dsh-auto-review 0.4.0

package/lib/types/client/styles.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Scoped stylesheet for the review panel. Standalone bundles cannot use the
+ * in-repo CSS-module pipeline, so the panel injects one `<style>` element
+ * whose selectors are all scoped under `[data-dsh-auto-review]`.
+ * @module dsh-auto-review/client/styles
+ */
+/** Install the scoped stylesheet once per plugin fiber. */
+export declare function installPanelStyles(): () => void;
+//# sourceMappingURL=styles.d.ts.map

package/lib/types/client/styles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../src/client/styles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmHH,2DAA2D;AAC3D,wBAAgB,kBAAkB,IAAI,MAAM,IAAI,CAS/C"}

package/lib/types/client/styles.js

@@ -0,0 +1,130 @@
+/**
+ * Scoped stylesheet for the review panel. Standalone bundles cannot use the
+ * in-repo CSS-module pipeline, so the panel injects one `<style>` element
+ * whose selectors are all scoped under `[data-dsh-auto-review]`.
+ * @module dsh-auto-review/client/styles
+ */
+const STYLE_ID = 'dsh-auto-review-panel-styles';
+const CSS = `
+[data-dsh-auto-review] {
+  --ar-allow: var(--dsw-color-success, #16a34a);
+  --ar-deny: var(--dsw-color-danger, #dc2626);
+  --ar-fallback: var(--dsw-color-warning, #d97706);
+  --ar-escalation: var(--dsw-color-warning, #d97706);
+  --ar-border: var(--dsw-color-border, rgba(128, 128, 128, 0.3));
+  --ar-bg: var(--dsw-color-surface, #ffffff);
+  --ar-fg: var(--dsw-color-text, #1f2328);
+  --ar-muted: var(--dsw-color-text-muted, #6b7280);
+  font-family: inherit;
+  color: var(--ar-fg);
+}
+[data-dsh-auto-review-panel] {
+  position: absolute;
+  z-index: 40;
+  min-width: 320px;
+  max-width: 420px;
+  max-height: 70vh;
+  overflow-y: auto;
+  background: var(--ar-bg);
+  border: 1px solid var(--ar-border);
+  border-radius: 8px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.18);
+  padding: 12px;
+  font-size: 12px;
+  line-height: 1.5;
+}
+[data-dsh-auto-review-button] {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  cursor: pointer;
+  background: transparent;
+  border: 1px solid var(--ar-border);
+  border-radius: 6px;
+  padding: 3px 8px;
+  font-size: 12px;
+  color: var(--ar-fg);
+}
+[data-dsh-auto-review-button]:hover {
+  background: rgba(128, 128, 128, 0.12);
+}
+[data-dsh-auto-review-section] {
+  margin: 8px 0;
+  border-top: 1px solid var(--ar-border);
+  padding-top: 8px;
+}
+[data-dsh-auto-review-title] {
+  font-weight: 600;
+  margin-bottom: 6px;
+}
+[data-dsh-auto-review-row] {
+  display: flex;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 2px 0;
+  align-items: baseline;
+}
+[data-dsh-auto-review-muted] {
+  color: var(--ar-muted);
+}
+[data-dsh-auto-review-verdict] {
+  display: flex;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 3px 0;
+  border-bottom: 1px dashed var(--ar-border);
+}
+[data-dsh-auto-review-tone-allow] { color: var(--ar-allow); }
+[data-dsh-auto-review-tone-deny] { color: var(--ar-deny); }
+[data-dsh-auto-review-tone-fallback] { color: var(--ar-fallback); }
+[data-dsh-auto-review-tone-escalation] { color: var(--ar-escalation); }
+[data-dsh-auto-review-approve] {
+  cursor: pointer;
+  border: 1px solid var(--ar-border);
+  border-radius: 4px;
+  background: transparent;
+  color: var(--ar-fg);
+  padding: 1px 6px;
+  font-size: 11px;
+}
+[data-dsh-auto-review-approve]:hover {
+  background: rgba(128, 128, 128, 0.12);
+}
+[data-dsh-auto-review-switch] {
+  cursor: pointer;
+  border: 1px solid var(--ar-border);
+  border-radius: 4px;
+  background: transparent;
+  color: var(--ar-fg);
+  padding: 1px 6px;
+  font-size: 11px;
+}
