autor3search-typescript 0.1.0

package/dist/runner/exec.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Largest output we retain per stream, in characters (UTF-16 code units),
+ * not bytes. The cap exists to bound retained *memory*, and these are
+ * JavaScript strings living in V8 — which stores them as one-byte (latin1)
+ * or two-byte sequences, so retained memory tracks `.length` (code units),
+ * not UTF-8 byte length. Measuring in UTF-8 bytes would make the name
+ * accurate but the bound wrong: for a two-byte-represented string, the
+ * UTF-8 length can be smaller than the memory actually held, undercounting
+ * exactly where the bound matters most. Beyond this many characters we keep
+ * the tail.
+ */
+export declare const MAX_CAPTURED_CHARS: number;
+export interface ExecOptions {
+    cwd: string;
+    timeoutMs: number;
+    env?: NodeJS.ProcessEnv;
+    /** Receives output as it arrives, for run.log. */
+    log?: (chunk: string) => void;
+}
+export interface ExecResult {
+    exitCode: number;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    truncated: boolean;
+}
+/** A result is OK only if it exited zero, was not signalled, and did not time out. */
+export declare function ok(r: ExecResult): boolean;
+/** The last `lines` lines of `s`. */
+export declare function tail(s: string, lines: number): string;
+/**
+ * Accumulates output while keeping only the tail once the cap is exceeded.
+ *
+ * Exported for testing: the eviction and single-chunk-trim logic below is
+ * only reliably exercised by calling `push` directly — a real subprocess's
+ * output arrives from the OS pipe in fragments (observed ~64 KiB on this
+ * machine for a 4 MiB+ write), so driving it through a spawned process
+ * cannot be trusted to ever deliver a single chunk larger than the cap.
+ */
+export declare class Capture {
+    private chunks;
+    private size;
+    truncated: boolean;
+    push(s: string): void;
+    toString(): string;
+}
+/**
+ * Signals a process group, refusing to signal pid 1's group.
+ *
+ * On Linux a process whose group leader has exited can report ppid 1, and
+ * `kill(-1, ...)` means "every process the user may signal" — which in a
+ * container is everything. Refusing is strictly better than the alternative.
+ *
+ * Exported: `cli/cmd-stop.ts`'s `stop -force` needs this exact same refusal
+ * to signal the pid recorded in `eval.lock`. That is the same function, not
+ * two views of one enumeration (contrast the lockfile `switch` in
+ * `pm/detect.ts`, which genuinely cannot be imported across a `switch`) --
+ * so the duplication is eliminated by importing this rather than guarded by
+ * a second copy plus a comment. A future edit to the pid-1 refusal (e.g.
+ * hardening it for a new edge case) now cannot diverge between the two call
+ * sites by simply being forgotten in one of them.
+ */
+export declare function killGroup(pid: number | undefined, signal: NodeJS.Signals): void;
+/** Signals every currently-active child's process group, best effort. */
+export declare function killActiveChildren(signal: NodeJS.Signals): void;
+export declare function run(cmd: string, args: string[], opts: ExecOptions): Promise<ExecResult>;
+/** Runs a full command line through the platform shell. */
+export declare function runShell(command: string, opts: ExecOptions): Promise<ExecResult>;

