approval-md 0.0.1 → 0.2.0

package/dist/src/core/loop.js

@@ -0,0 +1,487 @@
+/**
+ * Loop safety (SPEC.md §10.2): "three consecutive `execution.failed` events for
+ * one task escalate to `manual` regardless of policy".
+ *
+ * This is a **pure projection over the log** and nothing else. It reads records,
+ * counts, and returns; it never appends, never reads the clock, and never
+ * consults the policy. Two very different consumers need the same answer and
+ * must not be allowed to disagree about it:
+ *
+ * - `core/gate.ts` refuses to admit a *new* non-manual request for an escalated
+ *   task (the `loop-escalated` refusal);
+ * - `core/execute.ts` refuses to *start* a supervised/autonomous execution for
+ *   one, directing the caller to the manual path.
+ *
+ * It lives in its own module rather than inside `core/execute.ts` for a boring
+ * structural reason: `execute.ts` imports the gate, so the gate cannot import
+ * `execute.ts` back without a cycle. `core/execute.ts` re-exports these names, so
+ * the documented home of the projection is still the execution module.
+ *
+ * ## What "consecutive" means here, stated exactly
+ *
+ * The streak is **per task**, not per action key — SPEC.md §10.2 says "for one
+ * task", and an agent that fails three different actions of the same task in a
+ * row is exactly the runaway loop the rule exists to stop.
+ *
+ * Only two event types move the counter:
+ *
+ * - `execution.failed` increments it;
+ * - `execution.completed` resets it to zero.
+ *
+ * Everything else — `execution.started`, approvals, budget events, another
+ * task's failures — is transparent. In particular a *retry* is not a reset: a
+ * failed action that is started again and fails again is two consecutive
+ * failures, which is the entire point. Only a successful completion is evidence
+ * that the loop broke, so only a completion clears the count.
+ *
+ * ## Escalation is a floor, never a ban
+ *
+ * An escalated task is escalated **to manual**, not to refused. Its manual
+ * actions still request, still grant, and still execute with a token — a human
+ * is now in the loop for every one of them, which is what "escalate to manual"
+ * means. Escalation is also **not** cleared by a human decision, only by an
+ * `execution.completed`: the log records the recovery, or the escalation stands.
+ *
+ * ## The harness scopes (APRV-145)
+ *
+ * Everything above is the per-task streak of SPEC.md §10.2 and is unchanged. A
+ * harness adapter (§10.1) mints a fresh task id for every tool call, so that
+ * streak cannot leave zero on that surface however wedged the session is. The
+ * amended §10.2 answers it with two more streaks, both derived here and both
+ * counted in TOOL CALLS rather than in events:
+ *
+ * - the **session**, `hook:<session id>`, which is a real prefix of every task
+ *   id the adapter mints, so the scope is recovered from a string the runtime
+ *   itself wrote rather than from a field an agent hands the gate;
+ * - the **actor**, the identity the adapter runs as, because a session id is
+ *   authored by the party under oversight and a scope key the subject can
+ *   rotate is a streak the subject can clear (§11.1 invariant 4).
+ *
+ * A command is escalated when EITHER reaches {@link LOOP_ESCALATION_THRESHOLD}.
+ *
+ * ## Only side effects accrue (APRV-280, amended SPEC.md §10.2)
+ *
+ * The streak counts failed executions of classes that DO something. A
+ * `read.*` command that exits non-zero has not failed a side effect: a `grep`
+ * that matches nothing and an `ls` of a path that is not there both exit 1, and
+ * that exit IS the command's answer. Counting those escalated whole sessions to
+ * manual over nothing, which is the incident APRV-280 was filed on: forty-eight
+ * requests queued in an hour behind three failed greps.
+ *
+ * The predicate is {@link isSideEffectingClass} and it is stated once. What it
+ * does NOT do is let a read clear anything: a tool call whose classes are all
+ * reads is transparent to the streak in both directions, so a failing write
+ * streak is not cleared by a successful `ls` in between. The strict direction is
+ * kept everywhere else too — a class this projection cannot resolve from the log
+ * counts as side-effecting, because "we could not establish what this was" is
+ * not "this was harmless".
+ *
+ * The class is read from the `execution.started` record the RUNTIME wrote for
+ * the action key (its `payload.class`), never from anything the reporter said
+ * (§11.1 invariants 1 and 4). The report chooses the outcome; it does not get to
+ * choose the bucket.
