audit-tools 0.52.5 → 0.53.0

package/dist/remediate/contractPipeline/executionPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionPlan.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/executionPlan.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA8B,KAAK,oBAAoB,EAAwD,MAAM,qCAAqC,CAAC;AAOlK,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOlB,CAAC;AACZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,wBAAsB,mBAAmB,CAAC,YAAY,EAAC,MAAM,GAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAK3F;AAED,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAItB,CAAC;AAEZ,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMrB,CAAC;AACZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;EAMnB,CAAC;AACZ,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGhB,CAAC;AACZ,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;EAQ1B,CAAC;AACZ,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4E,CAAC;AACtG,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBjB,CAAC;AACZ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;EAIxB,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC7D,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAAoC,CAAC;AAC5F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,WAAW,iBAAiB;IAChC,eAAe,EAAE,kBAAkB,EAAE,CAAC;IACtC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM;;;;;;;mBASpC,cAAc;;;;;EAMhC;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,GAAE,aAAa,CAAC,eAAe,CAAM,GAAG,MAAM,CAOjJ;AAED,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAG1F;AAED,wBAAsB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAMhG;AAED,wBAAsB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAK5F;AA2BD,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,GAAG,MAAM,EAAE,CAqC1G;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IACnC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyDlD;AA8BD,wBAAsB,uBAAuB,CAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,oBAAoB,GAAE,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAU3H;AAED,gGAAgG;AAChG,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EACrF,QAAQ,GAAE,SAAS;IAAE,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAwB1G;AAED,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAKzI;AAED,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAAG,SAAS,CAAC,CA0C3I"}

package/dist/remediate/contractPipeline/executionPlan.js

@@ -0,0 +1,467 @@
+// sites-pinned: tests/remediate/executable-plan-identity.test.ts, tests/remediate/executable-plan-context.test.ts, tests/remediate/executable-plan-safety.test.ts, tests/remediate/execution-unit-runtime.test.ts
+import { join } from "node:path";
+import { mkdir, rename, readFile, lstat, readdir } from "node:fs/promises";
+import { z } from "zod";
+import { hashContent, stableStringify, readOptionalJsonFile, writeJsonFile, repoRelativePath, toPosixPath, commandLeavesDeclaredShape, FindingSchema, AuditReadSchema, readIntentCheckpoint, fileExclusionReason, pathMatchesPrefix, EXCLUDED_OVERRIDE_STATUSES, AUDIT_TOOLS_DIRNAME, compareCodeUnits } from "audit-tools/shared";
+import { IntentCheckpointSchema } from "../../shared/types/intentCheckpoint.js";
+import { ExecutableChangePlanSchema, ExecutionRequestSchema, executionPlanReferenceIssues } from "../../shared/types/executionPlan.js";
+import { ContractReviewProvenanceSchema, reviewIndependenceIssue } from "../../shared/types/reviewIndependence.js";
+import { runTrackedAsync, TRACKED_CHILD_DEADLINE_MS } from "../../shared/tooling/exec.js";
+const text = z.string().trim().min(1);
+const digest = z.string().regex(/^[0-9a-f]{64}$/u);
+const ExecutionIntentSchema = IntentCheckpointSchema.omit({ confirmed_at: true, closing_action: true, closing_custom_command: true, conformance_review: true });
+export const PlanSourceSchema = z.object({
+    plan_id: text,
+    findings: z.array(FindingSchema),
+    request: ExecutionRequestSchema.optional(),
+    audit_read: AuditReadSchema.nullable(),
+    sources: z.array(z.object({ path: text, sha256: digest }).strict()),
+    intent: ExecutionIntentSchema.optional(),
+}).strict();
+export async function readExecutionIntent(artifactsDir) {
+    const checkpoint = await readIntentCheckpoint(join(artifactsDir, "intent_checkpoint.json"));
+    if (!checkpoint)
+        return undefined;
+    const { confirmed_at: _timestamp, closing_action: _closing, closing_custom_command: _command, conformance_review: _conformance, ...intent } = checkpoint;
+    return ExecutionIntentSchema.parse(intent);
+}
+export const PlanSubmissionSchema = z.object({
+    base_revision_sha256: digest.nullable(),
+    plan: ExecutableChangePlanSchema,
+    retired_requirements: z.array(z.object({ id: text, reason: text, replaced_by: z.array(text) }).strict()).default([]),
+}).strict();
+export const CanonicalPlanSchema = z.object({
+    contract_version: z.literal("remediate-code-executable-plan/v1"),
+    revision_sha256: digest,
+    source_sha256: digest,
+    context_files: z.array(z.object({ path: text, sha256: digest.nullable() }).strict()),
+    plan: ExecutableChangePlanSchema,
+}).strict();
+export const ReviewIssueSchema = z.object({
+    id: text,
+    description: text,
+    requirement_ids: z.array(text),
+    unit_ids: z.array(text),
+    blocking: z.boolean(),
+}).strict();
+export const CritiqueSchema = z.object({
+    verdict: z.enum(["approved", "needs_repair"]),
+    issues: z.array(ReviewIssueSchema),
+}).strict();
+export const PlanCounterexampleSchema = z.object({
+    id: text,
+    claim: text,
+    reproduction_steps: z.array(text).min(1),
+    expected: text,
+    actual: text,
+    requirement_ids: z.array(text),
+    unit_ids: z.array(text),
+}).strict();
+export const CriticSchema = z.object({ counterexamples: z.array(PlanCounterexampleSchema) }).strict();
+export const PlanJudgeSchema = z.object({
+    verdict: z.enum(["approved", "needs_repair"]),
+    classifications: z.array(z.object({
+        counterexample_id: text,
+        classification: z.enum(["accepted", "repaired", "invalid", "out_of_scope", "duplicate", "residual_risk"]),
+        rationale: text,
+    }).strict()),
+    requirement_assessments: z.array(z.object({
+        requirement_id: text,
+        verdict: z.enum(["satisfied", "insufficient"]),
+        evidence: z.array(text).min(1),
+    }).strict()),
+    disposition_assessments: z.array(z.object({
+        finding_id: text,
+        verdict: z.enum(["satisfied", "insufficient"]),
+        evidence: z.array(text).min(1),
+    }).strict()),
+    request_disposition_assessment: z.object({ verdict: z.enum(["satisfied", "insufficient"]), evidence: z.array(text).min(1) }).strict().optional(),
+}).strict();
+export const PlanRiskDecisionSchema = z.object({
+    revision_sha256: digest,
+    confirmed_by: z.literal("host"),
+    accepted_counterexample_ids: z.array(text),
+}).strict();
