests the API's answer, never \"the agent lied.\"\n */\n\n/** The authoritative API answer for a claim target. `degraded` ⇒ abstain (no row). */\nexport interface ApiState {\n  /** the authoritative state string (\"OPEN\" | \"CLOSED\" | \"MERGED\" | \"pass\" | \"fail\" | …) */\n  actual: string;\n  /** the API's authoritative actor, when present (`mergedBy.login`) */\n  actor?: string;\n  /** the API's own event timestamp (`mergedAt`), when present */\n  ts?: string;\n  url?: string;\n  /** true when the API could not give a confident answer (unreachable / pending / no creds) */\n  degraded?: boolean;\n}\n\n/** A fetcher resolves a claim's target to the API's authoritative state. Injected so the compare\n * logic is pure + testable; the real one shells out to `gh`. */\nexport type Fetcher = (claim: ExternalClaim) => ApiState;\n\n/** Did the claim match the API? merged ⇒ state MERGED; ci-green ⇒ every run pass. Exact equality\n * over enum strings — no inference. */\nfunction isMatch(kind: ExternalClaim[\"kind\"], actual: string): boolean {\n  if (kind === \"merged\") {\n    return actual.toUpperCase() === \"MERGED\";\n  }\n  return actual.toLowerCase() === \"pass\";\n}\n\n/**\n * Reconcile one claim against a fetcher. Returns a row, or null to ABSTAIN (degraded API — R3).\n * Pure given the fetcher.\n */\nexport function reconcileClaim(\n  claim: ExternalClaim,\n  fetch: Fetcher,\n  fetchedAt: string,\n): ExternalStateRow | null {\n  let api: ApiState;\n  try {\n    api = fetch(claim);\n  } catch {\n    return null; // unreachable / threw ⇒ abstain (degrade silent)\n  }\n  if (api.degraded || !api.actual) {\n    return null; // pending / 403 / rate-limited / no creds ⇒ abstain\n  }\n  return {\n    kind: claim.kind,\n    target: claim.target,\n    claimed: claim.kind === \"merged\" ? \"merged\" : \"green\",\n    actual: api.actual,\n    match: isMatch(claim.kind, api.actual),\n    ...(api.actor ? { actor: api.actor } : {}),\n    ...(api.ts ? { ts: api.ts } : {}),\n    fetchedAt,\n    ...(api.url ? { url: api.url } : {}),\n  };\n}\n\n/** Split a `#N` / `owner/repo#N` target into the PR number + optional `--repo` args. */\nfunction targetArgs(target: string): { num: string; repo?: string } | null {\n  const m = /^(?:([\\w.-]+\\/[\\w.-]+)#)?(\\d+)$/.exec(target);\n  if (!m) {\n    return null;\n  }\n  return { num: m[2], ...(m[1] ? { repo: m[1] } : {}) };\n}\n\nfunction gh(args: string[]): string {\n  return execFileSync(\"gh\", args, { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] });\n}\n\n/** The real fetcher: `gh pr view` for merged, `gh pr checks` for ci-green. Any failure throws or\n * returns degraded ⇒ the caller abstains. */\nexport const ghFetcher: Fetcher = (claim) => {\n  const t = targetArgs(claim.target);\n  if (!t) {\n    return { actual: \"\", degraded: true };\n  }\n  const repoArgs = t.repo ? [\"--repo\", t.repo] : [];\n  if (claim.kind === \"merged\") {\n    const out = gh([\"pr\", \"view\", t.num, ...repoArgs, \"--json\", \"state,mergedBy,mergedAt,url\"]);\n    const j = JSON.parse(out) as {\n      state?: string;\n      mergedBy?: { login?: string } | null;\n      mergedAt?: string | null;\n      url?: string;\n    };\n    if (!j.state) {\n      return { actual: \"\", degraded: true };\n    }\n    return {\n      actual: j.state,\n      ...(j.mergedBy?.login ? { actor: j.mergedBy.login } : {}),\n      ...(j.mergedAt ? { ts: j.mergedAt } : {}),\n      ...(j.url ? { url: j.url } : {}),\n    };\n  }\n  // ci-green: derive from per-run buckets (the real `gh pr checks` enum is\n  // pass/fail/pending/skipping/cancel). A check still `pending` ⇒ abstain (not a contradiction).\n  // Green requires NO `fail`/`cancel`; `skipping`/`skipped`/`neutral` do NOT break green (a suite\n  // of pass+skipping is green — ci-green-with-skips). The suite rollup combines by highest-priority\n  // conclusion, so we derive from per-run buckets, not the rollup.\n  const out = gh([\"pr\", \"checks\", t.num, ...repoArgs, \"--json\", \"bucket,state,name\"]);\n  const runs = JSON.parse(out) as { bucket?: string }[];\n  if (!Array.isArray(runs) || runs.length === 0) {\n    return { actual: \"\", degraded: true };\n  }\n  return ciStateFromBuckets(runs.map((r) => (r.bucket || \"\").toLowerCase()));\n};\n\nconst GREENISH = new Set([\"pass\", \"skipping\", \"skipped\", \"neutral\"]);\n\n/**\n * Map per-run `gh pr checks` buckets to a CI state. `pending` ⇒ abstain (not a contradiction);\n * any `fail`/`cancel` ⇒ \"fail\"; ALL recognized green/neutral ⇒ \"pass\". Abstain-on-doubt: an\n * unknown or empty bucket must NOT fall through to \"pass\" (codex review — a divergence can't fire\n * on a gh enum we don't model). Pure + unit-tested.\n */\nexport function ciStateFromBuckets(buckets: readonly string[]): ApiState {\n  if (buckets.length === 0) {\n    return { actual: \"\", degraded: true };\n  }\n  if (buckets.some((b) => b === \"pending\")) {\n    return { actual: \"\", degraded: true };\n  }\n  if (buckets.some((b) => b === \"fail\" || b === \"cancel\")) {\n    return { actual: \"fail\" };\n  }\n  if (buckets.every((b) => GREENISH.has(b))) {\n    return { actual: \"pass\" };\n  }\n  return { actual: \"\", degraded: true }; // an unknown/empty bucket ⇒ abstain\n}\n\nexport interface ReconcileResult {\n  /** claims parsed from the final text */\n  claims: number;\n  /** rows written (after abstentions) */\n  rows: ExternalStateRow[];\n}\n\n/**\n * Reconcile a session's external-state claims and append the rows to its side-log. Opt-in: a\n * no-op unless `RECEIPTS_RECONCILE` is set. `finalText` is the agent's final message; `sessionId`\n * is the transcript basename (the key `receipts pr` reads).\n */\nexport function reconcileSession(\n  sessionId: string,\n  finalText: string,\n  fetch: Fetcher = ghFetcher,\n  fetchedAt = \"\",\n): ReconcileResult {\n  if (!process.env.RECEIPTS_RECONCILE) {\n    return { claims: 0, rows: [] };\n  }\n  const claims = parseExternalClaims(finalText);\n  const rows: ExternalStateRow[] = [];\n  for (const c of claims) {\n    const row = reconcileClaim(c, fetch, fetchedAt);\n    if (row) {\n      rows.push(row);\n    }\n  }\n  if (rows.length && sessionId) {\n    const dir = reconcileDir();\n    mkdirSync(dir, { recursive: true });\n    // OVERWRITE (not append): each reconcile run re-reconciles the session's CURRENT claims, so\n    // the freshest run is authoritative. Appending would let a stale OPEN mismatch keep rendering\n    // after the PR later merges (the API answer changed). One run ⇒ one fresh side-log.\n    writeFileSync(\n      join(dir, `${sessionId}.jsonl`),\n      `${rows.map((r) => JSON.stringify(r)).join(\"\\n\")}\\n`,\n    );\n  }\n  return { claims: claims.length, rows };\n}\n","import { spawnSync } from \"node:child_process\";\n\n/**\n * `receipts ack` (M78) — the attributed human acknowledgment of an agent's work. An ack\n * is the **active gesture** (a human did something, not just a bot that auto-ran) and an\n * **audit-trail signal**: \"a named person, at a time, reviewed this agent's work record.\" Recorded into an append-only, local-only ledger in a sibling\n * git ref (`refs/receipts-acks/<slug>`) — never mutating the signed receipt itself.\n *\n * Local-first (R4): reads/writes only local refs the user owns; nothing uploaded. The\n * outward half — writing the ack back onto the PR comment — is deliberately OUT of scope\n * (requires comment-write auth; SPEC-0073 NG2). This is the safe, composable core: once\n * recorded, `receipts fleet` surfaces review coverage across the org.\n *\n * Acks carry a real actor + timestamp — a genuine non-deterministic *input* (a user\n * action), like prEffort/prHistory, not a derived value; both are passed in by the caller\n * so the core stays pure and testable.\n */\n\nexport const ACK_REF_PREFIX = \"refs/receipts-acks/\";\nexport const ackRef = (slug: string): string => `${ACK_REF_PREFIX}${slug}`;\n\nexport interface AckEntry {\n  /** who acknowledged — `Name <email>` or a bare username */\n  actor: string;\n  /** unix ms when acknowledged (a recorded input, not derived) */\n  ts: number;\n  /** optional note the reviewer left */\n  note?: string;\n  /** optional event id (the receipts-state event this ack is about); omitted = whole receipt */\n  eventId?: string;\n}\n\ninterface GitResult {\n  out: string;\n  ok: boolean;\n  err: string;\n}\nfunction git(\n  args: string[],\n  opts: { cwd?: string; input?: string; env?: NodeJS.ProcessEnv } = {},\n): GitResult {\n  const r = spawnSync(\"git\", args, {\n    encoding: \"utf8\",\n    cwd: opts.cwd,\n    input: opts.input,\n    env: opts.env ? { ...process.env, ...opts.env } : process.env,\n  });\n  return { out: (r.stdout ?? \"\").trim(), ok: r.status === 0, err: (r.stderr ?? \"\").trim() };\n}\n\n// Deterministic ledger commits (the entries carry the real time; the wrapping commit is\n// fixed-identity so re-writing the same entries yields the same tree, like store.ts).\nconst IDENT = [\"-c\", \"user.name=receipts\", \"-c\", \"user.email=receipts@altimate.ai\"];\n\n/** Read the append-only ack ledger for `slug` (newest-last), or `[]` if none. */\nexport function readAcks(slug: string, cwd?: string): AckEntry[] {\n  const r = git([\"cat-file\", \"blob\", `${ackRef(slug)}:acks.json`], { cwd });\n  if (!r.ok || !r.out) {\n    return [];\n  }\n  try {\n    const v = JSON.parse(r.out);\n    return Array.isArray(v) ? (v as AckEntry[]) : [];\n  } catch {\n    return [];\n  }\n}\n\nexport type AppendAckResult =\n  | { ok: true; ref: string; total: number }\n  | { ok: false; reason: string };\n\n/** Append one ack to `slug`'s ledger (append-only: prior entries are preserved). Writes\n * a sibling ref via plumbing — no index, no checkout, no tree files. */\nexport function appendAck(slug: string, entry: AckEntry, cwd?: string): AppendAckResult {\n  const existing = readAcks(slug, cwd);\n  const next = [...existing, entry];\n  const json = `${JSON.stringify(next, null, 2)}\\n`;\n\n  const blob = git([\"hash-object\", \"-w\", \"--stdin\"], { cwd, input: json });\n  if (!blob.ok) {\n    return { ok: false, reason: \"hash-object failed (not a git repository?)\" };\n  }\n  const tree = git([\"mktree\"], { cwd, input: `100644 blob ${blob.out}\\tacks.json\\n` });\n  if (!tree.ok) {\n    return { ok: false, reason: \"mktree failed\" };\n  }\n  // The wrapping commit's date is the ack's own timestamp (set via GIT_*_DATE), so the\n  // same accumulated entries reproduce the same commit — not wall-clock (review fix).\n  const when = `@${Math.max(1, Math.floor(entry.ts / 1000))} +0000`;\n  const commit = git([...IDENT, \"commit-tree\", tree.out, \"-m\", `acks: ${slug}`], {\n    cwd,\n    env: { GIT_AUTHOR_DATE: when, GIT_COMMITTER_DATE: when },\n  });\n  if (!commit.ok) {\n    return { ok: false, reason: `commit-tree failed: ${commit.err}` };\n  }\n  const ref = ackRef(slug);\n  const upd = git([\"update-ref\", ref, commit.out], { cwd });\n  if (!upd.ok) {\n    return { ok: false, reason: `update-ref ${ref} failed` };\n  }\n  return { ok: true, ref, total: next.length };\n}\n\n/** Resolve the acknowledging actor from local git identity, falling back to $USER. The\n * one impure read — kept here so the ledger core stays pure given (actor, ts). */\nexport function resolveActor(cwd?: string): string {\n  const name = git([\"config\", \"user.name\"], { cwd }).out;\n  const email = git([\"config\", \"user.email\"], { cwd }).out;\n  if (name && email) {\n    return `${name} <${email}>`;\n  }\n  return name || email || process.env.USER || process.env.LOGNAME || \"unknown\";\n}\n\n/** Which receipt slugs have ≥1 ack — used by `fleet` to show review coverage. */\nexport function listAckedSlugs(cwd?: string): Set<string> {\n  const r = git([\"for-each-ref\", ACK_REF_PREFIX, \"--format=%(refname)\"], { cwd });\n  if (!r.ok || !r.out) {\n    return new Set();\n  }\n  return new Set(\n    r.out\n      .split(\"\\n\")\n      .filter(Boolean)\n      .map((ref) => ref.slice(ACK_REF_PREFIX.length)),\n  );\n}\n","import type { GradeLetter } from \"../findings/grade.js\";\n\n/**\n * `receipts badge` (M59) — a [shields.io endpoint](https://shields.io/badges/endpoint-badge)\n * JSON for a repo's README/PR: an at-a-glance, **factual** state of the agent-work receipt.\n * It states the finding count (and colors by worst severity) — never a quality verdict about\n * the code (R2). Pure function of the receipt's findings; deterministic; zero model calls.\n *\n * Hosting is the user's choice (commit the JSON + a raw URL, or publish it from CI); this only\n * emits the endpoint object. Works once a repo is public (shields.io must reach the URL).\n */\n\nexport interface ShieldsEndpoint {\n  schemaVersion: 1;\n  label: string;\n  message: string;\n  color: string;\n}\n\ntype Sev = \"critical\" | \"high\" | \"medium\" | \"low\";\nconst SEV_ORDER: readonly Sev[] = [\"critical\", \"high\", \"medium\", \"low\"];\n\n/** The worst severity present in a finding set, or undefined when empty. */\nexport function worstSeverity(findings: readonly { severity: Sev }[]): Sev | undefined {\n  return SEV_ORDER.find((s) => findings.some((f) => f.severity === s));\n}\n\n/**\n * Build the shields.io endpoint object from a receipt predicate. Message is the finding\n * count (factual); color maps to the worst severity (clean → brightgreen, critical/high →\n * red, medium → orange, low → yellow). The synthesized grade is deliberately NOT the\n * message — the badge states what was found, not a verdict.\n */\nexport function badgeEndpoint(predicate: {\n  grade?: GradeLetter;\n  findings?: readonly { severity: Sev }[];\n}): ShieldsEndpoint {\n  const findings = predicate.findings ?? [];\n  const n = findings.length;\n  const worst = worstSeverity(findings);\n  const color =\n    n === 0\n      ? \"brightgreen\"\n      : worst === \"critical\" || worst === \"high\"\n        ? \"red\"\n        : worst === \"medium\"\n          ? \"orange\"\n          : \"yellow\";\n  const message = n === 0 ? \"no findings\" : `${n} finding${n === 1 ? \"\" : \"s\"}`;\n  return { schemaVersion: 1, label: \"receipts\", message, color };\n}\n","import { formatCostAlways, formatTokens } from \"../findings/format.js\";\nimport type { Receipt, ReceiptFinding } from \"../receipt/build.js\";\n\n/**\n * Receipt-to-receipt diff (M51) — \"what changed between two agent runs?\" A pure,\n * deterministic comparison of two receipts Receipts already emits (a re-run on the\n * same PR, last night's run vs tonight's, agent A vs agent B). It reports **deltas and\n * counts** — files/edits/commands, cost/tokens, findings added/removed, the\n * test-observation flip, both grades — and **never a judgement** (no \"better / worse /\n * regressed / improved\"). The reader decides; the diff states facts (SPEC-0000 R2).\n *\n * Deterministic · zero model calls · no schema change · same {a, b} → identical delta.\n */\n\nexport interface CountDelta {\n  key: string;\n  label: string;\n  a: number;\n  b: number;\n  delta: number;\n}\n\nexport interface ReceiptDelta {\n  grade: { a: string; b: string };\n  counts: CountDelta[];\n  cost: { a: number; b: number; delta: number };\n  testsObserved: { a: boolean; b: boolean };\n  findingsAdded: ReceiptFinding[];\n  findingsRemoved: ReceiptFinding[];\n  findingsCommon: number;\n  scope: { a: string; b: string };\n}\n\n/** Stable cross-run identity for a finding. The raw `id` embeds span indices that\n * differ between runs, so identity is the human-stable (title + filePath) pair. */\nfunction findingKey(f: ReceiptFinding): string {\n  return `${f.title}\u0000${f.filePath ?? \"\"}`;\n}\n\nfunction scopeLabel(r: Receipt): string {\n  const s = r.predicate.scope;\n  if (!s || s.kind === \"session\") return \"whole session\";\n  if (s.kind === \"branch\") return `branch ${s.branch ?? \"?\"}`;\n  return `diff (${(s.files ?? []).length} files${s.base ? ` vs ${s.base}` : \"\"})`;\n}\n\nexport function diffReceipts(a: Receipt, b: Receipt): ReceiptDelta {\n  const ea = a.predicate.evidence;\n  const eb = b.predicate.evidence;\n  const count = (key: string, label: string, va: number, vb: number): CountDelta => ({\n    key,\n    label,\n    a: va,\n    b: vb,\n    delta: vb - va,\n  });\n  const counts: CountDelta[] = [\n    count(\"filesChanged\", \"files changed\", ea.filesChanged, eb.filesChanged),\n    count(\"edits\", \"edits\", ea.edits, eb.edits),\n    count(\"commands\", \"commands\", ea.commands, eb.commands),\n    count(\"reads\", \"reads\", ea.reads, eb.reads),\n    count(\"destructiveOps\", \"destructive ops\", ea.destructiveOps, eb.destructiveOps),\n    count(\"tokens\", \"tokens\", ea.tokens.total, eb.tokens.total),\n  ];\n\n  const aKeys = new Set(a.predicate.findings.map(findingKey));\n  const bKeys = new Set(b.predicate.findings.map(findingKey));\n  const findingsAdded = b.predicate.findings.filter((f) => !aKeys.has(findingKey(f)));\n  const findingsRemoved = a.predicate.findings.filter((f) => !bKeys.has(findingKey(f)));\n  const findingsCommon = a.predicate.findings.filter((f) => bKeys.has(findingKey(f))).length;\n\n  return {\n    grade: { a: a.predicate.grade, b: b.predicate.grade },\n    counts,\n    cost: { a: ea.costUsd, b: eb.costUsd, delta: eb.costUsd - ea.costUsd },\n    testsObserved: { a: ea.testsRan, b: eb.testsRan },\n    findingsAdded,\n    findingsRemoved,\n    findingsCommon,\n    scope: { a: scopeLabel(a), b: scopeLabel(b) },\n  };\n}\n\nconst SEV_ICON: Record<string, string> = { critical: \"⛔\", high: \"⚠️\", medium: \"🔍\", low: \"·\" };\n\n/** Signed-delta string, neutral: \"+3\" / \"-2\" / \"±0\". No value judgement on direction. */\nfunction signed(n: number): string {\n  if (n === 0) return \"±0\";\n  return n > 0 ? `+${n}` : `${n}`;\n}\n\nfunction findingLines(fs: readonly ReceiptFinding[]): string[] {\n  return fs.map((f) => {\n    const loc = f.filePath ? ` (\\`${f.filePath}\\`)` : \"\";\n    return `  ${SEV_ICON[f.severity] ?? \"·\"} ${f.title}${loc}`;\n  });\n}\n\n/** Render the delta as plain text (A = baseline, B = new). Facts only. */\nexport function renderDiff(d: ReceiptDelta): string {\n  const out: string[] = [];\n  out.push(\"Receipt diff — A (baseline) → B (new)\");\n  out.push(\"\");\n  out.push(`Grade: ${d.grade.a} → ${d.grade.b}`);\n  out.push(`Scope: A ${d.scope.a} · B ${d.scope.b}`);\n  out.push(\"\");\n  out.push(\"Evidence:\");\n  for (const c of d.counts) {\n    out.push(`  ${c.label}: ${c.a} → ${c.b} (${signed(c.delta)})`);\n  }\n  const cd = d.cost;\n  const costDelta =\n    cd.delta === 0 ? \"±0\" : (cd.delta > 0 ? \"+\" : \"-\") + formatCostAlways(Math.abs(cd.delta));\n  out.push(`  cost: ${formatCostAlways(cd.a)} → ${formatCostAlways(cd.b)} (${costDelta})`);\n  out.push(\n    `  tokens (total): ${formatTokens(d.counts.find((c) => c.key === \"tokens\")?.a ?? 0)} → ${formatTokens(d.counts.find((c) => c.key === \"tokens\")?.b ?? 0)}`,\n  );\n  const to = d.testsObserved;\n  const toStr = (v: boolean) => (v ? \"observed\" : \"not observed\");\n  out.push(`  test command: ${toStr(to.a)} → ${toStr(to.b)}${to.a !== to.b ? \" (changed)\" : \"\"}`);\n  out.push(\"\");\n  out.push(\n    `Findings: ${d.findingsAdded.length} only in B · ${d.findingsRemoved.length} only in A · ${d.findingsCommon} in both`,\n  );\n  if (d.findingsAdded.length) {\n    out.push(\"\");\n    out.push(\"Only in B (new):\");\n    out.push(...findingLines(d.findingsAdded));\n  }\n  if (d.findingsRemoved.length) {\n    out.push(\"\");\n    out.push(\"Only in A (absent from B):\");\n    out.push(...findingLines(d.findingsRemoved));\n  }\n  out.push(\"\");\n  out.push(\"Deterministic · 0 model calls · evidence, not judgement.\");\n  return `${out.join(\"\\n\")}\\n`;\n}\n","import type { AgentSource } from \"../trace/types.js\";\nimport { CHECK_CATALOG, checkForId } from \"./checks.js\";\n\n/**\n * `receipts eval` (M57) — a precision/recall harness for the **work-account**, not the code.\n *\n * Receipts' thesis is that a human reviews the agent's *work* (a faithful, deterministic\n * account of what it did) instead of re-reading the agent's *output*. That only holds if the\n * account is trustworthy: one false alarm and the reviewer goes back to reading diffs. So the\n * near-zero-FP bar (SPEC-0000 R3) is existential — and until now, unmeasured. This turns it\n * into a number: run the detectors over a hand-labeled corpus, compare what fired to the\n * ground truth, and compute precision/recall/F1.\n *\n * It is **dev/CI tooling, not the product path**: it adds no detector, calls no model (R1),\n * and renders no verdict about any code (R2) — it measures *detector fidelity*. The unit of\n * scoring is (session × merge-surface category): each fixture's ground truth and the\n * detectors' output are both sets of {@link CHECK_CATALOG} keys (advisory cost/loop findings\n * are out of scope by construction — they aren't in the catalog).\n */\n\n/** A finding, reduced to the one field the harness needs. */\nexport interface ScorableFinding {\n  id: string;\n}\n\n/** The merge-surface category keys a finding set fired (reusing the existing taxonomy). */\nexport function firedCategories(findings: readonly ScorableFinding[]): Set<string> {\n  const keys = new Set<string>();\n  for (const f of findings) {\n    const c = checkForId(f.id);\n    if (c) {\n      keys.add(c.key);\n    }\n  }\n  return keys;\n}\n\n/**\n * The categories the curated corpus scores precision/recall over: the **deterministic\n * STATEMENT detectors** whose near-zero-FP we guarantee (SPEC-0000 R3). The heuristic,\n * confidence-weighted \"QUESTION\" detectors (blind/unverified edits, duplication, unfulfilled\n * promises, swallowed errors, stubbed impls — see `findings.ts`) need full-session context to\n * be meaningful and fire as artifacts on minimal single-behavior fixtures, so they are out of\n * the curated precision claim. The field scan (`receipts eval`) exercises them over real\n * sessions, where they belong.\n */\nexport const SCORED_CATEGORIES: ReadonlySet<string> = new Set([\n  \"destructive\",\n  \"git-history\",\n  \"secrets\",\n  \"cicd\",\n  \"lockfile\",\n  \"tests\",\n  \"weakening\",\n  \"injection\",\n  \"trojan\",\n  \"malformed\",\n  \"truncated\",\n  \"tool-calls\",\n]);\n\n/** Restrict a set of category keys to the scored (deterministic) scope. */\nexport function scoped(keys: Iterable<string>): string[] {\n  return [...keys].filter((k) => SCORED_CATEGORIES.has(k));\n}\n\n/** One labeled corpus row: a fixture and the categories that *should* fire ([] = clean). */\nexport interface CorpusEntry {\n  fixture: string;\n  /** merge-surface category keys (CHECK_CATALOG) expected to fire; empty ⇒ clean session */\n  expect: string[];\n  /** adapter to load the fixture through (default claude-code) */\n  source?: AgentSource;\n  /** why this fixture is labeled this way (kept honest, human-readable) */\n  note?: string;\n}\n\n/** The per-entry input to scoring: expected vs. actually-fired category keys. */\nexport interface ScoredEntry {\n  fixture: string;\n  expected: string[];\n  fired: string[];\n  /** fired but not expected — the false positives that erode trust */\n  fp: string[];\n  /** expected but not fired — the misses */\n  fn: string[];\n}\n\nexport interface CategoryMetric {\n  key: string;\n  label: string;\n  tp: number;\n  fp: number;\n  fn: number;\n  precision: number;\n  recall: number;\n  f1: number;\n}\n\nexport interface EvalMetrics {\n  entries: number;\n  tp: number;\n  fp: number;\n  fn: number;\n  precision: number;\n  recall: number;\n  f1: number;\n  perCategory: CategoryMetric[];\n  details: ScoredEntry[];\n}\n\n/** Precision/recall with an empty denominator = 1 (firing nothing on a clean session is\n * perfect, not undefined; missing nothing is perfect recall). */\nconst ratio = (num: number, denom: number): number => (denom === 0 ? 1 : num / denom);\nconst f1Of = (p: number, r: number): number => (p + r === 0 ? 0 : (2 * p * r) / (p + r));\n\n/**\n * Score a corpus run into a confusion matrix at (session × category) granularity. Pure: the\n * caller is responsible for loading fixtures and deriving findings; this only does the math,\n * so it is unit-testable without any I/O.\n */\nexport function scoreCorpus(\n  results: readonly { fixture: string; expected: readonly string[]; fired: ReadonlySet<string> }[],\n): EvalMetrics {\n  const label = new Map(CHECK_CATALOG.map((c) => [c.key, c.label] as const));\n  const cat = new Map<string, { tp: number; fp: number; fn: number }>();\n  const bump = (key: string, field: \"tp\" | \"fp\" | \"fn\") => {\n    const row = cat.get(key) ?? { tp: 0, fp: 0, fn: 0 };\n    row[field]++;\n    cat.set(key, row);\n  };\n\n  let tp = 0;\n  let fp = 0;\n  let fn = 0;\n  const details: ScoredEntry[] = [];\n\n  for (const r of results) {\n    const expected = new Set(r.expected);\n    const fpKeys: string[] = [];\n    const fnKeys: string[] = [];\n    for (const key of r.fired) {\n      if (expected.has(key)) {\n        tp++;\n        bump(key, \"tp\");\n      } else {\n        fp++;\n        fpKeys.push(key);\n        bump(key, \"fp\");\n      }\n    }\n    for (const key of expected) {\n      if (!r.fired.has(key)) {\n        fn++;\n        fnKeys.push(key);\n        bump(key, \"fn\");\n      }\n    }\n    details.push({\n      fixture: r.fixture,\n      expected: [...expected],\n      fired: [...r.fired],\n      fp: fpKeys,\n      fn: fnKeys,\n    });\n  }\n\n  const perCategory: CategoryMetric[] = [...cat.entries()]\n    .map(([key, v]) => {\n      const precision = ratio(v.tp, v.tp + v.fp);\n      const recall = ratio(v.tp, v.tp + v.fn);\n      return {\n        key,\n        label: label.get(key) ?? key,\n        ...v,\n        precision,\n        recall,\n        f1: f1Of(precision, recall),\n      };\n    })\n    .sort((a, b) => b.tp + b.fn - (a.tp + a.fn) || a.label.localeCompare(b.label));\n\n  const precision = ratio(tp, tp + fp);\n  const recall = ratio(tp, tp + fn);\n  return {\n    entries: results.length,\n    tp,\n    fp,\n    fn,\n    precision,\n    recall,\n    f1: f1Of(precision, recall),\n    perCategory,\n    details,\n  };\n}\n\nconst pct = (n: number): string => `${(100 * n).toFixed(1)}%`;\n\n/** Render the corpus confusion matrix as facts-only text (the trust artifact). */\nexport function renderEval(m: EvalMetrics): string {\n  const out: string[] = [];\n  out.push(`Receipts detector eval — ${m.entries} labeled session${m.entries === 1 ? \"\" : \"s\"}`);\n  out.push(\"\");\n  out.push(\n    `Precision ${pct(m.precision)} · Recall ${pct(m.recall)} · F1 ${pct(m.f1)}  (TP ${m.tp} · FP ${m.fp} · FN ${m.fn})`,\n  );\n  out.push(\"\");\n  if (m.perCategory.length) {\n    out.push(\"By category:\");\n    for (const c of m.perCategory) {\n      out.push(\n        `  ${c.label.padEnd(26)} P ${pct(c.precision).padStart(6)} R ${pct(c.recall).padStart(6)}  (tp ${c.tp} fp ${c.fp} fn ${c.fn})`,\n      );\n    }\n  }\n  const fps = m.details.filter((d) => d.fp.length);\n  const fns = m.details.filter((d) => d.fn.length);\n  if (fps.length) {\n    out.push(\"\", \"False positives (fired but should be clean):\");\n    for (const d of fps) out.push(`  ${d.fixture}: ${d.fp.join(\", \")}`);\n  }\n  if (fns.length) {\n    out.push(\"\", \"Misses (expected but did not fire):\");\n    for (const d of fns) out.push(`  ${d.fixture}: ${d.fn.join(\", \")}`);\n  }\n  out.push(\"\", \"Deterministic · 0 model calls · measures detector fidelity, not code quality.\");\n  return `${out.join(\"\\n\")}\\n`;\n}\n\n/** One real session's contribution to the field scan. */\nexport interface FieldRow {\n  title: string;\n  categories: string[];\n}\n\nexport interface FieldScan {\n  scanned: number;\n  flagged: number;\n  byCategory: { key: string; label: string; sessions: number }[];\n  rows: FieldRow[];\n}\n\n/** Aggregate a field scan over real local sessions: how often the work-account flags real\n * work, by category. A rate the human interprets — never a verdict (a flag may be a true\n * finding or an FP). */\nexport function summarizeFieldScan(rows: readonly FieldRow[]): FieldScan {\n  const label = new Map(CHECK_CATALOG.map((c) => [c.key, c.label] as const));\n  const cat = new Map<string, number>();\n  let flagged = 0;\n  for (const r of rows) {\n    if (r.categories.length) {\n      flagged++;\n    }\n    for (const key of new Set(r.categories)) {\n      cat.set(key, (cat.get(key) ?? 0) + 1);\n    }\n  }\n  const byCategory = [...cat.entries()]\n    .map(([key, sessions]) => ({ key, label: label.get(key) ?? key, sessions }))\n    .sort((a, b) => b.sessions - a.sessions || a.label.localeCompare(b.label));\n  return { scanned: rows.length, flagged, byCategory, rows: [...rows] };\n}\n\n/** Render the field scan as facts-only text. */\nexport function renderFieldScan(s: FieldScan): string {\n  if (s.scanned === 0) {\n    return \"No local agent sessions found to scan.\\n\";\n  }\n  const out: string[] = [];\n  out.push(`Receipts field scan — ${s.scanned} real local session${s.scanned === 1 ? \"\" : \"s\"}`);\n  out.push(\"\");\n  const rate = Math.round((100 * s.flagged) / s.scanned);\n  out.push(`Flagged: ${s.flagged}/${s.scanned} sessions (${rate}%) carried ≥1 merge-surface flag`);\n  out.push(\"\");\n  if (s.byCategory.length === 0) {\n    out.push(\"No merge-surface category fired on any scanned session.\");\n  } else {\n    out.push(\"By category (sessions flagged):\");\n    for (const c of s.byCategory) {\n      out.push(`  ${c.label.padEnd(26)} ${c.sessions}`);\n    }\n  }\n  out.push(\n    \"\",\n    \"A flag may be a true finding or a false positive — this is a flag rate you interpret,\",\n    \"not a verdict. Deterministic · 0 model calls · reads only local sessions.\",\n  );\n  return `${out.join(\"\\n\")}\\n`;\n}\n","import { readFileSync, readdirSync } from \"node:fs\";\nimport { basename, dirname, join } from \"node:path\";\nimport type { Severity } from \"../findings/findings.js\";\nimport { formatCostAlways } from \"../findings/format.js\";\nimport type { GradeLetter } from \"../findings/grade.js\";\nimport { verifyBundle } from \"../sign/verify.js\";\nimport { listAckedSlugs } from \"./ack.js\";\nimport { listReceiptRefs, readReceiptRef } from \"./store.js\";\n\n/**\n * `receipts fleet` (M77) — the local, cross-repo / cross-agent ROLLUP over the receipts\n * a team already has (`.receipts/*.json` + `refs/receipts/*`). It answers the org\n * question the per-repo `stats` can't: *across all our repos and every coding agent,\n * what did the agents spend, how much of the changes did their transcripts cover, and\n * what did Receipts flag?* A local, per-repo × per-agent rollup over the receipts a\n * team already has — no server, no upload.\n *\n * Deterministic · zero model calls · **local-first** (reads only refs the user already\n * owns; no network egress, nothing uploaded) · **counts, never a verdict** (R1/R2/R4).\n * It is a queryable VIEW, not a tamper-evidence layer — the signing/immutability moat\n * stays explicitly unbuilt and unclaimed here.\n *\n * The rollup is a lossless deterministic reduction of the same per-receipt fields the\n * per-repo surfaces read, so `fleet`'s totals sum-reconcile with `stats`/`--json` over\n * the same refs — that reconciliation is the value-gate the e2e proves.\n */\n\nconst NON_RECEIPT = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\nconst SEV_RANK: Record<Severity, number> = { critical: 0, high: 1, medium: 2, low: 3 };\n\n/** One validated receipt, flattened to the fields the rollup reduces. */\nexport interface FleetReceipt {\n  repo: string;\n  agent: string;\n  /** this change's attributed cost (diff-scoped upper bound), else the session cost */\n  costUsd: number;\n  grade: GradeLetter;\n  findings: number;\n  /** flagged-event counts by severity */\n  bySeverity: Record<Severity, number>;\n  /** files the transcript covered, and the change's file count (coverage numerator/denominator) */\n  covered?: number;\n  changed?: number;\n  endedAt?: number;\n  /** has >=1 attributed ack (a human reviewed it) — M78 */\n  reviewed?: boolean;\n}\n\nexport interface AgentRollup {\n  agent: string;\n  receipts: number;\n  reviewed: number;\n  costUsd: number;\n  findings: number;\n  bySeverity: Record<Severity, number>;\n  covered: number;\n  changed: number;\n}\n\nexport interface RepoRollup {\n  repo: string;\n  receipts: number;\n  reviewed: number;\n  costUsd: number;\n  findings: number;\n  bySeverity: Record<Severity, number>;\n  covered: number;\n  changed: number;\n  agents: string[];\n}\n\nexport interface Fleet {\n  repos: RepoRollup[];\n  agents: AgentRollup[];\n  totals: {\n    repos: number;\n    receipts: number;\n    reviewed: number;\n    costUsd: number;\n    findings: number;\n    bySeverity: Record<Severity, number>;\n    /** Σ covered / Σ changed across every diff-scoped receipt, or null when none carry coverage */\n    coverage: number | null;\n  };\n}\n\nconst zeroSev = (): Record<Severity, number> => ({ critical: 0, high: 0, medium: 0, low: 0 });\n\n/** Load + validate every receipt under one repo working dir (`.receipts/*.json` AND\n * `refs/receipts/*`), flattened. Mirrors `loadReceiptHistory`'s source-merge so `fleet`\n * sees exactly what `log`/`stats` see — no more, no less. A missing/empty repo yields\n * `[]` (it contributes zero, never throws). */\nexport function loadRepoReceipts(repoDir: string): FleetReceipt[] {\n  const label = basename(repoDir.replace(/\\/$/, \"\")) || repoDir;\n  const dir = join(repoDir, \".receipts\");\n  const repoCwd = dirname(dir);\n  const acked = listAckedSlugs(repoCwd);\n  const sources: Array<{ raw: string | null; slug: string }> = [];\n  try {\n    for (const f of readdirSync(dir)) {\n      if (!f.endsWith(\".json\") || NON_RECEIPT.test(f)) continue;\n      const slug = f.replace(/\\.json$/i, \"\");\n      try {\n        sources.push({ raw: readFileSync(join(dir, f), \"utf8\"), slug });\n      } catch {\n        sources.push({ raw: null, slug });\n      }\n    }\n  } catch {\n    // no .receipts dir — fine, ref-mode repos keep everything in refs\n  }\n  // refs are listed relative to the repo working dir (the `.receipts` dir's parent)\n  for (const { slug } of listReceiptRefs(repoCwd)) {\n    sources.push({ raw: readReceiptRef(slug, repoCwd), slug });\n  }\n\n  const out: FleetReceipt[] = [];\n  for (const { raw, slug } of sources) {\n    if (raw == null) continue;\n    let input: unknown;\n    try {\n      input = JSON.parse(raw);\n    } catch {\n      continue;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) continue;\n    const p = res.receipt.predicate;\n    const findings = p.findings ?? [];\n    const bySeverity = zeroSev();\n    for (const f of findings) {\n      bySeverity[f.severity]++;\n    }\n    const scopeFiles = p.scope?.kind === \"diff\" ? (p.scope.files?.length ?? 0) : undefined;\n    out.push({\n      repo: label,\n      agent: p.session?.agent || \"unknown\",\n      // same basis as `log`: the change's cost when scoped, else the session total\n      costUsd: p.evidence.diffCostUsd ?? p.evidence.costUsd,\n      grade: p.grade,\n      findings: findings.length,\n      bySeverity,\n      covered: p.evidence.coveredFiles,\n      changed: scopeFiles,\n      endedAt: p.session?.endedAt,\n      reviewed: acked.has(slug),\n    });\n  }\n  return out;\n}\n\nconst round2 = (n: number): number => Math.round(n * 100) / 100;\nconst topSeverity = (s: Record<Severity, number>): Severity | undefined =>\n  ([\"critical\", \"high\", \"medium\", \"low\"] as const).find((k) => s[k] > 0);\n\n/** Reduce a flat receipt list into the per-repo × per-agent fleet rollup. Pure. */\nexport function computeFleet(receipts: readonly FleetReceipt[]): Fleet {\n  const repoMap = new Map<string, RepoRollup>();\n  const agentMap = new Map<string, AgentRollup>();\n  const tSev = zeroSev();\n  let tCost = 0;\n  let tFind = 0;\n  let tCovered = 0;\n  let tChanged = 0;\n  let tReviewed = 0;\n\n  const addSev = (dst: Record<Severity, number>, src: Record<Severity, number>) => {\n    for (const k of Object.keys(src) as Severity[]) dst[k] += src[k];\n  };\n\n  for (const r of receipts) {\n    let repo = repoMap.get(r.repo);\n    if (!repo) {\n      repo = {\n        repo: r.repo,\n        receipts: 0,\n        reviewed: 0,\n        costUsd: 0,\n        findings: 0,\n        bySeverity: zeroSev(),\n        covered: 0,\n        changed: 0,\n        agents: [],\n      };\n      repoMap.set(r.repo, repo);\n    }\n    let agent = agentMap.get(r.agent);\n    if (!agent) {\n      agent = {\n        agent: r.agent,\n        receipts: 0,\n        reviewed: 0,\n        costUsd: 0,\n        findings: 0,\n        bySeverity: zeroSev(),\n        covered: 0,\n        changed: 0,\n      };\n      agentMap.set(r.agent, agent);\n    }\n    repo.receipts++;\n    if (r.reviewed) repo.reviewed++;\n    repo.costUsd += r.costUsd;\n    repo.findings += r.findings;\n    addSev(repo.bySeverity, r.bySeverity);\n    if (!repo.agents.includes(r.agent)) repo.agents.push(r.agent);\n    agent.receipts++;\n    if (r.reviewed) agent.reviewed++;\n    agent.costUsd += r.costUsd;\n    agent.findings += r.findings;\n    addSev(agent.bySeverity, r.bySeverity);\n    tCost += r.costUsd;\n    if (r.reviewed) tReviewed++;\n    tFind += r.findings;\n    addSev(tSev, r.bySeverity);\n    // coverage only sums over receipts that carry it (diff-scoped)\n    if (r.covered != null && r.changed != null) {\n      repo.covered += r.covered;\n      repo.changed += r.changed;\n      agent.covered += r.covered;\n      agent.changed += r.changed;\n      tCovered += r.covered;\n      tChanged += r.changed;\n    }\n  }\n\n  const finishRepo = (x: RepoRollup): RepoRollup => ({ ...x, costUsd: round2(x.costUsd) });\n  const finishAgent = (x: AgentRollup): AgentRollup => ({ ...x, costUsd: round2(x.costUsd) });\n  const repos = [...repoMap.values()].map(finishRepo).sort((a, b) => b.costUsd - a.costUsd);\n  const agents = [...agentMap.values()].map(finishAgent).sort((a, b) => b.costUsd - a.costUsd);\n\n  return {\n    repos,\n    agents,\n    totals: {\n      repos: repos.length,\n      receipts: receipts.length,\n      reviewed: tReviewed,\n      costUsd: round2(tCost),\n      findings: tFind,\n      bySeverity: tSev,\n      coverage: tChanged > 0 ? round2(tCovered / tChanged) : null,\n    },\n  };\n}\n\n/** Load N repo working dirs and roll them up. The org entry point. */\nexport function computeFleetFromRepos(repoDirs: readonly string[]): Fleet {\n  const all: FleetReceipt[] = [];\n  for (const d of repoDirs) all.push(...loadRepoReceipts(d));\n  return computeFleet(all);\n}\n\nconst sevChip = (s: Record<Severity, number>): string => {\n  const parts: string[] = [];\n  if (s.critical) parts.push(`${s.critical}⛔`);\n  if (s.high) parts.push(`${s.high}⚠️`);\n  if (s.medium) parts.push(`${s.medium}🔍`);\n  if (s.low) parts.push(`${s.low}·`);\n  return parts.join(\" \") || \"—\";\n};\nconst covCell = (covered: number, changed: number): string =>\n  changed > 0 ? `${Math.round((covered / changed) * 100)}%` : \"—\";\n\n/** Aligned text table — facts only, no verdict. */\nexport function renderFleet(f: Fleet): string {\n  if (f.totals.receipts === 0) {\n    return \"No receipts found across the given repos (looked in .receipts/ and refs/receipts/*).\\n\";\n  }\n  const lines: string[] = [];\n  lines.push(\n    `Fleet — ${f.totals.receipts} receipt${f.totals.receipts === 1 ? \"\" : \"s\"} across ${f.totals.repos} repo${f.totals.repos === 1 ? \"\" : \"s\"} · ${f.agents.length} agent${f.agents.length === 1 ? \"\" : \"s\"}`,\n  );\n  lines.push(\"\");\n  const cov = f.totals.coverage == null ? \"—\" : `${Math.round(f.totals.coverage * 100)}%`;\n  lines.push(\n    `Total agent spend ${formatCostAlways(f.totals.costUsd)} · coverage ${cov} · ${f.totals.findings} flagged event${f.totals.findings === 1 ? \"\" : \"s\"} (${sevChip(f.totals.bySeverity)})`,\n  );\n  lines.push(\n    `Human review: ${f.totals.reviewed}/${f.totals.receipts} receipt${f.totals.receipts === 1 ? \"\" : \"s\"} acknowledged`,\n  );\n  lines.push(\"\");\n\n  const rrows = f.repos.map((r) => ({\n    repo: r.repo,\n    n: String(r.receipts),\n    agents: r.agents.join(\", \"),\n    cost: formatCostAlways(r.costUsd),\n    cov: covCell(r.covered, r.changed),\n    flagged:\n      r.findings === 0\n        ? \"0\"\n        : `${r.findings} ${topSeverity(r.bySeverity) ? sevChip(r.bySeverity) : \"\"}`.trim(),\n  }));\n  const w = (key: keyof (typeof rrows)[number], head: string) =>\n    Math.max(head.length, ...rrows.map((r) => r[key].length));\n  const wR = w(\"repo\", \"REPO\");\n  const wN = w(\"n\", \"N\");\n  const wA = w(\"agents\", \"AGENTS\");\n  const wC = w(\"cost\", \"SPEND\");\n  const wV = w(\"cov\", \"COVER\");\n  lines.push(\n    `${\"REPO\".padEnd(wR)}  ${\"N\".padEnd(wN)}  ${\"AGENTS\".padEnd(wA)}  ${\"SPEND\".padEnd(wC)}  ${\"COVER\".padEnd(wV)}  FLAGGED`,\n  );\n  for (const r of rrows) {\n    lines.push(\n      `${r.repo.padEnd(wR)}  ${r.n.padEnd(wN)}  ${r.agents.padEnd(wA)}  ${r.cost.padEnd(wC)}  ${r.cov.padEnd(wV)}  ${r.flagged}`,\n    );\n  }\n  lines.push(\"\");\n  lines.push(\"By agent:\");\n  for (const a of f.agents) {\n    lines.push(\n      `  ${a.agent} — ${a.receipts} receipt${a.receipts === 1 ? \"\" : \"s\"} · ${formatCostAlways(a.costUsd)} · cover ${covCell(a.covered, a.changed)} · ${a.findings} flagged`,\n    );\n  }\n  lines.push(\"\");\n  lines.push(\n    \"<spend = each change's attributed cost (diff-scoped where available) · coverage = Σ transcript-covered files / Σ changed files · counts, not a verdict · 0 model calls · local-only>\",\n  );\n  return `${lines.join(\"\\n\")}\\n`;\n}\n","import { readFileSync, readdirSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport type { Severity } from \"../findings/findings.js\";\nimport { formatCostAlways } from \"../findings/format.js\";\nimport type { GradeLetter } from \"../findings/grade.js\";\nimport { verifyBundle } from \"../sign/verify.js\";\nimport { listReceiptRefs, readReceiptRef } from \"./store.js\";\n\n/**\n * `receipts log` (M52) — a chronological list of the committed receipts in `.receipts/`\n * (one line per receipt: date, grade, change-cost, finding count + top severity, scope,\n * name). The `git log` of receipts: the local, history-aware companion to `receipts diff`\n * (which compares two) and `receipts trends` (which aggregates sessions). It reads the\n * COMMITTED receipts, not live sessions, so it answers \"what receipts have we attached,\n * and what do they say?\" — a view nothing else provides.\n *\n * Deterministic · zero model calls · local-first · lists recorded facts (each receipt's\n * own grade/cost/findings), never a synthesized judgement.\n */\n\nconst SEV_ICON: Record<Severity, string> = { critical: \"⛔\", high: \"⚠️\", medium: \"🔍\", low: \"·\" };\nconst SEV_RANK: Record<Severity, number> = { critical: 0, high: 1, medium: 2, low: 3 };\n\nexport interface LogEntry {\n  name: string;\n  grade: GradeLetter;\n  costUsd: number;\n  findings: number;\n  topSeverity?: Severity;\n  scope: string;\n  endedAt?: number;\n}\n\n/** Files in `.receipts/` that are config/examples, not receipts. */\nconst NON_RECEIPT = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\n\nfunction scopeLabel(\n  scope: { kind: string; files?: string[]; branch?: string } | undefined,\n): string {\n  if (!scope || scope.kind === \"session\") return \"session\";\n  if (scope.kind === \"branch\") return `branch ${scope.branch ?? \"?\"}`;\n  return `diff ${(scope.files ?? []).length}f`;\n}\n\nfunction isoDate(ms: number | undefined): string {\n  if (!ms || !Number.isFinite(ms)) return \"—\".padEnd(10);\n  return new Date(ms).toISOString().slice(0, 10);\n}\n\n/** Load and validate the committed receipts under `dir` — plus, since SPEC-0070,\n * any `refs/receipts/*` ref-stored receipts — most-recent first. */\nexport function loadReceiptHistory(dir: string): LogEntry[] {\n  let files: string[];\n  try {\n    files = readdirSync(dir).filter((f) => f.endsWith(\".json\") && !NON_RECEIPT.test(f));\n  } catch {\n    files = [];\n  }\n  const sources: Array<{ name: string; raw: string | null }> = files.map((f) => {\n    try {\n      return { name: f, raw: readFileSync(join(dir, f), \"utf8\") };\n    } catch {\n      return { name: f, raw: null };\n    }\n  });\n  // Refs are listed relative to the receipts dir's repo (its parent), never the\n  // process cwd — a log over some other directory must not see this repo's refs.\n  const repo = dirname(dir);\n  for (const { slug } of listReceiptRefs(repo)) {\n    sources.push({ name: `${slug}@ref`, raw: readReceiptRef(slug, repo) });\n  }\n  const entries: LogEntry[] = [];\n  for (const { name: f, raw } of sources) {\n    if (raw == null) {\n      continue;\n    }\n    let input: unknown;\n    try {\n      input = JSON.parse(raw);\n    } catch {\n      continue;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) continue;\n    const p = res.receipt.predicate;\n    const fs = p.findings ?? [];\n    let topSeverity: Severity | undefined;\n    for (const x of fs) {\n      if (!topSeverity || SEV_RANK[x.severity] < SEV_RANK[topSeverity]) topSeverity = x.severity;\n    }\n    entries.push({\n      name: f.replace(/\\.json$/i, \"\"),\n      grade: p.grade,\n      costUsd: p.evidence.diffCostUsd ?? p.evidence.costUsd,\n      findings: fs.length,\n      topSeverity,\n      scope: scopeLabel(p.scope),\n      endedAt: p.session?.endedAt,\n    });\n  }\n  // most-recent first; receipts without a timestamp sort last (by name, stable)\n  entries.sort((a, b) => (b.endedAt ?? 0) - (a.endedAt ?? 0) || a.name.localeCompare(b.name));\n  return entries;\n}\n\n/** Render the history as an aligned text table (most-recent first). Facts only. */\nexport function renderLog(entries: readonly LogEntry[], total = entries.length): string {\n  if (!entries.length) return \"No committed receipts found in .receipts/.\\n\";\n  const rows = entries.map((e) => {\n    const findings =\n      e.findings === 0\n        ? \"0\"\n        : `${e.findings} ${e.topSeverity ? SEV_ICON[e.topSeverity] : \"\"}`.trim();\n    return {\n      date: isoDate(e.endedAt),\n      grade: e.grade,\n      cost: formatCostAlways(e.costUsd),\n      findings,\n      scope: e.scope,\n      name: e.name,\n    };\n  });\n  const w = (key: keyof (typeof rows)[number], head: string) =>\n    Math.max(head.length, ...rows.map((r) => r[key].length));\n  const wDate = w(\"date\", \"DATE\");\n  const wGrade = Math.max(5, ...rows.map((r) => r.grade.length));\n  const wCost = w(\"cost\", \"COST\");\n  const wFind = w(\"findings\", \"FINDINGS\");\n  const wScope = w(\"scope\", \"SCOPE\");\n  const head = `${\"DATE\".padEnd(wDate)}  ${\"GRADE\".padEnd(wGrade)}  ${\"COST\".padEnd(wCost)}  ${\"FINDINGS\".padEnd(wFind)}  ${\"SCOPE\".padEnd(wScope)}  RECEIPT`;\n  const lines = rows.map(\n    (r) =>\n      `${r.date.padEnd(wDate)}  ${r.grade.padEnd(wGrade)}  ${r.cost.padEnd(wCost)}  ${r.findings.padEnd(wFind)}  ${r.scope.padEnd(wScope)}  ${r.name}`,\n  );\n  const header = `Receipt history — .receipts/ (${total} receipt${total === 1 ? \"\" : \"s\"}${entries.length < total ? `, showing ${entries.length}` : \"\"})`;\n  return `${header}\\n\\n${head}\\n${lines.join(\"\\n\")}\\n\\n<cost = this change's cost (diff-scoped where available) · grade is each receipt's own recorded grade · evidence, not judgement>\\n`;\n}\n","/**\n * `receipts prune` (M65b / SPEC-0064 \"ephemeral\") — the committed-receipt clutter reducer.\n *\n * A receipt is a per-branch PR artifact: CI reads/signs/comments it during the PR. After the\n * branch merges (and is deleted), the committed `.receipts/<branch>.json` is dead weight that\n * accumulates on the trunk forever (the PR comment + attestation are the durable record). This\n * removes receipts whose branch no longer exists, keeping live-branch receipts and the\n * non-branch example files. Pure planning here; the CLI does the git/fs + the live-branch read.\n */\n\n/** Example/config files in `.receipts/` that are never branch receipts — always kept. */\nconst PROTECTED = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\n\n/** The committed-receipt filename slug for a branch (matches `receipts pr`'s naming). */\nexport function branchSlug(branch: string): string {\n  return branch.replace(/[/\\\\]/g, \"-\");\n}\n\nexport interface PrunePlan {\n  keep: string[];\n  remove: string[];\n}\n\n/**\n * Partition receipt files into keep/remove: keep the protected example files and any whose slug\n * belongs to a live branch; remove the rest (merged/deleted branches). Pure — `liveSlugs` is the\n * set of `branchSlug(branch)` for branches that still exist (resolved by the caller from git).\n */\nexport function planPrune(files: readonly string[], liveSlugs: ReadonlySet<string>): PrunePlan {\n  const keep: string[] = [];\n  const remove: string[] = [];\n  for (const f of files) {\n    const base = f.split(\"/\").pop() ?? f;\n    const slug = base.replace(/\\.json$/i, \"\");\n    if (PROTECTED.test(base) || liveSlugs.has(slug)) {\n      keep.push(f);\n    } else {\n      remove.push(f);\n    }\n  }\n  return { keep, remove };\n}\n","import { readFileSync, readdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { GradeLetter } from \"../findings/grade.js\";\nimport { verifyBundle } from \"../sign/verify.js\";\nimport { checkForId } from \"./checks.js\";\n\n/**\n * `receipts stats` (M53) — a dogfooding scoreboard over the committed receipts in\n * `.receipts/`. Answers the two questions a pilot owner asks: **how often did Receipts\n * run, and what did it catch?** It aggregates the receipts the tool already wrote — how\n * many, the grade distribution, the flagged rate, and findings rolled up **by check\n * category** (which agent-failure modes actually show up here, ranked). Pure read + count\n * over local JSON; deterministic, zero model calls. It reports counts, never a verdict.\n *\n * This is the local measurement surface; an org-wide rollup (across repos) is a thin\n * scheduled job on top of the same per-repo numbers.\n */\n\nconst NON_RECEIPT = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\n\nexport interface ReceiptStats {\n  /** how many valid committed receipts (≈ how many PRs Receipts ran on) */\n  receipts: number;\n  /** files in the dir that weren't valid receipts (skipped) */\n  skipped: number;\n  /** receipts with ≥1 finding */\n  flagged: number;\n  /** A/B/C/F counts */\n  grades: Record<GradeLetter, number>;\n  /** finding count rolled up by check category, ranked desc; label is human-readable */\n  byCategory: { key: string; icon: string; label: string; findings: number; receipts: number }[];\n  /** total findings across all receipts */\n  totalFindings: number;\n}\n\n/** Aggregate the committed receipts under `dir` into a dogfooding scoreboard. */\nexport function computeStats(dir: string): ReceiptStats {\n  let files: string[];\n  try {\n    files = readdirSync(dir).filter((f) => f.endsWith(\".json\") && !NON_RECEIPT.test(f));\n  } catch {\n    files = [];\n  }\n  const grades: Record<GradeLetter, number> = { A: 0, B: 0, C: 0, F: 0 };\n  const cat = new Map<\n    string,\n    { icon: string; label: string; findings: number; receipts: number }\n  >();\n  let receipts = 0;\n  let skipped = 0;\n  let flagged = 0;\n  let totalFindings = 0;\n\n  for (const f of files) {\n    let input: unknown;\n    try {\n      input = JSON.parse(readFileSync(join(dir, f), \"utf8\"));\n    } catch {\n      skipped++;\n      continue;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) {\n      skipped++;\n      continue;\n    }\n    receipts++;\n    const p = res.receipt.predicate;\n    grades[p.grade] = (grades[p.grade] ?? 0) + 1;\n    const findings = p.findings ?? [];\n    if (findings.length) flagged++;\n    totalFindings += findings.length;\n    // which categories this receipt touched (count receipts once per category)\n    const seen = new Set<string>();\n    for (const finding of findings) {\n      const c = checkForId(finding.id);\n      if (!c) continue;\n      const row = cat.get(c.key) ?? { icon: c.icon, label: c.label, findings: 0, receipts: 0 };\n      row.findings++;\n      if (!seen.has(c.key)) {\n        row.receipts++;\n        seen.add(c.key);\n      }\n      cat.set(c.key, row);\n    }\n  }\n\n  const byCategory = [...cat.entries()]\n    .map(([key, v]) => ({ key, ...v }))\n    .sort((a, b) => b.findings - a.findings || a.label.localeCompare(b.label));\n\n  return { receipts, skipped, flagged, grades, byCategory, totalFindings };\n}\n\n/** Render the scoreboard as plain text. Facts only. */\nexport function renderStats(s: ReceiptStats): string {\n  if (s.receipts === 0) return \"No committed receipts found in .receipts/.\\n\";\n  const out: string[] = [];\n  out.push(\n    `Receipts scoreboard — ${s.receipts} receipt${s.receipts === 1 ? \"\" : \"s\"} in .receipts/`,\n  );\n  out.push(\"\");\n  const pct = (n: number) => `${Math.round((100 * n) / s.receipts)}%`;\n  out.push(\n    `Grades: 🟢 A ${s.grades.A} · 🟡 B ${s.grades.B} · 🟠 C ${s.grades.C} · 🔴 F ${s.grades.F}`,\n  );\n  out.push(`Flagged: ${s.flagged}/${s.receipts} receipts (${pct(s.flagged)}) carried ≥1 finding`);\n  out.push(\"\");\n  if (s.byCategory.length === 0) {\n    out.push(\"Problems caught: none — every committed receipt was clean.\");\n  } else {\n    out.push(\n      `Problems caught (${s.totalFindings} findings across ${s.byCategory.length} categories):`,\n    );\n    for (const c of s.byCategory) {\n      out.push(\n        `  ${c.icon} ${c.label.padEnd(26)} ${c.findings} finding${c.findings === 1 ? \"\" : \"s\"} in ${c.receipts} receipt${c.receipts === 1 ? \"\" : \"s\"}`,\n      );\n    }\n  }\n  if (s.skipped) {\n    out.push(\"\", `<${s.skipped} non-receipt/invalid file${s.skipped === 1 ? \"\" : \"s\"} skipped>`);\n  }\n  out.push(\"\", \"Deterministic · 0 model calls · counts of recorded receipts, not a verdict.\");\n  return `${out.join(\"\\n\")}\\n`;\n}\n","import type { AssertResult } from \"../receipt/assert.js\";\nimport type { ReceiptPredicate } from \"../receipt/build.js\";\nimport { CHECK_CATALOG } from \"./checks.js\";\n\n/**\n * Work-verdict policy layer (SPEC-0121) — turn the BUNDLE of already-attested facts into one\n * answer to \"is this work done and right?\": VERIFIED / INCOMPLETE / WRONG / ESCALATE (+ the\n * default-off UNJUDGED sentinel).\n *\n * This is the union of two SHIPPED out-of-receipt gates — `block-on` (a finding-id fact-gate,\n * verified-by.mjs `decideConclusion`) and `.receipts/asserts.json` (`assertExitCode`). It is a\n * PURE, total function of `(predicate, policy)`: zero model calls, no transcript re-parse, no\n * network. It does NOT mutate the receipt, emit a finding, or appear in any exporter (R2 — the\n * verdict is a *policy decision over cited facts*, computed OUTSIDE the determinism wall, never a\n * fact written into the signed evidence). Each verdict carries `reasons[]` that cite real\n * `finding.id`/`filePath` or `evidence.testMetrics`, never a free-text quality opinion.\n *\n * Weighting (R5): WRONG > INCOMPLETE > ESCALATE > VERIFIED. A cited blockable/tamper fact\n * dominates; absent that, an incompleteness signal; absent that, a judgement-required signal;\n * only a fully-cleared board verifies. Ambiguity resolves UPWARD in safety (never a false\n * WRONG/INCOMPLETE) — the under-claim discipline (R3).\n */\n\nexport type Verdict = \"VERIFIED\" | \"INCOMPLETE\" | \"WRONG\" | \"ESCALATE\" | \"UNJUDGED\";\n\nexport interface VerdictReason {\n  axis: \"completion\" | \"correctness\" | \"claim-truth\" | \"integrity\";\n  /** a cited fact: a finding id (+ filePath) or an evidence field — never a quality opinion */\n  fact: string;\n  contributes: Verdict;\n}\n\nexport interface WorkPolicy {\n  /** finding-id prefixes whose main-band presence means WRONG (a cited tamper/blockable fact) */\n  blockable?: string[];\n  /** evaluated asserts (from evaluateAsserts) — a failed ERROR-severity assert ⇒ INCOMPLETE */\n  asserts?: AssertResult[];\n  /** finding-id prefixes whose presence means ESCALATE (judgement required, board else clean) */\n  escalateOn?: string[];\n  /** opt-in: a parsed `testMetrics.exitStatus:\"failed\"` ⇒ WRONG (R7 — off by default) */\n  gateTestOutcome?: boolean;\n}\n\nexport interface WorkVerdict {\n  verdict: Verdict;\n  reasons: VerdictReason[];\n}\n\n/** The verdict layer's OWN default blockable set — INTENTIONALLY broader than\n * verified-by.mjs's BLOCKABLE_PREFIXES (which omits fake-green/green-by-suppression and\n * process.exit(1)s on unknown prefixes). A cited green-faking/tamper fact is the canonical\n * WRONG. Callers can override via `policy.blockable`. */\nexport const DEFAULT_BLOCKABLE: readonly string[] = [\n  \"fake-green\",\n  \"green-by-suppression\",\n  \"eval-override\",\n  \"grader-edit\",\n  \"test-trivialised\",\n  \"test-skipped\",\n  \"test-focus\",\n  \"config-weaken\",\n  \"spec-tamper\",\n  \"hook-bypass\",\n  \"impl-stubbed\",\n  \"masked-failure\",\n  \"external-state-mismatch\",\n];\n\n/** Default judgement-required signals (board deterministically clean, but a human should look). */\nexport const DEFAULT_ESCALATE: readonly string[] = [\n  \"untested-test\",\n  \"blind-edit\",\n  \"weak-oracle\",\n  \"self-tested\",\n  // A large deletion is a content-loss RISK, not a tamper fact — and `workVerdict` matches by\n  // id-prefix only, so it cannot isolate the test-path shrink that `surface.ts` privileges from a\n  // benign dead-code/file removal. Blocking ALL file-shrink would auto-WRONG legitimate deletions\n  // (a false WRONG — the costliest error). ESCALATE is the right tier: a human confirms it\n  // (codex review reversed a prior, over-eager move of this into the blockable set).\n  \"file-shrink\",\n];\n\n/** Main-band completion facts (the agent's own promise/coverage gaps). out-of-scope is LOW\n * confidence (never main-band) so it is excluded automatically. */\nconst COMPLETION_PREFIXES: readonly string[] = [\"unfulfilled-promise\", \"completion-uncovered\"];\n\n/** Every finding-id prefix a `verdict` policy may legitimately reference: the union of all check\n * categories' prefixes plus the verdict layer's own default + completion sets. A user-supplied\n * `blockable`/`escalateOn` entry outside this set is a typo (`flake-green`) or an over-broad\n * string (`test`) that would silently gate nothing — or silently match unintended families — so\n * the caller rejects it and the policy fails closed (codex review). */\nexport const KNOWN_VERDICT_PREFIXES: ReadonlySet<string> = new Set<string>([\n  ...CHECK_CATALOG.flatMap((c) => c.prefixes),\n  ...DEFAULT_BLOCKABLE,\n  ...DEFAULT_ESCALATE,\n  ...COMPLETION_PREFIXES,\n]);\n\n/** Return the policy entries that are NOT canonical prefixes (typos / over-broad strings). Empty\n * ⇒ the policy is well-formed. Pure. */\nexport function unknownVerdictPrefixes(cfg: {\n  blockable?: string[];\n  escalateOn?: string[];\n}): string[] {\n  return [...(cfg.blockable ?? []), ...(cfg.escalateOn ?? [])].filter(\n    (p) => !KNOWN_VERDICT_PREFIXES.has(p),\n  );\n}\n\nconst matchesPrefix = (id: string, prefixes: readonly string[]): boolean =>\n  prefixes.some((p) => id === p || id.startsWith(`${p}-`));\n\nconst cite = (f: { id: string; filePath?: string; evidenceRef?: string }): string =>\n  `${f.id}${f.filePath ? ` (${f.filePath})` : f.evidenceRef ? ` (${f.evidenceRef})` : \"\"}`;\n\n/**\n * Compute the work-verdict from a receipt predicate + an opt-in policy. No policy ⇒ UNJUDGED\n * (default-off; never gates). Pure + total.\n */\nexport function workVerdict(p: ReceiptPredicate, policy?: WorkPolicy): WorkVerdict {\n  if (!policy) {\n    return { verdict: \"UNJUDGED\", reasons: [] };\n  }\n  // main-band only: a finding must have cleared its own confidence floor (≥ 0.5) to gate.\n  const main = p.findings.filter((f) => f.confidence >= 0.5);\n  const blockable = policy.blockable ?? DEFAULT_BLOCKABLE;\n  const escalateOn = policy.escalateOn ?? DEFAULT_ESCALATE;\n\n  // 1. WRONG — a cited blockable/tamper fact, or (opt-in) a parsed red test run.\n  const wrong: VerdictReason[] = [];\n  for (const f of main) {\n    if (matchesPrefix(f.id, blockable)) {\n      wrong.push({ axis: \"integrity\", fact: cite(f), contributes: \"WRONG\" });\n    }\n  }\n  if (policy.gateTestOutcome && p.evidence.testMetrics?.exitStatus === \"failed\") {\n    wrong.push({\n      axis: \"correctness\",\n      fact: `evidence.testMetrics.exitStatus:\"failed\"`,\n      contributes: \"WRONG\",\n    });\n  }\n  if (wrong.length > 0) {\n    return { verdict: \"WRONG\", reasons: wrong };\n  }\n\n  // 2. INCOMPLETE — a failed ERROR-severity assert, or a main-band completion gap.\n  const incomplete: VerdictReason[] = [];\n  for (const a of policy.asserts ?? []) {\n    if ((!a.pass || a.error) && (a.assertion.severity ?? \"error\") === \"error\") {\n      incomplete.push({\n        axis: \"completion\",\n        fact: `assert ${a.assertion.path} ${a.assertion.op}${a.error ? \" (config error)\" : \"\"}`,\n        contributes: \"INCOMPLETE\",\n      });\n    }\n  }\n  for (const f of main) {\n    if (matchesPrefix(f.id, COMPLETION_PREFIXES)) {\n      incomplete.push({ axis: \"completion\", fact: cite(f), contributes: \"INCOMPLETE\" });\n    }\n  }\n  if (incomplete.length > 0) {\n    return { verdict: \"INCOMPLETE\", reasons: incomplete };\n  }\n\n  // 3. ESCALATE — a judgement-required signal on an otherwise-clean board.\n  const escalate: VerdictReason[] = [];\n  for (const f of main) {\n    if (matchesPrefix(f.id, escalateOn)) {\n      escalate.push({ axis: \"correctness\", fact: cite(f), contributes: \"ESCALATE\" });\n    }\n  }\n  if (escalate.length > 0) {\n    return { verdict: \"ESCALATE\", reasons: escalate };\n  }\n\n  // 4. VERIFIED — a policy was supplied and every arm is empty (nothing wrong is cited).\n  return { verdict: \"VERIFIED\", reasons: [] };\n}\n\n/** Exit code: WRONG/INCOMPLETE gate (non-zero); ESCALATE/VERIFIED/UNJUDGED are advisory (0).\n * Mirrors assertExitCode — the verdict gates the same way the asserts it composes do. */\nexport function verdictExitCode(v: Verdict): number {\n  return v === \"WRONG\" || v === \"INCOMPLETE\" ? 1 : 0;\n}\n","import { execFileSync } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { ingestSarif } from \"./sarifIngest.js\";\nimport type { Scanner, ScannerContext, ScannerEvidence } from \"./scanners.js\";\n\n/**\n * SAST adapter (#23) — semgrep over the diff-scoped changed files. OPT-IN + fingerprint-or-omit:\n * runs only when `RECEIPTS_SEMGREP_RULES` points at a pinned local rules dir (the rulesetHash\n * source) AND the `semgrep` binary is on PATH; otherwise returns null (skip silently, R5). The\n * network is never touched (registry rulesets drift — pin local rules; `--disable-version-check`).\n * Facts-only: the result is the tool's own `{ruleId,file,line,level}`, never a security verdict.\n */\n\nfunction sh(cmd: string, args: string[], cwd?: string): string {\n  return execFileSync(cmd, args, {\n    encoding: \"utf8\",\n    stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    ...(cwd ? { cwd } : {}),\n  });\n}\n\n/** sha256 over the pinned rules dir's file contents (sorted) — the rulesetHash half of the\n * toolFingerprint, so a ruleset bump is honestly a NEW fact, not non-determinism. */\nfunction hashRulesDir(dir: string): string | null {\n  try {\n    const h = createHash(\"sha256\");\n    const walk = (d: string): void => {\n      for (const name of readdirSync(d).sort()) {\n        const p = join(d, name);\n        const st = statSync(p);\n        if (st.isDirectory()) {\n          walk(p);\n        } else {\n          h.update(name);\n          h.update(readFileSync(p));\n        }\n      }\n    };\n    walk(dir);\n    return h.digest(\"hex\").slice(0, 16);\n  } catch {\n    return null;\n  }\n}\n\nexport const semgrepScanner: Scanner = {\n  name: \"semgrep\",\n  category: \"sast\",\n  run(ctx: ScannerContext): ScannerEvidence | null {\n    const rulesDir = process.env.RECEIPTS_SEMGREP_RULES;\n    if (!rulesDir || ctx.scopeFiles.length === 0) {\n      return null; // no pinned ruleset / nothing to scan → skip\n    }\n    const rulesetHash = hashRulesDir(rulesDir);\n    if (!rulesetHash) {\n      return null; // can't fingerprint the ruleset → skip (R5)\n    }\n    let version: string;\n    try {\n      version = sh(\"semgrep\", [\"--version\"]).trim().split(\"\\n\")[0];\n    } catch {\n      return null; // semgrep not on PATH → skip (NG4)\n    }\n    if (!version) {\n      return null;\n    }\n    let sarif: string;\n    try {\n      const args = [\n        \"--sarif\",\n        \"--quiet\",\n        \"--disable-version-check\",\n        \"--config\",\n        rulesDir,\n        ...(ctx.base ? [\"--baseline-commit\", ctx.base] : []),\n        \"--\", // end-of-options: a path beginning with `-` is a path, not a flag (codex review)\n        ...ctx.scopeFiles,\n      ];\n      // Run from the repo root so repo-relative `scopeFiles` and `--baseline-commit` resolve\n      // against the right tree, not the caller's cwd (codex review).\n      sarif = sh(\"semgrep\", args, ctx.repoRoot);\n    } catch (e) {\n      // semgrep exits non-zero when it finds results; its stdout still holds the SARIF.\n      const out = (e as { stdout?: Buffer | string }).stdout;\n      sarif = typeof out === \"string\" ? out : out ? out.toString(\"utf8\") : \"\";\n      if (!sarif) {\n        return null;\n      }\n    }\n    const { results, findingCount } = ingestSarif(sarif, ctx.scopeFiles);\n    return {\n      tool: \"semgrep\",\n      version,\n      category: \"sast\",\n      rulesetHash,\n      scope: \"diff\",\n      findingCount,\n      ...(results.length ? { results } : {}),\n    };\n  },\n};\n","import type { ScannerLevel, ScannerResult } from \"./scanners.js\";\n\n/**\n * SARIF 2.1.0 INGEST (SPEC-0124) — the consumer direction of `src/report/sarif.ts` (the producer).\n * Parse a scanner's SARIF output into normalized, DIFF-SCOPED `ScannerResult[]` + a count-by-level.\n * Pure: no I/O, no model. Diff-scoping is the FP wall Receipts owns — a result is kept ONLY when\n * its file matches one of `scope.files` (a result with no resolvable location is dropped, since it\n * can't be attributed to the changed hunks). Results are capped; counts reflect the kept set.\n */\n\nconst CAP = 50;\n\n/** STRICT path match: exact, or full-path-segment suffix where the SHORTER side is itself a\n * multi-segment path. NO basename fallback and NO single-segment suffix — a bare-basename uri\n * (`db.py`) must NOT match a changed `src/app/db.py`, nor `tests/db.py` a changed `src/db.py`\n * (multi-aspect FP review: a same-basename file in another dir is out of scope).\n * Returns the MATCHED scope file (repo-relative) so the caller records the normalized path, never\n * the scanner's raw uri — an absolute / `file://` / `..` uri must not leak a machine path into the\n * receipt nor break repo-relative anchoring (codex review). */\nfunction matchScope(file: string, scopeFiles: readonly string[]): string | null {\n  if (scopeFiles.length === 0) {\n    return null;\n  }\n  for (const sf of scopeFiles) {\n    if (\n      sf === file ||\n      (file.includes(\"/\") && sf.endsWith(`/${file}`)) ||\n      (sf.includes(\"/\") && file.endsWith(`/${sf}`))\n    ) {\n      return sf;\n    }\n  }\n  return null;\n}\n\nfunction levelOf(raw: unknown): ScannerLevel {\n  const l = String(raw ?? \"\").toLowerCase();\n  return l === \"error\" || l === \"warning\" || l === \"note\" ? l : \"warning\"; // SARIF default is warning\n}\n\ninterface SarifResultIn {\n  ruleId?: unknown;\n  level?: unknown;\n  message?: { text?: unknown };\n  locations?: {\n    physicalLocation?: {\n      artifactLocation?: { uri?: unknown };\n      region?: { startLine?: unknown };\n    };\n  }[];\n}\n\n/**\n * Ingest a SARIF JSON string, filtered to `scopeFiles`. Returns the kept results (capped) + the\n * count by level over the kept set. Malformed / non-SARIF input → empty (never throws).\n */\nexport function ingestSarif(\n  sarifText: string,\n  scopeFiles: readonly string[],\n  cap = CAP,\n): { results: ScannerResult[]; findingCount: Record<string, number> } {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(sarifText);\n  } catch {\n    return { results: [], findingCount: {} };\n  }\n  const runs =\n    parsed && typeof parsed === \"object\" && Array.isArray((parsed as { runs?: unknown }).runs)\n      ? ((parsed as { runs: { results?: unknown }[] }).runs ?? [])\n      : [];\n\n  const all: ScannerResult[] = [];\n  const findingCount: Record<string, number> = {};\n  for (const run of runs) {\n    const results = Array.isArray(run?.results) ? (run.results as SarifResultIn[]) : [];\n    for (const r of results) {\n      const loc = r.locations?.