+ *
+ * ## Escalation raises scrutiny on side effects only (APRV-297, amended §10.2)
+ *
+ * APRV-280 above says what a read does not ACCRUE. This says what a tripped
+ * floor does not ROUTE, and it is the same sentence read forward: a tool call
+ * whose classes are all `read.*` is answered by the policy under a tripped floor
+ * exactly as it is under a clear one.
+ *
+ * The floor bounds a harm a read cannot cause. It exists to stop an agent
+ * retrying a side effect that keeps failing, so routing a `grep` to a phone buys
+ * no safety at all, and it costs the thing the floor is spending: a human's
+ * attention, once per read, plus the wait the agent spends before it is refused.
+ * On 2026-09-06/07 a floor tripped and a session that could not get an answer
+ * could not read a file either, which is the state this removes.
+ *
+ * Two edges, both narrow. A MIXED tool call is routed whole, as one question,
+ * because the side-effecting half of it is exactly what the floor is for; its
+ * read classes are neither counted nor separately raised, so the approver sees
+ * one prompt for the command's effects and none for its looking. And the
+ * exemption is about ROUTING alone: a read still clears nothing, so a session
+ * cannot read its way out from under a floor.
+ *
+ * This module states the fact; the two surfaces that apply it are the harness
+ * adapter's verdict (`cli/hook.ts`) and the write boundary that re-checks it
+ * (`core/gate.ts`'s `startHarnessExecution`), and both use
+ * {@link isSideEffectingClass} so neither can drift from the other.
+ */
+import { payloadOf } from "./state.js";
+/**
+ * Consecutive failures that force a task to manual (SPEC.md §10.2). Three, and
+ * the number is spelled here once so the gate, the executor, and the CLI cannot
+ * hold three opinions about it.
+ */
+export const LOOP_ESCALATION_THRESHOLD = 3;
+/**
+ * Does an action in this class have a side effect the loop rule is about?
+ * (APRV-280, amended SPEC.md §10.2.)
+ *
+ * THE PREDICATE, exactly: a class is side-effecting unless it is `read` itself
+ * or sits under the `read.` namespace. Everything else — `files.write.*`,
+ * `files.delete.*`, `vcs.*`, `deps.*`, `network.*`, `communicate.*`,
+ * `policy.*`, `log.*`, a routed `policy.edit.*`, and any class this build has
+ * never heard of — is side-effecting. The unknown falls on the strict side by
+ * construction, which is the whole reason the predicate is written as a
+ * carve-OUT of `read.*` rather than as a list of the namespaces that act.
+ *
+ * `core/command-class.ts` already reads `read.*` this way when it decides which
+ * command substitutions may run unattended, and this is deliberately the same
+ * sentence: one reading of "this command only looks at things", used by the
+ * classifier and by loop safety alike.
+ */
+export function isSideEffectingClass(cls) {
+    return !(cls === "read" || cls.startsWith("read."));
+}
+/**
+ * The class the RUNTIME recorded for each action key, from the
+ * `execution.started` it wrote.
+ *
+ * A key with no start, or a start whose payload carries no `class` string, maps
+ * to `null`, and every caller reads `null` as side-effecting. The map is built
+ * in one forward pass and later starts overwrite earlier ones, which cannot
+ * happen for a single-use key and is the harmless reading if it ever does.
+ */
+function classByActionKey(records) {
+    const classes = new Map();
+    for (const record of records) {
+        if (record.event !== "execution.started")
+            continue;
+        const key = record.action_key;
+        if (typeof key !== "string" || key.length === 0)
+            continue;
+        const cls = payloadOf(record)["class"];
+        if (typeof cls === "string" && cls.length > 0)
+            classes.set(key, cls);
+    }
+    return classes;
+}
+/**
+ * Does this outcome record belong to a class the streak counts?
+ *
+ * Fail closed twice over: an outcome whose key names no start, and a start that
+ * recorded no class, both answer `true`.
+ */
+function outcomeIsSideEffecting(record, classes) {
+    const key = record.action_key;
+    if (typeof key !== "string" || key.length === 0)
+        return true;
+    const cls = classes.get(key);
+    return cls === undefined ? true : isSideEffectingClass(cls);
+}
+/**
+ * Loop state for every task that has recorded an execution outcome.
+ *
+ * Returned sorted by task id so the projection is byte-stable: two runs over
+ * the same log produce the same list in the same order, which is what lets
+ * `approval status --json` be pinned by a `deepEqual` test.