+export const PLAN_REVIEW_ROLES = ["critique", "critic", "judge"];
+export const PlanReviewReceiptSchema = z.object({
+    revision_sha256: digest,
+    role: z.enum(["critique", "critic", "judge"]),
+    input_sha256: digest,
+    provenance: ContractReviewProvenanceSchema,
+    result: z.unknown(),
+}).strict();
+export function executionPlanPaths(artifactsDir) {
+    const directory = join(artifactsDir, "intake", "plan");
+    return {
+        directory,
+        source: join(directory, "source.json"),
+        canonical: join(directory, "plan.json"),
+        submission: join(directory, "plan.input.json"),
+        history: join(directory, "review-history.json"),
+        approval: join(directory, "approval.json"),
+        review: (role) => ({
+            request: join(directory, `${role}.request.json`),
+            submission: join(directory, `${role}.input.json`),
+            accepted: join(directory, `${role}.json`),
+        }),
+    };
+}
+/** Canonical order ignores unrelated insert/reorder, but command order is semantic. */
+export function executionPlanRevision(plan, sourceSha256, contextFiles = []) {
+    const byId = (values) => [...values].sort((a, b) => compareCodeUnits(a.id, b.id));
+    return hashContent(stableStringify({ source_sha256: sourceSha256, context_files: [...contextFiles].sort((a, b) => compareCodeUnits(a.path, b.path)), plan: {
+            ...plan,
+            requirements: byId(plan.requirements),
+            units: byId(plan.units).map(unit => ({ ...unit, dependencies: [...unit.dependencies].sort(), requirement_ids: [...unit.requirement_ids].sort(), source_finding_ids: [...unit.source_finding_ids].sort() })),
+        } }));
+}
+export async function readPlanSource(artifactsDir) {
+    const raw = await readOptionalJsonFile(executionPlanPaths(artifactsDir).source);
+    return raw === undefined ? undefined : PlanSourceSchema.parse(raw);
+}
+export async function readCanonicalPlan(artifactsDir) {
+    const raw = await readOptionalJsonFile(executionPlanPaths(artifactsDir).canonical);
+    if (raw === undefined)
+        return undefined;
+    const canonical = CanonicalPlanSchema.parse(raw);
+    if (executionPlanRevision(canonical.plan, canonical.source_sha256, canonical.context_files) !== canonical.revision_sha256)
+        throw new Error("Canonical executable plan content does not match its revision binding.");
+    return canonical;
+}
+export async function readPlanReviewHistory(artifactsDir) {
+    const raw = await readOptionalJsonFile(executionPlanPaths(artifactsDir).history);
+    return raw === undefined ? { counterexamples: [], accepted_ids: [], repair_rounds: 0 } : z.object({
+        counterexamples: z.array(PlanCounterexampleSchema), accepted_ids: z.array(text), repair_rounds: z.number().int().nonnegative(), repair_revision: digest.optional(), repair_reason: text.optional(),
+    }).strict().parse(raw);
+}
+/** Normalize spelling before review; the canonical grant remains the reviewed grant. */
+function normalizeExecutionPlanPaths(root, plan) {
+    const normalize = (path, label) => {
+        const portable = toPosixPath(path);
+        // Normalize separators BEFORE containment so a Windows-style escape cannot
+        // be interpreted as a harmless filename on a POSIX host.
+        const relative = repoRelativePath(root, portable, label);
+        return portable.endsWith("/") ? `${relative}/` : relative;
+    };
+    return {
+        ...plan,
+        requirements: plan.requirements.map(requirement => ({
+            ...requirement,
+            assertions: requirement.assertions.map(assertion => ({ ...assertion,
+                scope_paths: assertion.scope_paths.map(path => normalize(path, `Requirement ${requirement.id} assertion`)),
+            })),
+        })),
+        units: plan.units.map(unit => ({
+            ...unit,
+            read_paths: unit.read_paths.map(path => normalize(path, `Unit ${unit.id} read scope`)),
+            allowed_files: unit.allowed_files.map(path => normalize(path, `Unit ${unit.id} write scope`)),
+        })),
+    };
+}
+/** Cross-reference and executable-boundary validation, not semantic self-certification. */
+export function executionPlanIssues(root, source, plan) {
+    const issues = executionPlanReferenceIssues(plan, source.findings.map(finding => finding.id));
+    if (plan.plan_id !== source.plan_id)
+        issues.push("plan_id must match the tool-owned source identity.");
+    if (source.request && !plan.units.length && !plan.request_disposition)
+        issues.push("A request needs executable work or an explicit evidence-backed request disposition.");
+    if (plan.request_disposition && (!source.request || plan.units.length > 0))
+        issues.push("A request disposition is only valid for a request with no execution units.");
+    const validatePaths = (paths, label) => {
+        for (const path of paths) {
+            try {
+                repoRelativePath(root, path, label);
+            }
+            catch {
+                issues.push(`${label}: ${path} escapes the repository.`);
+            }
+        }
+    };
+    for (const requirement of plan.requirements) {
+        for (const assertion of requirement.assertions)
+            validatePaths(assertion.scope_paths, `Requirement ${requirement.id} assertion`);
+        if (!plan.units.some(unit => unit.requirement_ids.includes(requirement.id)))
+            issues.push(`Requirement ${requirement.id} has no execution unit.`);
+        if (requirement.change_kind === "structural" && !requirement.assertions.length && !requirement.inapplicable_reason && !plan.units.some(unit => unit.requirement_ids.includes(requirement.id) && unit.required_tests.length))
+            issues.push(`Structural requirement ${requirement.id} needs executable verification or a reviewed inapplicability reason.`);
+    }
+    for (const unit of plan.units) {
+        validatePaths(unit.read_paths, `Unit ${unit.id} read scope`);
+        validatePaths(unit.allowed_files, `Unit ${unit.id} write scope`);
+        if (source.intent) {
+            const checkpoint = { ...source.intent, confirmed_at: "bound" };
+            for (const path of unit.allowed_files) {
+                const reason = fileExclusionReason(path, checkpoint);
+                if (reason)
+                    issues.push(`Unit ${unit.id} writes forbidden scope ${path}: ${reason}`);
+                if (path.endsWith("/")) {
+                    const forbidden = [...(source.intent.excluded_scope ?? []).map(entry => entry.path),
+                        ...(source.intent.disposition_overrides ?? []).filter(entry => EXCLUDED_OVERRIDE_STATUSES.has(entry.status)).map(entry => entry.path),
+                        ...(source.intent.must_not_touch ?? [])];
+                    for (const glob of forbidden) {
+                        const prefix = glob.split(/[?*]/u, 1)[0].replace(/\/$/u, "");
