audit-tools 0.52.5 → 0.53.0

package/dist/remediate/contractPipeline/artifactStore.js

@@ -1,436 +0,0 @@
-// sites-pinned: tests/remediate/contract-pipeline-artifact-store.test.ts, tests/remediate/contract-review-independence.test.ts, tests/remediate/contract-pipeline.test.ts, tests/remediate/contract-pipeline-adversarial.test.ts
-import { propagateReachability } from "../../shared/graph/orderedReachability.js";
-import { ContractReviewProvenanceSchema, reviewIndependenceIssue } from "../../shared/types/reviewIndependence.js";
-/**
- * Typed read/write helpers for the contract-pipeline artifacts.
- *
- * Two distinct, non-overlapping path roles live under
- * `<artifactsDir>/intake/contract/` (D3):
- *
- * - **Host input** `<name>.input.json` — the authored submission. Ordinary roles
- *   write a raw payload; review roles write the bound review-submission envelope.
- * - **Canonical envelope** `<name>.json` — tool-owned validated domain payload,
- *   dependency hashes and accepted review provenance. Downstream roles read its
- *   `payload` field and never write this file.
- *
- * No host input is rewritten in place. Collapsed ordinary authoring sections
- * may read earlier raw inputs in the same round trip before ingestion; this
- * exception never admits an unvalidated review envelope as canonical data.
- *
- * Independence from StateStore is intentional: these helpers operate on the
- * contract-pipeline subdirectory only and do not touch the remediation
- * state machine.
- */
-import { existsSync } from "node:fs";
-import { mkdir, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { hashContent, isRecord, readOptionalJsonFile, stableStringify, writeJsonFile, } from "audit-tools/shared";
-import { semanticProjection, stableStringifyProjection, } from "./semanticProjection.js";
-// ── Artifact names ────────────────────────────────────────────────────────────
-// Defined in ./artifactNames.js (below both this module and semanticProjection,
-// which needs the name type — declaring it here closed a type-only cycle).
-// Re-exported so existing importers are unchanged.
-import { CP_ARTIFACT_NAMES } from "./artifactNames.js";
-export { CP_ARTIFACT_NAMES };
-// ── Dependency DAG ────────────────────────────────────────────────────────────
-// An artifact is stale when any dependency it lists is missing or has a
-// different content hash than recorded at write time.
-export const DEPENDENCY_MAP = {
-    goal_spec: [],
-    context_bundle: ["goal_spec"],
-    module_decomposition: ["goal_spec", "context_bundle"],
-    module_contracts: ["goal_spec", "context_bundle", "module_decomposition"],
-    seam_reconciliation_report: ["module_decomposition", "module_contracts"],
-    finalized_module_contracts: ["module_contracts", "seam_reconciliation_report"],
-    conceptual_design_critique: ["goal_spec", "module_decomposition", "finalized_module_contracts"],
-    obligation_ledger: ["goal_spec", "finalized_module_contracts"],
-    cyclic_seam_resolution: ["obligation_ledger"],
-    test_validator_plan: ["goal_spec", "obligation_ledger"],
-    contract_assessment_report: ["goal_spec", "finalized_module_contracts", "obligation_ledger", "cyclic_seam_resolution", "test_validator_plan"],
-    counterexample: ["goal_spec", "finalized_module_contracts", "obligation_ledger", "cyclic_seam_resolution", "test_validator_plan", "contract_assessment_report"],
-    judge_report: ["goal_spec", "module_decomposition", "finalized_module_contracts", "obligation_ledger", "cyclic_seam_resolution", "test_validator_plan", "contract_assessment_report", "counterexample"],
-    implementation_dag: [
-        "goal_spec",
-        "context_bundle",
-        "finalized_module_contracts",
-        "obligation_ledger",
-        "cyclic_seam_resolution",
-        "test_validator_plan",
-        "contract_assessment_report",
-        "counterexample",
-        "judge_report",
-    ],
-    verification_report: [
-        "goal_spec",
-        "context_bundle",
-        "finalized_module_contracts",
-        "obligation_ledger",
-        "contract_assessment_report",
-        "implementation_dag",
-    ],
-};
-/**
- * Surface a `content_hash` header that no longer describes its payload.