+ *
+ * Tasks with side-effecting executions but no failures are included with
+ * `consecutiveFailures: 0` — a caller rendering health wants to know the task
+ * was seen and is clean, and filtering is the caller's business, not this
+ * function's.
+ *
+ * APRV-280: outcomes of `read.*` actions are skipped entirely, so a task whose
+ * every execution was a read appears here not at all. That is the transparency
+ * the amended §10.2 asks for, read in both directions: a failed read accrues
+ * nothing, and a completed read clears nothing either.
+ */
+export function loopEscalation(records) {
+    const states = new Map();
+    const classes = classByActionKey(records);
+    const stateFor = (task) => {
+        const existing = states.get(task);
+        if (existing !== undefined)
+            return existing;
+        const created = {
+            task,
+            consecutiveFailures: 0,
+            escalated: false,
+            streakStartSeq: null,
+            lastFailureSeq: null,
+        };
+        states.set(task, created);
+        return created;
+    };
+    for (const record of records) {
+        const task = record.task;
+        if (typeof task !== "string" || task.length === 0)
+            continue;
+        if (record.event !== "execution.failed" && record.event !== "execution.completed")
+            continue;
+        // APRV-280. Checked before the counter moves and before the task is even
+        // registered: a read is transparent, not a zero.
+        if (!outcomeIsSideEffecting(record, classes))
+            continue;
+        if (record.event === "execution.failed") {
+            const state = stateFor(task);
+            state.consecutiveFailures += 1;
+            state.escalated = state.consecutiveFailures >= LOOP_ESCALATION_THRESHOLD;
+            if (state.streakStartSeq === null)
+                state.streakStartSeq = record.seq;
+            state.lastFailureSeq = record.seq;
+            continue;
+        }
+        if (record.event === "execution.completed") {
+            const state = stateFor(task);
+            state.consecutiveFailures = 0;
+            state.escalated = false;
+            state.streakStartSeq = null;
+            state.lastFailureSeq = null;
+        }
+    }
+    return [...states.values()].sort((a, b) => (a.task < b.task ? -1 : a.task > b.task ? 1 : 0));
+}
+/** Is `task` escalated to manual by loop safety right now? */
+export function isLoopEscalated(records, task) {
+    for (const state of loopEscalation(records)) {
+        if (state.task === task)
+            return state.escalated;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// The harness scopes (APRV-145, amended SPEC.md §10.2)
+// ---------------------------------------------------------------------------
+/** The prefix every harness adapter task id carries (`src/cli/hook.ts`). */
+export const HARNESS_TASK_PREFIX = "hook:";
+/**
+ * The bucket every unreadable session identifier lands in.
+ *
+ * ONE shared bucket, not a fresh one per unreadable id, and the difference is
+ * the whole rule: absence must accrue FASTER and never slower. `parseHookInput`
+ * already substitutes this literal for an absent `session_id`, so the two halves
+ * of the runtime spell it the same way.
+ */
+export const UNKNOWN_SESSION = "unknown-session";
+/**
+ * The session scope key of a harness task id, or `null` for a task no harness
+ * adapter minted.
+ *
+ * DERIVED, never declared. The id is `hook:<session>:<tool-use id>` and this
+ * reads its middle segment back out; nothing here reads a scope an agent named.
+ * A `hook:` task that does not split into exactly three colon-separated parts is
+ * an id this runtime cannot read, so it lands in {@link UNKNOWN_SESSION} with
+ * every other unreadable one.
+ */
+export function harnessSessionOf(task) {
+    if (!task.startsWith(HARNESS_TASK_PREFIX))
+        return null;
+    const parts = task.split(":");
+    // APRV-311: Codex native ids may themselves contain colons, so the adapter
+    // writes fixed-width digests as `hook:codex:<session-digest>:<call-digest>`.
+    // Preserve the session digest as the loop bucket. This arm is deliberately
+    // exact; malformed Codex-shaped tasks fall through to the legacy unknown
+    // bucket rather than selecting a scope from attacker-authored fragments.