+                        if (!prefix || pathMatchesPrefix(prefix, path) || pathMatchesPrefix(path, prefix))
+                            issues.push(`Unit ${unit.id} directory grant ${path} can include forbidden ${glob}; enumerate permitted files instead.`);
+                    }
+                }
+            }
+        }
+        for (const command of unit.required_tests)
+            if (commandLeavesDeclaredShape(command))
+                issues.push(`Unit ${unit.id} command must be one invocation: ${command}`);
+        for (const requirement of plan.requirements.filter(requirement => unit.requirement_ids.includes(requirement.id)))
+            for (const id of requirement.source_finding_ids)
+                if (!unit.source_finding_ids.includes(id))
+                    issues.push(`Unit ${unit.id} drops requirement source finding ${id}.`);
+        for (const dependency of unit.dependencies) {
+            const prerequisite = plan.units.find(entry => entry.id === dependency);
+            if (prerequisite && (prerequisite.phase_ordinal ?? 0) > (unit.phase_ordinal ?? 0))
+                issues.push(`Unit ${unit.id} depends on a later integration phase.`);
+        }
+    }
+    for (const finding of source.findings)
+        if (!plan.units.some(unit => unit.source_finding_ids.includes(finding.id)) && !plan.source_dispositions.some(entry => entry.finding_id === finding.id))
+            issues.push(`Source finding ${finding.id} has no execution or explicit disposition.`);
+    return issues;
+}
+export async function ingestExecutionPlan(params) {
+    const paths = executionPlanPaths(params.artifactsDir);
+    const raw = await readOptionalJsonFile(paths.submission);
+    if (raw === undefined)
+        return { changed: false, issues: [] };
+    const parsed = PlanSubmissionSchema.safeParse(raw);
+    if (!parsed.success)
+        return { changed: false, issues: parsed.error.issues.map(issue => `${issue.path.join(".")}: ${issue.message}`) };
+    const source = await readPlanSource(params.artifactsDir);
+    if (!source)
+        return { changed: false, issues: ["No tool-owned source record exists."] };
+    if (stableStringify(source.intent ?? null) !== stableStringify(await readExecutionIntent(params.artifactsDir) ?? null))
+        return { changed: false, issues: ["Confirmed intent changed. Refresh the tool-owned input and review the plan under the new scope before proceeding."] };
+    let next;
+    try {
+        next = normalizeExecutionPlanPaths(params.root, parsed.data.plan);
+    }
+    catch (error) {
+        return { changed: false, issues: [error instanceof Error ? error.message : String(error)] };
+    }
+    const previous = await readCanonicalPlan(params.artifactsDir);
+    if (parsed.data.base_revision_sha256 !== (previous?.revision_sha256 ?? null)) {
+        // A crash after the canonical write but before consuming its input must be
+        // resumable. Identical accepted semantics are replay, never a new revision.
+        if (previous && executionPlanRevision(next, hashContent(stableStringify(source)), previous.context_files) === previous.revision_sha256) {
+            await mkdir(join(paths.directory, "submissions"), { recursive: true });
+            await rename(paths.submission, join(paths.directory, "submissions", `${previous.revision_sha256}-${hashContent(stableStringify(raw))}.json`));
+            return { changed: false, issues: [] };
+        }
+        return { changed: false, issues: ["The submission's base revision is stale. Read the current plan and revise that version."] };
+    }
+    const issues = executionPlanIssues(params.root, source, next);
+    const retired = new Map(parsed.data.retired_requirements.map(entry => [entry.id, entry]));
+    for (const requirement of previous?.plan.requirements ?? []) {
+        if (next.requirements.some(entry => entry.id === requirement.id))
+            continue;
+        const decision = retired.get(requirement.id);
+        if (!decision)
+            issues.push(`Requirement ${requirement.id} disappeared. Preserve its ID or state an explicit retirement/supersession reason.`);
+        else
+            for (const id of decision.replaced_by)
+                if (!next.requirements.some(entry => entry.id === id))
+                    issues.push(`Requirement ${requirement.id} supersedes to missing requirement ${id}.`);
+    }
+    for (const [id, accepted] of params.acceptedUnits ?? []) {
+        const nextUnit = next.units.find(unit => unit.id === id);
+        if (stableStringify(nextUnit) !== stableStringify(accepted))
+            issues.push(`Accepted unit ${id} is immutable. Preserve it and add a follow-up unit for additional work.`);
+        const priorUnit = previous?.plan.units.find(unit => unit.id === id);
+        for (const requirementId of priorUnit?.requirement_ids ?? []) {
+            if (stableStringify(previous?.plan.requirements.find(requirement => requirement.id === requirementId)) !== stableStringify(next.requirements.find(requirement => requirement.id === requirementId)))
+                issues.push(`Requirement ${requirementId} is already evidenced by accepted unit ${id}; preserve it and add a new requirement/follow-up unit.`);
+        }
+    }
+    for (const unit of next.units)
+        for (const path of unit.read_paths) {
+            try {
+                if (!(await inspectContextPath(params.root, path)).info)
+                    issues.push(`Unit ${unit.id} read context ${path} does not exist.`);
+            }
+            catch (error) {
+                issues.push(String(error));
+            }
+        }
+    const history = await readPlanReviewHistory(params.artifactsDir);
+    for (const id of history.accepted_ids)
+        if (!next.units.some(unit => unit.addresses_counterexample_ids.includes(id)))
+            issues.push(`Accepted counterexample ${id} must remain addressed by an execution unit.`);
+    if (issues.length)
+        return { changed: false, issues };
+    const sourceSha = hashContent(stableStringify(source));
+    let contextFiles;
+    try {
+        contextFiles = await captureExecutionContext(params.root, next);
+    }
+    catch (error) {
+        return { changed: false, issues: [error instanceof Error ? error.message : String(error)] };
+    }
+    const revision = executionPlanRevision(next, sourceSha, contextFiles);
+    const canonical = { contract_version: "remediate-code-executable-plan/v1", revision_sha256: revision, source_sha256: sourceSha, context_files: contextFiles, plan: next };
+    if (previous)
+        await writeJsonFile(join(paths.directory, "history", `${previous.revision_sha256}.json`), previous);
+    await writeJsonFile(paths.canonical, canonical);
+    // Keep the semantic amendment itself, including explicit retirement decisions.
