audit-tools 0.28.0

package/dist/shared/dispatch/tierRank.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tierRank.d.ts","sourceRoot":"","sources":["../../../src/shared/dispatch/tierRank.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAIhE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,iBAAiB,EAEY,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA8B,CAAC;AAEvE;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAG3E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EACvC,CAAC,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,GACtC,iBAAiB,GAAG,SAAS,CAM/B"}

package/dist/shared/dispatch/tierRank.js

@@ -0,0 +1,69 @@
+/**
+ * Single shared dispatch tier-rank authority (P1 / drift-consolidation).
+ *
+ * The `DispatchModelTier` *type* (`small | standard | deep`) is single-sourced in
+ * `types/stepContract.ts`; its *ordering* used to be re-declared in at least five
+ * places (audit `tierRouting.TIER_RANK`, audit `quotaPool.rankOrder`, shared
+ * `rollingDispatch.DISPATCH_TIER_RANK`, remediate `dispatch.RANK_ORDER` and the
+ * local `rankOrder` reducer in `buildImplementModelHint`). Every copy used the
+ * same `{small:0,standard:1,deep:2}` mapping, so they could silently drift. This
+ * module is the one ordering authority — all of those sites now import from here.
+ *
+ * Serves the no-hardcoded-models invariant: a "tier" is a RELATIVE capability
+ * label, never a model name, and its ordering lives in exactly one place.
+ *
+ * Pure / synchronous / zero-dependency beyond the type import.
+ */
+/**
+ * Canonical relative ordering of the dispatch tiers. Higher number = more
+ * capable. The ONLY place this mapping is declared.
+ */
+export const DISPATCH_TIER_RANK = {
+    small: 0,
+    standard: 1,
+    deep: 2,
+};
+/**
+ * Tiers in ascending capability order (`["small", "standard", "deep"]`). Derived
+ * from {@link DISPATCH_TIER_RANK} so it can never disagree with the rank map.
+ */
+export const DISPATCH_TIER_ORDER = Object.keys(DISPATCH_TIER_RANK).sort((a, b) => DISPATCH_TIER_RANK[a] - DISPATCH_TIER_RANK[b]);
+/**
+ * The neutral fallback rank for an absent/unknown tier: the MIDDLE tier
+ * ("standard"). Used where a pool/packet declares no tier — a new provider is
+ * treated as neutral rather than silently mis-classified (INV-shared-core-02).
+ */
+export const DISPATCH_TIER_RANK_FALLBACK = DISPATCH_TIER_RANK.standard;
+/**
+ * Numeric rank for a (possibly undefined) tier. An unknown/absent tier maps to
+ * the neutral middle rank, never to the bottom — so a pool with no declared rank
+ * is treated as "standard", matching the rolling-dispatch capability model.
+ */
+export function tierRank(tier) {
+    if (tier == null)
+        return DISPATCH_TIER_RANK_FALLBACK;
+    return DISPATCH_TIER_RANK[tier] ?? DISPATCH_TIER_RANK_FALLBACK;
+}
+/**
+ * Comparator over tiers: negative when `a` is less capable than `b`, positive
+ * when more capable, zero when equal. `compareTier(a, b)` sorts ascending
+ * (least-capable first); negate it for most-capable-first. Unknown tiers sort as
+ * the neutral middle rank.
+ */
+export function compareTier(a, b) {
+    return tierRank(a) - tierRank(b);
+}
+/**
+ * The most-capable tier among `tiers`, or `undefined` when the list is empty.
+ * Replaces the ad-hoc `reduce` that picked the max tier in
+ * `buildImplementModelHint`.
+ */
+export function mostCapableTier(tiers) {
+    let best;
+    for (const t of tiers) {
+        if (best === undefined || tierRank(t) > tierRank(best))
+            best = t;
+    }
+    return best;
+}
+//# sourceMappingURL=tierRank.js.map

package/dist/shared/dispatch/tierRank.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tierRank.js","sourceRoot":"","sources":["../../../src/shared/dispatch/tierRank.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsC;IACnE,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAC/B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,kBAAkB,CAAC,QAAQ,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,IAA0C;IACjE,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,2BAA2B,CAAC;IACrD,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,2BAA2B,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,CAAuC,EACvC,CAAuC;IAEvC,OAAO,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAuC;IAEvC,IAAI,IAAmC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/shared/engine/obligationEngine.d.ts