+[data-dsh-auto-review-switch] + [data-dsh-auto-review-switch] {
+  margin-left: 4px;
+}
+[data-dsh-auto-review-switch]:hover:not(:disabled) {
+  background: rgba(128, 128, 128, 0.12);
+}
+[data-dsh-auto-review-approve]:disabled,
+[data-dsh-auto-review-switch]:disabled {
+  opacity: 0.45;
+  cursor: default;
+}
+[data-dsh-auto-review-circuit] {
+  color: var(--ar-deny);
+  font-weight: 600;
+}
+`;
+/** Install the scoped stylesheet once per plugin fiber. */
+export function installPanelStyles() {
+    if (document.getElementById(STYLE_ID) !== null)
+        return () => undefined;
+    const element = document.createElement('style');
+    element.id = STYLE_ID;
+    element.textContent = CSS;
+    document.head.appendChild(element);
+    return () => {
+        element.remove();
+    };
+}
+//# sourceMappingURL=styles.js.map

package/lib/types/client/styles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.js","sourceRoot":"","sources":["../../../src/client/styles.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAE/C,MAAM,GAAG,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6GX,CAAA;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB;IAChC,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAA;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,CAAC,EAAE,GAAG,QAAQ,CAAA;IACrB,OAAO,CAAC,WAAW,GAAG,GAAG,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,MAAM,EAAE,CAAA;IAClB,CAAC,CAAA;AACH,CAAC"}

package/lib/types/config.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Config schema and resolution for `dsh-auto-review`. Every tunable is a
+ * validated {@link Config} field changeable from cordis.yml; the resolution
+ * step compiles risk-rule regexes and fails loud on invalid input.
+ * @module dsh-auto-review/config
+ */
+import z from '@deepseek-ai/schemastery';
+import type { UiLanguage } from './messages.ts';
+/**
+ * What one approval request does at the auto-review answerer:
+ *
+ * - `'ai'` — the AI reviewer decides (allow/deny) and the request never
+ *   reaches a human answerer.
+ * - `'human'` — the request is delegated (`next()`) to the human answerer;
+ *   auto-review does not short-circuit the chain.
+ * - `'never'` — the answerer rejects deterministically. Only for tools an
+ *   admin wants hard-disabled whenever approval is required.
+ */
+export type ToolReviewPolicy = 'ai' | 'human' | 'never';
+/** Risk levels the reviewer may attach to a verdict. */
+export type RiskLevel = 'low' | 'medium' | 'high';
+/** The risk-level ordering, low first — the comparison base of {@link RiskPolicyConfig}. */
+export declare const RISK_ORDER: readonly RiskLevel[];
+/** What a risk-rule pattern is matched against. */
+export type RiskRuleField = 'reason' | 'toolName' | 'arguments';
+/**
+ * What happens when the reviewer cannot deliver a verdict (crash, timeout,
+ * subagent unavailable, schema mismatch):
+ *
+ * - `'rejected'` — fail closed; the request is denied (the default).
+ * - `'delegate'` — the request is passed down the answerer chain (a human
+ *   answerer, when one is composed).
+ * - `'allow-once'` — the request is granted once. Deliberately dangerous:
+ *   the grant is unconditional, not "readonly" in any enforced sense; it
+ *   exists for unattended deployments whose admin accepts that risk. Renamed
+ *   from `allow-readonly` in 0.2.0 for honesty; the old spelling is rejected
+ *   loudly.
+ */
+export type FallbackPolicy = 'rejected' | 'delegate' | 'allow-once';
+/**
+ * How much of the session transcript the reviewer receives as compact
+ * context (the calling session's recent user/assistant messages and tool
+ * results, redacted and truncated). `turns: 0` disables the section.
