approval-md 0.0.1 → 0.1.0

package/dist/src/cli/checkpoint-tap.js

@@ -0,0 +1,238 @@
+/**
+ * The checkpoint tap: custody, the offer, the prompt text, the signature
+ * (APRV-257, the delivery half of APRV-220).
+ *
+ * APRV-220 built the record and gave a human exactly one way to sign one:
+ * `approval log checkpoint` at a terminal, remembered. This file is what makes
+ * it happen without the remembering, and it is deliberately the ONLY file
+ * between a channel and a signature.
+ *
+ * ## Why custody lives here now
+ *
+ * `core/checkpoint.ts` takes the private key as a value and reads it from
+ * nowhere, so that one file decides where a checkpoint key may come from. Until
+ * this task that file was `cli/log-checkpoint.ts`, because the terminal verb was
+ * the only caller. It is not any more: the Telegram listener and the CLI channel
+ * both sign now. So the decision moved here rather than being copied, and
+ * `cli/log-checkpoint.ts` calls {@link resolveCheckpointKey} like everyone else.
+ * There is still exactly one place to read to learn every way a key can reach a
+ * signature, which was the whole property.
+ *
+ * Two sources, in this order, unchanged from APRV-220:
+ *
+ * 1. `--key-file <path>`, for a key an operator keeps outside the vault.
+ * 2. The credential vault, under `approval.checkpoint.key`. Encrypted at rest
+ *    under the passphrase `vault.passphrase_env` names, which
+ *    `core/child-env.ts` strips from every child this runtime spawns
+ *    (APRV-205), behind a file whose reading classifies `account.credential`.
+ *
+ * There is no `--key` flag and no environment variable holding the key.
+ *
+ * ## Why an agent-launched process cannot reach any of this
+ *
+ * Three independent locks, and the tap adds none of its own — it inherits all
+ * three, which is why the tap can be built at all:
+ *
+ * 1. **Classification.** `approval log checkpoint` and `approval setup
+ *    checkpoint` classify `policy.core` in `core/command-class.ts`, which the
+ *    reference policy holds `human-only`, so the Claude Code hook denies both
+ *    with `hook-class-human-only` before a process starts.
+ * 2. **The passphrase.** `core/child-env.ts` strips `vault.passphrase_env` from
+ *    every child this runtime spawns, so a process an agent launched cannot
+ *    open the vault even if it ran this code.
+ * 3. **The launch.** The listener holds the passphrase because a HUMAN
+ *    exported it into the shell they started `approval up` in. Nothing an agent
+ *    can do puts it into a process the agent controls.
+ *
+ * `tests/checkpoint-tap.test.ts` proves the first two and proves the third
+ * structurally: the hook's module graph never reaches this file.
+ *
+ * ## What the human is shown is what gets signed
+ *
+ * The offer carries a `(seq, hash)`; the prompt prints it; the signature covers
+ * it. The head may have moved several times over between the prompt and the tap
+ * — a phone is in a pocket and a daemon is not — and
+ * {@link ../core/checkpoint.js appendCheckpointAt} signs the head that was on
+ * the screen, checking first that this chain still carries those bytes at that
+ * seq. APRV-220's verify rule (a checkpoint signs any seq below its own) exists
+ * precisely so this is a legal record rather than a clever one.
+ */
+import { readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { appendCheckpointAt, checkpointDue, checkpointPolicyOf, CHECKPOINT_KEY_CREDENTIAL, } from "../core/checkpoint.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { loadPolicy } from "../core/policy-load.js";
+import { getCredential, passphraseEnvFor, passphraseFrom, vaultPathFor } from "../core/vault.js";
+/** Why no key could be had. One code: the repair is the message, not a branch. */
+export const CHECKPOINT_KEY_REFUSAL = "checkpoint-key-unreadable";
+function absolute(path, cwd) {
+    return isAbsolute(path) ? path : resolve(cwd, path);
+}
+/**
+ * The private key, or a refusal naming which source failed and how to fix it.