@@ -0,0 +1,159 @@
+/**
+ * Shared obligation-engine primitives — the single source for how BOTH
+ * orchestrators express and select ordered obligations, so the engine
+ * vocabulary cannot drift between audit-code and remediate-code (A3).
+ *
+ * An *obligation* is one named unit of progress carrying a precomputed
+ * satisfaction `state`. The engine owns only the ordered *selection* (the scan
+ * below); each orchestrator derives its own obligation states — audit-code from
+ * the artifact-staleness DAG, remediate-code from persisted status + sidecar
+ * files — and maps the selected obligation to an executor.
+ *
+ * This module is A3's seed: it centralizes the vocabulary + the priority scan
+ * that audit-code already had and remediate-code re-derived inside an imperative
+ * cascade. The richer transition/emit advance loop (needed to absorb
+ * remediate-code's internally-recursive control flow) is added here when
+ * remediate-code adopts the engine, so the API is proven by a real consumer
+ * rather than designed in a vacuum. See `docs/a3-a4-engine-unification-plan.md`.
+ */
+/**
+ * Satisfaction state of a single ordered obligation. `missing` and `stale` are
+ * the *actionable* states the scan selects on; `present`, `satisfied`, and
+ * `blocked` are non-actionable.
+ */
+export type ObligationState = "missing" | "present" | "stale" | "blocked" | "satisfied";
+/** A single ordered obligation carrying its precomputed satisfaction state. */
+export interface Obligation {
+    id: string;
+    state: ObligationState;
+    reason?: string;
+}
+/**
+ * Return the first obligation — in `priority` order — that is actionable
+ * (`missing` or `stale`), or `undefined` when every listed obligation is
+ * satisfied / non-actionable. Obligations carry their precomputed `state`; the
+ * engine owns only this ordered scan so the selection cannot drift between
+ * callers.
+ *
+ * Generic over `T extends Obligation` so callers keep their domain obligation
+ * type (e.g. audit-code's `AuditObligation`) as the return type. Ids in
+ * `priority` with no matching obligation are skipped; obligations whose id is
+ * absent from `priority` are never selected (priority is the authority on order
+ * *and* membership).
+ */
+export declare function findFirstActionableObligation<T extends Obligation>(priority: readonly string[], obligations: readonly T[]): T | undefined;
+/**
+ * A *definition* of an ordered obligation for the transition/emit `advance` loop
+ * below — distinct from the precomputed-state `Obligation` *value* the bare
+ * `findFirstActionableObligation` scan consumes. A definition is an id plus two
+ * functions:
+ *
+ * - `derive(state)` computes the obligation's current satisfaction state from the
+ *   orchestrator state. It stays orchestrator-specific: audit-code reads its
+ *   artifact-staleness DAG; remediate-code reads persisted status + sidecar-file
+ *   existence. Only `missing`/`stale` are actionable.
+ * - `execute(state, ctx)` performs the one bounded unit of work and returns an
+ *   `ObligationOutcome` — either a `transition` (state advanced; the loop re-scans
+ *   within the same call) or an `emit` (a host-actionable step; the loop returns
+ *   it).
+ *
+ * Generic over `S` (orchestrator state), `Ctx` (per-orchestrator execution
+ * dependencies — the engine stays agnostic; each orchestrator picks its own `Ctx`
+ * rather than the engine imposing a union) and `Step` (the host-actionable step
+ * type).
+ */
+export interface ObligationDef<S, Ctx, Step> {
+    id: string;
+    derive(state: S): ObligationState;
+    execute(state: S, ctx: Ctx): Promise<ObligationOutcome<S, Step>>;
+}
+/**
+ * The result of executing an obligation.
+ *
+ * - `transition`: the state advanced (in place or replaced); `advance` re-scans
+ *   without a host round-trip. This is the generalization over the bare scan that
+ *   absorbs remediate-code's internally-recursive cascade (e.g.
+ *   planning→implementing→re-scan folded into one call).
+ * - `emit`: a host-actionable step; `advance` stops and returns it. `state`
+ *   carries the (optionally mutated) state to persist alongside the step — omit it
+ *   when the executor left the state unchanged.
+ */