+ */
+export interface ContextBudgetConfig {
+    /** How many completed turns (plus the current one) of transcript to include; 0 disables. */
+    readonly turns: number;
+    /** Character cap applied to the whole context section. */
+    readonly maxChars: number;
+}
+/** What a tripped rejection circuit breaker does to later ai-policy requests in the turn. */
+export type CircuitAction = 'delegate' | 'reject' | 'abort-turn';
+/**
+ * The rejection circuit breaker: after a run of denials the turn stops
+ * asking the reviewer. Trips on {@link consecutiveDenies} consecutive deny
+ * verdicts in the turn OR {@link windowDenies} denials inside the last
+ * {@link windowSize} verdicts of the turn, whichever comes first.
+ */
+export interface CircuitBreakerConfig {
+    /** Consecutive deny verdicts in one turn that trip the breaker. */
+    readonly consecutiveDenies: number;
+    /** Deny count inside the window that trips the breaker. */
+    readonly windowDenies: number;
+    /** How many recent verdicts the window counts. */
+    readonly windowSize: number;
+    /** What later requests in the turn do once tripped. */
+    readonly action: CircuitAction;
+}
+/**
+ * How the reviewer's verdict risk level constrains the outcome: an `allow`
+ * verdict whose risk exceeds {@link maxAutoAllow} never settles the request
+ * — it delegates to the human chain (or denies) per {@link onHighRisk}.
+ */
+export interface RiskPolicyConfig {
+    /** The highest risk level an allow verdict may settle with. */
+    readonly maxAutoAllow: RiskLevel;
+    /** What happens to an allow verdict above the cap. */
+    readonly onHighRisk: 'delegate' | 'deny';
+}
+/** One risk rule: a regex matched against the request reason, tool name, or redacted call arguments. */
+export interface RiskRuleConfig {
+    /** Regular expression source (compiled without flags). */
+    pattern: string;
+    /** The policy a matching request resolves to. */
+    policy: ToolReviewPolicy;
+    /** What the pattern is matched against. Default `'reason'`; `'arguments'` matches the redacted presented call arguments. */
+    field?: RiskRuleField;
+}
+/** Per-tool policy table: explicit overrides, then a default for unlisted tools. */
+export interface ToolsPolicyConfig {
+    /** Policy for tools not named in {@link overrides}. Default `'human'` (delegate). */
+    default: ToolReviewPolicy;
+    /** Exact tool-name → policy mapping. */
+    overrides: Record<string, ToolReviewPolicy>;
+}
+/** Raw plugin config — every field optional; {@link Config} supplies the defaults. */
+export interface Config {
+    /**
+     * Whether sessions start with auto-review enabled. The `/auto-review`
+     * command writes a durable per-session override that beats this default.
+     */
+    enableByDefault?: boolean;
+    /** Tool policy table (defaults + per-tool overrides). */
+    toolsPolicy?: Partial<ToolsPolicyConfig>;
+    /** Risk rules matched (first match wins) against the request reason before the tool table. */
+    riskRules?: RiskRuleConfig[];
+    /** Subagent provider name for the reviewer (default `fork`, the in-process fork backend). */
+    reviewerProvider?: string;
+    /** Reviewer model id; when unset the reviewer inherits the session agent's route. */
+    reviewerModel?: string;
+    /** Verdict deadline in milliseconds. Default 60000. */
+    reviewerTimeoutMs?: number;
+    /**
+     * The reviewer's tool allow-list — read-only tools by default. The subagent
+     * `toolFilter` is an allow-list: anything not named here is invisible to
+     * and unexecutable by the reviewer child. Must be non-empty.
+     */
+    reviewerTools?: string[];
+    /** Reviewer failure policy (see {@link FallbackPolicy}). Default `'rejected'`. */
+    fallbackPolicy?: FallbackPolicy;
+    /** Maximum real AI verdicts per open turn; further requests delegate to humans. */
+    maxReviewsPerTurn?: number;
+    /**
+     * Maximum reviewer failures (timeout/unavailable/schema — not user
+     * cancellations) per open turn; beyond it, further requests delegate
+     * instead of paying another full timeout. Defaults to
+     * {@link maxReviewsPerTurn}.