- *
- * The correction itself is silent-by-design (the payload is authoritative and
- * the read still returns), but a disagreement between a stored header and the
- * bytes beside it is a FACT someone needs: it means the envelope was edited in
- * place, copied, or written by an older hash definition, and the recorded value
- * is the identity the judge/critique repair ledger keys on. A silent in-memory
- * rewrite turns that into a run that behaves correctly and explains nothing.
- *
- * Same shape as the repository's other structured warnings
- * (`file_integrity_io_error` in `utils/fileIntegrity.ts`,
- * `truncated_verification_file_list` in the audit side): one `level: "warn"`
- * JSON object per line on stderr, so a log reader that already parses these
- * needs no new case.
- */
-function reportContentHashMismatch(name, stored, recomputed) {
-    process.stderr.write(JSON.stringify({
-        level: "warn",
-        event: "contract_artifact_content_hash_mismatch",
-        artifact_name: name,
-        stored_content_hash: stored,
-        recomputed_content_hash: recomputed,
-        ts: new Date().toISOString(),
-    }) + "\n");
-}
-/** One dependency hash entry: a contract-pipeline artifact name → sha. */
-function isDependencyHashes(value) {
-    return (isRecord(value) &&
-        Object.entries(value).every(([key, hash]) => CP_ARTIFACT_NAMES.includes(key) &&
-            typeof hash === "string"));
-}
-/**
- * Canonical predicate for a stored content-hash envelope. Single-sourced here so
- * any consumer (the contract-pipeline ingest path, the `validate-artifact` CLI)
- * unwraps with identical structural rules and cannot drift. A plain payload that
- * happens to carry an `artifact_name` but no `content_hash` is NOT an envelope.
- *
- * The THREE-KEY test this used to be (`artifact_name` string, `content_hash`
- * string, `"payload" in value`) was a cast wearing a predicate's name: it admits
- * a bare payload that carries `await`-shaped fields, and — more to the point —
- * it does not check that `artifact_name` is one of the fifteen names the
- * dependency DAG and the semantic projection are keyed by. An envelope whose
- * `artifact_name` was misspelled passes `isEnvelope`, then reads a projection
- * table with an absent key. See {@link readContractArtifact}, which is where
- * that binding is now enforced.
- */
-export function isEnvelope(value) {
-    return (isRecord(value) &&
-        CP_ARTIFACT_NAMES.includes(value.artifact_name) &&
-        typeof value.content_hash === "string" &&
-        value.content_hash.length > 0 &&
-        "payload" in value &&
-        isDependencyHashes(value.dependency_hashes) &&
-        (value.review_provenance === undefined || ContractReviewProvenanceSchema.safeParse(value.review_provenance).success));
-}
-// ── Helpers ───────────────────────────────────────────────────────────────────
-/**
- * Stamp a tool-owned `created_at` onto a raw artifact payload when the host did
- * not provide one. The host has no clock — `created_at` is tool bookkeeping, not
- * a judgment field — so the tool stamps it at the point the payload enters the
- * tool (ingest + the `validate-artifact` self-check), and the host-facing
- * schemas no longer ask for it. A payload that already carries a string
- * `created_at` (e.g. a tool-derived artifact) is returned untouched. The stamp
- * is a universal non-semantic field (`semanticProjection` strips it), so adding
- * it never affects staleness. Non-object payloads pass through unchanged — their
- * own validator reports the shape error.
- */
-export function stampToolCreatedAt(payload, now) {
-    if (!isRecord(payload))
-        return payload;
-    if (typeof payload.created_at === "string" && payload.created_at.length > 0) {
-        return payload;
-    }
-    return { ...payload, created_at: now };
-}
-export function contractPipelineDir(artifactsDir) {
-    return join(artifactsDir, "intake", "contract");
-}
-/**
- * Path to the optional Path-A seed file. Present only when the intake source
- * is a structured audit-findings report; absent for document/conversation runs.
- */
-export function pathASeedFilePath(artifactsDir) {
-    return join(contractPipelineDir(artifactsDir), "path_a_seed.json");
-}
-/**
- * Where a review artifact's diff-based re-review snapshot lives.
- *
- * Single-sourced here, beside the artifact path helpers, because the ARCHIVE
- * boundary has to reach it from a module that must not import the snapshot
- * module's own read/write surface. Kept as a filename rather than a computed
- * `join` in each caller so the two can never disagree about the directory.