+ *
+ * Moved verbatim from `cli/log-checkpoint.ts` (APRV-257) so that the terminal
+ * verb, the Telegram listener and the CLI channel share one answer to "where
+ * may a checkpoint key come from". The sentences are unchanged: an operator who
+ * has seen this refusal once should not meet it in new words on another
+ * surface.
+ */
+export function resolveCheckpointKey(keyFile, logPath, vaultFlag, policyWhere, cwd, 
+/**
+ * Where the passphrase is read from. `process.env` in production.
+ *
+ * A seam and not a back door, and the same one `setup adapter` carries: it
+ * goes through {@link passphraseFrom}, which is the function `approval vault
+ * set` uses, and it never resolves `.approval/env` (SPEC.md §11.1 invariant
+ * 7). Injectable so a suite can prove the vault path without mutating an
+ * environment every other test in the process shares.
+ */
+env) {
+    if (keyFile !== null) {
+        const path = absolute(keyFile, cwd);
+        let text;
+        try {
+            text = readFileSync(path, "utf8").trim();
+        }
+        catch (cause) {
+            return {
+                ok: false,
+                code: CHECKPOINT_KEY_REFUSAL,
+                message: `--key-file ${path} could not be read (${cause instanceof Error ? cause.message : String(cause)}); nothing was appended`,
+            };
+        }
+        if (text.length === 0) {
+            return {
+                ok: false,
+                code: CHECKPOINT_KEY_REFUSAL,
+                message: `--key-file ${path} is empty; a checkpoint key is a base64 PKCS#8 Ed25519 private key on one line. Nothing was appended`,
+            };
+        }
+        return { ok: true, privateKey: text };
+    }
+    const vaultPath = vaultFlag === null ? vaultPathFor(logPath) : absolute(vaultFlag, cwd);
+    const passphraseEnv = passphraseEnvFor(loadPolicy(policyWhere));
+    const passphrase = passphraseFrom(passphraseEnv, env ?? process.env);
+    if (passphrase === null) {
+        return {
+            ok: false,
+            code: CHECKPOINT_KEY_REFUSAL,
+            message: `${passphraseEnv} is unset or empty, so the vault holding ${CHECKPOINT_KEY_CREDENTIAL} could not be opened. The passphrase is read from that variable and from nowhere else; there is no --passphrase flag. Nothing was appended`,
+        };
+    }
+    const credential = getCredential(vaultPath, passphrase, CHECKPOINT_KEY_CREDENTIAL);
+    if (!credential.ok) {
+        return {
+            ok: false,
+            code: CHECKPOINT_KEY_REFUSAL,
+            message: `the checkpoint signing key could not be read from ${vaultPath} (${credential.code}: ${credential.message}). Mint one with \`approval setup checkpoint\`, or pass --key-file. Nothing was appended`,
+        };
+    }
+    return { ok: true, privateKey: credential.value };
+}
+// ---------------------------------------------------------------------------
+// The offer
+// ---------------------------------------------------------------------------
+/**
+ * The checkpoint this log is owed, or `null`.
+ *
+ * Reads the policy first and gives up the moment it names no cadence, so a
+ * dispatch cycle on a gate that has never turned checkpoints on pays one policy
+ * load and no log walk. Everything after that is
+ * {@link ../core/checkpoint.js checkpointDue} over verified records, which is
+ * the same call the daemon's warning and doctor's row make: three surfaces,
+ * one rule, no arrangement in which they disagree.
+ *
+ * A log that does not verify produces no offer and no complaint. A chain that
+ * is not fit to be read is not fit to be signed either, and the surfaces that
+ * exist to shout about a bad chain — `approval log verify`, the daemon's
+ * re-proof, doctor's `log` row — are already shouting.
+ */
+export function checkpointOfferFor(tap, now) {
+    const configured = checkpointPolicyOf(tap.policy, tap.schemaDir);
+    if (configured.checkpointEveryMs === null || configured.publicKeys.length === 0)
+        return null;
+    const read = readVerifiedRecords(tap.logPath, tap.schemaDir === undefined ? {} : { schemaDir: tap.schemaDir });
+    if (!read.ok)
+        return null;
+    return checkpointDue({
+        records: read.records,
+        publicKeys: configured.publicKeys,
+        checkpointEveryMs: configured.checkpointEveryMs,
+        ...(now === undefined ? {} : { now }),
+    });
+}
+/**
+ * What a human reads before they tap, on every channel.