[0]?.physicalLocation;\n      const uri = typeof loc?.artifactLocation?.uri === \"string\" ? loc.artifactLocation.uri : \"\";\n      const file = uri ? matchScope(uri, scopeFiles) : null;\n      if (!file) {\n        continue; // no location, or outside the diff scope → not our fact (R3)\n      }\n      const level = levelOf(r.level);\n      const line = typeof loc?.region?.startLine === \"number\" ? loc.region.startLine : undefined;\n      const result: ScannerResult = {\n        ruleId: typeof r.ruleId === \"string\" && r.ruleId ? r.ruleId : \"unknown\",\n        file, // normalized to the matched scope path — never the raw scanner uri\n        level,\n        ...(line && line >= 1 ? { line } : {}),\n        ...(typeof r.message?.text === \"string\" ? { message: r.message.text.slice(0, 300) } : {}),\n      };\n      // count every in-scope hit, even past the result cap, so the count stays faithful.\n      findingCount[level] = (findingCount[level] ?? 0) + 1;\n      all.push(result);\n    }\n  }\n  // Deterministic order BEFORE the cap: a scanner's emission order is not guaranteed stable, so\n  // sort on a total key and only then slice — otherwise the kept-50 set (and the receipt bytes)\n  // could vary run-to-run with tool ordering (codex review: L1 determinism).\n  all.sort(\n    (a, b) =>\n      (a.file ?? \"\").localeCompare(b.file ?? \"\") ||\n      (a.line ?? 0) - (b.line ?? 0) ||\n      a.ruleId.localeCompare(b.ruleId) ||\n      a.level.localeCompare(b.level) ||\n      (a.message ?? \"\").localeCompare(b.message ?? \"\"),\n  );\n  return { results: all.slice(0, cap), findingCount };\n}\n","import { semgrepScanner } from \"./semgrep.js\";\n\n/**\n * Scanners surface (SPEC-0124) — the SIXTH extension point, parallel to adapters / detectors /\n * test-parsers / guard-rules / exporters. A scanner runs a pinned EXTERNAL tool (semgrep,\n * gitleaks, osv, …) over the diff-scoped changed files, ingests its SARIF, and records a\n * count-only fact block at a new TOP-LEVEL `predicate.scanners[]`.\n *\n * It is a RECORDED INPUT (like guardEvents/subagents): a CI verifier re-running the engine on the\n * transcript alone cannot reproduce a semgrep run, so `scanners[]` is exempt from the L1\n * byte-compare (rederive.ts strips it) and lives OUTSIDE `evidence`/`findings`. \"Deterministic\"\n * here means same changed-files + same `toolFingerprint` → same output (R5 fingerprint-or-omit),\n * not \"offline re-derivable\". Facts-only — never a security verdict (R2). The whole surface is\n * gated behind `RECEIPTS_EXPERIMENTAL_DETECTORS=1` and is advisory until live-fleet FP-validated.\n *\n * NG6: gitleaks/osv/config-drift/mutation adapters are additional members of THIS registry — the\n * seam ships now; each adapter lands when its preconditions (pinned ruleset / offline DB) exist.\n */\n\nexport type ScannerCategory = \"sast\" | \"secret-scan\" | \"sca\" | \"config-drift\" | \"mutation\";\nexport type ScannerLevel = \"error\" | \"warning\" | \"note\";\n\n/** One scanner result — a file:line-cited fact, never a verdict. Mirrors the SARIF result keys\n * the producer (sarif.ts) re-emits, so ingest → re-export is identity on these fields. */\nexport interface ScannerResult {\n  ruleId: string;\n  file?: string;\n  line?: number;\n  level: ScannerLevel;\n  message?: string;\n}\n\n/** A scanner's recorded fact block (one per tool run). */\nexport interface ScannerEvidence {\n  tool: string;\n  version: string;\n  category: ScannerCategory;\n  /** sha256 of the pinned ruleset dir (SAST/config) — half the toolFingerprint */\n  rulesetHash?: string;\n  /** DB snapshot identity (SCA / secret-DB) — the other fingerprint shape */\n  dbAsOf?: string;\n  dbHash?: string;\n  scope: \"diff\";\n  /** count by SARIF level (error/warning/note) — facts, no rollup verdict */\n  findingCount: Record<string, number>;\n  /** capped, file:line-cited results */\n  results?: ScannerResult[];\n  /** #15 mutation-score ingest only */\n  mutation?: { killed: number; survived: number; total: number };\n}\n\n/** What a scanner needs to run: the diff-scoped changed files + the base ref for net-new. */\nexport interface ScannerContext {\n  scopeFiles: readonly string[];\n  base?: string;\n  /** repo root the tool runs in (cwd) */\n  repoRoot?: string;\n}\n\n/** A scanner: runs the external tool over the scope and returns its evidence, or null to skip\n * (tool absent / fingerprint unresolvable — R5 fingerprint-or-omit). MUST NOT throw. */\nexport interface Scanner {\n  name: string;\n  category: ScannerCategory;\n  run(ctx: ScannerContext): ScannerEvidence | null;\n}\n\n/** The registry — append a `{name, category, run}` adapter to add a scanner (parallels DETECTORS). */\nexport const SCANNERS: readonly Scanner[] = [semgrepScanner];\n\n/**\n * Run every registered scanner over the diff scope. Gated by `RECEIPTS_EXPERIMENTAL_DETECTORS=1`\n * (advisory until FP-validated) AND `scope.kind === \"diff\"` (R3, diff-only — never the backlog).\n * Crash-safe: a scanner that throws or can't fingerprint is skipped, never breaks the receipt.\n */\nexport function runScanners(ctx: ScannerContext): ScannerEvidence[] {\n  if (process.env.RECEIPTS_EXPERIMENTAL_DETECTORS !== \"1\") {\n    return [];\n  }\n  const out: ScannerEvidence[] = [];\n  for (const s of SCANNERS) {\n    try {\n      const ev = s.run(ctx);\n      if (ev) {\n        out.push(ev);\n      }\n    } catch {\n      // a scanner is a bonus, never a hard dependency — a failure must not break the receipt.\n    }\n  }\n  return out;\n}\n","import type { FindingSet } from \"../findings/findings.js\";\nimport type { Receipt } from \"../receipt/build.js\";\nimport { redact } from \"./redact.js\";\n\n/**\n * Verifiable handoff brief (SPEC-0025 / M23). A pure projection of a session's Receipt +\n * findings into typed sections (DONE / OPEN / RISK / NEXT / PREVENT / VERIFY) the next\n * agent or human can read AND check (re-derive the subject hash). Deterministic, zero\n * model calls, no new schema. Evidence, not judgement: NEXT/PREVENT are the VERBATIM\n * fixPrompt/guardrailRule strings the findings engine already produced — no invented\n * advice, no readiness verdict.\n */\n\nconst OPEN_IDS = new Set([\"unverified-change\", \"claimed-commit-none\", \"fake-green\"]);\n\nexport interface Handoff {\n  subject: string;\n  grade: string;\n  done: { filesChanged: number; edits: number; commands: number; reads: number; testsRan: boolean };\n  open: string[];\n  risk: { severity: string; title: string }[];\n  next: string[];\n  prevent: string[];\n  verify: string;\n}\n\nexport function buildHandoff(receipt: Receipt, findings: FindingSet): Handoff {\n  const all = [...findings.main, ...findings.minor];\n  const ev = receipt.predicate.evidence;\n  return {\n    subject: receipt.subject[0]?.digest.sha256 ?? \"\",\n    grade: receipt.predicate.grade,\n    done: {\n      filesChanged: ev.filesChanged,\n      edits: ev.edits,\n      commands: ev.commands,\n      reads: ev.reads,\n      testsRan: ev.testsRan,\n    },\n    open: all.filter((f) => OPEN_IDS.has(f.id)).map((f) => redact(f.title)),\n    risk: all\n      .filter((f) => f.severity === \"high\" || f.severity === \"critical\")\n      .map((f) => ({ severity: f.severity, title: redact(f.title) })),\n    next: all\n      .map((f) => f.fixPrompt)\n      .filter((p): p is string => !!p)\n      .map(redact),\n    prevent: all\n      .map((f) => f.guardrailRule)\n      .filter((g): g is string => !!g)\n      .map(redact),\n    verify: `receipts rederive <transcript>   # reproduces subject ${(receipt.subject[0]?.digest.sha256 ?? \"\").slice(0, 12)}…`,\n  };\n}\n\nexport function renderHandoffMarkdown(h: Handoff): string {\n  const lines: string[] = [];\n  lines.push(`# Handoff — Grade ${h.grade}`, \"\");\n  lines.push(\n    \"## ✅ Done\",\n    `${h.done.filesChanged} files changed · ${h.done.edits} edits · ${h.done.commands} commands · ${h.done.reads} reads · tests ran: ${h.done.testsRan ? \"yes\" : \"no\"}`,\n    \"\",\n  );\n  if (h.open.length) {\n    lines.push(\"## 🚧 Open\", ...h.open.map((o) => `- ${o}`), \"\");\n  }\n  if (h.risk.length) {\n    lines.push(\n      \"## 🛡️ Risk\",\n      ...h.risk.map((r) => `- **${r.severity.toUpperCase()}** ${r.title}`),\n      \"\",\n    );\n  }\n  if (h.next.length) {\n    lines.push(\"## ⏭️ Next\", ...h.next.map((n) => `- ${n}`), \"\");\n  }\n  if (h.prevent.length) {\n    lines.push(\"## 🧷 Prevent\", ...h.prevent.map((p) => `- ${p}`), \"\");\n  }\n  lines.push(\"## 🔎 Verify\", `\\`${h.verify}\\``, \"\");\n  return `${lines.join(\"\\n\").trimEnd()}\\n`;\n}\n","/**\n * SPEC-0098 (M106) — witness cross-check.\n *\n * The signed Receipt proves \"this receipt describes a transcript with this exact\n * sha256\" — receipt ↔ transcript integrity. It cannot prove that transcript\n * reflects what actually happened: a doctored transcript still hashes, signs, and\n * verifies green (the recorder is inside the agent's trust domain).\n *\n * This module closes the gap for the MODEL side. `altimate-router` proxies every\n * model call, so it can independently record the conversation it saw — hashes\n * only, never content (the router's local-first promise). We re-derive the same\n * per-block hashes from the transcript and check that every block the router\n * witnessed is present, byte-identical, in the transcript.\n *\n * Unit = the atomic content BLOCK, not the message turn. Validated on real paired\n * data (router capture vs transcript, session 8c35bdf5): per-message matched only\n * 34% of assistant turns (Claude Code splits one wire message into several\n * transcript entries), but per assistant block — each `text`, each `tool_use` —\n * matched 100% of tool_use byte-for-byte. Because wire user turns also carry\n * Claude-Code-injected context the transcript never stores, block ORDER does not\n * align across the two records, so the check is **multiset containment**\n * (witness ⊆ transcript), not an ordered chain.\n *\n * Surface = ASSISTANT blocks only — the model's own output (text + the tool_use it\n * emitted), which both records carry verbatim. User turns are excluded (wire-side\n * injection makes them diverge; R3 forbids the false alarm). Direction = containment\n * only: catches deletion and modification of any witnessed block. Fabrication\n * detection (transcript ⊆ witness) needs reliable coverage-window boundaries and is\n * deferred (M106 follow-up).\n *\n * Honest boundary (R2): witnesses the model's decisions, not execution (the bash\n * that ran, the file written, the tool_result fed back — client-side, off the\n * proxy). `witnessed` = \"every model decision the router saw is intact in the\n * transcript\", never \"the work is correct\". Determinism (R1): pure, zero model calls.\n */\n\nimport { createHash, createHmac } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { canonicalize } from \"../receipt/canonical.js\";\nimport type { Session, SessionMessage } from \"../trace/types.js\";\n\n/** An atomic, wire-equivalent unit of the model's output. */\nexport type WitnessBlock =\n  | { kind: \"text\"; text: string }\n  | { kind: \"call\"; name: string; input: unknown };\n\n/**\n * The router's witness log: the ordered digests of the assistant blocks it saw.\n * The router DSSE-signs `canonicalize(log)` with its own key (reuse\n * `src/sign/envelope.ts`); order is retained for the signature/audit but the\n * cross-check below is order-independent (multiset containment).\n */\nexport interface WitnessLog {\n  blocks: string[];\n}\n\nexport type WitnessTier = \"witnessed\" | \"witness-divergence\";\n\nexport interface WitnessResult {\n  tier: WitnessTier;\n  /** blocks in the witness log */\n  witnessed: number;\n  /** witnessed blocks found byte-identical in the transcript */\n  present: number;\n  /** witnessed blocks absent from the transcript (deleted or modified) */\n  missing: number;\n  /** index in the log of the first missing block, if any */\n  firstMissingIndex?: number;\n}\n\nconst sha256 = (s: string): string => createHash(\"sha256\").update(s, \"utf8\").digest(\"hex\");\n\n/**\n * Decompose a session into the ordered assistant content blocks — the witnessed\n * surface. For each assistant message: its `text` (when non-empty) as one block,\n * then one block per tool call (`name` + `input`).\n *\n * Excluded on purpose (the gate hinges on this — incidental fields make the two\n * records disagree byte-for-byte):\n *  - non-assistant messages — user turns carry Claude-Code-injected context the\n *    wire has but the transcript doesn't; system/tool messages aren't model output.\n *  - `thinking` — returned summarized/omitted, replay-variable across models.\n *  - tool `output`/`status`/`durationMs`/`cwd` — execution side, client-local.\n *  - tool_use `id` (model-generated, random; no tamper signal over name+input),\n *    `caller`, usage, cost, timestamp, model, finishReason.\n * Canonicalization is key-sorted (`src/receipt/canonical.ts`), so the router and\n * receipts agree on the exact bytes regardless of construction order.\n */\nexport function modelDecisionBlocks(session: Session): WitnessBlock[] {\n  const blocks: WitnessBlock[] = [];\n  for (const m of session.messages) {\n    blocks.push(...messageBlocks(m));\n  }\n  return blocks;\n}\n\n/** The assistant blocks of one message (empty for non-assistant or empty turns). */\nexport function messageBlocks(m: SessionMessage): WitnessBlock[] {\n  if (m.role !== \"assistant\") {\n    return [];\n  }\n  const out: WitnessBlock[] = [];\n  const text = (m.text ?? \"\").trim();\n  if (text !== \"\") {\n    out.push({ kind: \"text\", text });\n  }\n  for (const c of m.toolCalls ?? []) {\n    out.push({ kind: \"call\", name: c.name, input: c.input ?? null });\n  }\n  return out;\n}\n\n/** sha256 of the canonical block — the unit both the router and we compute. */\nexport function blockDigest(block: WitnessBlock): string {\n  return sha256(canonicalize(block));\n}\n\n/**\n * Build the witness log for a block sequence — exactly what `altimate-router`\n * emits (then DSSE-signs). Exposed so the cross-check, tests, and the conformance\n * fixture derive it identically.\n */\nexport function witnessLog(blocks: WitnessBlock[]): WitnessLog {\n  return { blocks: blocks.map(blockDigest) };\n}\n\n/**\n * Cross-check a session's transcript against the router's witness log.\n *\n * Multiset containment: every block digest in the log must be present (with\n * multiplicity) among the transcript's assistant block digests. A witnessed block\n * with no match is a deleted-or-modified model decision → `witness-divergence`,\n * reported at the first offending log index. Order is not required (the two\n * records segment turns differently and the wire carries extra user-context the\n * transcript lacks), so this catches deletion and modification, not reordering or\n * fabrication (the latter is the deferred completeness direction).\n */\nexport function crossCheck(session: Session, log: WitnessLog): WitnessResult {\n  const have = new Map<string, number>();\n  for (const b of modelDecisionBlocks(session)) {\n    const d = blockDigest(b);\n    have.set(d, (have.get(d) ?? 0) + 1);\n  }\n\n  let present = 0;\n  let missing = 0;\n  let firstMissingIndex: number | undefined;\n  for (let i = 0; i < log.blocks.length; i++) {\n    const d = log.blocks[i];\n    const n = have.get(d) ?? 0;\n    if (n > 0) {\n      have.set(d, n - 1);\n      present++;\n    } else {\n      missing++;\n      if (firstMissingIndex === undefined) {\n        firstMissingIndex = i;\n      }\n    }\n  }\n\n  return {\n    tier: missing > 0 ? \"witness-divergence\" : \"witnessed\",\n    witnessed: log.blocks.length,\n    present,\n    missing,\n    firstMissingIndex,\n  };\n}\n\n/** DSSE payload type for the witness log — must match the router's `WITNESS_PAYLOAD_TYPE`. */\nexport const WITNESS_PAYLOAD_TYPE = \"application/vnd.altimate.witness+json\";\n\n/** DSSE Pre-Authentication Encoding — byte-identical to the router's `dsse_pae`. */\nexport function witnessPae(payload: string): Buffer {\n  const p = Buffer.from(payload, \"utf8\");\n  const t = Buffer.from(WITNESS_PAYLOAD_TYPE, \"utf8\");\n  return Buffer.concat([\n    Buffer.from(`DSSEv1 ${t.length} ${WITNESS_PAYLOAD_TYPE} ${p.length} `, \"utf8\"),\n    p,\n  ]);\n}\n\nexport type WitnessSigState = \"verified\" | \"bad\" | \"no-key\" | \"unsigned\";\n\n/**\n * Verify a witness log's HMAC `sig` (M106 v1, symmetric) with the gateway key. The MAC is over\n * the DSSE-PAE of the canonical `{blocks,session}` (the log minus `sig`), so it proves the log\n * was not altered after the router — which holds the key the agent does not — wrote it.\n * Cross-language verified against the Rust gateway's `hmac_sha256`. (Asymmetric ed25519/Sigstore,\n * so anyone can verify with a public key, is the next hardening — see SPEC-0024.)\n */\nexport function verifyWitnessSig(\n  log: Record<string, unknown>,\n  key: string | undefined,\n): WitnessSigState {\n  const sig = log.sig as { value?: unknown } | undefined;\n  if (!sig || typeof sig.value !== \"string\") return \"unsigned\";\n  if (!key) return \"no-key\";\n  const { sig: _omit, ...unsigned } = log;\n  const want = createHmac(\"sha256\", key)\n    .update(witnessPae(canonicalize(unsigned)))\n    .digest(\"hex\");\n  return want === sig.value ? \"verified\" : \"bad\";\n}\n\n/** Witness provenance attached to a receipt (M106b) — see `ReceiptPredicate.witness`. */\nexport interface WitnessProvenance {\n  tier: \"witnessed\" | \"witness-divergence\";\n  witnessed: number;\n  present: number;\n  signed: \"verified\" | \"unverified\" | \"none\";\n}\n\n/**\n * Discover a router-emitted witness log for this session (the gateway writes\n * `<dir>/<session>.json`, keyed by the Claude Code session id = the transcript basename) and\n * cross-check it. Returns the receipt's witness provenance, or `undefined` when there is no log\n * for this session (⇒ self-reported). Pure read; never throws.\n */\nexport function discoverWitness(\n  session: Session,\n  dir: string,\n  key?: string,\n): WitnessProvenance | undefined {\n  const sid = basename(session.filePath ?? \"\").replace(/\\.jsonl$/, \"\");\n  if (!sid) return undefined;\n  const path = join(dir, `${sid}.json`);\n  if (!existsSync(path)) return undefined;\n  let log: WitnessLog & Record<string, unknown>;\n  try {\n    log = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    return undefined;\n  }\n  if (!Array.isArray(log.blocks) || log.blocks.length === 0) return undefined;\n  const r = crossCheck(session, log);\n  const sig = verifyWitnessSig(log, key);\n  return {\n    tier: r.tier,\n    witnessed: r.witnessed,\n    present: r.present,\n    signed: sig === \"verified\" ? \"verified\" : sig === \"unsigned\" ? \"none\" : \"unverified\",\n  };\n}\n","import { existsSync, readdirSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { type Finding, deriveFindings } from \"../findings/findings.js\";\nimport { deriveSpans } from \"../findings/spans.js\";\nimport {\n  destructiveOutsideRepo,\n  findingSurface,\n  privileged,\n  regenerableBuildArtifact,\n  regenerableReceiptRm,\n} from \"../findings/surface.js\";\nimport { redact } from \"../share/redact.js\";\nimport { loadById } from \"./load.js\";\n\n/**\n * Subagent attribution (SPEC-0096 / M104). Claude Code records each Task/Workflow subagent's turns\n * in a SEPARATE transcript — `<parentPath − .jsonl>/subagents/agent-<agentId>.jsonl` — and the\n * parent transcript contains NONE of their tool calls. So the receipt is otherwise blind to\n * everything subagents did. This loader discovers those files, derives each subagent's findings,\n * and surfaces the MERGE-RELEVANT ones attributed to the subagent's brief (its first user message).\n *\n * Recorded input (SPEC-0096 Option B), like guardEvents: the surfaced findings are stored in the\n * predicate's `subagents` field, exempt from the L1 byte-compare (the CI verifier has no access to\n * the subagents dir), envelope-covered by the parent digest. Deterministic; zero model calls.\n */\nexport interface AttributedFinding {\n  /** the subagent's id (from the agent-<id>.jsonl filename) */\n  agentId: string;\n  /** the subagent's brief — its first user message, redacted + truncated */\n  brief: string;\n  id: string;\n  severity: Finding[\"severity\"];\n  title: string;\n  detail: string;\n  filePath?: string;\n}\n\nexport interface SubagentActivity {\n  /** subagent transcripts discovered for this session */\n  total: number;\n  /** subagents that did file/command work (deep-derived; research/read-only are skipped) */\n  considered: number;\n  /** the merge-relevant findings, attributed to their subagent */\n  surfaced: AttributedFinding[];\n}\n\n/**\n * Whether a subagent's finding earns a row on the MERGE surface. Mirrors `visibleMergeFindings`\n * (src/report/prComment.ts) on the subagent's own findings BEFORE they're surfaced, so a research\n * subagent's process noise can't reach the reviewer's merge gate:\n *  - EXCLUDE operator/efficiency findings (bottleneck/loop/cost/cache/model-downgrade/errcluster) —\n *    those describe HOW the subagent worked, not the merged change (they live on the operator card);\n *  - EXCLUDE carved-out destructives (a `rm -rf /tmp/scratch` / build-dir / regenerable receipt) —\n *    session scratch, not a merge risk;\n *  - then keep only the consequential rest: privileged surface, ≥high OUTCOME severity, or a finding\n *    that touches a file in this PR's diff.\n * Without this, a `bottleneck` (severity \"high\" because it's notable, not because it's a merge risk)\n * floods a small PR with \"Bash took 79% of tool time — via subagent\" noise (the exact failure that\n * prompted this fix).\n */\nexport function subagentMergeRelevant(f: Finding, inDiff: boolean): boolean {\n  if (findingSurface(f.id) !== \"merge\") {\n    return false;\n  }\n  if (f.severity === \"low\") {\n    return false;\n  }\n  if (\n    f.id.startsWith(\"destructive\") &&\n    (destructiveOutsideRepo(f.title) ||\n      regenerableBuildArtifact(f.title) ||\n      regenerableReceiptRm(f.title))\n  ) {\n    return false;\n  }\n  return (\n    privileged(f.id, f.filePath) || f.severity === \"critical\" || f.severity === \"high\" || inDiff\n  );\n}\n\nconst MAX_SUBAGENTS = 200;\n\n/** Repo-relative-ish normalization for diff-file matching. */\nconst norm = (p: string): string => p.replace(/^\\.\\//, \"\").replace(/^[\"']|[\"']$/g, \"\");\n\n/** The subagents directory beside a parent transcript, or undefined when there is none. */\nexport function subagentsDir(parentPath: string): string | undefined {\n  const dir = `${parentPath.replace(/\\.jsonl$/i, \"\")}/subagents`;\n  return existsSync(dir) ? dir : undefined;\n}\n\n/**\n * Load + attribute the merge-relevant subagent findings for a session. A subagent finding is\n * surfaced when it is privileged, ≥high severity, or touches a file in the diff — otherwise it is\n * counted but not shown (the scope gate keeps a 162-subagent session quiet). Returns undefined when\n * the session spawned no subagents. Crash-safe: a bad subagent file is skipped, not fatal.\n */\nexport async function loadSubagentActivity(\n  parentPath: string,\n  opts: { diffFiles?: string[]; cap?: number } = {},\n): Promise<SubagentActivity | undefined> {\n  const dir = subagentsDir(parentPath);\n  if (!dir) {\n    return undefined;\n  }\n  let files: string[];\n  try {\n    files = readdirSync(dir).filter((f) => f.endsWith(\".jsonl\"));\n  } catch {\n    return undefined;\n  }\n  if (!files.length) {\n    return undefined;\n  }\n  const cap = opts.cap ?? MAX_SUBAGENTS;\n  const diff = new Set((opts.diffFiles ?? []).map(norm));\n  const diffBases = new Set([...diff].map((p) => basename(p)));\n  const surfaced: AttributedFinding[] = [];\n  let considered = 0;\n  for (const file of files.slice(0, cap)) {\n    let activity: { brief: string; agentId: string; findings: Finding[] } | undefined;\n    try {\n      // Subagent transcripts under `.claude/` are Claude Code format by construction, so the\n      // adapter is fixed here. If a second agent ever spawns its own subagent transcripts, thread\n      // the parent's AgentSource through instead of hard-coding it.\n      const s = await loadById(\"claude-code\", join(dir, file));\n      if (!s) {\n        continue;\n      }\n      const derived = deriveSpans(s);\n      // research/read-only subagents (no edits, no commands) are counted but not deep-attributed\n      if (derived.filesChanged.length === 0 && derived.commands.length === 0) {\n        continue;\n      }\n      const fset = deriveFindings(derived);\n      activity = {\n        brief: redact((derived.prompt ?? s.title ?? \"\").replace(/\\s+/g, \" \").trim()).slice(0, 120),\n        agentId: basename(file)\n          .replace(/^agent-/, \"\")\n          .replace(/\\.jsonl$/i, \"\"),\n        findings: [...fset.main, ...fset.minor],\n      };\n    } catch {\n      continue; // a malformed subagent file shouldn't break the receipt\n    }\n    considered++;\n    for (const f of activity.findings) {\n      const inDiff =\n        !!f.filePath && (diff.has(norm(f.filePath)) || diffBases.has(basename(f.filePath)));\n      if (subagentMergeRelevant(f, inDiff)) {\n        surfaced.push({\n          agentId: activity.agentId,\n          brief: activity.brief,\n          id: f.id,\n          severity: f.severity,\n          title: f.title,\n          detail: f.detail,\n          ...(f.filePath ? { filePath: f.filePath } : {}),\n        });\n      }\n    }\n  }\n  return { total: files.length, considered, surfaced };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAAA,kBAAiB;AAE1B;AAAA,EACE,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,QAAM,gBAAgB;AAC/B,SAAS,qBAAqB;;;ACb9B,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,QAAAC,aAAY;;;ACyCrB,IAAM,UAAU,CAAC,MAAsB,EAAE,QAAQ,YAAY,IAAI,EAAE,QAAQ,YAAY,IAAI;AAC3F,IAAM,UAAU,CAAC,MACf,EAAE,cAAc,SAAS,QAAQ,cAAc,OAAO,EAAE,YAAY,WAAW,EAAE,CAAC,CAAC,IAAI;AACzF,IAAM,UAAU,CAAC,MACf,EAAE,cAAc,SAAS,cAAc,OAAO,EAAE,YAAY,WAAW,EAAE,CAAC,IAAI;AAChF,IAAM,WAAW,CAAC,MAChB,EAAE,cAAc,UAAU,EAAE,cAAc,WAAW,EAAE,cAAc,cACjE,OAAO,EAAE,YAAY,aAAa,EAAE,YAAY,QAAQ,EAAE,IAC1D;AAGN,IAAM,oBAAoB,CAAC,MAAuB,sBAAsB,CAAC,KAAK,kBAAkB,CAAC;AAKjG,IAAM,iBACJ;AAGF,SAAS,UAAU,KAAuB;AACxC,QAAM,IAAI,IAAI,MAAM,aAAa;AACjC,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,QAAQ,MAAM,IAAI;AAC5F;AAQA,SAAS,oBAAoB,KAAa,MAAc,KAAyB;AAC/E,MACE,eAAe,KAAK,GAAG,KACvB,YAAY,KAAK,GAAG,KACpB,2BAA2B,KAAK,GAAG,KACnC,uBAAuB,KAAK,GAAG,GAC/B;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,UAAU,GAAG;AAC7B,MAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,MAAM,iBAAiB,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,MACE,yCAAyC,KAAK,GAAG,KACjD,4BAA4B,KAAK,GAAG,KACpC,4BAA4B,KAAK,GAAG,KACpC,wCAAwC,KAAK,GAAG,KAChD,yCAAyC,KAAK,GAAG,GACjD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMA,SAAS,kBAAkB,GAAkC;AAC3D,MAAI,EAAE,cAAc,OAAQ,QAAO;AACnC,QAAM,OAAO,QAAQ,CAAC;AACtB,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,GAAG;AACD,UAAM,MAAM,EAAE,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAC3C,QAAI,UAAU,KAAK,GAAG,EAAG,QAAO,IAAI,EAAE,CAAC,GAAG,GAAG;AAAA,EAC/C;AACA,MAAI,OAA2B;AAC/B,aAAW,MAAM,gBAAgB,IAAI,GAAG;AACtC,QAAI,IAAI;AACR,eAAW,CAAC,GAAG,GAAG,KAAK;AACrB,UAAI,EAAE,QAAQ,IAAI,OAAO,UAAU,CAAC,wBAAwB,GAAG,GAAG,GAAG;AACvE,UAAM,IAAI,oBAAoB,QAAQ,CAAC,GAAG,CAAC;AAC3C,QAAI,MAAM,OAAQ,QAAO;AACzB,QAAI,MAAM,MAAO,QAAO;AAAA,EAC1B;AACA,SAAO;AACT;AAKA,SAAS,gBAAgB,GAAkC;AACzD,MAAI,EAAE,cAAc,OAAQ,QAAO;AACnC,MAAI,UAA8B;AAClC,aAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC,GAAG;AAC5C,QAAI,CAAC,iBAAiB,KAAK,EAAE,EAAG;AAChC,QAAI,CAAC,oCAAoC,KAAK,EAAE,EAAG;AACnD,UAAM,QAAQ,GAAG,QAAQ,2BAA2B,EAAE;AACtD,UAAM,SACJ,MACG,MAAM,KAAK,EACX,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC,EACrC,IAAI,KAAK;AACd,UAAM,MAAM,OAAO,SAAS,GAAG,IAAK,OAAO,MAAM,GAAG,EAAE,IAAI,KAAK,KAAM;AACrE,QAAI,OAAO,mBAAmB,KAAK,GAAG,EAAG,QAAO;AAChD,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAGO,IAAM,SAAiB;AAAA,EAC5B;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,gBAAgB;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,CAAC,MAAM,kBAAkB,CAAC,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,YAAY;AAAA,IACjB,QAAQ;AAAA,IACR,OAAO,CAAC,MAAM,gBAAgB,CAAC,KAAK;AAAA,EACtC;AAAA,EACA,EAAE,IAAI,eAAe,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,gBAAgB,KAAK,QAAQ,CAAC,CAAC,EAAE;AAAA,EACzF;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,oBAAoB;AAAA;AAAA;AAAA,IAGzB,OAAO,CAAC,MAAM;AACZ,YAAM,IAAI,QAAQ,CAAC;AACnB,UAAI,4DAA4D,KAAK,CAAC,EAAG,QAAO;AAChF,YAAM,IAAI,EAAE,MAAM,oEAAoE;AACtF,aAAO,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;AAAA,IACtC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,kBAAkB;AAAA,IACvB,OAAO,CAAC,MAAM,6CAA6C,KAAK,QAAQ,CAAC,CAAC;AAAA,EAC5E;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,qBAAqB;AAAA,IAC1B,OAAO,CAAC,MACN,iEAAiE,KAAK,SAAS,CAAC,CAAC;AAAA,EACrF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,WAAW;AAAA,IAChB,OAAO,CAAC,MAAM;AACZ,YAAM,IAAI,SAAS,CAAC;AACpB,aACE,sGAAsG;AAAA,QACpG;AAAA,MACF,KAAK,qDAAqD,KAAK,CAAC;AAAA,IAEpE;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,iBAAiB;AAAA,IACtB,OAAO,CAAC,MAAM;AACZ,YAAM,IAAI,QAAQ,CAAC;AACnB,YAAM,IAAI,SAAS,CAAC;AAEpB,YAAM,aAAa,gCAAgC,KAAK,CAAC;AACzD,aACE,yFAAyF;AAAA,QACvF;AAAA,MACF,KACC,CAAC,cAAc,6DAA6D,KAAK,CAAC;AAAA,IAEvF;AAAA,EACF;AACF;AAGA,SAAS,SAAS,MAAY,OAAsC;AAClE,MAAI;AACF,WAAO,OAAO,KAAK,WAAW,aAAa,KAAK,OAAO,KAAK,IAAK,KAAK,UAAU;AAAA,EAClF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,OAAoC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE;AAM9D,SAAS,SAAS,OAAmC;AAC1D,MAAI,OAAwB;AAC5B,aAAW,QAAQ,QAAQ;AACzB,QAAI,MAAM;AACV,QAAI;AACF,YAAM,KAAK,MAAM,KAAK;AAAA,IACxB,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAK;AACV,UAAM,SAAS,SAAS,MAAM,KAAK;AACnC,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,EAAG,QAAO,EAAE,MAAM,OAAO;AACrE,QAAI,KAAK,WAAW,OAAQ;AAAA,EAC9B;AACA,SAAO;AACT;;;ACtPA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,UAAU,YAAY;AAexB,SAAS,WAAmB;AACjC,SAAO,QAAQ,IAAI,sBAAsB,KAAK,QAAQ,GAAG,WAAW,YAAY,OAAO;AACzF;AAGO,SAAS,kBAAkB,gBAAgC;AAChE,SAAO,SAAS,cAAc,EAAE,QAAQ,aAAa,EAAE;AACzD;AAEA,SAAS,aAAa,GAA6B;AACjD,MAAI,CAAC,KAAK,OAAO,MAAM,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AACV,UACG,EAAE,WAAW,UAAU,EAAE,WAAW,SAAS,EAAE,WAAW,WAC3D,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,SAAS,YAClB,OAAO,EAAE,YAAY,YACrB,OAAO,EAAE,cAAc;AAE3B;AAMO,SAAS,gBAAgB,WAAiC;AAC/D,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,KAAK,SAAS,GAAG,GAAG,SAAS,QAAQ,GAAG,MAAM;AAAA,EACnE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAoB,CAAC;AAC3B,aAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,UAAM,IAAI,KAAK,KAAK;AACpB,QAAI,CAAC,GAAG;AACN;AAAA,IACF;AACA,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,CAAC;AACtB,UAAI,aAAa,CAAC,GAAG;AACnB,YAAI,KAAK;AAAA,UACP,QAAQ,EAAE;AAAA,UACV,QAAQ,EAAE;AAAA,UACV,MAAM,EAAE;AAAA,UACR,SAAS,EAAE;AAAA,UACX,WAAW,EAAE;AAAA,UACb,GAAI,OAAO,EAAE,QAAQ,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,UAClD,GAAI,OAAO,EAAE,OAAO,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;;;AFpDA,SAAS,YAAoC;AAC3C,MAAI,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,IAAI,kBAAkB,IAAK,QAAO;AACpF,QAAM,KAAK,QAAQ,IAAI,kBAAkB,IAAI,KAAK,EAAE,YAAY;AAChE,MAAI,MAAM,WAAW,MAAM,YAAY,MAAM,UAAW,QAAO;AAC/D,SAAO;AACT;AAEA,SAAS,UAAU,GAAsB;AACvC,MAAI,EAAE,cAAc,OAAQ,QAAO,KAAK,OAAO,EAAE,YAAY,WAAW,EAAE,EAAE,MAAM,GAAG,GAAG,CAAC;AACzF,SAAO,KAAK,OAAO,EAAE,YAAY,aAAa,EAAE,YAAY,QAAQ,EAAE,CAAC;AACzE;AAIA,SAAS,eAAe,GAAc,KAAe,SAAuB;AAC1E,MAAI;AACF,UAAM,YAAY,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,KAAK;AACjE,QAAI,CAAC,UAAW;AAChB,UAAM,MAAM,SAAS;AACrB,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,IAAI,KAAK,IAAI;AAAA,MACb,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI,KAAK;AAAA,MACjB,MAAM,OAAO,EAAE,aAAa,EAAE;AAAA,MAC9B,SAAS,QAAQ,QAAQ,UAAU,EAAE,EAAE,MAAM,GAAG,GAAG;AAAA,MACnD,WAAW,IAAI,KAAK;AAAA,MACpB,GAAI,IAAI,KAAK,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,CAAC;AACD,mBAAeC,MAAK,KAAK,GAAG,SAAS,QAAQ,GAAG,GAAG,IAAI;AAAA,CAAI;AAAA,EAC7D,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,SAAS,OAAiD;AACxE,QAAM,OAAO,UAAU;AACvB,MAAI,SAAS,MAAO,QAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AACjD,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,SAAS,IAAI;AAAA,EAClC,QAAQ;AACN,WAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AAAA,EAC/B;AACA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AAAA,EAC/B;AACA,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AAEvC,QAAM,UAAU,UAAU,KAAK;AAC/B,iBAAe,OAAO,KAAK,OAAO;AAClC,QAAM,SAAS,GAAG,IAAI,KAAK,SAAS,iBAAiB,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,GAAG;AAKlF,MAAI,SAAS,SAAS;AACpB,UAAM,OAAO,IAAI,WAAW,SAAS,UAAU,IAAI,WAAW,QAAQ,YAAY;AAClF,UAAM,MAAM,OACR,iDAAqC,IAAI,IAAI,OAAO,WAAM,IAAI,KAAK,SAAS,iDAC5E,2CAA+B,OAAO,WAAM,IAAI,KAAK,SAAS;AAClE,WAAO,EAAE,QAAQ,KAAK,UAAU,EAAE,eAAe,IAAI,CAAC,GAAG,MAAM,EAAE;AAAA,EACnE;AAEA,MAAI,IAAI,WAAW,QAAQ;AACzB,WAAO;AAAA,MACL,QAAQ,KAAK,UAAU;AAAA,QACrB,eAAe,0CAA8B,OAAO,WAAM,IAAI,KAAK,SAAS;AAAA,QAC5E,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,oBAAoB;AAAA,UACpB,0BAA0B;AAAA,QAC5B;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,IAAI,WAAW,OAAO;AACxB,WAAO;AAAA,MACL,QAAQ,KAAK,UAAU;AAAA,QACrB,eAAe,2CAA+B,OAAO,WAAM,IAAI,KAAK,SAAS;AAAA,QAC7E,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,oBAAoB;AAAA,UACpB,0BAA0B;AAAA,QAC5B;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,KAAK,UAAU;AAAA,MACrB,eAAe,gCAAsB,OAAO,WAAM,IAAI,KAAK,SAAS;AAAA,IACtE,CAAC;AAAA,IACD,MAAM;AAAA,EACR;AACF;;;AGnIA,SAAS,iBAAiB;AAC1B,SAAS,WAAW,YAAY,aAAAC,YAAW,gBAAAC,eAAc,YAAY,qBAAqB;AAC1F,SAAS,YAAY,QAAAC,aAAY;AAYjC,IAAM,SAAS;AAOf,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlB,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,SAAS;AAIX,IAAM,eAAe;AAAA;AAAA;AAAA,EAGnB,SAAS;AAMX,SAAS,IAAI,MAAgB,KAA6B;AACxD,QAAM,IAAI,UAAU,OAAO,MAAM,EAAE,UAAU,QAAQ,IAAI,CAAC;AAC1D,SAAO,EAAE,WAAW,IAAI,EAAE,OAAO,KAAK,IAAI;AAC5C;AAEA,IAAM,MAAM,CAAC,GAAW,QACtB,WAAW,CAAC,IAAI,IAAIA,MAAK,OAAO,QAAQ,IAAI,GAAG,CAAC;AAM3C,SAAS,kBACd,KAC0D;AAC1D,MAAI,IAAI,CAAC,aAAa,WAAW,GAAG,GAAG,MAAM,MAAM;AACjD,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,CAAC,UAAU,gBAAgB,GAAG,GAAG;AACvD,MAAI,WAAW;AACb,UAAM,QAAQ,UAAU,MAAM,OAAO;AACrC,QAAI,MAAM,SAAS,QAAQ,GAAG;AAE5B,YAAM,OAAO,IAAI,CAAC,aAAa,iBAAiB,GAAG,GAAG,KAAK,OAAO,QAAQ,IAAI;AAC9E,aAAO,EAAE,MAAM,SAAS,KAAKA,MAAK,MAAM,QAAQ,EAAE;AAAA,IACpD;AACA,WAAO,EAAE,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,EAAE;AAAA,EACpD;AACA,QAAM,IAAI,IAAI,CAAC,aAAa,cAAc,OAAO,GAAG,GAAG;AACvD,SAAO,IAAI,EAAE,MAAM,OAAO,KAAK,IAAI,GAAG,GAAG,EAAE,IAAI;AACjD;AAOO,SAAS,eAAe,KAA6B;AAC1D,QAAM,SAAS,kBAAkB,GAAG;AACpC,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AAAA,EACrD;AACA,QAAM,SAAS,OAAO,SAAS,UAAU,eAAe;AACxD,EAAAC,WAAU,OAAO,KAAK,EAAE,WAAW,KAAK,CAAC;AACzC,QAAM,WAAWC,MAAK,OAAO,KAAK,UAAU;AAC5C,QAAM,QAAQA,MAAK,OAAO,KAAK,gBAAgB;AAE/C,MAAI,WAAW,QAAQ,GAAG;AACxB,UAAM,UAAUC,cAAa,UAAU,MAAM;AAC7C,QAAI,QAAQ,SAAS,MAAM,GAAG;AAC5B,UAAI,YAAY,QAAQ;AACtB,eAAO,EAAE,IAAI,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA,MACzD;AAEA,oBAAc,UAAU,MAAM;AAC9B,gBAAU,UAAU,GAAK;AACzB,aAAO,EAAE,IAAI,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA,IACzD;AACA,QAAI,OAAO,SAAS,SAAS;AAG3B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,GAAG,QAAQ;AAAA,EAAyC,SAAS;AAAA,MACvE;AAAA,IACF;AAEA,QAAI,WAAW,KAAK,GAAG;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,GAAG,QAAQ,QAAQ,KAAK;AAAA,MAClC;AAAA,IACF;AACA,eAAW,UAAU,KAAK;AAC1B,kBAAc,UAAU,MAAM;AAC9B,cAAU,UAAU,GAAK;AACzB,WAAO,EAAE,IAAI,MAAM,QAAQ,WAAW,MAAM,SAAS;AAAA,EACvD;AAEA,gBAAc,UAAU,MAAM;AAC9B,YAAU,UAAU,GAAK;AACzB,SAAO,EAAE,IAAI,MAAM,QAAQ,aAAa,MAAM,SAAS;AACzD;AASA,IAAM,cAAc;AAEb,SAAS,kBAAkB,SAAgC;AAChE,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,uDAAkD;AAAA,EAC1F;AACA,QAAM,MAAMA,cAAa,SAAS,MAAM;AACxC,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,iDAA4C;AAAA,EACpF;AACA,MAAI,IAAI,YAAY,QAAW;AAC7B,QAAI,UAAU,CAAC;AAAA,EACjB;AACA,QAAM,UAAU,IAAI;AACpB,QAAM,UAAU,QAAQ;AACxB,MAAI,SAAS,SAAS,WAAW,GAAG;AAClC,WAAO,EAAE,IAAI,MAAM,SAAS,MAAM;AAAA,EACpC;AACA,UAAQ,UAAU,UAAU,GAAG,OAAO,OAAO,WAAW,KAAK;AAE7D,QAAM,SAAS,IAAI,MAAM,UAAU,IAAI,CAAC,KAAK;AAC7C,gBAAc,SAAS,GAAG,KAAK,UAAU,KAAK,MAAM,MAAM,CAAC;AAAA,CAAI;AAC/D,SAAO,EAAE,IAAI,MAAM,SAAS,KAAK;AACnC;;;ACzKA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,QAAAC,aAAY;;;ACFrB,SAAS,aAAAC,kBAAiB;AAc1B,IAAM,QAAQ,CAAC,MAAM,sBAAsB,MAAM,iCAAiC;AAE3E,IAAM,qBAAqB;AAC3B,IAAM,aAAa,CAAC,SAAyB,GAAG,kBAAkB,GAAG,IAAI;AAQhF,SAASC,KACP,MACA,OAAkE,CAAC,GACxD;AACX,QAAM,IAAID,WAAU,OAAO,MAAM;AAAA,IAC/B,UAAU;AAAA,IACV,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,KAAK,IAAI,IAAI,QAAQ;AAAA,EAC5D,CAAC;AACD,SAAO,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,KAAK,EAAE;AAC1F;AAOO,SAAS,gBACd,MACA,QACA,MACA,WACA,KACgB;AAChB,QAAM,OAAOC,KAAI,CAAC,eAAe,MAAM,SAAS,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC;AACvE,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,6CAA6C;AAAA,EAC3E;AACA,QAAM,OAAOA,KAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,OAAO,eAAe,KAAK,GAAG;AAAA,EAAmB,CAAC;AACtF,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAAA,EAC9C;AAGA,QAAM,OAAO,IAAI,KAAK,IAAI,GAAG,KAAK,OAAO,aAAa,KAAK,GAAI,CAAC,CAAC;AACjE,QAAM,SAASA,KAAI,CAAC,GAAG,OAAO,eAAe,KAAK,KAAK,MAAM,YAAY,MAAM,EAAE,GAAG;AAAA,IAClF;AAAA,IACA,KAAK,EAAE,iBAAiB,MAAM,oBAAoB,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB,OAAO,GAAG,GAAG;AAAA,EAClE;AACA,QAAM,MAAM,WAAW,IAAI;AAC3B,QAAM,MAAMA,KAAI,CAAC,cAAc,KAAK,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;AACxD,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,GAAG,UAAU;AAAA,EACzD;AACA,SAAO,EAAE,IAAI,MAAM,KAAK,QAAQ,OAAO,IAAI;AAC7C;AAGO,SAAS,eAAe,MAAc,KAA6B;AACxE,QAAM,IAAIA,KAAI,CAAC,YAAY,QAAQ,GAAG,WAAW,IAAI,CAAC,eAAe,GAAG,EAAE,IAAI,CAAC;AAC/E,SAAO,EAAE,KAAK,EAAE,MAAM;AACxB;AAUO,SAAS,gBAAgB,KAAoD;AAClF,QAAM,IAAIC,KAAI,CAAC,gBAAgB,oBAAoB,qBAAqB,GAAG,EAAE,IAAI,CAAC;AAClF,MAAI,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK;AACnB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,EAAE,IACN,MAAM,IAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,EAAE,KAAK,MAAM,IAAI,MAAM,mBAAmB,MAAM,EAAE,EAAE;AACvE;AAGO,SAAS,eAAe,MAAc,SAAS,UAAU,KAAuB;AACrF,QAAM,MAAM,WAAW,IAAI;AAC3B,SAAOA,KAAI,CAAC,QAAQ,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE;AAC1D;;;ACzGA,SAAS,cAAAC,aAAY,aAAAC,YAAW,gBAAAC,eAAc,iBAAAC,sBAAqB;AACnE,SAAS,SAAS,QAAAC,aAAY;AAYvB,IAAM,eAAe;AAKrB,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AAetB,SAAS,cAAc,MAAkC;AAC9D,MAAI;AACF,UAAM,IAAI,KAAK,MAAMF,cAAaE,MAAK,MAAM,WAAW,eAAe,GAAG,MAAM,CAAC;AAGjF,UAAM,IAAI,GAAG,KAAK;AAClB,WAAO,OAAO,MAAM,YAAY,IAAI,IAAI;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,sBACd,MACA,UAAkB,cAClB,OAQI,CAAC,GACQ;AACb,MAAI,WAAoC,CAAC;AACzC,MAAIJ,YAAW,IAAI,GAAG;AACpB,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,iDAA4C;AAAA,IACjF;AACA,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,aAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,oDAA+C;AAAA,IACpF;AACA,eAAW;AAAA,EACb;AAEA,MAAI,SAAS,UAAU,QAAW;AAChC,aAAS,QAAQ,CAAC;AAAA,EACpB;AACA,QAAM,QAAQ,SAAS;AACvB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,4DAAuD;AAAA,EAC5F;AACA,MAAI,MAAM,eAAe,QAAW;AAClC,UAAM,aAAa,CAAC;AAAA,EACtB;AACA,QAAM,MAAM,MAAM;AAClB,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,gEAA2D;AAAA,EAChG;AACA,QAAM,UAAU,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC;AAI7E,MAAI,aAAa;AACjB,MAAI,KAAK,iBAAiB;AACxB,QAAI,SAAS,QAAQ,QAAW;AAC9B,eAAS,MAAM,CAAC;AAAA,IAClB;AACA,UAAM,MAAM,SAAS;AACrB,QAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AACjE,aAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,0DAAqD;AAAA,IAC1F;AACA,QAAI,IAAI,mBAAmB,QAAW;AACpC,UAAI,iBAAiB;AACrB,mBAAa;AAAA,IACf;AAAA,EACF;AAEA,MAAI,WAAW,CAAC,YAAY;AAC1B,WAAO,EAAE,IAAI,MAAM,SAAS,MAAM;AAAA,EACpC;AACA,MAAI,CAAC,SAAS;AACZ,QAAI,KAAK,EAAE,SAAS,KAAK,WAAW,QAAQ,OAAO,CAAC,EAAE,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAAA,EACrF;AAEA,EAAAD,WAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,EAAAE,eAAc,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5D,SAAO,EAAE,IAAI,MAAM,SAAS,KAAK;AACnC;;;AFxFO,IAAM,cAAc;AAE3B,IAAM,iBAAiB,CAAC,WAAmB,6CAA6C,MAAM;AAE9F,SAASE,KAAI,MAAgB,KAAsB;AACjD,QAAM,IAAIC,WAAU,OAAO,MAAM,EAAE,UAAU,QAAQ,IAAI,CAAC;AAC1D,SAAO,EAAE,WAAW,IAAI,EAAE,OAAO,KAAK,IAAI;AAC5C;AAKA,IAAM,cAAc;AASb,SAAS,UAAU,SAA0B;AAClD,aAAW,EAAE,KAAK,KAAK,KAAK,eAAe,OAAO,GAAG;AACnD,QAAI,QAAQ,QAAQ;AAClB;AAAA,IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,QAAQ,GAAG;AAChF;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC,EAAE,MAAM,CAAC;AAC/D,QAAI,SAAS,SAAS,KAAK,SAAS,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,GAAG;AACrE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAQO,SAAS,YAAY,SAA0B;AACpD,aAAW,EAAE,KAAK,KAAK,KAAK,eAAe,OAAO,GAAG;AACnD,QAAI,QAAQ,YAAY,CAAC,KAAK,SAAS,WAAW,GAAG;AACnD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIO,SAAS,qBAAqB,OAAwB;AAC3D,SAAO,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,WAAW,aAAa,CAAC;AAC/E;AAIA,IAAM,YAAY,CAAC,SACjBC,YAAWC,MAAK,MAAM,WAAW,aAAa,cAAc,CAAC,KAC7DD,YAAWC,MAAK,MAAM,WAAW,CAAC;AAc7B,SAAS,YAAY,UAA2B;AACrD,MAAI,UAAU,QAAQ,GAAG;AACvB,WAAO;AAAA,EACT;AACA,QAAM,UAAU,gBAAgB,QAAQ;AACxC,SAAO,UAAU,UAAU,OAAO,IAAI;AACxC;AAGO,SAAS,gBAAgB,UAAiC;AAC/D,QAAM,SAASH,KAAI,CAAC,aAAa,kBAAkB,GAAG,QAAQ;AAC9D,MAAI,OAAO,SAAS,OAAO,GAAG;AAC5B,UAAM,UAAU,OAAO,MAAM,GAAG,CAAC,QAAQ,MAAM;AAC/C,QAAI,WAAW,YAAY,UAAU;AACnC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,mBAAmB,QAAgB,KAAuB;AACxE,SAAOA,KAAI,CAAC,OAAO,MAAM,aAAa,GAAG,GAAG,MAAM,eAAe,MAAM;AACzE;AASO,SAAS,gBAAgB,QAAgB,KAAuB;AACrE,QAAM,OAAOA,KAAI,CAAC,gBAAgB,WAAW,0BAA0B,GAAG,GAAG;AAC7E,MAAI,MAAM;AACR,WAAO,SAAS,UAAU,MAAM;AAAA,EAClC;AACA,SAAO,WAAW,UAAU,WAAW;AACzC;AAWA,eAAsB,UAAU,SAAgC,QAAQ,OAAwB;AAC9F,MAAI,OAAO;AACX,mBAAiB,SAAS,QAAQ;AAChC,YAAQ;AAAA,EACV;AACA,SAAO;AACT;AAYA,eAAsB,eACpB,SACA,OACA,UACqB;AACrB,MAAI,gBAAgB;AACpB,MAAI;AACF,QAAI,QAAQ,IAAI,kBAAkB,KAAK;AACrC,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAGA,SAAK,QAAQ,IAAI,kBAAkB,UAAU,YAAY,MAAM,QAAQ;AACrE,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAEA,QAAI,YAAY,YAAY,YAAY,SAAS;AAC/C,UAAI;AACJ,UAAI;AACF,kBAAU,KAAK,MAAM,KAAK;AAAA,MAC5B,QAAQ;AACN,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AACA,UAAI,QAAQ,cAAc,UAAU,CAAC,QAAQ,YAAY,SAAS;AAChE,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AACA,UAAI,QAAQ,OAAOE,YAAW,QAAQ,GAAG,GAAG;AAC1C,gBAAQ,MAAM,QAAQ,GAAG;AAAA,MAC3B;AACA,UAAI,CAAC,UAAU,QAAQ,WAAW,OAAO,GAAG;AAC1C,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AAKA,YAAM,QAAQ,cAAc,QAAQ,WAAW,SAAS,QAAQ,IAAI,CAAC;AACrE,UAAI,MAAM,SAAS,WAAWA,YAAW,MAAM,IAAI,GAAG;AACpD,gBAAQ,MAAM,MAAM,IAAI;AAAA,MAC1B;AACA,sBAAgB,YAAY,QAAQ,WAAW,OAAO;AAAA,IACxD,WAAW,CAAC,qBAAqB,KAAK,GAAG;AACvC,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAEA,UAAM,WAAWF,KAAI,CAAC,aAAa,iBAAiB,CAAC;AACrD,QAAI,CAAC,YAAY,CAAC,YAAY,QAAQ,GAAG;AACvC,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,UAAM,SAASA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAI,CAAC,UAAU,WAAW,UAAU,gBAAgB,MAAM,GAAG;AAC3D,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAIA,UAAM,SACJ,QAAQ,IAAI,kBACZ,cAAc,QAAQ,KACtB,cAAc,gBAAgB,QAAQ,KAAK,EAAE,KAC7C,UACA,YAAY;AACd,QAAI,UAAU,QAAQ;AACpB,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,YAAQ,IAAI,iBAAiB;AAE7B,QAAI,UAAU,SAAS,YAAY,SAAS,mBAAmB,MAAM,GAAG;AACtE,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAKA,UAAM,QAAQ,QAAQ,OAAO,MAAM,KAAK,QAAQ,MAAM;AACtD,YAAQ,OAAO,SAAS,MAAM;AAC9B,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,EAAE,cAAc,CAAC;AAAA,IAC9C,UAAE;AACA,cAAQ,OAAO,QAAQ;AAAA,IACzB;AACA,QAAI,cAAc,GAAG;AACnB,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAKA,QAAI,UAAU,OAAO;AACnB,YAAM,OAAO,OAAO,QAAQ,UAAU,GAAG;AACzC,UAAI,eAAe,IAAI,KAAK,MAAM;AAChC,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AACA,YAAM,SAAS,eAAe,IAAI;AAClC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,SACL,sCAAsC,IAAI,yCAC1C,iCAAiC,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,CAACA,KAAI,CAAC,UAAU,eAAe,YAAY,CAAC,GAAG;AACjD,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,IAAAC,WAAU,OAAO,CAAC,OAAO,YAAY,GAAG,EAAE,UAAU,OAAO,CAAC;AAE5D,UAAM,SAASA;AAAA,MACb;AAAA,MACA,CAAC,UAAU,eAAe,MAAM,eAAe,MAAM,GAAG,MAAM,YAAY;AAAA,MAC1E,EAAE,UAAU,OAAO;AAAA,IACrB;AACA,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,QAAI,YAAY,OAAO;AACrB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,sDAA+C,MAAM;AAAA,MAChE;AAAA,IACF;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,4CAA4C,MAAM;AAAA,IAC7D;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,MAAM,EAAE;AAAA,EACnB;AACF;;;AGrTA,SAAS,gBAAAG,qBAAoB;AAC7B,SAAS,QAAAC,aAAY;AAuBrB,IAAM,MAAM,oBAAI,IAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAqBM,SAAS,YAAY,WAA6B,MAAuB;AAC9E,MAAI,SAAS,cAAc,KAAK,WAAW,WAAW,GAAG;AACvD,UAAM,OAAO,SAAS,aAAa,KAAK,KAAK,MAAM,YAAY,MAAM;AACrE,QAAI,SAAS,IAAI;AACf,aAAO,UAAU,SAAS;AAAA,IAC5B;AACA,QAAI,KAAK,WAAW,WAAW,GAAG;AAChC,YAAM,QAAQ,KAAK,MAAM,YAAY,MAAM;AAC3C,aAAO,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,aAAa,KAAK,EAAE;AAAA,IAChE;AAGA,WAAO,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,GAAG,CAAC,EAAE;AAAA,EACxF;AAEA,MAAI,MAAe;AACnB,aAAW,OAAO,KAAK,MAAM,GAAG,GAAG;AACjC,QAAI,OAAO,QAAQ,OAAO,QAAQ,UAAU;AAC1C,aAAO;AAAA,IACT;AACA,UAAO,IAAgC,GAAG;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,IAAM,QAAQ,CAAC,MAA4B,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACrF,IAAM,UAAU,CAAC,MACf,KAAK,QACL,MAAM,MACN,MAAM,KACL,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,KACjC,OAAO,MAAM,YAAY,OAAO,KAAK,CAAW,EAAE,WAAW;AAGhE,SAAS,QACP,IACA,QACA,OACuC;AACvC,QAAM,UAAU,MACd,MAAM,MAAM,KAAK,MAAM,KAAK,IACxB,OACA,EAAE,OAAO,OAAO,EAAE,0CAA0C,KAAK,UAAU,MAAM,CAAC,IAAI;AAC5F,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,UAAa,WAAW,KAAK;AAAA,IACzD,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,MAAM,EAAE;AAAA,IACjC,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,MAAM;AAAA,IAClC,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,MAAM;AAAA,IAClC,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,SAAqB,MAAiB;AAAA,IACrE,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,UAAsB,MAAiB;AAAA,IACtE,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,SAAqB,MAAiB;AAAA,IACrE,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,UAAsB,MAAiB;AAAA,IACtE,KAAK,WAAW;AACd,UAAI,OAAO,WAAW,YAAY,OAAO,UAAU,UAAU;AAC3D,eAAO,EAAE,OAAO,yDAAyD;AAAA,MAC3E;AACA,UAAI;AACF,eAAO,EAAE,MAAM,IAAI,OAAO,KAAK,EAAE,KAAK,MAAM,EAAE;AAAA,MAChD,SAAS,GAAG;AACV,eAAO,EAAE,OAAO,kBAAkB,KAAK,MAAO,EAAY,OAAO,GAAG;AAAA,MACtE;AAAA,IACF;AAAA,IACA,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,IACtB,EAAE,MAAM,MAAM,SAAS,MAAM,EAAE,IAC/B,EAAE,OAAO,+BAA+B;AAAA,IAC9C;AACE,aAAO,EAAE,OAAO,eAAe,EAAE,IAAI;AAAA,EACzC;AACF;AAGA,SAAS,kBAAkB,KAA4D;AACrF,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO,EAAE,OAAO,8BAA8B;AAAA,EAChD;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,EAAE,MAAM;AACzC,WAAO,EAAE,OAAO,4CAA4C;AAAA,EAC9D;AACA,MAAI,OAAO,EAAE,OAAO,YAAY,CAAC,IAAI,IAAI,EAAE,EAAc,GAAG;AAC1D,WAAO,EAAE,OAAO,iBAAiB,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG;AAAA,EACvF;AACA,MAAI,EAAE,aAAa,UAAa,EAAE,aAAa,WAAW,EAAE,aAAa,QAAQ;AAC/E,WAAO,EAAE,OAAO,+CAA+C;AAAA,EACjE;AACA,SAAO;AAAA,IACL,WAAW;AAAA,MACT,MAAM,EAAE;AAAA,MACR,IAAI,EAAE;AAAA,MACN,OAAO,EAAE;AAAA,MACT,UAAW,EAAE,YAAiC;AAAA,IAChD;AAAA,EACF;AACF;AAIO,SAAS,YAAY,UAA+B;AACzD,QAAM,OAAOA,MAAK,UAAU,aAAa,cAAc;AACvD,MAAI;AACJ,MAAI;AACF,WAAOD,cAAa,MAAM,MAAM;AAAA,EAClC,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI,MAAM,6CAA8C,EAAY,OAAO,EAAE;AAAA,EACrF;AACA,QAAM,OAAO,MAAM,QAAQ,MAAM,IAC7B,SACA,UACE,OAAO,WAAW,YAClB,MAAM,QAAS,OAAiC,OAAO,IACtD,OAAkC,UACnC;AACN,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,MAAmB,CAAC;AAC1B,aAAW,OAAO,MAAM;AACtB,UAAM,IAAI,kBAAkB,GAAG;AAC/B,QAAI,WAAW,GAAG;AAChB,YAAM,IAAI,MAAM,sBAAsB,EAAE,KAAK,KAAK,KAAK,UAAU,GAAG,CAAC,GAAG;AAAA,IAC1E;AACA,QAAI,KAAK,EAAE,SAAS;AAAA,EACtB;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,SAAkB,SAA+C;AAC/F,SAAO,QAAQ,IAAI,CAAC,cAAc;AAChC,UAAM,SAAS,YAAY,QAAQ,WAAW,UAAU,IAAI;AAE5D,QACE,WAAW,UACX,UAAU,OAAO,YACjB,UAAU,OAAO,WACjB,UAAU,OAAO,MACjB;AACA,aAAO,EAAE,WAAW,MAAM,OAAO,QAAQ,OAAO,SAAS,UAAU,IAAI,cAAc;AAAA,IACvF;AACA,UAAM,MAAM,QAAQ,UAAU,IAAI,QAAQ,UAAU,KAAK;AACzD,WAAO,WAAW,MACd,EAAE,WAAW,MAAM,OAAO,QAAQ,OAAO,IAAI,MAAM,IACnD,EAAE,WAAW,MAAM,IAAI,MAAM,OAAO;AAAA,EAC1C,CAAC;AACH;AAGO,SAAS,eAAe,SAA0C;AACvE,SAAO,QAAQ,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,YAAY,aAAa,OAAO,IAC5F,IACA;AACN;AAGO,SAAS,oBAAoB,SAA0C;AAC5E,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM;AAC/B,UAAM,EAAE,MAAM,IAAI,OAAO,SAAS,IAAI,EAAE;AACxC,UAAM,OAAO,GAAG,IAAI,IAAI,EAAE,GAAG,UAAU,SAAY,KAAK,IAAI,KAAK,UAAU,KAAK,CAAC,EAAE;AACnF,QAAI,EAAE,OAAO;AACX,aAAO,0BAAgB,IAAI,WAAM,EAAE,KAAK;AAAA,IAC1C;AACA,UAAM,MAAM,EAAE,OAAO,mBAAc,aAAa,SAAS,sBAAe;AACxE,WAAO,GAAG,GAAG,IAAI,IAAI,cAAc,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,EAC7D,CAAC;AACD,QAAM,SAAS,QAAQ;AAAA,IACrB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,YAAY,aAAa;AAAA,EAC1D,EAAE;AACF,QAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,aAAa,MAAM,EAAE;AACjF,QAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;AAC7C,QAAM;AAAA,IACJ,KAAK,MAAM,gBAAa,MAAM,UAAU,SAAS,SAAM,MAAM,YAAY,EAAE,OAAO,QAAQ,MAAM;AAAA,EAClG;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACvPA,SAAS,gBAAAE,qBAAoB;AAC7B,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAgBd,SAAS,eAAuB;AACrC,SAAO,QAAQ,IAAI,0BAA0BA,MAAKD,SAAQ,GAAG,WAAW,YAAY,WAAW;AACjG;AAEA,SAAS,mBAAmB,GAAmC;AAC7D,MAAI,CAAC,KAAK,OAAO,MAAM,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AACV,UACG,EAAE,SAAS,YAAY,EAAE,SAAS,eACnC,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,YAAY,YACrB,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,UAAU;AAEvB;AAMO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAMD,cAAaE,MAAK,aAAa,GAAG,GAAG,SAAS,QAAQ,GAAG,MAAM;AAAA,EACvE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAA0B,CAAC;AACjC,aAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,UAAM,IAAI,KAAK,KAAK;AACpB,QAAI,CAAC,GAAG;AACN;AAAA,IACF;AACA,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,CAAC;AACtB,UAAI,mBAAmB,CAAC,GAAG;AACzB,YAAI,KAAK;AAAA,UACP,MAAM,EAAE;AAAA,UACR,QAAQ,EAAE;AAAA,UACV,SAAS,EAAE;AAAA,UACX,QAAQ,EAAE;AAAA,UACV,OAAO,EAAE;AAAA,UACT,GAAI,OAAO,EAAE,UAAU,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,UACxD,GAAI,OAAO,EAAE,OAAO,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAAA,UAC/C,GAAI,OAAO,EAAE,cAAc,WAAW,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,UACpE,GAAI,OAAO,EAAE,QAAQ,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;;;AC5EA,SAAS,oBAAoB;AAC7B,SAAS,aAAAC,YAAW,iBAAAC,sBAAqB;AACzC,SAAS,QAAAC,aAAY;AAqCrB,SAAS,QAAQ,MAA6B,QAAyB;AACrE,MAAI,SAAS,UAAU;AACrB,WAAO,OAAO,YAAY,MAAM;AAAA,EAClC;AACA,SAAO,OAAO,YAAY,MAAM;AAClC;AAMO,SAAS,eACd,OACA,OACA,WACyB;AACzB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,KAAK;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,YAAY,CAAC,IAAI,QAAQ;AAC/B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM,SAAS,WAAW,WAAW;AAAA,IAC9C,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ,MAAM,MAAM,IAAI,MAAM;AAAA,IACrC,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,IACxC,GAAI,IAAI,KAAK,EAAE,IAAI,IAAI,GAAG,IAAI,CAAC;AAAA,IAC/B;AAAA,IACA,GAAI,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC;AAAA,EACpC;AACF;AAGA,SAAS,WAAW,QAAuD;AACzE,QAAM,IAAI,kCAAkC,KAAK,MAAM;AACvD,MAAI,CAAC,GAAG;AACN,WAAO;AAAA,EACT;AACA,SAAO,EAAE,KAAK,EAAE,CAAC,GAAG,GAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAG;AACtD;AAEA,SAAS,GAAG,MAAwB;AAClC,SAAO,aAAa,MAAM,MAAM,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAC3F;AAIO,IAAM,YAAqB,CAAC,UAAU;AAC3C,QAAM,IAAI,WAAW,MAAM,MAAM;AACjC,MAAI,CAAC,GAAG;AACN,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,QAAM,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC;AAChD,MAAI,MAAM,SAAS,UAAU;AAC3B,UAAMC,OAAM,GAAG,CAAC,MAAM,QAAQ,EAAE,KAAK,GAAG,UAAU,UAAU,6BAA6B,CAAC;AAC1F,UAAM,IAAI,KAAK,MAAMA,IAAG;AAMxB,QAAI,CAAC,EAAE,OAAO;AACZ,aAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,IACtC;AACA,WAAO;AAAA,MACL,QAAQ,EAAE;AAAA,MACV,GAAI,EAAE,UAAU,QAAQ,EAAE,OAAO,EAAE,SAAS,MAAM,IAAI,CAAC;AAAA,MACvD,GAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACvC,GAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAChC;AAAA,EACF;AAMA,QAAM,MAAM,GAAG,CAAC,MAAM,UAAU,EAAE,KAAK,GAAG,UAAU,UAAU,mBAAmB,CAAC;AAClF,QAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,GAAG;AAC7C,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,SAAO,mBAAmB,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,YAAY,CAAC,CAAC;AAC3E;AAEA,IAAM,WAAW,oBAAI,IAAI,CAAC,QAAQ,YAAY,WAAW,SAAS,CAAC;AAQ5D,SAAS,mBAAmB,SAAsC;AACvE,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,MAAM,SAAS,GAAG;AACxC,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,MAAM,UAAU,MAAM,QAAQ,GAAG;AACvD,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AACA,MAAI,QAAQ,MAAM,CAAC,MAAM,SAAS,IAAI,CAAC,CAAC,GAAG;AACzC,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AACA,SAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AACtC;AAcO,SAAS,iBACd,WACA,WACA,QAAiB,WACjB,YAAY,IACK;AACjB,MAAI,CAAC,QAAQ,IAAI,oBAAoB;AACnC,WAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,EAAE;AAAA,EAC/B;AACA,QAAM,SAAS,oBAAoB,SAAS;AAC5C,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,QAAQ;AACtB,UAAM,MAAM,eAAe,GAAG,OAAO,SAAS;AAC9C,QAAI,KAAK;AACP,WAAK,KAAK,GAAG;AAAA,IACf;AAAA,EACF;AACA,MAAI,KAAK,UAAU,WAAW;AAC5B,UAAM,MAAM,aAAa;AACzB,IAAAC,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAIlC,IAAAC;AAAA,MACEC,MAAK,KAAK,GAAG,SAAS,QAAQ;AAAA,MAC9B,GAAG,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IAClD;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK;AACvC;;;AClMA,SAAS,aAAAC,kBAAiB;AAkBnB,IAAM,iBAAiB;AACvB,IAAM,SAAS,CAAC,SAAyB,GAAG,cAAc,GAAG,IAAI;AAkBxE,SAASC,KACP,MACA,OAAkE,CAAC,GACxD;AACX,QAAM,IAAID,WAAU,OAAO,MAAM;AAAA,IAC/B,UAAU;AAAA,IACV,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,KAAK,IAAI,IAAI,QAAQ;AAAA,EAC5D,CAAC;AACD,SAAO,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,KAAK,EAAE;AAC1F;AAIA,IAAME,SAAQ,CAAC,MAAM,sBAAsB,MAAM,iCAAiC;AAG3E,SAAS,SAAS,MAAc,KAA0B;AAC/D,QAAM,IAAID,KAAI,CAAC,YAAY,QAAQ,GAAG,OAAO,IAAI,CAAC,YAAY,GAAG,EAAE,IAAI,CAAC;AACxE,MAAI,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK;AACnB,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,EAAE,GAAG;AAC1B,WAAO,MAAM,QAAQ,CAAC,IAAK,IAAmB,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAQO,SAAS,UAAU,MAAcE,QAAiB,KAA+B;AACtF,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,QAAM,OAAO,CAAC,GAAG,UAAUA,MAAK;AAChC,QAAM,OAAO,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA;AAE7C,QAAM,OAAOF,KAAI,CAAC,eAAe,MAAM,SAAS,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC;AACvE,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,6CAA6C;AAAA,EAC3E;AACA,QAAM,OAAOA,KAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,OAAO,eAAe,KAAK,GAAG;AAAA,EAAgB,CAAC;AACnF,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAAA,EAC9C;AAGA,QAAM,OAAO,IAAI,KAAK,IAAI,GAAG,KAAK,MAAME,OAAM,KAAK,GAAI,CAAC,CAAC;AACzD,QAAM,SAASF,KAAI,CAAC,GAAGC,QAAO,eAAe,KAAK,KAAK,MAAM,SAAS,IAAI,EAAE,GAAG;AAAA,IAC7E;AAAA,IACA,KAAK,EAAE,iBAAiB,MAAM,oBAAoB,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB,OAAO,GAAG,GAAG;AAAA,EAClE;AACA,QAAM,MAAM,OAAO,IAAI;AACvB,QAAM,MAAMD,KAAI,CAAC,cAAc,KAAK,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;AACxD,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,GAAG,UAAU;AAAA,EACzD;AACA,SAAO,EAAE,IAAI,MAAM,KAAK,OAAO,KAAK,OAAO;AAC7C;AAIO,SAAS,aAAa,KAAsB;AACjD,QAAM,OAAOA,KAAI,CAAC,UAAU,WAAW,GAAG,EAAE,IAAI,CAAC,EAAE;AACnD,QAAM,QAAQA,KAAI,CAAC,UAAU,YAAY,GAAG,EAAE,IAAI,CAAC,EAAE;AACrD,MAAI,QAAQ,OAAO;AACjB,WAAO,GAAG,IAAI,KAAK,KAAK;AAAA,EAC1B;AACA,SAAO,QAAQ,SAAS,QAAQ,IAAI,QAAQ,QAAQ,IAAI,WAAW;AACrE;AAGO,SAAS,eAAe,KAA2B;AACxD,QAAM,IAAIA,KAAI,CAAC,gBAAgB,gBAAgB,qBAAqB,GAAG,EAAE,IAAI,CAAC;AAC9E,MAAI,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK;AACnB,WAAO,oBAAI,IAAI;AAAA,EACjB;AACA,SAAO,IAAI;AAAA,IACT,EAAE,IACC,MAAM,IAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,QAAQ,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,EAClD;AACF;;;AC5GA,IAAM,YAA4B,CAAC,YAAY,QAAQ,UAAU,KAAK;AAG/D,SAAS,cAAc,UAAyD;AACrF,SAAO,UAAU,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACrE;AAQO,SAAS,cAAc,WAGV;AAClB,QAAM,WAAW,UAAU,YAAY,CAAC;AACxC,QAAM,IAAI,SAAS;AACnB,QAAM,QAAQ,cAAc,QAAQ;AACpC,QAAM,QACJ,MAAM,IACF,gBACA,UAAU,cAAc,UAAU,SAChC,QACA,UAAU,WACR,WACA;AACV,QAAM,UAAU,MAAM,IAAI,gBAAgB,GAAG,CAAC,WAAW,MAAM,IAAI,KAAK,GAAG;AAC3E,SAAO,EAAE,eAAe,GAAG,OAAO,YAAY,SAAS,MAAM;AAC/D;;;ACfA,SAAS,WAAW,GAA2B;AAC7C,SAAO,GAAG,EAAE,KAAK,KAAI,EAAE,YAAY,EAAE;AACvC;AAEA,SAAS,WAAW,GAAoB;AACtC,QAAM,IAAI,EAAE,UAAU;AACtB,MAAI,CAAC,KAAK,EAAE,SAAS,UAAW,QAAO;AACvC,MAAI,EAAE,SAAS,SAAU,QAAO,UAAU,EAAE,UAAU,GAAG;AACzD,SAAO,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,KAAK,EAAE;AAC9E;AAEO,SAAS,aAAa,GAAY,GAA0B;AACjE,QAAM,KAAK,EAAE,UAAU;AACvB,QAAM,KAAK,EAAE,UAAU;AACvB,QAAM,QAAQ,CAAC,KAAa,OAAe,IAAY,QAA4B;AAAA,IACjF;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,GAAG;AAAA,IACH,OAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAuB;AAAA,IAC3B,MAAM,gBAAgB,iBAAiB,GAAG,cAAc,GAAG,YAAY;AAAA,IACvE,MAAM,SAAS,SAAS,GAAG,OAAO,GAAG,KAAK;AAAA,IAC1C,MAAM,YAAY,YAAY,GAAG,UAAU,GAAG,QAAQ;AAAA,IACtD,MAAM,SAAS,SAAS,GAAG,OAAO,GAAG,KAAK;AAAA,IAC1C,MAAM,kBAAkB,mBAAmB,GAAG,gBAAgB,GAAG,cAAc;AAAA,IAC/E,MAAM,UAAU,UAAU,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK;AAAA,EAC5D;AAEA,QAAM,QAAQ,IAAI,IAAI,EAAE,UAAU,SAAS,IAAI,UAAU,CAAC;AAC1D,QAAM,QAAQ,IAAI,IAAI,EAAE,UAAU,SAAS,IAAI,UAAU,CAAC;AAC1D,QAAM,gBAAgB,EAAE,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AAClF,QAAM,kBAAkB,EAAE,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AACpF,QAAM,iBAAiB,EAAE,UAAU,SAAS,OAAO,CAAC,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE;AAEpF,SAAO;AAAA,IACL,OAAO,EAAE,GAAG,EAAE,UAAU,OAAO,GAAG,EAAE,UAAU,MAAM;AAAA,IACpD;AAAA,IACA,MAAM,EAAE,GAAG,GAAG,SAAS,GAAG,GAAG,SAAS,OAAO,GAAG,UAAU,GAAG,QAAQ;AAAA,IACrE,eAAe,EAAE,GAAG,GAAG,UAAU,GAAG,GAAG,SAAS;AAAA,IAChD;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,GAAG,WAAW,CAAC,EAAE;AAAA,EAC9C;AACF;AAEA,IAAM,WAAmC,EAAE,UAAU,UAAK,MAAM,gBAAM,QAAQ,aAAM,KAAK,OAAI;AAG7F,SAAS,OAAO,GAAmB;AACjC,MAAI,MAAM,EAAG,QAAO;AACpB,SAAO,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAC/B;AAEA,SAAS,aAAa,IAAyC;AAC7D,SAAO,GAAG,IAAI,CAAC,MAAM;AACnB,UAAM,MAAM,EAAE,WAAW,OAAO,EAAE,QAAQ,QAAQ;AAClD,WAAO,KAAK,SAAS,EAAE,QAAQ,KAAK,MAAG,IAAI,EAAE,KAAK,GAAG,GAAG;AAAA,EAC1D,CAAC;AACH;AAGO,SAAS,WAAW,GAAyB;AAClD,QAAM,MAAgB,CAAC;AACvB,MAAI,KAAK,iDAAuC;AAChD,MAAI,KAAK,EAAE;AACX,MAAI,KAAK,UAAU,EAAE,MAAM,CAAC,WAAM,EAAE,MAAM,CAAC,EAAE;AAC7C,MAAI,KAAK,YAAY,EAAE,MAAM,CAAC,WAAQ,EAAE,MAAM,CAAC,EAAE;AACjD,MAAI,KAAK,EAAE;AACX,MAAI,KAAK,WAAW;AACpB,aAAW,KAAK,EAAE,QAAQ;AACxB,QAAI,KAAK,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,WAAM,EAAE,CAAC,KAAK,OAAO,EAAE,KAAK,CAAC,GAAG;AAAA,EAC/D;AACA,QAAM,KAAK,EAAE;AACb,QAAM,YACJ,GAAG,UAAU,IAAI,WAAQ,GAAG,QAAQ,IAAI,MAAM,OAAO,iBAAiB,KAAK,IAAI,GAAG,KAAK,CAAC;AAC1F,MAAI,KAAK,WAAW,iBAAiB,GAAG,CAAC,CAAC,WAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,SAAS,GAAG;AACvF,MAAI;AAAA,IACF,qBAAqB,aAAa,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAM,aAAa,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,QAAQ,GAAG,KAAK,CAAC,CAAC;AAAA,EACzJ;AACA,QAAM,KAAK,EAAE;AACb,QAAM,QAAQ,CAAC,MAAgB,IAAI,aAAa;AAChD,MAAI,KAAK,mBAAmB,MAAM,GAAG,CAAC,CAAC,WAAM,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,IAAI,eAAe,EAAE,EAAE;AAC9F,MAAI,KAAK,EAAE;AACX,MAAI;AAAA,IACF,aAAa,EAAE,cAAc,MAAM,mBAAgB,EAAE,gBAAgB,MAAM,mBAAgB,EAAE,cAAc;AAAA,EAC7G;AACA,MAAI,EAAE,cAAc,QAAQ;AAC1B,QAAI,KAAK,EAAE;AACX,QAAI,KAAK,kBAAkB;AAC3B,QAAI,KAAK,GAAG,aAAa,EAAE,aAAa,CAAC;AAAA,EAC3C;AACA,MAAI,EAAE,gBAAgB,QAAQ;AAC5B,QAAI,KAAK,EAAE;AACX,QAAI,KAAK,4BAA4B;AACrC,QAAI,KAAK,GAAG,aAAa,EAAE,eAAe,CAAC;AAAA,EAC7C;AACA,MAAI,KAAK,EAAE;AACX,MAAI,KAAK,gEAA0D;AACnE,SAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA;AAC1B;;;AC/GO,SAAS,gBAAgB,UAAmD;AACjF,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,UAAU;AACxB,UAAM,IAAI,WAAW,EAAE,EAAE;AACzB,QAAI,GAAG;AACL,WAAK,IAAI,EAAE,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAmNO,SAAS,mBAAmB,MAAsC;AACvE,QAAM,QAAQ,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AACzE,QAAM,MAAM,oBAAI,IAAoB;AACpC,MAAI,UAAU;AACd,aAAW,KAAK,MAAM;AACpB,QAAI,EAAE,WAAW,QAAQ;AACvB;AAAA,IACF;AACA,eAAW,OAAO,IAAI,IAAI,EAAE,UAAU,GAAG;AACvC,UAAI,IAAI,MAAM,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC;AAAA,IACtC;AAAA,EACF;AACA,QAAM,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,EACjC,IAAI,CAAC,CAAC,KAAK,QAAQ,OAAO,EAAE,KAAK,OAAO,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,EAAE,EAC1E,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC3E,SAAO,EAAE,SAAS,KAAK,QAAQ,SAAS,YAAY,MAAM,CAAC,GAAG,IAAI,EAAE;AACtE;AAGO,SAAS,gBAAgB,GAAsB;AACpD,MAAI,EAAE,YAAY,GAAG;AACnB,WAAO;AAAA,EACT;AACA,QAAM,MAAgB,CAAC;AACvB,MAAI,KAAK,8BAAyB,EAAE,OAAO,sBAAsB,EAAE,YAAY,IAAI,KAAK,GAAG,EAAE;AAC7F,MAAI,KAAK,EAAE;AACX,QAAM,OAAO,KAAK,MAAO,MAAM,EAAE,UAAW,EAAE,OAAO;AACrD,MAAI,KAAK,YAAY,EAAE,OAAO,IAAI,EAAE,OAAO,cAAc,IAAI,uCAAkC;AAC/F,MAAI,KAAK,EAAE;AACX,MAAI,EAAE,WAAW,WAAW,GAAG;AAC7B,QAAI,KAAK,yDAAyD;AAAA,EACpE,OAAO;AACL,QAAI,KAAK,iCAAiC;AAC1C,eAAW,KAAK,EAAE,YAAY;AAC5B,UAAI,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE;AAAA,IAClD;AAAA,EACF;AACA,MAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA;AAC1B;;;ACjSA,SAAS,gBAAAG,eAAc,mBAAmB;AAC1C,SAAS,YAAAC,WAAU,WAAAC,UAAS,QAAAC,aAAY;AA0BxC,IAAM,cAAc;AA2DpB,IAAM,UAAU,OAAiC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AAMpF,SAAS,iBAAiB,SAAiC;AAChE,QAAM,QAAQC,UAAS,QAAQ,QAAQ,OAAO,EAAE,CAAC,KAAK;AACtD,QAAM,MAAMC,MAAK,SAAS,WAAW;AACrC,QAAM,UAAUC,SAAQ,GAAG;AAC3B,QAAM,QAAQ,eAAe,OAAO;AACpC,QAAM,UAAuD,CAAC;AAC9D,MAAI;AACF,eAAW,KAAK,YAAY,GAAG,GAAG;AAChC,UAAI,CAAC,EAAE,SAAS,OAAO,KAAK,YAAY,KAAK,CAAC,EAAG;AACjD,YAAM,OAAO,EAAE,QAAQ,YAAY,EAAE;AACrC,UAAI;AACF,gBAAQ,KAAK,EAAE,KAAKC,cAAaF,MAAK,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;AAAA,MAChE,QAAQ;AACN,gBAAQ,KAAK,EAAE,KAAK,MAAM,KAAK,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,aAAW,EAAE,KAAK,KAAK,gBAAgB,OAAO,GAAG;AAC/C,YAAQ,KAAK,EAAE,KAAK,eAAe,MAAM,OAAO,GAAG,KAAK,CAAC;AAAA,EAC3D;AAEA,QAAM,MAAsB,CAAC;AAC7B,aAAW,EAAE,KAAK,KAAK,KAAK,SAAS;AACnC,QAAI,OAAO,KAAM;AACjB,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,GAAG;AAAA,IACxB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,QAAS;AAC7B,UAAM,IAAI,IAAI,QAAQ;AACtB,UAAM,WAAW,EAAE,YAAY,CAAC;AAChC,UAAM,aAAa,QAAQ;AAC3B,eAAW,KAAK,UAAU;AACxB,iBAAW,EAAE,QAAQ;AAAA,IACvB;AACA,UAAM,aAAa,EAAE,OAAO,SAAS,SAAU,EAAE,MAAM,OAAO,UAAU,IAAK;AAC7E,QAAI,KAAK;AAAA,MACP,MAAM;AAAA,MACN,OAAO,EAAE,SAAS,SAAS;AAAA;AAAA,MAE3B,SAAS,EAAE,SAAS,eAAe,EAAE,SAAS;AAAA,MAC9C,OAAO,EAAE;AAAA,MACT,UAAU,SAAS;AAAA,MACnB;AAAA,MACA,SAAS,EAAE,SAAS;AAAA,MACpB,SAAS;AAAA,MACT,SAAS,EAAE,SAAS;AAAA,MACpB,UAAU,MAAM,IAAI,IAAI;AAAA,IAC1B,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAM,SAAS,CAAC,MAAsB,KAAK,MAAM,IAAI,GAAG,IAAI;AAC5D,IAAM,cAAc,CAAC,MAClB,CAAC,YAAY,QAAQ,UAAU,KAAK,EAAY,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;AAGhE,SAAS,aAAa,UAA0C;AACrE,QAAM,UAAU,oBAAI,IAAwB;AAC5C,QAAM,WAAW,oBAAI,IAAyB;AAC9C,QAAM,OAAO,QAAQ;AACrB,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,YAAY;AAEhB,QAAM,SAAS,CAAC,KAA+B,QAAkC;AAC/E,eAAW,KAAK,OAAO,KAAK,GAAG,EAAiB,KAAI,CAAC,KAAK,IAAI,CAAC;AAAA,EACjE;AAEA,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,QAAQ,IAAI,EAAE,IAAI;AAC7B,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,MAAM,EAAE;AAAA,QACR,UAAU;AAAA,QACV,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,YAAY,QAAQ;AAAA,QACpB,SAAS;AAAA,QACT,SAAS;AAAA,QACT,QAAQ,CAAC;AAAA,MACX;AACA,cAAQ,IAAI,EAAE,MAAM,IAAI;AAAA,IAC1B;AACA,QAAI,QAAQ,SAAS,IAAI,EAAE,KAAK;AAChC,QAAI,CAAC,OAAO;AACV,cAAQ;AAAA,QACN,OAAO,EAAE;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,YAAY,QAAQ;AAAA,QACpB,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,eAAS,IAAI,EAAE,OAAO,KAAK;AAAA,IAC7B;AACA,SAAK;AACL,QAAI,EAAE,SAAU,MAAK;AACrB,SAAK,WAAW,EAAE;AAClB,SAAK,YAAY,EAAE;AACnB,WAAO,KAAK,YAAY,EAAE,UAAU;AACpC,QAAI,CAAC,KAAK,OAAO,SAAS,EAAE,KAAK,EAAG,MAAK,OAAO,KAAK,EAAE,KAAK;AAC5D,UAAM;AACN,QAAI,EAAE,SAAU,OAAM;AACtB,UAAM,WAAW,EAAE;AACnB,UAAM,YAAY,EAAE;AACpB,WAAO,MAAM,YAAY,EAAE,UAAU;AACrC,aAAS,EAAE;AACX,QAAI,EAAE,SAAU;AAChB,aAAS,EAAE;AACX,WAAO,MAAM,EAAE,UAAU;AAEzB,QAAI,EAAE,WAAW,QAAQ,EAAE,WAAW,MAAM;AAC1C,WAAK,WAAW,EAAE;AAClB,WAAK,WAAW,EAAE;AAClB,YAAM,WAAW,EAAE;AACnB,YAAM,WAAW,EAAE;AACnB,kBAAY,EAAE;AACd,kBAAY,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,aAAa,CAAC,OAA+B,EAAE,GAAG,GAAG,SAAS,OAAO,EAAE,OAAO,EAAE;AACtF,QAAM,cAAc,CAAC,OAAiC,EAAE,GAAG,GAAG,SAAS,OAAO,EAAE,OAAO,EAAE;AACzF,QAAM,QAAQ,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,IAAI,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;AACxF,QAAM,SAAS,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,IAAI,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;AAE3F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,MACN,OAAO,MAAM;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,UAAU;AAAA,MACV,SAAS,OAAO,KAAK;AAAA,MACrB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,UAAU,WAAW,IAAI,OAAO,WAAW,QAAQ,IAAI;AAAA,IACzD;AAAA,EACF;AACF;AAGO,SAAS,sBAAsB,UAAoC;AACxE,QAAM,MAAsB,CAAC;AAC7B,aAAW,KAAK,SAAU,KAAI,KAAK,GAAG,iBAAiB,CAAC,CAAC;AACzD,SAAO,aAAa,GAAG;AACzB;AAEA,IAAM,UAAU,CAAC,MAAwC;AACvD,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,SAAU,OAAM,KAAK,GAAG,EAAE,QAAQ,QAAG;AAC3C,MAAI,EAAE,KAAM,OAAM,KAAK,GAAG,EAAE,IAAI,cAAI;AACpC,MAAI,EAAE,OAAQ,OAAM,KAAK,GAAG,EAAE,MAAM,WAAI;AACxC,MAAI,EAAE,IAAK,OAAM,KAAK,GAAG,EAAE,GAAG,MAAG;AACjC,SAAO,MAAM,KAAK,GAAG,KAAK;AAC5B;AACA,IAAM,UAAU,CAAC,SAAiB,YAChC,UAAU,IAAI,GAAG,KAAK,MAAO,UAAU,UAAW,GAAG,CAAC,MAAM;AAGvD,SAAS,YAAY,GAAkB;AAC5C,MAAI,EAAE,OAAO,aAAa,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM;AAAA,IACJ,gBAAW,EAAE,OAAO,QAAQ,WAAW,EAAE,OAAO,aAAa,IAAI,KAAK,GAAG,WAAW,EAAE,OAAO,KAAK,QAAQ,EAAE,OAAO,UAAU,IAAI,KAAK,GAAG,SAAM,EAAE,OAAO,MAAM,SAAS,EAAE,OAAO,WAAW,IAAI,KAAK,GAAG;AAAA,EACzM;AACA,QAAM,KAAK,EAAE;AACb,QAAM,MAAM,EAAE,OAAO,YAAY,OAAO,WAAM,GAAG,KAAK,MAAM,EAAE,OAAO,WAAW,GAAG,CAAC;AACpF,QAAM;AAAA,IACJ,qBAAqB,iBAAiB,EAAE,OAAO,OAAO,CAAC,kBAAe,GAAG,SAAM,EAAE,OAAO,QAAQ,iBAAiB,EAAE,OAAO,aAAa,IAAI,KAAK,GAAG,KAAK,QAAQ,EAAE,OAAO,UAAU,CAAC;AAAA,EACtL;AACA,QAAM;AAAA,IACJ,iBAAiB,EAAE,OAAO,QAAQ,IAAI,EAAE,OAAO,QAAQ,WAAW,EAAE,OAAO,aAAa,IAAI,KAAK,GAAG;AAAA,EACtG;AACA,QAAM,KAAK,EAAE;AAEb,QAAM,QAAQ,EAAE,MAAM,IAAI,CAAC,OAAO;AAAA,IAChC,MAAM,EAAE;AAAA,IACR,GAAG,OAAO,EAAE,QAAQ;AAAA,IACpB,QAAQ,EAAE,OAAO,KAAK,IAAI;AAAA,IAC1B,MAAM,iBAAiB,EAAE,OAAO;AAAA,IAChC,KAAK,QAAQ,EAAE,SAAS,EAAE,OAAO;AAAA,IACjC,SACE,EAAE,aAAa,IACX,MACA,GAAG,EAAE,QAAQ,IAAI,YAAY,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE,GAAG,KAAK;AAAA,EACvF,EAAE;AACF,QAAM,IAAI,CAAC,KAAmC,SAC5C,KAAK,IAAI,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;AAC1D,QAAM,KAAK,EAAE,QAAQ,MAAM;AAC3B,QAAM,KAAK,EAAE,KAAK,GAAG;AACrB,QAAM,KAAK,EAAE,UAAU,QAAQ;AAC/B,QAAM,KAAK,EAAE,QAAQ,OAAO;AAC5B,QAAM,KAAK,EAAE,OAAO,OAAO;AAC3B,QAAM;AAAA,IACJ,GAAG,OAAO,OAAO,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,SAAS,OAAO,EAAE,CAAC,KAAK,QAAQ,OAAO,EAAE,CAAC,KAAK,QAAQ,OAAO,EAAE,CAAC;AAAA,EAC/G;AACA,aAAW,KAAK,OAAO;AACrB,UAAM;AAAA,MACJ,GAAG,EAAE,KAAK,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO;AAAA,IAC1H;AAAA,EACF;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,WAAW;AACtB,aAAW,KAAK,EAAE,QAAQ;AACxB,UAAM;AAAA,MACJ,KAAK,EAAE,KAAK,WAAM,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG,SAAM,iBAAiB,EAAE,OAAO,CAAC,eAAY,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAM,EAAE,QAAQ;AAAA,IAC9J;AAAA,EACF;AACA,QAAM,KAAK,EAAE;AACb,QAAM;AAAA,IACJ;AAAA,EACF;AACA,SAAO,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA;AAC5B;;;ACjUA,SAAS,gBAAAG,eAAc,eAAAC,oBAAmB;AAC1C,SAAS,WAAAC,UAAS,QAAAC,cAAY;AAmB9B,IAAMC,YAAqC,EAAE,UAAU,UAAK,MAAM,gBAAM,QAAQ,aAAM,KAAK,OAAI;AAC/F,IAAM,WAAqC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AAarF,IAAMC,eAAc;AAEpB,SAASC,YACP,OACQ;AACR,MAAI,CAAC,SAAS,MAAM,SAAS,UAAW,QAAO;AAC/C,MAAI,MAAM,SAAS,SAAU,QAAO,UAAU,MAAM,UAAU,GAAG;AACjE,SAAO,SAAS,MAAM,SAAS,CAAC,GAAG,MAAM;AAC3C;AAEA,SAAS,QAAQ,IAAgC;AAC/C,MAAI,CAAC,MAAM,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO,SAAI,OAAO,EAAE;AACrD,SAAO,IAAI,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC/C;AAIO,SAAS,mBAAmB,KAAyB;AAC1D,MAAI;AACJ,MAAI;AACF,YAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,KAAK,CAACF,aAAY,KAAK,CAAC,CAAC;AAAA,EACpF,QAAQ;AACN,YAAQ,CAAC;AAAA,EACX;AACA,QAAM,UAAuD,MAAM,IAAI,CAAC,MAAM;AAC5E,QAAI;AACF,aAAO,EAAE,MAAM,GAAG,KAAKG,cAAaC,OAAK,KAAK,CAAC,GAAG,MAAM,EAAE;AAAA,IAC5D,QAAQ;AACN,aAAO,EAAE,MAAM,GAAG,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF,CAAC;AAGD,QAAM,OAAOC,SAAQ,GAAG;AACxB,aAAW,EAAE,KAAK,KAAK,gBAAgB,IAAI,GAAG;AAC5C,YAAQ,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,KAAK,eAAe,MAAM,IAAI,EAAE,CAAC;AAAA,EACvE;AACA,QAAM,UAAsB,CAAC;AAC7B,aAAW,EAAE,MAAM,GAAG,IAAI,KAAK,SAAS;AACtC,QAAI,OAAO,MAAM;AACf;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,GAAG;AAAA,IACxB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,QAAS;AAC7B,UAAM,IAAI,IAAI,QAAQ;AACtB,UAAM,KAAK,EAAE,YAAY,CAAC;AAC1B,QAAIC;AACJ,eAAW,KAAK,IAAI;AAClB,UAAI,CAACA,gBAAe,SAAS,EAAE,QAAQ,IAAI,SAASA,YAAW,EAAG,CAAAA,eAAc,EAAE;AAAA,IACpF;AACA,YAAQ,KAAK;AAAA,MACX,MAAM,EAAE,QAAQ,YAAY,EAAE;AAAA,MAC9B,OAAO,EAAE;AAAA,MACT,SAAS,EAAE,SAAS,eAAe,EAAE,SAAS;AAAA,MAC9C,UAAU,GAAG;AAAA,MACb,aAAAA;AAAA,MACA,OAAOL,YAAW,EAAE,KAAK;AAAA,MACzB,SAAS,EAAE,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,UAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,WAAW,MAAM,EAAE,WAAW,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC1F,SAAO;AACT;AAGO,SAAS,UAAU,SAA8B,QAAQ,QAAQ,QAAgB;AACtF,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,OAAO,QAAQ,IAAI,CAAC,MAAM;AAC9B,UAAM,WACJ,EAAE,aAAa,IACX,MACA,GAAG,EAAE,QAAQ,IAAI,EAAE,cAAcF,UAAS,EAAE,WAAW,IAAI,EAAE,GAAG,KAAK;AAC3E,WAAO;AAAA,MACL,MAAM,QAAQ,EAAE,OAAO;AAAA,MACvB,OAAO,EAAE;AAAA,MACT,MAAM,iBAAiB,EAAE,OAAO;AAAA,MAChC;AAAA,MACA,OAAO,EAAE;AAAA,MACT,MAAM,EAAE;AAAA,IACV;AAAA,EACF,CAAC;AACD,QAAM,IAAI,CAAC,KAAkCQ,UAC3C,KAAK,IAAIA,MAAK,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;AACzD,QAAM,QAAQ,EAAE,QAAQ,MAAM;AAC9B,QAAM,SAAS,KAAK,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;AAC7D,QAAM,QAAQ,EAAE,QAAQ,MAAM;AAC9B,QAAM,QAAQ,EAAE,YAAY,UAAU;AACtC,QAAM,SAAS,EAAE,SAAS,OAAO;AACjC,QAAM,OAAO,GAAG,OAAO,OAAO,KAAK,CAAC,KAAK,QAAQ,OAAO,MAAM,CAAC,KAAK,OAAO,OAAO,KAAK,CAAC,KAAK,WAAW,OAAO,KAAK,CAAC,KAAK,QAAQ,OAAO,MAAM,CAAC;AAChJ,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MACC,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI;AAAA,EAClJ;AACA,QAAM,SAAS,sCAAiC,KAAK,WAAW,UAAU,IAAI,KAAK,GAAG,GAAG,QAAQ,SAAS,QAAQ,aAAa,QAAQ,MAAM,KAAK,EAAE;AACpJ,SAAO,GAAG,MAAM;AAAA;AAAA,EAAO,IAAI;AAAA,EAAK,MAAM,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAClD;;;AC7HA,IAAM,YAAY;AAGX,SAAS,WAAW,QAAwB;AACjD,SAAO,OAAO,QAAQ,UAAU,GAAG;AACrC;AAYO,SAAS,UAAU,OAA0B,WAA2C;AAC7F,QAAM,OAAiB,CAAC;AACxB,QAAM,SAAmB,CAAC;AAC1B,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK;AACnC,UAAM,OAAO,KAAK,QAAQ,YAAY,EAAE;AACxC,QAAI,UAAU,KAAK,IAAI,KAAK,UAAU,IAAI,IAAI,GAAG;AAC/C,WAAK,KAAK,CAAC;AAAA,IACb,OAAO;AACL,aAAO,KAAK,CAAC;AAAA,IACf;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;;;ACzCA,SAAS,gBAAAC,eAAc,eAAAC,oBAAmB;AAC1C,SAAS,QAAAC,cAAY;AAiBrB,IAAMC,eAAc;AAkBb,SAAS,aAAa,KAA2B;AACtD,MAAI;AACJ,MAAI;AACF,YAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,KAAK,CAACD,aAAY,KAAK,CAAC,CAAC;AAAA,EACpF,QAAQ;AACN,YAAQ,CAAC;AAAA,EACX;AACA,QAAM,SAAsC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE;AACrE,QAAM,MAAM,oBAAI,IAGd;AACF,MAAI,WAAW;AACf,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,gBAAgB;AAEpB,aAAW,KAAK,OAAO;AACrB,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAME,cAAaC,OAAK,KAAK,CAAC,GAAG,MAAM,CAAC;AAAA,IACvD,QAAQ;AACN;AACA;AAAA,IACF;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B;AACA;AAAA,IACF;AACA;AACA,UAAM,IAAI,IAAI,QAAQ;AACtB,WAAO,EAAE,KAAK,KAAK,OAAO,EAAE,KAAK,KAAK,KAAK;AAC3C,UAAM,WAAW,EAAE,YAAY,CAAC;AAChC,QAAI,SAAS,OAAQ;AACrB,qBAAiB,SAAS;AAE1B,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,WAAW,UAAU;AAC9B,YAAM,IAAI,WAAW,QAAQ,EAAE;AAC/B,UAAI,CAAC,EAAG;AACR,YAAM,MAAM,IAAI,IAAI,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,UAAU,GAAG,UAAU,EAAE;AACvF,UAAI;AACJ,UAAI,CAAC,KAAK,IAAI,EAAE,GAAG,GAAG;AACpB,YAAI;AACJ,aAAK,IAAI,EAAE,GAAG;AAAA,MAChB;AACA,UAAI,IAAI,EAAE,KAAK,GAAG;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,EACjC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,EAAE,EAAE,EACjC,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAE3E,SAAO,EAAE,UAAU,SAAS,SAAS,QAAQ,YAAY,cAAc;AACzE;AAGO,SAAS,YAAY,GAAyB;AACnD,MAAI,EAAE,aAAa,EAAG,QAAO;AAC7B,QAAM,MAAgB,CAAC;AACvB,MAAI;AAAA,IACF,8BAAyB,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG;AAAA,EAC3E;AACA,MAAI,KAAK,EAAE;AACX,QAAM,MAAM,CAAC,MAAc,GAAG,KAAK,MAAO,MAAM,IAAK,EAAE,QAAQ,CAAC;AAChE,MAAI;AAAA,IACF,uBAAgB,EAAE,OAAO,CAAC,qBAAW,EAAE,OAAO,CAAC,qBAAW,EAAE,OAAO,CAAC,qBAAW,EAAE,OAAO,CAAC;AAAA,EAC3F;AACA,MAAI,KAAK,YAAY,EAAE,OAAO,IAAI,EAAE,QAAQ,cAAc,IAAI,EAAE,OAAO,CAAC,2BAAsB;AAC9F,MAAI,KAAK,EAAE;AACX,MAAI,EAAE,WAAW,WAAW,GAAG;AAC7B,QAAI,KAAK,iEAA4D;AAAA,EACvE,OAAO;AACL,QAAI;AAAA,MACF,oBAAoB,EAAE,aAAa,oBAAoB,EAAE,WAAW,MAAM;AAAA,IAC5E;AACA,eAAW,KAAK,EAAE,YAAY;AAC5B,UAAI;AAAA,QACF,KAAK,EAAE,IAAI,IAAI,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG,OAAO,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG;AAAA,MAC9I;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,SAAS;AACb,QAAI,KAAK,IAAI,IAAI,EAAE,OAAO,4BAA4B,EAAE,YAAY,IAAI,KAAK,GAAG,WAAW;AAAA,EAC7F;AACA,MAAI,KAAK,IAAI,mFAA6E;AAC1F,SAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA;AAC1B;;;ACzEO,IAAM,oBAAuC;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,mBAAsC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AACF;AAIA,IAAM,sBAAyC,CAAC,uBAAuB,sBAAsB;AAOtF,IAAM,yBAA8C,oBAAI,IAAY;AAAA,EACzE,GAAG,cAAc,QAAQ,CAAC,MAAM,EAAE,QAAQ;AAAA,EAC1C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAIM,SAAS,uBAAuB,KAG1B;AACX,SAAO,CAAC,GAAI,IAAI,aAAa,CAAC,GAAI,GAAI,IAAI,cAAc,CAAC,CAAE,EAAE;AAAA,IAC3D,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC;AAAA,EACtC;AACF;AAEA,IAAM,gBAAgB,CAAC,IAAY,aACjC,SAAS,KAAK,CAAC,MAAM,OAAO,KAAK,GAAG,WAAW,GAAG,CAAC,GAAG,CAAC;AAEzD,IAAM,OAAO,CAAC,MACZ,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,KAAK,EAAE,QAAQ,MAAM,EAAE,cAAc,KAAK,EAAE,WAAW,MAAM,EAAE;AAMjF,SAAS,YAAY,GAAqB,QAAkC;AACjF,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,SAAS,YAAY,SAAS,CAAC,EAAE;AAAA,EAC5C;AAEA,QAAM,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG;AACzD,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,aAAa,OAAO,cAAc;AAGxC,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,MAAM;AACpB,QAAI,cAAc,EAAE,IAAI,SAAS,GAAG;AAClC,YAAM,KAAK,EAAE,MAAM,aAAa,MAAM,KAAK,CAAC,GAAG,aAAa,QAAQ,CAAC;AAAA,IACvE;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,EAAE,SAAS,aAAa,eAAe,UAAU;AAC7E,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,WAAO,EAAE,SAAS,SAAS,SAAS,MAAM;AAAA,EAC5C;AAGA,QAAM,aAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,WAAW,CAAC,GAAG;AACpC,SAAK,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,YAAY,aAAa,SAAS;AACzE,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,MAAM,UAAU,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,oBAAoB,EAAE;AAAA,QACrF,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AACA,aAAW,KAAK,MAAM;AACpB,QAAI,cAAc,EAAE,IAAI,mBAAmB,GAAG;AAC5C,iBAAW,KAAK,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC,GAAG,aAAa,aAAa,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,WAAO,EAAE,SAAS,cAAc,SAAS,WAAW;AAAA,EACtD;AAGA,QAAM,WAA4B,CAAC;AACnC,aAAW,KAAK,MAAM;AACpB,QAAI,cAAc,EAAE,IAAI,UAAU,GAAG;AACnC,eAAS,KAAK,EAAE,MAAM,eAAe,MAAM,KAAK,CAAC,GAAG,aAAa,WAAW,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,WAAO,EAAE,SAAS,YAAY,SAAS,SAAS;AAAA,EAClD;AAGA,SAAO,EAAE,SAAS,YAAY,SAAS,CAAC,EAAE;AAC5C;AAIO,SAAS,gBAAgB,GAAoB;AAClD,SAAO,MAAM,WAAW,MAAM,eAAe,IAAI;AACnD;;;ACzLA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,gBAAAC,eAAc,eAAAC,cAAa,gBAAgB;AACpD,SAAS,QAAAC,cAAY;;;ACOrB,IAAM,MAAM;AASZ,SAAS,WAAW,MAAc,YAA8C;AAC9E,MAAI,WAAW,WAAW,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,aAAW,MAAM,YAAY;AAC3B,QACE,OAAO,QACN,KAAK,SAAS,GAAG,KAAK,GAAG,SAAS,IAAI,IAAI,EAAE,KAC5C,GAAG,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,EAAE,EAAE,GAC3C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAA4B;AAC3C,QAAM,IAAI,OAAO,OAAO,EAAE,EAAE,YAAY;AACxC,SAAO,MAAM,WAAW,MAAM,aAAa,MAAM,SAAS,IAAI;AAChE;AAkBO,SAAS,YACd,WACA,YACA,MAAM,KAC8D;AACpE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,SAAS;AAAA,EAC/B,QAAQ;AACN,WAAO,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,EAAE;AAAA,EACzC;AACA,QAAM,OACJ,UAAU,OAAO,WAAW,YAAY,MAAM,QAAS,OAA8B,IAAI,IACnF,OAA6C,QAAQ,CAAC,IACxD,CAAC;AAEP,QAAM,MAAuB,CAAC;AAC9B,QAAM,eAAuC,CAAC;AAC9C,aAAWC,QAAO,MAAM;AACtB,UAAM,UAAU,MAAM,QAAQA,MAAK,OAAO,IAAKA,KAAI,UAA8B,CAAC;AAClF,eAAW,KAAK,SAAS;AACvB,YAAM,MAAM,EAAE,YAAY,CAAC,GAAG;AAC9B,YAAM,MAAM,OAAO,KAAK,kBAAkB,QAAQ,WAAW,IAAI,iBAAiB,MAAM;AACxF,YAAM,OAAO,MAAM,WAAW,KAAK,UAAU,IAAI;AACjD,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,QAAQ,QAAQ,EAAE,KAAK;AAC7B,YAAM,OAAO,OAAO,KAAK,QAAQ,cAAc,WAAW,IAAI,OAAO,YAAY;AACjF,YAAM,SAAwB;AAAA,QAC5B,QAAQ,OAAO,EAAE,WAAW,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,QAC9D;AAAA;AAAA,QACA;AAAA,QACA,GAAI,QAAQ,QAAQ,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,QACpC,GAAI,OAAO,EAAE,SAAS,SAAS,WAAW,EAAE,SAAS,EAAE,QAAQ,KAAK,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC;AAAA,MACzF;AAEA,mBAAa,KAAK,KAAK,aAAa,KAAK,KAAK,KAAK;AACnD,UAAI,KAAK,MAAM;AAAA,IACjB;AAAA,EACF;AAIA,MAAI;AAAA,IACF,CAAC,GAAG,OACD,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ,EAAE,MACxC,EAAE,QAAQ,MAAM,EAAE,QAAQ,MAC3B,EAAE,OAAO,cAAc,EAAE,MAAM,KAC/B,EAAE,MAAM,cAAc,EAAE,KAAK,MAC5B,EAAE,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE;AAAA,EACnD;AACA,SAAO,EAAE,SAAS,IAAI,MAAM,GAAG,GAAG,GAAG,aAAa;AACpD;;;AD9FA,SAAS,GAAG,KAAa,MAAgB,KAAsB;AAC7D,SAAOC,cAAa,KAAK,MAAM;AAAA,IAC7B,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IAClC,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB,CAAC;AACH;AAIA,SAAS,aAAa,KAA4B;AAChD,MAAI;AACF,UAAM,IAAI,WAAW,QAAQ;AAC7B,UAAM,OAAO,CAAC,MAAoB;AAChC,iBAAW,QAAQC,aAAY,CAAC,EAAE,KAAK,GAAG;AACxC,cAAM,IAAIC,OAAK,GAAG,IAAI;AACtB,cAAM,KAAK,SAAS,CAAC;AACrB,YAAI,GAAG,YAAY,GAAG;AACpB,eAAK,CAAC;AAAA,QACR,OAAO;AACL,YAAE,OAAO,IAAI;AACb,YAAE,OAAOC,cAAa,CAAC,CAAC;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AACA,SAAK,GAAG;AACR,WAAO,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,iBAA0B;AAAA,EACrC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,IAAI,KAA6C;AAC/C,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,CAAC,YAAY,IAAI,WAAW,WAAW,GAAG;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,cAAc,aAAa,QAAQ;AACzC,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,GAAG,WAAW,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;AAAA,IAC7D,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,IACT;AACA,QAAI;AACJ,QAAI;AACF,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAI,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,IAAI,CAAC;AAAA,QAClD;AAAA;AAAA,QACA,GAAG,IAAI;AAAA,MACT;AAGA,cAAQ,GAAG,WAAW,MAAM,IAAI,QAAQ;AAAA,IAC1C,SAAS,GAAG;AAEV,YAAM,MAAO,EAAmC;AAChD,cAAQ,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,SAAS,MAAM,IAAI;AACrE,UAAI,CAAC,OAAO;AACV,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,EAAE,SAAS,aAAa,IAAI,YAAY,OAAO,IAAI,UAAU;AACnE,WAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,GAAI,QAAQ,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtC;AAAA,EACF;AACF;;;AElCO,IAAM,WAA+B,CAAC,cAAc;AAOpD,SAAS,YAAY,KAAwC;AAClE,MAAI,QAAQ,IAAI,oCAAoC,KAAK;AACvD,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAyB,CAAC;AAChC,aAAW,KAAK,UAAU;AACxB,QAAI;AACF,YAAM,KAAK,EAAE,IAAI,GAAG;AACpB,UAAI,IAAI;AACN,YAAI,KAAK,EAAE;AAAA,MACb;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;;;AC9EA,IAAM,WAAW,oBAAI,IAAI,CAAC,qBAAqB,uBAAuB,YAAY,CAAC;AAa5E,SAAS,aAAa,SAAkB,UAA+B;AAC5E,QAAM,MAAM,CAAC,GAAG,SAAS,MAAM,GAAG,SAAS,KAAK;AAChD,QAAM,KAAK,QAAQ,UAAU;AAC7B,SAAO;AAAA,IACL,SAAS,QAAQ,QAAQ,CAAC,GAAG,OAAO,UAAU;AAAA,IAC9C,OAAO,QAAQ,UAAU;AAAA,IACzB,MAAM;AAAA,MACJ,cAAc,GAAG;AAAA,MACjB,OAAO,GAAG;AAAA,MACV,UAAU,GAAG;AAAA,MACb,OAAO,GAAG;AAAA,MACV,UAAU,GAAG;AAAA,IACf;AAAA,IACA,MAAM,IAAI,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,CAAC;AAAA,IACtE,MAAM,IACH,OAAO,CAAC,MAAM,EAAE,aAAa,UAAU,EAAE,aAAa,UAAU,EAChE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,OAAO,OAAO,EAAE,KAAK,EAAE,EAAE;AAAA,IAChE,MAAM,IACH,IAAI,CAAC,MAAM,EAAE,SAAS,EACtB,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC,EAC9B,IAAI,MAAM;AAAA,IACb,SAAS,IACN,IAAI,CAAC,MAAM,EAAE,aAAa,EAC1B,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC,EAC9B,IAAI,MAAM;AAAA,IACb,QAAQ,0DAA0D,QAAQ,QAAQ,CAAC,GAAG,OAAO,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAAA,EACzH;AACF;AAEO,SAAS,sBAAsB,GAAoB;AACxD,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,0BAAqB,EAAE,KAAK,IAAI,EAAE;AAC7C,QAAM;AAAA,IACJ;AAAA,IACA,GAAG,EAAE,KAAK,YAAY,uBAAoB,EAAE,KAAK,KAAK,eAAY,EAAE,KAAK,QAAQ,kBAAe,EAAE,KAAK,KAAK,0BAAuB,EAAE,KAAK,WAAW,QAAQ,IAAI;AAAA,IACjK;AAAA,EACF;AACA,MAAI,EAAE,KAAK,QAAQ;AACjB,UAAM,KAAK,qBAAc,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE;AAAA,EAC7D;AACA,MAAI,EAAE,KAAK,QAAQ;AACjB,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,SAAS,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,KAAK,QAAQ;AACjB,UAAM,KAAK,wBAAc,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE;AAAA,EAC7D;AACA,MAAI,EAAE,QAAQ,QAAQ;AACpB,UAAM,KAAK,wBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE;AAAA,EACnE;AACA,QAAM,KAAK,uBAAgB,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,SAAO,GAAG,MAAM,KAAK,IAAI,EAAE,QAAQ,CAAC;AAAA;AACtC;;;AC7CA,SAAS,cAAAC,aAAY,kBAAkB;AACvC,SAAS,cAAAC,aAAY,gBAAAC,sBAAoB;AACzC,SAAS,YAAAC,WAAU,QAAAC,cAAY;AAiC/B,IAAM,SAAS,CAAC,MAAsBC,YAAW,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,KAAK;AAkBlF,SAAS,oBAAoB,SAAkC;AACpE,QAAM,SAAyB,CAAC;AAChC,aAAW,KAAK,QAAQ,UAAU;AAChC,WAAO,KAAK,GAAG,cAAc,CAAC,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAGO,SAAS,cAAc,GAAmC;AAC/D,MAAI,EAAE,SAAS,aAAa;AAC1B,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAsB,CAAC;AAC7B,QAAM,QAAQ,EAAE,QAAQ,IAAI,KAAK;AACjC,MAAI,SAAS,IAAI;AACf,QAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,EACjC;AACA,aAAW,KAAK,EAAE,aAAa,CAAC,GAAG;AACjC,QAAI,KAAK,EAAE,MAAM,QAAQ,MAAM,EAAE,MAAM,OAAO,EAAE,SAAS,KAAK,CAAC;AAAA,EACjE;AACA,SAAO;AACT;AAGO,SAAS,YAAY,OAA6B;AACvD,SAAO,OAAO,aAAa,KAAK,CAAC;AACnC;AAsBO,SAAS,WAAW,SAAkB,KAAgC;AAC3E,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,KAAK,oBAAoB,OAAO,GAAG;AAC5C,UAAM,IAAI,YAAY,CAAC;AACvB,SAAK,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC;AAAA,EACpC;AAEA,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,IAAI,OAAO,QAAQ,KAAK;AAC1C,UAAM,IAAI,IAAI,OAAO,CAAC;AACtB,UAAM,IAAI,KAAK,IAAI,CAAC,KAAK;AACzB,QAAI,IAAI,GAAG;AACT,WAAK,IAAI,GAAG,IAAI,CAAC;AACjB;AAAA,IACF,OAAO;AACL;AACA,UAAI,sBAAsB,QAAW;AACnC,4BAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,IAAI,uBAAuB;AAAA,IAC3C,WAAW,IAAI,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGO,IAAM,uBAAuB;AAG7B,SAAS,WAAW,SAAyB;AAClD,QAAM,IAAI,OAAO,KAAK,SAAS,MAAM;AACrC,QAAM,IAAI,OAAO,KAAK,sBAAsB,MAAM;AAClD,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,KAAK,UAAU,EAAE,MAAM,IAAI,oBAAoB,IAAI,EAAE,MAAM,KAAK,MAAM;AAAA,IAC7E;AAAA,EACF,CAAC;AACH;AAWO,SAAS,iBACd,KACA,KACiB;AACjB,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,OAAO,OAAO,IAAI,UAAU,SAAU,QAAO;AAClD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,EAAE,KAAK,OAAO,GAAG,SAAS,IAAI;AACpC,QAAM,OAAO,WAAW,UAAU,GAAG,EAClC,OAAO,WAAW,aAAa,QAAQ,CAAC,CAAC,EACzC,OAAO,KAAK;AACf,SAAO,SAAS,IAAI,QAAQ,aAAa;AAC3C;AAgBO,SAAS,gBACd,SACA,KACA,KAC+B;AAC/B,QAAM,MAAMC,UAAS,QAAQ,YAAY,EAAE,EAAE,QAAQ,YAAY,EAAE;AACnE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAOC,OAAK,KAAK,GAAG,GAAG,OAAO;AACpC,MAAI,CAACC,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAMC,eAAa,MAAM,MAAM,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,IAAI,MAAM,KAAK,IAAI,OAAO,WAAW,EAAG,QAAO;AAClE,QAAM,IAAI,WAAW,SAAS,GAAG;AACjC,QAAM,MAAM,iBAAiB,KAAK,GAAG;AACrC,SAAO;AAAA,IACL,MAAM,EAAE;AAAA,IACR,WAAW,EAAE;AAAA,IACb,SAAS,EAAE;AAAA,IACX,QAAQ,QAAQ,aAAa,aAAa,QAAQ,aAAa,SAAS;AAAA,EAC1E;AACF;;;ACrPA,SAAS,cAAAC,aAAY,eAAAC,oBAAmB;AACxC,SAAS,YAAAC,WAAU,QAAAC,cAAY;AA2DxB,SAAS,sBAAsB,GAAYC,SAA0B;AAC1E,MAAI,eAAe,EAAE,EAAE,MAAM,SAAS;AACpC,WAAO;AAAA,EACT;AACA,MAAI,EAAE,aAAa,OAAO;AACxB,WAAO;AAAA,EACT;AACA,MACE,EAAE,GAAG,WAAW,aAAa,MAC5B,uBAAuB,EAAE,KAAK,KAC7B,yBAAyB,EAAE,KAAK,KAChC,qBAAqB,EAAE,KAAK,IAC9B;AACA,WAAO;AAAA,EACT;AACA,SACE,WAAW,EAAE,IAAI,EAAE,QAAQ,KAAK,EAAE,aAAa,cAAc,EAAE,aAAa,UAAUA;AAE1F;AAEA,IAAM,gBAAgB;AAGtB,IAAM,OAAO,CAAC,MAAsB,EAAE,QAAQ,SAAS,EAAE,EAAE,QAAQ,gBAAgB,EAAE;AAG9E,SAAS,aAAa,YAAwC;AACnE,QAAM,MAAM,GAAG,WAAW,QAAQ,aAAa,EAAE,CAAC;AAClD,SAAOC,YAAW,GAAG,IAAI,MAAM;AACjC;AAQA,eAAsB,qBACpB,YACA,OAA+C,CAAC,GACT;AACvC,QAAM,MAAM,aAAa,UAAU;AACnC,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,CAAC;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ;AACjB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,OAAO,IAAI,KAAK,KAAK,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC;AACrD,QAAM,YAAY,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,MAAMC,UAAS,CAAC,CAAC,CAAC;AAC3D,QAAM,WAAgC,CAAC;AACvC,MAAI,aAAa;AACjB,aAAW,QAAQ,MAAM,MAAM,GAAG,GAAG,GAAG;AACtC,QAAI;AACJ,QAAI;AAIF,YAAM,IAAI,MAAM,SAAS,eAAeC,OAAK,KAAK,IAAI,CAAC;AACvD,UAAI,CAAC,GAAG;AACN;AAAA,MACF;AACA,YAAM,UAAU,YAAY,CAAC;AAE7B,UAAI,QAAQ,aAAa,WAAW,KAAK,QAAQ,SAAS,WAAW,GAAG;AACtE;AAAA,MACF;AACA,YAAM,OAAO,eAAe,OAAO;AACnC,iBAAW;AAAA,QACT,OAAO,QAAQ,QAAQ,UAAU,EAAE,SAAS,IAAI,QAAQ,QAAQ,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG;AAAA,QACzF,SAASD,UAAS,IAAI,EACnB,QAAQ,WAAW,EAAE,EACrB,QAAQ,aAAa,EAAE;AAAA,QAC1B,UAAU,CAAC,GAAG,KAAK,MAAM,GAAG,KAAK,KAAK;AAAA,MACxC;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AACA;AACA,eAAW,KAAK,SAAS,UAAU;AACjC,YAAMH,UACJ,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI,KAAK,EAAE,QAAQ,CAAC,KAAK,UAAU,IAAIG,UAAS,EAAE,QAAQ,CAAC;AACnF,UAAI,sBAAsB,GAAGH,OAAM,GAAG;AACpC,iBAAS,KAAK;AAAA,UACZ,SAAS,SAAS;AAAA,UAClB,OAAO,SAAS;AAAA,UAChB,IAAI,EAAE;AAAA,UACN,UAAU,EAAE;AAAA,UACZ,OAAO,EAAE;AAAA,UACT,QAAQ,EAAE;AAAA,UACV,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,OAAO,MAAM,QAAQ,YAAY,SAAS;AACrD;;;AzBxDA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4Gb,IAAM,WAAW,oBAAI,IAAa;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA+CM,SAAS,UAAU,MAA4B;AACpD,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,QAAM,SAAqB;AAAA,IACzB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,SAAS;AAAA,IACT,IAAI;AAAA,IACJ,OAAO,CAAC,QAAQ,IAAI,YAAY,QAAQ,OAAO,UAAU;AAAA,EAC3D;AACA,QAAM,cAAwB,CAAC;AAC/B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,QAAQ,MAAM,UAAU;AAChC,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,QAAQ,MAAM,aAAa;AAC1C,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,WAAW;AAC1B,YAAM,IAAI,KAAK,EAAE,CAAC;AAClB,UAAI;AACF,eAAO,QAAQ,EACZ,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,IACrB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO,KAAK,EAAE,CAAC;AAAA,IACxB,WAAW,MAAM,WAAW;AAC1B,aAAO,UAAU,KAAK,EAAE,CAAC;AAAA,IAC3B,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ;AAAA,IACjB,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,YAAY;AAC3B,aAAO,SAAS;AAAA,IAClB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,SAAS;AACxB,aAAO,MAAM,KAAK,EAAE,CAAC;AAAA,IACvB,WAAW,MAAM,YAAY;AAC3B,aAAO,SAAS,KAAK,EAAE,CAAC;AAAA,IAC1B,WAAW,MAAM,YAAY;AAC3B,aAAO,cAAc,KAAK,EAAE,CAAC;AAAA,IAC/B,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO,KAAK,EAAE,CAAC;AAAA,IACxB,WAAW,MAAM,cAAc;AAC7B,aAAO,WAAW,KAAK,EAAE,CAAC;AAAA,IAC5B,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ,KAAK,EAAE,CAAC;AAAA,IACzB,WAAW,MAAM,gBAAgB;AAC/B,aAAO,aAAa,KAAK,EAAE,CAAC;AAAA,IAC9B,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU,KAAK,EAAE,CAAC;AAAA,IAC3B,WAAW,MAAM,UAAU;AACzB,YAAM,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;AAC1B,UAAI,OAAO,SAAS,CAAC,KAAK,IAAI,GAAG;AAC/B,eAAO,OAAO,KAAK,MAAM,CAAC;AAAA,MAC5B;AAAA,IACF,WAAW,MAAM,aAAa;AAC5B,aAAO,SAAS;AAAA,IAClB,WAAW,MAAM,mBAAmB;AAClC,aAAO,eAAe;AAAA,IACxB,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,QAAQ;AACvB,aAAO,KAAK;AAAA,IACd,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ;AAAA,IACjB,WAAW,MAAM,YAAY;AAC3B,aAAO,UAAU,KAAK,EAAE,CAAC,KAAK,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IAC7D,WAAW,MAAM,WAAW;AAC1B,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,QAAQ,SAAS,EAAE,SAAS,IAAmB,GAAG;AACpD,eAAO,QAAQ;AACf;AAAA,MACF,WAAW,SAAS,YAAY,SAAS,WAAW,SAAS,OAAO;AAClE,eAAO,cAAc;AACrB;AAAA,MACF;AAAA,IACF,WAAW,MAAM,cAAc;AAC7B,aAAO,QAAQ;AAAA,IACjB,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ;AAAA,IACjB,WAAW,CAAC,EAAE,WAAW,GAAG,GAAG;AAC7B,kBAAY,KAAK,CAAC;AAAA,IACpB;AAAA,EACF;AACA,MAAI,YAAY,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,CAAY,GAAG;AAC7D,WAAO,UAAU,YAAY,CAAC;AAC9B,WAAO,OAAO,YAAY,CAAC;AAC3B,WAAO,SAAS,YAAY,CAAC;AAAA,EAC/B,OAAO;AACL,WAAO,WAAW,YAAY,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,MAAiC;AACzD,QAAM,OAAO,UAAU,IAAI;AAE3B,MAAI,KAAK,SAAS;AAChB,YAAQ,OAAO,MAAM,GAAG,WAAW,CAAC;AAAA,CAAI;AACxC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAChC,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,YAAY,YAAY;AAC/B,WAAO,YAAY,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU,KAAK,MAAM;AAAA,MAC1B,YAAY,KAAK;AAAA,MACjB,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,KAAK,MAAM,KAAK,QAAQ,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EAC3E;AACA,MAAI,KAAK,YAAY,OAAO;AAC1B,WAAO,OAAO,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EAC9E;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EAC/D;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,KAAK,YAAY,OAAO;AAC1B,WAAO,OAAO,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,EACtF;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,EAAE,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,EACzE;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,EAC9C;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,EAC9C;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU,KAAK,MAAM,EAAE,QAAQ,KAAK,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,MAAM,CAAC;AAAA,EACvF;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EACpD;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,EAAE,SAAS,KAAK,SAAS,QAAQ,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,CAAC;AAAA,EAC/F;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,KAAK,MAAM,KAAK,eAAe,QAAQ;AAAA,EACxD;AACA,MAAI,KAAK,YAAY,gBAAgB;AACnC,WAAO,eAAe;AAAA,EACxB;AACA,MAAI,KAAK,YAAY,eAAe;AAClC,WAAO,cAAc;AAAA,EACvB;AACA,MAAI,KAAK,YAAY,YAAY;AAC/B,WAAO,YAAY,KAAK,MAAM;AAAA,MAC5B,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,cAAc;AAEjC,WAAO,cAAc;AAAA,MACnB,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU;AAAA,MACf,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,MAAM;AACzB,WAAO,MAAM;AAAA,MACX,KAAK,KAAK;AAAA,MACV,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,cAAc,KAAK;AAAA,MACnB,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IACjB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,aAAa;AAChC,WAAO,aAAa,EAAE,QAAQ,KAAK,YAAY,CAAC;AAAA,EAClD;AACA,MAAI,KAAK,YAAY,WAAW;AAE9B,QAAI,QAAQ,IAAI,qBAAqB,KAAK;AACxC,cAAQ,OAAO;AAAA,QACb;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,cAAc,KAAK;AAAA,MACnB,SAAS;AAAA,MACT,UAAU,KAAK;AAAA,IACjB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU,EAAE,UAAU,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAC9E;AACA,MAAI,KAAK,YAAY,WAAW;AAC9B,WAAO,WAAW,EAAE,UAAU,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAC/E;AACA,MAAI,KAAK,YAAY,OAAO;AAE1B,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,iBAAiB;AACrD,UAAM,WAAW;AAGjB,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,cAAQ,MAAM,KAAK,SAAS,OAAO;AACnC,cAAQ,MAAM,KAAK,OAAO,OAAO;AAAA,IACnC,CAAC;AACD,WAAO;AAAA,EACT;AAEA,MAAI,CAAE,MAAM,YAAY,GAAI;AAC1B,YAAQ,OAAO;AAAA,MACb,oCAAoC,UAAU,CAAC;AAAA;AAAA;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,MAAM,aAAa,KAAK,KAAK;AAE9C,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,WAAW,UAAU,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;AAChE,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,cAAc,UAAU,KAAK,QAAQ;AACrD,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,KAAK,WACD,uBAAuB,KAAK,QAAQ;AAAA,IACpC;AAAA,IACN;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,YAAY,OAAO;AACnC,QAAM,WAAW,eAAe,OAAO;AAEvC,MAAI,KAAK,MAAM;AACb,QAAI,UAAU,MAAM,aAAa,SAAS,SAAS,QAAQ;AAC3D,QAAI,KAAK,QAAQ;AACf,gBAAU,cAAc,OAAO;AAAA,IACjC;AACA,UAAM,MAAM,KAAK,UAAU,aAAa,OAAO,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC;AAClF,QAAI,KAAK,KAAK;AACZ,MAAAK,eAAc,KAAK,KAAK,GAAG,GAAG;AAAA,CAAI;AAClC,cAAQ,OAAO,MAAM,sBAAsB,KAAK,GAAG;AAAA,CAAI;AACvD,aAAO;AAAA,IACT;AACA,SAAK,KAAK,KAAK,MAAM,SAAS;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,OAAO;AACd,UAAM,KAAK,oBAAoB,EAAE,SAAS,SAAS,SAAS,SAAS,CAAC;AACtE,SAAK,GAAG,QAAQ,GAAG,KAAK,MAAM,mBAAmB;AACjD,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,SAAS;AAChB,UAAM,UAAU,cAAc,MAAM,aAAa,SAAS,SAAS,QAAQ,CAAC;AAC5E,UAAM,KAAK,sBAAsB,aAAa,SAAS,QAAQ,CAAC;AAChE,SAAK,GAAG,QAAQ,GAAG,KAAK,MAAM,SAAS;AACvC,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,MAAM,WAAW,EAAE,SAAS,SAAS,SAAS,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;AACtF,SAAO;AACT;AAEA,SAASC,KAAI,MAAwB;AACnC,QAAM,IAAIC,WAAU,OAAO,MAAM,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,EAAE,WAAW,IAAI,EAAE,OAAO,KAAK,IAAI;AAC5C;AASA,IAAM,iBAAiB;AAWhB,SAAS,YAAY,SAAyB,OAAkC;AACrF,SAAO,QAAQ,aAAa,OAAO,CAAC,MAAM,OAAO,EAAE,MAAM,KAAK,CAAC,EAAE;AACnE;AAMO,SAAS,cAAc,MAA8B;AAC1D,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,MAAMD,KAAI,CAAC,OAAO,aAAa,gBAAgB,GAAG,IAAI,QAAQ,CAAC;AACrE,QAAM,QAAQ,OAAO,IAAI,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;AAC/C,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ,MAAO;AAC9D;AAKO,SAAS,eAAe,SAA6B,SAAiC;AAC3F,SAAO,WAAW,QAAQ,WAAW,QAAQ,UAAU;AACzD;AAaA,eAAe,YACb,KACA,QACA,UACA,OACA,UAAyB,MACzB,OAA0B,CAAC,GACI;AAC/B,QAAM,OAAO,OAAO,QAAuD;AACzE,UAAM,UAAU,MAAM,YAAY,GAAG;AACrC,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,IACT;AACA,WAAO,EAAE,SAAS,KAAK,SAAS,SAAS,YAAY,OAAO,EAAE;AAAA,EAChE;AASA,MAAI,KAAK,SAAS,GAAG;AACnB,eAAW,OAAO,IAAI,MAAM,GAAG,cAAc,GAAG;AAC9C,YAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,UAAI,QAAQ,eAAe,KAAK,QAAQ,OAAO,IAAI,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,gBAAgB,KAAK,QAAQ,QAAQ;AACxD,QAAM,UAAU,aAAa,MAAM,KAAK,UAAU,IAAI;AACtD,MAAI,WAAW,YAAY,QAAQ,SAAS,KAAK,IAAI,GAAG;AACtD,WAAO;AAAA,EACT;AAQA,MAAI,OAA6B;AACjC,MAAI,YAAY;AAChB,QAAM,SAAS,IACZ,OAAO,CAAC,MAAM,OAAO,EAAE,aAAa,QAAQ,CAAC,EAC7C,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,OAAO,CAAC,EACjD,MAAM,GAAG,cAAc;AAC1B,aAAW,OAAO,QAAQ;AACxB,UAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,QAAI,CAAC,MAAM;AACT;AAAA,IACF;AACA,UAAM,QAAQ,YAAY,KAAK,SAAS,KAAK;AAC7C,QAAI,QAAQ,WAAW;AACrB,aAAO;AACP,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;AAQA,eAAe,aAAa,MAA4C;AACtE,MAAI,CAAC,QAAQ,IAAI,oBAAoB;AACnC,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,UAAUA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,QAAM,WAAWA,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,MAAI,CAAC,UAAU,WAAW,QAAQ;AAChC,YAAQ,OAAO,MAAM,kEAAkE;AACvF,WAAO;AAAA,EACT;AAGA,QAAM,MAAM,MAAM,aAAa;AAC/B,QAAM,OAAO,aAAa,QAAW,CAAC,CAAC;AACvC,MAAI,UAA0D;AAC9D,MAAI,MAAM;AACR,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,cAAc,KAAK,IAAI;AAAA,MACvB,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,cAAU,QAAQ,WAAW;AAAA,EAC/B;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,gBAAgB,KAAK,QAAQ,QAAQ;AACrD,cAAU,UAAU,MAAM,YAAY,OAAO,IAAI;AAAA,EACnD;AACA,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,0DAA0D,MAAM;AAAA,CAAM;AAC3F,WAAO;AAAA,EACT;AACA,QAAM,YACJ,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,IAAI,GAAG,QAAQ;AACzF,QAAM,YAAY,kBAAkB,QAAQ,QAAQ;AACpD,QAAM,MAAM,iBAAiB,WAAW,WAAW,YAAW,oBAAI,KAAK,GAAE,YAAY,CAAC;AACtF,QAAM,WAAW,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;AAClD,UAAQ,OAAO;AAAA,IACb,uBAAuB,IAAI,MAAM,SAAS,IAAI,WAAW,IAAI,KAAK,GAAG,gBAAa,IAAI,KAAK,MAAM,gBAAgB,QAAQ,cAAc,aAAa,IAAI,KAAK,GAAG,yBAAoB,SAAS;AAAA;AAAA,EAC/L;AACA,SAAO;AACT;AAEA,eAAe,MAAM,MAcD;AAClB,QAAM,SAAS,KAAK,UAAUA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,QAAM,WAAWA,KAAI,CAAC,aAAa,iBAAiB,CAAC;AACrD,MAAI,CAAC,UAAU,WAAW,QAAQ;AAChC,YAAQ,OAAO,MAAM,2DAA2D;AAChF,WAAO;AAAA,EACT;AAKA,QAAM,OAAO,KAAK,eACd,OACA,aAAa,KAAK,MAAM,EAAE,oBAAoB,KAAK,cAAc,CAAC;AACtE,QAAM,MAAM,MAAM,aAAa;AAC/B,QAAM,SAAS,OACX,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,KAAK,IAAI;AAAA,IACvB,WAAW,KAAK,IAAI;AAAA,EACtB,IACA,OAAO,YAAY;AACjB,UAAM,MAAM,gBAAgB,KAAK,QAAQ,YAAY,MAAS;AAC9D,WAAO,MAAM,EAAE,SAAS,KAAK,SAAS,MAAM,YAAY,GAAG,GAAG,SAAS,KAAK,IAAI;AAAA,EAClF,GAAG;AAEP,MAAI,CAAC,UAAU,CAAC,OAAO,SAAS;AAC9B,YAAQ,OAAO;AAAA,MACb,mDAAmD,MAAM;AAAA;AAAA;AAAA,IAC3D;AACA,WAAO;AAAA,EACT;AACA,QAAM,EAAE,SAAS,QAAQ,IAAI;AAK7B,QAAM,WAAW,aAAa,YAAY,KAAK,KAAK,QAAQ;AAE5D,MAAI,gBAAgB;AACpB,MAAI,UAAU,OAAO,WAAW,YAAY,OAAO;AACnD,MAAI,SAAS,QAAQ;AACnB,YAAQ,WAAW;AAAA,EACrB;AACA,MAAI,WAAW,eAAe,OAAO;AAGrC,MAAI,aAAa,SAAS,SACtB,kBAAkB,SAAS,CAAC,GAAG,SAAS,MAAM,GAAG,SAAS,KAAK,CAAC,IAChE;AACJ,MAAI,QAAsB,EAAE,MAAM,UAAU;AAC5C,MAAI,YAAY;AAEhB,MAAI,MAAM;AACR,UAAM,KAAK,eAAe,SAAS,UAAU,KAAK,OAAO,QAAQ,WAAW;AAC5E,cAAU,GAAG;AACb,eAAW,GAAG;AAId,YAAQ,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,OAAO,KAAK,OAAO,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG;AAI1F,UAAM,YAAY,QAAQ,IAAI,4BAA4B,IACvD,MAAM,MAAM,EACZ,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,QAAI,SAAS,QAAQ;AACnB,YAAM,iBAAiB;AAAA,IACzB;AACA,gBAAY,WAAW,KAAK,IAAI,KAAK,KAAK,MAAM,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAGhG,UAAM,QAAQ,cAAc,SAAS,MAAM;AAC3C,QAAI,MAAM,aAAa,QAAQ,YAAY,KAAK,IAAI,MAAM,KAAK,KAAK;AACpE,QAAI,CAAC,KAAK;AAKR,YAAM,OAAO,WAAW,KAAK,IAAI;AACjC,YAAM,MAAM,UAAU,QAAQ,OAAO,IAAI;AACzC,UAAI,KAAK;AACP,cAAM,eAAe,SAAS,KAAK,OAAO,GAAG;AAC7C,YAAI,KAAK;AACP,gBAAM,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK;AACP,gBAAU,EAAE,GAAG,SAAS,aAAa,IAAI,MAAM,YAAY,IAAI,QAAQ,WAAW,IAAI,MAAM;AAC5F,YAAM,SAAS;AAAA,IACjB;AAAA,EACF,WAAW,CAAC,KAAK,cAAc;AAC7B,UAAM,QAAQ,cAAc,SAAS,MAAM;AAC3C,QAAI,OAAO;AACT,sBAAgB;AAChB,gBAAU,YAAY,KAAK;AAC3B,UAAI,SAAS,QAAQ;AACnB,gBAAQ,WAAW;AAAA,MACrB;AACA,iBAAW,eAAe,OAAO;AACjC,mBAAa,SAAS,SAClB,kBAAkB,SAAS,CAAC,GAAG,SAAS,MAAM,GAAG,SAAS,KAAK,CAAC,IAChE;AACJ,cAAQ,EAAE,MAAM,UAAU,OAAO;AACjC,kBAAY,UAAU,MAAM;AAAA,IAC9B,OAAO;AACL,kBAAY;AAAA,IACd;AAAA,EACF;AAIA,QAAM,cAAc,gBAAgB,kBAAkB,cAAc,QAAQ,CAAC;AAG7E,QAAM,gBAAgB,kBAAkB,kBAAkB,cAAc,QAAQ,CAAC;AAGjF,QAAM,YAAY,MAAM,qBAAqB,cAAc,UAAU;AAAA,IACnE,WAAW,OAAO,SAAS,SAAS,MAAM,QAAQ;AAAA,EACpD,CAAC;AAGD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,IAAI,wBACV,QAAQ,IAAI,+BACZE,OAAKC,SAAQ,GAAG,oBAAoB,SAAS;AAAA,IAC/C,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;AAAA,EAClD;AAGA,QAAM,WACJ,MAAM,SAAS,UAAU,MAAM,OAAO,SAClC,YAAY,EAAE,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,UAAU,YAAY,OAAU,CAAC,IAC1F,CAAC;AACP,QAAM,UAAU;AAAA,IACd,MAAM,aAAa,eAAe,SAAS,UAAU;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAKA,QAAM,IAAI,QAAQ;AAClB,MAAI,YAAY,MAAM,SAAS,QAAQ;AACrC,UAAM,OAAO,OAAO,QAAQ,UAAU,GAAG;AACzC,QAAI,WAA0B;AAC9B,QAAI;AACF,iBAAW,eAAe,MAAM,QAAQ;AACxC,UAAI,YAAY,MAAM;AACpB,cAAM,IAAID,OAAK,UAAU,aAAa,GAAG,IAAI,OAAO;AACpD,mBAAWE,YAAW,CAAC,IAAIC,eAAa,GAAG,MAAM,IAAI;AAAA,MACvD;AAAA,IACF,QAAQ;AACN,iBAAW;AAAA,IACb;AACA,QAAI,YAAY,MAAM;AACpB,UAAI;AACF,cAAM,OAAQ,KAAK,MAAM,QAAQ,EAAc;AAC/C,cAAM,cACJ,KAAK,SAAS,cAAc,EAAE,QAAQ,aACtC,KAAK,SAAS,UAAU,EAAE,QAAQ;AACpC,YAAI,EAAE,SAAS,eAAe,MAAM;AAClC,gBAAM,WAAW,cACZ,KAAK,UAAU,YAAY,IAC3B,KAAK,UAAU,YAAY,KAAK,SAAS,eAAe;AAC7D,gBAAM,WAAW,cACZ,KAAK,UAAU,YAAY,KAC3B,KAAK,UAAU,YAAY,KAAK;AACrC,cAAI,WAAW,GAAG;AAChB,cAAE,WAAW;AAAA,cACX,UAAU,KAAK,MAAM,WAAW,GAAG,IAAI;AAAA,cACvC,UAAU,KAAK,OAAO,WAAW,EAAE,SAAS,eAAe,GAAG,IAAI;AAAA,cAClE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAIA,cAAM,cAAc,qBAAqB,KAAK,YAAY,CAAC,CAAC;AAC5D,cAAM,cAAc,qBAAqB,EAAE,QAAQ;AACnD,cAAM,WAAW,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC;AAClD,cAAM,WAAW,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC;AAClD,cAAM,aAAa,YAChB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EACxC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,EAAG,EAAE;AACnF,cAAM,WAAW,YAAY,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE;AACvE,cAAM,OAAO,KAAK,WAAW,SACzB,KAAK,YACL;AAAA,UACE;AAAA,YACE,MAAM;AAAA,YACN,GAAI,KAAK,SAAS,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,IAAI,CAAC;AAAA,YACjE,KAAK,YAAY;AAAA,YACjB,SAAS;AAAA,YACT,MAAM,YAAY;AAAA,YAClB,GAAI,KAAK,SAAS,eAAe,OAC7B,EAAE,SAAS,KAAK,SAAS,YAAY,IACrC,CAAC;AAAA,UACP;AAAA,QACF;AAIJ,cAAM,MAAML,KAAI,CAAC,aAAa,aAAa,MAAM,CAAC,KAAK;AACvD,cAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,cAAM,WAAW,CAAC,CAAC,OAAO,KAAK,QAAQ;AACvC,cAAMM,SAAQ;AAAA,UACZ,MAAM,WAAW,KAAK,OAAO,KAAK,OAAO;AAAA,UACzC,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,UACrB,GAAI,EAAE,QAAQ,UAAU,EAAE,SAAS,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,UAC1D,KAAK;AAAA,UACL,SAAS,WAAW;AAAA,UACpB,MAAM,YAAY;AAAA,UAClB,GAAI,EAAE,SAAS,eAAe,OAAO,EAAE,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,QAC9E;AACA,UAAE,YAAY,CAAC,GAAI,WAAW,KAAK,MAAM,GAAG,EAAE,IAAI,MAAOA,MAAK,EAAE,MAAM,GAAG;AACzE,YAAI,WAAW,QAAQ;AACrB,YAAE,YAAY;AAAA,QAChB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAMA,MAAI,KAAK,SAAS;AAChB,YAAQ,OAAO;AAAA,MACb,gBAAgB,SAAS,EAAE,YAAY,QAAQ,IAAI,yBAAyB,IAAI,CAAC;AAAA,IACnF;AACA,YAAQ,OAAO;AAAA,MACb,+CAA+C,SAAS;AAAA;AAAA,IAC1D;AACA,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA;AAMhD,QAAM,SACJ,KAAK,SACL,QAAQ,IAAI,mBACX,WACI,cAAc,QAAQ,KAAK,cAAc,gBAAgB,QAAQ,KAAK,EAAE,IACzE,WACJ,UACA,YAAY;AACd,MAAI,UAAU,QAAQ;AACpB,YAAQ,OAAO,MAAM,IAAI;AACzB,YAAQ,OAAO;AAAA,MACb,6DAAwD,QAAQ,UAAU,KAAK,KAAK,SAAS;AAAA;AAAA,IAC/F;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,SAAS,QAAQ,EAAE,SAAS,KAAK,GAAG;AACpD,YAAQ,OAAO;AAAA,MACb,sBAAsB,KAAK;AAAA;AAAA,IAC7B;AAAA,EACF,WAAW,UAAU,YAAY,UAAU,OAAO;AAChD,YAAQ,OAAO,MAAM,8BAA8B,KAAK;AAAA,CAAwB;AAAA,EAClF;AAEA,QAAM,OAAO,OAAO,QAAQ,UAAU,GAAG;AAKzC,MAAI,UAAU,OAAO;AACnB,UAAM,IAAI,gBAAgB,MAAM,QAAQ,MAAM,QAAQ,SAAS,YAAY,MAAS;AACpF,QAAI,EAAE,IAAI;AACR,cAAQ,OAAO;AAAA,QACb,sBAAsB,EAAE,GAAG,WAAW,QAAQ,UAAU,KAAK,KAAK,SAAS,WAAW,QAAQ,SAAS,UAAU;AAAA;AAAA,MACnH;AACA,aAAO;AAAA,IACT;AACA,YAAQ,OAAO,MAAM,kCAAkC,EAAE,MAAM;AAAA,CAAyB;AAAA,EAC1F;AAEA,QAAM,MAAMJ,OAAK,YAAY,KAAK,WAAW;AAC7C,QAAM,MAAM,KAAK,OAAOA,OAAK,KAAK,GAAG,IAAI,OAAO;AAChD,EAAAK,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAIlC,QAAM,QAAQL,OAAK,KAAK,gBAAgB;AACxC,MAAI,CAACE,YAAW,KAAK,GAAG;AACtB,IAAAL,eAAc,OAAO,wBAAwB;AAC7C,IAAAC,KAAI,CAAC,OAAO,KAAK,CAAC;AAAA,EACpB;AACA,EAAAD,eAAc,KAAK,IAAI;AACvB,EAAAC,KAAI,CAAC,OAAO,GAAG,CAAC;AAEhB,QAAM,MAAM,WAAW,SAAS,UAAU,GAAG,IAAI;AACjD,UAAQ,OAAO;AAAA,IACb,sBAAsB,GAAG,WAAW,QAAQ,UAAU,KAAK,KAAK,SAAS,WAAW,QAAQ,SAAS,UAAU;AAAA;AAAA,EACjH;AACA,SAAO;AACT;AAMA,eAAe,cAAc,MAOT;AAClB,MAAI,CAAE,MAAM,YAAY,GAAI;AAC1B,YAAQ,OAAO,MAAM,oCAAoC,UAAU,CAAC;AAAA,CAAK;AACzE,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,OAAO,KAAK;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,YAAY,WAAW,GAAG;AAC5B,YAAQ,OAAO,MAAM,oCAAoC;AACzD,WAAO;AAAA,EACT;AACA,QAAM,cAAc,YAAY,IAAI,CAAC,MAAM,EAAE,QAAQ;AAErD,QAAM,QAAQ,kBAAkB,WAAW;AAC3C,QAAM,QAAQ,sBAAsB,OAAO,KAAK,OAAO,SAAS,IAAI;AAEpE,MAAI,KAAK,KAAK;AACZ,UAAM,WAAWI,YAAW,KAAK,GAAG,IAAIC,eAAa,KAAK,KAAK,MAAM,IAAI;AACzE,IAAAN,eAAc,KAAK,KAAK,wBAAwB,UAAU,KAAK,CAAC;AAChE,YAAQ,OAAO;AAAA,MACb,qBAAqB,MAAM,MAAM,eAAe,KAAK,GAAG,UAAU,YAAY,MAAM,WAAW,YAAY,WAAW,IAAI,KAAK,GAAG;AAAA;AAAA,IACpI;AACA,WAAO;AAAA,EACT;AAEA,OAAK,OAAO,KAAK,QAAQ,OAAO,YAAY;AAC5C,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,kBAAkB,YAAY,MAAM;AAAA,CAAc;AAAA,EACzE;AACA,SAAO;AACT;AAOA,eAAe,UAAU,MAQL;AAClB,MAAI,CAAE,MAAM,YAAY,GAAI;AAC1B,YAAQ,OAAO,MAAM,oCAAoC,UAAU,CAAC;AAAA,CAAK;AACzE,WAAO;AAAA,EACT;AAIA,QAAM,YAAY,KAAK,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,KAAK,WAAW,IAAI;AAC/E,QAAM,cAAc,MAAM;AAAA,IACxB,KAAK,QAAQ,KAAK,OAAO,IACrB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,IACrC,KAAK,WACH,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,SAAS,IAC7C,EAAE,OAAO,KAAK,OAAO,MAAM,GAAG;AAAA,EACtC;AACA,MAAI,YAAY,WAAW,GAAG;AAC5B,YAAQ,OAAO,MAAM,iCAAiC;AACtD,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,YACZ,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,UAAU,EAAE,SAAS,EAAE;AAC5D,QAAM,SAAS,cAAc,QAAQ,SAAS;AAE9C,MAAI,KAAK,KAAK;AACZ,UAAM,QAAQ,aAAa,QAAQ,IAAI;AACvC,UAAM,WAAWK,YAAW,KAAK,GAAG,IAAIC,eAAa,KAAK,KAAK,MAAM,IAAI;AACzE,IAAAN,eAAc,KAAK,KAAK,oBAAoB,UAAU,KAAK,CAAC;AAC5D,YAAQ,OAAO;AAAA,MACb,4BAA4B,KAAK,GAAG,UAAU,OAAO,OAAO,IAAI;AAAA;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,MAAM;AACb,SAAK,aAAa,QAAQ,MAAM,GAAG,KAAK,QAAQ,OAAO,QAAQ;AAC/D,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,MAAM,aAAa,QAAQ,QAAQ,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;AACxE,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,gBAAgB,aAAa,QAAQ,QAAQ,EAAE,OAAO,MAAM,CAAC,CAAC;AACzE,YAAQ,OAAO;AAAA,MACb,KAAK,kCAAkC;AAAA,IACzC;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,YAAY,MAAuB;AAC1C,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,2CAA2C;AAChE,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,UAAU,KAAK,MAAMM,eAAa,MAAM,MAAM,CAAC;AACrD,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,eAAe,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5E,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,kBAAkB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC5F,WAAO;AAAA,EACT;AACF;AAGA,eAAe,UACb,MACA,OAAmE,CAAC,GACnD;AACjB,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,wEAAwE;AAC7F,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMA,eAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,kBAAkB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,CAAC,OAAO,IAAI;AACd,YAAQ,OAAO,MAAM,2BAAsB;AAC3C,eAAW,KAAK,OAAO,QAAQ;AAC7B,cAAQ,OAAO,MAAM,OAAO,CAAC;AAAA,CAAI;AAAA,IACnC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,OAAO,SACf,SAAS,OAAO,kBAAkB,SAAY,gBAAa,OAAO,aAAa,KAAK,EAAE,KACtF;AACJ,UAAQ,OAAO,MAAM,qCAA2B,OAAO,KAAK,SAAM,GAAG;AAAA,CAAI;AACzE,MAAI,OAAO,QAAQ;AACjB,YAAQ,OAAO,MAAM,aAAa,OAAO,MAAM;AAAA,CAAI;AAAA,EACrD;AAIA,MAAI,KAAK,SAAS;AAChB,QAAI,CAAC,KAAK,YAAY;AACpB,cAAQ,OAAO,MAAM,wEAAmE;AACxF,aAAO;AAAA,IACT;AACA,UAAM,OAAO,MAAM,gBAAgB,KAAK,YAAY,KAAK,OAAO;AAChE,QAAI,SAAS,GAAG;AACd,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI,KAAK,cAAc,OAAO,SAAS;AACrC,UAAM,MAAM,MAAM,oBAAoB,OAAO,SAAS,KAAK,YAAY,EAAE,QAAQ,KAAK,OAAO,CAAC;AAC9F,QAAI,CAAC,IAAI,WAAW;AAClB,cAAQ,OAAO,MAAM,6DAAwD;AAC7E,aAAO;AAAA,IACT;AACA,QAAI,CAAC,IAAI,SAAS;AAChB,cAAQ,OAAO;AAAA,QACb;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,YAAQ,OAAO,MAAM,8DAAoD;AACzE,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,eAAe,MAAiC;AACvD,MAAI;AACJ,MAAI;AACF,QAAI,KAAK,MAAMA,eAAa,MAAM,MAAM,CAAC;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,OAAO,MAAM,YAAY,MAAM,QAAS,EAAiB,MAAM,GAAG;AACzE,WAAO;AAAA,EACT;AAEA,QAAM,UAAW,GAA6B;AAC9C,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI;AACF,YAAM,QAAQ,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC;AACxE,UAAI,SAAS,MAAM,QAAQ,MAAM,MAAM,GAAG;AACxC,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAe,gBAAgB,YAAoB,aAAsC;AACvF,QAAM,MAAM,eAAe,WAAW;AACtC,MAAI,CAAC,KAAK;AACR,YAAQ,OAAO,MAAM,8CAAyC,WAAW;AAAA,CAAI;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,SAAS,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;AAC/D,QAAM,WAAW,iBAAiB,KAA2C,MAAM;AACnF,MAAI,aAAa,OAAO;AACtB,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,SAAS,eAAe,UAAU;AACxD,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,0CAAqC,UAAU;AAAA,CAAI;AACxE,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,SAAS,GAAG;AACjC,MAAI,EAAE,SAAS,sBAAsB;AACnC,YAAQ,OAAO;AAAA,MACb,sCAA4B,EAAE,OAAO,OAAO,EAAE,SAAS,mFAAmF,EAAE,iBAAiB;AAAA;AAAA,IAC/J;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,EAAE,cAAc,IAAI,KAAK,WAAM,EAAE,OAAO,IAAI,EAAE,SAAS;AACnE,QAAM,UACJ,aAAa,aACT,6BACA,aAAa,WACX,sDACA;AACR,UAAQ,OAAO,MAAM,wCAAmC,GAAG,GAAG,OAAO;AAAA,CAAI;AACzE,SAAO;AACT;AAGA,SAAS,QACP,OACA,OACA,OAAyC,CAAC,GAClC;AACR,MAAI,QAAQ;AACZ,MAAI,QAAQ;AAGZ,MAAI,CAAC,SAAS,CAAC,OAAO;AACpB,UAAM,OAAO,mBAAmB,WAAW;AAC3C,QAAI,KAAK,SAAS,GAAG;AACnB,cAAQ,OAAO;AAAA,QACb,2CAA2C,KAAK,MAAM;AAAA;AAAA,MACxD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,CAAC,SAChB,KAAK,SAAS,MAAM,IAAI,OAAOH,OAAK,aAAa,GAAG,IAAI,OAAO;AACjE,YAAQ,SAAS,KAAK,CAAC,EAAE,IAAI;AAC7B,YAAQ,SAAS,KAAK,CAAC,EAAE,IAAI;AAC7B,YAAQ,OAAO,MAAM,kBAAkB,KAAK,CAAC,EAAE,IAAI,WAAM,KAAK,CAAC,EAAE,IAAI;AAAA;AAAA,CAAwB;AAAA,EAC/F;AACA,MAAI,CAAC,SAAS,CAAC,OAAO;AACpB,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,CAAC,MAA8B;AAC1C,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,EAAE,SAAS,MAAM,IAAI,eAAe,EAAE,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI;AAC9E,cAAQ,KAAK,MAAM,OAAOG,eAAa,GAAG,MAAM,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,kBAAkB,CAAC,KAAK,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AACzF,aAAO;AAAA,IACT;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,cAAQ,OAAO,MAAM,UAAK,CAAC;AAAA,CAA4B;AACvD,iBAAW,KAAK,IAAI,OAAQ,SAAQ,OAAO,MAAM,OAAO,CAAC;AAAA,CAAI;AAC7D,aAAO;AAAA,IACT;AACA,WAAO,IAAI;AAAA,EACb;AACA,QAAM,IAAI,KAAK,KAAK;AACpB,QAAM,IAAI,KAAK,KAAK;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AAErB,QAAM,QAAQ,aAAa,GAAG,CAAC;AAC/B,QAAM,SAAS,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,WAAW,KAAK;AACnF,MAAI,KAAK,KAAK;AACZ,IAAAN,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,wBAAwB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC3D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,SAAS,OACP,SACA,OAA4D,CAAC,GACrD;AACR,MAAI,QAAQ,IAAI,iBAAiB,KAAK;AACpC,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAASC,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,QAAQ,WAAW,UAAU,IAAI,QAAQ,UAAU,GAAG;AAC5D,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,6EAAwE;AAC7F,WAAO;AAAA,EACT;AACA,QAAMM,SAAkB;AAAA,IACtB,OAAO,aAAa;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,IACb,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACvC,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,MAAM,UAAU,MAAMA,MAAK;AACjC,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,OAAO,MAAM,iBAAiB,IAAI,MAAM;AAAA,CAAK;AACrD,WAAO;AAAA,EACT;AACA,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK,UAAU,EAAE,MAAM,KAAK,IAAI,KAAK,OAAO,IAAI,OAAO,OAAAA,OAAM,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAMA,OAAM;AAClB,QAAM,OAAOA,OAAM,UAAU,WAAWA,OAAM,OAAO,OAAO,yBAAyB,IAAI;AACzF,UAAQ,OAAO;AAAA,IACb,gBAAgB,IAAI,OAAO,GAAG,GAAGA,OAAM,OAAO,YAAOA,OAAM,IAAI,MAAM,EAAE,SAAM,IAAI,KAAK,OAAO,IAAI,UAAU,IAAI,KAAK,GAAG,yCAAyC,IAAI;AAAA;AAAA,EACtK;AACA,SAAO;AACT;AAMA,SAAS,SAAS,OAA2D,CAAC,GAAW;AACvF,MAAI,QAAQ,IAAI,mBAAmB,KAAK;AACtC,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAWN,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,QAAQ,KAAK,SAAS,KAAK,MAAM,SAAS,IAAI,KAAK,QAAQ,CAAC,QAAQ;AAC1E,QAAM,QAAQ,sBAAsB,KAAK;AACzC,QAAM,OAAO,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,YAAY,KAAK;AAClF,MAAI,KAAK,KAAK;AACZ,IAAAD,eAAc,KAAK,KAAK,IAAI;AAC5B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAC1D,WAAO;AAAA,EACT;AACA,UAAQ,OAAO,MAAM,IAAI;AACzB,SAAO;AACT;AAGA,SAAS,OAAO,KAAc,OAAwD,CAAC,GAAW;AAChG,QAAM,MAAM,mBAAmB,OAAO,WAAW;AACjD,QAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,GAAG,KAAK,IAAI,IAAI;AACpD,QAAM,SAAS,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,UAAU,OAAO,IAAI,MAAM;AAC9F,MAAI,KAAK,KAAK;AACZ,IAAAA,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,uBAAuB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC1D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAGA,SAAS,SAAS,KAAc,OAAyC,CAAC,GAAW;AACnF,QAAM,QAAQ,aAAa,OAAO,WAAW;AAC7C,QAAM,SAAS,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,YAAY,KAAK;AACpF,MAAI,KAAK,KAAK;AACZ,IAAAA,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC5D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAKA,SAAS,SAAS,MAAe,OAAyB,CAAC,GAAW;AACpE,QAAM,WAAWC,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,SAASA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,OACJ,SACC,UAAU,WAAW,SAClBE,OAAK,UAAU,aAAa,GAAG,OAAO,QAAQ,UAAU,GAAG,CAAC,OAAO,IACnE;AACN,MAAI,CAAC,QAAQ,CAACE,YAAW,IAAI,GAAG;AAC9B,YAAQ,OAAO;AAAA,MACb,mCAAmC,OAAO,OAAO,IAAI,KAAK,EAAE;AAAA;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMC,eAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,YAAQ,OAAO,MAAM,mCAAmC,IAAI;AAAA,CAAI;AAChE,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa,KAAK;AAC9B,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,YAAQ,OAAO,MAAM,mBAAmB,IAAI;AAAA,CAA4B;AACxE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,GAAG,KAAK,UAAU,cAAc,IAAI,QAAQ,SAAS,GAAG,MAAM,CAAC,CAAC;AAAA;AAC/E,MAAI,KAAK,KAAK;AACZ,IAAAN,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC5D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAKA,SAAS,SAAS,MAAe,OAAyB,CAAC,GAAW;AACpE,QAAM,WAAWC,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,SAASA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,OACJ,SACC,UAAU,WAAW,SAClBE,OAAK,UAAU,aAAa,GAAG,OAAO,QAAQ,UAAU,GAAG,CAAC,OAAO,IACnE;AACN,MAAI,CAAC,QAAQ,CAACE,YAAW,IAAI,GAAG;AAC9B,YAAQ,OAAO;AAAA,MACb,mCAAmC,OAAO,OAAO,IAAI,KAAK,EAAE;AAAA;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMC,eAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,YAAQ,OAAO,MAAM,mCAAmC,IAAI;AAAA,CAAI;AAChE,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa,KAAK;AAC9B,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,YAAQ,OAAO,MAAM,mBAAmB,IAAI;AAAA,CAA4B;AACxE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,GAAG,KAAK,UAAU,QAAQ,IAAI,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA;AAC/D,MAAI,KAAK,KAAK;AACZ,IAAAN,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC5D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,eAAe,UACb,UACA,OAA+D,CAAC,GAC/C;AACjB,QAAM,WAAW,KAAK,SAAS,YAAY,KAAK,MAAM,IAAI;AAC1D,MAAI,CAAC,UAAU;AACb,YAAQ,OAAO;AAAA,MACb,oBAAoB,KAAK,SAAS,qBAAqB,KAAK,MAAM,MAAM,kBAAkB,gBAC1E,YAAY,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,cAAc,MAAM,aAAa,KAAK,KAAK,GAAG,QAAQ;AACtE,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,WACI,uBAAuB,QAAQ;AAAA,IAC/B;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,YAAY,OAAO;AACnC,QAAM,UAAU,cAAc,MAAM,aAAa,SAAS,SAAS,eAAe,OAAO,CAAC,CAAC;AAC3F,QAAM,SAAS,SAAS,OAAO,SAAS,OAAO;AAC/C,MAAI,KAAK,KAAK;AACZ,IAAAA,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,0BAA0B,KAAK,GAAG,KAAK,SAAS,EAAE;AAAA,CAAK;AAAA,EAC9E,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,SAAS,SAAS,KAAc,OAA6B,CAAC,GAAW;AACvE,QAAM,WAAWC,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,QAAQ,OAAOE,OAAK,UAAU,WAAW;AAC/C,MAAI;AACJ,MAAI;AACF,YAAQM,aAAY,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC;AAAA,EAC9D,QAAQ;AACN,YAAQ,OAAO,MAAM,sBAAsB,KAAK;AAAA,CAAe;AAC/D,WAAO;AAAA,EACT;AACA,QAAM,KAAKR,KAAI,CAAC,aAAa,WAAW,QAAQ,CAAC;AACjD,MAAI,OAAO,MAAM;AACf,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI;AAAA,IACpB,GACG,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,MAAM,aAAa,EAAE,CAAC,CAAC,EACpC,OAAO,OAAO,EACd,IAAI,CAAC,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC;AAAA,EACpC;AACA,QAAM,EAAE,MAAM,OAAO,IAAI,UAAU,OAAO,SAAS;AACnD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,aAAa,iBAAiB,WAAW,KAAK,UAAU,KAAK;AACnE,QAAI,eAAe,GAAG;AACpB,cAAQ,OAAO,MAAM,qCAAqC,KAAK,MAAM;AAAA,CAAsB;AAAA,IAC7F;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,QAAQ;AACf,YAAQ,OAAO;AAAA,MACb,0CAA0C,OAAO,MAAM,IAAI,MAAM,MAAM,qBAAqB,KAAK,MAAM;AAAA;AAAA,IACzG;AACA,eAAW,KAAK,QAAQ;AACtB,cAAQ,OAAO,MAAM,OAAO,CAAC;AAAA,CAAI;AAAA,IACnC;AACA,qBAAiB,WAAW,IAAI;AAChC,WAAO;AAAA,EACT;AACA,mBAAiB,WAAW,KAAK;AACjC,aAAW,KAAK,QAAQ;AACtB,UAAM,IAAIE,OAAK,OAAO,CAAC;AACvB,QAAIF,KAAI,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM;AACvC,UAAI;AACF,mBAAW,CAAC;AAAA,MACd,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,UAAQ,OAAO;AAAA,IACb,2BAA2B,OAAO,MAAM,iDAAiD,KAAK,MAAM;AAAA;AAAA,EACtG;AACA,SAAO;AACT;AAKA,SAAS,iBAAiB,WAAwB,QAAyB;AACzE,QAAM,OAAO,gBAAgB,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;AACxE,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO;AAAA,EACT;AACA,aAAW,EAAE,KAAK,KAAK,KAAK,MAAM;AAChC,QAAI,QAAQ;AACV,cAAQ,OAAO,MAAM,OAAO,GAAG;AAAA,CAAI;AACnC;AAAA,IACF;AACA,IAAAA,KAAI,CAAC,cAAc,MAAM,GAAG,CAAC;AAC7B,IAAAA,KAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,EAAE,CAAC;AACjC,YAAQ,OAAO,MAAM,2BAA2B,GAAG,YAAY,IAAI;AAAA,CAAW;AAAA,EAChF;AACA,SAAO,KAAK;AACd;AAQA,eAAe,QACb,OAAgE,CAAC,GAChD;AACjB,QAAM,QAAQ,KAAK,SAAS,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAC1D,QAAM,aAAa,MAAM,aAAa,KAAK,KAAK,GAAG,MAAM,GAAG,KAAK;AACjE,QAAM,OAAmB,CAAC;AAC1B,aAAW,WAAW,WAAW;AAC/B,UAAM,UAAU,MAAM,YAAY,OAAO;AACzC,QAAI,CAAC,SAAS;AACZ;AAAA,IACF;AACA,UAAM,EAAE,MAAM,MAAM,IAAI,eAAe,YAAY,OAAO,CAAC;AAC3D,SAAK,KAAK;AAAA,MACR,OAAO,QAAQ,SAAS,QAAQ;AAAA,MAChC,YAAY,CAAC,GAAG,gBAAgB,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AACA,QAAM,OAAO,mBAAmB,IAAI;AACpC,UAAQ,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,IAAO,gBAAgB,IAAI,CAAC;AAC7F,SAAO;AACT;AASA,SAAS,QACP,OAAgF,CAAC,GACzE;AACR,QAAM,QAAkB,CAAC;AAEzB,QAAM,UAAoB,CAAC;AAE3B,QAAM,IAAI,WAAW;AAIrB,QAAM,QAAQ,mBAAmB,KAAK,CAAC,IAAI,CAAC;AAC5C,QAAM,MAAM,QAAQ,IAAI,KAAK,KAAK;AAClC,QAAM,MAAM;AACZ,QAAM,OAAO,GAAG,GAAG;AACnB,MAAII,YAAW,IAAI,GAAG;AACpB,UAAM,KAAK,kBAAkB,IAAI,8CAAyC;AAAA,EAC5E,OAAO;AACL,IAAAG,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,IAAAR,eAAc,MAAM,gBAAgB,KAAK,CAAC,CAAC;AAC3C,YAAQ,KAAK,IAAI;AACjB,UAAM,KAAK,wBAAwB,IAAI,cAAc,GAAG,0BAA0B;AAAA,EACpF;AAIA,QAAM,eAAeG,OAAK,WAAW,eAAe;AACpD,QAAM,SAAS,sBAAsB,cAAc,QAAW,EAAE,iBAAiB,KAAK,CAAC;AACvF,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,KAAK,kBAAkB,OAAO,MAAM,GAAG;AAAA,EAC/C,WAAW,OAAO,SAAS;AACzB,YAAQ,KAAK,YAAY;AACzB,UAAM;AAAA,MACJ,sDAAsD,YAAY;AAAA,IACpE;AAAA,EACF,OAAO;AACL,UAAM,KAAK,kBAAkB,YAAY,iCAAiC;AAAA,EAC5E;AAIA,MAAI,KAAK,OAAO;AACd,UAAM,IAAI,sBAAsB,cAAc,oBAAoB,EAAE,SAAS,cAAc,CAAC;AAC5F,QAAI,CAAC,EAAE,IAAI;AACT,YAAM,KAAK,kBAAkB,EAAE,MAAM,gBAAgB;AAAA,IACvD,WAAW,EAAE,SAAS;AACpB,UAAI,CAAC,QAAQ,SAAS,YAAY,EAAG,SAAQ,KAAK,YAAY;AAC9D,YAAM;AAAA,QACJ,uDAAuD,YAAY;AAAA,MACrE;AAAA,IACF,OAAO;AACL,YAAM,KAAK,kBAAkB,YAAY,8BAA8B;AAAA,IACzE;AAAA,EACF;AACA,QAAM,aAAaA,OAAK,WAAW,YAAY;AAC/C,MAAI,CAACE,YAAW,UAAU,GAAG;AAC3B,IAAAL,eAAc,YAAY,kCAAkC;AAC5D,YAAQ,KAAK,UAAU;AACvB,UAAM,KAAK,wBAAwB,UAAU,2CAA2C;AAAA,EAC1F;AAIA,MAAI,KAAK,QAAQ,SAAS,OAAO,KAAKK,YAAW,QAAQ,GAAG;AAC1D,UAAM,YAAYF,OAAK,UAAU,YAAY;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,KAAK;AAAA,IAC1B;AACA,QAAI,CAAC,EAAE,IAAI;AACT,YAAM,KAAK,kBAAkB,EAAE,MAAM,GAAG;AAAA,IAC1C,WAAW,EAAE,SAAS;AACpB,cAAQ,KAAK,SAAS;AACtB,YAAM,KAAK,sDAAsD,SAAS,GAAG;AAAA,IAC/E,OAAO;AACL,YAAM,KAAK,kBAAkB,SAAS,iCAAiC;AAAA,IACzE;AAAA,EACF;AAIA,QAAM,YAAYA,OAAK,aAAa,gBAAgB;AACpD,MAAI,CAACE,YAAW,SAAS,GAAG;AAC1B,IAAAG,WAAU,aAAa,EAAE,WAAW,KAAK,CAAC;AAC1C,IAAAR,eAAc,WAAW,wBAAwB;AACjD,YAAQ,KAAK,SAAS;AACtB,UAAM,KAAK,wBAAwB,SAAS,mCAAmC;AAAA,EACjF;AAEA,MAAI,KAAK,SAAS;AAChB,UAAM,QAAQ,kBAAkB,cAAc;AAC9C,QAAI,CAAC,MAAM,IAAI;AACb,YAAM,KAAK,kBAAkB,MAAM,MAAM,GAAG;AAAA,IAC9C,WAAW,MAAM,SAAS;AACxB,cAAQ,KAAK,cAAc;AAC3B,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,KAAK,sDAAsD;AAAA,IACnE;AAAA,EACF;AAEA,MAAI,KAAK,IAAI;AACX,mBAAe,SAAS,KAAK;AAAA,EAC/B,OAAO;AACL,UAAM,KAAK,yEAAyE;AACpF,UAAM,KAAK,iEAAiE;AAAA,EAC9E;AACA,MAAI,QAAQ,SAAS,YAAY,GAAG;AAGlC,UAAM,KAAK,uFAAkF;AAAA,EAC/F;AACA,UAAQ,OAAO,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AAC5C,SAAO;AACT;AAEA,IAAM,eAAe;AAKrB,SAAS,eAAe,SAAmB,OAAuB;AAChE,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,KAAK,6EAAwE;AACnF;AAAA,EACF;AACA,MAAI,CAACC,KAAI,CAAC,aAAa,WAAW,CAAC,GAAG;AACpC,UAAM,KAAK,6EAAwE;AACnF;AAAA,EACF;AACA,MAAIA,KAAI,CAAC,aAAa,YAAY,WAAW,YAAY,CAAC,MAAM,IAAI;AAClE,UAAM;AAAA,MACJ,yBAAyB,YAAY;AAAA,IACvC;AACA;AAAA,EACF;AACA,MAAIC,WAAU,OAAO,CAAC,YAAY,MAAM,YAAY,GAAG,EAAE,UAAU,OAAO,CAAC,EAAE,WAAW,GAAG;AACzF,UAAM,KAAK,0CAA0C,YAAY,0BAAqB;AACtF;AAAA,EACF;AACA,EAAAA,WAAU,OAAO,CAAC,OAAO,MAAM,GAAG,OAAO,GAAG,EAAE,UAAU,OAAO,CAAC;AAGhE,QAAM,SAASA;AAAA,IACb;AAAA,IACA,CAAC,UAAU,MAAM,mEAA8D;AAAA,IAC/E,EAAE,UAAU,OAAO;AAAA,EACrB;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM;AAAA,MACJ,+EAA0E,YAAY;AAAA,IACxF;AACA;AAAA,EACF;AACA,QAAM,KAAK,4BAA4B,QAAQ,MAAM,eAAe,YAAY,GAAG;AACnF,QAAM,OAAOA,WAAU,OAAO,CAAC,QAAQ,MAAM,UAAU,YAAY,GAAG,EAAE,UAAU,OAAO,CAAC;AAC1F,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM;AAAA,MACJ;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,KAAK,yBAAyB,YAAY,GAAG;AACnD,QAAMQ,MAAKR;AAAA,IACT;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,UAAU,OAAO;AAAA,EACrB;AACA,MAAIQ,IAAG,WAAW,GAAG;AACnB,UAAM,KAAK,uCAAkCA,IAAG,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,CAAC,EAAE;AACjF;AAAA,EACF;AACA,QAAM,SAAST,KAAI,CAAC,UAAU,WAAW,QAAQ,CAAC;AAClD,QAAM,OAAO,SAAS,iCAAiC,KAAK,MAAM,IAAI,CAAC,IAAI;AAC3E,QAAM;AAAA,IACJ,OACI,6DAAwD,IAAI,aAAa,YAAY,KACrF;AAAA,EACN;AACF;AAEA,SAAS,gBAAgB,KAAa,GAAmB;AACvD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAmBU,GAAG;AAAA,gBACN,CAAC;AAAA,iFACgE,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAMpF;AAKA,eAAe,QAAQ,MAA0B,SAAuC;AAItF,MAAI,SAAS,SAAS;AACpB,UAAMU,SAAQ,MAAM,UAAU;AAC9B,UAAM,MAAM,SAASA,MAAK;AAC1B,QAAI,IAAI,OAAQ,SAAQ,OAAO,MAAM,IAAI,MAAM;AAC/C,WAAO,IAAI;AAAA,EACb;AACA,MAAI,SAAS,YAAY;AACvB,YAAQ,OAAO,MAAM,8DAA8D;AACnF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,UAAU;AAC9B,QAAM,MAAM,MAAM;AAAA,IAAe;AAAA,IAAS;AAAA,IAAO,OAAO,MACtD,MAAM,EAAE,eAAe,GAAG,cAAc,CAAC;AAAA,EAC3C;AACA,MAAI,IAAI,SAAS;AACf,YAAQ,OAAO,MAAM,GAAG,IAAI,OAAO;AAAA,CAAI;AAAA,EACzC;AACA,SAAO,IAAI;AACb;AAIA,SAAS,iBAAyB;AAChC,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,OAAO,MAAM,0BAA0B,IAAI,MAAM;AAAA,CAAK;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,OAAO;AAAA,IACX,WAAW,aAAa,IAAI,IAAI;AAAA,IAChC,WAAW,GAAG,IAAI,IAAI;AAAA,IACtB,SAAS,aAAa,IAAI,IAAI;AAAA,EAChC,EAAE,IAAI,MAAM;AACZ,UAAQ,OAAO,MAAM,0BAA0B,IAAI;AAAA,CAAK;AACxD,SAAO;AACT;AAKA,SAAS,gBAAwB;AAC/B,QAAM,OAAOR,OAAKC,SAAQ,GAAG,WAAW,eAAe;AACvD,QAAM,MAAM,sBAAsB,IAAI;AACtC,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,OAAO,MAAM,yBAAyB,IAAI,MAAM;AAAA,CAAK;AAC7D,WAAO;AAAA,EACT;AACA,UAAQ,OAAO;AAAA,IACb,IAAI,UACA,oDAAoD,IAAI;AAAA,IACxD,yBAAyB,IAAI;AAAA;AAAA,EACnC;AACA,SAAO;AACT;AAGA,eAAe,YACb,MACA,OAAuF,CAAC,GACvE;AACjB,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,uBAAuB,MAAM;AAAA,IACjD,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,EACf,CAAC;AACD,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,oDAAoD,IAAI;AAAA,CAAI;AACjF,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,UAAU,aAAa,OAAO,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC;AAClF,UAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AAC/B,SAAO;AACT;AAKA,eAAe,UAAU,MAIL;AAClB,QAAM,WAAWH,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,QAAQ;AAAA,EAChC,SAAS,GAAG;AACV,YAAQ,OAAO,MAAM,oBAAqB,EAAY,OAAO;AAAA,CAAI;AACjE,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,OAAO,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC;AAAA,CAAI;AACnD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,cAAc,MAAM,aAAa,KAAK,KAAK,GAAG,KAAK,QAAQ;AAC3E,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,KAAK,WACD,uBAAuB,KAAK,QAAQ;AAAA,IACpC;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,YAAY,OAAO;AACnC,QAAM,UAAU,MAAM,aAAa,SAAS,SAAS,eAAe,OAAO,CAAC;AAC5E,QAAM,UAAU,gBAAgB,SAAS,OAAO;AAEhD,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC9D,OAAO;AACL,YAAQ,OAAO,MAAM,GAAG,oBAAoB,OAAO,CAAC;AAAA,CAAI;AAAA,EAC1D;AACA,SAAO,eAAe,OAAO;AAC/B;AAQA,eAAe,WAAW,MAIN;AAClB,QAAM,WAAWA,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAG1D,MAAI;AACJ,MAAI,MAAkF,CAAC;AACvF,MAAI,aAAa;AACjB,QAAM,cAAcE,OAAK,UAAU,aAAa,cAAc;AAC9D,MAAIE,YAAW,WAAW,GAAG;AAC3B,iBAAa;AACb,QAAI;AACF,gBAAU,YAAY,QAAQ;AAC9B,YAAM,MAAM,KAAK,MAAMC,eAAa,aAAa,MAAM,CAAC;AACxD,YAAM,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAAI,IAAI,UAAU;AAChF,UAAI,MAAM,QAAW;AAInB,cAAM,WAAW,CAAC,MAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AAC1D,YACE,CAAC,KACD,OAAO,MAAM,YACb,MAAM,QAAQ,CAAC,KACd,EAAE,cAAc,UAAa,CAAC,SAAS,EAAE,SAAS,KAClD,EAAE,eAAe,UAAa,CAAC,SAAS,EAAE,UAAU,KACpD,EAAE,oBAAoB,UAAa,OAAO,EAAE,oBAAoB,WACjE;AACA,kBAAQ,OAAO;AAAA,YACb;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AAKA,cAAM,UAAU,uBAAuB,CAAC;AACxC,YAAI,QAAQ,SAAS,GAAG;AACtB,kBAAQ,OAAO;AAAA,YACb,mEAAmE,QAAQ,KAAK,IAAI,CAAC,kCAAkC,kBAAkB,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,UACjK;AACA,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,OAAO,MAAM,qBAAsB,EAAY,OAAO;AAAA,CAAI;AAClE,aAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,cAAU,CAAC;AAAA,EACb;AAEA,QAAM,UAAU,cAAc,MAAM,aAAa,KAAK,KAAK,GAAG,KAAK,QAAQ;AAC3E,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,KAAK,WACD,uBAAuB,KAAK,QAAQ;AAAA,IACpC;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,YAAY,OAAO;AAKnC,QAAM,UAAU,cAAc,MAAM,aAAa,SAAS,SAAS,eAAe,OAAO,CAAC,CAAC;AAC3F,QAAM,SAAiC,aACnC;AAAA,IACE,SAAS,gBAAgB,SAAS,OAAO;AAAA,IACzC,GAAI,MAAM,QAAQ,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,QAAQ,IAAI,UAAU,IAAI,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;AAAA,IACtE,GAAI,IAAI,kBAAkB,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,EACzD,IACA;AACJ,QAAM,SAAS,YAAY,QAAQ,WAAW,MAAM;AAEpD,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC7D,OAAO;AACL,UAAM,OACJ,OAAO,YAAY,aACf,sFACA,qBAAqB,OAAO,OAAO;AACzC,UAAM,QAAQ,OAAO,QAAQ,IAAI,CAAC,MAAM,WAAQ,EAAE,IAAI,KAAK,EAAE,IAAI,EAAE;AACnE,YAAQ,OAAO,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,CAAI;AAAA,EACzD;AACA,SAAO,gBAAgB,OAAO,OAAO;AACvC;AAGA,SAAS,KAAK,MAAc,MAAe,OAAqB;AAC9D,UAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAChC,MAAI,MAAM;AACR,UAAM,KAAK,gBAAgB,IAAI;AAC/B,YAAQ,OAAO;AAAA,MACb,KACI;AAAA,EAAK,KAAK;AAAA,IACV;AAAA,IACN;AAAA,EACF;AACF;AAQA,SAAS,aAAa,GAA2C;AAC/D,MAAI,MAAM,OAAW,QAAO;AAC5B,MAAI;AACF,WAAO,aAAa,CAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACA,IAAM,QAAQ,aAAa,QAAQ,KAAK,CAAC,CAAC;AAC1C,IAAM,SAAS,UAAU,UAAa,YAAY,QAAQ,cAAc,KAAK,EAAE;AAC/E,IAAI,QAAQ;AAMV,MAAI,QAAQ,IAAI,EACb,KAAK,CAAC,SAAS;AACd,YAAQ,WAAW;AAAA,EACrB,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,aAAa,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AACtF,YAAQ,WAAW;AAAA,EACrB,CAAC;AACL;","names":["spawnSync","existsSync","mkdirSync","readFileSync","readdirSync","writeFileSync","homedir","join","join","join","mkdirSync","readFileSync","join","mkdirSync","join","readFileSync","spawnSync","existsSync","join","spawnSync","git","git","existsSync","mkdirSync","readFileSync","writeFileSync","join","git","spawnSync","existsSync","join","readFileSync","join","readFileSync","homedir","join","mkdirSync","writeFileSync","join","out","mkdirSync","writeFileSync","join","spawnSync","git","IDENT","entry","readFileSync","basename","dirname","join","basename","join","dirname","readFileSync","readFileSync","readdirSync","dirname","join","SEV_ICON","NON_RECEIPT","scopeLabel","readdirSync","readFileSync","join","dirname","topSeverity","head","readFileSync","readdirSync","join","NON_RECEIPT","readdirSync","readFileSync","join","execFileSync","readFileSync","readdirSync","join","run","execFileSync","readdirSync","join","readFileSync","createHash","existsSync","readFileSync","basename","join","createHash","basename","join","existsSync","readFileSync","existsSync","readdirSync","basename","join","inDiff","existsSync","readdirSync","basename","join","writeFileSync","git","spawnSync","join","homedir","existsSync","readFileSync","entry","mkdirSync","readdirSync","gh","stdin"]}