- */
-export const REVIEW_SNAPSHOT_DIRNAME = "review-snapshots";
-export function reviewSnapshotDirPath(artifactsDir) {
-    return join(contractPipelineDir(artifactsDir), REVIEW_SNAPSHOT_DIRNAME);
-}
-export function reviewSnapshotFilePath(artifactsDir, name) {
-    return join(reviewSnapshotDirPath(artifactsDir), `${name}.json`);
-}
-/**
- * Drop a review artifact's diff-based re-review snapshot.
- *
- * Called when the artifact's INPUT is destroyed — the ordinary re-emit after an
- * archive, and the promotion rejection that rolls a promoted plan back. The
- * snapshot holds the verdict a re-review would re-affirm, and its whole value
- * depends on being the LAST verdict for THAT input. Left in place across a
- * rewrite it becomes worse than absent: `captureReviewSnapshot` runs at INGEST,
- * which happens AFTER ingest's own staleness pass, so the archive pass inside
- * THIS invocation has already gone by — a snapshot surviving the intervening
- * call would be diffed against the NEW payload while claiming to be the prior
- * verdict, and the worker would be told to re-affirm a verdict about content it
- * never saw. With none present, `buildReReviewSection` renders no section and
- * the phase runs as an ordinary full review, which is correct.
- *
- * Deliberately NOT called for the `stale` archive: that path re-opens a
- * DOWNSTREAM artifact, which by construction has no snapshot of its own (its
- * producer never ran), so there is nothing there to drop and the call would be
- * noise in a hot loop.
- */
-export async function dropReviewSnapshot(artifactsDir, name) {
-    await rm(reviewSnapshotFilePath(artifactsDir, name), { force: true });
-}
-/**
- * Canonical envelope path `<name>.json` — the TOOL-owned content-hash envelope.
- * Host code never reads or writes this; every tool-side consumer reaches it
- * through `readContractArtifact`.
- */
-export function contractArtifactFilePath(artifactsDir, name) {
-    return join(contractPipelineDir(artifactsDir), `${name}.json`);
-}
-/**
- * Host input path `<name>.input.json` — the plain payload the host writes (and
- * reads for upstreams). The host never sees the tool's canonical envelope; the
- * tool reads this at ingest, validates, and derives the canonical `<name>.json`
- * envelope from it (D3). Keeping the two paths disjoint means the on-disk file
- * the host wrote is never mutated into an envelope in place.
- */
-export function contractInputFilePath(artifactsDir, name) {
-    return join(contractPipelineDir(artifactsDir), `${name}.input.json`);
-}
-/**
- * The content hash of a payload — the artifact's IDENTITY, and the value the
- * judge/critique repair ledger keys on.
- *
- * `stableStringify`, not `JSON.stringify`. The hash must depend on the payload's
- * CONTENT and on nothing else, and raw `JSON.stringify` makes it depend on KEY
- * INSERTION ORDER as well: the same contract assembled in a different field
- * order hashes differently. That was latent while the only reader of the header
- * was the writer's own round trip, but the moment a read RECOMPUTES and compares
- * (see {@link readContractArtifact}) it becomes a false tamper report on a file
- * nobody touched. The single deterministic serializer is the shared one
- * (INV-CK-2: "there must be exactly ONE such serializer — never write a second"),
- * so write and read agree by construction rather than by both happening to call
- * the same expression.
- */
-function computeHash(value) {
-    return hashContent(stableStringify(value), { length: 32 });
-}
-/**
- * Hash an artifact's semantic projection (order-independent, stamp-stripped).
- * Exported so the ingest idempotency guard can compare a freshly-read host input
- * against the canonical envelope without re-deriving a new (stamp-bearing)
- * content hash on every next-step.
- */
-export function payloadSemanticHash(name, payload) {
-    return hashContent(stableStringifyProjection(semanticProjection(name, payload)), { length: 32 });
-}
-/**
- * The semantic hash to compare a dependency against. ALWAYS recomputed from the
- * envelope's current `payload` — never read from a stored header field — so an
- * in-place edit to a payload (header untouched) reconverges staleness on the next
- * read. Cosmetic edits project to the same hash (see `semanticProjection`) and so
- * still do not re-stale downstreams (B3).