package/dist/runner/exec.js

@@ -0,0 +1,185 @@
+import { spawn } from 'node:child_process';
+/**
+ * Largest output we retain per stream, in characters (UTF-16 code units),
+ * not bytes. The cap exists to bound retained *memory*, and these are
+ * JavaScript strings living in V8 — which stores them as one-byte (latin1)
+ * or two-byte sequences, so retained memory tracks `.length` (code units),
+ * not UTF-8 byte length. Measuring in UTF-8 bytes would make the name
+ * accurate but the bound wrong: for a two-byte-represented string, the
+ * UTF-8 length can be smaller than the memory actually held, undercounting
+ * exactly where the bound matters most. Beyond this many characters we keep
+ * the tail.
+ */
+export const MAX_CAPTURED_CHARS = 4 * 1024 * 1024;
+/** A result is OK only if it exited zero, was not signalled, and did not time out. */
+export function ok(r) {
+    return r.exitCode === 0 && r.signal === null && !r.timedOut;
+}
+/** The last `lines` lines of `s`. */
+export function tail(s, lines) {
+    const parts = s.split('\n');
+    return parts.slice(Math.max(0, parts.length - lines)).join('\n');
+}
+/**
+ * Accumulates output while keeping only the tail once the cap is exceeded.
+ *
+ * Exported for testing: the eviction and single-chunk-trim logic below is
+ * only reliably exercised by calling `push` directly — a real subprocess's
+ * output arrives from the OS pipe in fragments (observed ~64 KiB on this
+ * machine for a 4 MiB+ write), so driving it through a spawned process
+ * cannot be trusted to ever deliver a single chunk larger than the cap.
+ */
+export class Capture {
+    chunks = [];
+    size = 0;
+    truncated = false;
+    push(s) {
+        if (s.length > MAX_CAPTURED_CHARS) {
+            // A single incoming chunk can itself exceed the whole cap (a chatty
+            // process writing in one huge call, or a pipe that happens to hand us
+            // a large read). Chunk-granularity eviction below can't bound this —
+            // with only one chunk held there is nothing to evict — so trim this
+            // string's own tail directly. Its last MAX_CAPTURED_CHARS characters
+            // are also the most recent MAX_CAPTURED_CHARS characters of the whole
+            // stream, so anything held from before this chunk is now stale and is
+            // discarded along with the front of this one.
+            this.chunks = [s.slice(s.length - MAX_CAPTURED_CHARS)];
+            this.size = MAX_CAPTURED_CHARS;
+            this.truncated = true;
+            return;
+        }
+        this.chunks.push(s);
+        this.size += s.length;
+        while (this.size > MAX_CAPTURED_CHARS && this.chunks.length > 1) {
+            this.size -= this.chunks.shift().length;
+            this.truncated = true;
+        }
+    }
+    toString() {
+        return this.chunks.join('');
+    }
+}
+/**
+ * Signals a process group, refusing to signal pid 1's group.
+ *
+ * On Linux a process whose group leader has exited can report ppid 1, and
+ * `kill(-1, ...)` means "every process the user may signal" — which in a
+ * container is everything. Refusing is strictly better than the alternative.
+ *
+ * Exported: `cli/cmd-stop.ts`'s `stop -force` needs this exact same refusal
+ * to signal the pid recorded in `eval.lock`. That is the same function, not
+ * two views of one enumeration (contrast the lockfile `switch` in
+ * `pm/detect.ts`, which genuinely cannot be imported across a `switch`) --
+ * so the duplication is eliminated by importing this rather than guarded by
+ * a second copy plus a comment. A future edit to the pid-1 refusal (e.g.
+ * hardening it for a new edge case) now cannot diverge between the two call
+ * sites by simply being forgotten in one of them.
+ */
+export function killGroup(pid, signal) {
+    if (pid === undefined || pid <= 1)
+        return;
+    try {
+        process.kill(-pid, signal);
+    }
+    catch {
+        // The group is already gone; fall back to the single process.
+        try {
+            process.kill(pid, signal);
+        }
+        catch {
+            /* already dead */
+        }
+    }
+}
+/**
+ * Every measurement/typecheck/build/test child currently spawned by THIS
+ * process, so a signal handler can reach them without any pipeline-layer
+ * plumbing. Load-bearing for `stop -force`: `eval.ts` spawns each
+ * measurement child `detached: true` so it is its own process-group leader
+ * (see `exec` below), which means it is NOT killed for free when `eval`
+ * itself receives SIGTERM. Left unhandled, `stop -force`'s SIGTERM to the
+ * eval process kills node immediately (SIGTERM's default disposition) with
+ * the benchmark child still running and the eval lock still held -- the
+ * exact orphaned-process hazard spec section 2 item 4 names explicitly.
+ */
+const activeChildPids = new Set();
+/** Signals every currently-active child's process group, best effort. */
+export function killActiveChildren(signal) {
+    for (const pid of activeChildPids)
+        killGroup(pid, signal);
+}
+function exec(cmd, args, opts, useShell) {
+    return new Promise((resolve) => {
+        const stdout = new Capture();
+        const stderr = new Capture();
+        let timedOut = false;
+        let settled = false;
+        const child = spawn(cmd, args, {
+            cwd: opts.cwd,
+            env: opts.env ?? process.env,
+            shell: useShell,
+            // A new process group is what makes killGroup able to reach
+            // grandchildren. Without it, a benchmark spawned by a test runner
+            // survives the timeout and corrupts every later measurement.
+            detached: process.platform !== 'win32',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        if (child.pid !== undefined)
+            activeChildPids.add(child.pid);
+        // A throwing `log` must not take down an unattended overnight run —
+        // losing a log line is fine, losing the whole exec because a log
+        // stream closed or a disk filled is not.
+        const safeLog = (c) => {
+            try {
+                opts.log?.(c);
+            }
+            catch {
+                /* a broken logger must not break the run it is only observing */
+            }
+        };
+        child.stdout?.setEncoding('utf8');
+        child.stderr?.setEncoding('utf8');
+        child.stdout?.on('data', (c) => {
+            stdout.push(c);
+            safeLog(c);
+        });
+        child.stderr?.on('data', (c) => {
+            stderr.push(c);
+            safeLog(c);
+        });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            killGroup(child.pid, 'SIGKILL');
+        }, opts.timeoutMs);
+        const finish = (exitCode, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (child.pid !== undefined)
+                activeChildPids.delete(child.pid);
+            resolve({
+                exitCode,
+                signal,
+                stdout: stdout.toString(),
+                stderr: stderr.toString(),
+                timedOut,
+                truncated: stdout.truncated || stderr.truncated,
+            });
+        };
+        // A missing binary is a result the caller reasons about, not a crash.
+        child.on('error', (e) => {
+            stderr.push(e.message);
+            finish(127, null);
+        });
+        child.on('close', (code, signal) => finish(code ?? 0, signal));
+    });
+}
+export function run(cmd, args, opts) {
+    return exec(cmd, args, opts, false);
+}
+/** Runs a full command line through the platform shell. */
+export function runShell(command, opts) {
+    return exec(command, [], opts, true);
+}
+//# sourceMappingURL=exec.js.map