+ *
+ * One text for every surface, because the thing being consented to is identical
+ * and a phone that phrased it differently from a terminal would be two claims
+ * about one gesture. The `(seq, hash)` is first and whole: it is the entire
+ * content of the signature, and an approver who cannot see what they are
+ * signing is not approving anything.
+ *
+ * The last line is the one that keeps this honest. Declining costs nothing —
+ * there is no path in this runtime from a checkpoint that is due to a refusal
+ * of anything — and a prompt that implied otherwise would be manufacturing
+ * pressure for a signature.
+ */
+export function checkpointPromptLines(offer) {
+    return [
+        `CHECKPOINT DUE — sign the log head at seq ${String(offer.head.seq)}?`,
+        `head  seq ${String(offer.head.seq)}  ${offer.head.hash}`,
+        offer.since === null
+            ? "This log has never been checkpointed."
+            : `The newest checkpoint is at seq ${String(offer.since)}.`,
+        offer.warning,
+        "Signing appends one log.checkpoint saying that a key no agent process holds saw this head. It authorizes nothing, spends nothing, and decides no request.",
+        "The head may move before you tap. What is signed is the head named above, which is the one you are looking at.",
+        "Not signing is not a refusal of anything: a checkpoint that is owed is a warning at every layer and never a reason to hold up an action.",
+    ];
+}
+/**
+ * Sign one head and append the record, on the machine the channel runs on.
+ *
+ * `head` is the `(seq, hash)` that was on the screen, handed back by the
+ * channel unchanged. It is a head rather than the whole offer on purpose: by
+ * tap time the offer's cadence arithmetic is hours stale and nothing should be
+ * tempted to read it, while the head is the one part that must survive
+ * verbatim.
+ *
+ * The key is resolved at TAP time and not at offer time, and that ordering is
+ * the point: a prompt sitting on a phone for an hour holds no key material
+ * anywhere, and a listener whose vault the operator has since re-keyed refuses
+ * the tap with a sentence rather than signing with something stale.
+ */
+export function signCheckpointOffer(tap, head, actor, channel, cwd) {
+    const key = resolveCheckpointKey(tap.keyFile, tap.logPath, tap.vault, tap.policy, cwd);
+    if (!key.ok)
+        return key;
+    const appended = appendCheckpointAt(tap.logPath, key.privateKey, actor, head, {
+        channel,
+        ...(tap.schemaDir === undefined ? {} : { schemaDir: tap.schemaDir }),
+    });
+    if (!appended.ok)
+        return { ok: false, code: appended.code, message: appended.message };
+    return {
+        ok: true,
+        seq: appended.record.seq,
+        signed: { seq: appended.head.seq, hash: appended.head.hash },
+        fingerprint: appended.fingerprint,
+    };
+}
+/** What a channel says on the message it just edited, once a tap has landed. */
+export function checkpointSignedLines(result) {
+    if (!result.ok) {
+        return [
+            "NOT CHECKPOINTED",
+            `${result.code}: ${result.message}`,
+            "Nothing was appended. The log is unchanged and no verdict anywhere depends on this.",
+        ];
+    }
+    return [
+        "CHECKPOINTED",
+        `log.checkpoint at seq ${String(result.seq)}, signing head seq ${String(result.signed.seq)} ${result.signed.hash}`,
+        `key ${result.fingerprint}`,
+    ];
+}
+//# sourceMappingURL=checkpoint-tap.js.map