- */
-export function envelopeSemanticHash(envelope) {
-    return payloadSemanticHash(envelope.artifact_name, envelope.payload);
-}
-// ── Public API ────────────────────────────────────────────────────────────────
-/** Write an artifact envelope. Creates parent directories as needed. */
-export async function writeContractArtifact(artifactsDir, name, payload, review) {
-    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-    const content_hash = computeHash(payload);
-    // Capture each dependency's SEMANTIC-projection hash at write time, so a later
-    // cosmetic edit to that dependency (same projection) does not re-stale this
-    // artifact — only a load-bearing change does (B3).
-    const dependency_hashes = {};
-    for (const dep of DEPENDENCY_MAP[name]) {
-        const depEnvelope = await readContractArtifact(artifactsDir, dep);
-        if (depEnvelope) {
-            dependency_hashes[dep] = envelopeSemanticHash(depEnvelope);
-        }
-    }
-    const envelope = {
-        artifact_name: name,
-        content_hash,
-        dependency_hashes,
-        payload,
-        ...(review ? { review_provenance: { ...review, reviewed_content_hash: content_hash } } : {}),
-    };
-    await writeJsonFile(contractArtifactFilePath(artifactsDir, name), envelope);
-    return envelope;
-}
-/**
- * Write a TOOL-DERIVED artifact to BOTH path roles: the plain payload at the
- * host-input path `<name>.input.json` and the canonical envelope at
- * `<name>.json`.
- *
- * Why the input path too. Every host-facing artifact path the pipeline renders —
- * both where a role WRITES its output and where it READS its upstreams — is
- * `<name>.input.json` (D3: the host's world is entirely plain input files). An
- * artifact the TOOL derives (the obligation ledger, the finalized contracts, a
- * degenerate seam report, a no-cycles seam resolution, a merged shard aggregate)
- * used to land only in the canonical envelope, so any downstream prompt naming
- * it pointed a worker at a file that never existed. Materializing it here makes
- * that ENOENT class unrepresentable: the write map and the prompts' input map
- * are the same map.
- *
- * Deliberately NOT folded into `writeContractArtifact`: that one is also how
- * INGEST wraps a host-authored payload, and writing back there would mutate the
- * host's own input file in place — the exact separation D3 exists to keep. The
- * derived input file is idempotent for ingest: its semantic projection matches
- * the canonical envelope's, so the ingest idempotency guard skips it on every
- * later pass rather than re-deriving.
- */
-export async function writeDerivedContractArtifact(artifactsDir, name, payload) {
-    await mkdir(contractPipelineDir(artifactsDir), { recursive: true });
-    await writeJsonFile(contractInputFilePath(artifactsDir, name), payload);
-    return writeContractArtifact(artifactsDir, name, payload);
-}
-/**
- * Payload of a stored artifact whether or not it has been enveloped yet. A null
- * envelope (absent on disk) yields undefined; a bare payload that was written
- * without the envelope wrapper is returned as-is. Single-sourced here so every
- * consumer unwraps identically (cannot drift from `isEnvelope`).
- */
-export function envelopePayload(envelope) {
-    if (!envelope)
-        return undefined;
-    return isEnvelope(envelope) ? envelope.payload : envelope;
-}
-/**
- * Read a stored artifact envelope, or null if absent.
- *
- * Three checks, all of them about IDENTITY — the file at `<name>.json` must BE
- * the artifact `<name>`, not merely a JSON document that was found there:
- *
- *  1. **Shape.** Parsed against {@link isEnvelope}, never cast. The previous
- *     body was `readOptionalJsonFile<ContractPipelineArtifactEnvelope>` — a
- *     generic TYPE PARAMETER, which is an assertion the compiler erases. A file
- *     containing `{"hello":1}` came back typed as an envelope, and every
- *     downstream `.artifact_name` / `.payload` read was an unchecked property
- *     access on `unknown`-shaped data.
- *  2. **Binding.** `artifact_name` must equal the name that was REQUESTED. The
- *     two are the same value by construction on the write path
- *     ({@link writeContractArtifact} passes one name to both), so a disagreement
- *     means the file was written by something else — a hand edit, a copy, a
- *     rename that missed the header. This is not cosmetic: `artifact_name` is
- *     the key into `DEPENDENCY_MAP` and `semanticProjection`, and a mismatched
- *     name silently reads another artifact's projection table. A mismatched
- *     envelope reads as ABSENT, so the caller's staleness DAG re-opens the
- *     producing phase rather than consuming bytes that cannot be trusted.