+export type ObligationOutcome<S, Step> = {
+    kind: "transition";
+    state: S;
+} | {
+    kind: "emit";
+    step: Step;
+    state?: S;
+};
+/** An engine instance: an ordered `priority` + the obligation definitions. */
+export interface ObligationEngine<S, Ctx, Step> {
+    priority: readonly string[];
+    obligations: readonly ObligationDef<S, Ctx, Step>[];
+}
+/**
+ * Derive every obligation's state from `state` and return the first actionable
+ * definition in `priority` order, or `undefined` when none is actionable. Reuses
+ * the single `findFirstActionableObligation` scan so the ordered-selection
+ * semantics (priority is the authority on order *and* membership; only
+ * missing/stale are actionable) cannot drift from the bare-scan callers. The
+ * engine itself does no IO — any IO lives inside each obligation's `derive`.
+ */
+export declare function findNextObligation<S, Ctx, Step>(priority: readonly string[], obligations: readonly ObligationDef<S, Ctx, Step>[], state: S): ObligationDef<S, Ctx, Step> | undefined;
+/**
+ * Backstop on consecutive transitions inside `advance` — catches a never-clearing
+ * (cyclic) transition obligation. Far above any legitimate transition chain (the
+ * deepest real remediate-code fold is a handful of transitions per call).
+ */
+export declare const DEFAULT_MAX_TRANSITIONS = 100;
+/**
+ * The outcome of an `advance` run.
+ *
+ * - `step` non-null → an obligation emitted a host-actionable step; `state` is the
+ *   state to persist alongside it.
+ * - `step` null, `stopped` undefined → no obligation is actionable: the run is
+ *   complete.
+ * - `step` null, `stopped: "cycle"` → a transition revisited an already-seen state
+ *   signature, so the fold is not converging; the caller surfaces a graceful
+ *   terminal rather than looping. Only possible when `opts.stateSignature` is
+ *   supplied (otherwise a runaway fold hits the `maxTransitions` throw instead).
+ */
+export interface AdvanceResult<S, Step> {
+    state: S;
+    step: Step | null;
+    stopped?: "cycle";
+}
+/**
+ * Drive the engine from `state`: repeatedly select the highest-priority actionable
+ * obligation and execute it. A `transition` outcome advances the state and the
+ * loop re-scans within the same call (one host round-trip can fold through several
+ * transitions); an `emit` outcome stops the loop and returns the host-actionable
+ * step. When no obligation is actionable the run is complete and `step` is `null`.
+ *
+ * **Cycle termination.** A transition obligation that never clears its own
+ * actionable state would loop forever. Two backstops:
+ * - `opts.stateSignature(state)` (preferred) records the signature of every state
+ *   the loop scans from; a transition landing on an already-seen signature —
+ *   including a *no-progress* transition that leaves the signature unchanged, or a
+ *   multi-obligation A→B→A state cycle — stops the loop with `stopped: "cycle"`.
+ *   This is the precise cycle condition ("a transition revisited a state already
+ *   scanned this run") that the blunt count only approximates, and it terminates
+ *   *gracefully* (the caller renders a terminal) instead of throwing. It also
+ *   handles non-monotonic folds (e.g. audit-code's selective deepening grows the
+ *   work-set before it shrinks): each distinct round is a new signature, so only a
+ *   genuine revisit stops it.
+ * - `maxTransitions` is the absolute backstop for callers that supply no
+ *   signature — it *throws* after that many consecutive transitions.
+ *
+ * `emit` and natural completion both terminate the loop and are never bounded.
+ *
+ * This is a strict generalization of the bare scan: an engine whose obligations
+ * only ever `emit` stops after exactly one unit (audit-code's emit-only,
+ * host-looped contract); `transition` outcomes add the in-call folding both
+ * orchestrators use to avoid host round-trips on deterministic pass-throughs.
+ */
+export declare function advance<S, Ctx, Step>(engine: ObligationEngine<S, Ctx, Step>, state: S, ctx: Ctx, opts?: {
+    maxTransitions?: number;
+    stateSignature?: (state: S) => string;
+}): Promise<AdvanceResult<S, Step>>;
+//# sourceMappingURL=obligationEngine.d.ts.map