package/dist/src/cli/checkpoint-tap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-tap.js","sourceRoot":"","sources":["../../../src/cli/checkpoint-tap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmBjG,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAMlE,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,OAAe,EACf,SAAwB,EACxB,WAAwB,EACxB,GAAW;AACX;;;;;;;;GAQG;AACH,GAAuB;IAEvB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,cAAc,IAAI,uBACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,yBAAyB;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,cAAc,IAAI,sGAAsG;aAClI,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,aAAa,4CAA4C,yBAAyB,4IAA4I;SAC3O,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,qDAAqD,SAAS,KAAK,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,0FAA0F;SAC7M,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB,EAAE,GAAY;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7F,MAAM,IAAI,GAAG,mBAAmB,CAC9B,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAChE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,aAAa,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAsB;IAC1D,OAAO;QACL,6CAA6C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACtE,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACzD,KAAK,CAAC,KAAK,KAAK,IAAI;YAClB,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;QAC7D,KAAK,CAAC,OAAO;QACb,2JAA2J;QAC3J,gHAAgH;QAChH,0IAA0I;KAC3I,CAAC;AACJ,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAkB,EAClB,IAAmC,EACnC,KAAa,EACb,OAAe,EACf,GAAW;IAEX,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;QAC5E,OAAO;QACP,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QACxB,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QAC5D,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,kBAAkB;YAClB,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE;YACnC,qFAAqF;SACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,cAAc;QACd,yBAAyB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAClH,OAAO,MAAM,CAAC,WAAW,EAAE;KAC5B,CAAC;AACJ,CAAC"}

package/dist/src/cli/coverage.js

@@ -0,0 +1,343 @@
+/**
+ * `approval coverage` — observed side effects, joined to the verified log
+ * (APRV-245, SPEC.md §10.1).
+ *
+ * ## What it answers
+ *
+ * "Here is everything the witnesses outside this runtime say happened, and here
+ * is what the log says about each one." Nothing more: the join is
+ * `core/coverage.ts`, the witnesses are `core/coverage-sources/`, and this file
+ * is argument parsing, source selection, and the rendering of a table.
+ *
+ * ## Why it exits 0 with gaps
+ *
+ * Because it is INFORMATIONAL, on exactly SPEC.md §10.1's rule for the APRV-145
+ * harness-start coverage in `approval status`: a coverage measurement is not an
+ * integrity verdict, and a control an operator learns to silence is worse than
+ * one that reports beside the verdict. A gap here is a question ("was this
+ * effect ever declared?"), and questions with legitimate answers must not fail
+ * a build. The two codes it can still emit are the filesystem's: 2 for a usage
+ * error and 4 for a log this process could not read, plus 3 for a torn tail,
+ * because a log it could not read is a report it did not make.
+ *
+ * ## Why a source that cannot be reached is not a gap
+ *
+ * A source reports `available: false` with a reason, and its effects are absent
+ * rather than uncovered. "`gh` is not on PATH" and "`gh` saw nothing" are
+ * different facts, and a report that flattened them would let a broken tool read
+ * as a clean bill of health. Every unavailable source prints its reason on its
+ * own line.
+ *
+ * ## Writes nothing, reads only verified records
+ *
+ * The log is read through `readVerifiedRecords` (SPEC.md §11.1 invariant 1) and
+ * nothing here appends, renders, or caches. Running it changes no state any
+ * later verdict depends on, which is what lets it be safe to run on a timer.