- *  3. **Content hash.** Recomputed from the payload and, when it disagrees with
- *     the recorded one, the envelope is returned with
- *     {@link ContractPipelineArtifactEnvelope.content_hash} rewritten to the
- *     RECOMPUTED value. The payload is authoritative — it is what every
- *     consumer reads and what `envelopeSemanticHash` projects — so a header
- *     that no longer describes its payload must not be allowed to keep
- *     speaking. Reading the payload but reporting the stale header's hash is
- *     exactly the failure `detectStaleArtifacts`'s recompute-on-read exists to
- *     prevent (see its note on in-place edits), and the hash is the identity
- *     the judge/critique repair ledger keys on (`judge_hash` /
- *     `critique_hash` in repairState.ts), so a drifted value would make
- *     "already repaired for this report" answer about the wrong report.
- *
- *     Deliberately NOT a null: treating a payload edit as an absent artifact
- *     would erase the distinction the caller needs (absent ⇒ re-emit the
- *     producer; edited ⇒ re-stale the downstreams), and it is a real thing
- *     hosts and tests do.
- *
- * A shape or binding refusal is silent-by-return (null), not a throw: every
- * caller already handles absent (that IS the fresh-run case), and throwing here
- * would turn one damaged file into a failed `next-step` rather than a re-emitted
- * phase.
- */
-export async function readContractArtifact(artifactsDir, name) {
-    const raw = await readOptionalJsonFile(contractArtifactFilePath(artifactsDir, name));
-    if (raw === undefined || raw === null)
-        return null;
-    if (!isEnvelope(raw))
-        return null;
-    if (raw.artifact_name !== name)
-        return null;
-    // Recompute through the SAME `computeHash` the writer used — one serializer
-    // for both directions (`stableStringify`, key-order independent), so a
-    // round-trip through disk always agrees and only a real payload edit fails.
-    // Re-deriving the expression here instead of calling the writer's would be a
-    // second copy of the hash definition, which is how a write and a read come to
-    // disagree about what "the same payload" means.
-    const actualHash = computeHash(raw.payload);
-    if (raw.review_provenance && (raw.review_provenance.reviewed_content_hash !== actualHash ||
-        reviewIndependenceIssue(raw.review_provenance.requirement, raw.review_provenance.review) !== null))
-        return null;
-    if (actualHash !== raw.content_hash) {
-        reportContentHashMismatch(name, raw.content_hash, actualHash);
-        return { ...raw, content_hash: actualHash };
-    }
-    return raw;
-}
-/**
- * Detect stale artifacts by walking the dependency DAG transitively.
- * An artifact is stale when:
- * - A dependency artifact is absent/missing.
- * - A dependency artifact's current SEMANTIC-projection hash differs from what
- *   was recorded at write time in this artifact's envelope. Cosmetic upstream
- *   edits (reworded prose, regenerated timestamps, reordered keys) project to
- *   the same hash and do NOT mark downstreams stale (B3).
- *
- * Absent artifacts (never written) are reported under `absent`, not `stale`.
- */
-export async function detectStaleArtifacts(artifactsDir) {
-    const stale = new Set();
-    const absent = new Set();
-    // Read all present envelopes up front to avoid repeated disk reads.
-    const envelopes = new Map();
-    for (const name of CP_ARTIFACT_NAMES) {
-        envelopes.set(name, await readContractArtifact(artifactsDir, name));
-    }
-    for (const name of CP_ARTIFACT_NAMES) {
-        const envelope = envelopes.get(name);
-        if (!envelope) {
-            absent.add(name);
-            continue;
-        }
-        // Check each immediate dependency.
-        for (const dep of DEPENDENCY_MAP[name]) {
-            const depEnvelope = envelopes.get(dep);
-            if (!depEnvelope) {
-                // Dependency is absent — downstream is stale.
-                stale.add(name);
-                break;
-            }
-            const recordedHash = (envelope.dependency_hashes ?? {})[dep];
-            if (recordedHash !== envelopeSemanticHash(depEnvelope)) {
-                stale.add(name);
-                break;
-            }
-        }
-    }
-    // Absence participates in reachability, but remains separate in the result.
-    // Preserve the old name-outer/dependency-inner edge order and Set insertion order.