package/dist/runner/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/runner/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAmBjD,sFAAsF;AACtF,MAAM,UAAU,EAAE,CAAC,CAAa;IAC9B,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7D,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,IAAI,CAAC,CAAS,EAAE,KAAa;IAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,OAAO;IACV,MAAM,GAAa,EAAE,CAAA;IACrB,IAAI,GAAG,CAAC,CAAA;IAChB,SAAS,GAAG,KAAK,CAAA;IAEjB,IAAI,CAAC,CAAS;QACZ,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YAClC,oEAAoE;YACpE,sEAAsE;YACtE,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,8CAA8C;YAC9C,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAA;YACtD,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;YAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;YACrB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAA;QACrB,OAAO,IAAI,CAAC,IAAI,GAAG,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAG,CAAC,MAAM,CAAA;YACxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAA;QACvB,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,SAAS,CAAC,GAAuB,EAAE,MAAsB;IACvE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC;QAAE,OAAM;IACzC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;AAEzC,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACvD,KAAK,MAAM,GAAG,IAAI,eAAe;QAAE,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC3D,CAAC;AAED,SAAS,IAAI,CACX,GAAW,EACX,IAAc,EACd,IAAiB,EACjB,QAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAE,CAAA;QAC5B,MAAM,MAAM,GAAG,IAAI,OAAO,EAAE,CAAA;QAC5B,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC5B,KAAK,EAAE,QAAQ;YACf,4DAA4D;YAC5D,kEAAkE;YAClE,6DAA6D;YAC7D,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;YACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAA;QAEF,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;YAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAE3D,oEAAoE;QACpE,iEAAiE;QACjE,yCAAyC;QACzC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAQ,EAAE;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;YACnE,CAAC;QACH,CAAC,CAAA;QAED,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;QACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACrC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAA;YACf,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QACjC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAElB,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,MAA6B,EAAQ,EAAE;YACvE,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC9D,OAAO,CAAC;gBACN,QAAQ;gBACR,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,QAAQ;gBACR,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS;aAChD,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,sEAAsE;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE;YAC7B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACtB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,IAAiB;IAChE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;AACrC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,IAAiB;IACzD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACtC,CAAC"}