+    await mkdir(join(paths.directory, "submissions"), { recursive: true });
+    await rename(paths.submission, join(paths.directory, "submissions", `${revision}-${Date.now()}.json`));
+    return { changed: previous?.revision_sha256 !== revision, issues: [] };
+}
+/**
+ * Lexical containment alone cannot authorize reading through a symlinked parent.
+ * Inspect every existing component before descending, including for future write
+ * targets. The caller-selected root may itself be an alias; interior links must
+ * be declared by their contained target instead. This is a fresh path check, not
+ * a claim of race-free filesystem isolation against concurrent directory swaps.
+ */
+async function inspectContextPath(root, path) {
+    const relative = repoRelativePath(root, path, "review context");
+    const parts = relative.split("/");
+    let absolute = root;
+    let info;
+    for (const [index, part] of parts.entries()) {
+        absolute = join(absolute, part);
+        try {
+            info = await lstat(absolute);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return { relative, absolute: join(root, relative) };
+            throw error;
+        }
+        if (info.isSymbolicLink())
+            throw new Error(`Review context ${relative} traverses a symbolic link at ${parts.slice(0, index + 1).join("/")}; declare its contained target explicitly.`);
+        if (index < parts.length - 1 && !info.isDirectory())
+            throw new Error(`Review context ${relative} traverses a non-directory path.`);
+    }
+    if (info && !info.isFile() && !info.isDirectory())
+        throw new Error(`Review context ${relative} is not a regular file or directory.`);
+    return { relative, absolute, info };
+}
+export async function captureExecutionContext(root, plan) {
+    const files = new Map();
+    const collect = async (path) => {
+        const { relative, absolute, info } = await inspectContextPath(root, path);
+        if (!info) {
+            files.set(relative, null);
+            return;
+        }
+        if (info.isDirectory())
+            for (const name of (await readdir(absolute)).sort().filter(name => name !== ".git" && name !== AUDIT_TOOLS_DIRNAME))
+                await collect(join(relative, name));
+        else
+            files.set(relative, hashContent((await readFile(absolute)).toString("base64")));
+    };
+    for (const path of new Set(plan.units.flatMap(unit => [...unit.read_paths, ...unit.allowed_files])))
+        await collect(path);
+    return [...files].sort(([a], [b]) => compareCodeUnits(a, b)).map(([path, sha256]) => ({ path, sha256 }));
+}
+/** Preparation checks reviewed premises; result ingestion instead checks its bound baseline. */
+export async function executionPlanContextIssues(root, canonical, accepted = []) {
+    const issues = [];
+    let context;
+    try {
+        context = await captureExecutionContext(root, canonical.plan);
+    }
+    catch (error) {
+        return [`Reviewed repository context cannot be inspected safely: ${error instanceof Error ? error.message : String(error)} Restore a contained readable context or revise/review the plan before continuing.`];
+    }
+    const current = new Map(context.map(entry => [entry.path, entry.sha256]));
+    const expected = new Map(canonical.context_files.map(entry => [entry.path, entry.sha256]));
+    for (const path of new Set([...current.keys(), ...expected.keys()])) {
+        if ((current.get(path) ?? null) === (expected.get(path) ?? null))
+            continue;
+        let explained = false;
+        for (const unit of accepted) {
+            // A commit tree can contain unrelated earlier work. Only THIS commit's
+            // actual changed-file set can explain a moved reviewed premise.
+            const changed = await runTrackedAsync(["git", "diff-tree", "--root", "--no-commit-id", "--name-only", "-z", "-r", unit.landed_commit, "--", `:(literal)${path}`], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+            if (changed.status !== 0 || !changed.stdout.split("\0").includes(path))
+                continue;
+            const diff = await runTrackedAsync(["git", "diff", "--quiet", unit.landed_commit, "--", `:(literal)${path}`], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+            const extra = await runTrackedAsync(["git", "ls-files", "--others", "--exclude-standard", "-z", "--", `:(literal)${path}`], { cwd: root, encoding: "utf8", timeout: TRACKED_CHILD_DEADLINE_MS });
+            if (diff.status === 0 && extra.status === 0 && extra.stdout.trim().length === 0) {
+                explained = true;
+                break;
+            }
+        }
+        if (!explained)
+            issues.push(`Reviewed repository context changed: ${path}. Revise/review the plan against current source before dispatch.`);
+    }
+    return issues;
+}
+export async function readPlanReview(artifactsDir, role, revision) {
+    const raw = await readOptionalJsonFile(executionPlanPaths(artifactsDir).review(role).accepted);
+    if (raw === undefined)
+        return undefined;
+    const receipt = PlanReviewReceiptSchema.parse(raw);
+    return receipt.revision_sha256 === revision && receipt.role === role ? receipt : undefined;
+}
+export async function readApprovedExecutionPlan(artifactsDir) {
+    const canonical = await readCanonicalPlan(artifactsDir);
+    const source = await readPlanSource(artifactsDir);
+    if (!canonical || !source || canonical.source_sha256 !== hashContent(stableStringify(source)))
+        return undefined;
+    if (stableStringify(source.intent ?? null) !== stableStringify(await readExecutionIntent(artifactsDir) ?? null))
+        return undefined;
+    for (const entry of source.sources) {
+        try {
+            if (hashContent(await readFile(entry.path, "utf8")) !== entry.sha256)
+                return undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const approval = await readOptionalJsonFile(executionPlanPaths(artifactsDir).approval);
+    const paths = executionPlanPaths(artifactsDir);
+    const owner = await readOptionalJsonFile(join(paths.directory, "owner-decision.json"));
+    const risk = await readOptionalJsonFile(join(paths.directory, "risk-decisions.json"));
+    if (approval?.owner_decision_sha256 !== hashContent(stableStringify(owner ?? null)) || approval.risk_decision_sha256 !== hashContent(stableStringify(risk ?? null)))
+        return undefined;
+    // An approved history is evidence, even when empty; absence is only a valid
+    // default during initial authoring, never after an approval bound that record.