-    const reached = new Set([...stale, ...absent]);
-    const edges = CP_ARTIFACT_NAMES.flatMap((name) => DEPENDENCY_MAP[name].map((dep) => [dep, name]));
-    propagateReachability(reached, edges, () => true);
-    return {
-        stale: [...reached].filter((name) => !absent.has(name)),
-        absent: [...absent],
-    };
-}
-/** Returns true when the artifact file is present on disk. */
-export function contractArtifactExists(artifactsDir, name) {
-    return existsSync(contractArtifactFilePath(artifactsDir, name));
-}
-//# sourceMappingURL=artifactStore.js.map

package/dist/remediate/contractPipeline/artifactStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"artifactStore.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/artifactStore.ts"],"names":[],"mappings":"AAAA,iOAAiO;AACjO,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,8BAA8B,EAAiE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAClL;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,WAAW,EACX,QAAQ,EACR,oBAAoB,EACpB,eAAe,EACf,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC,iFAAiF;AACjF,gFAAgF;AAChF,2EAA2E;AAC3E,mDAAmD;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAG7B,iFAAiF;AACjF,wEAAwE;AACxE,sDAAsD;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAyE;IAClG,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,oBAAoB,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACrD,gBAAgB,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,sBAAsB,CAAC;IACzE,0BAA0B,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;IACxE,0BAA0B,EAAE,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC9E,0BAA0B,EAAE,CAAC,WAAW,EAAE,sBAAsB,EAAE,4BAA4B,CAAC;IAC/F,iBAAiB,EAAE,CAAC,WAAW,EAAE,4BAA4B,CAAC;IAC9D,sBAAsB,EAAE,CAAC,mBAAmB,CAAC;IAC7C,mBAAmB,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;IACvD,0BAA0B,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,CAAC;IAC7I,cAAc,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,4BAA4B,CAAC;IAC/J,YAAY,EAAE,CAAC,WAAW,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,gBAAgB,CAAC;IACvM,kBAAkB,EAAE;QAClB,WAAW;QACX,gBAAgB;QAChB,4BAA4B;QAC5B,mBAAmB;QACnB,wBAAwB;QACxB,qBAAqB;QACrB,4BAA4B;QAC5B,gBAAgB;QAChB,cAAc;KACf;IACD,mBAAmB,EAAE;QACnB,WAAW;QACX,gBAAgB;QAChB,4BAA4B;QAC5B,mBAAmB;QACnB,4BAA4B;QAC5B,oBAAoB;KACrB;CACF,CAAC;AAyBF;;;;;;;;;;;;;;;GAeG;AACH,SAAS,yBAAyB,CAChC,IAAkC,EAClC,MAAc,EACd,UAAkB;IAElB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,yCAAyC;QAChD,aAAa,EAAE,IAAI;QACnB,mBAAmB,EAAE,MAAM;QAC3B,uBAAuB,EAAE,UAAU;QACnC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACzB,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CACb,iBAAuC,CAAC,QAAQ,CAAC,GAAG,CAAC;YACtD,OAAO,IAAI,KAAK,QAAQ,CAC3B,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc;IAEd,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACd,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAuB,CAAC;QAChF,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC7B,SAAS,IAAI,KAAK;QAClB,kBAAkB,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC3C,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,8BAA8B,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CACrH,CAAC;AACJ,CAAC;AAGD,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB,EAAE,GAAW;IAC9D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAE1D,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,IAAkC;IAElC,OAAO,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,IAAkC;IAElC,MAAM,EAAE,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,IAAkC;IAElC,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,IAAkC;IAElC,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,aAAa,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,WAAW,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAkC,EAClC,OAAgB;IAEhB,OAAO,WAAW,CAChB,yBAAyB,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAC5D,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA0C;IAE1C,OAAO,mBAAmB,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,iFAAiF;AAEjF,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,IAAkC,EAClC,OAAgB,EAChB,MAAkC;IAElC,MAAM,KAAK,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAE1C,+EAA+E;IAC/E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,iBAAiB,GAA0D,EAAE,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,iBAAiB,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAqC;QACjD,aAAa,EAAE,IAAI;QACnB,YAAY;QACZ,iBAAiB;QACjB,OAAO;QACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,EAAE,GAAG,MAAM,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC;IACF,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,YAAoB,EACpB,IAAkC,EAClC,OAAgB;IAEhB,MAAM,KAAK,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,aAAa,CAAC,qBAAqB,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACxE,OAAO,qBAAqB,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAiD;IAEjD,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,IAAkC;IAElC,MAAM,GAAG,GAAG,MAAM,oBAAoB,CACpC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAC7C,CAAC;IACF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,gDAAgD;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,iBAAiB,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,qBAAqB,KAAK,UAAU;QACtF,uBAAuB,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClH,IAAI,UAAU,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;QACpC,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC9D,OAAO,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEvD,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyE,CAAC;IACnG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QAED,mCAAmC;QACnC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,8CAA8C;gBAC9C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,YAAY,KAAK,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,mFAAmF;IACnF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAC/C,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAU,CAAC,CACxD,CAAC;IACF,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAElD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,IAAkC;IAElC,OAAO,UAAU,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/remediate/contractPipeline/changeClassification.d.ts

@@ -1,130 +0,0 @@
-/**
- * DC-5 — obligation change-vs-addition classification + paired/scoped negative
- * test-spec gate (single source).