+{"version":3,"sources":["../src/cli.ts","../src/hook/guard.ts","../src/policy/guard.ts","../src/receipt/guardLog.ts","../src/hook/installGitHook.ts","../src/hook/prePush.ts","../src/report/store.ts","../src/hook/settingsMerge.ts","../src/receipt/assert.ts","../src/receipt/externalStateLog.ts","../src/reconcile/reconcile.ts","../src/report/ack.ts","../src/report/badge.ts","../src/report/diff.ts","../src/report/eval.ts","../src/report/fleet.ts","../src/report/log.ts","../src/report/prune.ts","../src/report/stats.ts","../src/report/workVerdict.ts","../src/scanners/semgrep.ts","../src/scanners/sarifIngest.ts","../src/scanners/scanners.ts","../src/share/handoff.ts","../src/sign/witness.ts","../src/trace/subagents.ts"],"sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport { createHmac } from \"node:crypto\";\nimport {\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  readdirSync,\n  realpathSync,\n  unlinkSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, relative } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport { exporterFor, exporterIds } from \"./export/registry.js\";\nimport { computeCompletion } from \"./findings/completionFindings.js\";\nimport { loadCriteria } from \"./findings/criteria.js\";\nimport { deriveFindings } from \"./findings/findings.js\";\nimport type { DerivedSummary } from \"./findings/spans.js\";\nimport { deriveSpans } from \"./findings/spans.js\";\nimport { runGuard } from \"./hook/guard.js\";\nimport { installGitHook, wirePrepareScript } from \"./hook/installGitHook.js\";\nimport { type HookDialect, readStdin, runHookPrePush } from \"./hook/prePush.js\";\nimport { primaryCheckout } from \"./hook/prePush.js\";\nimport {\n  GUARD_HOOK_COMMAND,\n  GUARD_MATCHER,\n  mergeHookIntoSettings,\n  settingsStore,\n} from \"./hook/settingsMerge.js\";\nimport {\n  type Assertion,\n  assertExitCode,\n  evaluateAsserts,\n  loadAsserts,\n  renderAssertResults,\n} from \"./receipt/assert.js\";\nimport { type Receipt, type ReceiptScope, buildReceipt } from \"./receipt/build.js\";\nimport { canonicalize } from \"./receipt/canonical.js\";\nimport { readExternalState } from \"./receipt/externalStateLog.js\";\nimport { readGuardEvents, sessionIdFromPath } from \"./receipt/guardLog.js\";\nimport { ghFetcher, reconcileSession } from \"./reconcile/reconcile.js\";\nimport { type AckEntry, appendAck, readAcks, resolveActor } from \"./report/ack.js\";\nimport { badgeEndpoint } from \"./report/badge.js\";\nimport { renderCard, renderList } from \"./report/card.js\";\nimport { diffReceipts, renderDiff } from \"./report/diff.js\";\nimport {\n  type FieldRow,\n  firedCategories,\n  renderFieldScan,\n  summarizeFieldScan,\n} from \"./report/eval.js\";\nimport { computeFleetFromRepos, renderFleet } from \"./report/fleet.js\";\nimport {\n  collectGuardrails,\n  renderGuardrailsBlock,\n  upsertGuardrailsSection,\n} from \"./report/guardrails.js\";\nimport { loadReceiptHistory, renderLog } from \"./report/log.js\";\nimport { renderPrComment } from \"./report/prComment.js\";\nimport { eventKey, visibleMergeFindings } from \"./report/prComment.js\";\nimport { branchSlug, planPrune } from \"./report/prune.js\";\nimport { toSarif } from \"./report/sarif.js\";\nimport { deriveTargets } from \"./report/sessions.js\";\nimport { computeStats, renderStats } from \"./report/stats.js\";\nimport { listReceiptRefs, readReceiptRef, writeReceiptRef } from \"./report/store.js\";\nimport { computeTrends, renderTrends, upsertTrendsSection } from \"./report/trends.js\";\nimport {\n  DEFAULT_BLOCKABLE,\n  type WorkPolicy,\n  unknownVerdictPrefixes,\n  verdictExitCode,\n  workVerdict,\n} from \"./report/workVerdict.js\";\nimport { runScanners } from \"./scanners/scanners.js\";\nimport { copyToClipboard } from \"./share/clipboard.js\";\nimport { buildHandoff, renderHandoffMarkdown } from \"./share/handoff.js\";\nimport { renderShareMarkdown } from \"./share/markdown.js\";\nimport { redactReceipt } from \"./share/redact.js\";\nimport { toDsseEnvelope } from \"./sign/envelope.js\";\nimport { compareToTranscript, rederiveFromTranscript } from \"./sign/rederive.js\";\nimport { verifyBundle } from \"./sign/verify.js\";\nimport { type WitnessLog, crossCheck, discoverWitness, verifyWitnessSig } from \"./sign/witness.js\";\nimport { authoredBranch, branchShas, shaWindow } from \"./trace/commitMatch.js\";\nimport {\n  applyDiffScope,\n  changedFiles,\n  inDiff,\n  narrowEffort,\n  windowedEffort,\n} from \"./trace/diffScope.js\";\nimport {\n  anyDetected,\n  inRepo,\n  listSessions,\n  loadById,\n  loadSession,\n  rootsHint,\n  selectForBranch,\n  selectSummary,\n} from \"./trace/load.js\";\nimport { agentIds } from \"./trace/registry.js\";\nimport { sliceByBranch } from \"./trace/slice.js\";\nimport { loadSubagentActivity } from \"./trace/subagents.js\";\nimport type { AgentSource, Session, SessionSummary } from \"./trace/types.js\";\nimport { getVersion } from \"./version.js\";\n\nconst HELP = `\n🧾  receipts — proof, not vibes\n\n  A deterministic, cross-agent Report Card of what your coding agent actually did.\n  Reads the agent's own transcript locally. No account, no upload, no model calls.\n\nUsage\n  receipts [selector]           Print the Agent Report Card for a session\n  receipts --list               List recent sessions (then: receipts <n>)\n  receipts --json [selector]    Emit the Receipt object (in-toto Statement)\n  receipts --share [selector]   Print a redacted, paste-ready Markdown summary\n  receipts --handoff [selector]  Print a verifiable handoff brief (done/open/risk/next/verify)\n  receipts guardrails [sel]     Paste-ready prevention rules (AGENTS.md / CLAUDE.md)\n                                from the findings (--last N to aggregate sessions)\n  receipts trends               Cross-session digest: grades, recurring findings,\n                                and evidence over your last N sessions (default 10)\n  receipts preview              Render this branch's work record locally — exactly what CI\n                                will post (RECEIPTS_PREVIEW=1) — and store nothing\n  receipts pr                   Write this PR's redacted Receipt to .receipts/\n                                (diff-scoped: only this change's findings)\n  receipts envelope <receipt>   Wrap a Receipt as an unsigned DSSE envelope\n  receipts verify <bundle>      Verify a Receipt (+ --transcript to prove fidelity;\n                                + --witness <log> to cross-check vs altimate-router)\n  receipts diff [<a> <b>]       What changed between two Receipts (no args: last two; --json)\n  receipts log [dir]            List the committed receipts in .receipts/ (--last N)\n  receipts stats [dir]          Dogfooding scoreboard: how often it ran + what it caught\n  receipts fleet                Cross-repo/agent rollup over refs/receipts/* (RECEIPTS_FLEET=1;\n                                --repos a,b,c · --json) — local-only org record\n  receipts ack [slug]           Record an attributed review of an agent's work\n                                (RECEIPTS_ACK=1; --note · --event <id> · --json) — local-only\n  receipts eval                 Flag-rate of the detectors over your real local sessions (--last N, --json)\n  receipts badge [receipt]      shields.io endpoint JSON for a README/PR badge (--out f)\n  receipts sarif [receipt]      SARIF 2.1.0 for GitHub code-scanning (inline + Security tab; --out f)\n  receipts export --format otel [sel]  Emit the session as OpenTelemetry OTLP/JSON spans (also: --format sarif; --out f)\n  receipts prune [dir]          Remove committed receipts for merged/deleted branches (--dry-run)\n  receipts init                 One-command adopt: PR-check workflow + the repo-committed\n                                agent hook; --pr also branches, commits, pushes + opens the PR\n                                (--prepare wires the git floor; --agents codex too)\n  receipts hook pre-push        (called by hooks, not humans) attach the receipt on push\n                                (--agent claude | codex | git selects the payload dialect)\n  receipts install-hook         Write the self-updating pre-push hook into .git/hooks\n  receipts setup-local          Add the hook to YOUR ~/.claude/settings.json (only fires\n                                in repos that have adopted the Receipts workflow)\n  receipts rederive <file>      Reproduce the canonical Receipt from a transcript\n  receipts assert [selector]    Check the receipt against committed .receipts/asserts.json (CI gate)\n  receipts verdict [selector]   Work-verdict from the facts + .receipts/asserts.json policy —\n                                VERIFIED / INCOMPLETE / WRONG / ESCALATE (no policy ⇒ UNJUDGED; CI gate)\n  receipts reconcile            Reconcile the agent's external-state claims (PRs/issues/releases)\n                                against the GitHub API — opt-in (RECEIPTS_RECONCILE=1), local side-log\n  receipts mcp                  Start the MCP server (stdio) for IDEs/agents\n\n  selector: a list number (e.g. 3), a session id, or part of the title.\n  With no selector, the most recent session is used.\n\nOptions\n  --list                        List recent sessions and exit\n  --agent <name>                Limit to one agent: claude-code | codex | cursor | openclaw\n  --json                        Emit the Receipt as JSON (no card)\n  --compact                     With --json, emit canonical (sorted, minified) JSON\n  --share                       Emit a redacted Markdown summary for sharing\n  --redact                      With --json, redact secrets from the Receipt\n  --out <path>                  With --json, write to a file instead of stdout\n  --base <ref>                  With pr, the diff base to scope against (default: main)\n  --store <mode>                With pr, where the receipt goes: commit (default) | none\n                                (print to stdout, write nothing). Also RECEIPTS_STORE env.\n  --branch <name>               With pr, fall back to a branch slice (default: current)\n  --whole-session               With pr, use the whole session (no scoping)\n  --last <n>                    With guardrails / trends, span the last n sessions\n  --copy                        Also copy --share / --json output to the clipboard\n  --no-color                    Disable ANSI color (also honors NO_COLOR)\n  -v, --version                 Print the version and exit\n  -h, --help                    Print this help and exit\n\nSigning is done in CI by the \"Verified-by: Receipts\" GitHub Action (Sigstore\nkeyless via GitHub Artifact Attestations). See docs/verified-by.md.\n\nReceipts reports what an agent DID — not whether it was correct. Your tests are\nthe oracle for success. Evidence, not judgement.\n\nNote: a Receipt can contain titles, file paths, and command snippets from the\ntranscript (possibly secrets). Plain --json is local only; use --share or\n--json --redact to mask secrets before the output leaves your machine.\n\nDocs: https://github.com/AltimateAI/altimate-receipts\n`;\n\ntype Command =\n  | \"envelope\"\n  | \"verify\"\n  | \"pr\"\n  | \"preview\"\n  | \"mcp\"\n  | \"rederive\"\n  | \"guardrails\"\n  | \"trends\"\n  | \"diff\"\n  | \"log\"\n  | \"stats\"\n  | \"fleet\"\n  | \"ack\"\n  | \"eval\"\n  | \"badge\"\n  | \"sarif\"\n  | \"export\"\n  | \"prune\"\n  | \"init\"\n  | \"assert\"\n  | \"verdict\"\n  | \"hook\"\n  | \"install-hook\"\n  | \"reconcile\"\n  | \"setup-local\";\nconst COMMANDS = new Set<Command>([\n  \"envelope\",\n  \"verify\",\n  \"pr\",\n  \"preview\",\n  \"mcp\",\n  \"rederive\",\n  \"guardrails\",\n  \"trends\",\n  \"diff\",\n  \"log\",\n  \"stats\",\n  \"fleet\",\n  \"ack\",\n  \"eval\",\n  \"badge\",\n  \"prune\",\n  \"sarif\",\n  \"export\",\n  \"init\",\n  \"assert\",\n  \"verdict\",\n  \"hook\",\n  \"install-hook\",\n  \"reconcile\",\n  \"setup-local\",\n]);\n\ninterface ParsedArgs {\n  help: boolean;\n  version: boolean;\n  list: boolean;\n  json: boolean;\n  compact: boolean;\n  share: boolean;\n  handoff: boolean;\n  redact: boolean;\n  copy: boolean;\n  color: boolean;\n  dryRun: boolean;\n  wholeSession: boolean;\n  prepare: boolean;\n  /** `fleet --repos a,b,c` — extra repo working dirs to roll up (M77) */\n  repos?: string[];\n  /** `ack --note \"...\"` / `--event <id>` (M78) */\n  note?: string;\n  eventId?: string;\n  /** `init --agents <list>` — extra agent hook files to write (SPEC-0069) */\n  pr: boolean;\n  /** `init --guard` — also install the live PreToolUse guard (opt-in; off by default) */\n  guard?: boolean;\n  agents?: string[];\n  agent?: AgentSource;\n  /** `hook pre-push --agent <claude|git>` payload dialect (SPEC-0066) */\n  hookDialect?: HookDialect;\n  out?: string;\n  /** `export --format <id>` — the exporter format (e.g. otel, sarif) */\n  format?: string;\n  branchScope?: string;\n  base?: string;\n  /** `pr --criteria <file>` — SPEC-0118 definition-of-done items */\n  criteria?: string;\n  store?: string;\n  transcript?: string;\n  witness?: string;\n  last?: number;\n  command?: Command;\n  file?: string;\n  /** second positional (e.g. the `b` receipt for `receipts diff <a> <b>`) */\n  second?: string;\n  selector?: string;\n}\n\nexport function parseArgs(argv: string[]): ParsedArgs {\n  const args = argv.slice(2);\n  const parsed: ParsedArgs = {\n    help: false,\n    version: false,\n    list: false,\n    json: false,\n    compact: false,\n    share: false,\n    handoff: false,\n    redact: false,\n    copy: false,\n    dryRun: false,\n    wholeSession: false,\n    prepare: false,\n    pr: false,\n    color: !process.env.NO_COLOR && process.stdout.isTTY === true,\n  };\n  const positionals: string[] = [];\n  for (let i = 0; i < args.length; i++) {\n    const a = args[i];\n    if (a === \"-h\" || a === \"--help\") {\n      parsed.help = true;\n    } else if (a === \"-v\" || a === \"--version\") {\n      parsed.version = true;\n    } else if (a === \"--list\") {\n      parsed.list = true;\n    } else if (a === \"--json\") {\n      parsed.json = true;\n    } else if (a === \"--repos\") {\n      const v = args[++i];\n      if (v)\n        parsed.repos = v\n          .split(\",\")\n          .map((x) => x.trim())\n          .filter(Boolean);\n    } else if (a === \"--note\") {\n      parsed.note = args[++i];\n    } else if (a === \"--event\") {\n      parsed.eventId = args[++i];\n    } else if (a === \"--compact\") {\n      parsed.compact = true;\n    } else if (a === \"--share\") {\n      parsed.share = true;\n    } else if (a === \"--handoff\") {\n      parsed.handoff = true;\n    } else if (a === \"--redact\") {\n      parsed.redact = true;\n    } else if (a === \"--copy\") {\n      parsed.copy = true;\n    } else if (a === \"--out\") {\n      parsed.out = args[++i];\n    } else if (a === \"--format\") {\n      parsed.format = args[++i];\n    } else if (a === \"--branch\") {\n      parsed.branchScope = args[++i];\n    } else if (a === \"--base\") {\n      parsed.base = args[++i];\n    } else if (a === \"--criteria\") {\n      parsed.criteria = args[++i];\n    } else if (a === \"--store\") {\n      parsed.store = args[++i];\n    } else if (a === \"--transcript\") {\n      parsed.transcript = args[++i];\n    } else if (a === \"--witness\") {\n      parsed.witness = args[++i];\n    } else if (a === \"--last\") {\n      const n = Number(args[++i]);\n      if (Number.isFinite(n) && n > 0) {\n        parsed.last = Math.floor(n);\n      }\n    } else if (a === \"--dry-run\") {\n      parsed.dryRun = true;\n    } else if (a === \"--whole-session\") {\n      parsed.wholeSession = true;\n    } else if (a === \"--prepare\") {\n      parsed.prepare = true;\n    } else if (a === \"--pr\") {\n      parsed.pr = true;\n    } else if (a === \"--guard\") {\n      parsed.guard = true;\n    } else if (a === \"--agents\") {\n      parsed.agents = (args[++i] ?? \"\").split(\",\").filter(Boolean);\n    } else if (a === \"--agent\") {\n      const next = args[i + 1];\n      if (next && agentIds().includes(next as AgentSource)) {\n        parsed.agent = next as AgentSource;\n        i++;\n      } else if (next === \"claude\" || next === \"codex\" || next === \"git\") {\n        parsed.hookDialect = next; // `hook pre-push --agent <dialect>` (SPEC-0066)\n        i++;\n      }\n    } else if (a === \"--no-color\") {\n      parsed.color = false;\n    } else if (a === \"--color\") {\n      parsed.color = true;\n    } else if (!a.startsWith(\"-\")) {\n      positionals.push(a);\n    }\n  }\n  if (positionals[0] && COMMANDS.has(positionals[0] as Command)) {\n    parsed.command = positionals[0] as Command;\n    parsed.file = positionals[1];\n    parsed.second = positionals[2];\n  } else {\n    parsed.selector = positionals[0];\n  }\n  return parsed;\n}\n\nexport async function run(argv: string[]): Promise<number> {\n  const args = parseArgs(argv);\n\n  if (args.version) {\n    process.stdout.write(`${getVersion()}\\n`);\n    return 0;\n  }\n  if (args.help) {\n    process.stdout.write(`${HELP}\\n`);\n    return 0;\n  }\n\n  if (args.command === \"envelope\") {\n    return runEnvelope(args.file);\n  }\n  if (args.command === \"verify\") {\n    return runVerify(args.file, {\n      transcript: args.transcript,\n      branch: args.branchScope,\n      witness: args.witness,\n    });\n  }\n  if (args.command === \"diff\") {\n    return runDiff(args.file, args.second, { json: args.json, out: args.out });\n  }\n  if (args.command === \"log\") {\n    return runLog(args.file, { json: args.json, last: args.last, out: args.out });\n  }\n  if (args.command === \"stats\") {\n    return runStats(args.file, { json: args.json, out: args.out });\n  }\n  if (args.command === \"fleet\") {\n    return runFleet({ repos: args.repos, json: args.json, out: args.out });\n  }\n  if (args.command === \"ack\") {\n    return runAck(args.file, { note: args.note, eventId: args.eventId, json: args.json });\n  }\n  if (args.command === \"eval\") {\n    return runEval({ json: args.json, limit: args.last, agent: args.agent });\n  }\n  if (args.command === \"badge\") {\n    return runBadge(args.file, { out: args.out });\n  }\n  if (args.command === \"sarif\") {\n    return runSarif(args.file, { out: args.out });\n  }\n  if (args.command === \"export\") {\n    return runExport(args.file, { format: args.format, out: args.out, agent: args.agent });\n  }\n  if (args.command === \"prune\") {\n    return runPrune(args.file, { dryRun: args.dryRun });\n  }\n  if (args.command === \"init\") {\n    return runInit({ prepare: args.prepare, agents: args.agents, pr: args.pr, guard: args.guard });\n  }\n  if (args.command === \"hook\") {\n    return runHook(args.file, args.hookDialect ?? \"claude\");\n  }\n  if (args.command === \"install-hook\") {\n    return runInstallHook();\n  }\n  if (args.command === \"setup-local\") {\n    return runSetupLocal();\n  }\n  if (args.command === \"rederive\") {\n    return runRederive(args.file, {\n      source: args.agent,\n      branch: args.branchScope,\n      redact: args.redact,\n      compact: args.compact,\n    });\n  }\n  if (args.command === \"guardrails\") {\n    // for `guardrails`, the positional (args.file) is a session selector\n    return runGuardrails({\n      selector: args.file,\n      agent: args.agent,\n      last: args.last,\n      out: args.out,\n      copy: args.copy,\n      json: args.json,\n    });\n  }\n  if (args.command === \"trends\") {\n    return runTrends({\n      selector: args.file,\n      agent: args.agent,\n      last: args.last,\n      out: args.out,\n      copy: args.copy,\n      json: args.json,\n      color: args.color,\n    });\n  }\n  if (args.command === \"pr\") {\n    return runPr({\n      out: args.out,\n      branch: args.branchScope,\n      base: args.base,\n      wholeSession: args.wholeSession,\n      store: args.store,\n      criteria: args.criteria,\n    });\n  }\n  if (args.command === \"reconcile\") {\n    return runReconcile({ branch: args.branchScope });\n  }\n  if (args.command === \"preview\") {\n    // M79 — render the work record locally (exactly what CI will post), store nothing.\n    if (process.env.RECEIPTS_PREVIEW !== \"1\") {\n      process.stderr.write(\n        \"receipts preview is experimental — set RECEIPTS_PREVIEW=1 to enable (render the work record locally before you push).\\n\",\n      );\n      return 1;\n    }\n    return runPr({\n      branch: args.branchScope,\n      base: args.base,\n      wholeSession: args.wholeSession,\n      preview: true,\n      criteria: args.criteria,\n    });\n  }\n  if (args.command === \"assert\") {\n    return runAssert({ selector: args.file, agent: args.agent, json: args.json });\n  }\n  if (args.command === \"verdict\") {\n    return runVerdict({ selector: args.file, agent: args.agent, json: args.json });\n  }\n  if (args.command === \"mcp\") {\n    // Dynamic import keeps the MCP SDK out of every other code path.\n    const { startStdio } = await import(\"./mcp/server.js\");\n    await startStdio();\n    // Stay alive while the transport serves stdio; resolve when the client\n    // closes the input stream (so the process exits cleanly).\n    await new Promise<void>((resolve) => {\n      process.stdin.once(\"close\", resolve);\n      process.stdin.once(\"end\", resolve);\n    });\n    return 0;\n  }\n\n  if (!(await anyDetected())) {\n    process.stderr.write(\n      `No agent transcripts found under ${rootsHint()}.\\nRun a coding-agent session first, then try again.\\n`,\n    );\n    return 1;\n  }\n\n  const sessions = await listSessions(args.agent);\n\n  if (args.list) {\n    process.stdout.write(renderList(sessions, { color: args.color }));\n    return 0;\n  }\n\n  const summary = selectSummary(sessions, args.selector);\n  if (!summary) {\n    process.stderr.write(\n      args.selector\n        ? `No session matched \"${args.selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n\n  const derived = deriveSpans(session);\n  const findings = deriveFindings(derived);\n\n  if (args.json) {\n    let receipt = await buildReceipt(session, derived, findings);\n    if (args.redact) {\n      receipt = redactReceipt(receipt);\n    }\n    const out = args.compact ? canonicalize(receipt) : JSON.stringify(receipt, null, 2);\n    if (args.out) {\n      writeFileSync(args.out, `${out}\\n`);\n      process.stderr.write(`Receipt written to ${args.out}\\n`);\n      return 0;\n    }\n    emit(out, args.copy, \"Receipt\");\n    return 0;\n  }\n\n  if (args.share) {\n    const md = renderShareMarkdown({ summary, session, derived, findings });\n    emit(md.trimEnd(), args.copy, \"Shareable summary\");\n    return 0;\n  }\n\n  if (args.handoff) {\n    const receipt = redactReceipt(await buildReceipt(session, derived, findings));\n    const md = renderHandoffMarkdown(buildHandoff(receipt, findings));\n    emit(md.trimEnd(), args.copy, \"Handoff\");\n    return 0;\n  }\n\n  process.stdout.write(renderCard({ summary, derived, findings }, { color: args.color }));\n  return 0;\n}\n\nfunction git(args: string[]): string {\n  const r = spawnSync(\"git\", args, { encoding: \"utf8\" });\n  return r.status === 0 ? r.stdout.trim() : \"\";\n}\n\n/**\n * `receipts pr` — find the session that built the current git branch (matching\n * gitBranch + repo root from the transcript), and write its redacted Receipt to\n * `.receipts/<branch>.json` so the \"Verified-by: Receipts\" workflow can sign it.\n */\n/** How many recent in-repo sessions to scan when the branch session didn't produce the\n * diff (the integration-branch / squash-merge case). Bounds the cost of the fallback. */\nconst PR_SELECT_SCAN = 150;\n\n/** A loaded session + its derived evidence, returned by the `pr` session picker. */\ninterface PickedSession {\n  summary: SessionSummary;\n  session: Session;\n  derived: DerivedSummary;\n}\n\n/** How many of `files` (the diff) a session's edits touched — the evidence that this\n * session actually produced (part of) the change. */\nexport function diffOverlap(derived: DerivedSummary, files: readonly string[]): number {\n  return derived.filesChanged.filter((f) => inDiff(f.path, files)).length;\n}\n\n/** Earliest author time (epoch ms) of any commit unique to this branch, or null when\n * unknowable (no base, no commits yet, no git). Author time — not commit time — keeps\n * rebases and cherry-picks permissive: carried-over work keeps its old author date, so\n * the old session that produced it stays eligible (SPEC-0068 R3). */\nexport function branchBirthMs(base?: string): number | null {\n  if (!base) {\n    return null;\n  }\n  const out = git([\"log\", \"--reverse\", \"--format=%at\", `${base}..HEAD`]);\n  const first = Number(out.split(\"\\n\")[0]?.trim());\n  return Number.isFinite(first) && first > 0 ? first * 1000 : null;\n}\n\n/** A fallback-scan candidate is stale — and ineligible — when it ended before the\n * branch's first commit was authored: a session that ended before the branch existed\n * cannot have produced its diff (SPEC-0068 R3). Unknown times ⇒ not stale (guard off). */\nexport function staleForBranch(endedAt: number | undefined, birthMs: number | null): boolean {\n  return birthMs != null && endedAt != null && endedAt < birthMs;\n}\n\n/**\n * Pick the session that backs a diff-scoped `receipts pr`. A diff-scoped receipt is about\n * *who produced this change*, so the right session is the one whose edits **overlap the\n * diff** — not merely one carrying the branch tag. The branch-matched session is tried\n * first (cheap, the common feature-branch case); only when it didn't touch the diff (an\n * integration/release branch whose work was merged from feature branches, or a squash\n * workflow — where the branch tag carries only unrelated sessions) do we scan recent\n * in-repo sessions for the real author. Evidence-based: only a session that edited a diff\n * file can win, so this never mis-attributes an unrelated session's work (cf. M56). Returns\n * the branch session (even at 0 overlap) as an honest last resort, or null if none.\n */\nasync function pickForDiff(\n  all: SessionSummary[],\n  branch: string,\n  repoRoot: string | undefined,\n  files: readonly string[],\n  birthMs: number | null = null,\n  shas: readonly string[] = [],\n): Promise<PickedSession | null> {\n  const load = async (sum: SessionSummary): Promise<PickedSession | null> => {\n    const session = await loadSession(sum);\n    if (!session) {\n      return null;\n    }\n    return { summary: sum, session, derived: deriveSpans(session) };\n  };\n\n  // 0) strongest evidence first (SPEC-0069): a session whose `git commit`/`git push`\n  // OUTPUT carries one of this branch's commit SHAs authored the branch — exact and\n  // agent-agnostic (Codex/Cursor record no branch tags and often edit via shell, so\n  // the tag and edit-overlap selectors below can't see them). The pool is NOT\n  // repo-filtered: a commit SHA is globally unique, so a session run from another\n  // checkout (worktree, cross-repo tooling) attributes correctly too. Most-recent\n  // first; the first authored match wins.\n  if (shas.length > 0) {\n    for (const sum of all.slice(0, PR_SELECT_SCAN)) {\n      const cand = await load(sum);\n      if (cand && authoredBranch(cand.derived.spans, shas)) {\n        return cand;\n      }\n    }\n  }\n\n  // 1) cheap path: the branch-matched session, if it actually produced the diff.\n  const primarySum = selectForBranch(all, branch, repoRoot);\n  const primary = primarySum ? await load(primarySum) : null;\n  if (primary && diffOverlap(primary.derived, files) > 0) {\n    return primary;\n  }\n\n  // 2) the branch session didn't touch the diff → find the session that did, among the\n  // most-recent in-repo sessions (bounded). Most-recent-first, so ties keep the newest.\n  // Stale guard (SPEC-0068 R3): unlike the tag-matched primary, a scan candidate's only\n  // evidence is file overlap — and an old session that once edited the same hot file\n  // (.husky/pre-push, cli.ts, README) overlaps every later diff that touches it. A\n  // session that ended before this branch's first commit was authored is excluded.\n  let best: PickedSession | null = null;\n  let bestScore = 0;\n  const recent = all\n    .filter((s) => inRepo(s.projectPath, repoRoot))\n    .filter((s) => !staleForBranch(s.endedAt, birthMs))\n    .slice(0, PR_SELECT_SCAN);\n  for (const sum of recent) {\n    const cand = await load(sum);\n    if (!cand) {\n      continue;\n    }\n    const score = diffOverlap(cand.derived, files);\n    if (score > bestScore) {\n      best = cand;\n      bestScore = score;\n    }\n  }\n  return best ?? primary;\n}\n\n/**\n * SPEC-0120 — the opt-in external-state reconciler CLI step (CI only). Finds the branch's\n * session, parses its external-state claims, calls the authoritative API (`gh`), and writes the\n * reconciliation side-log that `receipts pr` then attaches. Opt-in: a no-op unless\n * `RECEIPTS_RECONCILE` is set. The deterministic `receipts pr`/`verify` core never calls this.\n */\nasync function runReconcile(opts: { branch?: string }): Promise<number> {\n  if (!process.env.RECEIPTS_RECONCILE) {\n    process.stderr.write(\n      \"receipts reconcile: opt-in — set RECEIPTS_RECONCILE=1 to reconcile external-state claims against the GitHub API.\\n\",\n    );\n    return 0;\n  }\n  const branch = opts.branch || git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || undefined;\n  if (!branch || branch === \"HEAD\") {\n    process.stderr.write(\"receipts reconcile: not on a git branch (use --branch <name>).\\n\");\n    return 1;\n  }\n  // Pick the SAME session `receipts pr` will attach to, so the side-log's sessionId matches the\n  // produced receipt (a diff-scoped `pr` uses pickForDiff, not selectForBranch — they can differ).\n  const all = await listSessions();\n  const diff = changedFiles(undefined, {});\n  let session: Awaited<ReturnType<typeof loadSession>> | null = null;\n  if (diff) {\n    const picked = await pickForDiff(\n      all,\n      branch,\n      repoRoot,\n      diff.files,\n      branchBirthMs(diff.base),\n      branchShas(diff.base),\n    );\n    session = picked?.session ?? null;\n  }\n  if (!session) {\n    const summary = selectForBranch(all, branch, repoRoot);\n    session = summary ? await loadSession(summary) : null;\n  }\n  if (!session) {\n    process.stderr.write(`receipts reconcile: no agent session found for branch \"${branch}\".\\n`);\n    return 0;\n  }\n  const finalText =\n    [...session.messages].reverse().find((m) => m.role === \"assistant\" && m.text)?.text ?? \"\";\n  const sessionId = sessionIdFromPath(session.filePath);\n  const res = reconcileSession(sessionId, finalText, ghFetcher, new Date().toISOString());\n  const diverged = res.rows.filter((r) => !r.match).length;\n  process.stdout.write(\n    `receipts reconcile: ${res.claims} claim${res.claims === 1 ? \"\" : \"s\"} parsed · ${res.rows.length} reconciled (${diverged} divergence${diverged === 1 ? \"\" : \"s\"}) → side-log for ${sessionId}.\\n`,\n  );\n  return 0;\n}\n\nasync function runPr(opts: {\n  out?: string;\n  branch?: string;\n  base?: string;\n  store?: string;\n  wholeSession?: boolean;\n  /** M79 — render the work record to the terminal and store nothing (preview). */\n  preview?: boolean;\n  /** the triggering command also carries a `git commit` (compound commit+push):\n   * union the working tree into the diff scope — those files aren't in HEAD yet */\n  pendingCommit?: boolean;\n  /** SPEC-0118 — a `--criteria <file>` of definition-of-done items (one per line), merged\n   * with `.receipts/asserts.json` `criteria`. */\n  criteria?: string;\n}): Promise<number> {\n  const branch = opts.branch || git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]);\n  if (!branch || branch === \"HEAD\") {\n    process.stderr.write(\"receipts pr: not on a git branch (use --branch <name>).\\n\");\n    return 1;\n  }\n\n  // Diff-scope by default: the receipt reflects only this PR's change. The changed\n  // file set is recorded in `predicate.scope` so the receipt stays re-derivable\n  // (SPEC-0013). Fall back to a branch slice, then the whole session, and say which.\n  const diff = opts.wholeSession\n    ? null\n    : changedFiles(opts.base, { includeWorkingTree: opts.pendingCommit });\n  const all = await listSessions();\n  const picked = diff\n    ? await pickForDiff(\n        all,\n        branch,\n        repoRoot || undefined,\n        diff.files,\n        branchBirthMs(diff.base),\n        branchShas(diff.base),\n      )\n    : await (async () => {\n        const sum = selectForBranch(all, branch, repoRoot || undefined);\n        return sum ? { summary: sum, session: await loadSession(sum), derived: null } : null;\n      })();\n\n  if (!picked || !picked.session) {\n    process.stderr.write(\n      `receipts pr: no agent session found for branch \"${branch}\" in this repo.\\nBuild the branch with a coding agent first, or run \\`receipts --list\\`.\\n`,\n    );\n    return 1;\n  }\n  const { summary, session } = picked;\n\n  // SPEC-0118 completion-oracle — load the user's definition-of-done (criteria) once and\n  // attach it to the summary before deriving, so the completion detector can attest\n  // per-criterion artifact coverage. Pure file read; absent ⇒ the detector no-ops.\n  const criteria = loadCriteria(repoRoot || \".\", opts.criteria);\n\n  let scopedSession = session;\n  let derived = picked.derived ?? deriveSpans(session);\n  if (criteria.length) {\n    derived.criteria = criteria;\n  }\n  let findings = deriveFindings(derived);\n  // SPEC-0118 — capture the completion result on the PRE-scope summary (same inputs as the\n  // finding), so the recorded count matches the surviving finding after diff-scoping.\n  let completion = criteria.length\n    ? computeCompletion(derived, [...findings.main, ...findings.minor])\n    : undefined;\n  let scope: ReceiptScope = { kind: \"session\" };\n  let scopeNote = \"whole session\";\n\n  if (diff) {\n    const sd = applyDiffScope(derived, findings, diff.files, session.projectPath);\n    derived = sd.derived;\n    findings = sd.findings;\n    // Record the branch this diff receipt is FOR — used as the receipt title (the session's\n    // first-message title is shared across every branch a long session produces). Recorded in scope\n    // so L1 re-derivation reproduces the same title. (Effort narrowing stays shas-driven, below.)\n    scope = { kind: \"diff\", base: diff.base, files: diff.files, ...(branch ? { branch } : {}) };\n    // M83b — per-repo `generated` coverage globs from env (a repo commits this in its\n    // Claude settings env, like RECEIPTS_STORE). Recorded in scope so rederive re-applies\n    // the same globs (L1). Colon- or comma-separated.\n    const genGlobs = (process.env.RECEIPTS_GENERATED_GLOBS || \"\")\n      .split(/[:,]/)\n      .map((s) => s.trim())\n      .filter(Boolean);\n    if (genGlobs.length) {\n      scope.generatedGlobs = genGlobs;\n    }\n    scopeNote = `diff vs ${diff.base} (${diff.files.length} file${diff.files.length === 1 ? \"\" : \"s\"})`;\n    // Branch-narrowed effort (SPEC-0068 R4): this branch's turns ∩ diff-file edits.\n    // `scope.branch` records the narrowing so rederive reproduces it byte-for-byte.\n    const slice = sliceByBranch(session, branch);\n    let eff = narrowEffort(slice ? deriveSpans(slice) : null, diff.files);\n    if (!eff) {\n      // Tagless session (codex): bound by the branch's commit window instead\n      // (SPEC-0072 R1) — without this, sibling PRs of one marathon session that\n      // share a file each inherit the file's whole edit history. `scope.shas`\n      // records the anchors so rederive reproduces the window.\n      const shas = branchShas(diff.base);\n      const win = shaWindow(derived.spans, shas);\n      if (win) {\n        eff = windowedEffort(derived, diff.files, win);\n        if (eff) {\n          scope.shas = shas;\n        }\n      }\n    }\n    if (eff) {\n      derived = { ...derived, diffCostUsd: eff.cost, diffTokens: eff.tokens, diffTurns: eff.turns };\n      scope.branch = branch;\n    }\n  } else if (!opts.wholeSession) {\n    const slice = sliceByBranch(session, branch);\n    if (slice) {\n      scopedSession = slice;\n      derived = deriveSpans(slice);\n      if (criteria.length) {\n        derived.criteria = criteria;\n      }\n      findings = deriveFindings(derived);\n      completion = criteria.length\n        ? computeCompletion(derived, [...findings.main, ...findings.minor])\n        : undefined;\n      scope = { kind: \"branch\", branch };\n      scopeNote = `branch ${branch} (no git diff)`;\n    } else {\n      scopeNote = \"whole session (no diff / branch tags)\";\n    }\n  }\n\n  // M103 — read the live-guard side-log for this session (the deny/ask/warn decisions the\n  // receipts-guard hook recorded before the calls ran). Attached as a recorded input.\n  const guardEvents = readGuardEvents(sessionIdFromPath(scopedSession.filePath));\n  // M116 — read the external-state reconciliation side-log (the opt-in reconciler's API-vs-claim\n  // rows). Recorded input like guardEvents; absent ⇒ no rows (the reconciler is opt-in, default-off).\n  const externalState = readExternalState(sessionIdFromPath(scopedSession.filePath));\n  // M104 — load + attribute the session's subagent work (separate transcripts the parent never\n  // inlines, so otherwise invisible to the receipt). Recorded input; surfaced merge-relevant only.\n  const subagents = await loadSubagentActivity(scopedSession.filePath, {\n    diffFiles: scope?.kind === \"diff\" ? scope.files : undefined,\n  });\n  // M106b — discover a router-emitted witness log for this session and cross-check the\n  // model-decision surface. Recorded input like guardEvents; absent ⇒ self-reported (no row).\n  const witness = discoverWitness(\n    scopedSession,\n    process.env.RECEIPTS_WITNESS_LOG ??\n      process.env.ALTIMATE_ROUTER_WITNESS_LOG ??\n      join(homedir(), \".altimate-router\", \"witness\"),\n    process.env.RECEIPTS_WITNESS_KEY ?? process.env.ALTIMATE_ROUTER_GATEWAY_KEY,\n  );\n  // M120 — run opt-in L2 scanners over the diff scope (gated by RECEIPTS_EXPERIMENTAL_DETECTORS;\n  // diff-scoped only). A recorded input like guardEvents; absent/disabled ⇒ no rows.\n  const scanners =\n    scope.kind === \"diff\" && scope.files?.length\n      ? runScanners({ scopeFiles: scope.files, base: scope.base, repoRoot: repoRoot || undefined })\n      : [];\n  const receipt = redactReceipt(\n    await buildReceipt(scopedSession, derived, findings, {\n      scope,\n      guardEvents,\n      subagents,\n      witness,\n      scanners,\n      externalState,\n      completion,\n    }),\n  );\n\n  // Prior-receipt accumulation: cumulative PR effort (SPEC-0072 R3) + the append-only\n  // push ledger and cleared-event carry (SPEC-0073 R6/R7). Same-session regeneration\n  // replaces its own snapshot — only carried priors persist.\n  const p = receipt.predicate;\n  if (repoRoot && scope.kind === \"diff\") {\n    const slug = branch.replace(/[/\\\\]/g, \"-\");\n    let priorRaw: string | null = null;\n    try {\n      priorRaw = readReceiptRef(slug, repoRoot);\n      if (priorRaw == null) {\n        const f = join(repoRoot, \".receipts\", `${slug}.json`);\n        priorRaw = existsSync(f) ? readFileSync(f, \"utf8\") : null;\n      }\n    } catch {\n      priorRaw = null;\n    }\n    if (priorRaw != null) {\n      try {\n        const prev = (JSON.parse(priorRaw) as Receipt).predicate;\n        const sameSession =\n          prev.session?.startedAt === p.session.startedAt &&\n          prev.session?.agent === p.session.agent;\n        if (p.evidence.diffCostUsd != null) {\n          const priorUsd = sameSession\n            ? (prev.prEffort?.priorUsd ?? 0)\n            : (prev.prEffort?.totalUsd ?? prev.evidence.diffCostUsd ?? 0);\n          const sessions = sameSession\n            ? (prev.prEffort?.sessions ?? 1)\n            : (prev.prEffort?.sessions ?? 1) + 1;\n          if (priorUsd > 0) {\n            p.prEffort = {\n              priorUsd: Math.round(priorUsd * 100) / 100,\n              totalUsd: Math.round((priorUsd + p.evidence.diffCostUsd) * 100) / 100,\n              sessions,\n            };\n          }\n        }\n        // SPEC-0073 R6/R7 — event-state diff vs the prior receipt's VISIBLE events\n        // (same predicate as the renderer, so cleared rows only reference events that\n        // were shown), then append/replace the push-ledger entry.\n        const prevVisible = visibleMergeFindings(prev.findings ?? []);\n        const currVisible = visibleMergeFindings(p.findings);\n        const currKeys = new Set(currVisible.map(eventKey));\n        const prevKeys = new Set(prevVisible.map(eventKey));\n        const clearedNow = prevVisible\n          .filter((f) => !currKeys.has(eventKey(f)))\n          .map((f) => ({ title: f.title, ...(f.filePath ? { filePath: f.filePath } : {}) }));\n        const newCount = currVisible.filter((f) => !prevKeys.has(eventKey(f))).length;\n        const base = prev.prHistory?.length\n          ? prev.prHistory\n          : [\n              {\n                push: 1,\n                ...(prev.session?.endedAt ? { endedAt: prev.session.endedAt } : {}),\n                new: prevVisible.length,\n                cleared: 0,\n                open: prevVisible.length,\n                ...(prev.evidence.diffCostUsd != null\n                  ? { costUsd: prev.evidence.diffCostUsd }\n                  : {}),\n              },\n            ];\n        // Per-COMMIT rows (field ask: \"show commit-level spend\"): a new HEAD sha\n        // appends a row even within one session; regenerating on the same sha\n        // replaces the row (the hook re-runs per push attempt).\n        const sha = git([\"rev-parse\", \"--short=7\", \"HEAD\"]) || undefined;\n        const last = base[base.length - 1];\n        const sameHead = !!sha && last.sha === sha;\n        const entry = {\n          push: sameHead ? last.push : last.push + 1,\n          ...(sha ? { sha } : {}),\n          ...(p.session.endedAt ? { endedAt: p.session.endedAt } : {}),\n          new: newCount,\n          cleared: clearedNow.length,\n          open: currVisible.length,\n          ...(p.evidence.diffCostUsd != null ? { costUsd: p.evidence.diffCostUsd } : {}),\n        };\n        p.prHistory = [...(sameHead ? base.slice(0, -1) : base), entry].slice(-10);\n        if (clearedNow.length) {\n          p.prCleared = clearedNow;\n        }\n      } catch {\n        // unreadable prior — honest under-claim: no accumulation\n      }\n    } else {\n      // First push on this branch (no prior receipt): seed the append-only ledger with THIS push\n      // INCLUDING its HEAD sha, so a later push reads a push-1 row that already carries its commit\n      // (B2 — push 1 used to be synthesized later, after its sha was unrecoverable). The renderer\n      // shows the ledger only for a multi-push PR, so a lone push 1 stays tableless.\n      const sha = git([\"rev-parse\", \"--short=7\", \"HEAD\"]) || undefined;\n      const currVisible = visibleMergeFindings(p.findings);\n      p.prHistory = [\n        {\n          push: 1,\n          ...(sha ? { sha } : {}),\n          ...(p.session.endedAt ? { endedAt: p.session.endedAt } : {}),\n          new: currVisible.length,\n          cleared: 0,\n          open: currVisible.length,\n          ...(p.evidence.diffCostUsd != null ? { costUsd: p.evidence.diffCostUsd } : {}),\n        },\n      ];\n    }\n  }\n\n  // M79 — preview: render the EXACT Agent Work Record a reviewer will see (the same\n  // renderPrComment the CI Action mirrors), to the terminal, and store nothing. Runs\n  // the full build above (scope, effort, prEffort/prHistory) so the preview is\n  // byte-identical to the eventual comment. Adoption lever: see it before you push.\n  if (opts.preview) {\n    process.stdout.write(\n      renderPrComment(receipt, { nextAction: process.env.RECEIPTS_NEXT_ACTION !== \"0\" }),\n    );\n    process.stderr.write(\n      `receipts preview: rendered the work record (${scopeNote}); wrote nothing. This is exactly what CI will post.\\n`,\n    );\n    return 0;\n  }\n\n  const json = `${JSON.stringify(receipt, null, 2)}\\n`;\n\n  // M65 (SPEC-0064): where the receipt lives is configurable; default `commit` keeps today's\n  // behavior. `none` emits to stdout and writes nothing; `ref` (SPEC-0070) stores it at\n  // refs/receipts/<slug> with no tree files. `ephemeral`/`upload` remain unbuilt — they fall\n  // back to `commit` with a notice so nothing silently changes.\n  const store = (\n    opts.store ||\n    process.env.RECEIPTS_STORE ||\n    (repoRoot\n      ? (settingsStore(repoRoot) ?? settingsStore(primaryCheckout(repoRoot) ?? \"\"))\n      : undefined) ||\n    \"commit\"\n  ).toLowerCase();\n  if (store === \"none\") {\n    process.stdout.write(json);\n    process.stderr.write(\n      `receipts pr: store=none — printed the receipt (Grade ${receipt.predicate.grade}, ${scopeNote}); wrote nothing.\\n`,\n    );\n    return 0;\n  }\n  if ([\"ephemeral\", \"notes\", \"upload\"].includes(store)) {\n    process.stderr.write(\n      `receipts pr: store=${store} not yet implemented (SPEC-0064) — using \\`commit\\`.\\n`,\n    );\n  } else if (store !== \"commit\" && store !== \"ref\") {\n    process.stderr.write(`receipts pr: unknown store=${store} — using \\`commit\\`.\\n`);\n  }\n\n  const safe = branch.replace(/[/\\\\]/g, \"-\");\n\n  // store=ref (SPEC-0070): the receipt lives at refs/receipts/<slug> — no tree\n  // files, no PR-diff entry, nothing on main. The hook pushes the ref alongside\n  // the branch; CI fetches it. Falls back to `commit` if the plumbing fails.\n  if (store === \"ref\") {\n    const w = writeReceiptRef(safe, branch, json, summary.endedAt, repoRoot || undefined);\n    if (w.ok) {\n      process.stderr.write(\n        `receipts pr: wrote ${w.ref} (Grade ${receipt.predicate.grade}, ${scopeNote}) from \"${summary.title ?? \"untitled\"}\" — no tree files.\\n`,\n      );\n      return 0;\n    }\n    process.stderr.write(`receipts pr: store=ref failed (${w.reason}) — using \\`commit\\`.\\n`);\n  }\n\n  const dir = join(repoRoot || \".\", \".receipts\");\n  const out = opts.out ?? join(dir, `${safe}.json`);\n  mkdirSync(dir, { recursive: true });\n  // Mark receipts linguist-generated so GitHub collapses them in PR diffs (the\n  // \"one more JSON in every PR\" complaint — docs/research/receipt-transport-options.md).\n  // Written here, not just in init, so existing adopters pick it up on their next receipt.\n  const attrs = join(dir, \".gitattributes\");\n  if (!existsSync(attrs)) {\n    writeFileSync(attrs, \"* linguist-generated\\n\");\n    git([\"add\", attrs]);\n  }\n  writeFileSync(out, json);\n  git([\"add\", out]); // best-effort stage\n\n  const rel = repoRoot ? relative(repoRoot, out) : out;\n  process.stderr.write(\n    `receipts pr: wrote ${rel} (Grade ${receipt.predicate.grade}, ${scopeNote}) from \"${summary.title ?? \"untitled\"}\".\\n`,\n  );\n  return 0;\n}\n\n/**\n * `receipts guardrails [selector] [--last N]` — turn findings into a paste-ready\n * prevention block (AGENTS.md / CLAUDE.md). Aggregates the deduped guardrailRules.\n */\nasync function runGuardrails(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  last?: number;\n  out?: string;\n  copy?: boolean;\n  json?: boolean;\n}): Promise<number> {\n  if (!(await anyDetected())) {\n    process.stderr.write(`No agent transcripts found under ${rootsHint()}.\\n`);\n    return 1;\n  }\n\n  const derivations = await deriveTargets({\n    agent: opts.agent,\n    last: opts.last,\n    selector: opts.selector,\n  });\n  if (derivations.length === 0) {\n    process.stderr.write(\"guardrails: no matching session.\\n\");\n    return 1;\n  }\n  const findingSets = derivations.map((d) => d.findings);\n\n  const rules = collectGuardrails(findingSets);\n  const block = renderGuardrailsBlock(rules, opts.json ? \"json\" : \"md\");\n\n  if (opts.out) {\n    const existing = existsSync(opts.out) ? readFileSync(opts.out, \"utf8\") : \"\";\n    writeFileSync(opts.out, upsertGuardrailsSection(existing, block));\n    process.stderr.write(\n      `guardrails: wrote ${rules.length} rule(s) to ${opts.out} (from ${findingSets.length} session${findingSets.length === 1 ? \"\" : \"s\"}).\\n`,\n    );\n    return 0;\n  }\n\n  emit(block, opts.copy ?? false, \"Guardrails\");\n  if (opts.last) {\n    process.stderr.write(`(from the last ${findingSets.length} sessions)\\n`);\n  }\n  return 0;\n}\n\n/**\n * `receipts trends [--last N]` — a cross-session digest: grade movement, the finding\n * kinds that recur most, and evidence totals over your last N sessions. Reuses the\n * same per-session derivation as the Report Card; deterministic, zero model calls.\n */\nasync function runTrends(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  last?: number;\n  out?: string;\n  copy?: boolean;\n  json?: boolean;\n  color?: boolean;\n}): Promise<number> {\n  if (!(await anyDetected())) {\n    process.stderr.write(`No agent transcripts found under ${rootsHint()}.\\n`);\n    return 1;\n  }\n\n  // A trend needs a window: default to the last 10 sessions. An explicit selector\n  // pins a single session; --last N overrides both.\n  const requested = opts.last && opts.last > 0 ? opts.last : opts.selector ? 1 : 10;\n  const derivations = await deriveTargets(\n    opts.last && opts.last > 0\n      ? { agent: opts.agent, last: opts.last }\n      : opts.selector\n        ? { agent: opts.agent, selector: opts.selector }\n        : { agent: opts.agent, last: 10 },\n  );\n  if (derivations.length === 0) {\n    process.stderr.write(\"trends: no matching sessions.\\n\");\n    return 1;\n  }\n\n  // deriveTargets is most-recent-first; the digest reads oldest → newest.\n  const inputs = derivations\n    .slice()\n    .reverse()\n    .map((d) => ({ derived: d.derived, findings: d.findings }));\n  const trends = computeTrends(inputs, requested);\n\n  if (opts.out) {\n    const block = renderTrends(trends, \"md\");\n    const existing = existsSync(opts.out) ? readFileSync(opts.out, \"utf8\") : \"\";\n    writeFileSync(opts.out, upsertTrendsSection(existing, block));\n    process.stderr.write(\n      `trends: wrote section to ${opts.out} (from ${trends.window.used} sessions).\\n`,\n    );\n    return 0;\n  }\n\n  if (opts.json) {\n    emit(renderTrends(trends, \"json\"), opts.copy ?? false, \"Trends\");\n    return 0;\n  }\n\n  process.stdout.write(renderTrends(trends, \"card\", { color: opts.color }));\n  if (opts.copy) {\n    const ok = copyToClipboard(renderTrends(trends, \"card\", { color: false }));\n    process.stderr.write(\n      ok ? \"Trends copied to clipboard.\\n\" : \"Clipboard unavailable — copy the output above.\\n\",\n    );\n  }\n  return 0;\n}\n\n/** `receipts envelope <receipt.json>` — wrap a Receipt as an unsigned DSSE envelope. */\nfunction runEnvelope(file?: string): number {\n  if (!file) {\n    process.stderr.write(\"Usage: receipts envelope <receipt.json>\\n\");\n    return 1;\n  }\n  try {\n    const receipt = JSON.parse(readFileSync(file, \"utf8\"));\n    process.stdout.write(`${JSON.stringify(toDsseEnvelope(receipt), null, 2)}\\n`);\n    return 0;\n  } catch (err) {\n    process.stderr.write(`Could not read ${file}: ${err instanceof Error ? err.message : err}\\n`);\n    return 1;\n  }\n}\n\n/** `receipts verify <bundle> [--transcript <t> --branch b]` — structural + re-derivation. */\nasync function runVerify(\n  file?: string,\n  opts: { transcript?: string; branch?: string; witness?: string } = {},\n): Promise<number> {\n  if (!file) {\n    process.stderr.write(\"Usage: receipts verify <bundle.json> [--transcript <t> [--branch b]]\\n\");\n    return 1;\n  }\n  let input: unknown;\n  try {\n    input = JSON.parse(readFileSync(file, \"utf8\"));\n  } catch (err) {\n    process.stderr.write(`Could not read ${file}: ${err instanceof Error ? err.message : err}\\n`);\n    return 1;\n  }\n  const result = verifyBundle(input);\n  if (!result.ok) {\n    process.stderr.write(\"✗ Invalid Receipt:\\n\");\n    for (const e of result.errors) {\n      process.stderr.write(`  - ${e}\\n`);\n    }\n    return 1;\n  }\n\n  const sig = result.signed\n    ? `signed${result.rekorLogIndex !== undefined ? ` · Rekor #${result.rekorLogIndex}` : \"\"}`\n    : \"unsigned\";\n  process.stdout.write(`✓ Valid Receipt — Grade ${result.grade} · ${sig}\\n`);\n  if (result.signer) {\n    process.stdout.write(`  signer: ${result.signer}\\n`);\n  }\n\n  // Witness cross-check (M106): independently confirm the transcript's model-decision\n  // surface against a router-emitted witness log. Needs the transcript to load the session.\n  if (opts.witness) {\n    if (!opts.transcript) {\n      process.stderr.write(\"  ✗ --witness needs --transcript (to load the session to check)\\n\");\n      return 1;\n    }\n    const wres = await runWitnessCheck(opts.transcript, opts.witness);\n    if (wres !== 0) {\n      return wres;\n    }\n  }\n\n  // Re-derivation: prove the Receipt is faithful to its transcript (L1).\n  if (opts.transcript && result.receipt) {\n    const cmp = await compareToTranscript(result.receipt, opts.transcript, { branch: opts.branch });\n    if (!cmp.rederived) {\n      process.stderr.write(\"  ✗ could not re-derive from the supplied transcript\\n\");\n      return 1;\n    }\n    if (!cmp.matches) {\n      process.stderr.write(\n        \"  ✗ re-derivation MISMATCH — the Receipt does not match its transcript (possibly hand-edited)\\n\",\n      );\n      return 1;\n    }\n    process.stdout.write(\"  ✓ re-derived — faithful to the transcript (L1)\\n\");\n    return 0;\n  }\n\n  process.stdout.write(\n    \"  Note: structural check only. Pass --transcript to prove fidelity (L1); `gh attestation verify` for full Sigstore/Rekor.\\n\",\n  );\n  return 0;\n}\n\n/** Read a {@link WitnessLog} from a raw `{blocks}` file or a DSSE envelope wrapping one. */\nfunction readWitnessLog(path: string): WitnessLog | null {\n  let v: unknown;\n  try {\n    v = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    return null;\n  }\n  if (v && typeof v === \"object\" && Array.isArray((v as WitnessLog).blocks)) {\n    return v as WitnessLog;\n  }\n  // DSSE-wrapped: payload is base64 of the canonical WitnessLog JSON.\n  const payload = (v as { payload?: unknown })?.payload;\n  if (typeof payload === \"string\") {\n    try {\n      const inner = JSON.parse(Buffer.from(payload, \"base64\").toString(\"utf8\"));\n      if (inner && Array.isArray(inner.blocks)) {\n        return inner as WitnessLog;\n      }\n    } catch {\n      /* fall through */\n    }\n  }\n  return null;\n}\n\n/**\n * `verify --witness <log>` (M106): cross-check the transcript's model-decision blocks\n * against a router-emitted witness log. Returns the process exit code (0 = witnessed or\n * partial; 1 = divergence, bad signature, or load error). Non-blocking by nature — this only\n * runs when the user explicitly passes a witness log.\n */\nasync function runWitnessCheck(transcript: string, witnessPath: string): Promise<number> {\n  const log = readWitnessLog(witnessPath);\n  if (!log) {\n    process.stderr.write(`  ✗ could not read a witness log from ${witnessPath}\\n`);\n    return 1;\n  }\n  const sigKey = process.env.RECEIPTS_WITNESS_KEY ?? process.env.ALTIMATE_ROUTER_GATEWAY_KEY;\n  const sigState = verifyWitnessSig(log as unknown as Record<string, unknown>, sigKey);\n  if (sigState === \"bad\") {\n    process.stderr.write(\n      \"  ✗ witness log SIGNATURE INVALID — the log itself was altered after the router signed it. Refusing to trust it.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadById(\"claude-code\", transcript);\n  if (!session) {\n    process.stderr.write(`  ✗ could not load the transcript ${transcript}\\n`);\n    return 1;\n  }\n  const r = crossCheck(session, log);\n  if (r.tier === \"witness-divergence\") {\n    process.stderr.write(\n      `  ✗ witness divergence — ${r.missing} of ${r.witnessed} model decisions the router saw are missing from the transcript (first at block ${r.firstMissingIndex}). The submitted transcript does not match what altimate-router independently recorded.\\n`,\n    );\n    return 1;\n  }\n  const cov = r.witnessed === 0 ? \"\" : ` — ${r.present}/${r.witnessed} model decisions intact`;\n  const sigNote =\n    sigState === \"verified\"\n      ? \" · signature verified\"\n      : sigState === \"no-key\"\n        ? \" · signed (set RECEIPTS_WITNESS_KEY to verify)\"\n        : \"\";\n  process.stdout.write(`  ✓ witnessed by altimate-router${cov}${sigNote}\\n`);\n  return 0;\n}\n\n/** `receipts diff <a.json> <b.json>` — what changed between two receipts (M51). */\nfunction runDiff(\n  fileA?: string,\n  fileB?: string,\n  opts: { json?: boolean; out?: string } = {},\n): number {\n  let pathA = fileA;\n  let pathB = fileB;\n  // No args → \"what changed since the last run\": diff the two most recent committed\n  // receipts in .receipts/ (composes `log`'s history with `diff`). A = older, B = newest.\n  if (!pathA && !pathB) {\n    const hist = loadReceiptHistory(\".receipts\");\n    if (hist.length < 2) {\n      process.stderr.write(\n        `receipts diff: need two receipts. Found ${hist.length} in .receipts/ — pass two explicitly: receipts diff <a.json> <b.json>.\\n`,\n      );\n      return 1;\n    }\n    // `<slug>@ref` entries are ref-stored (SPEC-0070) — resolved by `read` below.\n    const sourceOf = (name: string): string =>\n      name.endsWith(\"@ref\") ? name : join(\".receipts\", `${name}.json`);\n    pathA = sourceOf(hist[1].name); // second-newest = baseline\n    pathB = sourceOf(hist[0].name); // newest = new\n    process.stdout.write(`receipts diff: ${hist[1].name} → ${hist[0].name} (most recent two)\\n\\n`);\n  }\n  if (!pathA || !pathB) {\n    process.stderr.write(\n      \"Usage: receipts diff [<receiptA.json> <receiptB.json>] [--json] [--out <f>]\\n\" +\n        \"  with no args, diffs the two most recent receipts in .receipts/\\n\",\n    );\n    return 1;\n  }\n  const read = (f: string): Receipt | null => {\n    let input: unknown;\n    try {\n      const raw = f.endsWith(\"@ref\") ? readReceiptRef(f.slice(0, -\"@ref\".length)) : null;\n      input = JSON.parse(raw ?? readFileSync(f, \"utf8\"));\n    } catch (err) {\n      process.stderr.write(`Could not read ${f}: ${err instanceof Error ? err.message : err}\\n`);\n      return null;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) {\n      process.stderr.write(`✗ ${f} is not a valid Receipt:\\n`);\n      for (const e of res.errors) process.stderr.write(`  - ${e}\\n`);\n      return null;\n    }\n    return res.receipt;\n  };\n  const a = read(pathA);\n  const b = read(pathB);\n  if (!a || !b) return 1;\n\n  const delta = diffReceipts(a, b);\n  const output = opts.json ? `${JSON.stringify(delta, null, 2)}\\n` : renderDiff(delta);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts diff: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts ack [slug]` (M78) — record an attributed human acknowledgment that a\n * reviewer looked at the agent's work, into an append-only local ledger\n * (refs/receipts-acks/<slug>). The active gesture + the audit signal; local-only (the\n * outward comment-write half is deferred). Gated behind `RECEIPTS_ACK=1`. */\nfunction runAck(\n  slugArg?: string,\n  opts: { note?: string; eventId?: string; json?: boolean } = {},\n): number {\n  if (process.env.RECEIPTS_ACK !== \"1\") {\n    process.stderr.write(\n      \"receipts ack is experimental — set RECEIPTS_ACK=1 to enable (record an attributed review; local-only).\\n\",\n    );\n    return 1;\n  }\n  const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const slug = (slugArg || branch || \"\").replace(/[/\\\\]/g, \"-\");\n  if (!slug) {\n    process.stderr.write(\"receipts ack: no slug and not on a git branch — pass a receipt slug.\\n\");\n    return 1;\n  }\n  const entry: AckEntry = {\n    actor: resolveActor(),\n    ts: Date.now(),\n    ...(opts.note ? { note: opts.note } : {}),\n    ...(opts.eventId ? { eventId: opts.eventId } : {}),\n  };\n  const res = appendAck(slug, entry);\n  if (!res.ok) {\n    process.stderr.write(`receipts ack: ${res.reason}.\\n`);\n    return 1;\n  }\n  if (opts.json) {\n    process.stdout.write(\n      `${JSON.stringify({ slug, ref: res.ref, total: res.total, entry }, null, 2)}\\n`,\n    );\n    return 0;\n  }\n  const who = entry.actor;\n  const what = entry.eventId ? `event \\`${entry.eventId}\\`` : `the work record for \\`${slug}\\``;\n  process.stdout.write(\n    `Acknowledged ${what} as ${who}${entry.note ? ` — \"${entry.note}\"` : \"\"} · ${res.total} ack${res.total === 1 ? \"\" : \"s\"} on record (local; refs/receipts-acks/${slug}).\\n`,\n  );\n  return 0;\n}\n\n/** `receipts fleet` (M77) — local cross-repo / cross-agent rollup over `refs/receipts/*`\n * (+ `.receipts/*.json`). Gated behind `RECEIPTS_FLEET=1` (experimental): the seed data\n * layer of the org dashboard, proving the org-record value with no server, no upload.\n * Deterministic, local-only, counts-not-verdict (R1/R2/R4). */\nfunction runFleet(opts: { repos?: string[]; json?: boolean; out?: string } = {}): number {\n  if (process.env.RECEIPTS_FLEET !== \"1\") {\n    process.stderr.write(\n      \"receipts fleet is experimental — set RECEIPTS_FLEET=1 to enable (cross-repo agent-work rollup, local-only).\\n\",\n    );\n    return 1;\n  }\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const repos = opts.repos && opts.repos.length > 0 ? opts.repos : [repoRoot];\n  const fleet = computeFleetFromRepos(repos);\n  const body = opts.json ? `${JSON.stringify(fleet, null, 2)}\\n` : renderFleet(fleet);\n  if (opts.out) {\n    writeFileSync(opts.out, body);\n    process.stdout.write(`receipts fleet: wrote ${opts.out}\\n`);\n    return 0;\n  }\n  process.stdout.write(body);\n  return 0;\n}\n\n/** `receipts log [dir]` — list the committed receipts in `.receipts/` (M52). */\nfunction runLog(dir?: string, opts: { json?: boolean; last?: number; out?: string } = {}): number {\n  const all = loadReceiptHistory(dir ?? \".receipts\");\n  const shown = opts.last ? all.slice(0, opts.last) : all;\n  const output = opts.json ? `${JSON.stringify(shown, null, 2)}\\n` : renderLog(shown, all.length);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts log: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts stats [dir]` — dogfooding scoreboard over the committed receipts (M53). */\nfunction runStats(dir?: string, opts: { json?: boolean; out?: string } = {}): number {\n  const stats = computeStats(dir ?? \".receipts\");\n  const output = opts.json ? `${JSON.stringify(stats, null, 2)}\\n` : renderStats(stats);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts stats: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts badge` (M59) — emit a shields.io endpoint JSON for a committed receipt (the\n * branch receipt by default), an at-a-glance factual state for a README/PR badge. States the\n * finding count, colors by worst severity; never a quality verdict (R2). Deterministic. */\nfunction runBadge(file?: string, opts: { out?: string } = {}): number {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const path =\n    file ??\n    (branch && branch !== \"HEAD\"\n      ? join(repoRoot, \".receipts\", `${branch.replace(/[/\\\\]/g, \"-\")}.json`)\n      : undefined);\n  if (!path || !existsSync(path)) {\n    process.stderr.write(\n      `receipts badge: no receipt found${path ? ` at ${path}` : \"\"}. Run \\`receipts pr\\` first, or pass a receipt path.\\n`,\n    );\n    return 1;\n  }\n  let input: unknown;\n  try {\n    input = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    process.stderr.write(`receipts badge: could not parse ${path}\\n`);\n    return 1;\n  }\n  const res = verifyBundle(input);\n  if (!res.ok || !res.receipt) {\n    process.stderr.write(`receipts badge: ${path} is not a valid Receipt.\\n`);\n    return 1;\n  }\n  const output = `${JSON.stringify(badgeEndpoint(res.receipt.predicate), null, 2)}\\n`;\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts badge: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts sarif` (M63) — emit SARIF 2.1.0 for a committed receipt (the branch receipt by\n * default) so GitHub code-scanning can post findings inline + in the Security tab. Pure\n * transform; uploading is the user's CI step (see docs/sarif.md). */\nfunction runSarif(file?: string, opts: { out?: string } = {}): number {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n  const path =\n    file ??\n    (branch && branch !== \"HEAD\"\n      ? join(repoRoot, \".receipts\", `${branch.replace(/[/\\\\]/g, \"-\")}.json`)\n      : undefined);\n  if (!path || !existsSync(path)) {\n    process.stderr.write(\n      `receipts sarif: no receipt found${path ? ` at ${path}` : \"\"}. Run \\`receipts pr\\` first, or pass a receipt path.\\n`,\n    );\n    return 1;\n  }\n  let input: unknown;\n  try {\n    input = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    process.stderr.write(`receipts sarif: could not parse ${path}\\n`);\n    return 1;\n  }\n  const res = verifyBundle(input);\n  if (!res.ok || !res.receipt) {\n    process.stderr.write(`receipts sarif: ${path} is not a valid Receipt.\\n`);\n    return 1;\n  }\n  const output = `${JSON.stringify(toSarif(res.receipt), null, 2)}\\n`;\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts sarif: wrote ${opts.out}\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts export --format <id> [selector]` (M114) — serialize a session's Receipt to an external\n * format via the EXPORTERS registry. Resolves the session (like the default card), derives spans +\n * findings + receipt, and hands both to the exporter (otel needs the span tree; sarif ignores it).\n * Facts only — the exporters never emit a grade/score/verdict. */\nasync function runExport(\n  selector: string | undefined,\n  opts: { format?: string; out?: string; agent?: AgentSource } = {},\n): Promise<number> {\n  const exporter = opts.format ? exporterFor(opts.format) : undefined;\n  if (!exporter) {\n    process.stderr.write(\n      `receipts export: ${opts.format ? `unknown --format \"${opts.format}\"` : \"missing --format\"}. ` +\n        `Available: ${exporterIds().join(\", \")}.\\n`,\n    );\n    return 1;\n  }\n  const summary = selectSummary(await listSessions(opts.agent), selector);\n  if (!summary) {\n    process.stderr.write(\n      selector\n        ? `No session matched \"${selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n  const derived = deriveSpans(session);\n  const receipt = redactReceipt(await buildReceipt(session, derived, deriveFindings(derived)));\n  const output = exporter.export(receipt, derived);\n  if (opts.out) {\n    writeFileSync(opts.out, output);\n    process.stdout.write(`receipts export: wrote ${opts.out} (${exporter.id})\\n`);\n  } else {\n    process.stdout.write(output);\n  }\n  return 0;\n}\n\n/** `receipts prune` (M65b) — the committed-receipt clutter reducer: remove\n * `.receipts/<branch>.json` files whose branch no longer exists on the remote (merged/deleted),\n * keeping live-branch receipts + the example files. Live branches come from `git ls-remote`; if\n * that can't be read, it aborts and removes nothing. `--dry-run` previews. */\nfunction runPrune(dir?: string, opts: { dryRun?: boolean } = {}): number {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  const dpath = dir ?? join(repoRoot, \".receipts\");\n  let files: string[];\n  try {\n    files = readdirSync(dpath).filter((f) => f.endsWith(\".json\"));\n  } catch {\n    process.stderr.write(`receipts prune: no ${dpath} directory.\\n`);\n    return 0;\n  }\n  const ls = git([\"ls-remote\", \"--heads\", \"origin\"]);\n  if (ls === null) {\n    process.stderr.write(\n      \"receipts prune: could not list remote branches (offline / no 'origin'?) — aborting, nothing removed.\\n\",\n    );\n    return 1;\n  }\n  const liveSlugs = new Set(\n    ls\n      .split(\"\\n\")\n      .map((l) => l.split(\"refs/heads/\")[1])\n      .filter(Boolean)\n      .map((b) => branchSlug(b.trim())),\n  );\n  const { keep, remove } = planPrune(files, liveSlugs);\n  if (remove.length === 0) {\n    const prunedRefs = pruneReceiptRefs(liveSlugs, opts.dryRun ?? false);\n    if (prunedRefs === 0) {\n      process.stdout.write(`receipts prune: nothing to prune (${keep.length} receipt(s) kept).\\n`);\n    }\n    return 0;\n  }\n  if (opts.dryRun) {\n    process.stdout.write(\n      `receipts prune (dry-run): would remove ${remove.length}/${files.length} receipt(s), keep ${keep.length}:\\n`,\n    );\n    for (const f of remove) {\n      process.stdout.write(`  - ${f}\\n`);\n    }\n    pruneReceiptRefs(liveSlugs, true);\n    return 0;\n  }\n  pruneReceiptRefs(liveSlugs, false);\n  for (const f of remove) {\n    const p = join(dpath, f);\n    if (git([\"rm\", \"-f\", \"--\", p]) === null) {\n      try {\n        unlinkSync(p);\n      } catch {\n        /* already gone */\n      }\n    }\n  }\n  process.stdout.write(\n    `receipts prune: removed ${remove.length} receipt(s) for merged/deleted branches; kept ${keep.length}.\\n`,\n  );\n  return 0;\n}\n\n/** Prune ref-stored receipts (SPEC-0070): a refs/receipts/<slug> whose branch is\n * gone from origin is deleted locally and on the remote. Shares runPrune's\n * liveness basis (origin's heads) and dry-run semantics. */\nfunction pruneReceiptRefs(liveSlugs: Set<string>, dryRun: boolean): number {\n  const refs = listReceiptRefs().filter(({ slug }) => !liveSlugs.has(slug));\n  if (refs.length === 0) {\n    return 0;\n  }\n  for (const { ref, slug } of refs) {\n    if (dryRun) {\n      process.stdout.write(`  - ${ref}\\n`);\n      continue;\n    }\n    git([\"update-ref\", \"-d\", ref]);\n    git([\"push\", \"origin\", `:${ref}`]); // best-effort remote cleanup\n    process.stdout.write(`receipts prune: removed ${ref} (branch ${slug} gone).\\n`);\n  }\n  return refs.length;\n}\n\n/** `receipts eval` — field scan (M57): run the work-account detectors over your own real\n * local agent sessions and report how often each merge-surface category fires. A flag rate\n * the human interprets (a flag may be a true finding or an FP), never a verdict. Local-first\n * (reads only local sessions), deterministic, 0 model calls. `--last N` bounds the scan\n * (default 200, most-recent first). The labeled precision/recall corpus is a dev/CI artifact\n * (see `eval/corpus.json` + `test/eval.test.ts`), not shipped through this command. */\nasync function runEval(\n  opts: { json?: boolean; limit?: number; agent?: AgentSource } = {},\n): Promise<number> {\n  const limit = opts.limit && opts.limit > 0 ? opts.limit : 200;\n  const summaries = (await listSessions(opts.agent)).slice(0, limit);\n  const rows: FieldRow[] = [];\n  for (const summary of summaries) {\n    const session = await loadSession(summary);\n    if (!session) {\n      continue;\n    }\n    const { main, minor } = deriveFindings(deriveSpans(session));\n    rows.push({\n      title: summary.title ?? summary.id,\n      categories: [...firedCategories([...main, ...minor])],\n    });\n  }\n  const scan = summarizeFieldScan(rows);\n  process.stdout.write(opts.json ? `${JSON.stringify(scan, null, 2)}\\n` : renderFieldScan(scan));\n  return 0;\n}\n\n/** `receipts init` — one-command integration (SPEC-0066): scaffold the quiet-mode\n * \"Verified by Receipts\" PR-check workflow AND the repo-committed Claude Code hook\n * (a frozen npx one-liner in .claude/settings.json — every contributor gets it on\n * clone, behavior updates ship via npm). `--prepare` additionally wires the git-hook\n * floor into package.json. Each artifact is independently idempotent. `--pr` then\n * does the ceremony too: branch, commit (only the generated files), push, open the\n * PR — each step best-effort, degrading to printed instructions. */\nfunction runInit(\n  opts: { prepare?: boolean; agents?: string[]; pr?: boolean; guard?: boolean } = {},\n): number {\n  const lines: string[] = [];\n  /** files this run actually created or changed — the exact commit for `--pr` */\n  const written: string[] = [];\n\n  const v = getVersion();\n  // Float the major tag (`v0`, `v1` — the `actions/checkout@v4` pattern) so adopters get new\n  // minor/patch features automatically on the next CI run; only a major bump needs a workflow\n  // edit. Security-strict adopters can pin a full version (vX.Y.Z) or a commit SHA instead.\n  const major = /^(\\d+)\\.\\d+\\.\\d+/.exec(v)?.[1];\n  const tag = major ? `v${major}` : \"v0\";\n  const dir = \".github/workflows\";\n  const path = `${dir}/receipts.yml`;\n  if (existsSync(path)) {\n    lines.push(`receipts init: ${path} already exists — leaving it untouched.`);\n  } else {\n    mkdirSync(dir, { recursive: true });\n    writeFileSync(path, workflowContent(tag, v));\n    written.push(path);\n    lines.push(`receipts init: wrote ${path} (tracking ${tag}, quiet + non-blocking).`);\n  }\n\n  // The agent-embedded trigger: generation fires inside any Claude Code session\n  // that pushes — repo state, not machine state, so there is nothing to install.\n  const settingsPath = join(\".claude\", \"settings.json\");\n  const merged = mergeHookIntoSettings(settingsPath, undefined, { defaultStoreRef: true });\n  if (!merged.ok) {\n    lines.push(`receipts init: ${merged.reason}.`);\n  } else if (merged.changed) {\n    written.push(settingsPath);\n    lines.push(\n      `receipts init: added the receipts pre-push hook to ${settingsPath} (store=ref — receipts live at refs/receipts/<branch>, no files in the tree).`,\n    );\n  } else {\n    lines.push(`receipts init: ${settingsPath} already has the receipts hook.`);\n  }\n  // Opt-in live guard (M103): classifies tool calls BEFORE they run (deny/ask/warn) and records the\n  // decision for the receipt. Off by default — active gating is the user's choice; turn it off any\n  // time with `RECEIPTS_GUARD=0` (no un-install needed).\n  if (opts.guard) {\n    const g = mergeHookIntoSettings(settingsPath, GUARD_HOOK_COMMAND, { matcher: GUARD_MATCHER });\n    if (!g.ok) {\n      lines.push(`receipts init: ${g.reason} (live guard).`);\n    } else if (g.changed) {\n      if (!written.includes(settingsPath)) written.push(settingsPath);\n      lines.push(\n        `receipts init: added the live guard (PreToolUse) to ${settingsPath} — deny/ask/warn before a tool runs. Opt out any time with RECEIPTS_GUARD=0.`,\n      );\n    } else {\n      lines.push(`receipts init: ${settingsPath} already has the live guard.`);\n    }\n  }\n  const ignorePath = join(\".claude\", \".gitignore\");\n  if (!existsSync(ignorePath)) {\n    writeFileSync(ignorePath, \"*\\n!settings.json\\n!.gitignore\\n\");\n    written.push(ignorePath);\n    lines.push(`receipts init: wrote ${ignorePath} (commit settings.json, ignore the rest).`);\n  }\n  // Codex native trigger (SPEC-0069 R4): same schema as Claude's settings hooks,\n  // different file + dialect. Written when asked for (--agents codex) or when the\n  // repo already carries a .codex/ dir (the team clearly uses Codex).\n  if (opts.agents?.includes(\"codex\") || existsSync(\".codex\")) {\n    const codexPath = join(\".codex\", \"hooks.json\");\n    const m = mergeHookIntoSettings(\n      codexPath,\n      \"npx -y altimate-receipts@latest hook pre-push --agent codex\",\n      { defaultStoreRef: true },\n    );\n    if (!m.ok) {\n      lines.push(`receipts init: ${m.reason}.`);\n    } else if (m.changed) {\n      written.push(codexPath);\n      lines.push(`receipts init: added the receipts pre-push hook to ${codexPath}.`);\n    } else {\n      lines.push(`receipts init: ${codexPath} already has the receipts hook.`);\n    }\n  }\n\n  // Receipts are linguist-generated: GitHub collapses them in PR diffs, so the\n  // committed .receipts/<branch>.json never adds review noise.\n  const attrsPath = join(\".receipts\", \".gitattributes\");\n  if (!existsSync(attrsPath)) {\n    mkdirSync(\".receipts\", { recursive: true });\n    writeFileSync(attrsPath, \"* linguist-generated\\n\");\n    written.push(attrsPath);\n    lines.push(`receipts init: wrote ${attrsPath} (receipts collapse in PR diffs).`);\n  }\n\n  if (opts.prepare) {\n    const wired = wirePrepareScript(\"package.json\");\n    if (!wired.ok) {\n      lines.push(`receipts init: ${wired.reason}.`);\n    } else if (wired.changed) {\n      written.push(\"package.json\");\n      lines.push(\n        \"receipts init: wired `prepare` in package.json — `npm install` now self-installs the git hook.\",\n      );\n    } else {\n      lines.push(\"receipts init: package.json `prepare` already wired.\");\n    }\n  }\n\n  if (opts.pr) {\n    openAdoptionPr(written, lines);\n  } else {\n    lines.push(\"  Commit these, open a PR, and receipts attach themselves from then on.\");\n    lines.push(\"  (Or let init do that too: `npx altimate-receipts init --pr`.)\");\n  }\n  if (written.includes(settingsPath)) {\n    // Field-observed: a session that ran init then pushed got no receipt — agent\n    // runtimes snapshot project hooks at session START, so the hook arms next session.\n    lines.push(\"  Note: agent sessions load hooks at startup — restart any running session once.\");\n  }\n  process.stdout.write(`${lines.join(\"\\n\")}\\n`);\n  return 0;\n}\n\nconst ADOPT_BRANCH = \"chore/adopt-receipts\";\n\n/** `init --pr` — finish the ceremony: branch, commit ONLY the files init generated,\n * push, open the PR (gh when available, else the GitHub compare URL). Every step is\n * best-effort: a failure prints what to do by hand and never loses the files. */\nfunction openAdoptionPr(written: string[], lines: string[]): void {\n  if (written.length === 0) {\n    lines.push(\"receipts init: nothing new to commit — the repo is already integrated.\");\n    return;\n  }\n  if (!git([\"rev-parse\", \"--git-dir\"])) {\n    lines.push(\"receipts init: not a git repository — commit the files above manually.\");\n    return;\n  }\n  if (git([\"rev-parse\", \"--verify\", \"--quiet\", ADOPT_BRANCH]) !