package/dist/shared/engine/obligationEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligationEngine.d.ts","sourceRoot":"","sources":["../../../src/shared/engine/obligationEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,SAAS,GACT,OAAO,GACP,SAAS,GACT,WAAW,CAAC;AAEhB,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,UAAU,EAChE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,EAAE,SAAS,CAAC,EAAE,GACxB,CAAC,GAAG,SAAS,CAQf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC;IAClC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;CAClE;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,EAAE,IAAI,IACjC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5C,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI;IAC5C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,WAAW,EAAE,SAAS,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAC7C,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,WAAW,EAAE,SAAS,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EACnD,KAAK,EAAE,CAAC,GACP,aAAa,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAIzC;AAED;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,IAAI;IACpC,KAAK,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EACxC,MAAM,EAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EACtC,KAAK,EAAE,CAAC,EACR,GAAG,EAAE,GAAG,EACR,IAAI,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAA;CAAE,GACxE,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAuCjC"}

package/dist/shared/engine/obligationEngine.js

@@ -0,0 +1,124 @@
+/**
+ * Shared obligation-engine primitives — the single source for how BOTH
+ * orchestrators express and select ordered obligations, so the engine
+ * vocabulary cannot drift between audit-code and remediate-code (A3).
+ *
+ * An *obligation* is one named unit of progress carrying a precomputed
+ * satisfaction `state`. The engine owns only the ordered *selection* (the scan
+ * below); each orchestrator derives its own obligation states — audit-code from
+ * the artifact-staleness DAG, remediate-code from persisted status + sidecar
+ * files — and maps the selected obligation to an executor.
+ *
+ * This module is A3's seed: it centralizes the vocabulary + the priority scan
+ * that audit-code already had and remediate-code re-derived inside an imperative
+ * cascade. The richer transition/emit advance loop (needed to absorb
+ * remediate-code's internally-recursive control flow) is added here when
+ * remediate-code adopts the engine, so the API is proven by a real consumer
+ * rather than designed in a vacuum. See `docs/a3-a4-engine-unification-plan.md`.
+ */
+/**
+ * Return the first obligation — in `priority` order — that is actionable
+ * (`missing` or `stale`), or `undefined` when every listed obligation is
+ * satisfied / non-actionable. Obligations carry their precomputed `state`; the
+ * engine owns only this ordered scan so the selection cannot drift between
+ * callers.
+ *
+ * Generic over `T extends Obligation` so callers keep their domain obligation
+ * type (e.g. audit-code's `AuditObligation`) as the return type. Ids in
+ * `priority` with no matching obligation are skipped; obligations whose id is
+ * absent from `priority` are never selected (priority is the authority on order
+ * *and* membership).
+ */
+export function findFirstActionableObligation(priority, obligations) {
+    for (const id of priority) {
+        const item = obligations.find((o) => o.id === id);
+        if (item && (item.state === "missing" || item.state === "stale")) {
+            return item;
+        }
+    }
+    return undefined;
+}
+/**
+ * Derive every obligation's state from `state` and return the first actionable
+ * definition in `priority` order, or `undefined` when none is actionable. Reuses
+ * the single `findFirstActionableObligation` scan so the ordered-selection
+ * semantics (priority is the authority on order *and* membership; only
+ * missing/stale are actionable) cannot drift from the bare-scan callers. The
+ * engine itself does no IO — any IO lives inside each obligation's `derive`.
+ */
+export function findNextObligation(priority, obligations, state) {
+    const scanned = obligations.map((o) => ({ id: o.id, state: o.derive(state) }));