- *
- * Two latent failure modes this module closes:
- *
- *   CE-013 (render-only misclassification): the paired-obligation gate used to
- *     force EVERY testable obligation to carry a positive+negative pair, with no
- *     notion of whether the obligation changes prior behavior or adds new
- *     behavior. A pure addition has no behavior to regress, so pairing it is
- *     burden without signal — and, worse, the "classification" lived only in the
- *     prompt prose (render-only), never as a recorded, checkable verdict. This
- *     module classifies each obligation *deterministically first* (does it touch
- *     a symbol/file that already exists?) and records the verdict on the ledger,
- *     so an LLM may confirm/override but the result is never silent.
- *
- *   CE-006 (unscoped repo-wide-grep negative): a behavior-CHANGE obligation's
- *     negative half could be satisfied by an assertion that greps the whole repo
- *     ("no file anywhere contains X") — which rots immediately and proves nothing
- *     about the changed symbol. The negative must be SCOPED to the changed
- *     symbol/file. The scope check is a structural PREDICATE over the assertion
- *     (it must name an anchor AND must not be an unscoped global scan), not a
- *     keyword match — keyword matching alone is exactly what let the unscoped
- *     negative through.
- *
- * Single-source invariant (mirrors `derive.ts`): the deriver, the test-plan
- * derivation gate (`validatePairedObligations`), and the `mergeImplementResults`
- * verify gate ALL classify and pair through the helpers here. No parallel logic.
- */
-import { type ObligationChangeClassification } from "audit-tools/shared";
-/** Extract candidate symbol/file tokens from free text (lowercased, de-noised). */
-export declare function extractSymbolTokens(text: string): string[];
-/**
- * Build the baseline corpus of pre-existing symbol/file tokens from the finalized
- * module contracts. A symbol present here already exists, so an obligation that
- * references it is *changing* existing behavior rather than adding new behavior.
- *
- * The corpus is drawn from the declared interface surface (inputs / outputs /
- * side_effects / validation_boundary) plus each module name — the things the
- * contract says already exist at the seam.
- */
-export declare function buildBaselineSymbolCorpus(finalizedModuleContracts: unknown): Set<string>;
-/**
- * Classify one obligation change-vs-addition deterministically.
- *
- * Heuristic: the obligation *touches an existing symbol* when any symbol token in
- * its description is present in the baseline corpus of pre-existing symbols. Such
- * an obligation is a behavior CHANGE; otherwise it is a pure ADDITION.
- *
- * The matched tokens become `touched_symbols` — the scope anchors a paired
- * negative assertion must name. This is the deterministic FIRST pass; an LLM may
- * confirm or override it via `applyLlmConfirmation`, and the override is recorded.
- */
-export declare function classifyObligationChange(description: string, baselineSymbols: Set<string>): ObligationChangeClassification;
-/**
- * A negative assertion for a behavior-CHANGE obligation is SCOPED when it names
- * at least one of the change's anchors (the touched symbol/file) AND does not
- * perform an affirmative unscoped repo-wide scan. Naming an anchor is necessary
- * but not sufficient: an assertion that both names the symbol and says "grep the
- * whole repo" is still rejected, because the scan, not the symbol, is what it
- * actually checks. A merely DESCRIPTIVE mention of a global scan ("scoped to X,
- * not an unscoped repo-wide check") does NOT disqualify — the veto reads the
- * assertion's action, not the literal words, so a host need not euphemise (CE-006).
- *
- * Returns true when the assertion is acceptably scoped to the change.