package/dist/scope/scope.d.ts

@@ -0,0 +1,20 @@
+export interface ScopeViolation {
+    file: string;
+    reason: 'immutable' | 'out-of-scope';
+}
+/**
+ * Compiles a glob to an anchored regexp.
+ *
+ * `**` crosses directory separators, `*` and `?` do not. Everything else is
+ * escaped: a pattern is data from a config file, and a stray `.` or `+`
+ * silently widening the scope is exactly the failure this gate must not have.
+ */
+export declare function matchGlob(pattern: string, p: string): boolean;
+/**
+ * Every reason the changed set is not allowed.
+ *
+ * Immutability is checked first and independently of `scope`: a dependency or
+ * compiler-configuration change is a human decision, and no scope setting may
+ * grant it.
+ */
+export declare function checkScope(changed: string[], scope: string[]): ScopeViolation[];

package/dist/scope/scope.js

@@ -0,0 +1,70 @@
+import { CONFIG_PATH, IMMUTABLE_FILES } from '../config/schema.js';
+/**
+ * Compiles a glob to an anchored regexp.
+ *
+ * `**` crosses directory separators, `*` and `?` do not. Everything else is
+ * escaped: a pattern is data from a config file, and a stray `.` or `+`
+ * silently widening the scope is exactly the failure this gate must not have.
+ */
+export function matchGlob(pattern, p) {
+    let re = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === '*') {
+            if (pattern[i + 1] === '*') {
+                // `**/` also matches zero directories, so `src/**` matches `src/a.ts`.
+                if (pattern[i + 2] === '/') {
+                    re += '(?:.*/)?';
+                    i += 2;
+                }
+                else {
+                    re += '.*';
+                    i += 1;
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else {
+            re += c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        }
+    }
+    return new RegExp(`^${re}$`).test(p);
+}
+const IMMUTABLE = new Set(IMMUTABLE_FILES);
+/**
+ * Every reason the changed set is not allowed.
+ *
+ * Immutability is checked first and independently of `scope`: a dependency or
+ * compiler-configuration change is a human decision, and no scope setting may
+ * grant it.
+ */
+export function checkScope(changed, scope) {
+    const out = [];
+    for (const file of changed) {
+        // `.autor3search/config.yaml` is now a tracked, committed file (spec
+        // section 13), so any edit to it is visible to `changedFiles` like any
+        // other file -- but it already has its own dedicated, more specific
+        // protection: `pipeline/eval.ts` gate 2 hashes it against what baseline
+        // recorded and FAILs with a diagnosis naming the actual problem
+        // ("the run configuration is frozen"), not a generic scope violation.
+        // Exempting it here just lets that more specific gate be the one that
+        // actually reports it, rather than racing scope to the same conclusion
+        // with a less useful message.
+        if (file === CONFIG_PATH)
+            continue;
+        if (IMMUTABLE.has(file)) {
+            out.push({ file, reason: 'immutable' });
+            continue;
+        }
+        if (!scope.some((pat) => matchGlob(pat, file))) {
+            out.push({ file, reason: 'out-of-scope' });
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/scope/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAOlE;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,CAAS;IAClD,IAAI,EAAE,GAAG,EAAE,CAAA;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,uEAAuE;gBACvE,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC3B,EAAE,IAAI,UAAU,CAAA;oBAChB,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAA;oBACV,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAA;YACf,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAA;QACd,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;QAChD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,OAAiB,EAAE,KAAe;IAC3D,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,gEAAgE;QAChE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,8BAA8B;QAC9B,IAAI,IAAI,KAAK,WAAW;YAAE,SAAQ;QAClC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;YACvC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/state/baseline.d.ts