+ */
+import { isAbsolute, resolve as resolvePathSegments } from "node:path";
+import { observeAdapter } from "../core/coverage-sources/adapter.js";
+import { observeGh } from "../core/coverage-sources/gh.js";
+import { DEFAULT_TRUNK_REF, defaultRange, observeGit, } from "../core/coverage-sources/git.js";
+import { coverageReport } from "../core/coverage.js";
+import { loadPolicy, parseDuration } from "../core/policy-load.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { passphraseEnvFor, vaultPathFor } from "../core/vault.js";
+import { agentmailAdapter } from "../adapters/agentmail.js";
+import { vaultCredentialProvider } from "../adapters/vault-provider.js";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { EXIT_IO, EXIT_OK, EXIT_TORN_TAIL, EXIT_USAGE } from "./exit-codes.js";
+import { repoRoot } from "./git-scope.js";
+import { COVERAGE_HELP } from "./help.js";
+import { DEFAULT_LOG_PATH, preflightLog, resolvePath } from "./paths.js";
+import { style, table } from "./style.js";
+import { usageErrorText } from "./usage.js";
+const FLAGS = {
+    "--base": "string",
+    "--head": "string",
+    "--since": "string",
+    "--until": "string",
+    "--source": "string",
+    "--log": "string",
+    "--policy": "string",
+    "--dir": "string",
+    "--vault": "string",
+    "--json": "boolean",
+    "--help": "boolean",
+    "-h": "boolean",
+};
+/** The sources this verb knows how to ask. */
+const KNOWN_SOURCES = ["git", "gh", "agentmail"];
+/** The default set. `agentmail` is opt-in because it opens a vault. */
+const DEFAULT_SOURCES = ["git", "gh"];
+/** The adapter window when `--since` is not given. */
+const DEFAULT_SINCE = "7d";
+function absolute(value, cwd) {
+    return isAbsolute(value) ? value : resolvePathSegments(cwd, value);
+}
+/**
+ * Where policy lives, from `--policy` / `--dir`, with the CLI's cwd default.
+ *
+ * The same four lines `cli/execute.ts` gives `status`, spelled again rather than
+ * imported: that copy is module-private, and importing it would pull the whole
+ * execution module (the appender, the child spawner, the token reader) into a
+ * verb whose entire promise is that it writes nothing. The behaviour is pinned
+ * by the CLI suites on both sides, so a drift would show up as a test failure
+ * rather than as a quietly different discovery order.
+ */
+function policyLocation(flags, cwd) {
+    const policyFlag = stringFlag(flags, "--policy");
+    const dirFlag = stringFlag(flags, "--dir");
+    if (policyFlag !== null)
+        return { file: absolute(policyFlag, cwd) };
+    return { dir: dirFlag === null ? cwd : absolute(dirFlag, cwd) };
+}
+function usageError(streams, json, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "usage", message } })}\n`);
+    else
+        streams.err(usageErrorText(message, COVERAGE_HELP));
+    return EXIT_USAGE;
+}
+function ioError(streams, json, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code: "io", message } })}\n`);
+    else
+        streams.err(`approval: ${message}\n`);
+    return EXIT_IO;
+}
+function emitJson(streams, value) {
+    streams.out(`${JSON.stringify(value)}\n`);
+}
+/**
+ * The evidence column, as one short string a reader can act on.
+ *
+ * The qualifier says how the record was found, so that a weaker match is never
+ * read as a stronger one and the strongest is not read as the ordinary one.
+ * `(id)` is APRV-251's: the record names this exact effect by the provider's own
+ * identifier, which is a different claim from "a record of this class sits in
+ * this effect's window" and prints as one.
+ */
+export function evidenceText(entry) {
+    const evidence = entry.evidence;
+    if (evidence === null)
+        return "none";
+    if ("verdict" in evidence)
+        return evidence.verdict;
+    const qualifier = entry.match === "family" ? " (family)" : entry.match === "provider-ref" ? " (id)" : "";
+    return `seq ${String(evidence.seq)} ${evidence.event}${qualifier}`;
+}
+/** The coverage line one source prints, in the shape the help promises. */
+export function coverageLine(source) {
+    if (!source.available) {
+        return `${source.name}: unavailable (${source.reason ?? "no reason given"})`;
+    }
+    const qualifier = source.reason === null ? "" : ` — ${source.reason}`;
+    return `${source.name}: ${String(source.covered)} of ${String(source.observed)} effect(s) carry evidence${qualifier}`;
+}
+export async function commandCoverage(argv, streams, cwd) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, FLAGS);
+    if (!parsed.ok)
+        return usageError(streams, json, parsed.message);
+    if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+        streams.out(`${COVERAGE_HELP}\n`);
+        return EXIT_OK;
+    }
+    const extra = parsed.positionals[0];
+    if (extra !== undefined) {
+        return usageError(streams, json, `unexpected argument ${JSON.stringify(extra)}`);
+    }
+    const flags = parsed.flags;
+    // --- the sources ------------------------------------------------------
+    const requested = stringFlag(flags, "--source");
+    let sources = [...DEFAULT_SOURCES];
+    if (requested !== null) {
+        const named = requested
+            .split(",")
+            .map((word) => word.trim())
+            .filter((word) => word.length > 0);
+        if (named.length === 0) {
+            return usageError(streams, json, "--source was given no source names");
+        }
+        for (const name of named) {
+            if (!KNOWN_SOURCES.includes(name)) {
+                return usageError(streams, json, `unknown source ${JSON.stringify(name)}; the sources are ${KNOWN_SOURCES.join(", ")}`);
+            }
+        }
+        sources = [...new Set(named)];
+    }
+    // --- the adapter window ----------------------------------------------
+    const sinceText = stringFlag(flags, "--since") ?? DEFAULT_SINCE;
+    const sinceMs = parseDuration(sinceText);
+    if (sinceMs === null) {
+        return usageError(streams, json, `--since ${JSON.stringify(sinceText)} is not a duration (e.g. 7d, 24h, 90m)`);
+    }
+    const untilText = stringFlag(flags, "--until");
+    // The one clock read in this verb, and it reaches only the window a source is
+    // ASKED about. Nothing derived from it is written anywhere.