+    const picked = findFirstActionableObligation(priority, scanned);
+    return picked ? obligations.find((o) => o.id === picked.id) : undefined;
+}
+/**
+ * Backstop on consecutive transitions inside `advance` — catches a never-clearing
+ * (cyclic) transition obligation. Far above any legitimate transition chain (the
+ * deepest real remediate-code fold is a handful of transitions per call).
+ */
+export const DEFAULT_MAX_TRANSITIONS = 100;
+/**
+ * Drive the engine from `state`: repeatedly select the highest-priority actionable
+ * obligation and execute it. A `transition` outcome advances the state and the
+ * loop re-scans within the same call (one host round-trip can fold through several
+ * transitions); an `emit` outcome stops the loop and returns the host-actionable
+ * step. When no obligation is actionable the run is complete and `step` is `null`.
+ *
+ * **Cycle termination.** A transition obligation that never clears its own
+ * actionable state would loop forever. Two backstops:
+ * - `opts.stateSignature(state)` (preferred) records the signature of every state
+ *   the loop scans from; a transition landing on an already-seen signature —
+ *   including a *no-progress* transition that leaves the signature unchanged, or a
+ *   multi-obligation A→B→A state cycle — stops the loop with `stopped: "cycle"`.
+ *   This is the precise cycle condition ("a transition revisited a state already
+ *   scanned this run") that the blunt count only approximates, and it terminates
+ *   *gracefully* (the caller renders a terminal) instead of throwing. It also
+ *   handles non-monotonic folds (e.g. audit-code's selective deepening grows the
+ *   work-set before it shrinks): each distinct round is a new signature, so only a
+ *   genuine revisit stops it.
+ * - `maxTransitions` is the absolute backstop for callers that supply no
+ *   signature — it *throws* after that many consecutive transitions.
+ *
+ * `emit` and natural completion both terminate the loop and are never bounded.
+ *
+ * This is a strict generalization of the bare scan: an engine whose obligations
+ * only ever `emit` stops after exactly one unit (audit-code's emit-only,
+ * host-looped contract); `transition` outcomes add the in-call folding both
+ * orchestrators use to avoid host round-trips on deterministic pass-throughs.
+ */
+export async function advance(engine, state, ctx, opts) {
+    const maxTransitions = opts?.maxTransitions ?? DEFAULT_MAX_TRANSITIONS;
+    const stateSignature = opts?.stateSignature;
+    const visited = stateSignature ? new Set() : null;
+    let current = state;
+    let transitions = 0;
+    for (;;) {
+        if (visited) {
+            const signature = stateSignature(current);
+            if (visited.has(signature)) {
+                // A transition revisited a state already scanned this run — the fold is
+                // not converging (a no-progress step that left the signature unchanged,
+                // or a multi-obligation state cycle). Stop gracefully; the caller renders
+                // a terminal rather than throwing.
+                return { state: current, step: null, stopped: "cycle" };
+            }
+            visited.add(signature);
+        }
+        const obligation = findNextObligation(engine.priority, engine.obligations, current);
+        if (!obligation)
+            return { state: current, step: null };
+        const outcome = await obligation.execute(current, ctx);
+        if (outcome.kind === "emit") {
+            return { state: outcome.state ?? current, step: outcome.step };
+        }
+        current = outcome.state;
+        if (++transitions > maxTransitions) {
+            throw new Error(`advance: exceeded maxTransitions (${maxTransitions}) without reaching ` +
+                `an emit or completion. The last selected obligation was ` +
+                `"${obligation.id}" — a transition obligation is likely not clearing ` +
+                `its own actionable state (cycle). Supply opts.stateSignature for ` +
+                `graceful cycle detection.`);
+        }
+    }
+}
+//# sourceMappingURL=obligationEngine.js.map