== \"\") {\n    lines.push(\n      `receipts init: branch ${ADOPT_BRANCH} already exists — commit the files above to it manually.`,\n    );\n    return;\n  }\n  if (spawnSync(\"git\", [\"checkout\", \"-b\", ADOPT_BRANCH], { encoding: \"utf8\" }).status !== 0) {\n    lines.push(`receipts init: could not create branch ${ADOPT_BRANCH} — commit manually.`);\n    return;\n  }\n  spawnSync(\"git\", [\"add\", \"--\", ...written], { encoding: \"utf8\" });\n  // No --no-verify: the repo's own pre-commit checks should see the change. If they\n  // reject it, the files stay staged on the branch for the owner to finish.\n  const commit = spawnSync(\n    \"git\",\n    [\"commit\", \"-m\", \"chore: adopt receipts — zero-install agent-work verification\"],\n    { encoding: \"utf8\" },\n  );\n  if (commit.status !== 0) {\n    lines.push(\n      `receipts init: commit failed (pre-commit hooks?) — files are staged on ${ADOPT_BRANCH}; finish manually.`,\n    );\n    return;\n  }\n  lines.push(`receipts init: committed ${written.length} file(s) on ${ADOPT_BRANCH}.`);\n  const push = spawnSync(\"git\", [\"push\", \"-u\", \"origin\", ADOPT_BRANCH], { encoding: \"utf8\" });\n  if (push.status !== 0) {\n    lines.push(\n      \"receipts init: push failed (no remote / auth?) — push the branch and open a PR manually.\",\n    );\n    return;\n  }\n  lines.push(`receipts init: pushed ${ADOPT_BRANCH}.`);\n  const gh = spawnSync(\n    \"gh\",\n    [\n      \"pr\",\n      \"create\",\n      \"--title\",\n      \"chore: adopt receipts — zero-install agent-work verification\",\n      \"--body\",\n      \"Adds the Verified-by-Receipts PR check and the repo-committed agent hook (generated by `npx altimate-receipts init --pr`). Contributors install nothing — see https://github.com/AltimateAI/altimate-receipts/blob/main/docs/onboarding.md\",\n    ],\n    { encoding: \"utf8\" },\n  );\n  if (gh.status === 0) {\n    lines.push(`receipts init: opened the PR — ${gh.stdout.trim().split(\"\\n\").pop()}`);\n    return;\n  }\n  const remote = git([\"remote\", \"get-url\", \"origin\"]);\n  const slug = remote ? /github\\.com[:/]([^/]+\\/[^/.]+)/.exec(remote)?.[1] : undefined;\n  lines.push(\n    slug\n      ? `receipts init: open the PR here — https://github.com/${slug}/pull/new/${ADOPT_BRANCH}`\n      : \"receipts init: branch pushed — open a PR from it in your forge.\",\n  );\n}\n\nfunction workflowContent(tag: string, v: string): string {\n  return `name: Verified by Receipts\n\n# Deterministic \"what did the coding agent actually do?\" check on PRs. Quiet + non-blocking\n# pilot: acts only when a branch commits an agent Receipt (.receipts/<branch>.json);\n# otherwise silent. Adds a new \"Receipts\" check only — touches no existing workflow.\n# Docs: https://github.com/AltimateAI/altimate-receipts/blob/main/docs/onboarding-internal.md\n\non:\n  pull_request:\n\npermissions:\n  contents: read\n  id-token: write # Sigstore keyless signing of the receipt\n  attestations: write # record the attestation\n  pull-requests: write # post the Receipts comment\n  checks: write # post the Receipts check\n\njobs:\n  receipts:\n    # Tracks the ${tag} major tag (auto-gets minor/patch features). Pin a full version\n    # (e.g. @v${v}) or a commit SHA for immutability.\n    uses: AltimateAI/altimate-receipts/.github/workflows/receipts.reusable.yml@${tag}\n    with:\n      require-receipt: false # never fail a PR that has no receipt (soft pilot)\n      notify-when-missing: false # stay silent unless a receipt is present\n      # block-on: \"\"          # informational check; never blocks a merge\n`;\n}\n\n/** `receipts hook pre-push --agent <claude|git>` — the agent-embedded trigger\n * (SPEC-0066 R1). Reads one payload from stdin, decides, and at most adds a\n * receipt commit. Never blocks: see src/hook/prePush.ts. */\nasync function runHook(kind: string | undefined, dialect: HookDialect): Promise<number> {\n  // `receipts hook guard` — the live PreToolUse guard (M103). Reads a PreToolUse event on stdin,\n  // classifies it (deny/ask/warn/allow), records non-allow decisions for the receipt, and writes the\n  // decision JSON to stdout. Fail-open by contract (see src/hook/guard.ts).\n  if (kind === \"guard\") {\n    const stdin = await readStdin();\n    const out = runGuard(stdin);\n    if (out.stdout) process.stdout.write(out.stdout);\n    return out.exit;\n  }\n  if (kind !== \"pre-push\") {\n    process.stderr.write(\"Usage: receipts hook pre-push | guard [--agent claude|git]\\n\");\n    return 1;\n  }\n  const stdin = await readStdin();\n  const res = await runHookPrePush(dialect, stdin, async (o) =>\n    runPr({ pendingCommit: o?.pendingCommit }),\n  );\n  if (res.message) {\n    process.stderr.write(`${res.message}\\n`);\n  }\n  return res.exit;\n}\n\n/** `receipts install-hook` — write the npx-shim pre-push hook into .git/hooks\n * (the universal floor; SPEC-0066 R6). */\nfunction runInstallHook(): number {\n  const res = installGitHook();\n  if (!res.ok) {\n    process.stderr.write(`receipts install-hook: ${res.reason}.\\n`);\n    return 1;\n  }\n  const note = {\n    installed: `installed ${res.path}`,\n    unchanged: `${res.path} already installed`,\n    chained: `installed ${res.path} (existing hook preserved as pre-push.local, runs first)`,\n  }[res.action];\n  process.stdout.write(`receipts install-hook: ${note}.\\n`);\n  return 0;\n}\n\n/** `receipts setup-local` — merge the self-gated hook into the USER's\n * ~/.claude/settings.json (SPEC-0066 R8), for repos that commit only the\n * workflow file. Inert outside integrated repos (the R4 gate). */\nfunction runSetupLocal(): number {\n  const path = join(homedir(), \".claude\", \"settings.json\");\n  const res = mergeHookIntoSettings(path);\n  if (!res.ok) {\n    process.stderr.write(`receipts setup-local: ${res.reason}.\\n`);\n    return 1;\n  }\n  process.stdout.write(\n    res.changed\n      ? `receipts setup-local: added the receipts hook to ${path} — active only in repos with the Receipts workflow.\\n`\n      : `receipts setup-local: ${path} already has the receipts hook.\\n`,\n  );\n  return 0;\n}\n\n/** `receipts rederive <transcript>` — reproduce the canonical Receipt from a transcript. */\nasync function runRederive(\n  file?: string,\n  opts: { source?: AgentSource; branch?: string; redact?: boolean; compact?: boolean } = {},\n): Promise<number> {\n  if (!file) {\n    process.stderr.write(\n      \"Usage: receipts rederive <transcript.jsonl> [--agent a] [--branch b] [--redact]\\n\",\n    );\n    return 1;\n  }\n  const receipt = await rederiveFromTranscript(file, {\n    source: opts.source,\n    branch: opts.branch,\n    redact: opts.redact,\n  });\n  if (!receipt) {\n    process.stderr.write(`receipts rederive: could not read a session from ${file}\\n`);\n    return 1;\n  }\n  const out = opts.compact ? canonicalize(receipt) : JSON.stringify(receipt, null, 2);\n  process.stdout.write(`${out}\\n`);\n  return 0;\n}\n\n/** `receipts assert [selector]` — evaluate `.receipts/asserts.json` against the receipt\n * (a local CI gate the user controls). Exit non-zero iff an error-severity assertion fails\n * or the asserts file is malformed; a missing file is a clean no-op. */\nasync function runAssert(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  json?: boolean;\n}): Promise<number> {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  let asserts: Assertion[];\n  try {\n    asserts = loadAsserts(repoRoot);\n  } catch (e) {\n    process.stderr.write(`receipts assert: ${(e as Error).message}\\n`);\n    return 2; // config error — distinct from an assertion failure\n  }\n  if (asserts.length === 0) {\n    process.stdout.write(`${renderAssertResults([])}\\n`);\n    return 0; // absent file ⇒ no-op\n  }\n\n  const summary = selectSummary(await listSessions(opts.agent), opts.selector);\n  if (!summary) {\n    process.stderr.write(\n      opts.selector\n        ? `No session matched \"${opts.selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n  const derived = deriveSpans(session);\n  const receipt = await buildReceipt(session, derived, deriveFindings(derived));\n  const results = evaluateAsserts(receipt, asserts);\n\n  if (opts.json) {\n    process.stdout.write(`${JSON.stringify(results, null, 2)}\\n`);\n  } else {\n    process.stdout.write(`${renderAssertResults(results)}\\n`);\n  }\n  return assertExitCode(results);\n}\n\n/**\n * SPEC-0121 — `receipts verdict`: compute the work-verdict (VERIFIED/INCOMPLETE/WRONG/ESCALATE)\n * from the receipt's already-attested facts + an opt-in policy (`.receipts/asserts.json`). The\n * verdict is a policy decision OUTSIDE the receipt (R2) — it never mutates the predicate. No\n * asserts.json ⇒ UNJUDGED (default-off). Exits non-zero on WRONG/INCOMPLETE (like `assert`).\n */\nasync function runVerdict(opts: {\n  selector?: string;\n  agent?: AgentSource;\n  json?: boolean;\n}): Promise<number> {\n  const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]) || \".\";\n  // The policy is opt-in: it exists iff `.receipts/asserts.json` is present. Its optional\n  // `verdict` block overrides the default blockable/escalate sets and the test-outcome gate.\n  let asserts: Assertion[];\n  let cfg: { blockable?: string[]; escalateOn?: string[]; gateTestOutcome?: boolean } = {};\n  let havePolicy = false;\n  const assertsPath = join(repoRoot, \".receipts\", \"asserts.json\");\n  if (existsSync(assertsPath)) {\n    havePolicy = true;\n    try {\n      asserts = loadAsserts(repoRoot);\n      const raw = JSON.parse(readFileSync(assertsPath, \"utf8\"));\n      const v = raw && typeof raw === \"object\" && !Array.isArray(raw) ? raw.verdict : undefined;\n      if (v !== undefined) {\n        // Validate the optional `verdict` block: a non-null object with string[]/boolean fields, so\n        // a `verdict: null` (typeof \"object\"!), a typo'd field, or a wrong type is a config error —\n        // never a crash or a silent fall-back to defaults.\n        const isStrArr = (x: unknown): x is string[] =>\n          Array.isArray(x) && x.every((s) => typeof s === \"string\");\n        if (\n          !v ||\n          typeof v !== \"object\" ||\n          Array.isArray(v) ||\n          (v.blockable !== undefined && !isStrArr(v.blockable)) ||\n          (v.escalateOn !== undefined && !isStrArr(v.escalateOn)) ||\n          (v.gateTestOutcome !== undefined && typeof v.gateTestOutcome !== \"boolean\")\n        ) {\n          process.stderr.write(\n            \"receipts verdict: .receipts/asserts.json `verdict` must be an object with optional `blockable`/`escalateOn` (string arrays) and `gateTestOutcome` (boolean).\\n\",\n          );\n          return 2;\n        }\n        // Each blockable/escalateOn entry must be a CANONICAL finding-id prefix. A typo\n        // (`flake-green`) or an over-broad string (`test`) would otherwise silently gate nothing\n        // — or, worse, silently match several families the user didn't intend (codex review).\n        // Reject unknown prefixes loudly so the policy fails closed, not silent.\n        const unknown = unknownVerdictPrefixes(v);\n        if (unknown.length > 0) {\n          process.stderr.write(\n            `receipts verdict: unknown finding-id prefix(es) in \\`verdict\\`: ${unknown.join(\", \")}. Use a canonical prefix (e.g. ${DEFAULT_BLOCKABLE.slice(0, 3).join(\", \")}, …); see the check catalog.\\n`,\n          );\n          return 2;\n        }\n        cfg = v;\n      }\n    } catch (e) {\n      process.stderr.write(`receipts verdict: ${(e as Error).message}\\n`);\n      return 2;\n    }\n  } else {\n    asserts = [];\n  }\n\n  const summary = selectSummary(await listSessions(opts.agent), opts.selector);\n  if (!summary) {\n    process.stderr.write(\n      opts.selector\n        ? `No session matched \"${opts.selector}\". Try \\`receipts --list\\`.\\n`\n        : \"No sessions found.\\n\",\n    );\n    return 1;\n  }\n  const session = await loadSession(summary);\n  if (!session) {\n    process.stderr.write(`Could not read session: ${summary.id}\\n`);\n    return 1;\n  }\n  const derived = deriveSpans(session);\n  // Redact before computing the verdict: `reasons[]` cite `finding.filePath`/`evidenceRef`, which\n  // are printed in both --json and text mode and could carry a secret-bearing path (codex review).\n  // Redaction masks only free-text values (numbers/booleans/ids untouched), so the verdict logic\n  // and every assert evaluation are identical — just the printed facts are safe.\n  const receipt = redactReceipt(await buildReceipt(session, derived, deriveFindings(derived)));\n  const policy: WorkPolicy | undefined = havePolicy\n    ? {\n        asserts: evaluateAsserts(receipt, asserts),\n        ...(Array.isArray(cfg.blockable) ? { blockable: cfg.blockable } : {}),\n        ...(Array.isArray(cfg.escalateOn) ? { escalateOn: cfg.escalateOn } : {}),\n        ...(cfg.gateTestOutcome ? { gateTestOutcome: true } : {}),\n      }\n    : undefined;\n  const result = workVerdict(receipt.predicate, policy);\n\n  if (opts.json) {\n    process.stdout.write(`${JSON.stringify(result, null, 2)}\\n`);\n  } else {\n    const head =\n      result.verdict === \"UNJUDGED\"\n        ? \"receipts verdict: UNJUDGED — no policy supplied (add .receipts/asserts.json)\"\n        : `receipts verdict: ${result.verdict} by policy`;\n    const lines = result.reasons.map((r) => `  · [${r.axis}] ${r.fact}`);\n    process.stdout.write(`${[head, ...lines].join(\"\\n\")}\\n`);\n  }\n  return verdictExitCode(result.verdict);\n}\n\n/** Write `text` to stdout; if `copy`, also try the clipboard and note the result. */\nfunction emit(text: string, copy: boolean, label: string): void {\n  process.stdout.write(`${text}\\n`);\n  if (copy) {\n    const ok = copyToClipboard(text);\n    process.stderr.write(\n      ok\n        ? `\\n${label} copied to clipboard.\\n`\n        : \"\\nClipboard unavailable — copy the output above.\\n\",\n    );\n  }\n}\n\n// Run only when executed directly as the CLI — not when imported by a test.\n// Resolve symlinks on argv[1] before comparing: Node sets import.meta.url to the\n// realpath of this module, but process.argv[1] is the path as invoked. When the CLI\n// runs through a symlink — e.g. the global npm bin (/usr/local/bin/receipts ->\n// …/dist/cli.js), or under macOS /tmp -> /private/tmp — the two differ and the guard\n// would wrongly treat the entrypoint as an import, running nothing (exit 0, no output).\nfunction resolveEntry(p: string | undefined): string | undefined {\n  if (p === undefined) return undefined;\n  try {\n    return realpathSync(p);\n  } catch {\n    return p;\n  }\n}\nconst entry = resolveEntry(process.argv[1]);\nconst isMain = entry !== undefined && import.meta.url === pathToFileURL(entry).href;\nif (isMain) {\n  // Set process.exitCode rather than calling process.exit(): process.exit()\n  // terminates before pending async writes to stdout/stderr flush, which silently\n  // truncates output when stdout is a pipe/file/redirect (not a TTY). Every command\n  // resolves cleanly with no lingering handles, so the process exits naturally once\n  // the event loop drains — after the output has flushed.\n  run(process.argv)\n    .then((code) => {\n      process.exitCode = code;\n    })\n    .catch((err: unknown) => {\n      process.stderr.write(`receipts: ${err instanceof Error ? err.message : String(err)}\\n`);\n      process.exitCode = 1;\n    });\n}\n","import { appendFileSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { type GuardHit, type HookInput, evaluate } from \"../policy/guard.js\";\nimport { guardDir } from \"../receipt/guardLog.js\";\n\n// The `receipts hook guard` PreToolUse command — the live arm of the trust layer. Reads a Claude\n// Code / Codex PreToolUse event on stdin, classifies it with the shared FP-aware evaluator\n// (src/policy/guard.ts), and:\n//   deny  → block the call (permissionDecision \"deny\")  — never-legit catastrophe\n//   ask   → route to the user's confirmation prompt      — ambiguous-but-dangerous\n//   warn  → surface only, do not block                   — record-worthy, intent unknown pre-exec\n// Every non-allow decision is recorded to the per-session guard log that `receipts pr` ingests, so\n// the BLOCKED call (which never reaches the transcript) still shows up in the receipt (M103).\n//\n// FAIL-OPEN by contract: any error, or the RECEIPTS_GUARD=0 / RECEIPTS_HOOK=0 opt-out, allows the\n// call silently. A guard that breaks the agent or can't be turned off would just get uninstalled —\n// receipts' post-hoc detector is the backstop, so live enforcement can afford to favor allow.\n\n/**\n * The guard's enforcement posture (M106 watch mode):\n *  - `off`   — `RECEIPTS_GUARD=0` / `RECEIPTS_HOOK=0`: do nothing, allow silently.\n *  - `watch` — `RECEIPTS_GUARD=watch|shadow|observe`: evaluate + record, but NEVER block —\n *              narrate what it WOULD have blocked. The on-ramp: see the policy on your real\n *              traffic, build trust, then flip enforcement on.\n *  - `on`    — default: enforce (deny/ask) as configured.\n */\nfunction guardMode(): \"off\" | \"watch\" | \"on\" {\n  if (process.env.RECEIPTS_GUARD === \"0\" || process.env.RECEIPTS_HOOK === \"0\") return \"off\";\n  const m = (process.env.RECEIPTS_GUARD ?? \"\").trim().toLowerCase();\n  if (m === \"watch\" || m === \"shadow\" || m === \"observe\") return \"watch\";\n  return \"on\";\n}\n\nfunction subjectOf(i: HookInput): string {\n  if (i.tool_name === \"Bash\") return `\\`${String(i.tool_input?.command ?? \"\").slice(0, 200)}\\``;\n  return `\\`${String(i.tool_input?.file_path ?? i.tool_input?.path ?? \"\")}\\``;\n}\n\n/** Persist a non-allow decision so the post-hoc receipt can surface it (the blocked call never\n * reaches the transcript). Best-effort — a recording failure must never break the agent. */\nfunction recordDecision(i: HookInput, hit: GuardHit, subject: string): void {\n  try {\n    const sessionId = String(i.session_id ?? i.sessionId ?? \"\").trim();\n    if (!sessionId) return; // nothing to bind the record to\n    const dir = guardDir();\n    mkdirSync(dir, { recursive: true });\n    const line = JSON.stringify({\n      ts: Date.now(),\n      action: hit.action,\n      ruleId: hit.rule.id,\n      tool: String(i.tool_name ?? \"\"),\n      subject: subject.replace(/^`|`$/g, \"\").slice(0, 200),\n      guardrail: hit.rule.guardrail,\n      ...(hit.rule.fix ? { fix: hit.rule.fix } : {}),\n    });\n    appendFileSync(join(dir, `${sessionId}.jsonl`), `${line}\\n`);\n  } catch {\n    // swallow — recording is a bonus, never a hard dependency\n  }\n}\n\n/**\n * Run the guard against a PreToolUse stdin payload. Returns the JSON to write to stdout (the hook's\n * decision; empty = allow silently) and the process exit code (always 0 — the decision is in the\n * JSON, not the exit status).\n */\nexport function runGuard(stdin: string): { stdout: string; exit: number } {\n  const mode = guardMode();\n  if (mode === \"off\") return { stdout: \"\", exit: 0 };\n  let input: HookInput;\n  try {\n    input = JSON.parse(stdin || \"{}\") as HookInput;\n  } catch {\n    return { stdout: \"\", exit: 0 }; // unparseable → fail open\n  }\n  let hit: GuardHit | null;\n  try {\n    hit = evaluate(input);\n  } catch {\n    return { stdout: \"\", exit: 0 }; // any classifier error → fail open\n  }\n  if (!hit) return { stdout: \"\", exit: 0 }; // clean / regenerable target → allow silently\n\n  const subject = subjectOf(input);\n  recordDecision(input, hit, subject);\n  const reason = `${hit.rule.guardrail}  (guardrail: ${hit.rule.id})  ${hit.rule.fix}`;\n\n  // Watch mode: evaluate + record, but NEVER block. Narrate what enforcement WOULD do so a\n  // user can dogfood the policy on real traffic before flipping it on. `warn` is already\n  // non-blocking, so it reads the same in both modes.\n  if (mode === \"watch\") {\n    const verb = hit.action === \"deny\" ? \"BLOCK\" : hit.action === \"ask\" ? \"confirm\" : null;\n    const msg = verb\n      ? `👁️ receipts-guard (watch): WOULD ${verb} ${subject} — ${hit.rule.guardrail} (allowed; set RECEIPTS_GUARD=on to enforce)`\n      : `👁️ receipts-guard (watch): ${subject} — ${hit.rule.guardrail} (allowed; recorded)`;\n    return { stdout: JSON.stringify({ systemMessage: msg }), exit: 0 };\n  }\n\n  if (hit.action === \"deny\") {\n    return {\n      stdout: JSON.stringify({\n        systemMessage: `🛡️ receipts-guard BLOCKED ${subject} — ${hit.rule.guardrail}`,\n        hookSpecificOutput: {\n          hookEventName: \"PreToolUse\",\n          permissionDecision: \"deny\",\n          permissionDecisionReason: reason,\n        },\n      }),\n      exit: 0,\n    };\n  }\n  if (hit.action === \"ask\") {\n    return {\n      stdout: JSON.stringify({\n        systemMessage: `🛡️ receipts-guard: confirm ${subject} — ${hit.rule.guardrail}`,\n        hookSpecificOutput: {\n          hookEventName: \"PreToolUse\",\n          permissionDecision: \"ask\",\n          permissionDecisionReason: reason,\n        },\n      }),\n      exit: 0,\n    };\n  }\n  // warn: surface it (user + record see it) but DO NOT block or prompt.\n  return {\n    stdout: JSON.stringify({\n      systemMessage: `⚠️ receipts-guard: ${subject} — ${hit.rule.guardrail} (allowed; recorded for review)`,\n    }),\n    exit: 0,\n  };\n}\n","import {\n  isEphemeralTarget,\n  isRegenerableBuildDir,\n  splitStatements,\n  stripHeredocs,\n} from \"./classify.js\";\n// The LIVE-GUARD evaluator — the pre-execution composition layer over the shared FP-aware\n// primitives (src/policy/classify.ts). Classifies a PreToolUse tool call into deny | ask | warn |\n// allow BEFORE it runs. This is the TS home of what used to be the standalone hooks/guard-policy.mjs\n// island; it now ships in `dist` and runs via the `altimate-receipts hook guard` CLI command, so the\n// guard's decisions finally reach the receipt (`guardEvents`). The post-hoc detector and this guard\n// share ONE classifier — the dogfood audit found the same FP fixed twice when they were separate.\nimport { EPHEMERAL, G, PROTECTED_BRANCHES } from \"./load.js\";\n\nexport type GuardAction = \"deny\" | \"ask\" | \"warn\";\n\nexport interface HookInput {\n  tool_name?: string;\n  tool_input?: Record<string, unknown>;\n  cwd?: string;\n  session_id?: string;\n  sessionId?: string;\n}\n\ninterface GuardrailMeta {\n  severity?: string;\n  guardrail: string;\n  fix: string;\n  action?: GuardAction;\n}\n\ninterface Rule extends Omit<GuardrailMeta, \"action\"> {\n  id: string;\n  match: (i: HookInput) => boolean;\n  action?: GuardAction | ((i: HookInput) => GuardAction | null);\n}\n\nexport interface GuardHit {\n  rule: Rule;\n  action: GuardAction;\n}\n\nconst deQuote = (s: string): string => s.replace(/'[^']*'/g, \"''\").replace(/\"[^\"]*\"/g, '\"\"');\nconst bashCmd = (i: HookInput): string =>\n  i.tool_name === \"Bash\" ? deQuote(stripHeredocs(String(i.tool_input?.command ?? \"\"))) : \"\";\nconst rawBash = (i: HookInput): string =>\n  i.tool_name === \"Bash\" ? stripHeredocs(String(i.tool_input?.command ?? \"\")) : \"\";\nconst editPath = (i: HookInput): string =>\n  i.tool_name === \"Edit\" || i.tool_name === \"Write\" || i.tool_name === \"MultiEdit\"\n    ? String(i.tool_input?.file_path ?? i.tool_input?.path ?? \"\")\n    : \"\";\n\n/** A single rm operand is regenerable iff a path segment is a known build dir, or it's scratch. */\nconst regenerableTarget = (t: string): boolean => isRegenerableBuildDir(t) || isEphemeralTarget(t);\n\n// Never-legitimate destructive targets → hard deny. REQUIRES the recursive flag (-r): the\n// catastrophe is wiping a whole tree (rm -rf ~, rm -rf .git, rm -rf .receipts), not removing one\n// file under a protected prefix (rm -f ~/.local/bin/foo — an uninstall → ask).\nconst CATASTROPHE_RM =\n  /\\brm\\s+(-\\S*\\s+)*-\\S*r\\S*\\s+(-\\S*\\s+)*(\\/(\\s|$|\\*)|~\\/?(\\s|$|\\*)|\\$HOME\\/?(\\s|$|\\*)|\\.(\\s|$)|\\*(\\s|$)|\\S*\\.git\\/?(\\s|$)|\\S*\\.receipts\\/?(\\s|$))/i;\n\n/** Targets of an `rm` command (tokens after the command that aren't flags). */\nfunction rmTargets(cmd: string): string[] {\n  const m = cmd.match(/\\brm\\b(.*)/i);\n  if (!m) return [];\n  return m[1].split(/\\s+/).filter((t) => t && !t.startsWith(\"-\") && t !== \"''\" && t !== '\"\"');\n}\n\n/**\n * Classify a Bash command's destructive risk → \"deny\" | \"ask\" | null(allow). The FP-aware core.\n * `cmd` is de-quoted (so a *mentioned* token like `grep 'rm -rf'` isn't read as executed). `raw` is\n * the original — used for SQL, where the quoted string IS the executed payload (`psql -c 'DROP\n * DATABASE'`). Git push (force / force-with-lease) is owned by its own rules.\n */\nfunction classifyDestructive(cmd: string, raw: string = cmd): GuardAction | null {\n  if (\n    CATASTROPHE_RM.test(cmd) ||\n    /\\bmkfs\\b/i.test(cmd) ||\n    /\\bdd\\b[^|]*\\bof=\\/dev\\//i.test(cmd) ||\n    /\\bDROP\\s+DATABASE\\b/i.test(raw)\n  ) {\n    return \"deny\";\n  }\n  const targets = rmTargets(cmd);\n  if (/\\brm\\b/i.test(cmd) && targets.length && targets.every(regenerableTarget)) {\n    return null; // every rm target regenerable → allow\n  }\n  if (\n    /\\brm\\s+(-[a-z]*\\s+)*-?[a-z]*f[a-z]*\\b/i.test(cmd) ||\n    /\\bgit\\s+reset\\s+--hard\\b/i.test(cmd) ||\n    /\\bgit\\s+clean\\s+-[a-z]*f/i.test(cmd) ||\n    /\\b(DROP|TRUNCATE)\\s+(TABLE|SCHEMA)\\b/i.test(raw) ||\n    /\\bDELETE\\s+FROM\\b(?![\\s\\S]*\\bWHERE\\b)/i.test(raw)\n  ) {\n    return \"ask\";\n  }\n  return null;\n}\n\n/** Destructive verdict over a whole Bash command = the MAX over its statements (deny > ask). Each\n * statement is classified on its own, so a benign statement never inherits a sibling's `rm`/`DROP`.\n * A var rebound to an ephemeral path in the same command (`export HOME=/tmp/x`) is substituted so\n * `rm -rf $HOME` reads as scratch, not the home dir. */\nfunction destructiveAction(i: HookInput): GuardAction | null {\n  if (i.tool_name !== \"Bash\") return null;\n  const full = rawBash(i);\n  const rebind = new Map<string, string>();\n  for (const m of full.matchAll(\n    /(?:^|[\\s;&|(])(?:export\\s+)?([A-Za-z_]\\w*)=(\"[^\"]*\"|'[^']*'|\\S+)/g,\n  )) {\n    const val = m[2].replace(/^[\"']|[\"']$/g, \"\");\n    if (EPHEMERAL.test(val)) rebind.set(m[1], val);\n  }\n  let best: GuardAction | null = null;\n  for (const st of splitStatements(full)) {\n    let s = st;\n    for (const [v, val] of rebind)\n      s = s.replace(new RegExp(`\\\\$\\\\{?${v}\\\\}?(?![A-Za-z0-9_])`, \"g\"), val);\n    const a = classifyDestructive(deQuote(s), s);\n    if (a === \"deny\") return \"deny\";\n    if (a === \"ask\") best = \"ask\";\n  }\n  return best;\n}\n\n/** Force-push verdict. Denied ONLY when the push's OWN target ref is protected — read from the `git\n * push … -f` statement itself, not from `main` appearing anywhere. A merge-loop that fetches `origin\n * main` and force-pushes a *feature* branch confirms (ask). A bare `git push -f` (unknown ref) → ask. */\nfunction forcePushAction(i: HookInput): GuardAction | null {\n  if (i.tool_name !== \"Bash\") return null;\n  let verdict: GuardAction | null = null;\n  for (const st of splitStatements(bashCmd(i))) {\n    if (!/\\bgit\\s+push\\b/.test(st)) continue;\n    if (!/(--force\\b(?!-with-lease)|\\s-f\\b)/.test(st)) continue;\n    const after = st.replace(/^[\\s\\S]*?\\bgit\\s+push\\b/, \"\");\n    const target =\n      after\n        .split(/\\s+/)\n        .filter((t) => t && !t.startsWith(\"-\"))\n        .pop() || \"\";\n    const dst = target.includes(\":\") ? (target.split(\":\").pop() ?? \"\") : target;\n    if (dst && PROTECTED_BRANCHES.test(dst)) return \"deny\";\n    verdict = \"ask\";\n  }\n  return verdict;\n}\n\n// Each rule: a matcher + action; severity/guardrail/fix come from the canonical policy (G[id]).\nexport const POLICY: Rule[] = [\n  {\n    id: \"destructive-op\",\n    ...G[\"destructive-op\"],\n    action: destructiveAction,\n    match: (i) => destructiveAction(i) != null,\n  },\n  {\n    id: \"force-push\",\n    ...G[\"force-push\"],\n    action: forcePushAction,\n    match: (i) => forcePushAction(i) != null,\n  },\n  { id: \"hook-bypass\", ...G[\"hook-bypass\"], match: (i) => /--no-verify\\b/.test(bashCmd(i)) },\n  {\n    id: \"pipe-from-internet\",\n    ...G[\"pipe-from-internet\"],\n    // Danger = the interpreter executes the FETCHED STREAM as its program. `| sh|bash` always does;\n    // bare `| python|node` does; `| python -c '…'` / `node -e '…'` run the inline arg, stdin is DATA.\n    match: (i) => {\n      const c = bashCmd(i);\n      if (/\\b(curl|wget|fetch)\\b[^|]*\\|\\s*(sudo\\s+)?(sh|bash|zsh)\\b/i.test(c)) return true;\n      const m = c.match(/\\b(curl|wget|fetch)\\b[^|]*\\|\\s*(sudo\\s+)?(python3?|node)\\b([^|]*)/i);\n      return !!m && !/\\s-[ce]\\b/.test(m[4]);\n    },\n  },\n  {\n    id: \"force-with-lease\",\n    ...G[\"force-with-lease\"],\n    match: (i) => /\\bgit\\s+push\\b[\\s\\S]*--force-with-lease\\b/i.test(bashCmd(i)),\n  },\n  {\n    id: \"grader-harness-edit\",\n    ...G[\"grader-harness-edit\"],\n    match: (i) =>\n      /(^|\\/)(grader|conftest|harness)\\b|(^|\\/)[^/]*test[_-]?harness/i.test(editPath(i)),\n  },\n  {\n    id: \"cicd-edit\",\n    ...G[\"cicd-edit\"],\n    match: (i) => {\n      const p = editPath(i);\n      return (\n        /(^|\\/)\\.github\\/workflows\\/|\\.gitlab-ci|(^|\\/)\\.circleci\\/|(^|\\/)Dockerfile$|(^|\\/)[^/]*\\.(ya?ml)$/i.test(\n          p,\n        ) && /(workflow|pipeline|ci|cd|deploy|release|\\.github)/i.test(p)\n      );\n    },\n  },\n  {\n    id: \"secret-exposure\",\n    ...G[\"secret-exposure\"],\n    match: (i) => {\n      const c = bashCmd(i);\n      const p = editPath(i);\n      // `.env.example` / `.env.sample` / `.env.template` are committed templates, not secrets.\n      const isTemplate = /\\.(example|sample|template)$/i.test(p);\n      return (\n        /(cat|echo|printenv|env)\\b[\\s\\S]*(\\.env\\b|secret|credential|\\.aws\\/credentials|id_rsa)/i.test(\n          c,\n        ) ||\n        (!isTemplate && /(^|\\/)\\.env($|\\.)|(^|\\/)\\.aws\\/credentials|(^|\\/)id_rsa\\b/i.test(p))\n      );\n    },\n  },\n];\n\n/** The action of a rule for a given input — supports a fixed string or a function. */\nfunction actionOf(rule: Rule, input: HookInput): GuardAction | null {\n  try {\n    return typeof rule.action === \"function\" ? rule.action(input) : (rule.action ?? null);\n  } catch {\n    return null; // a broken rule must never break the agent\n  }\n}\n\nconst RANK: Record<GuardAction, number> = { deny: 3, ask: 2, warn: 1 };\n\n/**\n * Evaluate the policy against a PreToolUse input. Returns { rule, action } for the highest-severity\n * hit (deny > ask > warn), or null when nothing fires (allow).\n */\nexport function evaluate(input: HookInput): GuardHit | null {\n  let best: GuardHit | null = null;\n  for (const rule of POLICY) {\n    let hit = false;\n    try {\n      hit = rule.match(input);\n    } catch {\n      hit = false;\n    }\n    if (!hit) continue;\n    const action = actionOf(rule, input);\n    if (!action) continue; // classified as allow\n    if (!best || RANK[action] > RANK[best.action]) best = { rule, action };\n    if (best.action === \"deny\") break; // can't beat deny\n  }\n  return best;\n}\n","import { readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { basename, join } from \"node:path\";\nimport type { GuardEvent } from \"../findings/guardEvents.js\";\n\n/**\n * Reader for the live-guard event side-log (SPEC-0095 / M103). The `receipts hook guard` PreToolUse\n * command (src/hook/guard.ts) appends one JSON line per non-allow decision to\n * `${RECEIPTS_GUARD_DIR || ~/.claude/receipts/guard}/<sessionId>.jsonl`. `receipts pr` reads the\n * log for the session it is building and attaches the events as a recorded input (exempt from the\n * L1 byte-compare; envelope-covered). Crash-safe: a missing or garbled log yields `[]` — guard\n * events are a bonus, never a hard dependency, so a read failure must never break a receipt.\n *\n * The producer (src/hook/guard.ts) imports `guardDir()` from here, so the write path and this read\n * path share one source — they cannot drift. `<sessionId>` is the PreToolUse payload's `session_id`,\n * which equals the transcript file's basename, so `sessionIdFromPath()` resolves the same key.\n */\nexport function guardDir(): string {\n  return process.env.RECEIPTS_GUARD_DIR || join(homedir(), \".claude\", \"receipts\", \"guard\");\n}\n\n/** The Claude Code session id is the transcript file's basename (e.g. `<uuid>.jsonl`). */\nexport function sessionIdFromPath(transcriptPath: string): string {\n  return basename(transcriptPath).replace(/\\.jsonl$/i, \"\");\n}\n\nfunction isGuardEvent(v: unknown): v is GuardEvent {\n  if (!v || typeof v !== \"object\") {\n    return false;\n  }\n  const o = v as Record<string, unknown>;\n  return (\n    (o.action === \"deny\" || o.action === \"ask\" || o.action === \"warn\") &&\n    typeof o.ruleId === \"string\" &&\n    typeof o.tool === \"string\" &&\n    typeof o.subject === \"string\" &&\n    typeof o.guardrail === \"string\"\n  );\n}\n\n/**\n * Read + validate the guard events for a session id. Returns the well-formed events in file order;\n * skips malformed lines. Returns `[]` when the log is absent or unreadable.\n */\nexport function readGuardEvents(sessionId: string): GuardEvent[] {\n  if (!sessionId) {\n    return [];\n  }\n  let raw: string;\n  try {\n    raw = readFileSync(join(guardDir(), `${sessionId}.jsonl`), \"utf8\");\n  } catch {\n    return []; // no log for this session — the common case\n  }\n  const out: GuardEvent[] = [];\n  for (const line of raw.split(\"\\n\")) {\n    const t = line.trim();\n    if (!t) {\n      continue;\n    }\n    try {\n      const v = JSON.parse(t);\n      if (isGuardEvent(v)) {\n        out.push({\n          action: v.action,\n          ruleId: v.ruleId,\n          tool: v.tool,\n          subject: v.subject,\n          guardrail: v.guardrail,\n          ...(typeof v.fix === \"string\" ? { fix: v.fix } : {}),\n          ...(typeof v.ts === \"number\" ? { ts: v.ts } : {}),\n        });\n      }\n    } catch {\n      // skip a malformed line; a partial/corrupt log still yields its good events\n    }\n  }\n  return out;\n}\n","import { spawnSync } from \"node:child_process\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { isAbsolute, join } from \"node:path\";\n\n/**\n * `receipts install-hook` (SPEC-0066 R6, hardened by SPEC-0068 R1/R2) — the\n * universal floor: a git pre-push hook for humans pushing agent work from a\n * terminal and for agents without a hook system. The script is a frozen npx\n * shim; behavior updates ship via npm. The write location honors the repo's\n * actual hook manager: `.git/hooks` by default, the user-hook dir for husky\n * repos, or a custom `core.hooksPath`.\n */\n\n/** Marker that identifies a pre-push script as ours (idempotency + upgrades). */\nconst MARKER = \"altimate-receipts\";\n\n/** The set-`e`-proof shim body (SPEC-0068 R2). Hook runners (husky among them)\n * may execute hooks under `set -e`, where a bare non-zero npx exit would abort\n * the script — and block the push — before the exit-code check runs. The\n * `|| code=$?` capture keeps every failure path non-blocking; exit 42\n * (REPUSH_EXIT) is the only code that stops the push. */\nconst SHIM_BODY = `command -v npx >/dev/null 2>&1 || exit 0\ncode=0\nnpx -y altimate-receipts@latest hook pre-push --agent git || code=$?\nif [ \"$code\" -eq 42 ]; then exit 1; fi\nexit 0\n`;\n\n/** The git-hooks-dir variant: chains a preserved pre-existing hook first (it\n * gets no stdin refs — pre-push hooks rarely read them — and its failure still\n * blocks, it's the user's gate). */\nconst HOOK_SCRIPT = `#!/bin/sh\n# Verified-by-Receipts pre-push hook — generated by \\`receipts install-hook\\` (altimate-receipts).\n# Attaches this branch's agent receipt before pushing. Best-effort: only the\n# deliberate \"receipt attached, push again\" signal (exit 42) ever stops a push.\nhookdir=$(dirname \"$0\")\nif [ -x \"$hookdir/pre-push.local\" ]; then\n  \"$hookdir/pre-push.local\" \"$@\" </dev/null || exit $?\nfi\n${SHIM_BODY}`;\n\n/** The husky variant: husky runs each .husky/<hook> file itself (no shebang,\n * no pre-push.local convention) and is the chaining layer already. */\nconst HUSKY_SCRIPT = `# Verified-by-Receipts pre-push hook — generated by \\`receipts install-hook\\` (altimate-receipts).\n# Attaches this branch's agent receipt before pushing. Best-effort: only the\n# deliberate \"receipt attached, push again\" signal (exit 42) ever stops a push.\n${SHIM_BODY}`;\n\nexport type InstallResult =\n  | { ok: true; action: \"installed\" | \"unchanged\" | \"chained\"; path: string }\n  | { ok: false; reason: string };\n\nfunction git(args: string[], cwd?: string): string | null {\n  const r = spawnSync(\"git\", args, { encoding: \"utf8\", cwd });\n  return r.status === 0 ? r.stdout.trim() : null;\n}\n\nconst abs = (p: string, cwd?: string): string =>\n  isAbsolute(p) ? p : join(cwd ?? process.cwd(), p);\n\n/** Where this repo actually executes pre-push hooks (SPEC-0068 R1).\n * `--git-path hooks` follows `core.hooksPath`, so a husky repo would resolve to\n * `.husky/_` — a directory husky regenerates, where a written hook silently\n * dies. Inspect `core.hooksPath` explicitly instead. */\nexport function resolveHookTarget(\n  cwd?: string,\n): { kind: \"git\" | \"custom\" | \"husky\"; dir: string } | null {\n  if (git([\"rev-parse\", \"--git-dir\"], cwd) === null) {\n    return null;\n  }\n  const hooksPath = git([\"config\", \"core.hooksPath\"], cwd);\n  if (hooksPath) {\n    const parts = hooksPath.split(/[\\\\/]/);\n    if (parts.includes(\".husky\")) {\n      // husky owns hook dispatch; user hooks live in <repo>/.husky, never `_`\n      const root = git([\"rev-parse\", \"--show-toplevel\"], cwd) ?? cwd ?? process.cwd();\n      return { kind: \"husky\", dir: join(root, \".husky\") };\n    }\n    return { kind: \"custom\", dir: abs(hooksPath, cwd) };\n  }\n  const p = git([\"rev-parse\", \"--git-path\", \"hooks\"], cwd);\n  return p ? { kind: \"git\", dir: abs(p, cwd) } : null;\n}\n\n/** Back-compat export: the resolved hooks dir (tests + older callers). */\nexport function hooksDir(cwd?: string): string | null {\n  return resolveHookTarget(cwd)?.dir ?? null;\n}\n\nexport function installGitHook(cwd?: string): InstallResult {\n  const target = resolveHookTarget(cwd);\n  if (!target) {\n    return { ok: false, reason: \"not a git repository\" };\n  }\n  const script = target.kind === \"husky\" ? HUSKY_SCRIPT : HOOK_SCRIPT;\n  mkdirSync(target.dir, { recursive: true });\n  const hookPath = join(target.dir, \"pre-push\");\n  const local = join(target.dir, \"pre-push.local\");\n\n  if (existsSync(hookPath)) {\n    const current = readFileSync(hookPath, \"utf8\");\n    if (current.includes(MARKER)) {\n      if (current === script) {\n        return { ok: true, action: \"unchanged\", path: hookPath };\n      }\n      // ours but an older revision — rewrite in place\n      writeFileSync(hookPath, script);\n      chmodSync(hookPath, 0o755);\n      return { ok: true, action: \"installed\", path: hookPath };\n    }\n    if (target.kind === \"husky\") {\n      // husky runs exactly one file per hook and it's the user's; don't edit it\n      // (SPEC-0068 NG5) — tell them what to append instead.\n      return {\n        ok: false,\n        reason: `${hookPath} already exists — append this to it:\\n${SHIM_BODY}`,\n      };\n    }\n    // a foreign hook: preserve it as pre-push.local (invoked first by ours)\n    if (existsSync(local)) {\n      return {\n        ok: false,\n        reason: `${hookPath} and ${local} both exist and aren't receipts hooks — resolve manually`,\n      };\n    }\n    renameSync(hookPath, local);\n    writeFileSync(hookPath, script);\n    chmodSync(hookPath, 0o755);\n    return { ok: true, action: \"chained\", path: hookPath };\n  }\n\n  writeFileSync(hookPath, script);\n  chmodSync(hookPath, 0o755);\n  return { ok: true, action: \"installed\", path: hookPath };\n}\n\n/**\n * `receipts init --prepare` (R7): wire `install-hook` into package.json's\n * `prepare` script so `npm install` self-installs the floor for every\n * contributor. Append with `&&` if a prepare exists; never clobber; idempotent.\n */\nexport type PrepareResult = { ok: true; changed: boolean } | { ok: false; reason: string };\n\nconst PREPARE_CMD = \"npx -y altimate-receipts@latest install-hook\";\n\nexport function wirePrepareScript(pkgPath: string): PrepareResult {\n  if (!existsSync(pkgPath)) {\n    return { ok: false, reason: `${pkgPath} not found — \\`--prepare\\` needs a package.json` };\n  }\n  const raw = readFileSync(pkgPath, \"utf8\");\n  let pkg: Record<string, unknown>;\n  try {\n    pkg = JSON.parse(raw) as Record<string, unknown>;\n  } catch {\n    return { ok: false, reason: `${pkgPath} is not valid JSON — leaving it untouched` };\n  }\n  if (pkg.scripts === undefined) {\n    pkg.scripts = {};\n  }\n  const scripts = pkg.scripts as Record<string, string>;\n  const prepare = scripts.prepare;\n  if (prepare?.includes(PREPARE_CMD)) {\n    return { ok: true, changed: false };\n  }\n  scripts.prepare = prepare ? `${prepare} && ${PREPARE_CMD}` : PREPARE_CMD;\n  // keep the file's indentation (npm writes 2 spaces; some repos use 4 or tabs)\n  const indent = raw.match(/^(\\s+)\"/m)?.[1] ?? \"  \";\n  writeFileSync(pkgPath, `${JSON.stringify(pkg, null, indent)}\\n`);\n  return { ok: true, changed: true };\n}\n","import { spawnSync } from \"node:child_process\";\nimport { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { cwdAtFirstGit } from \"../findings/gitParse.js\";\nimport { pushReceiptRef, readReceiptRef } from \"../report/store.js\";\nimport { gitInvocations } from \"../trace/gitCommand.js\";\nimport { settingsStore } from \"./settingsMerge.js\";\n\n/**\n * `receipts hook pre-push` (SPEC-0066) — the agent-embedded trigger. One frozen\n * command line, two payload dialects:\n *\n *   --agent claude  Claude Code PreToolUse stdin JSON; fires only when the Bash\n *                   tool is about to run a real `git push`, and commits the\n *                   receipt BEFORE the push so it rides the agent's own push.\n *   --agent git     the git pre-push stdin protocol; fires on a branch push and\n *                   keeps the capped commit-then-re-push flow (a pre-push hook\n *                   cannot add commits to the in-flight push).\n *\n * Everything here is best-effort: every failure path exits 0 with at most one\n * stderr line. The hook may only ever add a commit — it must never block the\n * agent's tool call or fail a push.\n */\n\n/** `codex` shares Claude's payload shape exactly (same hooks.json schema, same\n * `tool_name`/`tool_input.command`/`cwd` stdin fields, exit-0-allows) — verified\n * against the Codex hooks docs + a live capture (SPEC-0069 R4). */\nexport type HookDialect = \"claude\" | \"codex\" | \"git\";\n\n/** Exit code the generated git hook script maps to \"stop this push, re-push\" —\n * deliberately distinctive so an npx/registry failure (exit 1) is never mistaken\n * for the intentional signal and can never block a push. */\nexport const REPUSH_EXIT = 42;\n\nconst ATTACH_SUBJECT = (branch: string) => `chore(receipts): attach agent receipt for ${branch}`;\n\nfunction git(args: string[], cwd?: string): string {\n  const r = spawnSync(\"git\", args, { encoding: \"utf8\", cwd });\n  return r.status === 0 ? r.stdout.trim() : \"\";\n}\n\n/* ------------------------------------------------------------------ matcher */\n\n/** A refspec that names a tag (tag-only pushes carry no branch work). */\nconst TAG_REFSPEC = /^(refs\\/tags\\/|v\\d+(\\.\\d+)*$)/;\n\n/**\n * Does this Bash command string contain a real branch `git push`? (SPEC-0066 R2.)\n * Token scan via the shared `gitInvocations` (quote-blanked, simple-command-anchored\n * — `echo \"git push\"`, `git pushup`, message text never fire; under-fires on exotic\n * quoting by design, Q3), plus push-specific exclusions: dry runs and tag-only\n * pushes carry no branch work.\n */\nexport function isGitPush(command: string): boolean {\n  for (const { sub, rest } of gitInvocations(command)) {\n    if (sub !== \"push\") {\n      continue;\n    }\n    if (rest.includes(\"--dry-run\") || rest.includes(\"-n\") || rest.includes(\"--tags\")) {\n      continue;\n    }\n    // refspec analysis: `git push origin v1.2.3` (tag-only) must not fire; a\n    // pure-flag or remote-only push targets the current branch and does fire.\n    const refspecs = rest.filter((t) => !t.startsWith(\"-\")).slice(1); // first positional = remote\n    if (refspecs.length > 0 && refspecs.every((r) => TAG_REFSPEC.test(r))) {\n      continue;\n    }\n    return true;\n  }\n  return false;\n}\n\n/** Same tokenizer discipline as `isGitPush`: true iff the command also carries a\n * real `git commit` — the compound `git commit … && git push` pattern. An agent\n * hook fires BEFORE the command runs, so that commit's files are still\n * working-tree-only; the diff scope must union them or the receipt falls back to\n * branch scope with no per-change cost (field-observed in a dogfooding repo).\n * `--dry-run` doesn't count; note `-n` on commit is `--no-verify`, not a dry run. */\nexport function isGitCommit(command: string): boolean {\n  for (const { sub, rest } of gitInvocations(command)) {\n    if (sub === \"commit\" && !rest.includes(\"--dry-run\")) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/** The git pre-push stdin protocol: `<local_ref> <sha> <remote_ref> <sha>` lines.\n * True iff at least one pushed ref is a branch (tag-only pushes don't trigger). */\nexport function gitStdinPushesBranch(stdin: string): boolean {\n  return stdin.split(\"\\n\").some((line) => line.trim().startsWith(\"refs/heads/\"));\n}\n\n/* ----------------------------------------------------------------- gate/cap */\n\nconst hasMarker = (root: string): boolean =>\n  existsSync(join(root, \".github\", \"workflows\", \"receipts.yml\")) ||\n  existsSync(join(root, \".receipts\"));\n\n/**\n * The universal self-gate (SPEC-0066 R4): the hook is inert unless this repo has\n * opted in — `receipts init`'s workflow file or an existing `.receipts/`. One\n * frozen one-liner therefore works committed in a repo's settings AND in a\n * user's ~/.claude/settings.json without ever firing in non-integrated repos.\n *\n * Worktrees (field-observed): a worktree created before\n * adoption has neither marker in its checkout even though the repo opted in —\n * so also accept the marker in the PRIMARY checkout (the git common dir's\n * parent). Old worktrees then stay covered by the git floor and user-level\n * hooks instead of going silent.\n */\nexport function repoOptedIn(repoRoot: string): boolean {\n  if (hasMarker(repoRoot)) {\n    return true;\n  }\n  const primary = primaryCheckout(repoRoot);\n  return primary ? hasMarker(primary) : false;\n}\n\n/** The primary checkout behind a worktree (git common dir's parent), or null. */\nexport function primaryCheckout(repoRoot: string): string | null {\n  const common = git([\"rev-parse\", \"--git-common-dir\"], repoRoot);\n  if (common.endsWith(\"/.git\")) {\n    const primary = common.slice(0, -\"/.git\".length);\n    if (primary && primary !== repoRoot) {\n      return primary;\n    }\n  }\n  return null;\n}\n\n/** Is HEAD already this branch's receipt-attach commit? The git-mode cap (R6):\n * one auto-commit per push attempt, so a live, still-growing session can never\n * re-push-loop — at worst the receipt is one snapshot behind, honestly. */\nexport function headIsAttachCommit(branch: string, cwd?: string): boolean {\n  return git([\"log\", \"-1\", \"--format=%s\"], cwd) === ATTACH_SUBJECT(branch);\n}\n\n/**\n * Receipts are per-PR artifacts; a push to the DEFAULT branch must not attach one\n * (field-observed: a `git push` while on main committed a whole-session Grade-F\n * `main.json` onto the repo's trunk). Resolve the default from\n * origin/HEAD; fall back to the conventional names when the remote head is\n * unset locally.\n */\nexport function isDefaultBranch(branch: string, cwd?: string): boolean {\n  const head = git([\"symbolic-ref\", \"--short\", \"refs/remotes/origin/HEAD\"], cwd);\n  if (head) {\n    return head === `origin/${branch}`;\n  }\n  return branch === \"main\" || branch === \"master\";\n}\n\n/* ------------------------------------------------------------------- runner */\n\n/** Claude Code PreToolUse payload — only the fields we read; extras tolerated. */\ninterface ClaudePayload {\n  tool_name?: string;\n  tool_input?: { command?: string };\n  cwd?: string;\n}\n\nexport async function readStdin(stream: NodeJS.ReadableStream = process.stdin): Promise<string> {\n  let data = \"\";\n  for await (const chunk of stream) {\n    data += chunk;\n  }\n  return data;\n}\n\nexport interface HookResult {\n  exit: number;\n  /** single stderr line, when there's something worth saying */\n  message?: string;\n}\n\n/**\n * Decide + act for one hook invocation. `generate` is the existing `receipts pr`\n * pipeline (injected to keep this module free of the CLI's session machinery).\n */\nexport async function runHookPrePush(\n  dialect: HookDialect,\n  stdin: string,\n  generate: (opts?: { pendingCommit?: boolean }) => Promise<number>,\n): Promise<HookResult> {\n  let pendingCommit = false;\n  try {\n    if (process.env.RECEIPTS_HOOK === \"0\") {\n      return { exit: 0 };\n    }\n    // Honor the storage opt-out (SPEC-0064): store=none means \"no committed\n    // receipts\", so the hook has nothing to attach and stays silent.\n    if ((process.env.RECEIPTS_STORE || \"commit\").toLowerCase() === \"none\") {\n      return { exit: 0 };\n    }\n\n    if (dialect === \"claude\" || dialect === \"codex\") {\n      let payload: ClaudePayload;\n      try {\n        payload = JSON.parse(stdin) as ClaudePayload;\n      } catch {\n        return { exit: 0 };\n      }\n      if (payload.tool_name !== \"Bash\" || !payload.tool_input?.command) {\n        return { exit: 0 };\n      }\n      if (payload.cwd && existsSync(payload.cwd)) {\n        process.chdir(payload.cwd); // generate against the session's repo\n      }\n      if (!isGitPush(payload.tool_input.command)) {\n        return { exit: 0 };\n      }\n      // Sibling-checkout pushes (field-observed in qa-autopilot's Actions runs):\n      // the agent pushes a repo it checked out NEXT TO the session root —\n      // `cd altimate-backend && git push`. Generate against the repo the push\n      // actually targets by tracking `cd` clauses, same as diff scoping does.\n      const locus = cwdAtFirstGit(payload.tool_input.command, process.cwd());\n      if (locus.kind === \"known\" && existsSync(locus.path)) {\n        process.chdir(locus.path);\n      }\n      pendingCommit = isGitCommit(payload.tool_input.command);\n    } else if (!gitStdinPushesBranch(stdin)) {\n      return { exit: 0 };\n    }\n\n    const repoRoot = git([\"rev-parse\", \"--show-toplevel\"]);\n    if (!repoRoot || !repoOptedIn(repoRoot)) {\n      return { exit: 0 };\n    }\n    const branch = git([\"rev-parse\", \"--abbrev-ref\", \"HEAD\"]);\n    if (!branch || branch === \"HEAD\" || isDefaultBranch(branch)) {\n      return { exit: 0 };\n    }\n\n    // Store resolution (SPEC-0070 R3): process env beats the repo-committed\n    // default in .claude/settings.json (worktree-aware via the primary checkout).\n    const store = (\n      process.env.RECEIPTS_STORE ||\n      settingsStore(repoRoot) ||\n      settingsStore(primaryCheckout(repoRoot) ?? \"\") ||\n      \"commit\"\n    ).toLowerCase();\n    if (store === \"none\") {\n      return { exit: 0 };\n    }\n    process.env.RECEIPTS_STORE = store; // the pipeline below resolves identically\n\n    if (store !== \"ref\" && dialect === \"git\" && headIsAttachCommit(branch)) {\n      return { exit: 0 }; // cap: already attached this push attempt — let it through\n    }\n\n    // Run the pipeline with stderr muted: a human pushing a hand-written branch\n    // must not see \"no agent session found\" on every push (R3: one line max,\n    // and only when we actually attach something).\n    const write = process.stderr.write.bind(process.stderr);\n    process.stderr.write = (() => true) as typeof process.stderr.write;\n    let generated: number;\n    try {\n      generated = await generate({ pendingCommit });\n    } finally {\n      process.stderr.write = write;\n    }\n    if (generated !== 0) {\n      return { exit: 0 }; // no matching session / generation declined — never block\n    }\n\n    // store=ref (SPEC-0070): the receipt is a sibling ref, not a branch commit —\n    // push it ourselves and let the branch push proceed untouched. No re-push\n    // dance in either dialect: a ref push never modifies the in-flight branch.\n    if (store === \"ref\") {\n      const slug = branch.replace(/[/\\\\]/g, \"-\");\n      if (readReceiptRef(slug) == null) {\n        return { exit: 0 };\n      }\n      const pushed = pushReceiptRef(slug);\n      return {\n        exit: 0,\n        message: pushed\n          ? `receipts: receipt at refs/receipts/${slug} — travels alongside this push.`\n          : `receipts: wrote refs/receipts/${slug}; pushing it failed — push the ref manually.`,\n      };\n    }\n\n    if (!git([\"status\", \"--porcelain\", \".receipts/\"])) {\n      return { exit: 0 }; // receipt unchanged — push proceeds untouched\n    }\n    spawnSync(\"git\", [\"add\", \".receipts/\"], { encoding: \"utf8\" });\n    // Pathspec commit: only .receipts/ lands, whatever else is staged stays staged.\n    const commit = spawnSync(\n      \"git\",\n      [\"commit\", \"--no-verify\", \"-m\", ATTACH_SUBJECT(branch), \"--\", \".receipts/\"],\n      { encoding: \"utf8\" },\n    );\n    if (commit.status !== 0) {\n      return { exit: 0 };\n    }\n    if (dialect === \"git\") {\n      return {\n        exit: REPUSH_EXIT,\n        message: `📎 Receipts: attached an agent receipt for '${branch}' — rerun the same \\`git push\\` command to include it.`,\n      };\n    }\n    return {\n      exit: 0,\n      message: `receipts: attached an agent receipt for '${branch}' — it rides this push.`,\n    };\n  } catch {\n    return { exit: 0 }; // SPEC-0066 R3: any failure → silent allow\n  }\n}\n","import { spawnSync } from \"node:child_process\";\n\n/**\n * `store=ref` (SPEC-0070 / M71): receipts as git objects on\n * `refs/receipts/<slug>` — zero files in the working tree, nothing in PR diffs,\n * nothing accumulating on main. Pure plumbing (hash-object → mktree →\n * commit-tree → update-ref): no index, no checkout, no worktree contact.\n *\n * The wrapping commit (rather than a bare blob ref) keeps the object GC-rooted\n * on every host, `git show`-friendly, and carries the branch name in its\n * message so `prune --refs` can recover it. Determinism: fixed identity and the\n * session's own end time as both dates — same receipt bytes ⇒ same commit SHA.\n */\n\nconst IDENT = [\"-c\", \"user.name=receipts\", \"-c\", \"user.email=receipts@altimate.ai\"];\n\nexport const RECEIPT_REF_PREFIX = \"refs/receipts/\";\nexport const receiptRef = (slug: string): string => `${RECEIPT_REF_PREFIX}${slug}`;\n\ninterface GitResult {\n  out: string;\n  ok: boolean;\n  err?: string;\n}\n\nfunction git(\n  args: string[],\n  opts: { cwd?: string; input?: string; env?: NodeJS.ProcessEnv } = {},\n): GitResult {\n  const r = spawnSync(\"git\", args, {\n    encoding: \"utf8\",\n    cwd: opts.cwd,\n    input: opts.input,\n    env: opts.env ? { ...process.env, ...opts.env } : process.env,\n  });\n  return { out: (r.stdout ?? \"\").trim(), ok: r.status === 0, err: (r.stderr ?? \"\").trim() };\n}\n\nexport type WriteRefResult =\n  | { ok: true; ref: string; commit: string }\n  | { ok: false; reason: string };\n\n/** Write `json` as refs/receipts/<slug> (force-updates an existing ref). */\nexport function writeReceiptRef(\n  slug: string,\n  branch: string,\n  json: string,\n  endedAtMs: number | undefined,\n  cwd?: string,\n): WriteRefResult {\n  const blob = git([\"hash-object\", \"-w\", \"--stdin\"], { cwd, input: json });\n  if (!blob.ok) {\n    return { ok: false, reason: \"hash-object failed (not a git repository?)\" };\n  }\n  const tree = git([\"mktree\"], { cwd, input: `100644 blob ${blob.out}\\treceipt.json\\n` });\n  if (!tree.ok) {\n    return { ok: false, reason: \"mktree failed\" };\n  }\n  // Deterministic commit: fixed identity, the session's end time as both dates\n  // (clamped to epoch second 1 — git rejects a raw timestamp of 0).\n  const when = `@${Math.max(1, Math.floor((endedAtMs ?? 0) / 1000))} +0000`;\n  const commit = git([...IDENT, \"commit-tree\", tree.out, \"-m\", `receipt: ${branch}`], {\n    cwd,\n    env: { GIT_AUTHOR_DATE: when, GIT_COMMITTER_DATE: when },\n  });\n  if (!commit.ok) {\n    return { ok: false, reason: `commit-tree failed: ${commit.err}` };\n  }\n  const ref = receiptRef(slug);\n  const upd = git([\"update-ref\", ref, commit.out], { cwd });\n  if (!upd.ok) {\n    return { ok: false, reason: `update-ref ${ref} failed` };\n  }\n  return { ok: true, ref, commit: commit.out };\n}\n\n/** Read the receipt JSON stored at refs/receipts/<slug>, or null. */\nexport function readReceiptRef(slug: string, cwd?: string): string | null {\n  const r = git([\"cat-file\", \"blob\", `${receiptRef(slug)}:receipt.json`], { cwd });\n  return r.ok ? r.out : null;\n}\n\n/** The branch a receipt ref was written for (recovered from the commit message). */\nexport function refBranch(ref: string, cwd?: string): string | null {\n  const r = git([\"log\", \"-1\", \"--format=%s\", ref], { cwd });\n  const m = r.ok ? /^receipt: (.+)$/.exec(r.out) : null;\n  return m ? m[1] : null;\n}\n\n/** All local receipt refs: [{ref, slug}]. */\nexport function listReceiptRefs(cwd?: string): Array<{ ref: string; slug: string }> {\n  const r = git([\"for-each-ref\", RECEIPT_REF_PREFIX, \"--format=%(refname)\"], { cwd });\n  if (!r.ok || !r.out) {\n    return [];\n  }\n  return r.out\n    .split(\"\\n\")\n    .filter(Boolean)\n    .map((ref) => ({ ref, slug: ref.slice(RECEIPT_REF_PREFIX.length) }));\n}\n\n/** Push the receipt ref to `remote` (force — receipts regenerate). Best-effort. */\nexport function pushReceiptRef(slug: string, remote = \"origin\", cwd?: string): boolean {\n  const ref = receiptRef(slug);\n  return git([\"push\", remote, `+${ref}:${ref}`], { cwd }).ok;\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\n\n/**\n * Deep-merge the Receipts hook entry into a Claude Code settings.json — used by\n * `receipts init` (the repo's .claude/settings.json) and `receipts setup-local`\n * (the user's ~/.claude/settings.json). SPEC-0066 R5/R8: preserve every existing\n * key and hook, be idempotent, and back off (never clobber) on a malformed file.\n *\n * The command is a FROZEN one-liner: all behavior lives behind npx, so published\n * updates reach every contributor with no re-commit and — because agent runtimes\n * record hook trust against the command text — no re-approval.\n */\nexport const HOOK_COMMAND = \"npx -y altimate-receipts@latest hook pre-push\";\n\n/** The live-guard PreToolUse command (opt-in; installed by `receipts init --guard`). It classifies a\n * tool call BEFORE it runs (deny/ask/warn) and records the decision for the receipt. A user can turn\n * it off without un-installing via `RECEIPTS_GUARD=0`. Matches Bash + file-edit tools. */\nexport const GUARD_HOOK_COMMAND = \"npx -y altimate-receipts@latest hook guard\";\nexport const GUARD_MATCHER = \"Bash|Edit|Write|MultiEdit\";\n\ninterface HookEntry {\n  matcher?: string;\n  hooks?: Array<{ type?: string; command?: string }>;\n}\n\nexport type MergeResult = { ok: true; changed: boolean } | { ok: false; reason: string };\n\n/**\n * The repo-committed store default (SPEC-0070 R3): `.claude/settings.json` →\n * `env.RECEIPTS_STORE`. Claude Code exports project env to sessions natively;\n * the hook reads the same key here so the git/codex dialects honor it too.\n * No new config file — the knob lives in the file adopters already commit.\n */\nexport function settingsStore(root: string): string | undefined {\n  try {\n    const s = JSON.parse(readFileSync(join(root, \".claude\", \"settings.json\"), \"utf8\")) as {\n      env?: Record<string, unknown>;\n    };\n    const v = s?.env?.RECEIPTS_STORE;\n    return typeof v === \"string\" && v ? v : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Add a PreToolUse→Bash→command entry to `path`, creating the file if absent.\n * Anything already in the file survives byte-meaning-identically. Codex's\n * hooks.json uses the exact same schema as Claude Code's settings hooks\n * (SPEC-0069 R4), so one merger serves both — `command` defaults to Claude's. */\nexport function mergeHookIntoSettings(\n  path: string,\n  command: string = HOOK_COMMAND,\n  opts: {\n    /** SPEC-0074/M75 (R1/R2): also write `env.RECEIPTS_STORE = \"ref\"` when the file\n     * doesn't already pin a store. REPO-level settings only — never set for the\n     * user-level merge (setup-local), where it would flip every repo they touch. */\n    defaultStoreRef?: boolean;\n    /** PreToolUse matcher (tool-name regex). Defaults to \"Bash\"; the live guard passes\n     * GUARD_MATCHER so it also sees file edits. */\n    matcher?: string;\n  } = {},\n): MergeResult {\n  let settings: Record<string, unknown> = {};\n  if (existsSync(path)) {\n    let parsed: unknown;\n    try {\n      parsed = JSON.parse(readFileSync(path, \"utf8\"));\n    } catch {\n      return { ok: false, reason: `${path} is not valid JSON — leaving it untouched` };\n    }\n    if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n      return { ok: false, reason: `${path} is not a JSON object — leaving it untouched` };\n    }\n    settings = parsed as Record<string, unknown>;\n  }\n\n  if (settings.hooks === undefined) {\n    settings.hooks = {};\n  }\n  const hooks = settings.hooks as Record<string, unknown>;\n  if (typeof hooks !== \"object\" || hooks === null || Array.isArray(hooks)) {\n    return { ok: false, reason: `${path} has a non-object \"hooks\" key — leaving it untouched` };\n  }\n  if (hooks.PreToolUse === undefined) {\n    hooks.PreToolUse = [];\n  }\n  const pre = hooks.PreToolUse as HookEntry[];\n  if (!Array.isArray(pre)) {\n    return { ok: false, reason: `${path} has a non-array hooks.PreToolUse — leaving it untouched` };\n  }\n  const present = pre.some((e) => e?.hooks?.some((h) => h?.command === command));\n\n  // M75 R1/R2: receipts-as-refs is the adoption default — but an explicit choice\n  // (any existing env.RECEIPTS_STORE value, including \"commit\") always survives.\n  let envChanged = false;\n  if (opts.defaultStoreRef) {\n    if (settings.env === undefined) {\n      settings.env = {};\n    }\n    const env = settings.env as Record<string, unknown>;\n    if (typeof env !== \"object\" || env === null || Array.isArray(env)) {\n      return { ok: false, reason: `${path} has a non-object \"env\" key — leaving it untouched` };\n    }\n    if (env.RECEIPTS_STORE === undefined) {\n      env.RECEIPTS_STORE = \"ref\";\n      envChanged = true;\n    }\n  }\n\n  if (present && !envChanged) {\n    return { ok: true, changed: false };\n  }\n  if (!present) {\n    pre.push({ matcher: opts.matcher ?? \"Bash\", hooks: [{ type: \"command\", command }] });\n  }\n\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(settings, null, 2)}\\n`);\n  return { ok: true, changed: true };\n}\n","import { readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { Receipt, ReceiptPredicate } from \"./build.js\";\n\n/**\n * Receipt assertions (M34, SPEC-0036) — eval-as-code WITHOUT the model judge. A committed\n * `.receipts/asserts.json` of deterministic `{path, op, value}` checks is evaluated\n * mechanically against the just-derived receipt: the **user** supplies the oracle, and\n * Receipts only does exact comparison over evidence it already attests. Pure function of\n * the receipt + the committed file ⇒ re-derivable; zero model calls; no quality verdict.\n */\n\nexport type AssertOp =\n  | \"eq\"\n  | \"ne\"\n  | \"lt\"\n  | \"lte\"\n  | \"gt\"\n  | \"gte\"\n  | \"matches\"\n  | \"in\"\n  | \"empty\"\n  | \"exists\";\n\nconst OPS = new Set<AssertOp>([\n  \"eq\",\n  \"ne\",\n  \"lt\",\n  \"lte\",\n  \"gt\",\n  \"gte\",\n  \"matches\",\n  \"in\",\n  \"empty\",\n  \"exists\",\n]);\n\nexport interface Assertion {\n  /** dotted accessor into `predicate` (e.g. `evidence.costUsd`, `grade`) or a finding\n   * selector (`findings.<id>` count, `findings.severity.<level>` count). */\n  path: string;\n  op: AssertOp;\n  value?: unknown;\n  /** `error` (default) gates the exit code; `warn` reports but does not fail. */\n  severity?: \"error\" | \"warn\";\n}\n\nexport interface AssertResult {\n  assertion: Assertion;\n  pass: boolean;\n  actual: unknown;\n  /** a config/usage error (bad op, missing field for a comparison, …) — never a silent pass */\n  error?: string;\n}\n\n/** Resolve a dotted `path` into the receipt predicate, with finding selectors. */\nexport function resolvePath(predicate: ReceiptPredicate, path: string): unknown {\n  if (path === \"findings\" || path.startsWith(\"findings.\")) {\n    const rest = path === \"findings\" ? \"\" : path.slice(\"findings.\".length);\n    if (rest === \"\") {\n      return predicate.findings.length;\n    }\n    if (rest.startsWith(\"severity.\")) {\n      const level = rest.slice(\"severity.\".length);\n      return predicate.findings.filter((f) => f.severity === level).length;\n    }\n    // `findings.<id>` → count of findings whose id equals or is prefixed by it (so a\n    // category like `destructive-git` matches `destructive-git-<span>`).\n    return predicate.findings.filter((f) => f.id === rest || f.id.startsWith(`${rest}-`)).length;\n  }\n  // dotted get into the predicate (evidence.*, grade, scope.*, session.*)\n  let cur: unknown = predicate;\n  for (const key of path.split(\".\")) {\n    if (cur == null || typeof cur !== \"object\") {\n      return undefined;\n    }\n    cur = (cur as Record<string, unknown>)[key];\n  }\n  return cur;\n}\n\nconst isNum = (v: unknown): v is number => typeof v === \"number\" && Number.isFinite(v);\nconst isEmpty = (v: unknown): boolean =>\n  v == null ||\n  v === \"\" ||\n  v === 0 ||\n  (Array.isArray(v) && v.length === 0) ||\n  (typeof v === \"object\" && Object.keys(v as object).length === 0);\n\n/** Apply one operator; returns `{pass}` or `{error}` for a config/type misuse. */\nfunction applyOp(\n  op: AssertOp,\n  actual: unknown,\n  value: unknown,\n): { pass: boolean } | { error: string } {\n  const needNum = (): { error: string } | null =>\n    isNum(actual) && isNum(value)\n      ? null\n      : { error: `op '${op}' needs a numeric field and value (got ${JSON.stringify(actual)})` };\n  switch (op) {\n    case \"exists\":\n      return { pass: actual !== undefined && actual !== null };\n    case \"empty\":\n      return { pass: isEmpty(actual) };\n    case \"eq\":\n      return { pass: actual === value };\n    case \"ne\":\n      return { pass: actual !== value };\n    case \"lt\":\n      return needNum() ?? { pass: (actual as number) < (value as number) };\n    case \"lte\":\n      return needNum() ?? { pass: (actual as number) <= (value as number) };\n    case \"gt\":\n      return needNum() ?? { pass: (actual as number) > (value as number) };\n    case \"gte\":\n      return needNum() ?? { pass: (actual as number) >= (value as number) };\n    case \"matches\": {\n      if (typeof actual !== \"string\" || typeof value !== \"string\") {\n        return { error: `op 'matches' needs a string field and a string pattern` };\n      }\n      try {\n        return { pass: new RegExp(value).test(actual) };\n      } catch (e) {\n        return { error: `invalid regex '${value}': ${(e as Error).message}` };\n      }\n    }\n    case \"in\":\n      return Array.isArray(value)\n        ? { pass: value.includes(actual) }\n        : { error: `op 'in' needs an array value` };\n    default:\n      return { error: `unknown op '${op}'` };\n  }\n}\n\n/** Validate + normalise one raw assertion entry; returns an error string when malformed. */\nfunction validateAssertion(raw: unknown): { assertion: Assertion } | { error: string } {\n  if (!raw || typeof raw !== \"object\") {\n    return { error: \"assertion must be an object\" };\n  }\n  const r = raw as Record<string, unknown>;\n  if (typeof r.path !