+    if (parts.length === 4 &&
+        parts[1] === "codex" &&
+        /^[a-f0-9]{64}$/u.test(parts[2] ?? "") &&
+        /^[a-f0-9]{64}$/u.test(parts[3] ?? "")) {
+        return `${HARNESS_TASK_PREFIX}codex:${parts[2]}`;
+    }
+    if (parts.length !== 3)
+        return `${HARNESS_TASK_PREFIX}${UNKNOWN_SESSION}`;
+    const session = parts[1];
+    if (session === undefined || session.length === 0) {
+        return `${HARNESS_TASK_PREFIX}${UNKNOWN_SESSION}`;
+    }
+    return `${HARNESS_TASK_PREFIX}${session}`;
+}
+/**
+ * Fold every harness task in the log to at most one outcome.
+ *
+ * THE UNIT IS THE TOOL CALL. One tool call is one task id and may declare
+ * several classes, each with its own action key and its own outcome record;
+ * counting events would let a three-class command trip the threshold on a single
+ * failure. So a task folds first: any `execution.failed` under it makes it a
+ * failed tool call, and only a task whose outcomes are all completions counts as
+ * a completed one. A task whose classes disagree is a FAILURE, because ambiguity
+ * resolves stricter.
+ *
+ * The outcome is placed at the seq of the task's LAST outcome record, so
+ * interleaved sessions and a late-arriving counterpart order deterministically
+ * in log order. Never by timestamp.
+ *
+ * APRV-280 subtracts the reads BEFORE the fold: an outcome whose class is
+ * `read.*` is not part of the tool call as loop safety sees it, so a tool call
+ * that declared nothing else produces no outcome here at all and is transparent
+ * to every streak. A mixed command still folds strictly — its side-effecting
+ * halves decide it — because the reads are simply not in the fold.
+ */
+function toolCallOutcomes(records) {
+    const byTask = new Map();
+    const classes = classByActionKey(records);
+    for (const record of records) {
+        if (record.event !== "execution.failed" && record.event !== "execution.completed")
+            continue;
+        const task = record.task;
+        if (typeof task !== "string" || task.length === 0)
+            continue;
+        const session = harnessSessionOf(task);
+        if (session === null)
+            continue;
+        if (!outcomeIsSideEffecting(record, classes))
+            continue;
+        const existing = byTask.get(task);
+        const failed = record.event === "execution.failed";
+        if (existing === undefined) {
+            byTask.set(task, { session, actor: record.actor, failed, seq: record.seq });
+            continue;
+        }
+        existing.actor = record.actor;
+        existing.seq = record.seq;
+        // Sticky: one failure anywhere under the task makes the tool call a failure,
+        // whatever its other classes reported.
+        existing.failed = existing.failed || failed;
+    }
+    return [...byTask.values()].sort((a, b) => a.seq - b.seq);
+}
+/**
+ * Loop state for every harness session and every harness actor the log has seen
+ * an outcome for.
+ *
+ * Sorted by scope then key so the projection is byte-stable, exactly as
+ * {@link loopEscalation} is, which is what lets `approval status --json` be
+ * pinned by a `deepEqual` test.
+ *
+ * What resets a streak is unchanged and deliberately not widened: only an
+ * `execution.completed` in the same scope, of a SIDE-EFFECTING class since
+ * APRV-280. A hook timeout, a deny, a withdrawn request, a granted approval, a
+ * fresh tool call, a successful `grep`, a restarted process and elapsed time all
+ * leave the streak where they found it. Silence is not evidence of recovery, and
+ * neither is a command that did nothing.
+ */
+export function harnessLoopEscalation(records) {
+    const states = new Map();
+    const stateFor = (scope, key) => {
+        const id = `${scope}${key}`;
+        const existing = states.get(id);
+        if (existing !== undefined)
+            return existing;
+        const created = {
+            scope,
+            key,
+            consecutiveFailures: 0,
+            escalated: false,
+            streakStartSeq: null,
+            lastFailureSeq: null,
+        };
+        states.set(id, created);
+        return created;
+    };
+    for (const call of toolCallOutcomes(records)) {
+        for (const state of [stateFor("session", call.session), stateFor("actor", call.actor)]) {
+            if (call.failed) {
+                state.consecutiveFailures += 1;
+                state.escalated = state.consecutiveFailures >= LOOP_ESCALATION_THRESHOLD;
+                if (state.streakStartSeq === null)
+                    state.streakStartSeq = call.seq;
+                state.lastFailureSeq = call.seq;
+                continue;
+            }
+            state.consecutiveFailures = 0;
+            state.escalated = false;
+            state.streakStartSeq = null;
+            state.lastFailureSeq = null;
+        }
+    }
+    return [...states.values()].sort((a, b) => {
+        const left = `${a.scope}${a.key}`;
+        const right = `${b.scope}${b.key}`;
+        return left < right ? -1 : left > right ? 1 : 0;
+    });
+}
+/**
+ * The harness scope that escalated this tool call, or `null` for a command no
+ * streak has floored.