+    if (await readOptionalJsonFile(paths.history) === undefined)
+        return undefined;
+    const history = await readPlanReviewHistory(artifactsDir);
+    if (approval.history_sha256 !== hashContent(stableStringify(history)))
+        return undefined;
+    const receipts = {};
+    for (const role of PLAN_REVIEW_ROLES) {
+        const receipt = await readPlanReview(artifactsDir, role, canonical.revision_sha256);
+        if (!receipt || receipt.provenance.reviewed_content_hash !== canonical.revision_sha256 || reviewIndependenceIssue(receipt.provenance.requirement, receipt.provenance.review) || approval.review_sha256?.[role] !== hashContent(stableStringify(receipt)))
+            return undefined;
+        if (role === "judge" && (receipt.provenance.requirement !== "independent" || receipt.provenance.review.mode !== "independent"))
+            return undefined;
+        receipts[role] = receipt;
+    }
+    const critique = CritiqueSchema.parse(receipts.critique.result);
+    if (critique.verdict !== "approved" || critique.issues.some(issue => issue.blocking))
+        return undefined;
+    const judge = receipts.judge;
+    if (approval.revision_sha256 !== canonical.revision_sha256 || approval.judge_input_sha256 !== judge.input_sha256)
+        return undefined;
+    const verdict = PlanJudgeSchema.parse(judge.result);
+    if (verdict.verdict !== "approved" || verdict.classifications.some(entry => entry.classification === "accepted"))
+        return undefined;
+    const covered = verdict.requirement_assessments;
+    if (covered.length !== canonical.plan.requirements.length || new Set(covered.map(entry => entry.requirement_id)).size !== covered.length || canonical.plan.requirements.some(requirement => !covered.some(entry => entry.requirement_id === requirement.id && entry.verdict === "satisfied")))
+        return undefined;
+    if (canonical.plan.source_dispositions.some(disposition => !verdict.disposition_assessments.some(entry => entry.finding_id === disposition.finding_id && entry.verdict === "satisfied")))
+        return undefined;
+    if (canonical.plan.request_disposition && verdict.request_disposition_assessment?.verdict !== "satisfied")
+        return undefined;
+    const residuals = verdict.classifications.filter(entry => entry.classification === "residual_risk");
+    if (residuals.length) {
+        const decision = PlanRiskDecisionSchema.safeParse(risk);
+        if (!decision.success || decision.data.revision_sha256 !== canonical.revision_sha256 || residuals.some(entry => !decision.data.accepted_counterexample_ids.includes(entry.counterexample_id)))
+            return undefined;
+    }
+    return { canonical, source };
+}
+//# sourceMappingURL=executionPlan.js.map

package/dist/remediate/contractPipeline/executionPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionPlan.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/executionPlan.ts"],"names":[],"mappings":"AAAA,kNAAkN;AAClN,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,oBAAoB,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,0BAA0B,EAAE,aAAa,EAAE,eAAe,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACnU,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,0BAA0B,EAA6B,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAClK,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE1F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,qBAAqB,GAAC,sBAAsB,CAAC,IAAI,CAAC,EAAC,YAAY,EAAC,IAAI,EAAC,cAAc,EAAC,IAAI,EAAC,sBAAsB,EAAC,IAAI,EAAC,kBAAkB,EAAC,IAAI,EAAC,CAAC,CAAC;AACrJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC1C,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACnE,MAAM,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,YAAmB;IAC3D,MAAM,UAAU,GAAC,MAAM,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAC,wBAAwB,CAAC,CAAC,CAAC;IACzF,IAAG,CAAC,UAAU;QAAC,OAAO,SAAS,CAAC;IAChC,MAAM,EAAC,YAAY,EAAC,UAAU,EAAC,cAAc,EAAC,QAAQ,EAAC,sBAAsB,EAAC,QAAQ,EAAC,kBAAkB,EAAC,YAAY,EAAC,GAAG,MAAM,EAAC,GAAC,UAAU,CAAC;IAC7I,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,0BAA0B;IAChC,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACrH,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC;IAChE,eAAe,EAAE,MAAM;IACvB,aAAa,EAAE,MAAM;IACrB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACpF,IAAI,EAAE,0BAA0B;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,IAAI;IACR,WAAW,EAAE,IAAI;IACjB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACnC,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,IAAI;IACX,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAChC,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QACzG,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC,MAAM,EAAE,CAAC;IACZ,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACxC,cAAc,EAAE,IAAI;QACpB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;IACZ,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACxC,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;QAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;IACZ,8BAA8B,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjJ,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,eAAe,EAAE,MAAM;IACvB,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/B,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iBAAiB,GAA8B,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,eAAe,EAAE,MAAM;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,YAAY,EAAE,MAAM;IACpB,UAAU,EAAE,8BAA8B;IAC1C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC,MAAM,EAAE,CAAC;AAWZ,MAAM,UAAU,kBAAkB,CAAC,YAAoB;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,OAAO;QACL,SAAS;QACT,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QACtC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;QAC9C,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC;QAC/C,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;QAC1C,MAAM,EAAE,CAAC,IAAoB,EAAE,EAAE,CAAC,CAAC;YACjC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,eAAe,CAAC;YAChD,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,aAAa,CAAC;YACjD,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC;SAC1C,CAAC;KACH,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,IAA0B,EAAE,YAAoB,EAAE,eAA+C,EAAE;IACvI,MAAM,IAAI,GAAG,CAA2B,MAAW,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChH,OAAO,WAAW,CAAC,eAAe,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE;YACrJ,GAAG,IAAI;YACP,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;YACrC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SAC5M,EAAE,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAAoB;IACvD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAU,kBAAkB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IACzF,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB;IAC1D,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAU,kBAAkB,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5F,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IACrN,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