+     */
+    maxFailuresPerTurn?: number;
+    /** Cap applied to reviewer reasons, the request reason, and the redacted argument preview before they enter prompts or logs. */
+    reasonMaxChars?: number;
+    /** Optional extra guidance appended to the reviewer prompt (advisory, not a hard rule). */
+    reviewerGuidance?: string;
+    /**
+     * Optional policy text injected into the reviewer prompt as the ruling
+     * policy (Markdown: always-deny / always-allow / require-justification
+     * sections), like Codex `auto_review.policy`. A template ships at
+     * `fixtures/config/policy-template.md`.
+     */
+    reviewerPolicyText?: string;
+    /** Guidance appended to every injected deny reason (anti-circumvention). */
+    denyGuidance?: string;
+    /** Compact transcript budget for the reviewer prompt (see {@link ContextBudgetConfig}). */
+    contextBudget?: Partial<ContextBudgetConfig>;
+    /** Verdict risk-level constraints (see {@link RiskPolicyConfig}). */
+    riskPolicy?: Partial<RiskPolicyConfig>;
+    /** The rejection circuit breaker (see {@link CircuitBreakerConfig}). */
+    circuitBreaker?: Partial<CircuitBreakerConfig>;
+    /** How long a `/auto-review approve` override stays usable, in milliseconds. Default 5 minutes. */
+    overrideTtlMs?: number;
+    /** UI language of the `/auto-review` command output (`en` | `zh`). Default `'en'`. */
+    language?: UiLanguage;
+}
+/** Config after {@link resolveConfig}: every optional field has its explicit default. */
+export interface ResolvedConfig {
+    readonly enableByDefault: boolean;
+    readonly toolsPolicy: ToolsPolicyConfig;
+    readonly riskRules: readonly ResolvedRiskRule[];
+    readonly reviewerProvider: string;
+    readonly reviewerModel: string | undefined;
+    readonly reviewerTimeoutMs: number;
+    readonly reviewerTools: readonly string[];
+    readonly fallbackPolicy: FallbackPolicy;
+    readonly maxReviewsPerTurn: number;
+    readonly maxFailuresPerTurn: number;
+    readonly reasonMaxChars: number;
+    readonly reviewerGuidance: string | undefined;
+    readonly reviewerPolicyText: string | undefined;
+    readonly denyGuidance: string;
+    readonly contextBudget: ContextBudgetConfig;
+    readonly riskPolicy: RiskPolicyConfig;
+    readonly circuitBreaker: CircuitBreakerConfig;
+    readonly overrideTtlMs: number;
+    readonly language: UiLanguage;
+}
+/** A compiled {@link RiskRuleConfig}, ready to test against its configured field. */
+export interface ResolvedRiskRule {
+    /** The original pattern source, kept for prompts and audit. */
+    readonly pattern: string;
+    readonly regex: RegExp;
+    readonly policy: ToolReviewPolicy;
+    readonly field: RiskRuleField;
+}
+/** Default anti-circumvention guidance appended to every injected deny reason. */
+export declare const DEFAULT_DENY_GUIDANCE: string;
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+export declare const Config: z<Config>;
+/** Whether `level` ranks strictly above `cap` in {@link RISK_ORDER}. */
+export declare function riskExceeds(level: RiskLevel, cap: RiskLevel): boolean;
+/**
+ * Validate raw values and compile the resolved config. Defaults are applied
+ * HERE — the explicit resolution step — so a partially-specified config from
+ * a direct `ctx.plugin` mount behaves like the loader-filled one.
+ * @param config - raw (possibly partial) plugin config.
+ * @returns the fully resolved config.
+ * @throws TypeError on invalid risk-rule regexes, non-positive budgets, or
+ *   out-of-range numbers (misconfiguration fails loud).