@@ -0,0 +1,35 @@
+import type { Manifest } from '../freeze/manifest.js';
+export interface BaselineRecord {
+    tag: string;
+    /**
+     * The commit the frozen tests and the scope gate always compare against.
+     * NEVER advances once the baseline is created. Moving it would move the
+     * success criteria mid-run — this is the field that, in the Go predecessor,
+     * got collapsed into a single "commit" and let a tampered experiment KEEP.
+     */
+    frozenCommit: string;
+    /**
+     * The commit base timings are measured against. Advances to the candidate
+     * commit after every KEEP, so each subsequent score reflects that
+     * experiment's own contribution rather than re-measuring an earlier win.
+     * Advancing this field must never change frozenCommit.
+     */
+    measureCommit: string;
+    configHash: string;
+    lockfileHash: string;
+    lockfileName: string;
+    benchmarks: string[];
+    manifest: Manifest;
+    createdAt: string;
+}
+export declare function baselinePath(dir: string): string;
+/**
+ * Writes via a temp file plus rename rather than truncating in place.
+ * baseline.json is read by every subsequent eval; a crash mid-truncate would
+ * leave a half-written (or empty) file that every future eval trips over. A
+ * rename within the same directory is atomic on the filesystems this tool
+ * targets, so a reader always sees either the old complete record or the new
+ * one, never a partial write.
+ */
+export declare function writeBaseline(dir: string, rec: BaselineRecord): Promise<void>;
+export declare function readBaseline(dir: string): Promise<BaselineRecord>;

package/dist/state/baseline.js

@@ -0,0 +1,38 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+export function baselinePath(dir) {
+    return path.join(dir, 'baseline.json');
+}
+/**
+ * Writes via a temp file plus rename rather than truncating in place.
+ * baseline.json is read by every subsequent eval; a crash mid-truncate would
+ * leave a half-written (or empty) file that every future eval trips over. A
+ * rename within the same directory is atomic on the filesystems this tool
+ * targets, so a reader always sees either the old complete record or the new
+ * one, never a partial write.
+ */
+export async function writeBaseline(dir, rec) {
+    await mkdir(dir, { recursive: true });
+    const dest = baselinePath(dir);
+    const tmpPath = path.join(dir, `.baseline.json.${process.pid}.${randomUUID()}.tmp`);
+    await writeFile(tmpPath, `${JSON.stringify(rec, null, 2)}\n`);
+    try {
+        await rename(tmpPath, dest);
+    }
+    catch (err) {
+        await rm(tmpPath, { force: true });
+        throw err;
+    }
+}
+export async function readBaseline(dir) {
+    let text;
+    try {
+        text = await readFile(baselinePath(dir), 'utf8');
+    }
+    catch {
+        throw new Error(`no baseline found at ${baselinePath(dir)}. Run "autor3search-typescript baseline -tag <tag>" first.`);
+    }
+    return JSON.parse(text);
+}
+//# sourceMappingURL=baseline.js.map

package/dist/state/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../../src/state/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,IAAI,MAAM,WAAW,CAAA;AA2B5B,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,GAAmB;IAClE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAA;IACnF,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClC,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,wBAAwB,YAAY,CAAC,GAAG,CAAC,4DAA4D,CACtG,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAA;AAC3C,CAAC"}

package/dist/state/home.d.ts

@@ -0,0 +1,9 @@
+export declare const STATE_HOME_ENV = "AUTOR3SEARCH_TYPESCRIPT_STATE_HOME";
+/**
+ * The root directory everything the metric depends on lives under, deliberately
+ * outside the repository the agent controls: baselines, eval locks and stop
+ * requests. If the agent could write any of this, it could grade its own work.
+ */
+export declare function stateHome(env?: NodeJS.ProcessEnv): string;
+/** The per-repository, per-tag state directory. */
+export declare function runDir(repoRoot: string, tag: string, env?: NodeJS.ProcessEnv): string;