+ *
+ * EITHER scope escalates (amended SPEC.md §10.2). The session is the smallest
+ * scope a runaway actually runs away in; the actor is the backstop, because the
+ * session id is authored by the party under oversight and a scope it can rotate
+ * is a streak it can shed. The session is reported in preference to the actor
+ * where both are tripped, because it is the narrower fact and names the run an
+ * operator has to go and look at.
+ */
+export function harnessLoopFloor(records, task, actor) {
+    const session = harnessSessionOf(task);
+    const states = harnessLoopEscalation(records);
+    const bySession = session === null
+        ? undefined
+        : states.find((state) => state.scope === "session" && state.key === session);
+    if (bySession?.escalated === true)
+        return bySession;
+    const byActor = states.find((state) => state.scope === "actor" && state.key === actor);
+    return byActor?.escalated === true ? byActor : null;
+}
+/**
+ * What clears this streak, in one sentence, for the surface that has to say so
+ * (APRV-280).
+ *
+ * Written here rather than at each call site because three surfaces print it —
+ * the gate's `loop-escalated` refusals, the hook's denies, and `approval
+ * status` — and three copies of a sentence about how to get out of a floor are
+ * three chances to tell an operator something that is not true. Everything in
+ * it is a fact of this module: a completion of a SIDE-EFFECTING class in the
+ * same scope, and nothing else, resets the counter.
+ *
+ * The gate window is named for the harness scopes only, because that is the
+ * surface it reaches: an open window routes every gated tool call through the
+ * bypass path before the floor is ever consulted (SPEC.md §5.2, APRV-214). It is
+ * named as the human's ceremony, which is what it is — it needs a terminal and a
+ * typed `understood`, and an agent may not run it.
+ *
+ * The harness sentence also states the routing exemption of APRV-297, and states
+ * it here for the same reason the clearance is here: the operator reading it in
+ * `approval status` and the agent reading it in a deny need the same account of
+ * what a floor does and does not reach, and two copies would eventually give two.
+ */
+export function loopClearance(scope, key) {
+    if (scope === "task") {
+        return `an execution.completed for task ${key} in a class that has side effects clears it; a read that succeeds clears nothing (amended SPEC.md §10.2)`;
+    }
+    return `one side-effecting tool call completing in this ${scope} scope (${key}) clears it — a human granting any request this floor routes to them, and the command then running, is that completion — or a human opening the gate window (\`approval gate open\`, the human's own ceremony), which bypasses the floor entirely. read.* commands are outside this floor in both directions (amended SPEC.md §10.2): the floor does not route them to a human, so reading and searching keep working while it stands, and a read that succeeds clears nothing.`;
+}
+/** Is this harness tool call floored to manual by either scope right now? */
+export function isHarnessLoopEscalated(records, task, actor) {
+    return harnessLoopFloor(records, task, actor) !== null;
+}
+/**
+ * Coverage of the completion counterpart, for `approval status`.
+ *
+ * INFORMATIONAL. It moves no health verdict and no exit code, for the reason
+ * §8's timestamp anomalies move neither: it is a coverage measurement rather
+ * than an integrity verdict, and a control an operator learns to silence is
+ * worse than one that reports beside the verdict. A persistently high
+ * `unreported` is how an operator learns the post-execution hook is not
+ * installed or not firing.