+ */
+export declare function resolveConfig(config?: Config): ResolvedConfig;
+//# sourceMappingURL=config.d.ts.map

package/lib/types/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAA;AAEvD,wDAAwD;AACxD,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;AAEjD,4FAA4F;AAC5F,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAA8B,CAAA;AAEzE,mDAAmD;AACnD,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAA;AAE/D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAA;AAEnE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAA;IAChC,sDAAsD;IACtD,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAAA;CACzC;AAED,wGAAwG;AACxG,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,MAAM,EAAE,gBAAgB,CAAA;IACxB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,OAAO,EAAE,gBAAgB,CAAA;IACzB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAC5C;AAED,sFAAsF;AACtF,MAAM,WAAW,MAAM;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,yDAAyD;IACzD,WAAW,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACxC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,cAAc,EAAE,CAAA;IAC5B,6FAA6F;IAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,gIAAgI;IAChI,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAC5C,qEAAqE;IACrE,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAA;IACtC,wEAAwE;IACxE,cAAc,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC9C,mGAAmG;IACnG,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,sFAAsF;IACtF,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAA;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAA;IAC3C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAA;CAC9B;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAC9B;AAQD,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,QAC0F,CAAA;AAE5H,kFAAkF;AAClF,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CA0C3B,CAAA;AAEF,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAErE;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,GAAE,MAAW,GAAG,cAAc,CA6EjE"}

package/lib/types/config.js

@@ -0,0 +1,154 @@
+/**
+ * Config schema and resolution for `dsh-auto-review`. Every tunable is a
+ * validated {@link Config} field changeable from cordis.yml; the resolution
+ * step compiles risk-rule regexes and fails loud on invalid input.
+ * @module dsh-auto-review/config
+ */
+import z from '@deepseek-ai/schemastery';
+/** The risk-level ordering, low first — the comparison base of {@link RiskPolicyConfig}. */
+export const RISK_ORDER = ['low', 'medium', 'high'];
+const POLICY = z.union(['ai', 'human', 'never']);
+const FALLBACK = z.union(['rejected', 'delegate', 'allow-once']);
+const RISK = z.union(['low', 'medium', 'high']);
+const FIELD = z.union(['reason', 'toolName', 'arguments']);
+const CIRCUIT_ACTION = z.union(['delegate', 'reject', 'abort-turn']);
+/** Default anti-circumvention guidance appended to every injected deny reason. */
+export const DEFAULT_DENY_GUIDANCE = 'Do not attempt to work around this denial. '
+    + 'Choose a materially safer alternative that stays inside your permissions, or ask the user before retrying this action.';
+/** Schemastery schema: the loader validates and fills defaults before `apply`. */
+export const Config = z.object({
+    enableByDefault: z.boolean().default(true),
+    toolsPolicy: z.object({
+        default: POLICY.default('human'),
+        overrides: z.dict(POLICY).default({}),
+    }).default({ default: 'human', overrides: {} }),
+    riskRules: z.array(z.object({
+        pattern: z.string(),
+        policy: POLICY,
+        field: FIELD.default('reason'),
+    })).default([]),
+    reviewerProvider: z.string().default('fork'),
+    reviewerModel: z.string(),
+    reviewerTimeoutMs: z.number().default(60_000),
+    reviewerTools: z.array(z.string()).default(['read', 'glob', 'grep']),
+    fallbackPolicy: FALLBACK.default('rejected'),
+    maxReviewsPerTurn: z.number().default(10),
+    maxFailuresPerTurn: z.number(),
+    reasonMaxChars: z.number().default(2000),
+    reviewerGuidance: z.string(),
+    reviewerPolicyText: z.string(),
+    denyGuidance: z.string().default(DEFAULT_DENY_GUIDANCE),
+    contextBudget: z.object({
+        turns: z.number().default(0),
+        maxChars: z.number().default(4000),
+    }).default({ turns: 0, maxChars: 4000 }),
+    riskPolicy: z.object({
+        maxAutoAllow: RISK.default('high'),
+        onHighRisk: z.union(['delegate', 'deny']).default('delegate'),
+    }).default({ maxAutoAllow: 'high', onHighRisk: 'delegate' }),
+    circuitBreaker: z.object({
+        consecutiveDenies: z.number().default(3),
+        // The window defaults must stay reachable under the default
+        // maxReviewsPerTurn (10): a window trip needs 6 denies inside the turn's
+        // at most 10 verdicts, so interleaved denials trip it even when no
+        // 3-deny run occurs (a 10-in-50 default could never trip first).