package/dist/state/home.js

@@ -0,0 +1,72 @@
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { hashString } from '../freeze/manifest.js';
+export const STATE_HOME_ENV = 'AUTOR3SEARCH_TYPESCRIPT_STATE_HOME';
+const APP = 'autor3search-typescript';
+/** Tags become directory names, so they must be a single safe segment. */
+const TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * The root directory everything the metric depends on lives under, deliberately
+ * outside the repository the agent controls: baselines, eval locks and stop
+ * requests. If the agent could write any of this, it could grade its own work.
+ */
+export function stateHome(env = process.env) {
+    const override = env[STATE_HOME_ENV];
+    if (override !== undefined && override !== '') {
+        if (!path.isAbsolute(override)) {
+            // A relative value resolves against whatever directory the current command
+            // happens to run from. `eval` invoked from a subdirectory and `stop` invoked
+            // from the repo root would then address different state for the same run,
+            // and the stop would silently appear to do nothing.
+            throw new Error(`${STATE_HOME_ENV} must be an absolute path, got ${JSON.stringify(override)}: a relative ` +
+                "value resolves against each command's working directory, so eval and stop could " +
+                'address different state for the same run');
+        }
+        return override;
+    }
+    if (process.platform === 'darwin')
+        return path.join(homedir(), 'Library', 'Caches');
+    if (process.platform === 'win32') {
+        return env['LOCALAPPDATA'] ?? path.join(homedir(), 'AppData', 'Local');
+    }
+    return env['XDG_CACHE_HOME'] ?? path.join(homedir(), '.cache');
+}
+/**
+ * Canonicalizes a repo path so the same repository keys identically no matter
+ * how it was reached: a trailing slash, a relative path, or a symlinked parent
+ * directory. `realpath` requires the path to exist; when it doesn't (as in
+ * tests that key against a repo root that was never created on disk) we fall
+ * back to the syntactic resolution rather than failing.
+ *
+ * The fallback is ONLY for ENOENT. Any other realpath failure (EACCES on a
+ * symlinked ancestor, ELOOP, ESTALE, ...) must propagate rather than silently
+ * fall back to the syntactic path: `baseline` might run as the repo's owner
+ * and key on the true canonical path, while `eval` later runs under a
+ * different uid or a sandbox with restricted traversal on that same ancestor,
+ * hits EACCES, and -- if we swallowed it -- would fall back to a differently-
+ * hashed syntactic path and report "no baseline" for a run that exists. That
+ * is the exact same stranded-state failure the canonicalization exists to
+ * prevent, reintroduced through its own fallback.
+ */
+function canonicalRepoPath(repoRoot) {
+    const abs = path.resolve(repoRoot);
+    try {
+        return realpathSync(abs);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return abs;
+        throw err;
+    }
+}
+/** The per-repository, per-tag state directory. */
+export function runDir(repoRoot, tag, env = process.env) {
+    if (!TAG_RE.test(tag)) {
+        throw new Error(`invalid tag ${JSON.stringify(tag)}: use letters, digits, dot, dash or underscore only ` +
+            '(a tag becomes a directory name)');
+    }
+    const key = hashString(canonicalRepoPath(repoRoot)).slice(0, 16);
+    return path.join(stateHome(env), APP, key, tag);
+}
+//# sourceMappingURL=home.js.map

package/dist/state/home.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home.js","sourceRoot":"","sources":["../../src/state/home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAElE,MAAM,GAAG,GAAG,yBAAyB,CAAA;AAErC,0EAA0E;AAC1E,MAAM,MAAM,GAAG,mCAAmC,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAc,CAAC,CAAA;IACpC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,2EAA2E;YAC3E,6EAA6E;YAC7E,0EAA0E;YAC1E,oDAAoD;YACpD,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,kCAAkC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe;gBACxF,kFAAkF;gBAClF,0CAA0C,CAC7C,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IACnF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAA;QAChE,MAAM,GAAG,CAAA;IACX,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,MAAM,CACpB,QAAgB,EAChB,GAAW,EACX,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sDAAsD;YACtF,kCAAkC,CACrC,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAChE,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AACjD,CAAC"}