+    const untilAt = untilText === null ? Date.now() : Date.parse(untilText);
+    if (Number.isNaN(untilAt)) {
+        return usageError(streams, json, `--until ${JSON.stringify(untilText ?? "")} is not an RFC 3339 instant`);
+    }
+    const window = {
+        since: new Date(untilAt - sinceMs).toISOString(),
+        until: new Date(untilAt).toISOString(),
+    };
+    // --- the log ----------------------------------------------------------
+    const logPath = resolvePath(stringFlag(flags, "--log"), DEFAULT_LOG_PATH, cwd);
+    const check = preflightLog(logPath);
+    if (!check.ok)
+        return ioError(streams, json, check.message);
+    const read = readVerifiedRecords(logPath);
+    if (!read.ok) {
+        if (read.code === "log-unreadable")
+            return ioError(streams, json, read.message);
+        if (read.code === "log-torn-tail") {
+            if (json) {
+                streams.err(`${JSON.stringify({ error: { code: read.code, message: read.message } })}\n`);
+            }
+            else {
+                streams.err(`approval: ${read.message}\n`);
+            }
+            return EXIT_TORN_TAIL;
+        }
+        // A corrupt chain is reported and the run stops: this verb reads only
+        // VERIFIED records (SPEC.md §11.1 invariant 1), so a chain that does not
+        // verify leaves it with nothing it is allowed to join against.
+        if (json) {
+            streams.err(`${JSON.stringify({ error: { code: read.code, message: read.message } })}\n`);
+        }
+        else {
+            streams.err(`approval: ${read.message}\n`);
+        }
+        return EXIT_IO;
+    }
+    const records = read.records;
+    const location = policyLocation(flags, cwd);
+    const load = loadPolicy(location.file === undefined ? { dir: location.dir ?? cwd } : { file: location.file });
+    const protectedPaths = load.ok ? (load.policy.protected_paths ?? []) : [];
+    // --- the commit range -------------------------------------------------
+    const root = repoRoot(cwd) ?? cwd;
+    const baseFlag = stringFlag(flags, "--base");
+    const headFlag = stringFlag(flags, "--head");
+    const fallback = baseFlag === null ? defaultRange(root, DEFAULT_TRUNK_REF) : null;
+    const base = baseFlag ?? fallback?.base ?? "HEAD~20";
+    const head = headFlag ?? "HEAD";
+    // --- ask each source --------------------------------------------------
+    const observations = [];
+    for (const name of sources) {
+        if (name === "git") {
+            const seen = observeGit(root, {
+                base,
+                head,
+                policyProtectedPaths: protectedPaths,
+            });
+            const note = fallback?.note;
+            observations.push(note === undefined
+                ? seen
+                : { ...seen, reason: seen.reason === undefined ? note : `${note}; ${seen.reason}` });
+            continue;
+        }
+        if (name === "gh") {
+            observations.push(observeGh(root, window));
+            continue;
+        }
+        observations.push(await observeAgentmailSource(flags, cwd, logPath, window));
+    }
+    // --- the join ---------------------------------------------------------
+    const all = observations.flatMap((observation) => observation.effects);
+    const report = coverageReport(all, records);
+    const byEffect = new Map();
+    for (const entry of report.entries)
+        byEffect.set(`${entry.effect.source}${entry.effect.id}`, entry);
+    const rendered = observations.map((observation) => {
+        const entries = observation.effects.flatMap((effect) => {
+            const entry = byEffect.get(`${effect.source}${effect.id}`);
+            return entry === undefined ? [] : [entry];
+        });
+        return {
+            name: observation.name,
+            available: observation.available,
+            reason: observation.reason ?? null,
+            entries,
+            observed: entries.length,