package/dist/shared/engine/obligationEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obligationEngine.js","sourceRoot":"","sources":["../../../src/shared/engine/obligationEngine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAqBH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAA2B,EAC3B,WAAyB;IAEzB,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAiDD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA2B,EAC3B,WAAmD,EACnD,KAAQ;IAER,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAoB3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,MAAsC,EACtC,KAAQ,EACR,GAAQ,EACR,IAAyE;IAEzE,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,uBAAuB,CAAC;IACvE,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;IAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,SAAS,CAAC;QACR,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,cAAe,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,wEAAwE;gBACxE,0EAA0E;gBAC1E,mCAAmC;gBACnC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAC1D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CACnC,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,WAAW,EAClB,OAAO,CACR,CAAC;QACF,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QACxB,IAAI,EAAE,WAAW,GAAG,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,qCAAqC,cAAc,qBAAqB;gBACtE,0DAA0D;gBAC1D,IAAI,UAAU,CAAC,EAAE,qDAAqD;gBACtE,mEAAmE;gBACnE,2BAA2B,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/shared/findingIdentitySignature.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The single finding-identity-signature authority for the whole pipeline
+ * (drift-plan R2). Before this module, three independent "is this the same
+ * finding?" rules existed: audit's `reporting/findingIdentity.ts` (this 3-tier
+ * ladder), remediate's `dedup/crossLensDedup.ts` (path + category + title
+ * Jaccard + path overlap), and remediate's `coverage/findingLedger.ts` (bare id
+ * string). They disagreed, so a finding could be one identity to the auditor and
+ * another to the remediator. This module owns the deterministic signature; the
+ * auditor re-keys findings off it, the remediator's dedup uses it as the exact
+ * -match collapse (its Jaccard/overlap heuristic is a fuzzy layer on top), and a
+ * finding's stable id (the coverage-ledger denominator key) is derived from it.
+ *
+ * It is a pure module — no IO, no hashing, no model identity — so the same
+ * semantic finding always yields the same signature across passes, runs, and
+ * both orchestrators.
+ */
+import type { Finding } from "./types/finding.js";
+/**
+ * The stable semantic fields a finding's identity may be derived from.
+ *
+ * Volatile, content-derived values — unit ids, line numbers, pass
+ * ordinals/pass_id, timestamps — are deliberately absent from this shape so
+ * they can never reach the signature at any ladder tier. The raw title is
+ * accepted but only ever influences identity after aggressive normalization
+ * (tier 3), and only when no stronger tier applies.
+ */
+export interface FindingIdentityFields {
+    /** Repo-relative primary file path of the structural anchor, if any. */
+    anchor_path?: string;
+    /** Symbol/scope identifier at the anchor (the anchor's unit/scope). */
+    anchor_symbol?: string;
+    /** Rule/category identifier. */
+    category?: string;
+    /** Lens — paired with category at tier 2 (the existing category convention). */
+    lens?: string;
+    /** Title; aggressively normalized before it can influence identity. */
+    title?: string;
+}
+/** Separator-normalized (always `/`), case-folded, repo-relative path. */
+export declare function normalizeAnchorPath(path: string | undefined): string;
+/**
+ * Aggressively normalize a title so volatile content cannot influence
+ * identity: case-folded; embedded file paths (with optional `:line[:col]`
+ * suffixes) stripped; counts, line numbers, and all other numerals stripped;
+ * punctuation collapsed; whitespace collapsed to single spaces.
+ */
+export declare function normalizeTitle(title: string | undefined): string;
+/**
+ * The single, explicit, deterministic fallback ladder for finding identity.
+ * The same semantic finding always yields the same signature across passes
+ * and runs; the ladder consults stable semantic fields only:
+ *
+ * 1. **Structural anchor** — the repo-relative primary file path
+ *    (separator-normalized, case-folded) together with the anchor's
+ *    symbol/scope. The unit/scope is part of the signature, so two findings at
+ *    the same path but different scopes get distinct signatures.
+ * 2. **Rule/category** — when no structural anchor is available, the
+ *    rule/category identifier paired with the lens (the existing category
+ *    convention).
+ * 3. **Normalized title** — when neither anchor nor rule/category exists, an
+ *    aggressively normalized title (see {@link normalizeTitle}).
+ *
+ * Content-derived unit ids, line numbers, pass ordinals/pass_id, timestamps,
+ * and raw (unnormalized) titles are never part of the signature: they do not
+ * appear in {@link FindingIdentityFields}, so no tier can hash them.
+ *
+ * The signature is also independent of a finding's merged affected-file
+ * *list*: at most the single structural anchor (primary path + scope) can
+ * contribute, never the full file set, so a finding's identity stays put as
+ * additional re-emitted files are unioned into it across passes and runs.
+ */
+export declare function findingIdentitySignature(fields: FindingIdentityFields): string;
+/** Extract only the stable identity-bearing fields from a {@link Finding}. */
+export declare function findingIdentityFields(finding: Finding): FindingIdentityFields;
+/**
+ * The deterministic identity signature of a {@link Finding} — the exact-match
+ * key consumers use to decide whether two findings are the same defect. Shared
+ * by the auditor's id re-keying, the remediator's cross-lens dedup (exact-match
+ * layer), and the coverage ledger.
+ */
+export declare function findingIdentityKey(finding: Finding): string;
+//# sourceMappingURL=findingIdentitySignature.d.ts.map