,YAAoB;IAC9D,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAU,kBAAkB,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAChG,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE;KACnM,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,wFAAwF;AACxF,SAAS,2BAA2B,CAAC,IAAY,EAAE,IAA0B;IAC3E,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;QACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,CAAC,CAAC;IACF,OAAO;QACL,GAAG,IAAI;QACP,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAClD,GAAG,WAAW;YACd,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS;gBACjE,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;aAC3G,CAAC,CAAC;SACJ,CAAC,CAAC;QACH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;YACtF,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;SAC9F,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAkB,EAAE,IAA0B;IAC9F,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB;QAAE,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAC1K,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACtK,MAAM,aAAa,GAAG,CAAC,KAAe,EAAE,KAAa,EAAE,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,gBAAgB,CAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,0BAA0B,CAAC,CAAC;YAAC,CAAC;QAAC,CAAC;IAC9I,CAAC,CAAC;IACF,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU;YAAE,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,eAAe,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;QAChI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC/I,IAAI,WAAW,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,WAAW,CAAC,EAAE,sEAAsE,CAAC,CAAC;IAC3V,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,aAAa,CAAC,IAAI,CAAC,UAAU,EAAC,QAAQ,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAAC,aAAa,CAAC,IAAI,CAAC,aAAa,EAAC,QAAQ,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7H,IAAG,MAAM,CAAC,MAAM,EAAC,CAAC;YAChB,MAAM,UAAU,GAAC,EAAC,GAAG,MAAM,CAAC,MAAM,EAAC,YAAY,EAAC,OAAO,EAAC,CAAC;YACzD,KAAI,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,EAAC,CAAC;gBACpC,MAAM,MAAM,GAAC,mBAAmB,CAAC,IAAI,EAAC,UAAU,CAAC,CAAC;gBAClD,IAAG,MAAM;oBAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,2BAA2B,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;gBACnF,IAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAC,CAAC;oBACrB,MAAM,SAAS,GAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,IAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,IAAI,CAAC;wBAC3E,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,IAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAA,EAAE,CAAA,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,IAAI,CAAC;wBAC/H,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,IAAE,EAAE,CAAC,CAAC,CAAC;oBACzC,KAAI,MAAM,IAAI,IAAI,SAAS,EAAC,CAAC;wBAAA,MAAM,MAAM,GAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,MAAM,EAAC,EAAE,CAAC,CAAC;wBAAA,IAAG,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,EAAC,MAAM,CAAC;4BAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,oBAAoB,IAAI,0BAA0B,IAAI,sCAAsC,CAAC,CAAC;oBAAA,CAAC;gBAClS,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc;YAAE,IAAI,0BAA0B,CAAC,OAAO,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,oCAAoC,OAAO,EAAE,CAAC,CAAC;QAC9J,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAAE,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,kBAAkB;gBAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAC;QACrR,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,EAAE,KAAG,UAAU,CAAC,CAAC;YACnE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,wCAAwC,CAAC,CAAC;QAC1J,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,UAAU,KAAG,OAAO,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,EAAE,4CAA4C,CAAC,CAAC;IAC/Q,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAGzC;IACC,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAU,KAAK,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IACtI,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,qCAAqC,CAAC,EAAE,CAAC;IACxF,IAAG,eAAe,CAAC,MAAM,CAAC,MAAM,IAAE,IAAI,CAAC,KAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,IAAE,IAAI,CAAC;QAAC,OAAO,EAAC,OAAO,EAAC,KAAK,EAAC,MAAM,EAAC,CAAC,mHAAmH,CAAC,EAAC,CAAC;IACpQ,IAAI,IAA0B,CAAC;IAC/B,IAAI,CAAC;QAAC,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC1E,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,QAAQ,EAAE,eAAe,IAAI,IAAI,CAAC,EAAE,CAAC;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,IAAI,QAAQ,IAAI,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;YACvI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAC,aAAa,CAAC,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,EAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAC,aAAa,EAAC,GAAG,QAAQ,CAAC,eAAe,IAAI,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3I,OAAO,EAAE,OAAO,EAAC,KAAK,EAAC,MAAM,EAAC,EAAE,EAAE,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,yFAAyF,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,KAAK,MAAM,WAAW,IAAI,QAAQ,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,EAAE,oFAAoF,CAAC,CAAC;;YACzI,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,WAAW;gBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,WAAW,CAAC,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC3L,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,0EAA0E,CAAC,CAAC;QACxK,MAAM,SAAS,GAAG,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,aAAa,IAAI,SAAS,EAAE,eAAe,IAAI,EAAE,EAAE,CAAC;YAC7D,IAAI,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,KAAK,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,eAAe,aAAa,0CAA0C,EAAE,yDAAyD,CAAC,CAAC;QACtV,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClE,IAAI,CAAC;gBAAC,IAAI,CAAC,CAAC,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,iBAAiB,IAAI,kBAAkB,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,CAAC;QACpL,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjE,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,8CAA8C,CAAC,CAAC;IAC9M,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,IAAI,YAA4C,CAAC;IACjD,IAAI,CAAC;QAAC,YAAY,GAAG,MAAM,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACvE,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,MAAM,SAAS,GAAkB,EAAE,gBAAgB,EAAE,mCAAmC,EAAE,eAAe,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACzL,IAAI,QAAQ;QAAE,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,eAAe,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClH,MAAM,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChD,+EAA+E;IAC/E,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACvG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,eAAe,KAAK,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAG1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,IAAI,IAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAC,CAAC;QACrC,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5G,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,iCAAiC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACtL,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,kCAAkC,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,sCAAsC,CAAC,CAAC;IACrI,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAW,EAAC,IAAyB;IACjF,MAAM,KAAK,GAAC,IAAI,GAAG,EAAsB,CAAC;IAC1C,MAAM,OAAO,GAAC,KAAK,EAAC,IAAW,EAAe,EAAE;QAC9C,MAAM,EAAC,QAAQ,EAAC,QAAQ,EAAC,IAAI,EAAC,GAAC,MAAM,kBAAkB,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC;QACnE,IAAG,CAAC,IAAI,EAAC,CAAC;YAAA,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAC3C,IAAG,IAAI,CAAC,WAAW,EAAE;YAAC,KAAI,MAAM,IAAI,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,KAAG,MAAM,IAAE,IAAI,KAAG,mBAAmB,CAAC;gBAAC,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;;YAC/J,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAC,WAAW,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;IACF,KAAI,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAA,EAAE,CAAA,CAAC,GAAG,IAAI,CAAC,UAAU,EAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpH,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,EAAC,EAAE,CAAA,gBAAgB,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC,EAAE,CAAA,CAAC,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,IAAY,EAAE,SAAwB,EACrF,WAAmF,EAAE;IACrF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAuC,CAAC;IAC5C,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,2DAA2D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;IACjN,CAAC;IACD,MAAM,OAAO,GAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,KAAK,CAAC,IAAI,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAC,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,KAAK,CAAC,IAAI,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,IAAI,CAAC;YAAE,SAAS;QACvE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,OAAO,GAAC,MAAM,eAAe,CAAC,CAAC,KAAK,EAAC,WAAW,EAAC,QAAQ,EAAC,gBAAgB,EAAC,aAAa,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,CAAC,aAAa,EAAC,IAAI,EAAC,aAAa,IAAI,EAAE,CAAC,EAAC,EAAC,GAAG,EAAC,IAAI,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,EAAC,yBAAyB,EAAC,CAAC,CAAC;YACpN,IAAG,OAAO,CAAC,MAAM,KAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAC,SAAS;YAC7E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,CAAC,KAAK,EAAC,MAAM,EAAC,SAAS,EAAC,IAAI,CAAC,aAAa,EAAC,IAAI,EAAC,aAAa,IAAI,EAAE,CAAC,EAAE,EAAC,GAAG,EAAC,IAAI,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,EAAC,yBAAyB,EAAC,CAAC,CAAC;YACvK,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,KAAK,EAAC,UAAU,EAAC,UAAU,EAAC,oBAAoB,EAAC,IAAI,EAAC,IAAI,EAAC,aAAa,IAAI,EAAE,CAAC,EAAE,EAAC,GAAG,EAAC,IAAI,EAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,EAAC,yBAAyB,EAAC,CAAC,CAAC;YACpL,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAAC,SAAS,GAAG,IAAI,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC/G,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,kEAAkE,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAAoB,EAAE,IAAoB,EAAE,QAAgB;IAC/F,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAU,kBAAkB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxG,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB;IAClE,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,aAAa,KAAK,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAChH,IAAG,eAAe,CAAC,MAAM,CAAC,MAAM,IAAE,IAAI,CAAC,KAAG,eAAe,CAAC,MAAM,mBAAmB,CAAC,YAAY,CAAC,IAAE,IAAI,CAAC;QAAC,OAAO,SAAS,CAAC;IAC1H,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YAAC,IAAI,WAAW,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;QAAC,CAAC;QAC/F,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;IAC7B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAwL,kBAAkB,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9Q,MAAM,KAAK,GAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAChG,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC/F,IAAI,QAAQ,EAAE,qBAAqB,KAAK,WAAW,CAAC,eAAe,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,oBAAoB,KAAK,WAAW,CAAC,eAAe,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACtL,4EAA4E;IAC5E,+EAA+E;IAC/E,IAAI,MAAM,oBAAoB,CAAU,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACvF,MAAM,OAAO,GAAC,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAG,QAAQ,CAAC,cAAc,KAAG,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IACpF,MAAM,QAAQ,GAAmD,EAAE,CAAC;IACpE,KAAI,MAAM,IAAI,IAAI,iBAAiB,EAAC,CAAC;QACnC,MAAM,OAAO,GAAC,MAAM,cAAc,CAAC,YAAY,EAAC,IAAI,EAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAChF,IAAG,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,qBAAqB,KAAG,SAAS,CAAC,eAAe,IAAI,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAG,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;QACpQ,IAAG,IAAI,KAAG,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,KAAG,aAAa,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,KAAG,aAAa,CAAC;YAAC,OAAO,SAAS,CAAC;QACzI,QAAQ,CAAC,IAAI,CAAC,GAAC,OAAO,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAS,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAG,QAAQ,CAAC,OAAO,KAAG,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,QAAQ,CAAC;QAAC,OAAO,SAAS,CAAC;IACjG,MAAM,KAAK,GAAC,QAAQ,CAAC,KAAM,CAAC;IAC5B,IAAG,QAAQ,CAAC,eAAe,KAAG,SAAS,CAAC,eAAe,IAAI,QAAQ,CAAC,kBAAkB,KAAG,KAAK,CAAC,YAAY;QAAC,OAAO,SAAS,CAAC;IAC7H,MAAM,OAAO,GAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClD,IAAG,OAAO,CAAC,OAAO,KAAG,UAAU,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,cAAc,KAAG,UAAU,CAAC;QAAC,OAAO,SAAS,CAAC;IAC3H,MAAM,OAAO,GAAC,OAAO,CAAC,uBAAuB,CAAC;IAC9C,IAAG,OAAO,CAAC,MAAM,KAAG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAG,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAA,EAAE,CAAA,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,cAAc,KAAG,WAAW,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,KAAG,WAAW,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IAChS,IAAG,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAA,EAAE,CAAA,CAAC,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,UAAU,KAAG,WAAW,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,KAAG,WAAW,CAAC,CAAC;QAAC,OAAO,SAAS,CAAC;IACjM,IAAG,SAAS,CAAC,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,8BAA8B,EAAE,OAAO,KAAG,WAAW;QAAC,OAAO,SAAS,CAAC;IACxH,MAAM,SAAS,GAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAA,EAAE,CAAA,KAAK,CAAC,cAAc,KAAG,eAAe,CAAC,CAAC;IAC9F,IAAG,SAAS,CAAC,MAAM,EAAC,CAAC;QACnB,MAAM,QAAQ,GAAC,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,IAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,eAAe,KAAG,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,CAAC,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAAC,OAAO,SAAS,CAAC;IAC5M,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC"}

package/dist/remediate/contractPipeline/runtimePlanAuthority.d.ts

@@ -0,0 +1,12 @@
+import type { RemediationState } from "../state/store.js";
+/** A recoverable authority failure; it never invalidates or deletes accepted evidence. */
+export declare class RemediationPlanAuthorityError extends Error {
+    readonly code: "plan_repair_required";
+    constructor(message: string);
+}