== \"string\" || !r.path) {\n    return { error: \"assertion.path must be a non-empty string\" };\n  }\n  if (typeof r.op !== \"string\" || !OPS.has(r.op as AssertOp)) {\n    return { error: `assertion.op '${String(r.op)}' is not one of ${[...OPS].join(\"|\")}` };\n  }\n  if (r.severity !== undefined && r.severity !== \"error\" && r.severity !== \"warn\") {\n    return { error: \"assertion.severity must be 'error' or 'warn'\" };\n  }\n  return {\n    assertion: {\n      path: r.path,\n      op: r.op as AssertOp,\n      value: r.value,\n      severity: (r.severity as \"error\" | \"warn\") ?? \"error\",\n    },\n  };\n}\n\n/** Read `.receipts/asserts.json` (JSON-only v1, no new dependency). Returns `[]` when\n * absent (the command is then a no-op). Throws on malformed JSON / wrong shape. */\nexport function loadAsserts(repoRoot: string): Assertion[] {\n  const path = join(repoRoot, \".receipts\", \"asserts.json\");\n  let text: string;\n  try {\n    text = readFileSync(path, \"utf8\");\n  } catch {\n    return []; // absent ⇒ no-op\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch (e) {\n    throw new Error(`.receipts/asserts.json is not valid JSON: ${(e as Error).message}`);\n  }\n  const list = Array.isArray(parsed)\n    ? parsed\n    : parsed &&\n        typeof parsed === \"object\" &&\n        Array.isArray((parsed as { asserts?: unknown }).asserts)\n      ? (parsed as { asserts: unknown[] }).asserts\n      : null;\n  if (!list) {\n    throw new Error(\".receipts/asserts.json must be an array or { asserts: [...] }\");\n  }\n  const out: Assertion[] = [];\n  for (const raw of list) {\n    const v = validateAssertion(raw);\n    if (\"error\" in v) {\n      throw new Error(`invalid assertion: ${v.error} (${JSON.stringify(raw)})`);\n    }\n    out.push(v.assertion);\n  }\n  return out;\n}\n\n/** Evaluate every assertion against the receipt — pure, total, no model. */\nexport function evaluateAsserts(receipt: Receipt, asserts: readonly Assertion[]): AssertResult[] {\n  return asserts.map((assertion) => {\n    const actual = resolvePath(receipt.predicate, assertion.path);\n    // a comparison op on a missing field is a config error, never a silent pass.\n    if (\n      actual === undefined &&\n      assertion.op !== \"exists\" &&\n      assertion.op !== \"empty\" &&\n      assertion.op !== \"ne\"\n    ) {\n      return { assertion, pass: false, actual, error: `path '${assertion.path}' not found` };\n    }\n    const res = applyOp(assertion.op, actual, assertion.value);\n    return \"error\" in res\n      ? { assertion, pass: false, actual, error: res.error }\n      : { assertion, pass: res.pass, actual };\n  });\n}\n\n/** Exit code: non-zero iff an error-severity assertion failed or hit a config error. */\nexport function assertExitCode(results: readonly AssertResult[]): number {\n  return results.some((r) => (!r.pass || r.error) && (r.assertion.severity ?? \"error\") === \"error\")\n    ? 1\n    : 0;\n}\n\n/** Human-readable report of the assertion run. */\nexport function renderAssertResults(results: readonly AssertResult[]): string {\n  if (results.length === 0) {\n    return \"receipts assert: no assertions (.receipts/asserts.json absent) — nothing to check.\";\n  }\n  const lines = results.map((r) => {\n    const { path, op, value, severity } = r.assertion;\n    const expr = `${path} ${op}${value === undefined ? \"\" : ` ${JSON.stringify(value)}`}`;\n    if (r.error) {\n      return `  ⚠️  ERROR  ${expr} — ${r.error}`;\n    }\n    const tag = r.pass ? \"  ✅ PASS \" : severity === \"warn\" ? \"  🟡 WARN \" : \"  ❌ FAIL \";\n    return `${tag} ${expr}  (actual: ${JSON.stringify(r.actual)})`;\n  });\n  const failed = results.filter(\n    (r) => !r.pass && (r.assertion.severity ?? \"error\") === \"error\",\n  ).length;\n  const warned = results.filter((r) => !r.pass && r.assertion.severity === \"warn\").length;\n  const passed = results.filter((r) => r.pass).length;\n  lines.push(\n    `  ${passed} passed · ${failed} failed${warned ? ` · ${warned} warned` : \"\"} of ${results.length}`,\n  );\n  return lines.join(\"\\n\");\n}\n","import { readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { ExternalStateRow } from \"../findings/externalState.js\";\n\n/**\n * Reader for the external-state reconciliation side-log (SPEC-0120 / external-state-reconciler).\n * The opt-in `receipts reconcile` CI step (src/reconcile/reconcile.ts) calls the authoritative\n * API (`gh pr view` / `gh pr checks`) and appends one JSON line per reconciliation to\n * `${RECEIPTS_RECONCILE_DIR || ~/.claude/receipts/reconcile}/<sessionId>.jsonl`. `receipts pr`\n * reads the log for the session it is building and attaches the rows as a recorded input (exempt\n * from the L1 byte-compare; envelope-covered). Crash-safe: a missing or garbled log yields `[]` —\n * the reconciler is a bonus, never a hard dependency, so a read failure must never break a receipt.\n *\n * The producer (the reconciler) imports `reconcileDir()` from here, so the write path and this read\n * path share one source — they cannot drift. `<sessionId>` is the transcript file's basename, the\n * same key `sessionIdFromPath()` (guardLog.ts) resolves.\n */\nexport function reconcileDir(): string {\n  return process.env.RECEIPTS_RECONCILE_DIR || join(homedir(), \".claude\", \"receipts\", \"reconcile\");\n}\n\nfunction isExternalStateRow(v: unknown): v is ExternalStateRow {\n  if (!v || typeof v !== \"object\") {\n    return false;\n  }\n  const o = v as Record<string, unknown>;\n  return (\n    (o.kind === \"merged\" || o.kind === \"ci-green\") &&\n    typeof o.target === \"string\" &&\n    typeof o.claimed === \"string\" &&\n    typeof o.actual === \"string\" &&\n    typeof o.match === \"boolean\"\n  );\n}\n\n/**\n * Read + validate the reconciliation rows for a session id. Returns the well-formed rows in file\n * order; skips malformed lines. Returns `[]` when the log is absent or unreadable.\n */\nexport function readExternalState(sessionId: string): ExternalStateRow[] {\n  if (!sessionId) {\n    return [];\n  }\n  let raw: string;\n  try {\n    raw = readFileSync(join(reconcileDir(), `${sessionId}.jsonl`), \"utf8\");\n  } catch {\n    return []; // no log for this session — the common case (reconciler is opt-in)\n  }\n  const out: ExternalStateRow[] = [];\n  for (const line of raw.split(\"\\n\")) {\n    const t = line.trim();\n    if (!t) {\n      continue;\n    }\n    try {\n      const v = JSON.parse(t);\n      if (isExternalStateRow(v)) {\n        out.push({\n          kind: v.kind,\n          target: v.target,\n          claimed: v.claimed,\n          actual: v.actual,\n          match: v.match,\n          ...(typeof v.actor === \"string\" ? { actor: v.actor } : {}),\n          ...(typeof v.ts === \"string\" ? { ts: v.ts } : {}),\n          ...(typeof v.fetchedAt === \"string\" ? { fetchedAt: v.fetchedAt } : {}),\n          ...(typeof v.url === \"string\" ? { url: v.url } : {}),\n        });\n      }\n    } catch {\n      // skip a malformed line; a partial/corrupt log still yields its good rows\n    }\n  }\n  return out;\n}\n","import { execFileSync } from \"node:child_process\";\nimport { mkdirSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n  type ExternalClaim,\n  type ExternalStateRow,\n  parseExternalClaims,\n} from \"../findings/externalState.js\";\nimport { reconcileDir } from \"../receipt/externalStateLog.js\";\n\n/**\n * The external-state reconciler (SPEC-0120 / external-state-reconciler — THE WEDGE). The ONLY\n * place network + creds enter the system, and it is OPT-IN (gated by `RECEIPTS_RECONCILE`) and\n * runs in CI — the deterministic `receipts` core never imports this. It parses the agent's\n * external-state claims, calls the authoritative API (`gh`), does an EXACT enum comparison, and\n * appends the result to the side-log `receipts pr` reads. Abstain-on-doubt (R3): any ambiguity —\n * no parseable target, API unreachable / 403 / rate-limited, a pending check — yields NO row.\n * Evidence, not judgement: a row attests the API's answer, never \"the agent lied.\"\n */\n\n/** The authoritative API answer for a claim target. `degraded` ⇒ abstain (no row). */\nexport interface ApiState {\n  /** the authoritative state string (\"OPEN\" | \"CLOSED\" | \"MERGED\" | \"pass\" | \"fail\" | …) */\n  actual: string;\n  /** the API's authoritative actor, when present (`mergedBy.login`) */\n  actor?: string;\n  /** the API's own event timestamp (`mergedAt`), when present */\n  ts?: string;\n  url?: string;\n  /** true when the API could not give a confident answer (unreachable / pending / no creds) */\n  degraded?: boolean;\n}\n\n/** A fetcher resolves a claim's target to the API's authoritative state. Injected so the compare\n * logic is pure + testable; the real one shells out to `gh`. */\nexport type Fetcher = (claim: ExternalClaim) => ApiState;\n\n/** Did the claim match the API? merged ⇒ state MERGED; ci-green ⇒ every run pass. Exact equality\n * over enum strings — no inference. */\nfunction isMatch(kind: ExternalClaim[\"kind\"], actual: string): boolean {\n  if (kind === \"merged\") {\n    return actual.toUpperCase() === \"MERGED\";\n  }\n  return actual.toLowerCase() === \"pass\";\n}\n\n/**\n * Reconcile one claim against a fetcher. Returns a row, or null to ABSTAIN (degraded API — R3).\n * Pure given the fetcher.\n */\nexport function reconcileClaim(\n  claim: ExternalClaim,\n  fetch: Fetcher,\n  fetchedAt: string,\n): ExternalStateRow | null {\n  let api: ApiState;\n  try {\n    api = fetch(claim);\n  } catch {\n    return null; // unreachable / threw ⇒ abstain (degrade silent)\n  }\n  if (api.degraded || !api.actual) {\n    return null; // pending / 403 / rate-limited / no creds ⇒ abstain\n  }\n  return {\n    kind: claim.kind,\n    target: claim.target,\n    claimed: claim.kind === \"merged\" ? \"merged\" : \"green\",\n    actual: api.actual,\n    match: isMatch(claim.kind, api.actual),\n    ...(api.actor ? { actor: api.actor } : {}),\n    ...(api.ts ? { ts: api.ts } : {}),\n    fetchedAt,\n    ...(api.url ? { url: api.url } : {}),\n  };\n}\n\n/** Split a `#N` / `owner/repo#N` target into the PR number + optional `--repo` args. */\nfunction targetArgs(target: string): { num: string; repo?: string } | null {\n  const m = /^(?:([\\w.-]+\\/[\\w.-]+)#)?(\\d+)$/.exec(target);\n  if (!m) {\n    return null;\n  }\n  return { num: m[2], ...(m[1] ? { repo: m[1] } : {}) };\n}\n\nfunction gh(args: string[]): string {\n  return execFileSync(\"gh\", args, { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] });\n}\n\n/** The real fetcher: `gh pr view` for merged, `gh pr checks` for ci-green. Any failure throws or\n * returns degraded ⇒ the caller abstains. */\nexport const ghFetcher: Fetcher = (claim) => {\n  const t = targetArgs(claim.target);\n  if (!t) {\n    return { actual: \"\", degraded: true };\n  }\n  const repoArgs = t.repo ? [\"--repo\", t.repo] : [];\n  if (claim.kind === \"merged\") {\n    const out = gh([\"pr\", \"view\", t.num, ...repoArgs, \"--json\", \"state,mergedBy,mergedAt,url\"]);\n    const j = JSON.parse(out) as {\n      state?: string;\n      mergedBy?: { login?: string } | null;\n      mergedAt?: string | null;\n      url?: string;\n    };\n    if (!j.state) {\n      return { actual: \"\", degraded: true };\n    }\n    return {\n      actual: j.state,\n      ...(j.mergedBy?.login ? { actor: j.mergedBy.login } : {}),\n      ...(j.mergedAt ? { ts: j.mergedAt } : {}),\n      ...(j.url ? { url: j.url } : {}),\n    };\n  }\n  // ci-green: derive from per-run buckets (the real `gh pr checks` enum is\n  // pass/fail/pending/skipping/cancel). A check still `pending` ⇒ abstain (not a contradiction).\n  // Green requires NO `fail`/`cancel`; `skipping`/`skipped`/`neutral` do NOT break green (a suite\n  // of pass+skipping is green — ci-green-with-skips). The suite rollup combines by highest-priority\n  // conclusion, so we derive from per-run buckets, not the rollup.\n  const out = gh([\"pr\", \"checks\", t.num, ...repoArgs, \"--json\", \"bucket,state,name\"]);\n  const runs = JSON.parse(out) as { bucket?: string }[];\n  if (!Array.isArray(runs) || runs.length === 0) {\n    return { actual: \"\", degraded: true };\n  }\n  return ciStateFromBuckets(runs.map((r) => (r.bucket || \"\").toLowerCase()));\n};\n\nconst GREENISH = new Set([\"pass\", \"skipping\", \"skipped\", \"neutral\"]);\n\n/**\n * Map per-run `gh pr checks` buckets to a CI state. `pending` ⇒ abstain (not a contradiction);\n * any `fail`/`cancel` ⇒ \"fail\"; ALL recognized green/neutral ⇒ \"pass\". Abstain-on-doubt: an\n * unknown or empty bucket must NOT fall through to \"pass\" (codex review — a divergence can't fire\n * on a gh enum we don't model). Pure + unit-tested.\n */\nexport function ciStateFromBuckets(buckets: readonly string[]): ApiState {\n  if (buckets.length === 0) {\n    return { actual: \"\", degraded: true };\n  }\n  if (buckets.some((b) => b === \"pending\")) {\n    return { actual: \"\", degraded: true };\n  }\n  if (buckets.some((b) => b === \"fail\" || b === \"cancel\")) {\n    return { actual: \"fail\" };\n  }\n  if (buckets.every((b) => GREENISH.has(b))) {\n    return { actual: \"pass\" };\n  }\n  return { actual: \"\", degraded: true }; // an unknown/empty bucket ⇒ abstain\n}\n\nexport interface ReconcileResult {\n  /** claims parsed from the final text */\n  claims: number;\n  /** rows written (after abstentions) */\n  rows: ExternalStateRow[];\n}\n\n/**\n * Reconcile a session's external-state claims and append the rows to its side-log. Opt-in: a\n * no-op unless `RECEIPTS_RECONCILE` is set. `finalText` is the agent's final message; `sessionId`\n * is the transcript basename (the key `receipts pr` reads).\n */\nexport function reconcileSession(\n  sessionId: string,\n  finalText: string,\n  fetch: Fetcher = ghFetcher,\n  fetchedAt = \"\",\n): ReconcileResult {\n  if (!process.env.RECEIPTS_RECONCILE) {\n    return { claims: 0, rows: [] };\n  }\n  const claims = parseExternalClaims(finalText);\n  const rows: ExternalStateRow[] = [];\n  for (const c of claims) {\n    const row = reconcileClaim(c, fetch, fetchedAt);\n    if (row) {\n      rows.push(row);\n    }\n  }\n  if (rows.length && sessionId) {\n    const dir = reconcileDir();\n    mkdirSync(dir, { recursive: true });\n    // OVERWRITE (not append): each reconcile run re-reconciles the session's CURRENT claims, so\n    // the freshest run is authoritative. Appending would let a stale OPEN mismatch keep rendering\n    // after the PR later merges (the API answer changed). One run ⇒ one fresh side-log.\n    writeFileSync(\n      join(dir, `${sessionId}.jsonl`),\n      `${rows.map((r) => JSON.stringify(r)).join(\"\\n\")}\\n`,\n    );\n  }\n  return { claims: claims.length, rows };\n}\n","import { spawnSync } from \"node:child_process\";\n\n/**\n * `receipts ack` (M78) — the attributed human acknowledgment of an agent's work. An ack\n * is the **active gesture** (a human did something, not just a bot that auto-ran) and an\n * **audit-trail signal**: \"a named person, at a time, reviewed this agent's work record.\" Recorded into an append-only, local-only ledger in a sibling\n * git ref (`refs/receipts-acks/<slug>`) — never mutating the signed receipt itself.\n *\n * Local-first (R4): reads/writes only local refs the user owns; nothing uploaded. The\n * outward half — writing the ack back onto the PR comment — is deliberately OUT of scope\n * (requires comment-write auth; SPEC-0073 NG2). This is the safe, composable core: once\n * recorded, `receipts fleet` surfaces review coverage across the org.\n *\n * Acks carry a real actor + timestamp — a genuine non-deterministic *input* (a user\n * action), like prEffort/prHistory, not a derived value; both are passed in by the caller\n * so the core stays pure and testable.\n */\n\nexport const ACK_REF_PREFIX = \"refs/receipts-acks/\";\nexport const ackRef = (slug: string): string => `${ACK_REF_PREFIX}${slug}`;\n\nexport interface AckEntry {\n  /** who acknowledged — `Name <email>` or a bare username */\n  actor: string;\n  /** unix ms when acknowledged (a recorded input, not derived) */\n  ts: number;\n  /** optional note the reviewer left */\n  note?: string;\n  /** optional event id (the receipts-state event this ack is about); omitted = whole receipt */\n  eventId?: string;\n}\n\ninterface GitResult {\n  out: string;\n  ok: boolean;\n  err: string;\n}\nfunction git(\n  args: string[],\n  opts: { cwd?: string; input?: string; env?: NodeJS.ProcessEnv } = {},\n): GitResult {\n  const r = spawnSync(\"git\", args, {\n    encoding: \"utf8\",\n    cwd: opts.cwd,\n    input: opts.input,\n    env: opts.env ? { ...process.env, ...opts.env } : process.env,\n  });\n  return { out: (r.stdout ?? \"\").trim(), ok: r.status === 0, err: (r.stderr ?? \"\").trim() };\n}\n\n// Deterministic ledger commits (the entries carry the real time; the wrapping commit is\n// fixed-identity so re-writing the same entries yields the same tree, like store.ts).\nconst IDENT = [\"-c\", \"user.name=receipts\", \"-c\", \"user.email=receipts@altimate.ai\"];\n\n/** Read the append-only ack ledger for `slug` (newest-last), or `[]` if none. */\nexport function readAcks(slug: string, cwd?: string): AckEntry[] {\n  const r = git([\"cat-file\", \"blob\", `${ackRef(slug)}:acks.json`], { cwd });\n  if (!r.ok || !r.out) {\n    return [];\n  }\n  try {\n    const v = JSON.parse(r.out);\n    return Array.isArray(v) ? (v as AckEntry[]) : [];\n  } catch {\n    return [];\n  }\n}\n\nexport type AppendAckResult =\n  | { ok: true; ref: string; total: number }\n  | { ok: false; reason: string };\n\n/** Append one ack to `slug`'s ledger (append-only: prior entries are preserved). Writes\n * a sibling ref via plumbing — no index, no checkout, no tree files. */\nexport function appendAck(slug: string, entry: AckEntry, cwd?: string): AppendAckResult {\n  const existing = readAcks(slug, cwd);\n  const next = [...existing, entry];\n  const json = `${JSON.stringify(next, null, 2)}\\n`;\n\n  const blob = git([\"hash-object\", \"-w\", \"--stdin\"], { cwd, input: json });\n  if (!blob.ok) {\n    return { ok: false, reason: \"hash-object failed (not a git repository?)\" };\n  }\n  const tree = git([\"mktree\"], { cwd, input: `100644 blob ${blob.out}\\tacks.json\\n` });\n  if (!tree.ok) {\n    return { ok: false, reason: \"mktree failed\" };\n  }\n  // The wrapping commit's date is the ack's own timestamp (set via GIT_*_DATE), so the\n  // same accumulated entries reproduce the same commit — not wall-clock (review fix).\n  const when = `@${Math.max(1, Math.floor(entry.ts / 1000))} +0000`;\n  const commit = git([...IDENT, \"commit-tree\", tree.out, \"-m\", `acks: ${slug}`], {\n    cwd,\n    env: { GIT_AUTHOR_DATE: when, GIT_COMMITTER_DATE: when },\n  });\n  if (!commit.ok) {\n    return { ok: false, reason: `commit-tree failed: ${commit.err}` };\n  }\n  const ref = ackRef(slug);\n  const upd = git([\"update-ref\", ref, commit.out], { cwd });\n  if (!upd.ok) {\n    return { ok: false, reason: `update-ref ${ref} failed` };\n  }\n  return { ok: true, ref, total: next.length };\n}\n\n/** Resolve the acknowledging actor from local git identity, falling back to $USER. The\n * one impure read — kept here so the ledger core stays pure given (actor, ts). */\nexport function resolveActor(cwd?: string): string {\n  const name = git([\"config\", \"user.name\"], { cwd }).out;\n  const email = git([\"config\", \"user.email\"], { cwd }).out;\n  if (name && email) {\n    return `${name} <${email}>`;\n  }\n  return name || email || process.env.USER || process.env.LOGNAME || \"unknown\";\n}\n\n/** Which receipt slugs have ≥1 ack — used by `fleet` to show review coverage. */\nexport function listAckedSlugs(cwd?: string): Set<string> {\n  const r = git([\"for-each-ref\", ACK_REF_PREFIX, \"--format=%(refname)\"], { cwd });\n  if (!r.ok || !r.out) {\n    return new Set();\n  }\n  return new Set(\n    r.out\n      .split(\"\\n\")\n      .filter(Boolean)\n      .map((ref) => ref.slice(ACK_REF_PREFIX.length)),\n  );\n}\n","import type { GradeLetter } from \"../findings/grade.js\";\n\n/**\n * `receipts badge` (M59) — a [shields.io endpoint](https://shields.io/badges/endpoint-badge)\n * JSON for a repo's README/PR: an at-a-glance, **factual** state of the agent-work receipt.\n * It states the finding count (and colors by worst severity) — never a quality verdict about\n * the code (R2). Pure function of the receipt's findings; deterministic; zero model calls.\n *\n * Hosting is the user's choice (commit the JSON + a raw URL, or publish it from CI); this only\n * emits the endpoint object. Works once a repo is public (shields.io must reach the URL).\n */\n\nexport interface ShieldsEndpoint {\n  schemaVersion: 1;\n  label: string;\n  message: string;\n  color: string;\n}\n\ntype Sev = \"critical\" | \"high\" | \"medium\" | \"low\";\nconst SEV_ORDER: readonly Sev[] = [\"critical\", \"high\", \"medium\", \"low\"];\n\n/** The worst severity present in a finding set, or undefined when empty. */\nexport function worstSeverity(findings: readonly { severity: Sev }[]): Sev | undefined {\n  return SEV_ORDER.find((s) => findings.some((f) => f.severity === s));\n}\n\n/**\n * Build the shields.io endpoint object from a receipt predicate. Message is the finding\n * count (factual); color maps to the worst severity (clean → brightgreen, critical/high →\n * red, medium → orange, low → yellow). The synthesized grade is deliberately NOT the\n * message — the badge states what was found, not a verdict.\n */\nexport function badgeEndpoint(predicate: {\n  grade?: GradeLetter;\n  findings?: readonly { severity: Sev }[];\n}): ShieldsEndpoint {\n  const findings = predicate.findings ?? [];\n  const n = findings.length;\n  const worst = worstSeverity(findings);\n  const color =\n    n === 0\n      ? \"brightgreen\"\n      : worst === \"critical\" || worst === \"high\"\n        ? \"red\"\n        : worst === \"medium\"\n          ? \"orange\"\n          : \"yellow\";\n  const message = n === 0 ? \"no findings\" : `${n} finding${n === 1 ? \"\" : \"s\"}`;\n  return { schemaVersion: 1, label: \"receipts\", message, color };\n}\n","import { formatCostAlways, formatTokens } from \"../findings/format.js\";\nimport type { Receipt, ReceiptFinding } from \"../receipt/build.js\";\n\n/**\n * Receipt-to-receipt diff (M51) — \"what changed between two agent runs?\" A pure,\n * deterministic comparison of two receipts Receipts already emits (a re-run on the\n * same PR, last night's run vs tonight's, agent A vs agent B). It reports **deltas and\n * counts** — files/edits/commands, cost/tokens, findings added/removed, the\n * test-observation flip, both grades — and **never a judgement** (no \"better / worse /\n * regressed / improved\"). The reader decides; the diff states facts (SPEC-0000 R2).\n *\n * Deterministic · zero model calls · no schema change · same {a, b} → identical delta.\n */\n\nexport interface CountDelta {\n  key: string;\n  label: string;\n  a: number;\n  b: number;\n  delta: number;\n}\n\nexport interface ReceiptDelta {\n  grade: { a: string; b: string };\n  counts: CountDelta[];\n  cost: { a: number; b: number; delta: number };\n  testsObserved: { a: boolean; b: boolean };\n  findingsAdded: ReceiptFinding[];\n  findingsRemoved: ReceiptFinding[];\n  findingsCommon: number;\n  scope: { a: string; b: string };\n}\n\n/** Stable cross-run identity for a finding. The raw `id` embeds span indices that\n * differ between runs, so identity is the human-stable (title + filePath) pair. */\nfunction findingKey(f: ReceiptFinding): string {\n  return `${f.title}\u0000${f.filePath ?? \"\"}`;\n}\n\nfunction scopeLabel(r: Receipt): string {\n  const s = r.predicate.scope;\n  if (!s || s.kind === \"session\") return \"whole session\";\n  if (s.kind === \"branch\") return `branch ${s.branch ?? \"?\"}`;\n  return `diff (${(s.files ?? []).length} files${s.base ? ` vs ${s.base}` : \"\"})`;\n}\n\nexport function diffReceipts(a: Receipt, b: Receipt): ReceiptDelta {\n  const ea = a.predicate.evidence;\n  const eb = b.predicate.evidence;\n  const count = (key: string, label: string, va: number, vb: number): CountDelta => ({\n    key,\n    label,\n    a: va,\n    b: vb,\n    delta: vb - va,\n  });\n  const counts: CountDelta[] = [\n    count(\"filesChanged\", \"files changed\", ea.filesChanged, eb.filesChanged),\n    count(\"edits\", \"edits\", ea.edits, eb.edits),\n    count(\"commands\", \"commands\", ea.commands, eb.commands),\n    count(\"reads\", \"reads\", ea.reads, eb.reads),\n    count(\"destructiveOps\", \"destructive ops\", ea.destructiveOps, eb.destructiveOps),\n    count(\"tokens\", \"tokens\", ea.tokens.total, eb.tokens.total),\n  ];\n\n  const aKeys = new Set(a.predicate.findings.map(findingKey));\n  const bKeys = new Set(b.predicate.findings.map(findingKey));\n  const findingsAdded = b.predicate.findings.filter((f) => !aKeys.has(findingKey(f)));\n  const findingsRemoved = a.predicate.findings.filter((f) => !bKeys.has(findingKey(f)));\n  const findingsCommon = a.predicate.findings.filter((f) => bKeys.has(findingKey(f))).length;\n\n  return {\n    grade: { a: a.predicate.grade, b: b.predicate.grade },\n    counts,\n    cost: { a: ea.costUsd, b: eb.costUsd, delta: eb.costUsd - ea.costUsd },\n    testsObserved: { a: ea.testsRan, b: eb.testsRan },\n    findingsAdded,\n    findingsRemoved,\n    findingsCommon,\n    scope: { a: scopeLabel(a), b: scopeLabel(b) },\n  };\n}\n\nconst SEV_ICON: Record<string, string> = { critical: \"⛔\", high: \"⚠️\", medium: \"🔍\", low: \"·\" };\n\n/** Signed-delta string, neutral: \"+3\" / \"-2\" / \"±0\". No value judgement on direction. */\nfunction signed(n: number): string {\n  if (n === 0) return \"±0\";\n  return n > 0 ? `+${n}` : `${n}`;\n}\n\nfunction findingLines(fs: readonly ReceiptFinding[]): string[] {\n  return fs.map((f) => {\n    const loc = f.filePath ? ` (\\`${f.filePath}\\`)` : \"\";\n    return `  ${SEV_ICON[f.severity] ?? \"·\"} ${f.title}${loc}`;\n  });\n}\n\n/** Render the delta as plain text (A = baseline, B = new). Facts only. */\nexport function renderDiff(d: ReceiptDelta): string {\n  const out: string[] = [];\n  out.push(\"Receipt diff — A (baseline) → B (new)\");\n  out.push(\"\");\n  out.push(`Grade: ${d.grade.a} → ${d.grade.b}`);\n  out.push(`Scope: A ${d.scope.a} · B ${d.scope.b}`);\n  out.push(\"\");\n  out.push(\"Evidence:\");\n  for (const c of d.counts) {\n    out.push(`  ${c.label}: ${c.a} → ${c.b} (${signed(c.delta)})`);\n  }\n  const cd = d.cost;\n  const costDelta =\n    cd.delta === 0 ? \"±0\" : (cd.delta > 0 ? \"+\" : \"-\") + formatCostAlways(Math.abs(cd.delta));\n  out.push(`  cost: ${formatCostAlways(cd.a)} → ${formatCostAlways(cd.b)} (${costDelta})`);\n  out.push(\n    `  tokens (total): ${formatTokens(d.counts.find((c) => c.key === \"tokens\")?.a ?? 0)} → ${formatTokens(d.counts.find((c) => c.key === \"tokens\")?.b ?? 0)}`,\n  );\n  const to = d.testsObserved;\n  const toStr = (v: boolean) => (v ? \"observed\" : \"not observed\");\n  out.push(`  test command: ${toStr(to.a)} → ${toStr(to.b)}${to.a !== to.b ? \" (changed)\" : \"\"}`);\n  out.push(\"\");\n  out.push(\n    `Findings: ${d.findingsAdded.length} only in B · ${d.findingsRemoved.length} only in A · ${d.findingsCommon} in both`,\n  );\n  if (d.findingsAdded.length) {\n    out.push(\"\");\n    out.push(\"Only in B (new):\");\n    out.push(...findingLines(d.findingsAdded));\n  }\n  if (d.findingsRemoved.length) {\n    out.push(\"\");\n    out.push(\"Only in A (absent from B):\");\n    out.push(...findingLines(d.findingsRemoved));\n  }\n  out.push(\"\");\n  out.push(\"Deterministic · 0 model calls · evidence, not judgement.\");\n  return `${out.join(\"\\n\")}\\n`;\n}\n","import type { AgentSource } from \"../trace/types.js\";\nimport { CHECK_CATALOG, checkForId } from \"./checks.js\";\n\n/**\n * `receipts eval` (M57) — a precision/recall harness for the **work-account**, not the code.\n *\n * Receipts' thesis is that a human reviews the agent's *work* (a faithful, deterministic\n * account of what it did) instead of re-reading the agent's *output*. That only holds if the\n * account is trustworthy: one false alarm and the reviewer goes back to reading diffs. So the\n * near-zero-FP bar (SPEC-0000 R3) is existential — and until now, unmeasured. This turns it\n * into a number: run the detectors over a hand-labeled corpus, compare what fired to the\n * ground truth, and compute precision/recall/F1.\n *\n * It is **dev/CI tooling, not the product path**: it adds no detector, calls no model (R1),\n * and renders no verdict about any code (R2) — it measures *detector fidelity*. The unit of\n * scoring is (session × merge-surface category): each fixture's ground truth and the\n * detectors' output are both sets of {@link CHECK_CATALOG} keys (advisory cost/loop findings\n * are out of scope by construction — they aren't in the catalog).\n */\n\n/** A finding, reduced to the one field the harness needs. */\nexport interface ScorableFinding {\n  id: string;\n}\n\n/** The merge-surface category keys a finding set fired (reusing the existing taxonomy). */\nexport function firedCategories(findings: readonly ScorableFinding[]): Set<string> {\n  const keys = new Set<string>();\n  for (const f of findings) {\n    const c = checkForId(f.id);\n    if (c) {\n      keys.add(c.key);\n    }\n  }\n  return keys;\n}\n\n/**\n * The categories the curated corpus scores precision/recall over: the **deterministic\n * STATEMENT detectors** whose near-zero-FP we guarantee (SPEC-0000 R3). The heuristic,\n * confidence-weighted \"QUESTION\" detectors (blind/unverified edits, duplication, unfulfilled\n * promises, swallowed errors, stubbed impls — see `findings.ts`) need full-session context to\n * be meaningful and fire as artifacts on minimal single-behavior fixtures, so they are out of\n * the curated precision claim. The field scan (`receipts eval`) exercises them over real\n * sessions, where they belong.\n */\nexport const SCORED_CATEGORIES: ReadonlySet<string> = new Set([\n  \"destructive\",\n  \"git-history\",\n  \"secrets\",\n  \"cicd\",\n  \"lockfile\",\n  \"tests\",\n  \"weakening\",\n  \"injection\",\n  \"trojan\",\n  \"malformed\",\n  \"truncated\",\n  \"tool-calls\",\n]);\n\n/** Restrict a set of category keys to the scored (deterministic) scope. */\nexport function scoped(keys: Iterable<string>): string[] {\n  return [...keys].filter((k) => SCORED_CATEGORIES.has(k));\n}\n\n/** One labeled corpus row: a fixture and the categories that *should* fire ([] = clean). */\nexport interface CorpusEntry {\n  fixture: string;\n  /** merge-surface category keys (CHECK_CATALOG) expected to fire; empty ⇒ clean session */\n  expect: string[];\n  /** adapter to load the fixture through (default claude-code) */\n  source?: AgentSource;\n  /** why this fixture is labeled this way (kept honest, human-readable) */\n  note?: string;\n}\n\n/** The per-entry input to scoring: expected vs. actually-fired category keys. */\nexport interface ScoredEntry {\n  fixture: string;\n  expected: string[];\n  fired: string[];\n  /** fired but not expected — the false positives that erode trust */\n  fp: string[];\n  /** expected but not fired — the misses */\n  fn: string[];\n}\n\nexport interface CategoryMetric {\n  key: string;\n  label: string;\n  tp: number;\n  fp: number;\n  fn: number;\n  precision: number;\n  recall: number;\n  f1: number;\n}\n\nexport interface EvalMetrics {\n  entries: number;\n  tp: number;\n  fp: number;\n  fn: number;\n  precision: number;\n  recall: number;\n  f1: number;\n  perCategory: CategoryMetric[];\n  details: ScoredEntry[];\n}\n\n/** Precision/recall with an empty denominator = 1 (firing nothing on a clean session is\n * perfect, not undefined; missing nothing is perfect recall). */\nconst ratio = (num: number, denom: number): number => (denom === 0 ? 1 : num / denom);\nconst f1Of = (p: number, r: number): number => (p + r === 0 ? 0 : (2 * p * r) / (p + r));\n\n/**\n * Score a corpus run into a confusion matrix at (session × category) granularity. Pure: the\n * caller is responsible for loading fixtures and deriving findings; this only does the math,\n * so it is unit-testable without any I/O.\n */\nexport function scoreCorpus(\n  results: readonly { fixture: string; expected: readonly string[]; fired: ReadonlySet<string> }[],\n): EvalMetrics {\n  const label = new Map(CHECK_CATALOG.map((c) => [c.key, c.label] as const));\n  const cat = new Map<string, { tp: number; fp: number; fn: number }>();\n  const bump = (key: string, field: \"tp\" | \"fp\" | \"fn\") => {\n    const row = cat.get(key) ?? { tp: 0, fp: 0, fn: 0 };\n    row[field]++;\n    cat.set(key, row);\n  };\n\n  let tp = 0;\n  let fp = 0;\n  let fn = 0;\n  const details: ScoredEntry[] = [];\n\n  for (const r of results) {\n    const expected = new Set(r.expected);\n    const fpKeys: string[] = [];\n    const fnKeys: string[] = [];\n    for (const key of r.fired) {\n      if (expected.has(key)) {\n        tp++;\n        bump(key, \"tp\");\n      } else {\n        fp++;\n        fpKeys.push(key);\n        bump(key, \"fp\");\n      }\n    }\n    for (const key of expected) {\n      if (!r.fired.has(key)) {\n        fn++;\n        fnKeys.push(key);\n        bump(key, \"fn\");\n      }\n    }\n    details.push({\n      fixture: r.fixture,\n      expected: [...expected],\n      fired: [...r.fired],\n      fp: fpKeys,\n      fn: fnKeys,\n    });\n  }\n\n  const perCategory: CategoryMetric[] = [...cat.entries()]\n    .map(([key, v]) => {\n      const precision = ratio(v.tp, v.tp + v.fp);\n      const recall = ratio(v.tp, v.tp + v.fn);\n      return {\n        key,\n        label: label.get(key) ?? key,\n        ...v,\n        precision,\n        recall,\n        f1: f1Of(precision, recall),\n      };\n    })\n    .sort((a, b) => b.tp + b.fn - (a.tp + a.fn) || a.label.localeCompare(b.label));\n\n  const precision = ratio(tp, tp + fp);\n  const recall = ratio(tp, tp + fn);\n  return {\n    entries: results.length,\n    tp,\n    fp,\n    fn,\n    precision,\n    recall,\n    f1: f1Of(precision, recall),\n    perCategory,\n    details,\n  };\n}\n\nconst pct = (n: number): string => `${(100 * n).toFixed(1)}%`;\n\n/** Render the corpus confusion matrix as facts-only text (the trust artifact). */\nexport function renderEval(m: EvalMetrics): string {\n  const out: string[] = [];\n  out.push(`Receipts detector eval — ${m.entries} labeled session${m.entries === 1 ? \"\" : \"s\"}`);\n  out.push(\"\");\n  out.push(\n    `Precision ${pct(m.precision)} · Recall ${pct(m.recall)} · F1 ${pct(m.f1)}  (TP ${m.tp} · FP ${m.fp} · FN ${m.fn})`,\n  );\n  out.push(\"\");\n  if (m.perCategory.length) {\n    out.push(\"By category:\");\n    for (const c of m.perCategory) {\n      out.push(\n        `  ${c.label.padEnd(26)} P ${pct(c.precision).padStart(6)} R ${pct(c.recall).padStart(6)}  (tp ${c.tp} fp ${c.fp} fn ${c.fn})`,\n      );\n    }\n  }\n  const fps = m.details.filter((d) => d.fp.length);\n  const fns = m.details.filter((d) => d.fn.length);\n  if (fps.length) {\n    out.push(\"\", \"False positives (fired but should be clean):\");\n    for (const d of fps) out.push(`  ${d.fixture}: ${d.fp.join(\", \")}`);\n  }\n  if (fns.length) {\n    out.push(\"\", \"Misses (expected but did not fire):\");\n    for (const d of fns) out.push(`  ${d.fixture}: ${d.fn.join(\", \")}`);\n  }\n  out.push(\"\", \"Deterministic · 0 model calls · measures detector fidelity, not code quality.\");\n  return `${out.join(\"\\n\")}\\n`;\n}\n\n/** One real session's contribution to the field scan. */\nexport interface FieldRow {\n  title: string;\n  categories: string[];\n}\n\nexport interface FieldScan {\n  scanned: number;\n  flagged: number;\n  byCategory: { key: string; label: string; sessions: number }[];\n  rows: FieldRow[];\n}\n\n/** Aggregate a field scan over real local sessions: how often the work-account flags real\n * work, by category. A rate the human interprets — never a verdict (a flag may be a true\n * finding or an FP). */\nexport function summarizeFieldScan(rows: readonly FieldRow[]): FieldScan {\n  const label = new Map(CHECK_CATALOG.map((c) => [c.key, c.label] as const));\n  const cat = new Map<string, number>();\n  let flagged = 0;\n  for (const r of rows) {\n    if (r.categories.length) {\n      flagged++;\n    }\n    for (const key of new Set(r.categories)) {\n      cat.set(key, (cat.get(key) ?? 0) + 1);\n    }\n  }\n  const byCategory = [...cat.entries()]\n    .map(([key, sessions]) => ({ key, label: label.get(key) ?? key, sessions }))\n    .sort((a, b) => b.sessions - a.sessions || a.label.localeCompare(b.label));\n  return { scanned: rows.length, flagged, byCategory, rows: [...rows] };\n}\n\n/** Render the field scan as facts-only text. */\nexport function renderFieldScan(s: FieldScan): string {\n  if (s.scanned === 0) {\n    return \"No local agent sessions found to scan.\\n\";\n  }\n  const out: string[] = [];\n  out.push(`Receipts field scan — ${s.scanned} real local session${s.scanned === 1 ? \"\" : \"s\"}`);\n  out.push(\"\");\n  const rate = Math.round((100 * s.flagged) / s.scanned);\n  out.push(`Flagged: ${s.flagged}/${s.scanned} sessions (${rate}%) carried ≥1 merge-surface flag`);\n  out.push(\"\");\n  if (s.byCategory.length === 0) {\n    out.push(\"No merge-surface category fired on any scanned session.\");\n  } else {\n    out.push(\"By category (sessions flagged):\");\n    for (const c of s.byCategory) {\n      out.push(`  ${c.label.padEnd(26)} ${c.sessions}`);\n    }\n  }\n  out.push(\n    \"\",\n    \"A flag may be a true finding or a false positive — this is a flag rate you interpret,\",\n    \"not a verdict. Deterministic · 0 model calls · reads only local sessions.\",\n  );\n  return `${out.join(\"\\n\")}\\n`;\n}\n","import { readFileSync, readdirSync } from \"node:fs\";\nimport { basename, dirname, join } from \"node:path\";\nimport type { Severity } from \"../findings/findings.js\";\nimport { formatCostAlways } from \"../findings/format.js\";\nimport type { GradeLetter } from \"../findings/grade.js\";\nimport { verifyBundle } from \"../sign/verify.js\";\nimport { listAckedSlugs } from \"./ack.js\";\nimport { listReceiptRefs, readReceiptRef } from \"./store.js\";\n\n/**\n * `receipts fleet` (M77) — the local, cross-repo / cross-agent ROLLUP over the receipts\n * a team already has (`.receipts/*.json` + `refs/receipts/*`). It answers the org\n * question the per-repo `stats` can't: *across all our repos and every coding agent,\n * what did the agents spend, how much of the changes did their transcripts cover, and\n * what did Receipts flag?* A local, per-repo × per-agent rollup over the receipts a\n * team already has — no server, no upload.\n *\n * Deterministic · zero model calls · **local-first** (reads only refs the user already\n * owns; no network egress, nothing uploaded) · **counts, never a verdict** (R1/R2/R4).\n * It is a queryable VIEW, not a tamper-evidence layer — the signing/immutability moat\n * stays explicitly unbuilt and unclaimed here.\n *\n * The rollup is a lossless deterministic reduction of the same per-receipt fields the\n * per-repo surfaces read, so `fleet`'s totals sum-reconcile with `stats`/`--json` over\n * the same refs — that reconciliation is the value-gate the e2e proves.\n */\n\nconst NON_RECEIPT = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\nconst SEV_RANK: Record<Severity, number> = { critical: 0, high: 1, medium: 2, low: 3 };\n\n/** One validated receipt, flattened to the fields the rollup reduces. */\nexport interface FleetReceipt {\n  repo: string;\n  agent: string;\n  /** this change's attributed cost (diff-scoped upper bound), else the session cost */\n  costUsd: number;\n  grade: GradeLetter;\n  findings: number;\n  /** flagged-event counts by severity */\n  bySeverity: Record<Severity, number>;\n  /** files the transcript covered, and the change's file count (coverage numerator/denominator) */\n  covered?: number;\n  changed?: number;\n  endedAt?: number;\n  /** has >=1 attributed ack (a human reviewed it) — M78 */\n  reviewed?: boolean;\n}\n\nexport interface AgentRollup {\n  agent: string;\n  receipts: number;\n  reviewed: number;\n  costUsd: number;\n  findings: number;\n  bySeverity: Record<Severity, number>;\n  covered: number;\n  changed: number;\n}\n\nexport interface RepoRollup {\n  repo: string;\n  receipts: number;\n  reviewed: number;\n  costUsd: number;\n  findings: number;\n  bySeverity: Record<Severity, number>;\n  covered: number;\n  changed: number;\n  agents: string[];\n}\n\nexport interface Fleet {\n  repos: RepoRollup[];\n  agents: AgentRollup[];\n  totals: {\n    repos: number;\n    receipts: number;\n    reviewed: number;\n    costUsd: number;\n    findings: number;\n    bySeverity: Record<Severity, number>;\n    /** Σ covered / Σ changed across every diff-scoped receipt, or null when none carry coverage */\n    coverage: number | null;\n  };\n}\n\nconst zeroSev = (): Record<Severity, number> => ({ critical: 0, high: 0, medium: 0, low: 0 });\n\n/** Load + validate every receipt under one repo working dir (`.receipts/*.json` AND\n * `refs/receipts/*`), flattened. Mirrors `loadReceiptHistory`'s source-merge so `fleet`\n * sees exactly what `log`/`stats` see — no more, no less. A missing/empty repo yields\n * `[]` (it contributes zero, never throws). */\nexport function loadRepoReceipts(repoDir: string): FleetReceipt[] {\n  const label = basename(repoDir.replace(/\\/$/, \"\")) || repoDir;\n  const dir = join(repoDir, \".receipts\");\n  const repoCwd = dirname(dir);\n  const acked = listAckedSlugs(repoCwd);\n  const sources: Array<{ raw: string | null; slug: string }> = [];\n  try {\n    for (const f of readdirSync(dir)) {\n      if (!f.endsWith(\".json\") || NON_RECEIPT.test(f)) continue;\n      const slug = f.replace(/\\.json$/i, \"\");\n      try {\n        sources.push({ raw: readFileSync(join(dir, f), \"utf8\"), slug });\n      } catch {\n        sources.push({ raw: null, slug });\n      }\n    }\n  } catch {\n    // no .receipts dir — fine, ref-mode repos keep everything in refs\n  }\n  // refs are listed relative to the repo working dir (the `.receipts` dir's parent)\n  for (const { slug } of listReceiptRefs(repoCwd)) {\n    sources.push({ raw: readReceiptRef(slug, repoCwd), slug });\n  }\n\n  const out: FleetReceipt[] = [];\n  for (const { raw, slug } of sources) {\n    if (raw == null) continue;\n    let input: unknown;\n    try {\n      input = JSON.parse(raw);\n    } catch {\n      continue;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) continue;\n    const p = res.receipt.predicate;\n    const findings = p.findings ?? [];\n    const bySeverity = zeroSev();\n    for (const f of findings) {\n      bySeverity[f.severity]++;\n    }\n    const scopeFiles = p.scope?.kind === \"diff\" ? (p.scope.files?.length ?? 0) : undefined;\n    out.push({\n      repo: label,\n      agent: p.session?.agent || \"unknown\",\n      // same basis as `log`: the change's cost when scoped, else the session total\n      costUsd: p.evidence.diffCostUsd ?? p.evidence.costUsd,\n      grade: p.grade,\n      findings: findings.length,\n      bySeverity,\n      covered: p.evidence.coveredFiles,\n      changed: scopeFiles,\n      endedAt: p.session?.endedAt,\n      reviewed: acked.has(slug),\n    });\n  }\n  return out;\n}\n\nconst round2 = (n: number): number => Math.round(n * 100) / 100;\nconst topSeverity = (s: Record<Severity, number>): Severity | undefined =>\n  ([\"critical\", \"high\", \"medium\", \"low\"] as const).find((k) => s[k] > 0);\n\n/** Reduce a flat receipt list into the per-repo × per-agent fleet rollup. Pure. */\nexport function computeFleet(receipts: readonly FleetReceipt[]): Fleet {\n  const repoMap = new Map<string, RepoRollup>();\n  const agentMap = new Map<string, AgentRollup>();\n  const tSev = zeroSev();\n  let tCost = 0;\n  let tFind = 0;\n  let tCovered = 0;\n  let tChanged = 0;\n  let tReviewed = 0;\n\n  const addSev = (dst: Record<Severity, number>, src: Record<Severity, number>) => {\n    for (const k of Object.keys(src) as Severity[]) dst[k] += src[k];\n  };\n\n  for (const r of receipts) {\n    let repo = repoMap.get(r.repo);\n    if (!repo) {\n      repo = {\n        repo: r.repo,\n        receipts: 0,\n        reviewed: 0,\n        costUsd: 0,\n        findings: 0,\n        bySeverity: zeroSev(),\n        covered: 0,\n        changed: 0,\n        agents: [],\n      };\n      repoMap.set(r.repo, repo);\n    }\n    let agent = agentMap.get(r.agent);\n    if (!agent) {\n      agent = {\n        agent: r.agent,\n        receipts: 0,\n        reviewed: 0,\n        costUsd: 0,\n        findings: 0,\n        bySeverity: zeroSev(),\n        covered: 0,\n        changed: 0,\n      };\n      agentMap.set(r.agent, agent);\n    }\n    repo.receipts++;\n    if (r.reviewed) repo.reviewed++;\n    repo.costUsd += r.costUsd;\n    repo.findings += r.findings;\n    addSev(repo.bySeverity, r.bySeverity);\n    if (!repo.agents.includes(r.agent)) repo.agents.push(r.agent);\n    agent.receipts++;\n    if (r.reviewed) agent.reviewed++;\n    agent.costUsd += r.costUsd;\n    agent.findings += r.findings;\n    addSev(agent.bySeverity, r.bySeverity);\n    tCost += r.costUsd;\n    if (r.reviewed) tReviewed++;\n    tFind += r.findings;\n    addSev(tSev, r.bySeverity);\n    // coverage only sums over receipts that carry it (diff-scoped)\n    if (r.covered != null && r.changed != null) {\n      repo.covered += r.covered;\n      repo.changed += r.changed;\n      agent.covered += r.covered;\n      agent.changed += r.changed;\n      tCovered += r.covered;\n      tChanged += r.changed;\n    }\n  }\n\n  const finishRepo = (x: RepoRollup): RepoRollup => ({ ...x, costUsd: round2(x.costUsd) });\n  const finishAgent = (x: AgentRollup): AgentRollup => ({ ...x, costUsd: round2(x.costUsd) });\n  const repos = [...repoMap.values()].map(finishRepo).sort((a, b) => b.costUsd - a.costUsd);\n  const agents = [...agentMap.values()].map(finishAgent).sort((a, b) => b.costUsd - a.costUsd);\n\n  return {\n    repos,\n    agents,\n    totals: {\n      repos: repos.length,\n      receipts: receipts.length,\n      reviewed: tReviewed,\n      costUsd: round2(tCost),\n      findings: tFind,\n      bySeverity: tSev,\n      coverage: tChanged > 0 ? round2(tCovered / tChanged) : null,\n    },\n  };\n}\n\n/** Load N repo working dirs and roll them up. The org entry point. */\nexport function computeFleetFromRepos(repoDirs: readonly string[]): Fleet {\n  const all: FleetReceipt[] = [];\n  for (const d of repoDirs) all.push(...loadRepoReceipts(d));\n  return computeFleet(all);\n}\n\nconst sevChip = (s: Record<Severity, number>): string => {\n  const parts: string[] = [];\n  if (s.critical) parts.push(`${s.critical}⛔`);\n  if (s.high) parts.push(`${s.high}⚠️`);\n  if (s.medium) parts.push(`${s.medium}🔍`);\n  if (s.low) parts.push(`${s.low}·`);\n  return parts.join(\" \") || \"—\";\n};\nconst covCell = (covered: number, changed: number): string =>\n  changed > 0 ? `${Math.round((covered / changed) * 100)}%` : \"—\";\n\n/** Aligned text table — facts only, no verdict. */\nexport function renderFleet(f: Fleet): string {\n  if (f.totals.receipts === 0) {\n    return \"No receipts found across the given repos (looked in .receipts/ and refs/receipts/*).\\n\";\n  }\n  const lines: string[] = [];\n  lines.push(\n    `Fleet — ${f.totals.receipts} receipt${f.totals.receipts === 1 ? \"\" : \"s\"} across ${f.totals.repos} repo${f.totals.repos === 1 ? \"\" : \"s\"} · ${f.agents.length} agent${f.agents.length === 1 ? \"\" : \"s\"}`,\n  );\n  lines.push(\"\");\n  const cov = f.totals.coverage == null ? \"—\" : `${Math.round(f.totals.coverage * 100)}%`;\n  lines.push(\n    `Total agent spend ${formatCostAlways(f.totals.costUsd)} · coverage ${cov} · ${f.totals.findings} flagged event${f.totals.findings === 1 ? \"\" : \"s\"} (${sevChip(f.totals.bySeverity)})`,\n  );\n  lines.push(\n    `Human review: ${f.totals.reviewed}/${f.totals.receipts} receipt${f.totals.receipts === 1 ? \"\" : \"s\"} acknowledged`,\n  );\n  lines.push(\"\");\n\n  const rrows = f.repos.map((r) => ({\n    repo: r.repo,\n    n: String(r.receipts),\n    agents: r.agents.join(\", \"),\n    cost: formatCostAlways(r.costUsd),\n    cov: covCell(r.covered, r.changed),\n    flagged:\n      r.findings === 0\n        ? \"0\"\n        : `${r.findings} ${topSeverity(r.bySeverity) ? sevChip(r.bySeverity) : \"\"}`.trim(),\n  }));\n  const w = (key: keyof (typeof rrows)[number], head: string) =>\n    Math.max(head.length, ...rrows.map((r) => r[key].length));\n  const wR = w(\"repo\", \"REPO\");\n  const wN = w(\"n\", \"N\");\n  const wA = w(\"agents\", \"AGENTS\");\n  const wC = w(\"cost\", \"SPEND\");\n  const wV = w(\"cov\", \"COVER\");\n  lines.push(\n    `${\"REPO\".padEnd(wR)}  ${\"N\".padEnd(wN)}  ${\"AGENTS\".padEnd(wA)}  ${\"SPEND\".padEnd(wC)}  ${\"COVER\".padEnd(wV)}  FLAGGED`,\n  );\n  for (const r of rrows) {\n    lines.push(\n      `${r.repo.padEnd(wR)}  ${r.n.padEnd(wN)}  ${r.agents.padEnd(wA)}  ${r.cost.padEnd(wC)}  ${r.cov.padEnd(wV)}  ${r.flagged}`,\n    );\n  }\n  lines.push(\"\");\n  lines.push(\"By agent:\");\n  for (const a of f.agents) {\n    lines.push(\n      `  ${a.agent} — ${a.receipts} receipt${a.receipts === 1 ? \"\" : \"s\"} · ${formatCostAlways(a.costUsd)} · cover ${covCell(a.covered, a.changed)} · ${a.findings} flagged`,\n    );\n  }\n  lines.push(\"\");\n  lines.push(\n    \"<spend = each change's attributed cost (diff-scoped where available) · coverage = Σ transcript-covered files / Σ changed files · counts, not a verdict · 0 model calls · local-only>\",\n  );\n  return `${lines.join(\"\\n\")}\\n`;\n}\n","import { readFileSync, readdirSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport type { Severity } from \"../findings/findings.js\";\nimport { formatCostAlways } from \"../findings/format.js\";\nimport type { GradeLetter } from \"../findings/grade.js\";\nimport { verifyBundle } from \"../sign/verify.js\";\nimport { listReceiptRefs, readReceiptRef } from \"./store.js\";\n\n/**\n * `receipts log` (M52) — a chronological list of the committed receipts in `.receipts/`\n * (one line per receipt: date, grade, change-cost, finding count + top severity, scope,\n * name). The `git log` of receipts: the local, history-aware companion to `receipts diff`\n * (which compares two) and `receipts trends` (which aggregates sessions). It reads the\n * COMMITTED receipts, not live sessions, so it answers \"what receipts have we attached,\n * and what do they say?\" — a view nothing else provides.\n *\n * Deterministic · zero model calls · local-first · lists recorded facts (each receipt's\n * own grade/cost/findings), never a synthesized judgement.\n */\n\nconst SEV_ICON: Record<Severity, string> = { critical: \"⛔\", high: \"⚠️\", medium: \"🔍\", low: \"·\" };\nconst SEV_RANK: Record<Severity, number> = { critical: 0, high: 1, medium: 2, low: 3 };\n\nexport interface LogEntry {\n  name: string;\n  grade: GradeLetter;\n  costUsd: number;\n  findings: number;\n  topSeverity?: Severity;\n  scope: string;\n  endedAt?: number;\n}\n\n/** Files in `.receipts/` that are config/examples, not receipts. */\nconst NON_RECEIPT = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\n\nfunction scopeLabel(\n  scope: { kind: string; files?: string[]; branch?: string } | undefined,\n): string {\n  if (!scope || scope.kind === \"session\") return \"session\";\n  if (scope.kind === \"branch\") return `branch ${scope.branch ?? \"?\"}`;\n  return `diff ${(scope.files ?? []).length}f`;\n}\n\nfunction isoDate(ms: number | undefined): string {\n  if (!ms || !Number.isFinite(ms)) return \"—\".padEnd(10);\n  return new Date(ms).toISOString().slice(0, 10);\n}\n\n/** Load and validate the committed receipts under `dir` — plus, since SPEC-0070,\n * any `refs/receipts/*` ref-stored receipts — most-recent first. */\nexport function loadReceiptHistory(dir: string): LogEntry[] {\n  let files: string[];\n  try {\n    files = readdirSync(dir).filter((f) => f.endsWith(\".json\") && !NON_RECEIPT.test(f));\n  } catch {\n    files = [];\n  }\n  const sources: Array<{ name: string; raw: string | null }> = files.map((f) => {\n    try {\n      return { name: f, raw: readFileSync(join(dir, f), \"utf8\") };\n    } catch {\n      return { name: f, raw: null };\n    }\n  });\n  // Refs are listed relative to the receipts dir's repo (its parent), never the\n  // process cwd — a log over some other directory must not see this repo's refs.\n  const repo = dirname(dir);\n  for (const { slug } of listReceiptRefs(repo)) {\n    sources.push({ name: `${slug}@ref`, raw: readReceiptRef(slug, repo) });\n  }\n  const entries: LogEntry[] = [];\n  for (const { name: f, raw } of sources) {\n    if (raw == null) {\n      continue;\n    }\n    let input: unknown;\n    try {\n      input = JSON.parse(raw);\n    } catch {\n      continue;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) continue;\n    const p = res.receipt.predicate;\n    const fs = p.findings ?? [];\n    let topSeverity: Severity | undefined;\n    for (const x of fs) {\n      if (!topSeverity || SEV_RANK[x.severity] < SEV_RANK[topSeverity]) topSeverity = x.severity;\n    }\n    entries.push({\n      name: f.replace(/\\.json$/i, \"\"),\n      grade: p.grade,\n      costUsd: p.evidence.diffCostUsd ?? p.evidence.costUsd,\n      findings: fs.length,\n      topSeverity,\n      scope: scopeLabel(p.scope),\n      endedAt: p.session?.endedAt,\n    });\n  }\n  // most-recent first; receipts without a timestamp sort last (by name, stable)\n  entries.sort((a, b) => (b.endedAt ?? 0) - (a.endedAt ?? 0) || a.name.localeCompare(b.name));\n  return entries;\n}\n\n/** Render the history as an aligned text table (most-recent first). Facts only. */\nexport function renderLog(entries: readonly LogEntry[], total = entries.length): string {\n  if (!entries.length) return \"No committed receipts found in .receipts/.\\n\";\n  const rows = entries.map((e) => {\n    const findings =\n      e.findings === 0\n        ? \"0\"\n        : `${e.findings} ${e.topSeverity ? SEV_ICON[e.topSeverity] : \"\"}`.trim();\n    return {\n      date: isoDate(e.endedAt),\n      grade: e.grade,\n      cost: formatCostAlways(e.costUsd),\n      findings,\n      scope: e.scope,\n      name: e.name,\n    };\n  });\n  const w = (key: keyof (typeof rows)[number], head: string) =>\n    Math.max(head.length, ...rows.map((r) => r[key].length));\n  const wDate = w(\"date\", \"DATE\");\n  const wGrade = Math.max(5, ...rows.map((r) => r.grade.length));\n  const wCost = w(\"cost\", \"COST\");\n  const wFind = w(\"findings\", \"FINDINGS\");\n  const wScope = w(\"scope\", \"SCOPE\");\n  const head = `${\"DATE\".padEnd(wDate)}  ${\"GRADE\".padEnd(wGrade)}  ${\"COST\".padEnd(wCost)}  ${\"FINDINGS\".padEnd(wFind)}  ${\"SCOPE\".padEnd(wScope)}  RECEIPT`;\n  const lines = rows.map(\n    (r) =>\n      `${r.date.padEnd(wDate)}  ${r.grade.padEnd(wGrade)}  ${r.cost.padEnd(wCost)}  ${r.findings.padEnd(wFind)}  ${r.scope.padEnd(wScope)}  ${r.name}`,\n  );\n  const header = `Receipt history — .receipts/ (${total} receipt${total === 1 ? \"\" : \"s\"}${entries.length < total ? `, showing ${entries.length}` : \"\"})`;\n  return `${header}\\n\\n${head}\\n${lines.join(\"\\n\")}\\n\\n<cost = this change's cost (diff-scoped where available) · grade is each receipt's own recorded grade · evidence, not judgement>\\n`;\n}\n","/**\n * `receipts prune` (M65b / SPEC-0064 \"ephemeral\") — the committed-receipt clutter reducer.\n *\n * A receipt is a per-branch PR artifact: CI reads/signs/comments it during the PR. After the\n * branch merges (and is deleted), the committed `.receipts/<branch>.json` is dead weight that\n * accumulates on the trunk forever (the PR comment + attestation are the durable record). This\n * removes receipts whose branch no longer exists, keeping live-branch receipts and the\n * non-branch example files. Pure planning here; the CLI does the git/fs + the live-branch read.\n */\n\n/** Example/config files in `.receipts/` that are never branch receipts — always kept. */\nconst PROTECTED = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\n\n/** The committed-receipt filename slug for a branch (matches `receipts pr`'s naming). */\nexport function branchSlug(branch: string): string {\n  return branch.replace(/[/\\\\]/g, \"-\");\n}\n\nexport interface PrunePlan {\n  keep: string[];\n  remove: string[];\n}\n\n/**\n * Partition receipt files into keep/remove: keep the protected example files and any whose slug\n * belongs to a live branch; remove the rest (merged/deleted branches). Pure — `liveSlugs` is the\n * set of `branchSlug(branch)` for branches that still exist (resolved by the caller from git).\n */\nexport function planPrune(files: readonly string[], liveSlugs: ReadonlySet<string>): PrunePlan {\n  const keep: string[] = [];\n  const remove: string[] = [];\n  for (const f of files) {\n    const base = f.split(\"/\").pop() ?? f;\n    const slug = base.replace(/\\.json$/i, \"\");\n    if (PROTECTED.test(base) || liveSlugs.has(slug)) {\n      keep.push(f);\n    } else {\n      remove.push(f);\n    }\n  }\n  return { keep, remove };\n}\n","import { readFileSync, readdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { GradeLetter } from \"../findings/grade.js\";\nimport { verifyBundle } from \"../sign/verify.js\";\nimport { checkForId } from \"./checks.js\";\n\n/**\n * `receipts stats` (M53) — a dogfooding scoreboard over the committed receipts in\n * `.receipts/`. Answers the two questions a pilot owner asks: **how often did Receipts\n * run, and what did it catch?** It aggregates the receipts the tool already wrote — how\n * many, the grade distribution, the flagged rate, and findings rolled up **by check\n * category** (which agent-failure modes actually show up here, ranked). Pure read + count\n * over local JSON; deterministic, zero model calls. It reports counts, never a verdict.\n *\n * This is the local measurement surface; an org-wide rollup (across repos) is a thin\n * scheduled job on top of the same per-repo numbers.\n */\n\nconst NON_RECEIPT = /(?:^|\\/)(?:asserts(?:\\.example)?|sample)\\.json$/i;\n\nexport interface ReceiptStats {\n  /** how many valid committed receipts (≈ how many PRs Receipts ran on) */\n  receipts: number;\n  /** files in the dir that weren't valid receipts (skipped) */\n  skipped: number;\n  /** receipts with ≥1 finding */\n  flagged: number;\n  /** A/B/C/F counts */\n  grades: Record<GradeLetter, number>;\n  /** finding count rolled up by check category, ranked desc; label is human-readable */\n  byCategory: { key: string; icon: string; label: string; findings: number; receipts: number }[];\n  /** total findings across all receipts */\n  totalFindings: number;\n}\n\n/** Aggregate the committed receipts under `dir` into a dogfooding scoreboard. */\nexport function computeStats(dir: string): ReceiptStats {\n  let files: string[];\n  try {\n    files = readdirSync(dir).filter((f) => f.endsWith(\".json\") && !NON_RECEIPT.test(f));\n  } catch {\n    files = [];\n  }\n  const grades: Record<GradeLetter, number> = { A: 0, B: 0, C: 0, F: 0 };\n  const cat = new Map<\n    string,\n    { icon: string; label: string; findings: number; receipts: number }\n  >();\n  let receipts = 0;\n  let skipped = 0;\n  let flagged = 0;\n  let totalFindings = 0;\n\n  for (const f of files) {\n    let input: unknown;\n    try {\n      input = JSON.parse(readFileSync(join(dir, f), \"utf8\"));\n    } catch {\n      skipped++;\n      continue;\n    }\n    const res = verifyBundle(input);\n    if (!res.ok || !res.receipt) {\n      skipped++;\n      continue;\n    }\n    receipts++;\n    const p = res.receipt.predicate;\n    grades[p.grade] = (grades[p.grade] ?? 0) + 1;\n    const findings = p.findings ?? [];\n    if (findings.length) flagged++;\n    totalFindings += findings.length;\n    // which categories this receipt touched (count receipts once per category)\n    const seen = new Set<string>();\n    for (const finding of findings) {\n      const c = checkForId(finding.id);\n      if (!c) continue;\n      const row = cat.get(c.key) ?? { icon: c.icon, label: c.label, findings: 0, receipts: 0 };\n      row.findings++;\n      if (!seen.has(c.key)) {\n        row.receipts++;\n        seen.add(c.key);\n      }\n      cat.set(c.key, row);\n    }\n  }\n\n  const byCategory = [...cat.entries()]\n    .map(([key, v]) => ({ key, ...v }))\n    .sort((a, b) => b.findings - a.findings || a.label.localeCompare(b.label));\n\n  return { receipts, skipped, flagged, grades, byCategory, totalFindings };\n}\n\n/** Render the scoreboard as plain text. Facts only. */\nexport function renderStats(s: ReceiptStats): string {\n  if (s.receipts === 0) return \"No committed receipts found in .receipts/.\\n\";\n  const out: string[] = [];\n  out.push(\n    `Receipts scoreboard — ${s.receipts} receipt${s.receipts === 1 ? \"\" : \"s\"} in .receipts/`,\n  );\n  out.push(\"\");\n  const pct = (n: number) => `${Math.round((100 * n) / s.receipts)}%`;\n  out.push(\n    `Grades: 🟢 A ${s.grades.A} · 🟡 B ${s.grades.B} · 🟠 C ${s.grades.C} · 🔴 F ${s.grades.F}`,\n  );\n  out.push(`Flagged: ${s.flagged}/${s.receipts} receipts (${pct(s.flagged)}) carried ≥1 finding`);\n  out.push(\"\");\n  if (s.byCategory.length === 0) {\n    out.push(\"Problems caught: none — every committed receipt was clean.\");\n  } else {\n    out.push(\n      `Problems caught (${s.totalFindings} findings across ${s.byCategory.length} categories):`,\n    );\n    for (const c of s.byCategory) {\n      out.push(\n        `  ${c.icon} ${c.label.padEnd(26)} ${c.findings} finding${c.findings === 1 ? \"\" : \"s\"} in ${c.receipts} receipt${c.receipts === 1 ? \"\" : \"s\"}`,\n      );\n    }\n  }\n  if (s.skipped) {\n    out.push(\"\", `<${s.skipped} non-receipt/invalid file${s.skipped === 1 ? \"\" : \"s\"} skipped>`);\n  }\n  out.push(\"\", \"Deterministic · 0 model calls · counts of recorded receipts, not a verdict.\");\n  return `${out.join(\"\\n\")}\\n`;\n}\n","import type { AssertResult } from \"../receipt/assert.js\";\nimport type { ReceiptPredicate } from \"../receipt/build.js\";\nimport { CHECK_CATALOG } from \"./checks.js\";\n\n/**\n * Work-verdict policy layer (SPEC-0121) — turn the BUNDLE of already-attested facts into one\n * answer to \"is this work done and right?\": VERIFIED / INCOMPLETE / WRONG / ESCALATE (+ the\n * default-off UNJUDGED sentinel).\n *\n * This is the union of two SHIPPED out-of-receipt gates — `block-on` (a finding-id fact-gate,\n * verified-by.mjs `decideConclusion`) and `.receipts/asserts.json` (`assertExitCode`). It is a\n * PURE, total function of `(predicate, policy)`: zero model calls, no transcript re-parse, no\n * network. It does NOT mutate the receipt, emit a finding, or appear in any exporter (R2 — the\n * verdict is a *policy decision over cited facts*, computed OUTSIDE the determinism wall, never a\n * fact written into the signed evidence). Each verdict carries `reasons[]` that cite real\n * `finding.id`/`filePath` or `evidence.testMetrics`, never a free-text quality opinion.\n *\n * Weighting (R5): WRONG > INCOMPLETE > ESCALATE > VERIFIED. A cited blockable/tamper fact\n * dominates; absent that, an incompleteness signal; absent that, a judgement-required signal;\n * only a fully-cleared board verifies. Ambiguity resolves UPWARD in safety (never a false\n * WRONG/INCOMPLETE) — the under-claim discipline (R3).\n */\n\nexport type Verdict = \"VERIFIED\" | \"INCOMPLETE\" | \"WRONG\" | \"ESCALATE\" | \"UNJUDGED\";\n\nexport interface VerdictReason {\n  axis: \"completion\" | \"correctness\" | \"claim-truth\" | \"integrity\";\n  /** a cited fact: a finding id (+ filePath) or an evidence field — never a quality opinion */\n  fact: string;\n  contributes: Verdict;\n}\n\nexport interface WorkPolicy {\n  /** finding-id prefixes whose main-band presence means WRONG (a cited tamper/blockable fact) */\n  blockable?: string[];\n  /** evaluated asserts (from evaluateAsserts) — a failed ERROR-severity assert ⇒ INCOMPLETE */\n  asserts?: AssertResult[];\n  /** finding-id prefixes whose presence means ESCALATE (judgement required, board else clean) */\n  escalateOn?: string[];\n  /** opt-in: a parsed `testMetrics.exitStatus:\"failed\"` ⇒ WRONG (R7 — off by default) */\n  gateTestOutcome?: boolean;\n}\n\nexport interface WorkVerdict {\n  verdict: Verdict;\n  reasons: VerdictReason[];\n}\n\n/** The verdict layer's OWN default blockable set — INTENTIONALLY broader than\n * verified-by.mjs's BLOCKABLE_PREFIXES (which omits fake-green/green-by-suppression and\n * process.exit(1)s on unknown prefixes). A cited green-faking/tamper fact is the canonical\n * WRONG. Callers can override via `policy.blockable`. */\nexport const DEFAULT_BLOCKABLE: readonly string[] = [\n  \"fake-green\",\n  \"green-by-suppression\",\n  \"eval-override\",\n  \"grader-edit\",\n  \"test-trivialised\",\n  \"test-skipped\",\n  \"test-focus\",\n  \"config-weaken\",\n  \"spec-tamper\",\n  \"hook-bypass\",\n  \"impl-stubbed\",\n  \"masked-failure\",\n  \"external-state-mismatch\",\n];\n\n/** Default judgement-required signals (board deterministically clean, but a human should look). */\nexport const DEFAULT_ESCALATE: readonly string[] = [\n  \"untested-test\",\n  \"blind-edit\",\n  \"weak-oracle\",\n  \"self-tested\",\n  // A large deletion is a content-loss RISK, not a tamper fact — and `workVerdict` matches by\n  // id-prefix only, so it cannot isolate the test-path shrink that `surface.ts` privileges from a\n  // benign dead-code/file removal. Blocking ALL file-shrink would auto-WRONG legitimate deletions\n  // (a false WRONG — the costliest error). ESCALATE is the right tier: a human confirms it\n  // (codex review reversed a prior, over-eager move of this into the blockable set).\n  \"file-shrink\",\n];\n\n/** Main-band completion facts (the agent's own promise/coverage gaps). out-of-scope is LOW\n * confidence (never main-band) so it is excluded automatically. */\nconst COMPLETION_PREFIXES: readonly string[] = [\"unfulfilled-promise\", \"completion-uncovered\"];\n\n/** Every finding-id prefix a `verdict` policy may legitimately reference: the union of all check\n * categories' prefixes plus the verdict layer's own default + completion sets. A user-supplied\n * `blockable`/`escalateOn` entry outside this set is a typo (`flake-green`) or an over-broad\n * string (`test`) that would silently gate nothing — or silently match unintended families — so\n * the caller rejects it and the policy fails closed (codex review). */\nexport const KNOWN_VERDICT_PREFIXES: ReadonlySet<string> = new Set<string>([\n  ...CHECK_CATALOG.flatMap((c) => c.prefixes),\n  ...DEFAULT_BLOCKABLE,\n  ...DEFAULT_ESCALATE,\n  ...COMPLETION_PREFIXES,\n]);\n\n/** Return the policy entries that are NOT canonical prefixes (typos / over-broad strings). Empty\n * ⇒ the policy is well-formed. Pure. */\nexport function unknownVerdictPrefixes(cfg: {\n  blockable?: string[];\n  escalateOn?: string[];\n}): string[] {\n  return [...(cfg.blockable ?? []), ...(cfg.escalateOn ?? [])].filter(\n    (p) => !KNOWN_VERDICT_PREFIXES.has(p),\n  );\n}\n\nconst matchesPrefix = (id: string, prefixes: readonly string[]): boolean =>\n  prefixes.some((p) => id === p || id.startsWith(`${p}-`));\n\nconst cite = (f: { id: string; filePath?: string; evidenceRef?: string }): string =>\n  `${f.id}${f.filePath ? ` (${f.filePath})` : f.evidenceRef ? ` (${f.evidenceRef})` : \"\"}`;\n\n/**\n * Compute the work-verdict from a receipt predicate + an opt-in policy. No policy ⇒ UNJUDGED\n * (default-off; never gates). Pure + total.\n */\nexport function workVerdict(p: ReceiptPredicate, policy?: WorkPolicy): WorkVerdict {\n  if (!policy) {\n    return { verdict: \"UNJUDGED\", reasons: [] };\n  }\n  // main-band only: a finding must have cleared its own confidence floor (≥ 0.5) to gate.\n  const main = p.findings.filter((f) => f.confidence >= 0.5);\n  const blockable = policy.blockable ?? DEFAULT_BLOCKABLE;\n  const escalateOn = policy.escalateOn ?? DEFAULT_ESCALATE;\n\n  // 1. WRONG — a cited blockable/tamper fact, or (opt-in) a parsed red test run.