+ */
+export function harnessOutcomeCoverage(records) {
+    /** Action keys whose latest `execution.started` carried the harness marker. */
+    const open = new Set();
+    let started = 0;
+    let reported = 0;
+    for (const record of records) {
+        const key = record.action_key;
+        if (typeof key !== "string" || key.length === 0)
+            continue;
+        if (record.event === "execution.started") {
+            if (payloadOf(record)["execution"] === "harness") {
+                started += 1;
+                open.add(key);
+            }
+            else {
+                open.delete(key);
+            }
+            continue;
+        }
+        if (record.event === "execution.completed" ||
+            record.event === "execution.failed" ||
+            record.event === "execution.indeterminate") {
+            if (open.delete(key))
+                reported += 1;
+        }
+    }
+    return { started, reported, unreported: started - reported };
+}
+//# sourceMappingURL=loop.js.map

package/dist/src/core/loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loop.js","sourceRoot":"","sources":["../../../src/core/loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4GG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB;YAAE,SAAS;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,MAAmB,EAAE,OAA4B;IAC/E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAeD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAsB;IACnD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE1C,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAiB,EAAE;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAkB;YAC7B,IAAI;YACJ,mBAAmB,EAAE,CAAC;YACtB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,SAAS;QAC5F,yEAAyE;QACzE,iDAAiD;QACjD,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;YAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;YACzE,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;gBAAE,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;YACrE,KAAK,CAAC,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;YACxB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,OAAsB,EAAE,IAAY;IAClE,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EACtC,CAAC;QACD,OAAO,GAAG,mBAAmB,SAAS,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,GAAG,mBAAmB,GAAG,eAAe,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,mBAAmB,GAAG,OAAO,EAAE,CAAC;AAC5C,CAAC;AA6BD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,gBAAgB,CAAC,OAAsB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,KAAK,KAAK,kBAAkB,IAAI,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAAE,SAAS;QAC5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YAAE,SAAS;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,KAAK,kBAAkB,CAAC;QACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAC1B,6EAA6E;QAC7E,uCAAuC;QACvC,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC;IAC9C,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,MAAM,QAAQ,GAAG,CAAC,KAAmB,EAAE,GAAW,EAAoB,EAAE;QACtE,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,KAAK;YACL,GAAG;YACH,mBAAmB,EAAE,CAAC;YACtB,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,IAAI;SACrB,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACvF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC;gBAC/B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,mBAAmB,IAAI,yBAAyB,CAAC;gBACzE,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;oBAAE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;gBACnE,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC9B,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;YACxB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,SAAS,GACb,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;IACjF,IAAI,SAAS,EAAE,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IACvF,OAAO,OAAO,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAAC,KAA4B,EAAE,GAAW;IACrE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,mCAAmC,GAAG,0GAA0G,CAAC;IAC1J,CAAC;IACD,OAAO,mDAAmD,KAAK,WAAW,GAAG,idAAid,CAAC;AACjiB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAAsB,EACtB,IAAY,EACZ,KAAa;IAEb,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAsB;IAC3D,+EAA+E;IAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC1D,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;gBACjD,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IACE,MAAM,CAAC,KAAK,KAAK,qBAAqB;YACtC,MAAM,CAAC,KAAK,KAAK,kBAAkB;YACnC,MAAM,CAAC,KAAK,KAAK,yBAAyB,EAC1C,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,QAAQ,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAG,QAAQ,EAAE,CAAC;AAC/D,CAAC"}

package/dist/src/core/md-fence.d.ts

@@ -0,0 +1,41 @@
+/**
+ * CommonMark fenced-block scanning, as a leaf module.
+ *
+ * `APPROVAL.md` is prose for humans plus fenced blocks for machines: exactly
+ * one ` ```yaml approval-policy ` block (SPEC.md §5) and at most one optional
+ * ` ```yaml approval-values ` block (SPEC.md §5.3). Two readers, two info
+ * strings, one question: which fenced blocks in this markdown carry that label,
+ * and was one of them left open at end of file.
+ *
+ * This module answers that question and nothing else. It was lifted out of
+ * `policy-load.ts` unchanged (APRV-238) so the values reader could ask it too
+ * without importing the policy loader, which is the module a values reader must
+ * stay clear of (SPEC.md §11.1 invariant 10, `tests/values-inert.test.ts`). The
+ * splitter is the one place allowed to know both info strings, because knowing
+ * a label is not reading a block: what it returns is text, and what a caller
+ * does with the text is the caller's whole subject.
+ *
+ * Pure function of the markdown and the info string. No filesystem, no clock,
+ * no schema, no YAML.
+ */
+/** The blocks a scan found, and whether one was left open at end of file. */
+export interface FenceScan {
+    /** Bodies of every block whose info string matched, in document order. */
+    blocks: string[];
+    /** True when a MATCHING fence was opened and never closed before EOF. */
+    unterminated: boolean;
+}
+/**
+ * Scan CommonMark fenced code blocks and collect the bodies of those whose info
+ * string is `infoString` (compared after {@link normaliseInfoString}).