+/** The immutable reviewed record, not a runtime-supplied digest, grants work and closing. */
+export declare function assertApprovedRuntimePlan(artifactsDir: string, state: RemediationState): Promise<{
+    canonical: import("./executionPlan.js").CanonicalPlan;
+    source: import("./executionPlan.js").PlanSource;
+}>;
+//# sourceMappingURL=runtimePlanAuthority.d.ts.map

package/dist/remediate/contractPipeline/runtimePlanAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimePlanAuthority.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/runtimePlanAuthority.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D,0FAA0F;AAC1F,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAG,sBAAsB,CAAU;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,6FAA6F;AAC7F,wBAAsB,yBAAyB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB;;;GA6B5F"}

package/dist/remediate/contractPipeline/runtimePlanAuthority.js

@@ -0,0 +1,41 @@
+// sites-pinned: tests/remediate/close-plan-authority.test.ts, tests/remediate/execution-unit-runtime.test.ts, tests/remediate/executable-plan-safety.test.ts
+import { stableStringify } from "audit-tools/shared";
+import { ExecutableChangePlanSchema } from "../../shared/types/executionPlan.js";
+import { executionPlanRevision, readApprovedExecutionPlan, readPlanReviewHistory } from "./executionPlan.js";
+/** A recoverable authority failure; it never invalidates or deletes accepted evidence. */
+export class RemediationPlanAuthorityError extends Error {
+    code = "plan_repair_required";
+    constructor(message) {
+        super(message);
+        this.name = "RemediationPlanAuthorityError";
+    }
+}
+/** The immutable reviewed record, not a runtime-supplied digest, grants work and closing. */
+export async function assertApprovedRuntimePlan(artifactsDir, state) {
+    try {
+        const approved = await readApprovedExecutionPlan(artifactsDir);
+        const plan = state.plan;
+        if (!approved || !plan)
+            throw new RemediationPlanAuthorityError("No current independently approved executable plan exists. Restore or renew the reviewed authority before continuing.");
+        const semantic = ExecutableChangePlanSchema.strip().parse(plan);
+        const history = await readPlanReviewHistory(artifactsDir);
+        const referenced = new Set(plan.units.flatMap(unit => unit.addresses_counterexample_ids));
+        const counterexamples = history.counterexamples.filter(example => referenced.has(example.id));
+        if (approved.canonical.revision_sha256 !== plan.review_revision_sha256 ||
+            executionPlanRevision(semantic, approved.canonical.source_sha256, approved.canonical.context_files) !== approved.canonical.revision_sha256 ||
+            stableStringify(plan.findings) !== stableStringify(approved.source.findings) ||
+            stableStringify(plan.request ?? null) !== stableStringify(approved.source.request ?? null) ||
+            stableStringify(plan.audit_read ?? null) !== stableStringify(approved.source.audit_read) ||
+            counterexamples.length !== referenced.size ||
+            stableStringify(plan.review_counterexamples ?? []) !== stableStringify(counterexamples)) {
+            throw new RemediationPlanAuthorityError("The runtime plan or source provenance does not match the current independently approved revision. Restore the reviewed plan or submit and review the change before dispatch, acceptance or closing.");
+        }
+        return approved;
+    }
+    catch (error) {
+        if (error instanceof RemediationPlanAuthorityError)
+            throw error;
+        throw new RemediationPlanAuthorityError(`The current reviewed plan authority cannot be verified: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=runtimePlanAuthority.js.map

package/dist/remediate/contractPipeline/runtimePlanAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimePlanAuthority.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/runtimePlanAuthority.ts"],"names":[],"mappings":"AAAA,6JAA6J;AAC7J,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE7G,0FAA0F;AAC1F,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAC7C,IAAI,GAAG,sBAA+B,CAAC;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,YAAoB,EAAE,KAAuB;IAC3F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,6BAA6B,CAC7D,sHAAsH,CACvH,CAAC;QACF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC1F,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,sBAAsB;YAClE,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,eAAe;YAC1I,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC5E,eAAe,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC;YAC1F,eAAe,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YACxF,eAAe,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;YAC1C,eAAe,CAAC,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC,KAAK,eAAe,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,6BAA6B,CACrC,qMAAqM,CACtM,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,6BAA6B;YAAE,MAAM,KAAK,CAAC;QAChE,MAAM,IAAI,6BAA6B,CACrC,2DAA2D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/remediate/dedup/crossLensDedup.d.ts

@@ -1,27 +1,14 @@
 import { wordJaccard } from "audit-tools/shared";
 import type { CrossLensDedupeResult } from "audit-tools/shared";
-import type { Finding, RemediationBlock } from "../state/types.js";
+import type { Finding } from "../state/types.js";
 export { wordJaccard };
 /**
  * Remediate's DRAW of the shared cross-lens dedup core (`crossLensDedupe`): the
- * auto-apply block-machine policy — a HARD category gate (never collapse two
+ * source-finding policy — a HARD category gate (never collapse two
  * different-category fixes, OBL-C003-DEDUP), the exact-identity short-circuit
  * (drift-plan R2), CLONE survivors so the caller's Finding objects are never
  * mutated (INV-remediate-state-05), no grounding merge / no file sort, and a
- * structured merge log. The returned `mergeMap` feeds `fixupBlocksAfterDedup`.
+ * structured merge log. Merge identities remain available to callers.
  */
 export declare function deduplicateCrossLensFindings(findings: Finding[]): CrossLensDedupeResult;
-/**
- * Rewrite absorbed finding ids to their dedupe survivor AND enforce single-block
- * ownership: after fixup, every finding id appears in exactly ONE block's items.
- *
- * Rewriting alone leaves a survivor absorbed from another lens's block in BOTH
- * blocks (its own, plus the absorbed finding's), which made block ownership
- * ill-defined — dispatch scoping and the coverage ledger each saw the finding
- * twice. Ownership is first-wins in block order (the same pinned semantic as
- * `blockIdsByFinding`), later occurrences are dropped, and a block whose items
- * all merged away is dropped whole — an empty block has nothing to dispatch and
- * would only distort scheduling.
- */
-export declare function fixupBlocksAfterDedup(blocks: RemediationBlock[], mergeMap: Map<string, string>): RemediationBlock[];
 //# sourceMappingURL=crossLensDedup.d.ts.map