+            covered: entries.filter((entry) => entry.evidence !== null).length,
+        };
+    });
+    if (json) {
+        emitJson(streams, {
+            ok: true,
+            window: { base, head, since: window.since, until: window.until },
+            sources: rendered.map((source) => ({
+                name: source.name,
+                available: source.available,
+                reason: source.reason,
+                effects: source.entries.map((entry) => ({
+                    id: entry.effect.id,
+                    class: entry.effect.class,
+                    at: entry.effect.at,
+                    actor_hint: entry.effect.actorHint,
+                    detail: entry.effect.detail,
+                    path: entry.effect.path ?? null,
+                    match: entry.match,
+                    evidence: entry.evidence === null
+                        ? null
+                        : "verdict" in entry.evidence
+                            ? { seq: null, event: null, verdict: entry.evidence.verdict }
+                            : { seq: entry.evidence.seq, event: entry.evidence.event, verdict: null },
+                })),
+                covered: source.covered,
+                observed: source.observed,
+            })),
+        });
+        return EXIT_OK;
+    }
+    const st = style({ json });
+    const rows = rendered.flatMap((source) => source.entries.map((entry) => [
+        source.name,
+        entry.effect.id.length > 20 ? `${entry.effect.id.slice(0, 19)}…` : entry.effect.id,
+        entry.effect.class,
+        entry.evidence === null
+            ? { text: "none", role: "warn" }
+            : { text: evidenceText(entry), role: "value" },
+    ]));
+    if (rows.length > 0) {
+        streams.out(`${table(st, rows, { header: ["source", "effect", "class", "evidence"] })}\n`);
+    }
+    streams.out(`range ${base}..${head}, adapter window ${window.since} .. ${window.until}\n`);
+    for (const source of rendered)
+        streams.out(`${coverageLine(source)}\n`);
+    streams.out(`${st.muted("informational: exit 0 with or without gaps. A gap is a question, not a verdict — docs/cli-reference.md#coverage")}\n`);
+    return EXIT_OK;
+}
+/**
+ * The AgentMail source, with the credential provider built exactly as
+ * `approval setup adapter agentmail` builds its probe's.
+ *
+ * `passphraseEnv` comes from the policy and `envFilePath` is deliberately NOT
+ * supplied. The `.approval/env` passphrase fallback is legitimate only inside a
+ * consumed-token window (APRV-168): its whole argument is that a human granted
+ * THIS action and the token is the authority. A reporting verb holds no token,
+ * so it reads the passphrase from the shell environment or it reports that it
+ * could not, which is SPEC.md §11.1 invariant 7 applied to a read.
+ *
+ * A vault that will not open is reported as an unavailable SOURCE with the
+ * reason, never as an exit code: the other sources still have answers, and a
+ * coverage report that refused to print because one provider was unreachable
+ * would be a report people stop running.
+ */
+async function observeAgentmailSource(flags, cwd, logPath, window) {
+    const location = policyLocation(flags, cwd);
+    const load = loadPolicy(location.file === undefined ? { dir: location.dir ?? cwd } : { file: location.file });
+    const passphraseEnv = passphraseEnvFor(load);
+    const vaultFlag = stringFlag(flags, "--vault");
+    const vaultPath = vaultFlag === null ? vaultPathFor(logPath) : absolute(vaultFlag, cwd);
+    const credentials = vaultCredentialProvider({ vaultPath }, { passphraseEnv });
+    // No `secrets` list, and deliberately: this verb never reads the vault's
+    // values itself, so the only party that knows what to scrub is the adapter,
+    // whose own configuration reader redacts before it returns. Assembling a
+    // secret corpus here would mean opening the vault a second time in the one
+    // verb that has no business holding what is in it.