+ *
+ * CommonMark rules honoured, because they decide what is and is not a fence:
+ * an opening fence is 3+ backticks indented at most 3 spaces; its info string
+ * may not contain a backtick; the closing fence is at least as long as the
+ * opener and carries nothing but whitespace. Every non-matching fenced block
+ * (```js, ```yaml, …) is still scanned as a block, so text *inside* it can
+ * never be mistaken for a matching fence. Everything outside a fence — including
+ * yaml-looking prose and 4-space-indented code blocks, which are not fences —
+ * is ignored entirely.
+ */
+export declare function scanFences(markdown: string, infoString: string): FenceScan;

package/dist/src/core/md-fence.js

@@ -0,0 +1,74 @@
+/**
+ * CommonMark fenced-block scanning, as a leaf module.
+ *
+ * `APPROVAL.md` is prose for humans plus fenced blocks for machines: exactly
+ * one ` ```yaml approval-policy ` block (SPEC.md §5) and at most one optional
+ * ` ```yaml approval-values ` block (SPEC.md §5.3). Two readers, two info
+ * strings, one question: which fenced blocks in this markdown carry that label,
+ * and was one of them left open at end of file.
+ *
+ * This module answers that question and nothing else. It was lifted out of
+ * `policy-load.ts` unchanged (APRV-238) so the values reader could ask it too
+ * without importing the policy loader, which is the module a values reader must
+ * stay clear of (SPEC.md §11.1 invariant 10, `tests/values-inert.test.ts`). The
+ * splitter is the one place allowed to know both info strings, because knowing
+ * a label is not reading a block: what it returns is text, and what a caller
+ * does with the text is the caller's whole subject.
+ *
+ * Pure function of the markdown and the info string. No filesystem, no clock,
+ * no schema, no YAML.
+ */
+/** Normalise a fence info string: trim ends, collapse internal whitespace. */
+function normaliseInfoString(info) {
+    return info.trim().replace(/\s+/gu, " ");
+}
+/**
+ * Scan CommonMark fenced code blocks and collect the bodies of those whose info
+ * string is `infoString` (compared after {@link normaliseInfoString}).
+ *
+ * CommonMark rules honoured, because they decide what is and is not a fence:
+ * an opening fence is 3+ backticks indented at most 3 spaces; its info string
+ * may not contain a backtick; the closing fence is at least as long as the
+ * opener and carries nothing but whitespace. Every non-matching fenced block
+ * (```js, ```yaml, …) is still scanned as a block, so text *inside* it can
+ * never be mistaken for a matching fence. Everything outside a fence — including
+ * yaml-looking prose and 4-space-indented code blocks, which are not fences —
+ * is ignored entirely.
+ */
+export function scanFences(markdown, infoString) {
+    const wanted = normaliseInfoString(infoString);
+    const lines = markdown.split(/\r\n|\n|\r/u);
+    const blocks = [];
+    let openLength = 0;
+    let openMatches = false;
+    let body = [];
+    let inFence = false;
+    for (const line of lines) {
+        if (!inFence) {
+            const open = /^ {0,3}(`{3,})(.*)$/u.exec(line);
+            if (open === null)
+                continue;
+            const info = open[2] ?? "";
+            // CommonMark: a backtick fence's info string may not contain a backtick.
+            if (info.includes("`"))
+                continue;
+            inFence = true;
+            openLength = (open[1] ?? "").length;
+            openMatches = normaliseInfoString(info) === wanted;
+            body = [];
+            continue;
+        }
+        const close = /^ {0,3}(`{3,})[ \t]*$/u.exec(line);
+        if (close !== null && (close[1] ?? "").length >= openLength) {
+            if (openMatches)
+                blocks.push(body.join("\n"));
+            inFence = false;
+            openMatches = false;
+            body = [];
+            continue;
+        }
+        body.push(line);
+    }
+    return { blocks, unterminated: inFence && openMatches };
+}
+//# sourceMappingURL=md-fence.js.map

package/dist/src/core/md-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"md-fence.js","sourceRoot":"","sources":["../../../src/core/md-fence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,UAAkB;IAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,yEAAyE;YACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YACjC,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACpC,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;YACnD,IAAI,GAAG,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YAC5D,IAAI,WAAW;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9C,OAAO,GAAG,KAAK,CAAC;YAChB,WAAW,GAAG,KAAK,CAAC;YACpB,IAAI,GAAG,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,CAAC;AAC1D,CAAC"}