+        windowDenies: z.number().default(6),
+        windowSize: z.number().default(10),
+        action: CIRCUIT_ACTION.default('delegate'),
+    }).default({ consecutiveDenies: 3, windowDenies: 6, windowSize: 10, action: 'delegate' }),
+    overrideTtlMs: z.number().default(5 * 60_000),
+    language: z.union(['en', 'zh']).default('en'),
+});
+/** Whether `level` ranks strictly above `cap` in {@link RISK_ORDER}. */
+export function riskExceeds(level, cap) {
+    return RISK_ORDER.indexOf(level) > RISK_ORDER.indexOf(cap);
+}
+/**
+ * Validate raw values and compile the resolved config. Defaults are applied
+ * HERE — the explicit resolution step — so a partially-specified config from
+ * a direct `ctx.plugin` mount behaves like the loader-filled one.
+ * @param config - raw (possibly partial) plugin config.
+ * @returns the fully resolved config.
+ * @throws TypeError on invalid risk-rule regexes, non-positive budgets, or
+ *   out-of-range numbers (misconfiguration fails loud).
+ */
+export function resolveConfig(config = {}) {
+    if (!Number.isSafeInteger(config.reviewerTimeoutMs ?? 60_000) || (config.reviewerTimeoutMs ?? 60_000) <= 0) {
+        throw new TypeError(`reviewerTimeoutMs must be a positive safe integer, got ${String(config.reviewerTimeoutMs)}`);
+    }
+    if (!Number.isSafeInteger(config.maxReviewsPerTurn ?? 10) || (config.maxReviewsPerTurn ?? 10) <= 0) {
+        throw new TypeError(`maxReviewsPerTurn must be a positive safe integer, got ${String(config.maxReviewsPerTurn)}`);
+    }
+    if (!Number.isSafeInteger(config.maxFailuresPerTurn ?? 10) || (config.maxFailuresPerTurn ?? 10) <= 0) {
+        throw new TypeError(`maxFailuresPerTurn must be a positive safe integer, got ${String(config.maxFailuresPerTurn)}`);
+    }
+    if (!Number.isSafeInteger(config.reasonMaxChars ?? 2000) || (config.reasonMaxChars ?? 2000) <= 0) {
+        throw new TypeError(`reasonMaxChars must be a positive safe integer, got ${String(config.reasonMaxChars)}`);
+    }
+    const turns = config.contextBudget?.turns ?? 0;
+    if (!Number.isSafeInteger(turns) || turns < 0) {
+        throw new TypeError(`contextBudget.turns must be a non-negative safe integer, got ${String(turns)}`);
+    }
+    const contextChars = config.contextBudget?.maxChars ?? 4000;
+    if (!Number.isSafeInteger(contextChars) || contextChars <= 0) {
+        throw new TypeError(`contextBudget.maxChars must be a positive safe integer, got ${String(contextChars)}`);
+    }
+    const breaker = config.circuitBreaker ?? {};
+    for (const [key, value] of [['consecutiveDenies', breaker.consecutiveDenies ?? 3], ['windowDenies', breaker.windowDenies ?? 6], ['windowSize', breaker.windowSize ?? 10]]) {
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new TypeError(`circuitBreaker.${key} must be a positive safe integer, got ${String(value)}`);
+        }
+    }
+    if (!Number.isSafeInteger(config.overrideTtlMs ?? 5 * 60_000) || (config.overrideTtlMs ?? 5 * 60_000) <= 0) {
+        throw new TypeError(`overrideTtlMs must be a positive safe integer, got ${String(config.overrideTtlMs)}`);
+    }
+    const reviewerTools = config.reviewerTools ?? ['read', 'glob', 'grep'];
+    if (reviewerTools.length === 0) {
+        throw new TypeError('reviewerTools must name at least one tool: an empty allow-list would leave the reviewer with no tool face');
+    }
+    const riskRules = (config.riskRules ?? []).map((rule) => {
+        let regex;
+        try {
+            // Flags are stripped: a global flag would make repeated .test() calls
+            // stateful (lastIndex), and other flags would silently change semantics.