+    return await observeAdapter(agentmailAdapter(), window, credentials);
+}
+//# sourceMappingURL=coverage.js.map

package/dist/src/cli/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../../src/cli/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,GAEX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,cAAc,EAA2C,MAAM,qBAAqB,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAiB,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAA6B;IACtC,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,QAAQ;IACjB,SAAS,EAAE,QAAQ;IACnB,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,SAAS;CAChB,CAAC;AAEF,8CAA8C;AAC9C,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAU,CAAC;AAG1D,uEAAuE;AACvE,MAAM,eAAe,GAA0B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAE7D,sDAAsD;AACtD,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CACrB,KAAuC,EACvC,GAAW;IAEX,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC;IACpE,OAAO,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAClE,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACzD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC/D,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QAC5E,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgB,EAAE,KAAc;IAChD,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAoB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,SAAS,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC;IACnD,MAAM,SAAS,GACb,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,OAAO,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;AACrE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,GAAG,MAAM,CAAC,IAAI,kBAAkB,MAAM,CAAC,MAAM,IAAI,iBAAiB,GAAG,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;IACtE,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,SAAS,EAAE,CAAC;AACxH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAc,EACd,OAAgB,EAChB,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,IAAI,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3B,yEAAyE;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,OAAO,GAAiB,CAAC,GAAG,eAAe,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,SAAS;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,oCAAoC,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAqB,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,wEAAwE;IACxE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,aAAa,CAAC;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,wCAAwC,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,OAAO,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,WAAW,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,6BAA6B,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE;QAChD,KAAK,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;KACvC,CAAC;IAEF,yEAAyE;IACzE,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC5F,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CACrF,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE1E,yEAAyE;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,MAAM,IAAI,GAAG,QAAQ,IAAI,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,IAAI,MAAM,CAAC;IAEhC,yEAAyE;IACzE,MAAM,YAAY,GAAwB,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE;gBAC5B,IAAI;gBACJ,IAAI;gBACJ,oBAAoB,EAAE,cAAc;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;YAC5B,YAAY,CAAC,IAAI,CACf,IAAI,KAAK,SAAS;gBAChB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,CACtF,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,MAAM,sBAAsB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,yEAAyE;IACzE,MAAM,GAAG,GAAqB,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAErG,MAAM,QAAQ,GAAqB,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAClE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,MAAM,EAAE,WAAW,CAAC,MAAM,IAAI,IAAI;YAClC,OAAO;YACP,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,MAAM;SACnE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE;YAChB,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;YAChE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACtC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;oBACnB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;oBACzB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;oBACnB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;oBAClC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;oBAC3B,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EACN,KAAK,CAAC,QAAQ,KAAK,IAAI;wBACrB,CAAC,CAAC,IAAI;wBACN,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ;4BAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE;4BAC7D,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;iBAChF,CAAC,CAAC;gBACH,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CACvC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI;QACX,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAClF,KAAK,CAAC,MAAM,CAAC,KAAK;QAClB,KAAK,CAAC,QAAQ,KAAK,IAAI;YACrB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAe,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE;KAC1D,CAAC,CACH,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,GAAG,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,IAAI,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,IAAI,oBAAoB,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAC3F,KAAK,MAAM,MAAM,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CACT,GAAG,EAAE,CAAC,KAAK,CAAC,iHAAiH,CAAC,IAAI,CACnI,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,sBAAsB,CACnC,KAAuC,EACvC,GAAW,EACX,OAAe,EACf,MAAwC;IAExC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CACrB,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CACrF,CAAC;IACF,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,uBAAuB,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC9E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,mDAAmD;IACnD,OAAO,MAAM,cAAc,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACvE,CAAC"}