package/dist/shared/findingIdentitySignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingIdentitySignature.d.ts","sourceRoot":"","sources":["../../src/shared/findingIdentitySignature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAWhE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,qBAAqB,GAC5B,MAAM,CA4BR;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,qBAAqB,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAE3D"}

package/dist/shared/findingIdentitySignature.js

@@ -0,0 +1,114 @@
+/**
+ * The single finding-identity-signature authority for the whole pipeline
+ * (drift-plan R2). Before this module, three independent "is this the same
+ * finding?" rules existed: audit's `reporting/findingIdentity.ts` (this 3-tier
+ * ladder), remediate's `dedup/crossLensDedup.ts` (path + category + title
+ * Jaccard + path overlap), and remediate's `coverage/findingLedger.ts` (bare id
+ * string). They disagreed, so a finding could be one identity to the auditor and
+ * another to the remediator. This module owns the deterministic signature; the
+ * auditor re-keys findings off it, the remediator's dedup uses it as the exact
+ * -match collapse (its Jaccard/overlap heuristic is a fuzzy layer on top), and a
+ * finding's stable id (the coverage-ledger denominator key) is derived from it.
+ *
+ * It is a pure module — no IO, no hashing, no model identity — so the same
+ * semantic finding always yields the same signature across passes, runs, and
+ * both orchestrators.
+ */
+/** Separator-normalized (always `/`), case-folded, repo-relative path. */
+export function normalizeAnchorPath(path) {
+    return (path ?? "")
+        .trim()
+        .replace(/\\/g, "/")
+        .replace(/^\.\//, "")
+        .toLowerCase();
+}
+/**
+ * Aggressively normalize a title so volatile content cannot influence
+ * identity: case-folded; embedded file paths (with optional `:line[:col]`
+ * suffixes) stripped; counts, line numbers, and all other numerals stripped;
+ * punctuation collapsed; whitespace collapsed to single spaces.
+ */
+export function normalizeTitle(title) {
+    return (title ?? "")
+        .toLowerCase()
+        // File paths, optionally suffixed with :line or :line:col.
+        .replace(/[\w.~-]*[\\/][\w.\\/~-]*(:\d+(:\d+)?)?/g, " ")
+        // Counts, line numbers, and any other numerals.
+        .replace(/\d+/g, " ")
+        // Collapse punctuation, then whitespace.
+        .replace(/[^a-z\s]/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/**
+ * The single, explicit, deterministic fallback ladder for finding identity.
+ * The same semantic finding always yields the same signature across passes
+ * and runs; the ladder consults stable semantic fields only:
+ *
+ * 1. **Structural anchor** — the repo-relative primary file path
+ *    (separator-normalized, case-folded) together with the anchor's
+ *    symbol/scope. The unit/scope is part of the signature, so two findings at
+ *    the same path but different scopes get distinct signatures.
+ * 2. **Rule/category** — when no structural anchor is available, the
+ *    rule/category identifier paired with the lens (the existing category
+ *    convention).
+ * 3. **Normalized title** — when neither anchor nor rule/category exists, an
+ *    aggressively normalized title (see {@link normalizeTitle}).
+ *
+ * Content-derived unit ids, line numbers, pass ordinals/pass_id, timestamps,
+ * and raw (unnormalized) titles are never part of the signature: they do not
+ * appear in {@link FindingIdentityFields}, so no tier can hash them.
+ *
+ * The signature is also independent of a finding's merged affected-file
+ * *list*: at most the single structural anchor (primary path + scope) can
+ * contribute, never the full file set, so a finding's identity stays put as
+ * additional re-emitted files are unioned into it across passes and runs.
+ */
+export function findingIdentitySignature(fields) {
+    // Tier 1: structural anchor (path + symbol/scope).
+    const anchorPath = normalizeAnchorPath(fields.anchor_path);
+    if (anchorPath !== "") {
+        const scope = (fields.anchor_symbol ?? "").trim();
+        return `anchor|${anchorPath}|${scope}`;
+    }
+    // Tier 2: rule/category (+ lens, the existing category convention).
+    //
+    // B8 decision (2026-06-17): two DISTINCT fileless findings of the same
+    // lens+category collapse to one identity here — and that is correct, not a bug.
+    // A fileless finding has no structural anchor, so its only stable identity is
+    // lens+category; the title is deliberately tier 3 (volatile — reworded
+    // re-emissions must still collapse, see normalizeTitle). Adding the title to
+    // this tier to split such findings would re-introduce the volatility-driven
+    // OVER-splitting (the same defect re-emitted with a reworded title becoming two
+    // findings) that the single-source authority exists to prevent. If two fileless
+    // findings are genuinely different defects, their CATEGORY must differ — that is
+    // the auditor's discriminator, not the signature's.
+    const category = (fields.category ?? "").trim().toLowerCase();
+    if (category !== "") {
+        const lens = (fields.lens ?? "").trim().toLowerCase();
+        return `rule|${lens}|${category}`;
+    }
+    // Tier 3: aggressively normalized title.
+    return `title|${normalizeTitle(fields.title)}`;
+}
+/** Extract only the stable identity-bearing fields from a {@link Finding}. */
+export function findingIdentityFields(finding) {
+    const anchor = finding.affected_files[0];
+    return {
+        anchor_path: anchor?.path,
+        anchor_symbol: anchor?.symbol,
+        category: finding.category,
+        lens: finding.lens,
+        title: finding.title,
+    };
+}
+/**
+ * The deterministic identity signature of a {@link Finding} — the exact-match
+ * key consumers use to decide whether two findings are the same defect. Shared
+ * by the auditor's id re-keying, the remediator's cross-lens dedup (exact-match
+ * layer), and the coverage ledger.
+ */
+export function findingIdentityKey(finding) {
+    return findingIdentitySignature(findingIdentityFields(finding));
+}
+//# sourceMappingURL=findingIdentitySignature.js.map