- */
-export declare function negativeAssertionIsScoped(assertion: string, anchors: readonly string[]): boolean;
-/** Phrases that mark a negative/failure assertion (paired-obligation half). */
-export declare const NEGATIVE_ASSERTION_PATTERN: RegExp;
-/** Phrases that mark a positive/satisfied assertion (paired-obligation half). */
-export declare const POSITIVE_ASSERTION_PATTERN: RegExp;
-/** The polarity an assertion declares, accounting for an authoritative label. */
-export type AssertionPolarity = "positive" | "negative" | "both" | "none";
-/**
- * Classify one assertion's polarity. An explicit `POSITIVE:` / `NEGATIVE:` label
- * is authoritative and skips the keyword fallback (so "POSITIVE: must not exceed
- * N" counts only as positive). Unlabeled assertions fall through to the keyword
- * regexes, which may match both polarities — run against an identifier-masked copy
- * so a polarity word embedded in a cited id (e.g. `fail` in `OBL-AUTH-fail-session`)
- * doesn't misclassify the assertion.
- */
-export declare function assertionPolarity(assertion: string): AssertionPolarity;
-/**
- * The pairing verdict for a single CHANGE obligation against its covering test
- * specs' assertions. `ok` is true only when BOTH a positive assertion and a
- * SCOPED negative assertion are present. Each reason is a short, stable code the
- * callers turn into a ValidationIssue (test-plan gate) or a block reason (verify
- * gate) — single-sourced so both gates report the same failures.
- */
-export interface PairingVerdict {
-    ok: boolean;
-    hasPositive: boolean;
-    hasNegative: boolean;
-    /** A negative was present but none of them were scoped to the change. */
-    negativeUnscoped: boolean;
-}
-/**
- * Evaluate the paired positive+scoped-negative requirement for a behavior-CHANGE
- * obligation. `anchors` are the change's scope anchors (touched symbols/file).
- *
- * - A positive half is any assertion with positive polarity.
- * - A negative half counts ONLY when it is scoped to the change (CE-006): an
- *   unscoped repo-wide negative does not satisfy the negative requirement.
- *   `negativeUnscoped` is reported when the sole negative(s) failed scoping, so
- *   the diagnostic distinguishes "no negative at all" from "negative not scoped".
- */
-export declare function evaluatePairing(assertions: readonly string[], anchors: readonly string[]): PairingVerdict;
-/**
- * Read an obligation's `change_classification` from a raw, untrusted payload.
- * Returns the narrowed classification, or `undefined` only when the field is
- * genuinely ABSENT — a truly unclassified obligation (e.g. a structural one), which
- * the gates already treat as a CHANGE (fail-closed) at the consumer.
- *
- * A classification that is PRESENT but CORRUPT (not a record, or an unrecognized
- * `change_kind`) is read as a fail-closed CHANGE rather than `undefined` (INV-IR-4):
- * a dropped or garbled classification can never relax the paired-test requirement
- * and can never let incremental item-scoping (contract-incremental-reconvergence)
- * carry a changed item forward as if it were an unchanged addition.
- */
-export declare function readObligationChangeClassification(obligation: unknown): ObligationChangeClassification | undefined;
-/**
- * The scope anchors a paired negative must name for one obligation. Prefers the
- * classification's recorded `touched_symbols`; falls back to the obligation id
- * plus any symbol tokens in its description when the classification carries none
- * (e.g. an unclassified obligation treated as a fail-closed change). Always
- * non-empty when the id is a real id, so a fail-closed change still has a concrete
- * anchor to scope against rather than vacuously accepting any negative.
- */
-export declare function obligationScopeAnchors(obligationId: string, description: string, classification: ObligationChangeClassification | undefined): string[];
-//# sourceMappingURL=changeClassification.d.ts.map

package/dist/remediate/contractPipeline/changeClassification.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"changeClassification.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/changeClassification.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAY,KAAK,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAqBnF,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAoB1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,wBAAwB,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAqBxF;AAKD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,GAC3B,8BAA8B,CAehC;AA0DD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAIT;AAID,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,QACkI,CAAC;AAE1K,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,QACoH,CAAC;AAE5J,iFAAiF;AACjF,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC;AA4G1E;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,CAYtE;AAID;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,yEAAyE;IACzE,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,cAAc,CAmBhB;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,OAAO,GAClB,8BAA8B,GAAG,SAAS,CAkC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,8BAA8B,GAAG,SAAS,GACzD,MAAM,EAAE,CAUV"}