+            regex = new RegExp(rule.pattern, 'u');
+        }
+        catch (error) {
+            throw new TypeError(`risk rule pattern ${JSON.stringify(rule.pattern)} is not a valid regular expression: ${String(error)}`);
+        }
+        return { pattern: rule.pattern, regex, policy: rule.policy, field: rule.field ?? 'reason' };
+    });
+    return {
+        enableByDefault: config.enableByDefault ?? true,
+        toolsPolicy: {
+            default: config.toolsPolicy?.default ?? 'human',
+            overrides: config.toolsPolicy?.overrides ?? {},
+        },
+        riskRules,
+        reviewerProvider: config.reviewerProvider ?? 'fork',
+        reviewerModel: config.reviewerModel,
+        reviewerTimeoutMs: config.reviewerTimeoutMs ?? 60_000,
+        reviewerTools,
+        fallbackPolicy: config.fallbackPolicy ?? 'rejected',
+        maxReviewsPerTurn: config.maxReviewsPerTurn ?? 10,
+        maxFailuresPerTurn: config.maxFailuresPerTurn ?? config.maxReviewsPerTurn ?? 10,
+        reasonMaxChars: config.reasonMaxChars ?? 2000,
+        reviewerGuidance: config.reviewerGuidance,
+        reviewerPolicyText: config.reviewerPolicyText,
+        denyGuidance: config.denyGuidance ?? DEFAULT_DENY_GUIDANCE,
+        contextBudget: { turns, maxChars: contextChars },
+        riskPolicy: {
+            maxAutoAllow: config.riskPolicy?.maxAutoAllow ?? 'high',
+            onHighRisk: config.riskPolicy?.onHighRisk ?? 'delegate',
+        },
+        circuitBreaker: {
+            consecutiveDenies: breaker.consecutiveDenies ?? 3,
+            windowDenies: breaker.windowDenies ?? 6,
+            windowSize: breaker.windowSize ?? 10,
+            action: breaker.action ?? 'delegate',
+        },
+        overrideTtlMs: config.overrideTtlMs ?? 5 * 60_000,
+        language: config.language ?? 'en',
+    };
+}
+//# sourceMappingURL=config.js.map

package/lib/types/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAkBxC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,UAAU,GAAyB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;AA6KzE,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC,CAAA;AACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC,CAAA;AACzE,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC,CAAA;AACxD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC,CAAA;AACnE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC,CAAA;AAE7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,6CAA6C;MAC9E,wHAAwH,CAAA;AAE5H,kFAAkF;AAClF,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACtC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACf,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpE,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KACnC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,MAAM,CAAU,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;KACvE,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC;QACvB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,4DAA4D;QAC5D,yEAAyE;QACzE,mEAAmE;QACnE,iEAAiE;QACjE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC;KAC3C,CAAC,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CACvD,CAAC,CAAA;AAEF,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,GAAc;IAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,SAAS,CAAC,0DAA0D,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,SAAS,CAAC,0DAA0D,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,SAAS,CAAC,2DAA2D,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;IACrH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,uDAAuD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IAC7G,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,KAAK,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,gEAAgE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,QAAQ,IAAI,IAAI,CAAA;IAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,+DAA+D,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;IAC5G,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAU,EAAE,CAAC;QACnL,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,SAAS,CAAC,kBAAkB,GAAG,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpG,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,SAAS,CAAC,sDAAsD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IACtE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CAAC,2GAA2G,CAAC,CAAA;IAClI,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAoB,EAAE;QACxE,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,sEAAsE;YACtE,yEAAyE;YACzE,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,uCAAuC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC9H,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAA;IAC7F,CAAC,CAAC,CAAA;IACF,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QAC/C,WAAW,EAAE;YACX,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,IAAI,OAAO;YAC/C,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,IAAI,EAAE;SAC/C;QACD,SAAS;QACT,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,MAAM;QACnD,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,MAAM;QACrD,aAAa;QACb,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,UAAU;QACnD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,EAAE;QACjD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,iBAAiB,IAAI,EAAE;QAC/E,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC7C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,qBAAqB;QAC1D,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE;QAChD,UAAU,EAAE;YACV,YAAY,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,IAAI,MAAM;YACvD,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,IAAI,UAAU;SACxD;QACD,cAAc,EAAE;YACd,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC;YACjD,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;YACvC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE;YACpC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;SACrC;QACD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC,GAAG,MAAM;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;KAClC,CAAA;AACH,CAAC"}