package/dist/state/lock.d.ts

@@ -0,0 +1,11 @@
+export declare function lockPath(dir: string): string;
+export declare function readEvalLock(dir: string): Promise<{
+    pid: number;
+} | null>;
+/**
+ * Acquires the per-run eval lock, refusing a concurrent eval for the same
+ * repo and tag. A crashed eval leaves its lock file behind with no process
+ * to clean it up; if the recorded pid is no longer alive the lock is stale
+ * and is reclaimed, so a crash never permanently blocks future evals.
+ */
+export declare function acquireEvalLock(dir: string): Promise<() => Promise<void>>;

package/dist/state/lock.js

@@ -0,0 +1,89 @@
+import { mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+export function lockPath(dir) {
+    return path.join(dir, 'eval.lock');
+}
+function isAlive(pid) {
+    try {
+        // Signal 0 sends nothing; it only probes whether the pid is signalable.
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM means the process exists but we lack permission to signal it --
+        // that is still "alive" and definitely not ours to reclaim. Any other
+        // error (ESRCH: no such process) means it is dead.
+        return err.code === 'EPERM';
+    }
+}
+export async function readEvalLock(dir) {
+    let text;
+    try {
+        text = await readFile(lockPath(dir), 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        // Any other read failure (EACCES, a different uid owns the file, a
+        // transient I/O error, ...) does NOT mean the lock is absent -- it means
+        // we could not check. Collapsing that into "absent" is how a genuinely
+        // held, live lock gets stolen out from under its owner. Propagate it so
+        // the caller never treats "couldn't read" as "safe to reclaim".
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        return { pid: parsed.pid };
+    }
+    catch {
+        // The read itself succeeded; the content is corrupt or half-written
+        // (e.g. a crash mid-write). That is genuinely indistinguishable from
+        // absent, so it is treated as reclaimable rather than wedging every
+        // future eval.
+        return null;
+    }
+}
+/**
+ * Acquires the per-run eval lock, refusing a concurrent eval for the same
+ * repo and tag. A crashed eval leaves its lock file behind with no process
+ * to clean it up; if the recorded pid is no longer alive the lock is stale
+ * and is reclaimed, so a crash never permanently blocks future evals.
+ */
+export async function acquireEvalLock(dir) {
+    await mkdir(dir, { recursive: true });
+    const file = lockPath(dir);
+    const record = { pid: process.pid, startedAt: new Date().toISOString() };
+    for (;;) {
+        try {
+            await writeFile(file, JSON.stringify(record), { flag: 'wx' });
+            break;
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+            // readEvalLock throws on anything other than "confirmed absent" or
+            // "confirmed corrupt" (see its doc comment); that throw propagates out
+            // of this function untouched, so a lock we failed to read is never
+            // reclaimed here.
+            const existing = await readEvalLock(dir);
+            if (existing !== null && isAlive(existing.pid)) {
+                throw new Error(`eval lock is already held by pid ${existing.pid}; wait for it to finish, or run ` +
+                    '"stop" to request it stop');
+            }
+            // existing is null here only because the file was confirmed absent (a
+            // race: it existed for writeFile's wx check but was gone by the time we
+            // read it) or its content was corrupt/half-written. Either way it is
+            // safe to reclaim. A dead-pid lock falls through the isAlive check
+            // above instead.
+            await rm(file, { force: true });
+        }
+    }
+    let released = false;
+    return async () => {
+        if (released)
+            return;
+        released = true;
+        await rm(file, { force: true });
+    };
+}
+//# sourceMappingURL=lock.js.map

package/dist/state/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../src/state/lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,IAAI,MAAM,WAAW,CAAA;AAO5B,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;AACpC,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,wEAAwE;QACxE,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,sEAAsE;QACtE,mDAAmD;QACnD,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAA;IACxD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACjE,mEAAmE;QACnE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAA;QAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,qEAAqE;QACrE,oEAAoE;QACpE,eAAe;QACf,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;IAEtF,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAC7D,MAAK;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAA;YAC/D,mEAAmE;YACnE,uEAAuE;YACvE,mEAAmE;YACnE,kBAAkB;YAClB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,QAAQ,CAAC,GAAG,kCAAkC;oBAChF,2BAA2B,CAC9B,CAAA;YACH,CAAC;YACD,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,mEAAmE;YACnE,iBAAiB;YACjB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC,CAAA;AACH,CAAC"}