package/dist/shared/findingIdentitySignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findingIdentitySignature.js","sourceRoot":"","sources":["../../src/shared/findingIdentitySignature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA0BH,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,WAAW,EAAE,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAyB;IACtD,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,WAAW,EAAE;QACd,2DAA2D;SAC1D,OAAO,CAAC,yCAAyC,EAAE,GAAG,CAAC;QACxD,gDAAgD;SAC/C,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACrB,yCAAyC;SACxC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA6B;IAE7B,mDAAmD;IACnD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,UAAU,UAAU,IAAI,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,oEAAoE;IACpE,EAAE;IACF,uEAAuE;IACvE,gFAAgF;IAChF,8EAA8E;IAC9E,uEAAuE;IACvE,6EAA6E;IAC7E,4EAA4E;IAC5E,gFAAgF;IAChF,gFAAgF;IAChF,iFAAiF;IACjF,oDAAoD;IACpD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACtD,OAAO,QAAQ,IAAI,IAAI,QAAQ,EAAE,CAAC;IACpC,CAAC;IAED,yCAAyC;IACzC,OAAO,SAAS,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,MAAM,GAAgC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO;QACL,WAAW,EAAE,MAAM,EAAE,IAAI;QACzB,aAAa,EAAE,MAAM,EAAE,MAAM;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO,wBAAwB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/shared/git.d.ts

@@ -0,0 +1,18 @@
+/** True when `root` is inside a git working tree. */
+export declare function isGitRepo(root: string): boolean;
+/**
+ * True when `ref` resolves to a commit in `root`. Lets callers distinguish a
+ * mistyped/unknown `--since` ref (fall back to a full audit) from a valid ref
+ * with no changes (`changedFiles` returns `[]` in both cases otherwise).
+ */
+export declare function gitRefExists(root: string, ref: string): boolean;
+/**
+ * Files differing between `since` (a ref/SHA) and the current working tree —
+ * committed, staged, and unstaged. Backs the auditor's `--since` delta mode.
+ */
+export declare function changedFiles(root: string, since: string): string[];
+/** The set of commit SHAs that have touched `path`, newest first. */
+export declare function fileCommits(root: string, path: string): Set<string>;
+/** Working-tree changes vs HEAD plus untracked (non-ignored) files. */
+export declare function stagedAndUntracked(root: string): string[];
+//# sourceMappingURL=git.d.ts.map

package/dist/shared/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/shared/git.ts"],"names":[],"mappings":"AAmBA,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAO/C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAElE;AAED,qEAAqE;AACrE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAEnE;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAazD"}