\n  const wrong: VerdictReason[] = [];\n  for (const f of main) {\n    if (matchesPrefix(f.id, blockable)) {\n      wrong.push({ axis: \"integrity\", fact: cite(f), contributes: \"WRONG\" });\n    }\n  }\n  if (policy.gateTestOutcome && p.evidence.testMetrics?.exitStatus === \"failed\") {\n    wrong.push({\n      axis: \"correctness\",\n      fact: `evidence.testMetrics.exitStatus:\"failed\"`,\n      contributes: \"WRONG\",\n    });\n  }\n  if (wrong.length > 0) {\n    return { verdict: \"WRONG\", reasons: wrong };\n  }\n\n  // 2. INCOMPLETE — a failed ERROR-severity assert, or a main-band completion gap.\n  const incomplete: VerdictReason[] = [];\n  for (const a of policy.asserts ?? []) {\n    if ((!a.pass || a.error) && (a.assertion.severity ?? \"error\") === \"error\") {\n      incomplete.push({\n        axis: \"completion\",\n        fact: `assert ${a.assertion.path} ${a.assertion.op}${a.error ? \" (config error)\" : \"\"}`,\n        contributes: \"INCOMPLETE\",\n      });\n    }\n  }\n  for (const f of main) {\n    if (matchesPrefix(f.id, COMPLETION_PREFIXES)) {\n      incomplete.push({ axis: \"completion\", fact: cite(f), contributes: \"INCOMPLETE\" });\n    }\n  }\n  if (incomplete.length > 0) {\n    return { verdict: \"INCOMPLETE\", reasons: incomplete };\n  }\n\n  // 3. ESCALATE — a judgement-required signal on an otherwise-clean board.\n  const escalate: VerdictReason[] = [];\n  for (const f of main) {\n    if (matchesPrefix(f.id, escalateOn)) {\n      escalate.push({ axis: \"correctness\", fact: cite(f), contributes: \"ESCALATE\" });\n    }\n  }\n  if (escalate.length > 0) {\n    return { verdict: \"ESCALATE\", reasons: escalate };\n  }\n\n  // 4. VERIFIED — a policy was supplied and every arm is empty (nothing wrong is cited).\n  return { verdict: \"VERIFIED\", reasons: [] };\n}\n\n/** Exit code: WRONG/INCOMPLETE gate (non-zero); ESCALATE/VERIFIED/UNJUDGED are advisory (0).\n * Mirrors assertExitCode — the verdict gates the same way the asserts it composes do. */\nexport function verdictExitCode(v: Verdict): number {\n  return v === \"WRONG\" || v === \"INCOMPLETE\" ? 1 : 0;\n}\n","import { execFileSync } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { ingestSarif } from \"./sarifIngest.js\";\nimport type { Scanner, ScannerContext, ScannerEvidence } from \"./scanners.js\";\n\n/**\n * SAST adapter (#23) — semgrep over the diff-scoped changed files. OPT-IN + fingerprint-or-omit:\n * runs only when `RECEIPTS_SEMGREP_RULES` points at a pinned local rules dir (the rulesetHash\n * source) AND the `semgrep` binary is on PATH; otherwise returns null (skip silently, R5). The\n * network is never touched (registry rulesets drift — pin local rules; `--disable-version-check`).\n * Facts-only: the result is the tool's own `{ruleId,file,line,level}`, never a security verdict.\n */\n\nfunction sh(cmd: string, args: string[], cwd?: string): string {\n  return execFileSync(cmd, args, {\n    encoding: \"utf8\",\n    stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    ...(cwd ? { cwd } : {}),\n  });\n}\n\n/** sha256 over the pinned rules dir's file contents (sorted) — the rulesetHash half of the\n * toolFingerprint, so a ruleset bump is honestly a NEW fact, not non-determinism. */\nfunction hashRulesDir(dir: string): string | null {\n  try {\n    const h = createHash(\"sha256\");\n    const walk = (d: string): void => {\n      for (const name of readdirSync(d).sort()) {\n        const p = join(d, name);\n        const st = statSync(p);\n        if (st.isDirectory()) {\n          walk(p);\n        } else {\n          h.update(name);\n          h.update(readFileSync(p));\n        }\n      }\n    };\n    walk(dir);\n    return h.digest(\"hex\").slice(0, 16);\n  } catch {\n    return null;\n  }\n}\n\nexport const semgrepScanner: Scanner = {\n  name: \"semgrep\",\n  category: \"sast\",\n  run(ctx: ScannerContext): ScannerEvidence | null {\n    const rulesDir = process.env.RECEIPTS_SEMGREP_RULES;\n    if (!rulesDir || ctx.scopeFiles.length === 0) {\n      return null; // no pinned ruleset / nothing to scan → skip\n    }\n    const rulesetHash = hashRulesDir(rulesDir);\n    if (!rulesetHash) {\n      return null; // can't fingerprint the ruleset → skip (R5)\n    }\n    let version: string;\n    try {\n      version = sh(\"semgrep\", [\"--version\"]).trim().split(\"\\n\")[0];\n    } catch {\n      return null; // semgrep not on PATH → skip (NG4)\n    }\n    if (!version) {\n      return null;\n    }\n    let sarif: string;\n    try {\n      const args = [\n        \"--sarif\",\n        \"--quiet\",\n        \"--disable-version-check\",\n        \"--config\",\n        rulesDir,\n        ...(ctx.base ? [\"--baseline-commit\", ctx.base] : []),\n        \"--\", // end-of-options: a path beginning with `-` is a path, not a flag (codex review)\n        ...ctx.scopeFiles,\n      ];\n      // Run from the repo root so repo-relative `scopeFiles` and `--baseline-commit` resolve\n      // against the right tree, not the caller's cwd (codex review).\n      sarif = sh(\"semgrep\", args, ctx.repoRoot);\n    } catch (e) {\n      // semgrep exits non-zero when it finds results; its stdout still holds the SARIF.\n      const out = (e as { stdout?: Buffer | string }).stdout;\n      sarif = typeof out === \"string\" ? out : out ? out.toString(\"utf8\") : \"\";\n      if (!sarif) {\n        return null;\n      }\n    }\n    const { results, findingCount } = ingestSarif(sarif, ctx.scopeFiles);\n    return {\n      tool: \"semgrep\",\n      version,\n      category: \"sast\",\n      rulesetHash,\n      scope: \"diff\",\n      findingCount,\n      ...(results.length ? { results } : {}),\n    };\n  },\n};\n","import type { ScannerLevel, ScannerResult } from \"./scanners.js\";\n\n/**\n * SARIF 2.1.0 INGEST (SPEC-0124) — the consumer direction of `src/report/sarif.ts` (the producer).\n * Parse a scanner's SARIF output into normalized, DIFF-SCOPED `ScannerResult[]` + a count-by-level.\n * Pure: no I/O, no model. Diff-scoping is the FP wall Receipts owns — a result is kept ONLY when\n * its file matches one of `scope.files` (a result with no resolvable location is dropped, since it\n * can't be attributed to the changed hunks). Results are capped; counts reflect the kept set.\n */\n\nconst CAP = 50;\n\n/** STRICT path match: exact, or full-path-segment suffix where the SHORTER side is itself a\n * multi-segment path. NO basename fallback and NO single-segment suffix — a bare-basename uri\n * (`db.py`) must NOT match a changed `src/app/db.py`, nor `tests/db.py` a changed `src/db.py`\n * (multi-aspect FP review: a same-basename file in another dir is out of scope).\n * Returns the MATCHED scope file (repo-relative) so the caller records the normalized path, never\n * the scanner's raw uri — an absolute / `file://` / `..` uri must not leak a machine path into the\n * receipt nor break repo-relative anchoring (codex review). */\nfunction matchScope(file: string, scopeFiles: readonly string[]): string | null {\n  if (scopeFiles.length === 0) {\n    return null;\n  }\n  for (const sf of scopeFiles) {\n    if (\n      sf === file ||\n      (file.includes(\"/\") && sf.endsWith(`/${file}`)) ||\n      (sf.includes(\"/\") && file.endsWith(`/${sf}`))\n    ) {\n      return sf;\n    }\n  }\n  return null;\n}\n\nfunction levelOf(raw: unknown): ScannerLevel {\n  const l = String(raw ?? \"\").toLowerCase();\n  return l === \"error\" || l === \"warning\" || l === \"note\" ? l : \"warning\"; // SARIF default is warning\n}\n\ninterface SarifResultIn {\n  ruleId?: unknown;\n  level?: unknown;\n  message?: { text?: unknown };\n  locations?: {\n    physicalLocation?: {\n      artifactLocation?: { uri?: unknown };\n      region?: { startLine?: unknown };\n    };\n  }[];\n}\n\n/**\n * Ingest a SARIF JSON string, filtered to `scopeFiles`. Returns the kept results (capped) + the\n * count by level over the kept set. Malformed / non-SARIF input → empty (never throws).\n */\nexport function ingestSarif(\n  sarifText: string,\n  scopeFiles: readonly string[],\n  cap = CAP,\n): { results: ScannerResult[]; findingCount: Record<string, number> } {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(sarifText);\n  } catch {\n    return { results: [], findingCount: {} };\n  }\n  const runs =\n    parsed && typeof parsed === \"object\" && Array.isArray((parsed as { runs?: unknown }).runs)\n      ? ((parsed as { runs: { results?: unknown }[] }).runs ?? [])\n      : [];\n\n  const all: ScannerResult[] = [];\n  const findingCount: Record<string, number> = {};\n  for (const run of runs) {\n    const results = Array.isArray(run?.results) ? (run.results as SarifResultIn[]) : [];\n    for (const r of results) {\n      const loc = r.locations?.[0]?.physicalLocation;\n      const uri = typeof loc?.artifactLocation?.uri === \"string\" ? loc.artifactLocation.uri : \"\";\n      const file = uri ? matchScope(uri, scopeFiles) : null;\n      if (!file) {\n        continue; // no location, or outside the diff scope → not our fact (R3)\n      }\n      const level = levelOf(r.level);\n      const line = typeof loc?.region?.startLine === \"number\" ? loc.region.startLine : undefined;\n      const result: ScannerResult = {\n        ruleId: typeof r.ruleId === \"string\" && r.ruleId ? r.ruleId : \"unknown\",\n        file, // normalized to the matched scope path — never the raw scanner uri\n        level,\n        ...(line && line >= 1 ? { line } : {}),\n        ...(typeof r.message?.text === \"string\" ? { message: r.message.text.slice(0, 300) } : {}),\n      };\n      // count every in-scope hit, even past the result cap, so the count stays faithful.\n      findingCount[level] = (findingCount[level] ?? 0) + 1;\n      all.push(result);\n    }\n  }\n  // Deterministic order BEFORE the cap: a scanner's emission order is not guaranteed stable, so\n  // sort on a total key and only then slice — otherwise the kept-50 set (and the receipt bytes)\n  // could vary run-to-run with tool ordering (codex review: L1 determinism).\n  all.sort(\n    (a, b) =>\n      (a.file ?? \"\").localeCompare(b.file ?? \"\") ||\n      (a.line ?? 0) - (b.line ?? 0) ||\n      a.ruleId.localeCompare(b.ruleId) ||\n      a.level.localeCompare(b.level) ||\n      (a.message ?? \"\").localeCompare(b.message ?? \"\"),\n  );\n  return { results: all.slice(0, cap), findingCount };\n}\n","import { semgrepScanner } from \"./semgrep.js\";\n\n/**\n * Scanners surface (SPEC-0124) — the SIXTH extension point, parallel to adapters / detectors /\n * test-parsers / guard-rules / exporters. A scanner runs a pinned EXTERNAL tool (semgrep,\n * gitleaks, osv, …) over the diff-scoped changed files, ingests its SARIF, and records a\n * count-only fact block at a new TOP-LEVEL `predicate.scanners[]`.\n *\n * It is a RECORDED INPUT (like guardEvents/subagents): a CI verifier re-running the engine on the\n * transcript alone cannot reproduce a semgrep run, so `scanners[]` is exempt from the L1\n * byte-compare (rederive.ts strips it) and lives OUTSIDE `evidence`/`findings`. \"Deterministic\"\n * here means same changed-files + same `toolFingerprint` → same output (R5 fingerprint-or-omit),\n * not \"offline re-derivable\". Facts-only — never a security verdict (R2). The whole surface is\n * gated behind `RECEIPTS_EXPERIMENTAL_DETECTORS=1` and is advisory until live-fleet FP-validated.\n *\n * NG6: gitleaks/osv/config-drift/mutation adapters are additional members of THIS registry — the\n * seam ships now; each adapter lands when its preconditions (pinned ruleset / offline DB) exist.\n */\n\nexport type ScannerCategory = \"sast\" | \"secret-scan\" | \"sca\" | \"config-drift\" | \"mutation\";\nexport type ScannerLevel = \"error\" | \"warning\" | \"note\";\n\n/** One scanner result — a file:line-cited fact, never a verdict. Mirrors the SARIF result keys\n * the producer (sarif.ts) re-emits, so ingest → re-export is identity on these fields. */\nexport interface ScannerResult {\n  ruleId: string;\n  file?: string;\n  line?: number;\n  level: ScannerLevel;\n  message?: string;\n}\n\n/** A scanner's recorded fact block (one per tool run). */\nexport interface ScannerEvidence {\n  tool: string;\n  version: string;\n  category: ScannerCategory;\n  /** sha256 of the pinned ruleset dir (SAST/config) — half the toolFingerprint */\n  rulesetHash?: string;\n  /** DB snapshot identity (SCA / secret-DB) — the other fingerprint shape */\n  dbAsOf?: string;\n  dbHash?: string;\n  scope: \"diff\";\n  /** count by SARIF level (error/warning/note) — facts, no rollup verdict */\n  findingCount: Record<string, number>;\n  /** capped, file:line-cited results */\n  results?: ScannerResult[];\n  /** #15 mutation-score ingest only */\n  mutation?: { killed: number; survived: number; total: number };\n}\n\n/** What a scanner needs to run: the diff-scoped changed files + the base ref for net-new. */\nexport interface ScannerContext {\n  scopeFiles: readonly string[];\n  base?: string;\n  /** repo root the tool runs in (cwd) */\n  repoRoot?: string;\n}\n\n/** A scanner: runs the external tool over the scope and returns its evidence, or null to skip\n * (tool absent / fingerprint unresolvable — R5 fingerprint-or-omit). MUST NOT throw. */\nexport interface Scanner {\n  name: string;\n  category: ScannerCategory;\n  run(ctx: ScannerContext): ScannerEvidence | null;\n}\n\n/** The registry — append a `{name, category, run}` adapter to add a scanner (parallels DETECTORS). */\nexport const SCANNERS: readonly Scanner[] = [semgrepScanner];\n\n/**\n * Run every registered scanner over the diff scope. Gated by `RECEIPTS_EXPERIMENTAL_DETECTORS=1`\n * (advisory until FP-validated) AND `scope.kind === \"diff\"` (R3, diff-only — never the backlog).\n * Crash-safe: a scanner that throws or can't fingerprint is skipped, never breaks the receipt.\n */\nexport function runScanners(ctx: ScannerContext): ScannerEvidence[] {\n  if (process.env.RECEIPTS_EXPERIMENTAL_DETECTORS !== \"1\") {\n    return [];\n  }\n  const out: ScannerEvidence[] = [];\n  for (const s of SCANNERS) {\n    try {\n      const ev = s.run(ctx);\n      if (ev) {\n        out.push(ev);\n      }\n    } catch {\n      // a scanner is a bonus, never a hard dependency — a failure must not break the receipt.\n    }\n  }\n  return out;\n}\n","import type { FindingSet } from \"../findings/findings.js\";\nimport type { Receipt } from \"../receipt/build.js\";\nimport { redact } from \"./redact.js\";\n\n/**\n * Verifiable handoff brief (SPEC-0025 / M23). A pure projection of a session's Receipt +\n * findings into typed sections (DONE / OPEN / RISK / NEXT / PREVENT / VERIFY) the next\n * agent or human can read AND check (re-derive the subject hash). Deterministic, zero\n * model calls, no new schema. Evidence, not judgement: NEXT/PREVENT are the VERBATIM\n * fixPrompt/guardrailRule strings the findings engine already produced — no invented\n * advice, no readiness verdict.\n */\n\nconst OPEN_IDS = new Set([\"unverified-change\", \"claimed-commit-none\", \"fake-green\"]);\n\nexport interface Handoff {\n  subject: string;\n  grade: string;\n  done: { filesChanged: number; edits: number; commands: number; reads: number; testsRan: boolean };\n  open: string[];\n  risk: { severity: string; title: string }[];\n  next: string[];\n  prevent: string[];\n  verify: string;\n}\n\nexport function buildHandoff(receipt: Receipt, findings: FindingSet): Handoff {\n  const all = [...findings.main, ...findings.minor];\n  const ev = receipt.predicate.evidence;\n  return {\n    subject: receipt.subject[0]?.digest.sha256 ?? \"\",\n    grade: receipt.predicate.grade,\n    done: {\n      filesChanged: ev.filesChanged,\n      edits: ev.edits,\n      commands: ev.commands,\n      reads: ev.reads,\n      testsRan: ev.testsRan,\n    },\n    open: all.filter((f) => OPEN_IDS.has(f.id)).map((f) => redact(f.title)),\n    risk: all\n      .filter((f) => f.severity === \"high\" || f.severity === \"critical\")\n      .map((f) => ({ severity: f.severity, title: redact(f.title) })),\n    next: all\n      .map((f) => f.fixPrompt)\n      .filter((p): p is string => !!p)\n      .map(redact),\n    prevent: all\n      .map((f) => f.guardrailRule)\n      .filter((g): g is string => !!g)\n      .map(redact),\n    verify: `receipts rederive <transcript>   # reproduces subject ${(receipt.subject[0]?.digest.sha256 ?? \"\").slice(0, 12)}…`,\n  };\n}\n\nexport function renderHandoffMarkdown(h: Handoff): string {\n  const lines: string[] = [];\n  lines.push(`# Handoff — Grade ${h.grade}`, \"\");\n  lines.push(\n    \"## ✅ Done\",\n    `${h.done.filesChanged} files changed · ${h.done.edits} edits · ${h.done.commands} commands · ${h.done.reads} reads · tests ran: ${h.done.testsRan ? \"yes\" : \"no\"}`,\n    \"\",\n  );\n  if (h.open.length) {\n    lines.push(\"## 🚧 Open\", ...h.open.map((o) => `- ${o}`), \"\");\n  }\n  if (h.risk.length) {\n    lines.push(\n      \"## 🛡️ Risk\",\n      ...h.risk.map((r) => `- **${r.severity.toUpperCase()}** ${r.title}`),\n      \"\",\n    );\n  }\n  if (h.next.length) {\n    lines.push(\"## ⏭️ Next\", ...h.next.map((n) => `- ${n}`), \"\");\n  }\n  if (h.prevent.length) {\n    lines.push(\"## 🧷 Prevent\", ...h.prevent.map((p) => `- ${p}`), \"\");\n  }\n  lines.push(\"## 🔎 Verify\", `\\`${h.verify}\\``, \"\");\n  return `${lines.join(\"\\n\").trimEnd()}\\n`;\n}\n","/**\n * SPEC-0098 (M106) — witness cross-check.\n *\n * The signed Receipt proves \"this receipt describes a transcript with this exact\n * sha256\" — receipt ↔ transcript integrity. It cannot prove that transcript\n * reflects what actually happened: a doctored transcript still hashes, signs, and\n * verifies green (the recorder is inside the agent's trust domain).\n *\n * This module closes the gap for the MODEL side. `altimate-router` proxies every\n * model call, so it can independently record the conversation it saw — hashes\n * only, never content (the router's local-first promise). We re-derive the same\n * per-block hashes from the transcript and check that every block the router\n * witnessed is present, byte-identical, in the transcript.\n *\n * Unit = the atomic content BLOCK, not the message turn. Validated on real paired\n * data (router capture vs transcript, session 8c35bdf5): per-message matched only\n * 34% of assistant turns (Claude Code splits one wire message into several\n * transcript entries), but per assistant block — each `text`, each `tool_use` —\n * matched 100% of tool_use byte-for-byte. Because wire user turns also carry\n * Claude-Code-injected context the transcript never stores, block ORDER does not\n * align across the two records, so the check is **multiset containment**\n * (witness ⊆ transcript), not an ordered chain.\n *\n * Surface = ASSISTANT blocks only — the model's own output (text + the tool_use it\n * emitted), which both records carry verbatim. User turns are excluded (wire-side\n * injection makes them diverge; R3 forbids the false alarm). Direction = containment\n * only: catches deletion and modification of any witnessed block. Fabrication\n * detection (transcript ⊆ witness) needs reliable coverage-window boundaries and is\n * deferred (M106 follow-up).\n *\n * Honest boundary (R2): witnesses the model's decisions, not execution (the bash\n * that ran, the file written, the tool_result fed back — client-side, off the\n * proxy). `witnessed` = \"every model decision the router saw is intact in the\n * transcript\", never \"the work is correct\". Determinism (R1): pure, zero model calls.\n */\n\nimport { createHash, createHmac } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { canonicalize } from \"../receipt/canonical.js\";\nimport type { Session, SessionMessage } from \"../trace/types.js\";\n\n/** An atomic, wire-equivalent unit of the model's output. */\nexport type WitnessBlock =\n  | { kind: \"text\"; text: string }\n  | { kind: \"call\"; name: string; input: unknown };\n\n/**\n * The router's witness log: the ordered digests of the assistant blocks it saw.\n * The router DSSE-signs `canonicalize(log)` with its own key (reuse\n * `src/sign/envelope.ts`); order is retained for the signature/audit but the\n * cross-check below is order-independent (multiset containment).\n */\nexport interface WitnessLog {\n  blocks: string[];\n}\n\nexport type WitnessTier = \"witnessed\" | \"witness-divergence\";\n\nexport interface WitnessResult {\n  tier: WitnessTier;\n  /** blocks in the witness log */\n  witnessed: number;\n  /** witnessed blocks found byte-identical in the transcript */\n  present: number;\n  /** witnessed blocks absent from the transcript (deleted or modified) */\n  missing: number;\n  /** index in the log of the first missing block, if any */\n  firstMissingIndex?: number;\n}\n\nconst sha256 = (s: string): string => createHash(\"sha256\").update(s, \"utf8\").digest(\"hex\");\n\n/**\n * Decompose a session into the ordered assistant content blocks — the witnessed\n * surface. For each assistant message: its `text` (when non-empty) as one block,\n * then one block per tool call (`name` + `input`).\n *\n * Excluded on purpose (the gate hinges on this — incidental fields make the two\n * records disagree byte-for-byte):\n *  - non-assistant messages — user turns carry Claude-Code-injected context the\n *    wire has but the transcript doesn't; system/tool messages aren't model output.\n *  - `thinking` — returned summarized/omitted, replay-variable across models.\n *  - tool `output`/`status`/`durationMs`/`cwd` — execution side, client-local.\n *  - tool_use `id` (model-generated, random; no tamper signal over name+input),\n *    `caller`, usage, cost, timestamp, model, finishReason.\n * Canonicalization is key-sorted (`src/receipt/canonical.ts`), so the router and\n * receipts agree on the exact bytes regardless of construction order.\n */\nexport function modelDecisionBlocks(session: Session): WitnessBlock[] {\n  const blocks: WitnessBlock[] = [];\n  for (const m of session.messages) {\n    blocks.push(...messageBlocks(m));\n  }\n  return blocks;\n}\n\n/** The assistant blocks of one message (empty for non-assistant or empty turns). */\nexport function messageBlocks(m: SessionMessage): WitnessBlock[] {\n  if (m.role !== \"assistant\") {\n    return [];\n  }\n  const out: WitnessBlock[] = [];\n  const text = (m.text ?? \"\").trim();\n  if (text !== \"\") {\n    out.push({ kind: \"text\", text });\n  }\n  for (const c of m.toolCalls ?? []) {\n    out.push({ kind: \"call\", name: c.name, input: c.input ?? null });\n  }\n  return out;\n}\n\n/** sha256 of the canonical block — the unit both the router and we compute. */\nexport function blockDigest(block: WitnessBlock): string {\n  return sha256(canonicalize(block));\n}\n\n/**\n * Build the witness log for a block sequence — exactly what `altimate-router`\n * emits (then DSSE-signs). Exposed so the cross-check, tests, and the conformance\n * fixture derive it identically.\n */\nexport function witnessLog(blocks: WitnessBlock[]): WitnessLog {\n  return { blocks: blocks.map(blockDigest) };\n}\n\n/**\n * Cross-check a session's transcript against the router's witness log.\n *\n * Multiset containment: every block digest in the log must be present (with\n * multiplicity) among the transcript's assistant block digests. A witnessed block\n * with no match is a deleted-or-modified model decision → `witness-divergence`,\n * reported at the first offending log index. Order is not required (the two\n * records segment turns differently and the wire carries extra user-context the\n * transcript lacks), so this catches deletion and modification, not reordering or\n * fabrication (the latter is the deferred completeness direction).\n */\nexport function crossCheck(session: Session, log: WitnessLog): WitnessResult {\n  const have = new Map<string, number>();\n  for (const b of modelDecisionBlocks(session)) {\n    const d = blockDigest(b);\n    have.set(d, (have.get(d) ?? 0) + 1);\n  }\n\n  let present = 0;\n  let missing = 0;\n  let firstMissingIndex: number | undefined;\n  for (let i = 0; i < log.blocks.length; i++) {\n    const d = log.blocks[i];\n    const n = have.get(d) ?? 0;\n    if (n > 0) {\n      have.set(d, n - 1);\n      present++;\n    } else {\n      missing++;\n      if (firstMissingIndex === undefined) {\n        firstMissingIndex = i;\n      }\n    }\n  }\n\n  return {\n    tier: missing > 0 ? \"witness-divergence\" : \"witnessed\",\n    witnessed: log.blocks.length,\n    present,\n    missing,\n    firstMissingIndex,\n  };\n}\n\n/** DSSE payload type for the witness log — must match the router's `WITNESS_PAYLOAD_TYPE`. */\nexport const WITNESS_PAYLOAD_TYPE = \"application/vnd.altimate.witness+json\";\n\n/** DSSE Pre-Authentication Encoding — byte-identical to the router's `dsse_pae`. */\nexport function witnessPae(payload: string): Buffer {\n  const p = Buffer.from(payload, \"utf8\");\n  const t = Buffer.from(WITNESS_PAYLOAD_TYPE, \"utf8\");\n  return Buffer.concat([\n    Buffer.from(`DSSEv1 ${t.length} ${WITNESS_PAYLOAD_TYPE} ${p.length} `, \"utf8\"),\n    p,\n  ]);\n}\n\nexport type WitnessSigState = \"verified\" | \"bad\" | \"no-key\" | \"unsigned\";\n\n/**\n * Verify a witness log's HMAC `sig` (M106 v1, symmetric) with the gateway key. The MAC is over\n * the DSSE-PAE of the canonical `{blocks,session}` (the log minus `sig`), so it proves the log\n * was not altered after the router — which holds the key the agent does not — wrote it.\n * Cross-language verified against the Rust gateway's `hmac_sha256`. (Asymmetric ed25519/Sigstore,\n * so anyone can verify with a public key, is the next hardening — see SPEC-0024.)\n */\nexport function verifyWitnessSig(\n  log: Record<string, unknown>,\n  key: string | undefined,\n): WitnessSigState {\n  const sig = log.sig as { value?: unknown } | undefined;\n  if (!sig || typeof sig.value !== \"string\") return \"unsigned\";\n  if (!key) return \"no-key\";\n  const { sig: _omit, ...unsigned } = log;\n  const want = createHmac(\"sha256\", key)\n    .update(witnessPae(canonicalize(unsigned)))\n    .digest(\"hex\");\n  return want === sig.value ? \"verified\" : \"bad\";\n}\n\n/** Witness provenance attached to a receipt (M106b) — see `ReceiptPredicate.witness`. */\nexport interface WitnessProvenance {\n  tier: \"witnessed\" | \"witness-divergence\";\n  witnessed: number;\n  present: number;\n  signed: \"verified\" | \"unverified\" | \"none\";\n}\n\n/**\n * Discover a router-emitted witness log for this session (the gateway writes\n * `<dir>/<session>.json`, keyed by the Claude Code session id = the transcript basename) and\n * cross-check it. Returns the receipt's witness provenance, or `undefined` when there is no log\n * for this session (⇒ self-reported). Pure read; never throws.\n */\nexport function discoverWitness(\n  session: Session,\n  dir: string,\n  key?: string,\n): WitnessProvenance | undefined {\n  const sid = basename(session.filePath ?? \"\").replace(/\\.jsonl$/, \"\");\n  if (!sid) return undefined;\n  const path = join(dir, `${sid}.json`);\n  if (!existsSync(path)) return undefined;\n  let log: WitnessLog & Record<string, unknown>;\n  try {\n    log = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    return undefined;\n  }\n  if (!Array.isArray(log.blocks) || log.blocks.length === 0) return undefined;\n  const r = crossCheck(session, log);\n  const sig = verifyWitnessSig(log, key);\n  return {\n    tier: r.tier,\n    witnessed: r.witnessed,\n    present: r.present,\n    signed: sig === \"verified\" ? \"verified\" : sig === \"unsigned\" ? \"none\" : \"unverified\",\n  };\n}\n","import { existsSync, readdirSync } from \"node:fs\";\nimport { basename, join } from \"node:path\";\nimport { type Finding, deriveFindings } from \"../findings/findings.js\";\nimport { deriveSpans } from \"../findings/spans.js\";\nimport {\n  destructiveOutsideRepo,\n  findingSurface,\n  privileged,\n  regenerableBuildArtifact,\n  regenerableReceiptRm,\n} from \"../findings/surface.js\";\nimport { redact } from \"../share/redact.js\";\nimport { loadById } from \"./load.js\";\n\n/**\n * Subagent attribution (SPEC-0096 / M104). Claude Code records each Task/Workflow subagent's turns\n * in a SEPARATE transcript — `<parentPath − .jsonl>/subagents/agent-<agentId>.jsonl` — and the\n * parent transcript contains NONE of their tool calls. So the receipt is otherwise blind to\n * everything subagents did. This loader discovers those files, derives each subagent's findings,\n * and surfaces the MERGE-RELEVANT ones attributed to the subagent's brief (its first user message).\n *\n * Recorded input (SPEC-0096 Option B), like guardEvents: the surfaced findings are stored in the\n * predicate's `subagents` field, exempt from the L1 byte-compare (the CI verifier has no access to\n * the subagents dir), envelope-covered by the parent digest. Deterministic; zero model calls.\n */\nexport interface AttributedFinding {\n  /** the subagent's id (from the agent-<id>.jsonl filename) */\n  agentId: string;\n  /** the subagent's brief — its first user message, redacted + truncated */\n  brief: string;\n  id: string;\n  severity: Finding[\"severity\"];\n  title: string;\n  detail: string;\n  filePath?: string;\n}\n\nexport interface SubagentActivity {\n  /** subagent transcripts discovered for this session */\n  total: number;\n  /** subagents that did file/command work (deep-derived; research/read-only are skipped) */\n  considered: number;\n  /** the merge-relevant findings, attributed to their subagent */\n  surfaced: AttributedFinding[];\n}\n\n/**\n * Whether a subagent's finding earns a row on the MERGE surface. Mirrors `visibleMergeFindings`\n * (src/report/prComment.ts) on the subagent's own findings BEFORE they're surfaced, so a research\n * subagent's process noise can't reach the reviewer's merge gate:\n *  - EXCLUDE operator/efficiency findings (bottleneck/loop/cost/cache/model-downgrade/errcluster) —\n *    those describe HOW the subagent worked, not the merged change (they live on the operator card);\n *  - EXCLUDE carved-out destructives (a `rm -rf /tmp/scratch` / build-dir / regenerable receipt) —\n *    session scratch, not a merge risk;\n *  - then keep only the consequential rest: privileged surface, ≥high OUTCOME severity, or a finding\n *    that touches a file in this PR's diff.\n * Without this, a `bottleneck` (severity \"high\" because it's notable, not because it's a merge risk)\n * floods a small PR with \"Bash took 79% of tool time — via subagent\" noise (the exact failure that\n * prompted this fix).\n */\nexport function subagentMergeRelevant(f: Finding, inDiff: boolean): boolean {\n  if (findingSurface(f.id) !== \"merge\") {\n    return false;\n  }\n  if (f.severity === \"low\") {\n    return false;\n  }\n  if (\n    f.id.startsWith(\"destructive\") &&\n    (destructiveOutsideRepo(f.title) ||\n      regenerableBuildArtifact(f.title) ||\n      regenerableReceiptRm(f.title))\n  ) {\n    return false;\n  }\n  return (\n    privileged(f.id, f.filePath) || f.severity === \"critical\" || f.severity === \"high\" || inDiff\n  );\n}\n\nconst MAX_SUBAGENTS = 200;\n\n/** Repo-relative-ish normalization for diff-file matching. */\nconst norm = (p: string): string => p.replace(/^\\.\\//, \"\").replace(/^[\"']|[\"']$/g, \"\");\n\n/** The subagents directory beside a parent transcript, or undefined when there is none. */\nexport function subagentsDir(parentPath: string): string | undefined {\n  const dir = `${parentPath.replace(/\\.jsonl$/i, \"\")}/subagents`;\n  return existsSync(dir) ? dir : undefined;\n}\n\n/**\n * Load + attribute the merge-relevant subagent findings for a session. A subagent finding is\n * surfaced when it is privileged, ≥high severity, or touches a file in the diff — otherwise it is\n * counted but not shown (the scope gate keeps a 162-subagent session quiet). Returns undefined when\n * the session spawned no subagents. Crash-safe: a bad subagent file is skipped, not fatal.\n */\nexport async function loadSubagentActivity(\n  parentPath: string,\n  opts: { diffFiles?: string[]; cap?: number } = {},\n): Promise<SubagentActivity | undefined> {\n  const dir = subagentsDir(parentPath);\n  if (!dir) {\n    return undefined;\n  }\n  let files: string[];\n  try {\n    files = readdirSync(dir).filter((f) => f.endsWith(\".jsonl\"));\n  } catch {\n    return undefined;\n  }\n  if (!files.length) {\n    return undefined;\n  }\n  const cap = opts.cap ?? MAX_SUBAGENTS;\n  const diff = new Set((opts.diffFiles ?? []).map(norm));\n  const diffBases = new Set([...diff].map((p) => basename(p)));\n  const surfaced: AttributedFinding[] = [];\n  let considered = 0;\n  for (const file of files.slice(0, cap)) {\n    let activity: { brief: string; agentId: string; findings: Finding[] } | undefined;\n    try {\n      // Subagent transcripts under `.claude/` are Claude Code format by construction, so the\n      // adapter is fixed here. If a second agent ever spawns its own subagent transcripts, thread\n      // the parent's AgentSource through instead of hard-coding it.\n      const s = await loadById(\"claude-code\", join(dir, file));\n      if (!s) {\n        continue;\n      }\n      const derived = deriveSpans(s);\n      // research/read-only subagents (no edits, no commands) are counted but not deep-attributed\n      if (derived.filesChanged.length === 0 && derived.commands.length === 0) {\n        continue;\n      }\n      const fset = deriveFindings(derived);\n      activity = {\n        brief: redact((derived.prompt ?? s.title ?? \"\").replace(/\\s+/g, \" \").trim()).slice(0, 120),\n        agentId: basename(file)\n          .replace(/^agent-/, \"\")\n          .replace(/\\.jsonl$/i, \"\"),\n        findings: [...fset.main, ...fset.minor],\n      };\n    } catch {\n      continue; // a malformed subagent file shouldn't break the receipt\n    }\n    considered++;\n    for (const f of activity.findings) {\n      const inDiff =\n        !!f.filePath && (diff.has(norm(f.filePath)) || diffBases.has(basename(f.filePath)));\n      if (subagentMergeRelevant(f, inDiff)) {\n        surfaced.push({\n          agentId: activity.agentId,\n          brief: activity.brief,\n          id: f.id,\n          severity: f.severity,\n          title: f.title,\n          detail: f.detail,\n          ...(f.filePath ? { filePath: f.filePath } : {}),\n        });\n      }\n    }\n  }\n  return { total: files.length, considered, surfaced };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAAA,kBAAiB;AAE1B;AAAA,EACE,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,QAAM,gBAAgB;AAC/B,SAAS,qBAAqB;;;ACb9B,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,QAAAC,aAAY;;;ACyCrB,IAAM,UAAU,CAAC,MAAsB,EAAE,QAAQ,YAAY,IAAI,EAAE,QAAQ,YAAY,IAAI;AAC3F,IAAM,UAAU,CAAC,MACf,EAAE,cAAc,SAAS,QAAQ,cAAc,OAAO,EAAE,YAAY,WAAW,EAAE,CAAC,CAAC,IAAI;AACzF,IAAM,UAAU,CAAC,MACf,EAAE,cAAc,SAAS,cAAc,OAAO,EAAE,YAAY,WAAW,EAAE,CAAC,IAAI;AAChF,IAAM,WAAW,CAAC,MAChB,EAAE,cAAc,UAAU,EAAE,cAAc,WAAW,EAAE,cAAc,cACjE,OAAO,EAAE,YAAY,aAAa,EAAE,YAAY,QAAQ,EAAE,IAC1D;AAGN,IAAM,oBAAoB,CAAC,MAAuB,sBAAsB,CAAC,KAAK,kBAAkB,CAAC;AAKjG,IAAM,iBACJ;AAGF,SAAS,UAAU,KAAuB;AACxC,QAAM,IAAI,IAAI,MAAM,aAAa;AACjC,MAAI,CAAC,EAAG,QAAO,CAAC;AAChB,SAAO,EAAE,CAAC,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,QAAQ,MAAM,IAAI;AAC5F;AAQA,SAAS,oBAAoB,KAAa,MAAc,KAAyB;AAC/E,MACE,eAAe,KAAK,GAAG,KACvB,YAAY,KAAK,GAAG,KACpB,2BAA2B,KAAK,GAAG,KACnC,uBAAuB,KAAK,GAAG,GAC/B;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,UAAU,GAAG;AAC7B,MAAI,UAAU,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,MAAM,iBAAiB,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,MACE,yCAAyC,KAAK,GAAG,KACjD,4BAA4B,KAAK,GAAG,KACpC,4BAA4B,KAAK,GAAG,KACpC,wCAAwC,KAAK,GAAG,KAChD,yCAAyC,KAAK,GAAG,GACjD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAMA,SAAS,kBAAkB,GAAkC;AAC3D,MAAI,EAAE,cAAc,OAAQ,QAAO;AACnC,QAAM,OAAO,QAAQ,CAAC;AACtB,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,GAAG;AACD,UAAM,MAAM,EAAE,CAAC,EAAE,QAAQ,gBAAgB,EAAE;AAC3C,QAAI,UAAU,KAAK,GAAG,EAAG,QAAO,IAAI,EAAE,CAAC,GAAG,GAAG;AAAA,EAC/C;AACA,MAAI,OAA2B;AAC/B,aAAW,MAAM,gBAAgB,IAAI,GAAG;AACtC,QAAI,IAAI;AACR,eAAW,CAAC,GAAG,GAAG,KAAK;AACrB,UAAI,EAAE,QAAQ,IAAI,OAAO,UAAU,CAAC,wBAAwB,GAAG,GAAG,GAAG;AACvE,UAAM,IAAI,oBAAoB,QAAQ,CAAC,GAAG,CAAC;AAC3C,QAAI,MAAM,OAAQ,QAAO;AACzB,QAAI,MAAM,MAAO,QAAO;AAAA,EAC1B;AACA,SAAO;AACT;AAKA,SAAS,gBAAgB,GAAkC;AACzD,MAAI,EAAE,cAAc,OAAQ,QAAO;AACnC,MAAI,UAA8B;AAClC,aAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC,GAAG;AAC5C,QAAI,CAAC,iBAAiB,KAAK,EAAE,EAAG;AAChC,QAAI,CAAC,oCAAoC,KAAK,EAAE,EAAG;AACnD,UAAM,QAAQ,GAAG,QAAQ,2BAA2B,EAAE;AACtD,UAAM,SACJ,MACG,MAAM,KAAK,EACX,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,WAAW,GAAG,CAAC,EACrC,IAAI,KAAK;AACd,UAAM,MAAM,OAAO,SAAS,GAAG,IAAK,OAAO,MAAM,GAAG,EAAE,IAAI,KAAK,KAAM;AACrE,QAAI,OAAO,mBAAmB,KAAK,GAAG,EAAG,QAAO;AAChD,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAGO,IAAM,SAAiB;AAAA,EAC5B;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,gBAAgB;AAAA,IACrB,QAAQ;AAAA,IACR,OAAO,CAAC,MAAM,kBAAkB,CAAC,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,YAAY;AAAA,IACjB,QAAQ;AAAA,IACR,OAAO,CAAC,MAAM,gBAAgB,CAAC,KAAK;AAAA,EACtC;AAAA,EACA,EAAE,IAAI,eAAe,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,gBAAgB,KAAK,QAAQ,CAAC,CAAC,EAAE;AAAA,EACzF;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,oBAAoB;AAAA;AAAA;AAAA,IAGzB,OAAO,CAAC,MAAM;AACZ,YAAM,IAAI,QAAQ,CAAC;AACnB,UAAI,4DAA4D,KAAK,CAAC,EAAG,QAAO;AAChF,YAAM,IAAI,EAAE,MAAM,oEAAoE;AACtF,aAAO,CAAC,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;AAAA,IACtC;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,kBAAkB;AAAA,IACvB,OAAO,CAAC,MAAM,6CAA6C,KAAK,QAAQ,CAAC,CAAC;AAAA,EAC5E;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,qBAAqB;AAAA,IAC1B,OAAO,CAAC,MACN,iEAAiE,KAAK,SAAS,CAAC,CAAC;AAAA,EACrF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,WAAW;AAAA,IAChB,OAAO,CAAC,MAAM;AACZ,YAAM,IAAI,SAAS,CAAC;AACpB,aACE,sGAAsG;AAAA,QACpG;AAAA,MACF,KAAK,qDAAqD,KAAK,CAAC;AAAA,IAEpE;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,GAAG,EAAE,iBAAiB;AAAA,IACtB,OAAO,CAAC,MAAM;AACZ,YAAM,IAAI,QAAQ,CAAC;AACnB,YAAM,IAAI,SAAS,CAAC;AAEpB,YAAM,aAAa,gCAAgC,KAAK,CAAC;AACzD,aACE,yFAAyF;AAAA,QACvF;AAAA,MACF,KACC,CAAC,cAAc,6DAA6D,KAAK,CAAC;AAAA,IAEvF;AAAA,EACF;AACF;AAGA,SAAS,SAAS,MAAY,OAAsC;AAClE,MAAI;AACF,WAAO,OAAO,KAAK,WAAW,aAAa,KAAK,OAAO,KAAK,IAAK,KAAK,UAAU;AAAA,EAClF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,OAAoC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE;AAM9D,SAAS,SAAS,OAAmC;AAC1D,MAAI,OAAwB;AAC5B,aAAW,QAAQ,QAAQ;AACzB,QAAI,MAAM;AACV,QAAI;AACF,YAAM,KAAK,MAAM,KAAK;AAAA,IACxB,QAAQ;AACN,YAAM;AAAA,IACR;AACA,QAAI,CAAC,IAAK;AACV,UAAM,SAAS,SAAS,MAAM,KAAK;AACnC,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,EAAG,QAAO,EAAE,MAAM,OAAO;AACrE,QAAI,KAAK,WAAW,OAAQ;AAAA,EAC9B;AACA,SAAO;AACT;;;ACtPA,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AACxB,SAAS,UAAU,YAAY;AAexB,SAAS,WAAmB;AACjC,SAAO,QAAQ,IAAI,sBAAsB,KAAK,QAAQ,GAAG,WAAW,YAAY,OAAO;AACzF;AAGO,SAAS,kBAAkB,gBAAgC;AAChE,SAAO,SAAS,cAAc,EAAE,QAAQ,aAAa,EAAE;AACzD;AAEA,SAAS,aAAa,GAA6B;AACjD,MAAI,CAAC,KAAK,OAAO,MAAM,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AACV,UACG,EAAE,WAAW,UAAU,EAAE,WAAW,SAAS,EAAE,WAAW,WAC3D,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,SAAS,YAClB,OAAO,EAAE,YAAY,YACrB,OAAO,EAAE,cAAc;AAE3B;AAMO,SAAS,gBAAgB,WAAiC;AAC/D,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAM,aAAa,KAAK,SAAS,GAAG,GAAG,SAAS,QAAQ,GAAG,MAAM;AAAA,EACnE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAoB,CAAC;AAC3B,aAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,UAAM,IAAI,KAAK,KAAK;AACpB,QAAI,CAAC,GAAG;AACN;AAAA,IACF;AACA,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,CAAC;AACtB,UAAI,aAAa,CAAC,GAAG;AACnB,YAAI,KAAK;AAAA,UACP,QAAQ,EAAE;AAAA,UACV,QAAQ,EAAE;AAAA,UACV,MAAM,EAAE;AAAA,UACR,SAAS,EAAE;AAAA,UACX,WAAW,EAAE;AAAA,UACb,GAAI,OAAO,EAAE,QAAQ,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,UAClD,GAAI,OAAO,EAAE,OAAO,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAAA,QACjD,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;;;AFpDA,SAAS,YAAoC;AAC3C,MAAI,QAAQ,IAAI,mBAAmB,OAAO,QAAQ,IAAI,kBAAkB,IAAK,QAAO;AACpF,QAAM,KAAK,QAAQ,IAAI,kBAAkB,IAAI,KAAK,EAAE,YAAY;AAChE,MAAI,MAAM,WAAW,MAAM,YAAY,MAAM,UAAW,QAAO;AAC/D,SAAO;AACT;AAEA,SAAS,UAAU,GAAsB;AACvC,MAAI,EAAE,cAAc,OAAQ,QAAO,KAAK,OAAO,EAAE,YAAY,WAAW,EAAE,EAAE,MAAM,GAAG,GAAG,CAAC;AACzF,SAAO,KAAK,OAAO,EAAE,YAAY,aAAa,EAAE,YAAY,QAAQ,EAAE,CAAC;AACzE;AAIA,SAAS,eAAe,GAAc,KAAe,SAAuB;AAC1E,MAAI;AACF,UAAM,YAAY,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,EAAE,KAAK;AACjE,QAAI,CAAC,UAAW;AAChB,UAAM,MAAM,SAAS;AACrB,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,UAAM,OAAO,KAAK,UAAU;AAAA,MAC1B,IAAI,KAAK,IAAI;AAAA,MACb,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI,KAAK;AAAA,MACjB,MAAM,OAAO,EAAE,aAAa,EAAE;AAAA,MAC9B,SAAS,QAAQ,QAAQ,UAAU,EAAE,EAAE,MAAM,GAAG,GAAG;AAAA,MACnD,WAAW,IAAI,KAAK;AAAA,MACpB,GAAI,IAAI,KAAK,MAAM,EAAE,KAAK,IAAI,KAAK,IAAI,IAAI,CAAC;AAAA,IAC9C,CAAC;AACD,mBAAeC,MAAK,KAAK,GAAG,SAAS,QAAQ,GAAG,GAAG,IAAI;AAAA,CAAI;AAAA,EAC7D,QAAQ;AAAA,EAER;AACF;AAOO,SAAS,SAAS,OAAiD;AACxE,QAAM,OAAO,UAAU;AACvB,MAAI,SAAS,MAAO,QAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AACjD,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAM,SAAS,IAAI;AAAA,EAClC,QAAQ;AACN,WAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AAAA,EAC/B;AACA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,KAAK;AAAA,EACtB,QAAQ;AACN,WAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AAAA,EAC/B;AACA,MAAI,CAAC,IAAK,QAAO,EAAE,QAAQ,IAAI,MAAM,EAAE;AAEvC,QAAM,UAAU,UAAU,KAAK;AAC/B,iBAAe,OAAO,KAAK,OAAO;AAClC,QAAM,SAAS,GAAG,IAAI,KAAK,SAAS,iBAAiB,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,GAAG;AAKlF,MAAI,SAAS,SAAS;AACpB,UAAM,OAAO,IAAI,WAAW,SAAS,UAAU,IAAI,WAAW,QAAQ,YAAY;AAClF,UAAM,MAAM,OACR,iDAAqC,IAAI,IAAI,OAAO,WAAM,IAAI,KAAK,SAAS,iDAC5E,2CAA+B,OAAO,WAAM,IAAI,KAAK,SAAS;AAClE,WAAO,EAAE,QAAQ,KAAK,UAAU,EAAE,eAAe,IAAI,CAAC,GAAG,MAAM,EAAE;AAAA,EACnE;AAEA,MAAI,IAAI,WAAW,QAAQ;AACzB,WAAO;AAAA,MACL,QAAQ,KAAK,UAAU;AAAA,QACrB,eAAe,0CAA8B,OAAO,WAAM,IAAI,KAAK,SAAS;AAAA,QAC5E,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,oBAAoB;AAAA,UACpB,0BAA0B;AAAA,QAC5B;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,IAAI,WAAW,OAAO;AACxB,WAAO;AAAA,MACL,QAAQ,KAAK,UAAU;AAAA,QACrB,eAAe,2CAA+B,OAAO,WAAM,IAAI,KAAK,SAAS;AAAA,QAC7E,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,oBAAoB;AAAA,UACpB,0BAA0B;AAAA,QAC5B;AAAA,MACF,CAAC;AAAA,MACD,MAAM;AAAA,IACR;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,KAAK,UAAU;AAAA,MACrB,eAAe,gCAAsB,OAAO,WAAM,IAAI,KAAK,SAAS;AAAA,IACtE,CAAC;AAAA,IACD,MAAM;AAAA,EACR;AACF;;;AGnIA,SAAS,iBAAiB;AAC1B,SAAS,WAAW,YAAY,aAAAC,YAAW,gBAAAC,eAAc,YAAY,qBAAqB;AAC1F,SAAS,YAAY,QAAAC,aAAY;AAYjC,IAAM,SAAS;AAOf,IAAM,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlB,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQlB,SAAS;AAIX,IAAM,eAAe;AAAA;AAAA;AAAA,EAGnB,SAAS;AAMX,SAAS,IAAI,MAAgB,KAA6B;AACxD,QAAM,IAAI,UAAU,OAAO,MAAM,EAAE,UAAU,QAAQ,IAAI,CAAC;AAC1D,SAAO,EAAE,WAAW,IAAI,EAAE,OAAO,KAAK,IAAI;AAC5C;AAEA,IAAM,MAAM,CAAC,GAAW,QACtB,WAAW,CAAC,IAAI,IAAIA,MAAK,OAAO,QAAQ,IAAI,GAAG,CAAC;AAM3C,SAAS,kBACd,KAC0D;AAC1D,MAAI,IAAI,CAAC,aAAa,WAAW,GAAG,GAAG,MAAM,MAAM;AACjD,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI,CAAC,UAAU,gBAAgB,GAAG,GAAG;AACvD,MAAI,WAAW;AACb,UAAM,QAAQ,UAAU,MAAM,OAAO;AACrC,QAAI,MAAM,SAAS,QAAQ,GAAG;AAE5B,YAAM,OAAO,IAAI,CAAC,aAAa,iBAAiB,GAAG,GAAG,KAAK,OAAO,QAAQ,IAAI;AAC9E,aAAO,EAAE,MAAM,SAAS,KAAKA,MAAK,MAAM,QAAQ,EAAE;AAAA,IACpD;AACA,WAAO,EAAE,MAAM,UAAU,KAAK,IAAI,WAAW,GAAG,EAAE;AAAA,EACpD;AACA,QAAM,IAAI,IAAI,CAAC,aAAa,cAAc,OAAO,GAAG,GAAG;AACvD,SAAO,IAAI,EAAE,MAAM,OAAO,KAAK,IAAI,GAAG,GAAG,EAAE,IAAI;AACjD;AAOO,SAAS,eAAe,KAA6B;AAC1D,QAAM,SAAS,kBAAkB,GAAG;AACpC,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB;AAAA,EACrD;AACA,QAAM,SAAS,OAAO,SAAS,UAAU,eAAe;AACxD,EAAAC,WAAU,OAAO,KAAK,EAAE,WAAW,KAAK,CAAC;AACzC,QAAM,WAAWC,MAAK,OAAO,KAAK,UAAU;AAC5C,QAAM,QAAQA,MAAK,OAAO,KAAK,gBAAgB;AAE/C,MAAI,WAAW,QAAQ,GAAG;AACxB,UAAM,UAAUC,cAAa,UAAU,MAAM;AAC7C,QAAI,QAAQ,SAAS,MAAM,GAAG;AAC5B,UAAI,YAAY,QAAQ;AACtB,eAAO,EAAE,IAAI,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA,MACzD;AAEA,oBAAc,UAAU,MAAM;AAC9B,gBAAU,UAAU,GAAK;AACzB,aAAO,EAAE,IAAI,MAAM,QAAQ,aAAa,MAAM,SAAS;AAAA,IACzD;AACA,QAAI,OAAO,SAAS,SAAS;AAG3B,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,GAAG,QAAQ;AAAA,EAAyC,SAAS;AAAA,MACvE;AAAA,IACF;AAEA,QAAI,WAAW,KAAK,GAAG;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,GAAG,QAAQ,QAAQ,KAAK;AAAA,MAClC;AAAA,IACF;AACA,eAAW,UAAU,KAAK;AAC1B,kBAAc,UAAU,MAAM;AAC9B,cAAU,UAAU,GAAK;AACzB,WAAO,EAAE,IAAI,MAAM,QAAQ,WAAW,MAAM,SAAS;AAAA,EACvD;AAEA,gBAAc,UAAU,MAAM;AAC9B,YAAU,UAAU,GAAK;AACzB,SAAO,EAAE,IAAI,MAAM,QAAQ,aAAa,MAAM,SAAS;AACzD;AASA,IAAM,cAAc;AAEb,SAAS,kBAAkB,SAAgC;AAChE,MAAI,CAAC,WAAW,OAAO,GAAG;AACxB,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,uDAAkD;AAAA,EAC1F;AACA,QAAM,MAAMA,cAAa,SAAS,MAAM;AACxC,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,iDAA4C;AAAA,EACpF;AACA,MAAI,IAAI,YAAY,QAAW;AAC7B,QAAI,UAAU,CAAC;AAAA,EACjB;AACA,QAAM,UAAU,IAAI;AACpB,QAAM,UAAU,QAAQ;AACxB,MAAI,SAAS,SAAS,WAAW,GAAG;AAClC,WAAO,EAAE,IAAI,MAAM,SAAS,MAAM;AAAA,EACpC;AACA,UAAQ,UAAU,UAAU,GAAG,OAAO,OAAO,WAAW,KAAK;AAE7D,QAAM,SAAS,IAAI,MAAM,UAAU,IAAI,CAAC,KAAK;AAC7C,gBAAc,SAAS,GAAG,KAAK,UAAU,KAAK,MAAM,MAAM,CAAC;AAAA,CAAI;AAC/D,SAAO,EAAE,IAAI,MAAM,SAAS,KAAK;AACnC;;;ACzKA,SAAS,aAAAC,kBAAiB;AAC1B,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,QAAAC,aAAY;;;ACFrB,SAAS,aAAAC,kBAAiB;AAc1B,IAAM,QAAQ,CAAC,MAAM,sBAAsB,MAAM,iCAAiC;AAE3E,IAAM,qBAAqB;AAC3B,IAAM,aAAa,CAAC,SAAyB,GAAG,kBAAkB,GAAG,IAAI;AAQhF,SAASC,KACP,MACA,OAAkE,CAAC,GACxD;AACX,QAAM,IAAID,WAAU,OAAO,MAAM;AAAA,IAC/B,UAAU;AAAA,IACV,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,KAAK,IAAI,IAAI,QAAQ;AAAA,EAC5D,CAAC;AACD,SAAO,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,KAAK,EAAE;AAC1F;AAOO,SAAS,gBACd,MACA,QACA,MACA,WACA,KACgB;AAChB,QAAM,OAAOC,KAAI,CAAC,eAAe,MAAM,SAAS,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC;AACvE,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,6CAA6C;AAAA,EAC3E;AACA,QAAM,OAAOA,KAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,OAAO,eAAe,KAAK,GAAG;AAAA,EAAmB,CAAC;AACtF,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAAA,EAC9C;AAGA,QAAM,OAAO,IAAI,KAAK,IAAI,GAAG,KAAK,OAAO,aAAa,KAAK,GAAI,CAAC,CAAC;AACjE,QAAM,SAASA,KAAI,CAAC,GAAG,OAAO,eAAe,KAAK,KAAK,MAAM,YAAY,MAAM,EAAE,GAAG;AAAA,IAClF;AAAA,IACA,KAAK,EAAE,iBAAiB,MAAM,oBAAoB,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB,OAAO,GAAG,GAAG;AAAA,EAClE;AACA,QAAM,MAAM,WAAW,IAAI;AAC3B,QAAM,MAAMA,KAAI,CAAC,cAAc,KAAK,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;AACxD,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,GAAG,UAAU;AAAA,EACzD;AACA,SAAO,EAAE,IAAI,MAAM,KAAK,QAAQ,OAAO,IAAI;AAC7C;AAGO,SAAS,eAAe,MAAc,KAA6B;AACxE,QAAM,IAAIA,KAAI,CAAC,YAAY,QAAQ,GAAG,WAAW,IAAI,CAAC,eAAe,GAAG,EAAE,IAAI,CAAC;AAC/E,SAAO,EAAE,KAAK,EAAE,MAAM;AACxB;AAUO,SAAS,gBAAgB,KAAoD;AAClF,QAAM,IAAIC,KAAI,CAAC,gBAAgB,oBAAoB,qBAAqB,GAAG,EAAE,IAAI,CAAC;AAClF,MAAI,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK;AACnB,WAAO,CAAC;AAAA,EACV;AACA,SAAO,EAAE,IACN,MAAM,IAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,EAAE,KAAK,MAAM,IAAI,MAAM,mBAAmB,MAAM,EAAE,EAAE;AACvE;AAGO,SAAS,eAAe,MAAc,SAAS,UAAU,KAAuB;AACrF,QAAM,MAAM,WAAW,IAAI;AAC3B,SAAOA,KAAI,CAAC,QAAQ,QAAQ,IAAI,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE;AAC1D;;;ACzGA,SAAS,cAAAC,aAAY,aAAAC,YAAW,gBAAAC,eAAc,iBAAAC,sBAAqB;AACnE,SAAS,SAAS,QAAAC,aAAY;AAYvB,IAAM,eAAe;AAKrB,IAAM,qBAAqB;AAC3B,IAAM,gBAAgB;AAetB,SAAS,cAAc,MAAkC;AAC9D,MAAI;AACF,UAAM,IAAI,KAAK,MAAMF,cAAaE,MAAK,MAAM,WAAW,eAAe,GAAG,MAAM,CAAC;AAGjF,UAAM,IAAI,GAAG,KAAK;AAClB,WAAO,OAAO,MAAM,YAAY,IAAI,IAAI;AAAA,EAC1C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,sBACd,MACA,UAAkB,cAClB,OAQI,CAAC,GACQ;AACb,MAAI,WAAoC,CAAC;AACzC,MAAIJ,YAAW,IAAI,GAAG;AACpB,QAAI;AACJ,QAAI;AACF,eAAS,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC;AAAA,IAChD,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,iDAA4C;AAAA,IACjF;AACA,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,aAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,oDAA+C;AAAA,IACpF;AACA,eAAW;AAAA,EACb;AAEA,MAAI,SAAS,UAAU,QAAW;AAChC,aAAS,QAAQ,CAAC;AAAA,EACpB;AACA,QAAM,QAAQ,SAAS;AACvB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,4DAAuD;AAAA,EAC5F;AACA,MAAI,MAAM,eAAe,QAAW;AAClC,UAAM,aAAa,CAAC;AAAA,EACtB;AACA,QAAM,MAAM,MAAM;AAClB,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,gEAA2D;AAAA,EAChG;AACA,QAAM,UAAU,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,GAAG,YAAY,OAAO,CAAC;AAI7E,MAAI,aAAa;AACjB,MAAI,KAAK,iBAAiB;AACxB,QAAI,SAAS,QAAQ,QAAW;AAC9B,eAAS,MAAM,CAAC;AAAA,IAClB;AACA,UAAM,MAAM,SAAS;AACrB,QAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AACjE,aAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,IAAI,0DAAqD;AAAA,IAC1F;AACA,QAAI,IAAI,mBAAmB,QAAW;AACpC,UAAI,iBAAiB;AACrB,mBAAa;AAAA,IACf;AAAA,EACF;AAEA,MAAI,WAAW,CAAC,YAAY;AAC1B,WAAO,EAAE,IAAI,MAAM,SAAS,MAAM;AAAA,EACpC;AACA,MAAI,CAAC,SAAS;AACZ,QAAI,KAAK,EAAE,SAAS,KAAK,WAAW,QAAQ,OAAO,CAAC,EAAE,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAAA,EACrF;AAEA,EAAAD,WAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,EAAAE,eAAc,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5D,SAAO,EAAE,IAAI,MAAM,SAAS,KAAK;AACnC;;;AFxFO,IAAM,cAAc;AAE3B,IAAM,iBAAiB,CAAC,WAAmB,6CAA6C,MAAM;AAE9F,SAASE,KAAI,MAAgB,KAAsB;AACjD,QAAM,IAAIC,WAAU,OAAO,MAAM,EAAE,UAAU,QAAQ,IAAI,CAAC;AAC1D,SAAO,EAAE,WAAW,IAAI,EAAE,OAAO,KAAK,IAAI;AAC5C;AAKA,IAAM,cAAc;AASb,SAAS,UAAU,SAA0B;AAClD,aAAW,EAAE,KAAK,KAAK,KAAK,eAAe,OAAO,GAAG;AACnD,QAAI,QAAQ,QAAQ;AAClB;AAAA,IACF;AACA,QAAI,KAAK,SAAS,WAAW,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,QAAQ,GAAG;AAChF;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC,EAAE,MAAM,CAAC;AAC/D,QAAI,SAAS,SAAS,KAAK,SAAS,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,GAAG;AACrE;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAQO,SAAS,YAAY,SAA0B;AACpD,aAAW,EAAE,KAAK,KAAK,KAAK,eAAe,OAAO,GAAG;AACnD,QAAI,QAAQ,YAAY,CAAC,KAAK,SAAS,WAAW,GAAG;AACnD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAIO,SAAS,qBAAqB,OAAwB;AAC3D,SAAO,MAAM,MAAM,IAAI,EAAE,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,WAAW,aAAa,CAAC;AAC/E;AAIA,IAAM,YAAY,CAAC,SACjBC,YAAWC,MAAK,MAAM,WAAW,aAAa,cAAc,CAAC,KAC7DD,YAAWC,MAAK,MAAM,WAAW,CAAC;AAc7B,SAAS,YAAY,UAA2B;AACrD,MAAI,UAAU,QAAQ,GAAG;AACvB,WAAO;AAAA,EACT;AACA,QAAM,UAAU,gBAAgB,QAAQ;AACxC,SAAO,UAAU,UAAU,OAAO,IAAI;AACxC;AAGO,SAAS,gBAAgB,UAAiC;AAC/D,QAAM,SAASH,KAAI,CAAC,aAAa,kBAAkB,GAAG,QAAQ;AAC9D,MAAI,OAAO,SAAS,OAAO,GAAG;AAC5B,UAAM,UAAU,OAAO,MAAM,GAAG,CAAC,QAAQ,MAAM;AAC/C,QAAI,WAAW,YAAY,UAAU;AACnC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,mBAAmB,QAAgB,KAAuB;AACxE,SAAOA,KAAI,CAAC,OAAO,MAAM,aAAa,GAAG,GAAG,MAAM,eAAe,MAAM;AACzE;AASO,SAAS,gBAAgB,QAAgB,KAAuB;AACrE,QAAM,OAAOA,KAAI,CAAC,gBAAgB,WAAW,0BAA0B,GAAG,GAAG;AAC7E,MAAI,MAAM;AACR,WAAO,SAAS,UAAU,MAAM;AAAA,EAClC;AACA,SAAO,WAAW,UAAU,WAAW;AACzC;AAWA,eAAsB,UAAU,SAAgC,QAAQ,OAAwB;AAC9F,MAAI,OAAO;AACX,mBAAiB,SAAS,QAAQ;AAChC,YAAQ;AAAA,EACV;AACA,SAAO;AACT;AAYA,eAAsB,eACpB,SACA,OACA,UACqB;AACrB,MAAI,gBAAgB;AACpB,MAAI;AACF,QAAI,QAAQ,IAAI,kBAAkB,KAAK;AACrC,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAGA,SAAK,QAAQ,IAAI,kBAAkB,UAAU,YAAY,MAAM,QAAQ;AACrE,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAEA,QAAI,YAAY,YAAY,YAAY,SAAS;AAC/C,UAAI;AACJ,UAAI;AACF,kBAAU,KAAK,MAAM,KAAK;AAAA,MAC5B,QAAQ;AACN,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AACA,UAAI,QAAQ,cAAc,UAAU,CAAC,QAAQ,YAAY,SAAS;AAChE,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AACA,UAAI,QAAQ,OAAOE,YAAW,QAAQ,GAAG,GAAG;AAC1C,gBAAQ,MAAM,QAAQ,GAAG;AAAA,MAC3B;AACA,UAAI,CAAC,UAAU,QAAQ,WAAW,OAAO,GAAG;AAC1C,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AAKA,YAAM,QAAQ,cAAc,QAAQ,WAAW,SAAS,QAAQ,IAAI,CAAC;AACrE,UAAI,MAAM,SAAS,WAAWA,YAAW,MAAM,IAAI,GAAG;AACpD,gBAAQ,MAAM,MAAM,IAAI;AAAA,MAC1B;AACA,sBAAgB,YAAY,QAAQ,WAAW,OAAO;AAAA,IACxD,WAAW,CAAC,qBAAqB,KAAK,GAAG;AACvC,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAEA,UAAM,WAAWF,KAAI,CAAC,aAAa,iBAAiB,CAAC;AACrD,QAAI,CAAC,YAAY,CAAC,YAAY,QAAQ,GAAG;AACvC,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,UAAM,SAASA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAI,CAAC,UAAU,WAAW,UAAU,gBAAgB,MAAM,GAAG;AAC3D,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAIA,UAAM,SACJ,QAAQ,IAAI,kBACZ,cAAc,QAAQ,KACtB,cAAc,gBAAgB,QAAQ,KAAK,EAAE,KAC7C,UACA,YAAY;AACd,QAAI,UAAU,QAAQ;AACpB,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,YAAQ,IAAI,iBAAiB;AAE7B,QAAI,UAAU,SAAS,YAAY,SAAS,mBAAmB,MAAM,GAAG;AACtE,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAKA,UAAM,QAAQ,QAAQ,OAAO,MAAM,KAAK,QAAQ,MAAM;AACtD,YAAQ,OAAO,SAAS,MAAM;AAC9B,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,SAAS,EAAE,cAAc,CAAC;AAAA,IAC9C,UAAE;AACA,cAAQ,OAAO,QAAQ;AAAA,IACzB;AACA,QAAI,cAAc,GAAG;AACnB,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AAKA,QAAI,UAAU,OAAO;AACnB,YAAM,OAAO,OAAO,QAAQ,UAAU,GAAG;AACzC,UAAI,eAAe,IAAI,KAAK,MAAM;AAChC,eAAO,EAAE,MAAM,EAAE;AAAA,MACnB;AACA,YAAM,SAAS,eAAe,IAAI;AAClC,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,SACL,sCAAsC,IAAI,yCAC1C,iCAAiC,IAAI;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,CAACA,KAAI,CAAC,UAAU,eAAe,YAAY,CAAC,GAAG;AACjD,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,IAAAC,WAAU,OAAO,CAAC,OAAO,YAAY,GAAG,EAAE,UAAU,OAAO,CAAC;AAE5D,UAAM,SAASA;AAAA,MACb;AAAA,MACA,CAAC,UAAU,eAAe,MAAM,eAAe,MAAM,GAAG,MAAM,YAAY;AAAA,MAC1E,EAAE,UAAU,OAAO;AAAA,IACrB;AACA,QAAI,OAAO,WAAW,GAAG;AACvB,aAAO,EAAE,MAAM,EAAE;AAAA,IACnB;AACA,QAAI,YAAY,OAAO;AACrB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,sDAA+C,MAAM;AAAA,MAChE;AAAA,IACF;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS,4CAA4C,MAAM;AAAA,IAC7D;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,MAAM,EAAE;AAAA,EACnB;AACF;;;AGrTA,SAAS,gBAAAG,qBAAoB;AAC7B,SAAS,QAAAC,aAAY;AAuBrB,IAAM,MAAM,oBAAI,IAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAqBM,SAAS,YAAY,WAA6B,MAAuB;AAC9E,MAAI,SAAS,cAAc,KAAK,WAAW,WAAW,GAAG;AACvD,UAAM,OAAO,SAAS,aAAa,KAAK,KAAK,MAAM,YAAY,MAAM;AACrE,QAAI,SAAS,IAAI;AACf,aAAO,UAAU,SAAS;AAAA,IAC5B;AACA,QAAI,KAAK,WAAW,WAAW,GAAG;AAChC,YAAM,QAAQ,KAAK,MAAM,YAAY,MAAM;AAC3C,aAAO,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,aAAa,KAAK,EAAE;AAAA,IAChE;AAGA,WAAO,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,OAAO,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,GAAG,CAAC,EAAE;AAAA,EACxF;AAEA,MAAI,MAAe;AACnB,aAAW,OAAO,KAAK,MAAM,GAAG,GAAG;AACjC,QAAI,OAAO,QAAQ,OAAO,QAAQ,UAAU;AAC1C,aAAO;AAAA,IACT;AACA,UAAO,IAAgC,GAAG;AAAA,EAC5C;AACA,SAAO;AACT;AAEA,IAAM,QAAQ,CAAC,MAA4B,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC;AACrF,IAAM,UAAU,CAAC,MACf,KAAK,QACL,MAAM,MACN,MAAM,KACL,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,KACjC,OAAO,MAAM,YAAY,OAAO,KAAK,CAAW,EAAE,WAAW;AAGhE,SAAS,QACP,IACA,QACA,OACuC;AACvC,QAAM,UAAU,MACd,MAAM,MAAM,KAAK,MAAM,KAAK,IACxB,OACA,EAAE,OAAO,OAAO,EAAE,0CAA0C,KAAK,UAAU,MAAM,CAAC,IAAI;AAC5F,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,UAAa,WAAW,KAAK;AAAA,IACzD,KAAK;AACH,aAAO,EAAE,MAAM,QAAQ,MAAM,EAAE;AAAA,IACjC,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,MAAM;AAAA,IAClC,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,MAAM;AAAA,IAClC,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,SAAqB,MAAiB;AAAA,IACrE,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,UAAsB,MAAiB;AAAA,IACtE,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,SAAqB,MAAiB;AAAA,IACrE,KAAK;AACH,aAAO,QAAQ,KAAK,EAAE,MAAO,UAAsB,MAAiB;AAAA,IACtE,KAAK,WAAW;AACd,UAAI,OAAO,WAAW,YAAY,OAAO,UAAU,UAAU;AAC3D,eAAO,EAAE,OAAO,yDAAyD;AAAA,MAC3E;AACA,UAAI;AACF,eAAO,EAAE,MAAM,IAAI,OAAO,KAAK,EAAE,KAAK,MAAM,EAAE;AAAA,MAChD,SAAS,GAAG;AACV,eAAO,EAAE,OAAO,kBAAkB,KAAK,MAAO,EAAY,OAAO,GAAG;AAAA,MACtE;AAAA,IACF;AAAA,IACA,KAAK;AACH,aAAO,MAAM,QAAQ,KAAK,IACtB,EAAE,MAAM,MAAM,SAAS,MAAM,EAAE,IAC/B,EAAE,OAAO,+BAA+B;AAAA,IAC9C;AACE,aAAO,EAAE,OAAO,eAAe,EAAE,IAAI;AAAA,EACzC;AACF;AAGA,SAAS,kBAAkB,KAA4D;AACrF,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO,EAAE,OAAO,8BAA8B;AAAA,EAChD;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,SAAS,YAAY,CAAC,EAAE,MAAM;AACzC,WAAO,EAAE,OAAO,4CAA4C;AAAA,EAC9D;AACA,MAAI,OAAO,EAAE,OAAO,YAAY,CAAC,IAAI,IAAI,EAAE,EAAc,GAAG;AAC1D,WAAO,EAAE,OAAO,iBAAiB,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG;AAAA,EACvF;AACA,MAAI,EAAE,aAAa,UAAa,EAAE,aAAa,WAAW,EAAE,aAAa,QAAQ;AAC/E,WAAO,EAAE,OAAO,+CAA+C;AAAA,EACjE;AACA,SAAO;AAAA,IACL,WAAW;AAAA,MACT,MAAM,EAAE;AAAA,MACR,IAAI,EAAE;AAAA,MACN,OAAO,EAAE;AAAA,MACT,UAAW,EAAE,YAAiC;AAAA,IAChD;AAAA,EACF;AACF;AAIO,SAAS,YAAY,UAA+B;AACzD,QAAM,OAAOA,MAAK,UAAU,aAAa,cAAc;AACvD,MAAI;AACJ,MAAI;AACF,WAAOD,cAAa,MAAM,MAAM;AAAA,EAClC,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,IAAI,MAAM,6CAA8C,EAAY,OAAO,EAAE;AAAA,EACrF;AACA,QAAM,OAAO,MAAM,QAAQ,MAAM,IAC7B,SACA,UACE,OAAO,WAAW,YAClB,MAAM,QAAS,OAAiC,OAAO,IACtD,OAAkC,UACnC;AACN,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,QAAM,MAAmB,CAAC;AAC1B,aAAW,OAAO,MAAM;AACtB,UAAM,IAAI,kBAAkB,GAAG;AAC/B,QAAI,WAAW,GAAG;AAChB,YAAM,IAAI,MAAM,sBAAsB,EAAE,KAAK,KAAK,KAAK,UAAU,GAAG,CAAC,GAAG;AAAA,IAC1E;AACA,QAAI,KAAK,EAAE,SAAS;AAAA,EACtB;AACA,SAAO;AACT;AAGO,SAAS,gBAAgB,SAAkB,SAA+C;AAC/F,SAAO,QAAQ,IAAI,CAAC,cAAc;AAChC,UAAM,SAAS,YAAY,QAAQ,WAAW,UAAU,IAAI;AAE5D,QACE,WAAW,UACX,UAAU,OAAO,YACjB,UAAU,OAAO,WACjB,UAAU,OAAO,MACjB;AACA,aAAO,EAAE,WAAW,MAAM,OAAO,QAAQ,OAAO,SAAS,UAAU,IAAI,cAAc;AAAA,IACvF;AACA,UAAM,MAAM,QAAQ,UAAU,IAAI,QAAQ,UAAU,KAAK;AACzD,WAAO,WAAW,MACd,EAAE,WAAW,MAAM,OAAO,QAAQ,OAAO,IAAI,MAAM,IACnD,EAAE,WAAW,MAAM,IAAI,MAAM,OAAO;AAAA,EAC1C,CAAC;AACH;AAGO,SAAS,eAAe,SAA0C;AACvE,SAAO,QAAQ,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,YAAY,aAAa,OAAO,IAC5F,IACA;AACN;AAGO,SAAS,oBAAoB,SAA0C;AAC5E,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM;AAC/B,UAAM,EAAE,MAAM,IAAI,OAAO,SAAS,IAAI,EAAE;AACxC,UAAM,OAAO,GAAG,IAAI,IAAI,EAAE,GAAG,UAAU,SAAY,KAAK,IAAI,KAAK,UAAU,KAAK,CAAC,EAAE;AACnF,QAAI,EAAE,OAAO;AACX,aAAO,0BAAgB,IAAI,WAAM,EAAE,KAAK;AAAA,IAC1C;AACA,UAAM,MAAM,EAAE,OAAO,mBAAc,aAAa,SAAS,sBAAe;AACxE,WAAO,GAAG,GAAG,IAAI,IAAI,cAAc,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,EAC7D,CAAC;AACD,QAAM,SAAS,QAAQ;AAAA,IACrB,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,YAAY,aAAa;AAAA,EAC1D,EAAE;AACF,QAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,aAAa,MAAM,EAAE;AACjF,QAAM,SAAS,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;AAC7C,QAAM;AAAA,IACJ,KAAK,MAAM,gBAAa,MAAM,UAAU,SAAS,SAAM,MAAM,YAAY,EAAE,OAAO,QAAQ,MAAM;AAAA,EAClG;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;ACvPA,SAAS,gBAAAE,qBAAoB;AAC7B,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAgBd,SAAS,eAAuB;AACrC,SAAO,QAAQ,IAAI,0BAA0BA,MAAKD,SAAQ,GAAG,WAAW,YAAY,WAAW;AACjG;AAEA,SAAS,mBAAmB,GAAmC;AAC7D,MAAI,CAAC,KAAK,OAAO,MAAM,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AACV,UACG,EAAE,SAAS,YAAY,EAAE,SAAS,eACnC,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,YAAY,YACrB,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,UAAU;AAEvB;AAMO,SAAS,kBAAkB,WAAuC;AACvE,MAAI,CAAC,WAAW;AACd,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,UAAMD,cAAaE,MAAK,aAAa,GAAG,GAAG,SAAS,QAAQ,GAAG,MAAM;AAAA,EACvE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAA0B,CAAC;AACjC,aAAW,QAAQ,IAAI,MAAM,IAAI,GAAG;AAClC,UAAM,IAAI,KAAK,KAAK;AACpB,QAAI,CAAC,GAAG;AACN;AAAA,IACF;AACA,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,CAAC;AACtB,UAAI,mBAAmB,CAAC,GAAG;AACzB,YAAI,KAAK;AAAA,UACP,MAAM,EAAE;AAAA,UACR,QAAQ,EAAE;AAAA,UACV,SAAS,EAAE;AAAA,UACX,QAAQ,EAAE;AAAA,UACV,OAAO,EAAE;AAAA,UACT,GAAI,OAAO,EAAE,UAAU,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAAA,UACxD,GAAI,OAAO,EAAE,OAAO,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAAA,UAC/C,GAAI,OAAO,EAAE,cAAc,WAAW,EAAE,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,UACpE,GAAI,OAAO,EAAE,QAAQ,WAAW,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;;;AC5EA,SAAS,oBAAoB;AAC7B,SAAS,aAAAC,YAAW,iBAAAC,sBAAqB;AACzC,SAAS,QAAAC,aAAY;AAqCrB,SAAS,QAAQ,MAA6B,QAAyB;AACrE,MAAI,SAAS,UAAU;AACrB,WAAO,OAAO,YAAY,MAAM;AAAA,EAClC;AACA,SAAO,OAAO,YAAY,MAAM;AAClC;AAMO,SAAS,eACd,OACA,OACA,WACyB;AACzB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,KAAK;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,YAAY,CAAC,IAAI,QAAQ;AAC/B,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM,SAAS,WAAW,WAAW;AAAA,IAC9C,QAAQ,IAAI;AAAA,IACZ,OAAO,QAAQ,MAAM,MAAM,IAAI,MAAM;AAAA,IACrC,GAAI,IAAI,QAAQ,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;AAAA,IACxC,GAAI,IAAI,KAAK,EAAE,IAAI,IAAI,GAAG,IAAI,CAAC;AAAA,IAC/B;AAAA,IACA,GAAI,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC;AAAA,EACpC;AACF;AAGA,SAAS,WAAW,QAAuD;AACzE,QAAM,IAAI,kCAAkC,KAAK,MAAM;AACvD,MAAI,CAAC,GAAG;AACN,WAAO;AAAA,EACT;AACA,SAAO,EAAE,KAAK,EAAE,CAAC,GAAG,GAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,EAAG;AACtD;AAEA,SAAS,GAAG,MAAwB;AAClC,SAAO,aAAa,MAAM,MAAM,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAC3F;AAIO,IAAM,YAAqB,CAAC,UAAU;AAC3C,QAAM,IAAI,WAAW,MAAM,MAAM;AACjC,MAAI,CAAC,GAAG;AACN,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,QAAM,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC;AAChD,MAAI,MAAM,SAAS,UAAU;AAC3B,UAAMC,OAAM,GAAG,CAAC,MAAM,QAAQ,EAAE,KAAK,GAAG,UAAU,UAAU,6BAA6B,CAAC;AAC1F,UAAM,IAAI,KAAK,MAAMA,IAAG;AAMxB,QAAI,CAAC,EAAE,OAAO;AACZ,aAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,IACtC;AACA,WAAO;AAAA,MACL,QAAQ,EAAE;AAAA,MACV,GAAI,EAAE,UAAU,QAAQ,EAAE,OAAO,EAAE,SAAS,MAAM,IAAI,CAAC;AAAA,MACvD,GAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC;AAAA,MACvC,GAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC;AAAA,IAChC;AAAA,EACF;AAMA,QAAM,MAAM,GAAG,CAAC,MAAM,UAAU,EAAE,KAAK,GAAG,UAAU,UAAU,mBAAmB,CAAC;AAClF,QAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,MAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,KAAK,WAAW,GAAG;AAC7C,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,SAAO,mBAAmB,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,YAAY,CAAC,CAAC;AAC3E;AAEA,IAAM,WAAW,oBAAI,IAAI,CAAC,QAAQ,YAAY,WAAW,SAAS,CAAC;AAQ5D,SAAS,mBAAmB,SAAsC;AACvE,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,MAAM,SAAS,GAAG;AACxC,WAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AAAA,EACtC;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,MAAM,UAAU,MAAM,QAAQ,GAAG;AACvD,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AACA,MAAI,QAAQ,MAAM,CAAC,MAAM,SAAS,IAAI,CAAC,CAAC,GAAG;AACzC,WAAO,EAAE,QAAQ,OAAO;AAAA,EAC1B;AACA,SAAO,EAAE,QAAQ,IAAI,UAAU,KAAK;AACtC;AAcO,SAAS,iBACd,WACA,WACA,QAAiB,WACjB,YAAY,IACK;AACjB,MAAI,CAAC,QAAQ,IAAI,oBAAoB;AACnC,WAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,EAAE;AAAA,EAC/B;AACA,QAAM,SAAS,oBAAoB,SAAS;AAC5C,QAAM,OAA2B,CAAC;AAClC,aAAW,KAAK,QAAQ;AACtB,UAAM,MAAM,eAAe,GAAG,OAAO,SAAS;AAC9C,QAAI,KAAK;AACP,WAAK,KAAK,GAAG;AAAA,IACf;AAAA,EACF;AACA,MAAI,KAAK,UAAU,WAAW;AAC5B,UAAM,MAAM,aAAa;AACzB,IAAAC,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAIlC,IAAAC;AAAA,MACEC,MAAK,KAAK,GAAG,SAAS,QAAQ;AAAA,MAC9B,GAAG,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IAClD;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,OAAO,QAAQ,KAAK;AACvC;;;AClMA,SAAS,aAAAC,kBAAiB;AAkBnB,IAAM,iBAAiB;AACvB,IAAM,SAAS,CAAC,SAAyB,GAAG,cAAc,GAAG,IAAI;AAkBxE,SAASC,KACP,MACA,OAAkE,CAAC,GACxD;AACX,QAAM,IAAID,WAAU,OAAO,MAAM;AAAA,IAC/B,UAAU;AAAA,IACV,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,KAAK,KAAK,MAAM,EAAE,GAAG,QAAQ,KAAK,GAAG,KAAK,IAAI,IAAI,QAAQ;AAAA,EAC5D,CAAC;AACD,SAAO,EAAE,MAAM,EAAE,UAAU,IAAI,KAAK,GAAG,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,KAAK,EAAE;AAC1F;AAIA,IAAME,SAAQ,CAAC,MAAM,sBAAsB,MAAM,iCAAiC;AAG3E,SAAS,SAAS,MAAc,KAA0B;AAC/D,QAAM,IAAID,KAAI,CAAC,YAAY,QAAQ,GAAG,OAAO,IAAI,CAAC,YAAY,GAAG,EAAE,IAAI,CAAC;AACxE,MAAI,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK;AACnB,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,EAAE,GAAG;AAC1B,WAAO,MAAM,QAAQ,CAAC,IAAK,IAAmB,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAQO,SAAS,UAAU,MAAcE,QAAiB,KAA+B;AACtF,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,QAAM,OAAO,CAAC,GAAG,UAAUA,MAAK;AAChC,QAAM,OAAO,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA;AAE7C,QAAM,OAAOF,KAAI,CAAC,eAAe,MAAM,SAAS,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC;AACvE,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,6CAA6C;AAAA,EAC3E;AACA,QAAM,OAAOA,KAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,OAAO,eAAe,KAAK,GAAG;AAAA,EAAgB,CAAC;AACnF,MAAI,CAAC,KAAK,IAAI;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AAAA,EAC9C;AAGA,QAAM,OAAO,IAAI,KAAK,IAAI,GAAG,KAAK,MAAME,OAAM,KAAK,GAAI,CAAC,CAAC;AACzD,QAAM,SAASF,KAAI,CAAC,GAAGC,QAAO,eAAe,KAAK,KAAK,MAAM,SAAS,IAAI,EAAE,GAAG;AAAA,IAC7E;AAAA,IACA,KAAK,EAAE,iBAAiB,MAAM,oBAAoB,KAAK;AAAA,EACzD,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,EAAE,IAAI,OAAO,QAAQ,uBAAuB,OAAO,GAAG,GAAG;AAAA,EAClE;AACA,QAAM,MAAM,OAAO,IAAI;AACvB,QAAM,MAAMD,KAAI,CAAC,cAAc,KAAK,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC;AACxD,MAAI,CAAC,IAAI,IAAI;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,cAAc,GAAG,UAAU;AAAA,EACzD;AACA,SAAO,EAAE,IAAI,MAAM,KAAK,OAAO,KAAK,OAAO;AAC7C;AAIO,SAAS,aAAa,KAAsB;AACjD,QAAM,OAAOA,KAAI,CAAC,UAAU,WAAW,GAAG,EAAE,IAAI,CAAC,EAAE;AACnD,QAAM,QAAQA,KAAI,CAAC,UAAU,YAAY,GAAG,EAAE,IAAI,CAAC,EAAE;AACrD,MAAI,QAAQ,OAAO;AACjB,WAAO,GAAG,IAAI,KAAK,KAAK;AAAA,EAC1B;AACA,SAAO,QAAQ,SAAS,QAAQ,IAAI,QAAQ,QAAQ,IAAI,WAAW;AACrE;AAGO,SAAS,eAAe,KAA2B;AACxD,QAAM,IAAIA,KAAI,CAAC,gBAAgB,gBAAgB,qBAAqB,GAAG,EAAE,IAAI,CAAC;AAC9E,MAAI,CAAC,EAAE,MAAM,CAAC,EAAE,KAAK;AACnB,WAAO,oBAAI,IAAI;AAAA,EACjB;AACA,SAAO,IAAI;AAAA,IACT,EAAE,IACC,MAAM,IAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,QAAQ,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,EAClD;AACF;;;AC5GA,IAAM,YAA4B,CAAC,YAAY,QAAQ,UAAU,KAAK;AAG/D,SAAS,cAAc,UAAyD;AACrF,SAAO,UAAU,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AACrE;AAQO,SAAS,cAAc,WAGV;AAClB,QAAM,WAAW,UAAU,YAAY,CAAC;AACxC,QAAM,IAAI,SAAS;AACnB,QAAM,QAAQ,cAAc,QAAQ;AACpC,QAAM,QACJ,MAAM,IACF,gBACA,UAAU,cAAc,UAAU,SAChC,QACA,UAAU,WACR,WACA;AACV,QAAM,UAAU,MAAM,IAAI,gBAAgB,GAAG,CAAC,WAAW,MAAM,IAAI,KAAK,GAAG;AAC3E,SAAO,EAAE,eAAe,GAAG,OAAO,YAAY,SAAS,MAAM;AAC/D;;;ACfA,SAAS,WAAW,GAA2B;AAC7C,SAAO,GAAG,EAAE,KAAK,KAAI,EAAE,YAAY,EAAE;AACvC;AAEA,SAAS,WAAW,GAAoB;AACtC,QAAM,IAAI,EAAE,UAAU;AACtB,MAAI,CAAC,KAAK,EAAE,SAAS,UAAW,QAAO;AACvC,MAAI,EAAE,SAAS,SAAU,QAAO,UAAU,EAAE,UAAU,GAAG;AACzD,SAAO,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,SAAS,EAAE,OAAO,OAAO,EAAE,IAAI,KAAK,EAAE;AAC9E;AAEO,SAAS,aAAa,GAAY,GAA0B;AACjE,QAAM,KAAK,EAAE,UAAU;AACvB,QAAM,KAAK,EAAE,UAAU;AACvB,QAAM,QAAQ,CAAC,KAAa,OAAe,IAAY,QAA4B;AAAA,IACjF;AAAA,IACA;AAAA,IACA,GAAG;AAAA,IACH,GAAG;AAAA,IACH,OAAO,KAAK;AAAA,EACd;AACA,QAAM,SAAuB;AAAA,IAC3B,MAAM,gBAAgB,iBAAiB,GAAG,cAAc,GAAG,YAAY;AAAA,IACvE,MAAM,SAAS,SAAS,GAAG,OAAO,GAAG,KAAK;AAAA,IAC1C,MAAM,YAAY,YAAY,GAAG,UAAU,GAAG,QAAQ;AAAA,IACtD,MAAM,SAAS,SAAS,GAAG,OAAO,GAAG,KAAK;AAAA,IAC1C,MAAM,kBAAkB,mBAAmB,GAAG,gBAAgB,GAAG,cAAc;AAAA,IAC/E,MAAM,UAAU,UAAU,GAAG,OAAO,OAAO,GAAG,OAAO,KAAK;AAAA,EAC5D;AAEA,QAAM,QAAQ,IAAI,IAAI,EAAE,UAAU,SAAS,IAAI,UAAU,CAAC;AAC1D,QAAM,QAAQ,IAAI,IAAI,EAAE,UAAU,SAAS,IAAI,UAAU,CAAC;AAC1D,QAAM,gBAAgB,EAAE,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AAClF,QAAM,kBAAkB,EAAE,UAAU,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AACpF,QAAM,iBAAiB,EAAE,UAAU,SAAS,OAAO,CAAC,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE;AAEpF,SAAO;AAAA,IACL,OAAO,EAAE,GAAG,EAAE,UAAU,OAAO,GAAG,EAAE,UAAU,MAAM;AAAA,IACpD;AAAA,IACA,MAAM,EAAE,GAAG,GAAG,SAAS,GAAG,GAAG,SAAS,OAAO,GAAG,UAAU,GAAG,QAAQ;AAAA,IACrE,eAAe,EAAE,GAAG,GAAG,UAAU,GAAG,GAAG,SAAS;AAAA,IAChD;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,GAAG,WAAW,CAAC,EAAE;AAAA,EAC9C;AACF;AAEA,IAAM,WAAmC,EAAE,UAAU,UAAK,MAAM,gBAAM,QAAQ,aAAM,KAAK,OAAI;AAG7F,SAAS,OAAO,GAAmB;AACjC,MAAI,MAAM,EAAG,QAAO;AACpB,SAAO,IAAI,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;AAC/B;AAEA,SAAS,aAAa,IAAyC;AAC7D,SAAO,GAAG,IAAI,CAAC,MAAM;AACnB,UAAM,MAAM,EAAE,WAAW,OAAO,EAAE,QAAQ,QAAQ;AAClD,WAAO,KAAK,SAAS,EAAE,QAAQ,KAAK,MAAG,IAAI,EAAE,KAAK,GAAG,GAAG;AAAA,EAC1D,CAAC;AACH;AAGO,SAAS,WAAW,GAAyB;AAClD,QAAM,MAAgB,CAAC;AACvB,MAAI,KAAK,iDAAuC;AAChD,MAAI,KAAK,EAAE;AACX,MAAI,KAAK,UAAU,EAAE,MAAM,CAAC,WAAM,EAAE,MAAM,CAAC,EAAE;AAC7C,MAAI,KAAK,YAAY,EAAE,MAAM,CAAC,WAAQ,EAAE,MAAM,CAAC,EAAE;AACjD,MAAI,KAAK,EAAE;AACX,MAAI,KAAK,WAAW;AACpB,aAAW,KAAK,EAAE,QAAQ;AACxB,QAAI,KAAK,KAAK,EAAE,KAAK,KAAK,EAAE,CAAC,WAAM,EAAE,CAAC,KAAK,OAAO,EAAE,KAAK,CAAC,GAAG;AAAA,EAC/D;AACA,QAAM,KAAK,EAAE;AACb,QAAM,YACJ,GAAG,UAAU,IAAI,WAAQ,GAAG,QAAQ,IAAI,MAAM,OAAO,iBAAiB,KAAK,IAAI,GAAG,KAAK,CAAC;AAC1F,MAAI,KAAK,WAAW,iBAAiB,GAAG,CAAC,CAAC,WAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,SAAS,GAAG;AACvF,MAAI;AAAA,IACF,qBAAqB,aAAa,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,QAAQ,GAAG,KAAK,CAAC,CAAC,WAAM,aAAa,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,QAAQ,GAAG,KAAK,CAAC,CAAC;AAAA,EACzJ;AACA,QAAM,KAAK,EAAE;AACb,QAAM,QAAQ,CAAC,MAAgB,IAAI,aAAa;AAChD,MAAI,KAAK,mBAAmB,MAAM,GAAG,CAAC,CAAC,WAAM,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,MAAM,GAAG,IAAI,eAAe,EAAE,EAAE;AAC9F,MAAI,KAAK,EAAE;AACX,MAAI;AAAA,IACF,aAAa,EAAE,cAAc,MAAM,mBAAgB,EAAE,gBAAgB,MAAM,mBAAgB,EAAE,cAAc;AAAA,EAC7G;AACA,MAAI,EAAE,cAAc,QAAQ;AAC1B,QAAI,KAAK,EAAE;AACX,QAAI,KAAK,kBAAkB;AAC3B,QAAI,KAAK,GAAG,aAAa,EAAE,aAAa,CAAC;AAAA,EAC3C;AACA,MAAI,EAAE,gBAAgB,QAAQ;AAC5B,QAAI,KAAK,EAAE;AACX,QAAI,KAAK,4BAA4B;AACrC,QAAI,KAAK,GAAG,aAAa,EAAE,eAAe,CAAC;AAAA,EAC7C;AACA,MAAI,KAAK,EAAE;AACX,MAAI,KAAK,gEAA0D;AACnE,SAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA;AAC1B;;;AC/GO,SAAS,gBAAgB,UAAmD;AACjF,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,UAAU;AACxB,UAAM,IAAI,WAAW,EAAE,EAAE;AACzB,QAAI,GAAG;AACL,WAAK,IAAI,EAAE,GAAG;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAmNO,SAAS,mBAAmB,MAAsC;AACvE,QAAM,QAAQ,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AACzE,QAAM,MAAM,oBAAI,IAAoB;AACpC,MAAI,UAAU;AACd,aAAW,KAAK,MAAM;AACpB,QAAI,EAAE,WAAW,QAAQ;AACvB;AAAA,IACF;AACA,eAAW,OAAO,IAAI,IAAI,EAAE,UAAU,GAAG;AACvC,UAAI,IAAI,MAAM,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC;AAAA,IACtC;AAAA,EACF;AACA,QAAM,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,EACjC,IAAI,CAAC,CAAC,KAAK,QAAQ,OAAO,EAAE,KAAK,OAAO,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,EAAE,EAC1E,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAC3E,SAAO,EAAE,SAAS,KAAK,QAAQ,SAAS,YAAY,MAAM,CAAC,GAAG,IAAI,EAAE;AACtE;AAGO,SAAS,gBAAgB,GAAsB;AACpD,MAAI,EAAE,YAAY,GAAG;AACnB,WAAO;AAAA,EACT;AACA,QAAM,MAAgB,CAAC;AACvB,MAAI,KAAK,8BAAyB,EAAE,OAAO,sBAAsB,EAAE,YAAY,IAAI,KAAK,GAAG,EAAE;AAC7F,MAAI,KAAK,EAAE;AACX,QAAM,OAAO,KAAK,MAAO,MAAM,EAAE,UAAW,EAAE,OAAO;AACrD,MAAI,KAAK,YAAY,EAAE,OAAO,IAAI,EAAE,OAAO,cAAc,IAAI,uCAAkC;AAC/F,MAAI,KAAK,EAAE;AACX,MAAI,EAAE,WAAW,WAAW,GAAG;AAC7B,QAAI,KAAK,yDAAyD;AAAA,EACpE,OAAO;AACL,QAAI,KAAK,iCAAiC;AAC1C,eAAW,KAAK,EAAE,YAAY;AAC5B,UAAI,KAAK,KAAK,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE;AAAA,IAClD;AAAA,EACF;AACA,MAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA;AAC1B;;;ACjSA,SAAS,gBAAAG,eAAc,mBAAmB;AAC1C,SAAS,YAAAC,WAAU,WAAAC,UAAS,QAAAC,aAAY;AA0BxC,IAAM,cAAc;AA2DpB,IAAM,UAAU,OAAiC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AAMpF,SAAS,iBAAiB,SAAiC;AAChE,QAAM,QAAQC,UAAS,QAAQ,QAAQ,OAAO,EAAE,CAAC,KAAK;AACtD,QAAM,MAAMC,MAAK,SAAS,WAAW;AACrC,QAAM,UAAUC,SAAQ,GAAG;AAC3B,QAAM,QAAQ,eAAe,OAAO;AACpC,QAAM,UAAuD,CAAC;AAC9D,MAAI;AACF,eAAW,KAAK,YAAY,GAAG,GAAG;AAChC,UAAI,CAAC,EAAE,SAAS,OAAO,KAAK,YAAY,KAAK,CAAC,EAAG;AACjD,YAAM,OAAO,EAAE,QAAQ,YAAY,EAAE;AACrC,UAAI;AACF,gBAAQ,KAAK,EAAE,KAAKC,cAAaF,MAAK,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC;AAAA,MAChE,QAAQ;AACN,gBAAQ,KAAK,EAAE,KAAK,MAAM,KAAK,CAAC;AAAA,MAClC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,aAAW,EAAE,KAAK,KAAK,gBAAgB,OAAO,GAAG;AAC/C,YAAQ,KAAK,EAAE,KAAK,eAAe,MAAM,OAAO,GAAG,KAAK,CAAC;AAAA,EAC3D;AAEA,QAAM,MAAsB,CAAC;AAC7B,aAAW,EAAE,KAAK,KAAK,KAAK,SAAS;AACnC,QAAI,OAAO,KAAM;AACjB,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,GAAG;AAAA,IACxB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,QAAS;AAC7B,UAAM,IAAI,IAAI,QAAQ;AACtB,UAAM,WAAW,EAAE,YAAY,CAAC;AAChC,UAAM,aAAa,QAAQ;AAC3B,eAAW,KAAK,UAAU;AACxB,iBAAW,EAAE,QAAQ;AAAA,IACvB;AACA,UAAM,aAAa,EAAE,OAAO,SAAS,SAAU,EAAE,MAAM,OAAO,UAAU,IAAK;AAC7E,QAAI,KAAK;AAAA,MACP,MAAM;AAAA,MACN,OAAO,EAAE,SAAS,SAAS;AAAA;AAAA,MAE3B,SAAS,EAAE,SAAS,eAAe,EAAE,SAAS;AAAA,MAC9C,OAAO,EAAE;AAAA,MACT,UAAU,SAAS;AAAA,MACnB;AAAA,MACA,SAAS,EAAE,SAAS;AAAA,MACpB,SAAS;AAAA,MACT,SAAS,EAAE,SAAS;AAAA,MACpB,UAAU,MAAM,IAAI,IAAI;AAAA,IAC1B,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,IAAM,SAAS,CAAC,MAAsB,KAAK,MAAM,IAAI,GAAG,IAAI;AAC5D,IAAM,cAAc,CAAC,MAClB,CAAC,YAAY,QAAQ,UAAU,KAAK,EAAY,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;AAGhE,SAAS,aAAa,UAA0C;AACrE,QAAM,UAAU,oBAAI,IAAwB;AAC5C,QAAM,WAAW,oBAAI,IAAyB;AAC9C,QAAM,OAAO,QAAQ;AACrB,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,WAAW;AACf,MAAI,WAAW;AACf,MAAI,YAAY;AAEhB,QAAM,SAAS,CAAC,KAA+B,QAAkC;AAC/E,eAAW,KAAK,OAAO,KAAK,GAAG,EAAiB,KAAI,CAAC,KAAK,IAAI,CAAC;AAAA,EACjE;AAEA,aAAW,KAAK,UAAU;AACxB,QAAI,OAAO,QAAQ,IAAI,EAAE,IAAI;AAC7B,QAAI,CAAC,MAAM;AACT,aAAO;AAAA,QACL,MAAM,EAAE;AAAA,QACR,UAAU;AAAA,QACV,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,YAAY,QAAQ;AAAA,QACpB,SAAS;AAAA,QACT,SAAS;AAAA,QACT,QAAQ,CAAC;AAAA,MACX;AACA,cAAQ,IAAI,EAAE,MAAM,IAAI;AAAA,IAC1B;AACA,QAAI,QAAQ,SAAS,IAAI,EAAE,KAAK;AAChC,QAAI,CAAC,OAAO;AACV,cAAQ;AAAA,QACN,OAAO,EAAE;AAAA,QACT,UAAU;AAAA,QACV,UAAU;AAAA,QACV,SAAS;AAAA,QACT,UAAU;AAAA,QACV,YAAY,QAAQ;AAAA,QACpB,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AACA,eAAS,IAAI,EAAE,OAAO,KAAK;AAAA,IAC7B;AACA,SAAK;AACL,QAAI,EAAE,SAAU,MAAK;AACrB,SAAK,WAAW,EAAE;AAClB,SAAK,YAAY,EAAE;AACnB,WAAO,KAAK,YAAY,EAAE,UAAU;AACpC,QAAI,CAAC,KAAK,OAAO,SAAS,EAAE,KAAK,EAAG,MAAK,OAAO,KAAK,EAAE,KAAK;AAC5D,UAAM;AACN,QAAI,EAAE,SAAU,OAAM;AACtB,UAAM,WAAW,EAAE;AACnB,UAAM,YAAY,EAAE;AACpB,WAAO,MAAM,YAAY,EAAE,UAAU;AACrC,aAAS,EAAE;AACX,QAAI,EAAE,SAAU;AAChB,aAAS,EAAE;AACX,WAAO,MAAM,EAAE,UAAU;AAEzB,QAAI,EAAE,WAAW,QAAQ,EAAE,WAAW,MAAM;AAC1C,WAAK,WAAW,EAAE;AAClB,WAAK,WAAW,EAAE;AAClB,YAAM,WAAW,EAAE;AACnB,YAAM,WAAW,EAAE;AACnB,kBAAY,EAAE;AACd,kBAAY,EAAE;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,aAAa,CAAC,OAA+B,EAAE,GAAG,GAAG,SAAS,OAAO,EAAE,OAAO,EAAE;AACtF,QAAM,cAAc,CAAC,OAAiC,EAAE,GAAG,GAAG,SAAS,OAAO,EAAE,OAAO,EAAE;AACzF,QAAM,QAAQ,CAAC,GAAG,QAAQ,OAAO,CAAC,EAAE,IAAI,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;AACxF,QAAM,SAAS,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,IAAI,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,OAAO;AAE3F,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,MACN,OAAO,MAAM;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,UAAU;AAAA,MACV,SAAS,OAAO,KAAK;AAAA,MACrB,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,UAAU,WAAW,IAAI,OAAO,WAAW,QAAQ,IAAI;AAAA,IACzD;AAAA,EACF;AACF;AAGO,SAAS,sBAAsB,UAAoC;AACxE,QAAM,MAAsB,CAAC;AAC7B,aAAW,KAAK,SAAU,KAAI,KAAK,GAAG,iBAAiB,CAAC,CAAC;AACzD,SAAO,aAAa,GAAG;AACzB;AAEA,IAAM,UAAU,CAAC,MAAwC;AACvD,QAAM,QAAkB,CAAC;AACzB,MAAI,EAAE,SAAU,OAAM,KAAK,GAAG,EAAE,QAAQ,QAAG;AAC3C,MAAI,EAAE,KAAM,OAAM,KAAK,GAAG,EAAE,IAAI,cAAI;AACpC,MAAI,EAAE,OAAQ,OAAM,KAAK,GAAG,EAAE,MAAM,WAAI;AACxC,MAAI,EAAE,IAAK,OAAM,KAAK,GAAG,EAAE,GAAG,MAAG;AACjC,SAAO,MAAM,KAAK,GAAG,KAAK;AAC5B;AACA,IAAM,UAAU,CAAC,SAAiB,YAChC,UAAU,IAAI,GAAG,KAAK,MAAO,UAAU,UAAW,GAAG,CAAC,MAAM;AAGvD,SAAS,YAAY,GAAkB;AAC5C,MAAI,EAAE,OAAO,aAAa,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,QAAM,QAAkB,CAAC;AACzB,QAAM;AAAA,IACJ,gBAAW,EAAE,OAAO,QAAQ,WAAW,EAAE,OAAO,aAAa,IAAI,KAAK,GAAG,WAAW,EAAE,OAAO,KAAK,QAAQ,EAAE,OAAO,UAAU,IAAI,KAAK,GAAG,SAAM,EAAE,OAAO,MAAM,SAAS,EAAE,OAAO,WAAW,IAAI,KAAK,GAAG;AAAA,EACzM;AACA,QAAM,KAAK,EAAE;AACb,QAAM,MAAM,EAAE,OAAO,YAAY,OAAO,WAAM,GAAG,KAAK,MAAM,EAAE,OAAO,WAAW,GAAG,CAAC;AACpF,QAAM;AAAA,IACJ,qBAAqB,iBAAiB,EAAE,OAAO,OAAO,CAAC,kBAAe,GAAG,SAAM,EAAE,OAAO,QAAQ,iBAAiB,EAAE,OAAO,aAAa,IAAI,KAAK,GAAG,KAAK,QAAQ,EAAE,OAAO,UAAU,CAAC;AAAA,EACtL;AACA,QAAM;AAAA,IACJ,iBAAiB,EAAE,OAAO,QAAQ,IAAI,EAAE,OAAO,QAAQ,WAAW,EAAE,OAAO,aAAa,IAAI,KAAK,GAAG;AAAA,EACtG;AACA,QAAM,KAAK,EAAE;AAEb,QAAM,QAAQ,EAAE,MAAM,IAAI,CAAC,OAAO;AAAA,IAChC,MAAM,EAAE;AAAA,IACR,GAAG,OAAO,EAAE,QAAQ;AAAA,IACpB,QAAQ,EAAE,OAAO,KAAK,IAAI;AAAA,IAC1B,MAAM,iBAAiB,EAAE,OAAO;AAAA,IAChC,KAAK,QAAQ,EAAE,SAAS,EAAE,OAAO;AAAA,IACjC,SACE,EAAE,aAAa,IACX,MACA,GAAG,EAAE,QAAQ,IAAI,YAAY,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,EAAE,GAAG,KAAK;AAAA,EACvF,EAAE;AACF,QAAM,IAAI,CAAC,KAAmC,SAC5C,KAAK,IAAI,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;AAC1D,QAAM,KAAK,EAAE,QAAQ,MAAM;AAC3B,QAAM,KAAK,EAAE,KAAK,GAAG;AACrB,QAAM,KAAK,EAAE,UAAU,QAAQ;AAC/B,QAAM,KAAK,EAAE,QAAQ,OAAO;AAC5B,QAAM,KAAK,EAAE,OAAO,OAAO;AAC3B,QAAM;AAAA,IACJ,GAAG,OAAO,OAAO,EAAE,CAAC,KAAK,IAAI,OAAO,EAAE,CAAC,KAAK,SAAS,OAAO,EAAE,CAAC,KAAK,QAAQ,OAAO,EAAE,CAAC,KAAK,QAAQ,OAAO,EAAE,CAAC;AAAA,EAC/G;AACA,aAAW,KAAK,OAAO;AACrB,UAAM;AAAA,MACJ,GAAG,EAAE,KAAK,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO;AAAA,IAC1H;AAAA,EACF;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,WAAW;AACtB,aAAW,KAAK,EAAE,QAAQ;AACxB,UAAM;AAAA,MACJ,KAAK,EAAE,KAAK,WAAM,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG,SAAM,iBAAiB,EAAE,OAAO,CAAC,eAAY,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,SAAM,EAAE,QAAQ;AAAA,IAC9J;AAAA,EACF;AACA,QAAM,KAAK,EAAE;AACb,QAAM;AAAA,IACJ;AAAA,EACF;AACA,SAAO,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA;AAC5B;;;ACjUA,SAAS,gBAAAG,eAAc,eAAAC,oBAAmB;AAC1C,SAAS,WAAAC,UAAS,QAAAC,cAAY;AAmB9B,IAAMC,YAAqC,EAAE,UAAU,UAAK,MAAM,gBAAM,QAAQ,aAAM,KAAK,OAAI;AAC/F,IAAM,WAAqC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AAarF,IAAMC,eAAc;AAEpB,SAASC,YACP,OACQ;AACR,MAAI,CAAC,SAAS,MAAM,SAAS,UAAW,QAAO;AAC/C,MAAI,MAAM,SAAS,SAAU,QAAO,UAAU,MAAM,UAAU,GAAG;AACjE,SAAO,SAAS,MAAM,SAAS,CAAC,GAAG,MAAM;AAC3C;AAEA,SAAS,QAAQ,IAAgC;AAC/C,MAAI,CAAC,MAAM,CAAC,OAAO,SAAS,EAAE,EAAG,QAAO,SAAI,OAAO,EAAE;AACrD,SAAO,IAAI,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE;AAC/C;AAIO,SAAS,mBAAmB,KAAyB;AAC1D,MAAI;AACJ,MAAI;AACF,YAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,KAAK,CAACF,aAAY,KAAK,CAAC,CAAC;AAAA,EACpF,QAAQ;AACN,YAAQ,CAAC;AAAA,EACX;AACA,QAAM,UAAuD,MAAM,IAAI,CAAC,MAAM;AAC5E,QAAI;AACF,aAAO,EAAE,MAAM,GAAG,KAAKG,cAAaC,OAAK,KAAK,CAAC,GAAG,MAAM,EAAE;AAAA,IAC5D,QAAQ;AACN,aAAO,EAAE,MAAM,GAAG,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF,CAAC;AAGD,QAAM,OAAOC,SAAQ,GAAG;AACxB,aAAW,EAAE,KAAK,KAAK,gBAAgB,IAAI,GAAG;AAC5C,YAAQ,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,KAAK,eAAe,MAAM,IAAI,EAAE,CAAC;AAAA,EACvE;AACA,QAAM,UAAsB,CAAC;AAC7B,aAAW,EAAE,MAAM,GAAG,IAAI,KAAK,SAAS;AACtC,QAAI,OAAO,MAAM;AACf;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,GAAG;AAAA,IACxB,QAAQ;AACN;AAAA,IACF;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,QAAS;AAC7B,UAAM,IAAI,IAAI,QAAQ;AACtB,UAAM,KAAK,EAAE,YAAY,CAAC;AAC1B,QAAIC;AACJ,eAAW,KAAK,IAAI;AAClB,UAAI,CAACA,gBAAe,SAAS,EAAE,QAAQ,IAAI,SAASA,YAAW,EAAG,CAAAA,eAAc,EAAE;AAAA,IACpF;AACA,YAAQ,KAAK;AAAA,MACX,MAAM,EAAE,QAAQ,YAAY,EAAE;AAAA,MAC9B,OAAO,EAAE;AAAA,MACT,SAAS,EAAE,SAAS,eAAe,EAAE,SAAS;AAAA,MAC9C,UAAU,GAAG;AAAA,MACb,aAAAA;AAAA,MACA,OAAOL,YAAW,EAAE,KAAK;AAAA,MACzB,SAAS,EAAE,SAAS;AAAA,IACtB,CAAC;AAAA,EACH;AAEA,UAAQ,KAAK,CAAC,GAAG,OAAO,EAAE,WAAW,MAAM,EAAE,WAAW,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC1F,SAAO;AACT;AAGO,SAAS,UAAU,SAA8B,QAAQ,QAAQ,QAAgB;AACtF,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,OAAO,QAAQ,IAAI,CAAC,MAAM;AAC9B,UAAM,WACJ,EAAE,aAAa,IACX,MACA,GAAG,EAAE,QAAQ,IAAI,EAAE,cAAcF,UAAS,EAAE,WAAW,IAAI,EAAE,GAAG,KAAK;AAC3E,WAAO;AAAA,MACL,MAAM,QAAQ,EAAE,OAAO;AAAA,MACvB,OAAO,EAAE;AAAA,MACT,MAAM,iBAAiB,EAAE,OAAO;AAAA,MAChC;AAAA,MACA,OAAO,EAAE;AAAA,MACT,MAAM,EAAE;AAAA,IACV;AAAA,EACF,CAAC;AACD,QAAM,IAAI,CAAC,KAAkCQ,UAC3C,KAAK,IAAIA,MAAK,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;AACzD,QAAM,QAAQ,EAAE,QAAQ,MAAM;AAC9B,QAAM,SAAS,KAAK,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;AAC7D,QAAM,QAAQ,EAAE,QAAQ,MAAM;AAC9B,QAAM,QAAQ,EAAE,YAAY,UAAU;AACtC,QAAM,SAAS,EAAE,SAAS,OAAO;AACjC,QAAM,OAAO,GAAG,OAAO,OAAO,KAAK,CAAC,KAAK,QAAQ,OAAO,MAAM,CAAC,KAAK,OAAO,OAAO,KAAK,CAAC,KAAK,WAAW,OAAO,KAAK,CAAC,KAAK,QAAQ,OAAO,MAAM,CAAC;AAChJ,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,MACC,GAAG,EAAE,KAAK,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,OAAO,KAAK,CAAC,KAAK,EAAE,SAAS,OAAO,KAAK,CAAC,KAAK,EAAE,MAAM,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI;AAAA,EAClJ;AACA,QAAM,SAAS,sCAAiC,KAAK,WAAW,UAAU,IAAI,KAAK,GAAG,GAAG,QAAQ,SAAS,QAAQ,aAAa,QAAQ,MAAM,KAAK,EAAE;AACpJ,SAAO,GAAG,MAAM;AAAA;AAAA,EAAO,IAAI;AAAA,EAAK,MAAM,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAClD;;;AC7HA,IAAM,YAAY;AAGX,SAAS,WAAW,QAAwB;AACjD,SAAO,OAAO,QAAQ,UAAU,GAAG;AACrC;AAYO,SAAS,UAAU,OAA0B,WAA2C;AAC7F,QAAM,OAAiB,CAAC;AACxB,QAAM,SAAmB,CAAC;AAC1B,aAAW,KAAK,OAAO;AACrB,UAAM,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK;AACnC,UAAM,OAAO,KAAK,QAAQ,YAAY,EAAE;AACxC,QAAI,UAAU,KAAK,IAAI,KAAK,UAAU,IAAI,IAAI,GAAG;AAC/C,WAAK,KAAK,CAAC;AAAA,IACb,OAAO;AACL,aAAO,KAAK,CAAC;AAAA,IACf;AAAA,EACF;AACA,SAAO,EAAE,MAAM,OAAO;AACxB;;;ACzCA,SAAS,gBAAAC,eAAc,eAAAC,oBAAmB;AAC1C,SAAS,QAAAC,cAAY;AAiBrB,IAAMC,eAAc;AAkBb,SAAS,aAAa,KAA2B;AACtD,MAAI;AACJ,MAAI;AACF,YAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,KAAK,CAACD,aAAY,KAAK,CAAC,CAAC;AAAA,EACpF,QAAQ;AACN,YAAQ,CAAC;AAAA,EACX;AACA,QAAM,SAAsC,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE;AACrE,QAAM,MAAM,oBAAI,IAGd;AACF,MAAI,WAAW;AACf,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,gBAAgB;AAEpB,aAAW,KAAK,OAAO;AACrB,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAME,cAAaC,OAAK,KAAK,CAAC,GAAG,MAAM,CAAC;AAAA,IACvD,QAAQ;AACN;AACA;AAAA,IACF;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B;AACA;AAAA,IACF;AACA;AACA,UAAM,IAAI,IAAI,QAAQ;AACtB,WAAO,EAAE,KAAK,KAAK,OAAO,EAAE,KAAK,KAAK,KAAK;AAC3C,UAAM,WAAW,EAAE,YAAY,CAAC;AAChC,QAAI,SAAS,OAAQ;AACrB,qBAAiB,SAAS;AAE1B,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,WAAW,UAAU;AAC9B,YAAM,IAAI,WAAW,QAAQ,EAAE;AAC/B,UAAI,CAAC,EAAG;AACR,YAAM,MAAM,IAAI,IAAI,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,UAAU,GAAG,UAAU,EAAE;AACvF,UAAI;AACJ,UAAI,CAAC,KAAK,IAAI,EAAE,GAAG,GAAG;AACpB,YAAI;AACJ,aAAK,IAAI,EAAE,GAAG;AAAA,MAChB;AACA,UAAI,IAAI,EAAE,KAAK,GAAG;AAAA,IACpB;AAAA,EACF;AAEA,QAAM,aAAa,CAAC,GAAG,IAAI,QAAQ,CAAC,EACjC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,EAAE,EAAE,EACjC,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAE3E,SAAO,EAAE,UAAU,SAAS,SAAS,QAAQ,YAAY,cAAc;AACzE;AAGO,SAAS,YAAY,GAAyB;AACnD,MAAI,EAAE,aAAa,EAAG,QAAO;AAC7B,QAAM,MAAgB,CAAC;AACvB,MAAI;AAAA,IACF,8BAAyB,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG;AAAA,EAC3E;AACA,MAAI,KAAK,EAAE;AACX,QAAM,MAAM,CAAC,MAAc,GAAG,KAAK,MAAO,MAAM,IAAK,EAAE,QAAQ,CAAC;AAChE,MAAI;AAAA,IACF,uBAAgB,EAAE,OAAO,CAAC,qBAAW,EAAE,OAAO,CAAC,qBAAW,EAAE,OAAO,CAAC,qBAAW,EAAE,OAAO,CAAC;AAAA,EAC3F;AACA,MAAI,KAAK,YAAY,EAAE,OAAO,IAAI,EAAE,QAAQ,cAAc,IAAI,EAAE,OAAO,CAAC,2BAAsB;AAC9F,MAAI,KAAK,EAAE;AACX,MAAI,EAAE,WAAW,WAAW,GAAG;AAC7B,QAAI,KAAK,iEAA4D;AAAA,EACvE,OAAO;AACL,QAAI;AAAA,MACF,oBAAoB,EAAE,aAAa,oBAAoB,EAAE,WAAW,MAAM;AAAA,IAC5E;AACA,eAAW,KAAK,EAAE,YAAY;AAC5B,UAAI;AAAA,QACF,KAAK,EAAE,IAAI,IAAI,EAAE,MAAM,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG,OAAO,EAAE,QAAQ,WAAW,EAAE,aAAa,IAAI,KAAK,GAAG;AAAA,MAC9I;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,SAAS;AACb,QAAI,KAAK,IAAI,IAAI,EAAE,OAAO,4BAA4B,EAAE,YAAY,IAAI,KAAK,GAAG,WAAW;AAAA,EAC7F;AACA,MAAI,KAAK,IAAI,mFAA6E;AAC1F,SAAO,GAAG,IAAI,KAAK,IAAI,CAAC;AAAA;AAC1B;;;ACzEO,IAAM,oBAAuC;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,mBAAsC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AACF;AAIA,IAAM,sBAAyC,CAAC,uBAAuB,sBAAsB;AAOtF,IAAM,yBAA8C,oBAAI,IAAY;AAAA,EACzE,GAAG,cAAc,QAAQ,CAAC,MAAM,EAAE,QAAQ;AAAA,EAC1C,GAAG;AAAA,EACH,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAIM,SAAS,uBAAuB,KAG1B;AACX,SAAO,CAAC,GAAI,IAAI,aAAa,CAAC,GAAI,GAAI,IAAI,cAAc,CAAC,CAAE,EAAE;AAAA,IAC3D,CAAC,MAAM,CAAC,uBAAuB,IAAI,CAAC;AAAA,EACtC;AACF;AAEA,IAAM,gBAAgB,CAAC,IAAY,aACjC,SAAS,KAAK,CAAC,MAAM,OAAO,KAAK,GAAG,WAAW,GAAG,CAAC,GAAG,CAAC;AAEzD,IAAM,OAAO,CAAC,MACZ,GAAG,EAAE,EAAE,GAAG,EAAE,WAAW,KAAK,EAAE,QAAQ,MAAM,EAAE,cAAc,KAAK,EAAE,WAAW,MAAM,EAAE;AAMjF,SAAS,YAAY,GAAqB,QAAkC;AACjF,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,SAAS,YAAY,SAAS,CAAC,EAAE;AAAA,EAC5C;AAEA,QAAM,OAAO,EAAE,SAAS,OAAO,CAAC,MAAM,EAAE,cAAc,GAAG;AACzD,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,aAAa,OAAO,cAAc;AAGxC,QAAM,QAAyB,CAAC;AAChC,aAAW,KAAK,MAAM;AACpB,QAAI,cAAc,EAAE,IAAI,SAAS,GAAG;AAClC,YAAM,KAAK,EAAE,MAAM,aAAa,MAAM,KAAK,CAAC,GAAG,aAAa,QAAQ,CAAC;AAAA,IACvE;AAAA,EACF;AACA,MAAI,OAAO,mBAAmB,EAAE,SAAS,aAAa,eAAe,UAAU;AAC7E,UAAM,KAAK;AAAA,MACT,MAAM;AAAA,MACN,MAAM;AAAA,MACN,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,WAAO,EAAE,SAAS,SAAS,SAAS,MAAM;AAAA,EAC5C;AAGA,QAAM,aAA8B,CAAC;AACrC,aAAW,KAAK,OAAO,WAAW,CAAC,GAAG;AACpC,SAAK,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,YAAY,aAAa,SAAS;AACzE,iBAAW,KAAK;AAAA,QACd,MAAM;AAAA,QACN,MAAM,UAAU,EAAE,UAAU,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,oBAAoB,EAAE;AAAA,QACrF,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF;AACA,aAAW,KAAK,MAAM;AACpB,QAAI,cAAc,EAAE,IAAI,mBAAmB,GAAG;AAC5C,iBAAW,KAAK,EAAE,MAAM,cAAc,MAAM,KAAK,CAAC,GAAG,aAAa,aAAa,CAAC;AAAA,IAClF;AAAA,EACF;AACA,MAAI,WAAW,SAAS,GAAG;AACzB,WAAO,EAAE,SAAS,cAAc,SAAS,WAAW;AAAA,EACtD;AAGA,QAAM,WAA4B,CAAC;AACnC,aAAW,KAAK,MAAM;AACpB,QAAI,cAAc,EAAE,IAAI,UAAU,GAAG;AACnC,eAAS,KAAK,EAAE,MAAM,eAAe,MAAM,KAAK,CAAC,GAAG,aAAa,WAAW,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,WAAO,EAAE,SAAS,YAAY,SAAS,SAAS;AAAA,EAClD;AAGA,SAAO,EAAE,SAAS,YAAY,SAAS,CAAC,EAAE;AAC5C;AAIO,SAAS,gBAAgB,GAAoB;AAClD,SAAO,MAAM,WAAW,MAAM,eAAe,IAAI;AACnD;;;ACzLA,SAAS,gBAAAC,qBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,gBAAAC,eAAc,eAAAC,cAAa,gBAAgB;AACpD,SAAS,QAAAC,cAAY;;;ACOrB,IAAM,MAAM;AASZ,SAAS,WAAW,MAAc,YAA8C;AAC9E,MAAI,WAAW,WAAW,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,aAAW,MAAM,YAAY;AAC3B,QACE,OAAO,QACN,KAAK,SAAS,GAAG,KAAK,GAAG,SAAS,IAAI,IAAI,EAAE,KAC5C,GAAG,SAAS,GAAG,KAAK,KAAK,SAAS,IAAI,EAAE,EAAE,GAC3C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,KAA4B;AAC3C,QAAM,IAAI,OAAO,OAAO,EAAE,EAAE,YAAY;AACxC,SAAO,MAAM,WAAW,MAAM,aAAa,MAAM,SAAS,IAAI;AAChE;AAkBO,SAAS,YACd,WACA,YACA,MAAM,KAC8D;AACpE,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,SAAS;AAAA,EAC/B,QAAQ;AACN,WAAO,EAAE,SAAS,CAAC,GAAG,cAAc,CAAC,EAAE;AAAA,EACzC;AACA,QAAM,OACJ,UAAU,OAAO,WAAW,YAAY,MAAM,QAAS,OAA8B,IAAI,IACnF,OAA6C,QAAQ,CAAC,IACxD,CAAC;AAEP,QAAM,MAAuB,CAAC;AAC9B,QAAM,eAAuC,CAAC;AAC9C,aAAWC,QAAO,MAAM;AACtB,UAAM,UAAU,MAAM,QAAQA,MAAK,OAAO,IAAKA,KAAI,UAA8B,CAAC;AAClF,eAAW,KAAK,SAAS;AACvB,YAAM,MAAM,EAAE,YAAY,CAAC,GAAG;AAC9B,YAAM,MAAM,OAAO,KAAK,kBAAkB,QAAQ,WAAW,IAAI,iBAAiB,MAAM;AACxF,YAAM,OAAO,MAAM,WAAW,KAAK,UAAU,IAAI;AACjD,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,QAAQ,QAAQ,EAAE,KAAK;AAC7B,YAAM,OAAO,OAAO,KAAK,QAAQ,cAAc,WAAW,IAAI,OAAO,YAAY;AACjF,YAAM,SAAwB;AAAA,QAC5B,QAAQ,OAAO,EAAE,WAAW,YAAY,EAAE,SAAS,EAAE,SAAS;AAAA,QAC9D;AAAA;AAAA,QACA;AAAA,QACA,GAAI,QAAQ,QAAQ,IAAI,EAAE,KAAK,IAAI,CAAC;AAAA,QACpC,GAAI,OAAO,EAAE,SAAS,SAAS,WAAW,EAAE,SAAS,EAAE,QAAQ,KAAK,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC;AAAA,MACzF;AAEA,mBAAa,KAAK,KAAK,aAAa,KAAK,KAAK,KAAK;AACnD,UAAI,KAAK,MAAM;AAAA,IACjB;AAAA,EACF;AAIA,MAAI;AAAA,IACF,CAAC,GAAG,OACD,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ,EAAE,MACxC,EAAE,QAAQ,MAAM,EAAE,QAAQ,MAC3B,EAAE,OAAO,cAAc,EAAE,MAAM,KAC/B,EAAE,MAAM,cAAc,EAAE,KAAK,MAC5B,EAAE,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE;AAAA,EACnD;AACA,SAAO,EAAE,SAAS,IAAI,MAAM,GAAG,GAAG,GAAG,aAAa;AACpD;;;AD9FA,SAAS,GAAG,KAAa,MAAgB,KAAsB;AAC7D,SAAOC,cAAa,KAAK,MAAM;AAAA,IAC7B,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IAClC,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,EACvB,CAAC;AACH;AAIA,SAAS,aAAa,KAA4B;AAChD,MAAI;AACF,UAAM,IAAI,WAAW,QAAQ;AAC7B,UAAM,OAAO,CAAC,MAAoB;AAChC,iBAAW,QAAQC,aAAY,CAAC,EAAE,KAAK,GAAG;AACxC,cAAM,IAAIC,OAAK,GAAG,IAAI;AACtB,cAAM,KAAK,SAAS,CAAC;AACrB,YAAI,GAAG,YAAY,GAAG;AACpB,eAAK,CAAC;AAAA,QACR,OAAO;AACL,YAAE,OAAO,IAAI;AACb,YAAE,OAAOC,cAAa,CAAC,CAAC;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AACA,SAAK,GAAG;AACR,WAAO,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,IAAM,iBAA0B;AAAA,EACrC,MAAM;AAAA,EACN,UAAU;AAAA,EACV,IAAI,KAA6C;AAC/C,UAAM,WAAW,QAAQ,IAAI;AAC7B,QAAI,CAAC,YAAY,IAAI,WAAW,WAAW,GAAG;AAC5C,aAAO;AAAA,IACT;AACA,UAAM,cAAc,aAAa,QAAQ;AACzC,QAAI,CAAC,aAAa;AAChB,aAAO;AAAA,IACT;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,GAAG,WAAW,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;AAAA,IAC7D,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,IACT;AACA,QAAI;AACJ,QAAI;AACF,YAAM,OAAO;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAI,IAAI,OAAO,CAAC,qBAAqB,IAAI,IAAI,IAAI,CAAC;AAAA,QAClD;AAAA;AAAA,QACA,GAAG,IAAI;AAAA,MACT;AAGA,cAAQ,GAAG,WAAW,MAAM,IAAI,QAAQ;AAAA,IAC1C,SAAS,GAAG;AAEV,YAAM,MAAO,EAAmC;AAChD,cAAQ,OAAO,QAAQ,WAAW,MAAM,MAAM,IAAI,SAAS,MAAM,IAAI;AACrE,UAAI,CAAC,OAAO;AACV,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,EAAE,SAAS,aAAa,IAAI,YAAY,OAAO,IAAI,UAAU;AACnE,WAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,UAAU;AAAA,MACV;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,GAAI,QAAQ,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtC;AAAA,EACF;AACF;;;AElCO,IAAM,WAA+B,CAAC,cAAc;AAOpD,SAAS,YAAY,KAAwC;AAClE,MAAI,QAAQ,IAAI,oCAAoC,KAAK;AACvD,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAyB,CAAC;AAChC,aAAW,KAAK,UAAU;AACxB,QAAI;AACF,YAAM,KAAK,EAAE,IAAI,GAAG;AACpB,UAAI,IAAI;AACN,YAAI,KAAK,EAAE;AAAA,MACb;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;;;AC9EA,IAAM,WAAW,oBAAI,IAAI,CAAC,qBAAqB,uBAAuB,YAAY,CAAC;AAa5E,SAAS,aAAa,SAAkB,UAA+B;AAC5E,QAAM,MAAM,CAAC,GAAG,SAAS,MAAM,GAAG,SAAS,KAAK;AAChD,QAAM,KAAK,QAAQ,UAAU;AAC7B,SAAO;AAAA,IACL,SAAS,QAAQ,QAAQ,CAAC,GAAG,OAAO,UAAU;AAAA,IAC9C,OAAO,QAAQ,UAAU;AAAA,IACzB,MAAM;AAAA,MACJ,cAAc,GAAG;AAAA,MACjB,OAAO,GAAG;AAAA,MACV,UAAU,GAAG;AAAA,MACb,OAAO,GAAG;AAAA,MACV,UAAU,GAAG;AAAA,IACf;AAAA,IACA,MAAM,IAAI,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,CAAC;AAAA,IACtE,MAAM,IACH,OAAO,CAAC,MAAM,EAAE,aAAa,UAAU,EAAE,aAAa,UAAU,EAChE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,OAAO,OAAO,EAAE,KAAK,EAAE,EAAE;AAAA,IAChE,MAAM,IACH,IAAI,CAAC,MAAM,EAAE,SAAS,EACtB,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC,EAC9B,IAAI,MAAM;AAAA,IACb,SAAS,IACN,IAAI,CAAC,MAAM,EAAE,aAAa,EAC1B,OAAO,CAAC,MAAmB,CAAC,CAAC,CAAC,EAC9B,IAAI,MAAM;AAAA,IACb,QAAQ,0DAA0D,QAAQ,QAAQ,CAAC,GAAG,OAAO,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC;AAAA,EACzH;AACF;AAEO,SAAS,sBAAsB,GAAoB;AACxD,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,0BAAqB,EAAE,KAAK,IAAI,EAAE;AAC7C,QAAM;AAAA,IACJ;AAAA,IACA,GAAG,EAAE,KAAK,YAAY,uBAAoB,EAAE,KAAK,KAAK,eAAY,EAAE,KAAK,QAAQ,kBAAe,EAAE,KAAK,KAAK,0BAAuB,EAAE,KAAK,WAAW,QAAQ,IAAI;AAAA,IACjK;AAAA,EACF;AACA,MAAI,EAAE,KAAK,QAAQ;AACjB,UAAM,KAAK,qBAAc,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE;AAAA,EAC7D;AACA,MAAI,EAAE,KAAK,QAAQ;AACjB,UAAM;AAAA,MACJ;AAAA,MACA,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,SAAS,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,MAAI,EAAE,KAAK,QAAQ;AACjB,UAAM,KAAK,wBAAc,GAAG,EAAE,KAAK,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE;AAAA,EAC7D;AACA,MAAI,EAAE,QAAQ,QAAQ;AACpB,UAAM,KAAK,wBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE;AAAA,EACnE;AACA,QAAM,KAAK,uBAAgB,KAAK,EAAE,MAAM,MAAM,EAAE;AAChD,SAAO,GAAG,MAAM,KAAK,IAAI,EAAE,QAAQ,CAAC;AAAA;AACtC;;;AC7CA,SAAS,cAAAC,aAAY,kBAAkB;AACvC,SAAS,cAAAC,aAAY,gBAAAC,sBAAoB;AACzC,SAAS,YAAAC,WAAU,QAAAC,cAAY;AAiC/B,IAAM,SAAS,CAAC,MAAsBC,YAAW,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,KAAK;AAkBlF,SAAS,oBAAoB,SAAkC;AACpE,QAAM,SAAyB,CAAC;AAChC,aAAW,KAAK,QAAQ,UAAU;AAChC,WAAO,KAAK,GAAG,cAAc,CAAC,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAGO,SAAS,cAAc,GAAmC;AAC/D,MAAI,EAAE,SAAS,aAAa;AAC1B,WAAO,CAAC;AAAA,EACV;AACA,QAAM,MAAsB,CAAC;AAC7B,QAAM,QAAQ,EAAE,QAAQ,IAAI,KAAK;AACjC,MAAI,SAAS,IAAI;AACf,QAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,EACjC;AACA,aAAW,KAAK,EAAE,aAAa,CAAC,GAAG;AACjC,QAAI,KAAK,EAAE,MAAM,QAAQ,MAAM,EAAE,MAAM,OAAO,EAAE,SAAS,KAAK,CAAC;AAAA,EACjE;AACA,SAAO;AACT;AAGO,SAAS,YAAY,OAA6B;AACvD,SAAO,OAAO,aAAa,KAAK,CAAC;AACnC;AAsBO,SAAS,WAAW,SAAkB,KAAgC;AAC3E,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,KAAK,oBAAoB,OAAO,GAAG;AAC5C,UAAM,IAAI,YAAY,CAAC;AACvB,SAAK,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC;AAAA,EACpC;AAEA,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI;AACJ,WAAS,IAAI,GAAG,IAAI,IAAI,OAAO,QAAQ,KAAK;AAC1C,UAAM,IAAI,IAAI,OAAO,CAAC;AACtB,UAAM,IAAI,KAAK,IAAI,CAAC,KAAK;AACzB,QAAI,IAAI,GAAG;AACT,WAAK,IAAI,GAAG,IAAI,CAAC;AACjB;AAAA,IACF,OAAO;AACL;AACA,UAAI,sBAAsB,QAAW;AACnC,4BAAoB;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,UAAU,IAAI,uBAAuB;AAAA,IAC3C,WAAW,IAAI,OAAO;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAGO,IAAM,uBAAuB;AAG7B,SAAS,WAAW,SAAyB;AAClD,QAAM,IAAI,OAAO,KAAK,SAAS,MAAM;AACrC,QAAM,IAAI,OAAO,KAAK,sBAAsB,MAAM;AAClD,SAAO,OAAO,OAAO;AAAA,IACnB,OAAO,KAAK,UAAU,EAAE,MAAM,IAAI,oBAAoB,IAAI,EAAE,MAAM,KAAK,MAAM;AAAA,IAC7E;AAAA,EACF,CAAC;AACH;AAWO,SAAS,iBACd,KACA,KACiB;AACjB,QAAM,MAAM,IAAI;AAChB,MAAI,CAAC,OAAO,OAAO,IAAI,UAAU,SAAU,QAAO;AAClD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,EAAE,KAAK,OAAO,GAAG,SAAS,IAAI;AACpC,QAAM,OAAO,WAAW,UAAU,GAAG,EAClC,OAAO,WAAW,aAAa,QAAQ,CAAC,CAAC,EACzC,OAAO,KAAK;AACf,SAAO,SAAS,IAAI,QAAQ,aAAa;AAC3C;AAgBO,SAAS,gBACd,SACA,KACA,KAC+B;AAC/B,QAAM,MAAMC,UAAS,QAAQ,YAAY,EAAE,EAAE,QAAQ,YAAY,EAAE;AACnE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,OAAOC,OAAK,KAAK,GAAG,GAAG,OAAO;AACpC,MAAI,CAACC,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAMC,eAAa,MAAM,MAAM,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ,IAAI,MAAM,KAAK,IAAI,OAAO,WAAW,EAAG,QAAO;AAClE,QAAM,IAAI,WAAW,SAAS,GAAG;AACjC,QAAM,MAAM,iBAAiB,KAAK,GAAG;AACrC,SAAO;AAAA,IACL,MAAM,EAAE;AAAA,IACR,WAAW,EAAE;AAAA,IACb,SAAS,EAAE;AAAA,IACX,QAAQ,QAAQ,aAAa,aAAa,QAAQ,aAAa,SAAS;AAAA,EAC1E;AACF;;;ACrPA,SAAS,cAAAC,aAAY,eAAAC,oBAAmB;AACxC,SAAS,YAAAC,WAAU,QAAAC,cAAY;AA2DxB,SAAS,sBAAsB,GAAYC,SAA0B;AAC1E,MAAI,eAAe,EAAE,EAAE,MAAM,SAAS;AACpC,WAAO;AAAA,EACT;AACA,MAAI,EAAE,aAAa,OAAO;AACxB,WAAO;AAAA,EACT;AACA,MACE,EAAE,GAAG,WAAW,aAAa,MAC5B,uBAAuB,EAAE,KAAK,KAC7B,yBAAyB,EAAE,KAAK,KAChC,qBAAqB,EAAE,KAAK,IAC9B;AACA,WAAO;AAAA,EACT;AACA,SACE,WAAW,EAAE,IAAI,EAAE,QAAQ,KAAK,EAAE,aAAa,cAAc,EAAE,aAAa,UAAUA;AAE1F;AAEA,IAAM,gBAAgB;AAGtB,IAAM,OAAO,CAAC,MAAsB,EAAE,QAAQ,SAAS,EAAE,EAAE,QAAQ,gBAAgB,EAAE;AAG9E,SAAS,aAAa,YAAwC;AACnE,QAAM,MAAM,GAAG,WAAW,QAAQ,aAAa,EAAE,CAAC;AAClD,SAAOC,YAAW,GAAG,IAAI,MAAM;AACjC;AAQA,eAAsB,qBACpB,YACA,OAA+C,CAAC,GACT;AACvC,QAAM,MAAM,aAAa,UAAU;AACnC,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQC,aAAY,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,CAAC;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM,QAAQ;AACjB,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,OAAO,IAAI,KAAK,KAAK,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC;AACrD,QAAM,YAAY,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,MAAMC,UAAS,CAAC,CAAC,CAAC;AAC3D,QAAM,WAAgC,CAAC;AACvC,MAAI,aAAa;AACjB,aAAW,QAAQ,MAAM,MAAM,GAAG,GAAG,GAAG;AACtC,QAAI;AACJ,QAAI;AAIF,YAAM,IAAI,MAAM,SAAS,eAAeC,OAAK,KAAK,IAAI,CAAC;AACvD,UAAI,CAAC,GAAG;AACN;AAAA,MACF;AACA,YAAM,UAAU,YAAY,CAAC;AAE7B,UAAI,QAAQ,aAAa,WAAW,KAAK,QAAQ,SAAS,WAAW,GAAG;AACtE;AAAA,MACF;AACA,YAAM,OAAO,eAAe,OAAO;AACnC,iBAAW;AAAA,QACT,OAAO,QAAQ,QAAQ,UAAU,EAAE,SAAS,IAAI,QAAQ,QAAQ,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG;AAAA,QACzF,SAASD,UAAS,IAAI,EACnB,QAAQ,WAAW,EAAE,EACrB,QAAQ,aAAa,EAAE;AAAA,QAC1B,UAAU,CAAC,GAAG,KAAK,MAAM,GAAG,KAAK,KAAK;AAAA,MACxC;AAAA,IACF,QAAQ;AACN;AAAA,IACF;AACA;AACA,eAAW,KAAK,SAAS,UAAU;AACjC,YAAMH,UACJ,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI,KAAK,EAAE,QAAQ,CAAC,KAAK,UAAU,IAAIG,UAAS,EAAE,QAAQ,CAAC;AACnF,UAAI,sBAAsB,GAAGH,OAAM,GAAG;AACpC,iBAAS,KAAK;AAAA,UACZ,SAAS,SAAS;AAAA,UAClB,OAAO,SAAS;AAAA,UAChB,IAAI,EAAE;AAAA,UACN,UAAU,EAAE;AAAA,UACZ,OAAO,EAAE;AAAA,UACT,QAAQ,EAAE;AAAA,UACV,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC;AAAA,QAC/C,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,OAAO,MAAM,QAAQ,YAAY,SAAS;AACrD;;;AzBxDA,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgHb,IAAM,WAAW,oBAAI,IAAa;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA+CM,SAAS,UAAU,MAA4B;AACpD,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,QAAM,SAAqB;AAAA,IACzB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,SAAS;AAAA,IACT,IAAI;AAAA,IACJ,OAAO,CAAC,QAAQ,IAAI,YAAY,QAAQ,OAAO,UAAU;AAAA,EAC3D;AACA,QAAM,cAAwB,CAAC;AAC/B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,QAAQ,MAAM,UAAU;AAChC,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,QAAQ,MAAM,aAAa;AAC1C,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,WAAW;AAC1B,YAAM,IAAI,KAAK,EAAE,CAAC;AAClB,UAAI;AACF,eAAO,QAAQ,EACZ,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AAAA,IACrB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO,KAAK,EAAE,CAAC;AAAA,IACxB,WAAW,MAAM,WAAW;AAC1B,aAAO,UAAU,KAAK,EAAE,CAAC;AAAA,IAC3B,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ;AAAA,IACjB,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,YAAY;AAC3B,aAAO,SAAS;AAAA,IAClB,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO;AAAA,IAChB,WAAW,MAAM,SAAS;AACxB,aAAO,MAAM,KAAK,EAAE,CAAC;AAAA,IACvB,WAAW,MAAM,YAAY;AAC3B,aAAO,SAAS,KAAK,EAAE,CAAC;AAAA,IAC1B,WAAW,MAAM,YAAY;AAC3B,aAAO,cAAc,KAAK,EAAE,CAAC;AAAA,IAC/B,WAAW,MAAM,UAAU;AACzB,aAAO,OAAO,KAAK,EAAE,CAAC;AAAA,IACxB,WAAW,MAAM,cAAc;AAC7B,aAAO,WAAW,KAAK,EAAE,CAAC;AAAA,IAC5B,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ,KAAK,EAAE,CAAC;AAAA,IACzB,WAAW,MAAM,gBAAgB;AAC/B,aAAO,aAAa,KAAK,EAAE,CAAC;AAAA,IAC9B,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU,KAAK,EAAE,CAAC;AAAA,IAC3B,WAAW,MAAM,UAAU;AACzB,YAAM,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC;AAC1B,UAAI,OAAO,SAAS,CAAC,KAAK,IAAI,GAAG;AAC/B,eAAO,OAAO,KAAK,MAAM,CAAC;AAAA,MAC5B;AAAA,IACF,WAAW,MAAM,aAAa;AAC5B,aAAO,SAAS;AAAA,IAClB,WAAW,MAAM,mBAAmB;AAClC,aAAO,eAAe;AAAA,IACxB,WAAW,MAAM,aAAa;AAC5B,aAAO,UAAU;AAAA,IACnB,WAAW,MAAM,QAAQ;AACvB,aAAO,KAAK;AAAA,IACd,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ;AAAA,IACjB,WAAW,MAAM,YAAY;AAC3B,aAAO,UAAU,KAAK,EAAE,CAAC,KAAK,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO;AAAA,IAC7D,WAAW,MAAM,WAAW;AAC1B,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,QAAQ,SAAS,EAAE,SAAS,IAAmB,GAAG;AACpD,eAAO,QAAQ;AACf;AAAA,MACF,WAAW,SAAS,YAAY,SAAS,WAAW,SAAS,OAAO;AAClE,eAAO,cAAc;AACrB;AAAA,MACF;AAAA,IACF,WAAW,MAAM,cAAc;AAC7B,aAAO,QAAQ;AAAA,IACjB,WAAW,MAAM,WAAW;AAC1B,aAAO,QAAQ;AAAA,IACjB,WAAW,CAAC,EAAE,WAAW,GAAG,GAAG;AAC7B,kBAAY,KAAK,CAAC;AAAA,IACpB;AAAA,EACF;AACA,MAAI,YAAY,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,CAAY,GAAG;AAC7D,WAAO,UAAU,YAAY,CAAC;AAC9B,WAAO,OAAO,YAAY,CAAC;AAC3B,WAAO,SAAS,YAAY,CAAC;AAAA,EAC/B,OAAO;AACL,WAAO,WAAW,YAAY,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAEA,eAAsB,IAAI,MAAiC;AACzD,QAAM,OAAO,UAAU,IAAI;AAE3B,MAAI,KAAK,SAAS;AAChB,YAAQ,OAAO,MAAM,GAAG,WAAW,CAAC;AAAA,CAAI;AACxC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAChC,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,YAAY,YAAY;AAC/B,WAAO,YAAY,KAAK,IAAI;AAAA,EAC9B;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU,KAAK,MAAM;AAAA,MAC1B,YAAY,KAAK;AAAA,MACjB,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,KAAK,MAAM,KAAK,QAAQ,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EAC3E;AACA,MAAI,KAAK,YAAY,OAAO;AAC1B,WAAO,OAAO,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EAC9E;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EAC/D;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,KAAK,YAAY,OAAO;AAC1B,WAAO,OAAO,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,EACtF;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,EAAE,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,EACzE;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,EAC9C;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,EAC9C;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU,KAAK,MAAM,EAAE,QAAQ,KAAK,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,MAAM,CAAC;AAAA,EACvF;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,WAAO,SAAS,KAAK,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EACpD;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,EAAE,SAAS,KAAK,SAAS,QAAQ,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,KAAK,MAAM,CAAC;AAAA,EAC/F;AACA,MAAI,KAAK,YAAY,QAAQ;AAC3B,WAAO,QAAQ,KAAK,MAAM,KAAK,eAAe,QAAQ;AAAA,EACxD;AACA,MAAI,KAAK,YAAY,gBAAgB;AACnC,WAAO,eAAe;AAAA,EACxB;AACA,MAAI,KAAK,YAAY,eAAe;AAClC,WAAO,cAAc;AAAA,EACvB;AACA,MAAI,KAAK,YAAY,YAAY;AAC/B,WAAO,YAAY,KAAK,MAAM;AAAA,MAC5B,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,cAAc;AAEjC,WAAO,cAAc;AAAA,MACnB,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU;AAAA,MACf,UAAU,KAAK;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,MAAM;AACzB,WAAO,MAAM;AAAA,MACX,KAAK,KAAK;AAAA,MACV,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,cAAc,KAAK;AAAA,MACnB,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IACjB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,aAAa;AAChC,WAAO,aAAa,EAAE,QAAQ,KAAK,YAAY,CAAC;AAAA,EAClD;AACA,MAAI,KAAK,YAAY,WAAW;AAE9B,QAAI,QAAQ,IAAI,qBAAqB,KAAK;AACxC,cAAQ,OAAO;AAAA,QACb;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,cAAc,KAAK;AAAA,MACnB,SAAS;AAAA,MACT,UAAU,KAAK;AAAA,IACjB,CAAC;AAAA,EACH;AACA,MAAI,KAAK,YAAY,UAAU;AAC7B,WAAO,UAAU,EAAE,UAAU,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAC9E;AACA,MAAI,KAAK,YAAY,WAAW;AAC9B,WAAO,WAAW,EAAE,UAAU,KAAK,MAAM,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,CAAC;AAAA,EAC/E;AACA,MAAI,KAAK,YAAY,OAAO;AAE1B,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,iBAAiB;AACrD,UAAM,WAAW;AAGjB,UAAM,IAAI,QAAc,CAAC,YAAY;AACnC,cAAQ,MAAM,KAAK,SAAS,OAAO;AACnC,cAAQ,MAAM,KAAK,OAAO,OAAO;AAAA,IACnC,CAAC;AACD,WAAO;AAAA,EACT;AAEA,MAAI,CAAE,MAAM,YAAY,GAAI;AAC1B,YAAQ,OAAO;AAAA,MACb,oCAAoC,UAAU,CAAC;AAAA;AAAA;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,MAAM,aAAa,KAAK,KAAK;AAE9C,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,WAAW,UAAU,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;AAChE,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,cAAc,UAAU,KAAK,QAAQ;AACrD,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,KAAK,WACD,uBAAuB,KAAK,QAAQ;AAAA,IACpC;AAAA,IACN;AACA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,YAAY,OAAO;AACnC,QAAM,WAAW,eAAe,OAAO;AAEvC,MAAI,KAAK,MAAM;AACb,QAAI,UAAU,MAAM,aAAa,SAAS,SAAS,QAAQ;AAC3D,QAAI,KAAK,QAAQ;AACf,gBAAU,cAAc,OAAO;AAAA,IACjC;AACA,UAAM,MAAM,KAAK,UAAU,aAAa,OAAO,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC;AAClF,QAAI,KAAK,KAAK;AACZ,MAAAK,eAAc,KAAK,KAAK,GAAG,GAAG;AAAA,CAAI;AAClC,cAAQ,OAAO,MAAM,sBAAsB,KAAK,GAAG;AAAA,CAAI;AACvD,aAAO;AAAA,IACT;AACA,SAAK,KAAK,KAAK,MAAM,SAAS;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,OAAO;AACd,UAAM,KAAK,oBAAoB,EAAE,SAAS,SAAS,SAAS,SAAS,CAAC;AACtE,SAAK,GAAG,QAAQ,GAAG,KAAK,MAAM,mBAAmB;AACjD,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,SAAS;AAChB,UAAM,UAAU,cAAc,MAAM,aAAa,SAAS,SAAS,QAAQ,CAAC;AAC5E,UAAM,KAAK,sBAAsB,aAAa,SAAS,QAAQ,CAAC;AAChE,SAAK,GAAG,QAAQ,GAAG,KAAK,MAAM,SAAS;AACvC,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,MAAM,WAAW,EAAE,SAAS,SAAS,SAAS,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;AACtF,SAAO;AACT;AAEA,SAASC,KAAI,MAAwB;AACnC,QAAM,IAAIC,WAAU,OAAO,MAAM,EAAE,UAAU,OAAO,CAAC;AACrD,SAAO,EAAE,WAAW,IAAI,EAAE,OAAO,KAAK,IAAI;AAC5C;AASA,IAAM,iBAAiB;AAWhB,SAAS,YAAY,SAAyB,OAAkC;AACrF,SAAO,QAAQ,aAAa,OAAO,CAAC,MAAM,OAAO,EAAE,MAAM,KAAK,CAAC,EAAE;AACnE;AAMO,SAAS,cAAc,MAA8B;AAC1D,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,QAAM,MAAMD,KAAI,CAAC,OAAO,aAAa,gBAAgB,GAAG,IAAI,QAAQ,CAAC;AACrE,QAAM,QAAQ,OAAO,IAAI,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;AAC/C,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,QAAQ,MAAO;AAC9D;AAKO,SAAS,eAAe,SAA6B,SAAiC;AAC3F,SAAO,WAAW,QAAQ,WAAW,QAAQ,UAAU;AACzD;AAaA,eAAe,YACb,KACA,QACA,UACA,OACA,UAAyB,MACzB,OAA0B,CAAC,GACI;AAC/B,QAAM,OAAO,OAAO,QAAuD;AACzE,UAAM,UAAU,MAAM,YAAY,GAAG;AACrC,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,IACT;AACA,WAAO,EAAE,SAAS,KAAK,SAAS,SAAS,YAAY,OAAO,EAAE;AAAA,EAChE;AASA,MAAI,KAAK,SAAS,GAAG;AACnB,eAAW,OAAO,IAAI,MAAM,GAAG,cAAc,GAAG;AAC9C,YAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,UAAI,QAAQ,eAAe,KAAK,QAAQ,OAAO,IAAI,GAAG;AACpD,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAGA,QAAM,aAAa,gBAAgB,KAAK,QAAQ,QAAQ;AACxD,QAAM,UAAU,aAAa,MAAM,KAAK,UAAU,IAAI;AACtD,MAAI,WAAW,YAAY,QAAQ,SAAS,KAAK,IAAI,GAAG;AACtD,WAAO;AAAA,EACT;AAQA,MAAI,OAA6B;AACjC,MAAI,YAAY;AAChB,QAAM,SAAS,IACZ,OAAO,CAAC,MAAM,OAAO,EAAE,aAAa,QAAQ,CAAC,EAC7C,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,OAAO,CAAC,EACjD,MAAM,GAAG,cAAc;AAC1B,aAAW,OAAO,QAAQ;AACxB,UAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,QAAI,CAAC,MAAM;AACT;AAAA,IACF;AACA,UAAM,QAAQ,YAAY,KAAK,SAAS,KAAK;AAC7C,QAAI,QAAQ,WAAW;AACrB,aAAO;AACP,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;AAQA,eAAe,aAAa,MAA4C;AACtE,MAAI,CAAC,QAAQ,IAAI,oBAAoB;AACnC,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,KAAK,UAAUA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,QAAM,WAAWA,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,MAAI,CAAC,UAAU,WAAW,QAAQ;AAChC,YAAQ,OAAO,MAAM,kEAAkE;AACvF,WAAO;AAAA,EACT;AAGA,QAAM,MAAM,MAAM,aAAa;AAC/B,QAAM,OAAO,aAAa,QAAW,CAAC,CAAC;AACvC,MAAI,UAA0D;AAC9D,MAAI,MAAM;AACR,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,MACL,cAAc,KAAK,IAAI;AAAA,MACvB,WAAW,KAAK,IAAI;AAAA,IACtB;AACA,cAAU,QAAQ,WAAW;AAAA,EAC/B;AACA,MAAI,CAAC,SAAS;AACZ,UAAM,UAAU,gBAAgB,KAAK,QAAQ,QAAQ;AACrD,cAAU,UAAU,MAAM,YAAY,OAAO,IAAI;AAAA,EACnD;AACA,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,0DAA0D,MAAM;AAAA,CAAM;AAC3F,WAAO;AAAA,EACT;AACA,QAAM,YACJ,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,IAAI,GAAG,QAAQ;AACzF,QAAM,YAAY,kBAAkB,QAAQ,QAAQ;AACpD,QAAM,MAAM,iBAAiB,WAAW,WAAW,YAAW,oBAAI,KAAK,GAAE,YAAY,CAAC;AACtF,QAAM,WAAW,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;AAClD,UAAQ,OAAO;AAAA,IACb,uBAAuB,IAAI,MAAM,SAAS,IAAI,WAAW,IAAI,KAAK,GAAG,gBAAa,IAAI,KAAK,MAAM,gBAAgB,QAAQ,cAAc,aAAa,IAAI,KAAK,GAAG,yBAAoB,SAAS;AAAA;AAAA,EAC/L;AACA,SAAO;AACT;AAEA,eAAe,MAAM,MAcD;AAClB,QAAM,SAAS,KAAK,UAAUA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACvE,QAAM,WAAWA,KAAI,CAAC,aAAa,iBAAiB,CAAC;AACrD,MAAI,CAAC,UAAU,WAAW,QAAQ;AAChC,YAAQ,OAAO,MAAM,2DAA2D;AAChF,WAAO;AAAA,EACT;AAKA,QAAM,OAAO,KAAK,eACd,OACA,aAAa,KAAK,MAAM,EAAE,oBAAoB,KAAK,cAAc,CAAC;AACtE,QAAM,MAAM,MAAM,aAAa;AAC/B,QAAM,SAAS,OACX,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,KAAK;AAAA,IACL,cAAc,KAAK,IAAI;AAAA,IACvB,WAAW,KAAK,IAAI;AAAA,EACtB,IACA,OAAO,YAAY;AACjB,UAAM,MAAM,gBAAgB,KAAK,QAAQ,YAAY,MAAS;AAC9D,WAAO,MAAM,EAAE,SAAS,KAAK,SAAS,MAAM,YAAY,GAAG,GAAG,SAAS,KAAK,IAAI;AAAA,EAClF,GAAG;AAEP,MAAI,CAAC,UAAU,CAAC,OAAO,SAAS;AAC9B,YAAQ,OAAO;AAAA,MACb,mDAAmD,MAAM;AAAA;AAAA;AAAA,IAC3D;AACA,WAAO;AAAA,EACT;AACA,QAAM,EAAE,SAAS,QAAQ,IAAI;AAK7B,QAAM,WAAW,aAAa,YAAY,KAAK,KAAK,QAAQ;AAE5D,MAAI,gBAAgB;AACpB,MAAI,UAAU,OAAO,WAAW,YAAY,OAAO;AACnD,MAAI,SAAS,QAAQ;AACnB,YAAQ,WAAW;AAAA,EACrB;AACA,MAAI,WAAW,eAAe,OAAO;AAGrC,MAAI,aAAa,SAAS,SACtB,kBAAkB,SAAS,CAAC,GAAG,SAAS,MAAM,GAAG,SAAS,KAAK,CAAC,IAChE;AACJ,MAAI,QAAsB,EAAE,MAAM,UAAU;AAC5C,MAAI,YAAY;AAEhB,MAAI,MAAM;AACR,UAAM,KAAK,eAAe,SAAS,UAAU,KAAK,OAAO,QAAQ,WAAW;AAC5E,cAAU,GAAG;AACb,eAAW,GAAG;AAId,YAAQ,EAAE,MAAM,QAAQ,MAAM,KAAK,MAAM,OAAO,KAAK,OAAO,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG;AAI1F,UAAM,YAAY,QAAQ,IAAI,4BAA4B,IACvD,MAAM,MAAM,EACZ,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO;AACjB,QAAI,SAAS,QAAQ;AACnB,YAAM,iBAAiB;AAAA,IACzB;AACA,gBAAY,WAAW,KAAK,IAAI,KAAK,KAAK,MAAM,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAGhG,UAAM,QAAQ,cAAc,SAAS,MAAM;AAC3C,QAAI,MAAM,aAAa,QAAQ,YAAY,KAAK,IAAI,MAAM,KAAK,KAAK;AACpE,QAAI,CAAC,KAAK;AAKR,YAAM,OAAO,WAAW,KAAK,IAAI;AACjC,YAAM,MAAM,UAAU,QAAQ,OAAO,IAAI;AACzC,UAAI,KAAK;AACP,cAAM,eAAe,SAAS,KAAK,OAAO,GAAG;AAC7C,YAAI,KAAK;AACP,gBAAM,OAAO;AAAA,QACf;AAAA,MACF;AAAA,IACF;AACA,QAAI,KAAK;AACP,gBAAU,EAAE,GAAG,SAAS,aAAa,IAAI,MAAM,YAAY,IAAI,QAAQ,WAAW,IAAI,MAAM;AAC5F,YAAM,SAAS;AAAA,IACjB;AAAA,EACF,WAAW,CAAC,KAAK,cAAc;AAC7B,UAAM,QAAQ,cAAc,SAAS,MAAM;AAC3C,QAAI,OAAO;AACT,sBAAgB;AAChB,gBAAU,YAAY,KAAK;AAC3B,UAAI,SAAS,QAAQ;AACnB,gBAAQ,WAAW;AAAA,MACrB;AACA,iBAAW,eAAe,OAAO;AACjC,mBAAa,SAAS,SAClB,kBAAkB,SAAS,CAAC,GAAG,SAAS,MAAM,GAAG,SAAS,KAAK,CAAC,IAChE;AACJ,cAAQ,EAAE,MAAM,UAAU,OAAO;AACjC,kBAAY,UAAU,MAAM;AAAA,IAC9B,OAAO;AACL,kBAAY;AAAA,IACd;AAAA,EACF;AAIA,QAAM,cAAc,gBAAgB,kBAAkB,cAAc,QAAQ,CAAC;AAG7E,QAAM,gBAAgB,kBAAkB,kBAAkB,cAAc,QAAQ,CAAC;AAGjF,QAAM,YAAY,MAAM,qBAAqB,cAAc,UAAU;AAAA,IACnE,WAAW,OAAO,SAAS,SAAS,MAAM,QAAQ;AAAA,EACpD,CAAC;AAGD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,IAAI,wBACV,QAAQ,IAAI,+BACZE,OAAKC,SAAQ,GAAG,oBAAoB,SAAS;AAAA,IAC/C,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;AAAA,EAClD;AAGA,QAAM,WACJ,MAAM,SAAS,UAAU,MAAM,OAAO,SAClC,YAAY,EAAE,YAAY,MAAM,OAAO,MAAM,MAAM,MAAM,UAAU,YAAY,OAAU,CAAC,IAC1F,CAAC;AACP,QAAM,UAAU;AAAA,IACd,MAAM,aAAa,eAAe,SAAS,UAAU;AAAA,MACnD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAKA,QAAM,IAAI,QAAQ;AAClB,MAAI,YAAY,MAAM,SAAS,QAAQ;AACrC,UAAM,OAAO,OAAO,QAAQ,UAAU,GAAG;AACzC,QAAI,WAA0B;AAC9B,QAAI;AACF,iBAAW,eAAe,MAAM,QAAQ;AACxC,UAAI,YAAY,MAAM;AACpB,cAAM,IAAID,OAAK,UAAU,aAAa,GAAG,IAAI,OAAO;AACpD,mBAAWE,YAAW,CAAC,IAAIC,eAAa,GAAG,MAAM,IAAI;AAAA,MACvD;AAAA,IACF,QAAQ;AACN,iBAAW;AAAA,IACb;AACA,QAAI,YAAY,MAAM;AACpB,UAAI;AACF,cAAM,OAAQ,KAAK,MAAM,QAAQ,EAAc;AAC/C,cAAM,cACJ,KAAK,SAAS,cAAc,EAAE,QAAQ,aACtC,KAAK,SAAS,UAAU,EAAE,QAAQ;AACpC,YAAI,EAAE,SAAS,eAAe,MAAM;AAClC,gBAAM,WAAW,cACZ,KAAK,UAAU,YAAY,IAC3B,KAAK,UAAU,YAAY,KAAK,SAAS,eAAe;AAC7D,gBAAM,WAAW,cACZ,KAAK,UAAU,YAAY,KAC3B,KAAK,UAAU,YAAY,KAAK;AACrC,cAAI,WAAW,GAAG;AAChB,cAAE,WAAW;AAAA,cACX,UAAU,KAAK,MAAM,WAAW,GAAG,IAAI;AAAA,cACvC,UAAU,KAAK,OAAO,WAAW,EAAE,SAAS,eAAe,GAAG,IAAI;AAAA,cAClE;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAIA,cAAM,cAAc,qBAAqB,KAAK,YAAY,CAAC,CAAC;AAC5D,cAAM,cAAc,qBAAqB,EAAE,QAAQ;AACnD,cAAM,WAAW,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC;AAClD,cAAM,WAAW,IAAI,IAAI,YAAY,IAAI,QAAQ,CAAC;AAClD,cAAM,aAAa,YAChB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EACxC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,EAAG,EAAE;AACnF,cAAM,WAAW,YAAY,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE;AACvE,cAAM,OAAO,KAAK,WAAW,SACzB,KAAK,YACL;AAAA,UACE;AAAA,YACE,MAAM;AAAA,YACN,GAAI,KAAK,SAAS,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,IAAI,CAAC;AAAA,YACjE,KAAK,YAAY;AAAA,YACjB,SAAS;AAAA,YACT,MAAM,YAAY;AAAA,YAClB,GAAI,KAAK,SAAS,eAAe,OAC7B,EAAE,SAAS,KAAK,SAAS,YAAY,IACrC,CAAC;AAAA,UACP;AAAA,QACF;AAIJ,cAAM,MAAML,KAAI,CAAC,aAAa,aAAa,MAAM,CAAC,KAAK;AACvD,cAAM,OAAO,KAAK,KAAK,SAAS,CAAC;AACjC,cAAM,WAAW,CAAC,CAAC,OAAO,KAAK,QAAQ;AACvC,cAAMM,SAAQ;AAAA,UACZ,MAAM,WAAW,KAAK,OAAO,KAAK,OAAO;AAAA,UACzC,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,UACrB,GAAI,EAAE,QAAQ,UAAU,EAAE,SAAS,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,UAC1D,KAAK;AAAA,UACL,SAAS,WAAW;AAAA,UACpB,MAAM,YAAY;AAAA,UAClB,GAAI,EAAE,SAAS,eAAe,OAAO,EAAE,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,QAC9E;AACA,UAAE,YAAY,CAAC,GAAI,WAAW,KAAK,MAAM,GAAG,EAAE,IAAI,MAAOA,MAAK,EAAE,MAAM,GAAG;AACzE,YAAI,WAAW,QAAQ;AACrB,YAAE,YAAY;AAAA,QAChB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF,OAAO;AAKL,YAAM,MAAMN,KAAI,CAAC,aAAa,aAAa,MAAM,CAAC,KAAK;AACvD,YAAM,cAAc,qBAAqB,EAAE,QAAQ;AACnD,QAAE,YAAY;AAAA,QACZ;AAAA,UACE,MAAM;AAAA,UACN,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;AAAA,UACrB,GAAI,EAAE,QAAQ,UAAU,EAAE,SAAS,EAAE,QAAQ,QAAQ,IAAI,CAAC;AAAA,UAC1D,KAAK,YAAY;AAAA,UACjB,SAAS;AAAA,UACT,MAAM,YAAY;AAAA,UAClB,GAAI,EAAE,SAAS,eAAe,OAAO,EAAE,SAAS,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,QAC9E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,MAAI,KAAK,SAAS;AAChB,YAAQ,OAAO;AAAA,MACb,gBAAgB,SAAS,EAAE,YAAY,QAAQ,IAAI,yBAAyB,IAAI,CAAC;AAAA,IACnF;AACA,YAAQ,OAAO;AAAA,MACb,+CAA+C,SAAS;AAAA;AAAA,IAC1D;AACA,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA;AAMhD,QAAM,SACJ,KAAK,SACL,QAAQ,IAAI,mBACX,WACI,cAAc,QAAQ,KAAK,cAAc,gBAAgB,QAAQ,KAAK,EAAE,IACzE,WACJ,UACA,YAAY;AACd,MAAI,UAAU,QAAQ;AACpB,YAAQ,OAAO,MAAM,IAAI;AACzB,YAAQ,OAAO;AAAA,MACb,6DAAwD,QAAQ,UAAU,KAAK,KAAK,SAAS;AAAA;AAAA,IAC/F;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,aAAa,SAAS,QAAQ,EAAE,SAAS,KAAK,GAAG;AACpD,YAAQ,OAAO;AAAA,MACb,sBAAsB,KAAK;AAAA;AAAA,IAC7B;AAAA,EACF,WAAW,UAAU,YAAY,UAAU,OAAO;AAChD,YAAQ,OAAO,MAAM,8BAA8B,KAAK;AAAA,CAAwB;AAAA,EAClF;AAEA,QAAM,OAAO,OAAO,QAAQ,UAAU,GAAG;AAKzC,MAAI,UAAU,OAAO;AACnB,UAAM,IAAI,gBAAgB,MAAM,QAAQ,MAAM,QAAQ,SAAS,YAAY,MAAS;AACpF,QAAI,EAAE,IAAI;AACR,cAAQ,OAAO;AAAA,QACb,sBAAsB,EAAE,GAAG,WAAW,QAAQ,UAAU,KAAK,KAAK,SAAS,WAAW,QAAQ,SAAS,UAAU;AAAA;AAAA,MACnH;AACA,aAAO;AAAA,IACT;AACA,YAAQ,OAAO,MAAM,kCAAkC,EAAE,MAAM;AAAA,CAAyB;AAAA,EAC1F;AAEA,QAAM,MAAME,OAAK,YAAY,KAAK,WAAW;AAC7C,QAAM,MAAM,KAAK,OAAOA,OAAK,KAAK,GAAG,IAAI,OAAO;AAChD,EAAAK,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAIlC,QAAM,QAAQL,OAAK,KAAK,gBAAgB;AACxC,MAAI,CAACE,YAAW,KAAK,GAAG;AACtB,IAAAL,eAAc,OAAO,wBAAwB;AAC7C,IAAAC,KAAI,CAAC,OAAO,KAAK,CAAC;AAAA,EACpB;AACA,EAAAD,eAAc,KAAK,IAAI;AACvB,EAAAC,KAAI,CAAC,OAAO,GAAG,CAAC;AAEhB,QAAM,MAAM,WAAW,SAAS,UAAU,GAAG,IAAI;AACjD,UAAQ,OAAO;AAAA,IACb,sBAAsB,GAAG,WAAW,QAAQ,UAAU,KAAK,KAAK,SAAS,WAAW,QAAQ,SAAS,UAAU;AAAA;AAAA,EACjH;AACA,SAAO;AACT;AAMA,eAAe,cAAc,MAOT;AAClB,MAAI,CAAE,MAAM,YAAY,GAAI;AAC1B,YAAQ,OAAO,MAAM,oCAAoC,UAAU,CAAC;AAAA,CAAK;AACzE,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,MAAM,cAAc;AAAA,IACtC,OAAO,KAAK;AAAA,IACZ,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,YAAY,WAAW,GAAG;AAC5B,YAAQ,OAAO,MAAM,oCAAoC;AACzD,WAAO;AAAA,EACT;AACA,QAAM,cAAc,YAAY,IAAI,CAAC,MAAM,EAAE,QAAQ;AAErD,QAAM,QAAQ,kBAAkB,WAAW;AAC3C,QAAM,QAAQ,sBAAsB,OAAO,KAAK,OAAO,SAAS,IAAI;AAEpE,MAAI,KAAK,KAAK;AACZ,UAAM,WAAWI,YAAW,KAAK,GAAG,IAAIC,eAAa,KAAK,KAAK,MAAM,IAAI;AACzE,IAAAN,eAAc,KAAK,KAAK,wBAAwB,UAAU,KAAK,CAAC;AAChE,YAAQ,OAAO;AAAA,MACb,qBAAqB,MAAM,MAAM,eAAe,KAAK,GAAG,UAAU,YAAY,MAAM,WAAW,YAAY,WAAW,IAAI,KAAK,GAAG;AAAA;AAAA,IACpI;AACA,WAAO;AAAA,EACT;AAEA,OAAK,OAAO,KAAK,QAAQ,OAAO,YAAY;AAC5C,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,kBAAkB,YAAY,MAAM;AAAA,CAAc;AAAA,EACzE;AACA,SAAO;AACT;AAOA,eAAe,UAAU,MAQL;AAClB,MAAI,CAAE,MAAM,YAAY,GAAI;AAC1B,YAAQ,OAAO,MAAM,oCAAoC,UAAU,CAAC;AAAA,CAAK;AACzE,WAAO;AAAA,EACT;AAIA,QAAM,YAAY,KAAK,QAAQ,KAAK,OAAO,IAAI,KAAK,OAAO,KAAK,WAAW,IAAI;AAC/E,QAAM,cAAc,MAAM;AAAA,IACxB,KAAK,QAAQ,KAAK,OAAO,IACrB,EAAE,OAAO,KAAK,OAAO,MAAM,KAAK,KAAK,IACrC,KAAK,WACH,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,SAAS,IAC7C,EAAE,OAAO,KAAK,OAAO,MAAM,GAAG;AAAA,EACtC;AACA,MAAI,YAAY,WAAW,GAAG;AAC5B,YAAQ,OAAO,MAAM,iCAAiC;AACtD,WAAO;AAAA,EACT;AAGA,QAAM,SAAS,YACZ,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,UAAU,EAAE,SAAS,EAAE;AAC5D,QAAM,SAAS,cAAc,QAAQ,SAAS;AAE9C,MAAI,KAAK,KAAK;AACZ,UAAM,QAAQ,aAAa,QAAQ,IAAI;AACvC,UAAM,WAAWK,YAAW,KAAK,GAAG,IAAIC,eAAa,KAAK,KAAK,MAAM,IAAI;AACzE,IAAAN,eAAc,KAAK,KAAK,oBAAoB,UAAU,KAAK,CAAC;AAC5D,YAAQ,OAAO;AAAA,MACb,4BAA4B,KAAK,GAAG,UAAU,OAAO,OAAO,IAAI;AAAA;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,KAAK,MAAM;AACb,SAAK,aAAa,QAAQ,MAAM,GAAG,KAAK,QAAQ,OAAO,QAAQ;AAC/D,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO,MAAM,aAAa,QAAQ,QAAQ,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;AACxE,MAAI,KAAK,MAAM;AACb,UAAM,KAAK,gBAAgB,aAAa,QAAQ,QAAQ,EAAE,OAAO,MAAM,CAAC,CAAC;AACzE,YAAQ,OAAO;AAAA,MACb,KAAK,kCAAkC;AAAA,IACzC;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,YAAY,MAAuB;AAC1C,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,2CAA2C;AAChE,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,UAAU,KAAK,MAAMM,eAAa,MAAM,MAAM,CAAC;AACrD,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,eAAe,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5E,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,kBAAkB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC5F,WAAO;AAAA,EACT;AACF;AAGA,eAAe,UACb,MACA,OAAmE,CAAC,GACnD;AACjB,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,wEAAwE;AAC7F,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMA,eAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,YAAQ,OAAO,MAAM,kBAAkB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AAC5F,WAAO;AAAA,EACT;AACA,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,CAAC,OAAO,IAAI;AACd,YAAQ,OAAO,MAAM,2BAAsB;AAC3C,eAAW,KAAK,OAAO,QAAQ;AAC7B,cAAQ,OAAO,MAAM,OAAO,CAAC;AAAA,CAAI;AAAA,IACnC;AACA,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,OAAO,SACf,SAAS,OAAO,kBAAkB,SAAY,gBAAa,OAAO,aAAa,KAAK,EAAE,KACtF;AACJ,UAAQ,OAAO,MAAM,qCAA2B,OAAO,KAAK,SAAM,GAAG;AAAA,CAAI;AACzE,MAAI,OAAO,QAAQ;AACjB,YAAQ,OAAO,MAAM,aAAa,OAAO,MAAM;AAAA,CAAI;AAAA,EACrD;AAIA,MAAI,KAAK,SAAS;AAChB,QAAI,CAAC,KAAK,YAAY;AACpB,cAAQ,OAAO,MAAM,wEAAmE;AACxF,aAAO;AAAA,IACT;AACA,UAAM,OAAO,MAAM,gBAAgB,KAAK,YAAY,KAAK,OAAO;AAChE,QAAI,SAAS,GAAG;AACd,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI,KAAK,cAAc,OAAO,SAAS;AACrC,UAAM,MAAM,MAAM,oBAAoB,OAAO,SAAS,KAAK,YAAY,EAAE,QAAQ,KAAK,OAAO,CAAC;AAC9F,QAAI,CAAC,IAAI,WAAW;AAClB,cAAQ,OAAO,MAAM,6DAAwD;AAC7E,aAAO;AAAA,IACT;AACA,QAAI,CAAC,IAAI,SAAS;AAChB,cAAQ,OAAO;AAAA,QACb;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,YAAQ,OAAO,MAAM,8DAAoD;AACzE,WAAO;AAAA,EACT;AAEA,UAAQ,OAAO;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,eAAe,MAAiC;AACvD,MAAI;AACJ,MAAI;AACF,QAAI,KAAK,MAAMA,eAAa,MAAM,MAAM,CAAC;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,KAAK,OAAO,MAAM,YAAY,MAAM,QAAS,EAAiB,MAAM,GAAG;AACzE,WAAO;AAAA,EACT;AAEA,QAAM,UAAW,GAA6B;AAC9C,MAAI,OAAO,YAAY,UAAU;AAC/B,QAAI;AACF,YAAM,QAAQ,KAAK,MAAM,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM,CAAC;AACxE,UAAI,SAAS,MAAM,QAAQ,MAAM,MAAM,GAAG;AACxC,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAe,gBAAgB,YAAoB,aAAsC;AACvF,QAAM,MAAM,eAAe,WAAW;AACtC,MAAI,CAAC,KAAK;AACR,YAAQ,OAAO,MAAM,8CAAyC,WAAW;AAAA,CAAI;AAC7E,WAAO;AAAA,EACT;AACA,QAAM,SAAS,QAAQ,IAAI,wBAAwB,QAAQ,IAAI;AAC/D,QAAM,WAAW,iBAAiB,KAA2C,MAAM;AACnF,MAAI,aAAa,OAAO;AACtB,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,SAAS,eAAe,UAAU;AACxD,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,0CAAqC,UAAU;AAAA,CAAI;AACxE,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,SAAS,GAAG;AACjC,MAAI,EAAE,SAAS,sBAAsB;AACnC,YAAQ,OAAO;AAAA,MACb,sCAA4B,EAAE,OAAO,OAAO,EAAE,SAAS,mFAAmF,EAAE,iBAAiB;AAAA;AAAA,IAC/J;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,EAAE,cAAc,IAAI,KAAK,WAAM,EAAE,OAAO,IAAI,EAAE,SAAS;AACnE,QAAM,UACJ,aAAa,aACT,6BACA,aAAa,WACX,sDACA;AACR,UAAQ,OAAO,MAAM,wCAAmC,GAAG,GAAG,OAAO;AAAA,CAAI;AACzE,SAAO;AACT;AAGA,SAAS,QACP,OACA,OACA,OAAyC,CAAC,GAClC;AACR,MAAI,QAAQ;AACZ,MAAI,QAAQ;AAGZ,MAAI,CAAC,SAAS,CAAC,OAAO;AACpB,UAAM,OAAO,mBAAmB,WAAW;AAC3C,QAAI,KAAK,SAAS,GAAG;AACnB,cAAQ,OAAO;AAAA,QACb,2CAA2C,KAAK,MAAM;AAAA;AAAA,MACxD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,CAAC,SAChB,KAAK,SAAS,MAAM,IAAI,OAAOH,OAAK,aAAa,GAAG,IAAI,OAAO;AACjE,YAAQ,SAAS,KAAK,CAAC,EAAE,IAAI;AAC7B,YAAQ,SAAS,KAAK,CAAC,EAAE,IAAI;AAC7B,YAAQ,OAAO,MAAM,kBAAkB,KAAK,CAAC,EAAE,IAAI,WAAM,KAAK,CAAC,EAAE,IAAI;AAAA;AAAA,CAAwB;AAAA,EAC/F;AACA,MAAI,CAAC,SAAS,CAAC,OAAO;AACpB,YAAQ,OAAO;AAAA,MACb;AAAA,IAEF;AACA,WAAO;AAAA,EACT;AACA,QAAM,OAAO,CAAC,MAA8B;AAC1C,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,EAAE,SAAS,MAAM,IAAI,eAAe,EAAE,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI;AAC9E,cAAQ,KAAK,MAAM,OAAOG,eAAa,GAAG,MAAM,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,cAAQ,OAAO,MAAM,kBAAkB,CAAC,KAAK,eAAe,QAAQ,IAAI,UAAU,GAAG;AAAA,CAAI;AACzF,aAAO;AAAA,IACT;AACA,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,cAAQ,OAAO,MAAM,UAAK,CAAC;AAAA,CAA4B;AACvD,iBAAW,KAAK,IAAI,OAAQ,SAAQ,OAAO,MAAM,OAAO,CAAC;AAAA,CAAI;AAC7D,aAAO;AAAA,IACT;AACA,WAAO,IAAI;AAAA,EACb;AACA,QAAM,IAAI,KAAK,KAAK;AACpB,QAAM,IAAI,KAAK,KAAK;AACpB,MAAI,CAAC,KAAK,CAAC,EAAG,QAAO;AAErB,QAAM,QAAQ,aAAa,GAAG,CAAC;AAC/B,QAAM,SAAS,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,WAAW,KAAK;AACnF,MAAI,KAAK,KAAK;AACZ,IAAAN,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,wBAAwB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC3D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,SAAS,OACP,SACA,OAA4D,CAAC,GACrD;AACR,MAAI,QAAQ,IAAI,iBAAiB,KAAK;AACpC,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAASC,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,QAAQ,WAAW,UAAU,IAAI,QAAQ,UAAU,GAAG;AAC5D,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO,MAAM,6EAAwE;AAC7F,WAAO;AAAA,EACT;AACA,QAAMM,SAAkB;AAAA,IACtB,OAAO,aAAa;AAAA,IACpB,IAAI,KAAK,IAAI;AAAA,IACb,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IACvC,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,EAClD;AACA,QAAM,MAAM,UAAU,MAAMA,MAAK;AACjC,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,OAAO,MAAM,iBAAiB,IAAI,MAAM;AAAA,CAAK;AACrD,WAAO;AAAA,EACT;AACA,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK,UAAU,EAAE,MAAM,KAAK,IAAI,KAAK,OAAO,IAAI,OAAO,OAAAA,OAAM,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IAC7E;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAMA,OAAM;AAClB,QAAM,OAAOA,OAAM,UAAU,WAAWA,OAAM,OAAO,OAAO,yBAAyB,IAAI;AACzF,UAAQ,OAAO;AAAA,IACb,gBAAgB,IAAI,OAAO,GAAG,GAAGA,OAAM,OAAO,YAAOA,OAAM,IAAI,MAAM,EAAE,SAAM,IAAI,KAAK,OAAO,IAAI,UAAU,IAAI,KAAK,GAAG,yCAAyC,IAAI;AAAA;AAAA,EACtK;AACA,SAAO;AACT;AAMA,SAAS,SAAS,OAA2D,CAAC,GAAW;AACvF,MAAI,QAAQ,IAAI,mBAAmB,KAAK;AACtC,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAWN,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,QAAQ,KAAK,SAAS,KAAK,MAAM,SAAS,IAAI,KAAK,QAAQ,CAAC,QAAQ;AAC1E,QAAM,QAAQ,sBAAsB,KAAK;AACzC,QAAM,OAAO,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,YAAY,KAAK;AAClF,MAAI,KAAK,KAAK;AACZ,IAAAD,eAAc,KAAK,KAAK,IAAI;AAC5B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAC1D,WAAO;AAAA,EACT;AACA,UAAQ,OAAO,MAAM,IAAI;AACzB,SAAO;AACT;AAGA,SAAS,OAAO,KAAc,OAAwD,CAAC,GAAW;AAChG,QAAM,MAAM,mBAAmB,OAAO,WAAW;AACjD,QAAM,QAAQ,KAAK,OAAO,IAAI,MAAM,GAAG,KAAK,IAAI,IAAI;AACpD,QAAM,SAAS,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,UAAU,OAAO,IAAI,MAAM;AAC9F,MAAI,KAAK,KAAK;AACZ,IAAAA,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,uBAAuB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC1D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAGA,SAAS,SAAS,KAAc,OAAyC,CAAC,GAAW;AACnF,QAAM,QAAQ,aAAa,OAAO,WAAW;AAC7C,QAAM,SAAS,KAAK,OAAO,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,IAAO,YAAY,KAAK;AACpF,MAAI,KAAK,KAAK;AACZ,IAAAA,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC5D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAKA,SAAS,SAAS,MAAe,OAAyB,CAAC,GAAW;AACpE,QAAM,WAAWC,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,SAASA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,OACJ,SACC,UAAU,WAAW,SAClBE,OAAK,UAAU,aAAa,GAAG,OAAO,QAAQ,UAAU,GAAG,CAAC,OAAO,IACnE;AACN,MAAI,CAAC,QAAQ,CAACE,YAAW,IAAI,GAAG;AAC9B,YAAQ,OAAO;AAAA,MACb,mCAAmC,OAAO,OAAO,IAAI,KAAK,EAAE;AAAA;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMC,eAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,YAAQ,OAAO,MAAM,mCAAmC,IAAI;AAAA,CAAI;AAChE,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa,KAAK;AAC9B,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,YAAQ,OAAO,MAAM,mBAAmB,IAAI;AAAA,CAA4B;AACxE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,GAAG,KAAK,UAAU,cAAc,IAAI,QAAQ,SAAS,GAAG,MAAM,CAAC,CAAC;AAAA;AAC/E,MAAI,KAAK,KAAK;AACZ,IAAAN,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC5D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAKA,SAAS,SAAS,MAAe,OAAyB,CAAC,GAAW;AACpE,QAAM,WAAWC,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,SAASA,KAAI,CAAC,aAAa,gBAAgB,MAAM,CAAC;AACxD,QAAM,OACJ,SACC,UAAU,WAAW,SAClBE,OAAK,UAAU,aAAa,GAAG,OAAO,QAAQ,UAAU,GAAG,CAAC,OAAO,IACnE;AACN,MAAI,CAAC,QAAQ,CAACE,YAAW,IAAI,GAAG;AAC9B,YAAQ,OAAO;AAAA,MACb,mCAAmC,OAAO,OAAO,IAAI,KAAK,EAAE;AAAA;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMC,eAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,YAAQ,OAAO,MAAM,mCAAmC,IAAI;AAAA,CAAI;AAChE,WAAO;AAAA,EACT;AACA,QAAM,MAAM,aAAa,KAAK;AAC9B,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,YAAQ,OAAO,MAAM,mBAAmB,IAAI;AAAA,CAA4B;AACxE,WAAO;AAAA,EACT;AACA,QAAM,SAAS,GAAG,KAAK,UAAU,QAAQ,IAAI,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA;AAC/D,MAAI,KAAK,KAAK;AACZ,IAAAN,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,yBAAyB,KAAK,GAAG;AAAA,CAAI;AAAA,EAC5D,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,eAAe,UACb,UACA,OAA+D,CAAC,GAC/C;AACjB,QAAM,WAAW,KAAK,SAAS,YAAY,KAAK,MAAM,IAAI;AAC1D,MAAI,CAAC,UAAU;AACb,YAAQ,OAAO;AAAA,MACb,oBAAoB,KAAK,SAAS,qBAAqB,KAAK,MAAM,MAAM,kBAAkB,gBAC1E,YAAY,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,IAC1C;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,cAAc,MAAM,aAAa,KAAK,KAAK,GAAG,QAAQ;AACtE,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,WACI,uBAAuB,QAAQ;AAAA,IAC/B;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,YAAY,OAAO;AACnC,QAAM,UAAU,cAAc,MAAM,aAAa,SAAS,SAAS,eAAe,OAAO,CAAC,CAAC;AAC3F,QAAM,SAAS,SAAS,OAAO,SAAS,OAAO;AAC/C,MAAI,KAAK,KAAK;AACZ,IAAAA,eAAc,KAAK,KAAK,MAAM;AAC9B,YAAQ,OAAO,MAAM,0BAA0B,KAAK,GAAG,KAAK,SAAS,EAAE;AAAA,CAAK;AAAA,EAC9E,OAAO;AACL,YAAQ,OAAO,MAAM,MAAM;AAAA,EAC7B;AACA,SAAO;AACT;AAMA,SAAS,SAAS,KAAc,OAA6B,CAAC,GAAW;AACvE,QAAM,WAAWC,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,QAAM,QAAQ,OAAOE,OAAK,UAAU,WAAW;AAC/C,MAAI;AACJ,MAAI;AACF,YAAQM,aAAY,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,OAAO,CAAC;AAAA,EAC9D,QAAQ;AACN,YAAQ,OAAO,MAAM,sBAAsB,KAAK;AAAA,CAAe;AAC/D,WAAO;AAAA,EACT;AACA,QAAM,KAAKR,KAAI,CAAC,aAAa,WAAW,QAAQ,CAAC;AACjD,MAAI,OAAO,MAAM;AACf,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,YAAY,IAAI;AAAA,IACpB,GACG,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,MAAM,aAAa,EAAE,CAAC,CAAC,EACpC,OAAO,OAAO,EACd,IAAI,CAAC,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC;AAAA,EACpC;AACA,QAAM,EAAE,MAAM,OAAO,IAAI,UAAU,OAAO,SAAS;AACnD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,aAAa,iBAAiB,WAAW,KAAK,UAAU,KAAK;AACnE,QAAI,eAAe,GAAG;AACpB,cAAQ,OAAO,MAAM,qCAAqC,KAAK,MAAM;AAAA,CAAsB;AAAA,IAC7F;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,QAAQ;AACf,YAAQ,OAAO;AAAA,MACb,0CAA0C,OAAO,MAAM,IAAI,MAAM,MAAM,qBAAqB,KAAK,MAAM;AAAA;AAAA,IACzG;AACA,eAAW,KAAK,QAAQ;AACtB,cAAQ,OAAO,MAAM,OAAO,CAAC;AAAA,CAAI;AAAA,IACnC;AACA,qBAAiB,WAAW,IAAI;AAChC,WAAO;AAAA,EACT;AACA,mBAAiB,WAAW,KAAK;AACjC,aAAW,KAAK,QAAQ;AACtB,UAAM,IAAIE,OAAK,OAAO,CAAC;AACvB,QAAIF,KAAI,CAAC,MAAM,MAAM,MAAM,CAAC,CAAC,MAAM,MAAM;AACvC,UAAI;AACF,mBAAW,CAAC;AAAA,MACd,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,UAAQ,OAAO;AAAA,IACb,2BAA2B,OAAO,MAAM,iDAAiD,KAAK,MAAM;AAAA;AAAA,EACtG;AACA,SAAO;AACT;AAKA,SAAS,iBAAiB,WAAwB,QAAyB;AACzE,QAAM,OAAO,gBAAgB,EAAE,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;AACxE,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO;AAAA,EACT;AACA,aAAW,EAAE,KAAK,KAAK,KAAK,MAAM;AAChC,QAAI,QAAQ;AACV,cAAQ,OAAO,MAAM,OAAO,GAAG;AAAA,CAAI;AACnC;AAAA,IACF;AACA,IAAAA,KAAI,CAAC,cAAc,MAAM,GAAG,CAAC;AAC7B,IAAAA,KAAI,CAAC,QAAQ,UAAU,IAAI,GAAG,EAAE,CAAC;AACjC,YAAQ,OAAO,MAAM,2BAA2B,GAAG,YAAY,IAAI;AAAA,CAAW;AAAA,EAChF;AACA,SAAO,KAAK;AACd;AAQA,eAAe,QACb,OAAgE,CAAC,GAChD;AACjB,QAAM,QAAQ,KAAK,SAAS,KAAK,QAAQ,IAAI,KAAK,QAAQ;AAC1D,QAAM,aAAa,MAAM,aAAa,KAAK,KAAK,GAAG,MAAM,GAAG,KAAK;AACjE,QAAM,OAAmB,CAAC;AAC1B,aAAW,WAAW,WAAW;AAC/B,UAAM,UAAU,MAAM,YAAY,OAAO;AACzC,QAAI,CAAC,SAAS;AACZ;AAAA,IACF;AACA,UAAM,EAAE,MAAM,MAAM,IAAI,eAAe,YAAY,OAAO,CAAC;AAC3D,SAAK,KAAK;AAAA,MACR,OAAO,QAAQ,SAAS,QAAQ;AAAA,MAChC,YAAY,CAAC,GAAG,gBAAgB,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;AAAA,IACtD,CAAC;AAAA,EACH;AACA,QAAM,OAAO,mBAAmB,IAAI;AACpC,UAAQ,OAAO,MAAM,KAAK,OAAO,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,IAAO,gBAAgB,IAAI,CAAC;AAC7F,SAAO;AACT;AASA,SAAS,QACP,OAAgF,CAAC,GACzE;AACR,QAAM,QAAkB,CAAC;AAEzB,QAAM,UAAoB,CAAC;AAE3B,QAAM,IAAI,WAAW;AAIrB,QAAM,QAAQ,mBAAmB,KAAK,CAAC,IAAI,CAAC;AAC5C,QAAM,MAAM,QAAQ,IAAI,KAAK,KAAK;AAClC,QAAM,MAAM;AACZ,QAAM,OAAO,GAAG,GAAG;AACnB,MAAII,YAAW,IAAI,GAAG;AACpB,UAAM,KAAK,kBAAkB,IAAI,8CAAyC;AAAA,EAC5E,OAAO;AACL,IAAAG,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,IAAAR,eAAc,MAAM,gBAAgB,KAAK,CAAC,CAAC;AAC3C,YAAQ,KAAK,IAAI;AACjB,UAAM,KAAK,wBAAwB,IAAI,cAAc,GAAG,0BAA0B;AAAA,EACpF;AAIA,QAAM,eAAeG,OAAK,WAAW,eAAe;AACpD,QAAM,SAAS,sBAAsB,cAAc,QAAW,EAAE,iBAAiB,KAAK,CAAC;AACvF,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,KAAK,kBAAkB,OAAO,MAAM,GAAG;AAAA,EAC/C,WAAW,OAAO,SAAS;AACzB,YAAQ,KAAK,YAAY;AACzB,UAAM;AAAA,MACJ,sDAAsD,YAAY;AAAA,IACpE;AAAA,EACF,OAAO;AACL,UAAM,KAAK,kBAAkB,YAAY,iCAAiC;AAAA,EAC5E;AAIA,MAAI,KAAK,OAAO;AACd,UAAM,IAAI,sBAAsB,cAAc,oBAAoB,EAAE,SAAS,cAAc,CAAC;AAC5F,QAAI,CAAC,EAAE,IAAI;AACT,YAAM,KAAK,kBAAkB,EAAE,MAAM,gBAAgB;AAAA,IACvD,WAAW,EAAE,SAAS;AACpB,UAAI,CAAC,QAAQ,SAAS,YAAY,EAAG,SAAQ,KAAK,YAAY;AAC9D,YAAM;AAAA,QACJ,uDAAuD,YAAY;AAAA,MACrE;AAAA,IACF,OAAO;AACL,YAAM,KAAK,kBAAkB,YAAY,8BAA8B;AAAA,IACzE;AAAA,EACF;AACA,QAAM,aAAaA,OAAK,WAAW,YAAY;AAC/C,MAAI,CAACE,YAAW,UAAU,GAAG;AAC3B,IAAAL,eAAc,YAAY,kCAAkC;AAC5D,YAAQ,KAAK,UAAU;AACvB,UAAM,KAAK,wBAAwB,UAAU,2CAA2C;AAAA,EAC1F;AAIA,MAAI,KAAK,QAAQ,SAAS,OAAO,KAAKK,YAAW,QAAQ,GAAG;AAC1D,UAAM,YAAYF,OAAK,UAAU,YAAY;AAC7C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,iBAAiB,KAAK;AAAA,IAC1B;AACA,QAAI,CAAC,EAAE,IAAI;AACT,YAAM,KAAK,kBAAkB,EAAE,MAAM,GAAG;AAAA,IAC1C,WAAW,EAAE,SAAS;AACpB,cAAQ,KAAK,SAAS;AACtB,YAAM,KAAK,sDAAsD,SAAS,GAAG;AAAA,IAC/E,OAAO;AACL,YAAM,KAAK,kBAAkB,SAAS,iCAAiC;AAAA,IACzE;AAAA,EACF;AAIA,QAAM,YAAYA,OAAK,aAAa,gBAAgB;AACpD,MAAI,CAACE,YAAW,SAAS,GAAG;AAC1B,IAAAG,WAAU,aAAa,EAAE,WAAW,KAAK,CAAC;AAC1C,IAAAR,eAAc,WAAW,wBAAwB;AACjD,YAAQ,KAAK,SAAS;AACtB,UAAM,KAAK,wBAAwB,SAAS,mCAAmC;AAAA,EACjF;AAEA,MAAI,KAAK,SAAS;AAChB,UAAM,QAAQ,kBAAkB,cAAc;AAC9C,QAAI,CAAC,MAAM,IAAI;AACb,YAAM,KAAK,kBAAkB,MAAM,MAAM,GAAG;AAAA,IAC9C,WAAW,MAAM,SAAS;AACxB,cAAQ,KAAK,cAAc;AAC3B,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,OAAO;AACL,YAAM,KAAK,sDAAsD;AAAA,IACnE;AAAA,EACF;AAEA,MAAI,KAAK,IAAI;AACX,mBAAe,SAAS,KAAK;AAAA,EAC/B,OAAO;AACL,UAAM,KAAK,yEAAyE;AACpF,UAAM,KAAK,iEAAiE;AAAA,EAC9E;AACA,MAAI,QAAQ,SAAS,YAAY,GAAG;AAGlC,UAAM,KAAK,uFAAkF;AAAA,EAC/F;AACA,UAAQ,OAAO,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AAC5C,SAAO;AACT;AAEA,IAAM,eAAe;AAKrB,SAAS,eAAe,SAAmB,OAAuB;AAChE,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,KAAK,6EAAwE;AACnF;AAAA,EACF;AACA,MAAI,CAACC,KAAI,CAAC,aAAa,WAAW,CAAC,GAAG;AACpC,UAAM,KAAK,6EAAwE;AACnF;AAAA,EACF;AACA,MAAIA,KAAI,CAAC,aAAa,YAAY,WAAW,YAAY,CAAC,MAAM,IAAI;AAClE,UAAM;AAAA,MACJ,yBAAyB,YAAY;AAAA,IACvC;AACA;AAAA,EACF;AACA,MAAIC,WAAU,OAAO,CAAC,YAAY,MAAM,YAAY,GAAG,EAAE,UAAU,OAAO,CAAC,EAAE,WAAW,GAAG;AACzF,UAAM,KAAK,0CAA0C,YAAY,0BAAqB;AACtF;AAAA,EACF;AACA,EAAAA,WAAU,OAAO,CAAC,OAAO,MAAM,GAAG,OAAO,GAAG,EAAE,UAAU,OAAO,CAAC;AAGhE,QAAM,SAASA;AAAA,IACb;AAAA,IACA,CAAC,UAAU,MAAM,mEAA8D;AAAA,IAC/E,EAAE,UAAU,OAAO;AAAA,EACrB;AACA,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM;AAAA,MACJ,+EAA0E,YAAY;AAAA,IACxF;AACA;AAAA,EACF;AACA,QAAM,KAAK,4BAA4B,QAAQ,MAAM,eAAe,YAAY,GAAG;AACnF,QAAM,OAAOA,WAAU,OAAO,CAAC,QAAQ,MAAM,UAAU,YAAY,GAAG,EAAE,UAAU,OAAO,CAAC;AAC1F,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM;AAAA,MACJ;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,KAAK,yBAAyB,YAAY,GAAG;AACnD,QAAMQ,MAAKR;AAAA,IACT;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,UAAU,OAAO;AAAA,EACrB;AACA,MAAIQ,IAAG,WAAW,GAAG;AACnB,UAAM,KAAK,uCAAkCA,IAAG,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,CAAC,EAAE;AACjF;AAAA,EACF;AACA,QAAM,SAAST,KAAI,CAAC,UAAU,WAAW,QAAQ,CAAC;AAClD,QAAM,OAAO,SAAS,iCAAiC,KAAK,MAAM,IAAI,CAAC,IAAI;AAC3E,QAAM;AAAA,IACJ,OACI,6DAAwD,IAAI,aAAa,YAAY,KACrF;AAAA,EACN;AACF;AAEA,SAAS,gBAAgB,KAAa,GAAmB;AACvD,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAmBU,GAAG;AAAA,gBACN,CAAC;AAAA,iFACgE,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAMpF;AAKA,eAAe,QAAQ,MAA0B,SAAuC;AAItF,MAAI,SAAS,SAAS;AACpB,UAAMU,SAAQ,MAAM,UAAU;AAC9B,UAAM,MAAM,SAASA,MAAK;AAC1B,QAAI,IAAI,OAAQ,SAAQ,OAAO,MAAM,IAAI,MAAM;AAC/C,WAAO,IAAI;AAAA,EACb;AACA,MAAI,SAAS,YAAY;AACvB,YAAQ,OAAO,MAAM,8DAA8D;AACnF,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,MAAM,UAAU;AAC9B,QAAM,MAAM,MAAM;AAAA,IAAe;AAAA,IAAS;AAAA,IAAO,OAAO,MACtD,MAAM,EAAE,eAAe,GAAG,cAAc,CAAC;AAAA,EAC3C;AACA,MAAI,IAAI,SAAS;AACf,YAAQ,OAAO,MAAM,GAAG,IAAI,OAAO;AAAA,CAAI;AAAA,EACzC;AACA,SAAO,IAAI;AACb;AAIA,SAAS,iBAAyB;AAChC,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,OAAO,MAAM,0BAA0B,IAAI,MAAM;AAAA,CAAK;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,OAAO;AAAA,IACX,WAAW,aAAa,IAAI,IAAI;AAAA,IAChC,WAAW,GAAG,IAAI,IAAI;AAAA,IACtB,SAAS,aAAa,IAAI,IAAI;AAAA,EAChC,EAAE,IAAI,MAAM;AACZ,UAAQ,OAAO,MAAM,0BAA0B,IAAI;AAAA,CAAK;AACxD,SAAO;AACT;AAKA,SAAS,gBAAwB;AAC/B,QAAM,OAAOR,OAAKC,SAAQ,GAAG,WAAW,eAAe;AACvD,QAAM,MAAM,sBAAsB,IAAI;AACtC,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,OAAO,MAAM,yBAAyB,IAAI,MAAM;AAAA,CAAK;AAC7D,WAAO;AAAA,EACT;AACA,UAAQ,OAAO;AAAA,IACb,IAAI,UACA,oDAAoD,IAAI;AAAA,IACxD,yBAAyB,IAAI;AAAA;AAAA,EACnC;AACA,SAAO;AACT;AAGA,eAAe,YACb,MACA,OAAuF,CAAC,GACvE;AACjB,MAAI,CAAC,MAAM;AACT,YAAQ,OAAO;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,uBAAuB,MAAM;AAAA,IACjD,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,EACf,CAAC;AACD,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,oDAAoD,IAAI;AAAA,CAAI;AACjF,WAAO;AAAA,EACT;AACA,QAAM,MAAM,KAAK,UAAU,aAAa,OAAO,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC;AAClF,UAAQ,OAAO,MAAM,GAAG,GAAG;AAAA,CAAI;AAC/B,SAAO;AACT;AAKA,eAAe,UAAU,MAIL;AAClB,QAAM,WAAWH,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAC1D,MAAI;AACJ,MAAI;AACF,cAAU,YAAY,QAAQ;AAAA,EAChC,SAAS,GAAG;AACV,YAAQ,OAAO,MAAM,oBAAqB,EAAY,OAAO;AAAA,CAAI;AACjE,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,YAAQ,OAAO,MAAM,GAAG,oBAAoB,CAAC,CAAC,CAAC;AAAA,CAAI;AACnD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,cAAc,MAAM,aAAa,KAAK,KAAK,GAAG,KAAK,QAAQ;AAC3E,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,KAAK,WACD,uBAAuB,KAAK,QAAQ;AAAA,IACpC;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,YAAY,OAAO;AACnC,QAAM,UAAU,MAAM,aAAa,SAAS,SAAS,eAAe,OAAO,CAAC;AAC5E,QAAM,UAAU,gBAAgB,SAAS,OAAO;AAEhD,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC9D,OAAO;AACL,YAAQ,OAAO,MAAM,GAAG,oBAAoB,OAAO,CAAC;AAAA,CAAI;AAAA,EAC1D;AACA,SAAO,eAAe,OAAO;AAC/B;AAQA,eAAe,WAAW,MAIN;AAClB,QAAM,WAAWA,KAAI,CAAC,aAAa,iBAAiB,CAAC,KAAK;AAG1D,MAAI;AACJ,MAAI,MAAkF,CAAC;AACvF,MAAI,aAAa;AACjB,QAAM,cAAcE,OAAK,UAAU,aAAa,cAAc;AAC9D,MAAIE,YAAW,WAAW,GAAG;AAC3B,iBAAa;AACb,QAAI;AACF,gBAAU,YAAY,QAAQ;AAC9B,YAAM,MAAM,KAAK,MAAMC,eAAa,aAAa,MAAM,CAAC;AACxD,YAAM,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAAI,IAAI,UAAU;AAChF,UAAI,MAAM,QAAW;AAInB,cAAM,WAAW,CAAC,MAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AAC1D,YACE,CAAC,KACD,OAAO,MAAM,YACb,MAAM,QAAQ,CAAC,KACd,EAAE,cAAc,UAAa,CAAC,SAAS,EAAE,SAAS,KAClD,EAAE,eAAe,UAAa,CAAC,SAAS,EAAE,UAAU,KACpD,EAAE,oBAAoB,UAAa,OAAO,EAAE,oBAAoB,WACjE;AACA,kBAAQ,OAAO;AAAA,YACb;AAAA,UACF;AACA,iBAAO;AAAA,QACT;AAKA,cAAM,UAAU,uBAAuB,CAAC;AACxC,YAAI,QAAQ,SAAS,GAAG;AACtB,kBAAQ,OAAO;AAAA,YACb,mEAAmE,QAAQ,KAAK,IAAI,CAAC,kCAAkC,kBAAkB,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA,UACjK;AACA,iBAAO;AAAA,QACT;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,OAAO,MAAM,qBAAsB,EAAY,OAAO;AAAA,CAAI;AAClE,aAAO;AAAA,IACT;AAAA,EACF,OAAO;AACL,cAAU,CAAC;AAAA,EACb;AAEA,QAAM,UAAU,cAAc,MAAM,aAAa,KAAK,KAAK,GAAG,KAAK,QAAQ;AAC3E,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO;AAAA,MACb,KAAK,WACD,uBAAuB,KAAK,QAAQ;AAAA,IACpC;AAAA,IACN;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,MAAM,YAAY,OAAO;AACzC,MAAI,CAAC,SAAS;AACZ,YAAQ,OAAO,MAAM,2BAA2B,QAAQ,EAAE;AAAA,CAAI;AAC9D,WAAO;AAAA,EACT;AACA,QAAM,UAAU,YAAY,OAAO;AAKnC,QAAM,UAAU,cAAc,MAAM,aAAa,SAAS,SAAS,eAAe,OAAO,CAAC,CAAC;AAC3F,QAAM,SAAiC,aACnC;AAAA,IACE,SAAS,gBAAgB,SAAS,OAAO;AAAA,IACzC,GAAI,MAAM,QAAQ,IAAI,SAAS,IAAI,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC;AAAA,IACnE,GAAI,MAAM,QAAQ,IAAI,UAAU,IAAI,EAAE,YAAY,IAAI,WAAW,IAAI,CAAC;AAAA,IACtE,GAAI,IAAI,kBAAkB,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAAA,EACzD,IACA;AACJ,QAAM,SAAS,YAAY,QAAQ,WAAW,MAAM;AAEpD,MAAI,KAAK,MAAM;AACb,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EAC7D,OAAO;AACL,UAAM,OACJ,OAAO,YAAY,aACf,sFACA,qBAAqB,OAAO,OAAO;AACzC,UAAM,QAAQ,OAAO,QAAQ,IAAI,CAAC,MAAM,WAAQ,EAAE,IAAI,KAAK,EAAE,IAAI,EAAE;AACnE,YAAQ,OAAO,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,CAAI;AAAA,EACzD;AACA,SAAO,gBAAgB,OAAO,OAAO;AACvC;AAGA,SAAS,KAAK,MAAc,MAAe,OAAqB;AAC9D,UAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAChC,MAAI,MAAM;AACR,UAAM,KAAK,gBAAgB,IAAI;AAC/B,YAAQ,OAAO;AAAA,MACb,KACI;AAAA,EAAK,KAAK;AAAA,IACV;AAAA,IACN;AAAA,EACF;AACF;AAQA,SAAS,aAAa,GAA2C;AAC/D,MAAI,MAAM,OAAW,QAAO;AAC5B,MAAI;AACF,WAAO,aAAa,CAAC;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACA,IAAM,QAAQ,aAAa,QAAQ,KAAK,CAAC,CAAC;AAC1C,IAAM,SAAS,UAAU,UAAa,YAAY,QAAQ,cAAc,KAAK,EAAE;AAC/E,IAAI,QAAQ;AAMV,MAAI,QAAQ,IAAI,EACb,KAAK,CAAC,SAAS;AACd,YAAQ,WAAW;AAAA,EACrB,CAAC,EACA,MAAM,CAAC,QAAiB;AACvB,YAAQ,OAAO,MAAM,aAAa,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,CAAI;AACtF,YAAQ,WAAW;AAAA,EACrB,CAAC;AACL;","names":["spawnSync","existsSync","mkdirSync","readFileSync","readdirSync","writeFileSync","homedir","join","join","join","mkdirSync","readFileSync","join","mkdirSync","join","readFileSync","spawnSync","existsSync","join","spawnSync","git","git","existsSync","mkdirSync","readFileSync","writeFileSync","join","git","spawnSync","existsSync","join","readFileSync","join","readFileSync","homedir","join","mkdirSync","writeFileSync","join","out","mkdirSync","writeFileSync","join","spawnSync","git","IDENT","entry","readFileSync","basename","dirname","join","basename","join","dirname","readFileSync","readFileSync","readdirSync","dirname","join","SEV_ICON","NON_RECEIPT","scopeLabel","readdirSync","readFileSync","join","dirname","topSeverity","head","readFileSync","readdirSync","join","NON_RECEIPT","readdirSync","readFileSync","join","execFileSync","readFileSync","readdirSync","join","run","execFileSync","readdirSync","join","readFileSync","createHash","existsSync","readFileSync","basename","join","createHash","basename","join","existsSync","readFileSync","existsSync","readdirSync","basename","join","inDiff","existsSync","readdirSync","basename","join","writeFileSync","git","spawnSync","join","homedir","existsSync","readFileSync","entry","mkdirSync","readdirSync","gh","stdin"]}