hex-audit 0.7.0 → 0.8.0

package/dist/mcp/server.js

@@ -0,0 +1,400 @@
+/**
+ * `hex mcp`: a stdio MCP server that gives a Claude Code session typed access
+ * to the Hex project — what the auditor is looking at in the dashboard, exact
+ * compiler facts, the protocol model, the board, the review map, notes and
+ * triage rules. Tools only (no channels). Every tool wraps the same core
+ * modules the CLI uses, so behaviour is identical either way.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { findOutputDir } from '../core/locate.js';
+import { COLUMN_TO_STATUS, createIssue, ISSUE_SOURCES, moveIssue, patchIssue, recordValidation, } from '../core/issues.js';
+import { dedupCandidates, markDuplicate } from '../core/dedup.js';
+import { markFunctions, REVIEW_STATES, reviewSummary } from '../core/review.js';
+import { addLeadIdempotent, readContractNote, resolveNoteTarget } from '../core/notes.js';
+import { commentsForFile, readComments } from '../core/comments.js';
+import { addRule, readRules } from '../core/rules.js';
+import { readInvariants, readProtocolModel, setInvariantStatus, setInvariantTest, } from '../core/model.js';
+import { FACT_QUERIES, loadFacts, resolveFunctions, runFactQuery, } from '../facts/query.js';
+const INSTRUCTIONS = `Hex is the auditor's Solidity audit workspace for this repository (data in .hex/).
+- When the user says "this", "here", "the selected …", "what I'm looking at" or similar, call hex_focus first: it returns what they have selected in the Hex dashboard (a function, card, diagram node, code range, invariant or code comment).
+- For exact code relationships (who calls X, who writes Y, storage layout, linearization, which entry points reach X) use hex_facts_query instead of grepping: it comes from the compiler AST.
+- The auditor's comments on lines of code (written in the dashboard's code viewer) come from hex_code_comments.
+- Board changes (new card, move, patch, duplicate, validation) and review marks go through these tools; never edit .hex JSON by hand.`;
+function ok(data) {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: typeof data === 'string' ? data : JSON.stringify(data, null, 2),
+            },
+        ],
+    };
+}
+function err(message) {
+    return { content: [{ type: 'text', text: message }], isError: true };
+}
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function createHexServer(cwd = process.cwd()) {
+    const server = new McpServer({ name: 'hex', version: '0.8.0' }, { instructions: INSTRUCTIONS });
+    const outDir = () => {
+        const d = findOutputDir(cwd);
+        if (!d)
+            throw new Error('No Hex project here (no .hex/config.json). Run `hex init` first.');
+        return d;
+    };
+    const guard = (fn) => async (args) => {
+        try {
+            return ok(fn(args));
+        }
+        catch (e) {
+            return err(e instanceof Error ? e.message : String(e));
+        }
+    };
+    // ── Focus ─────────────────────────────────────────────────────────
+    server.registerTool('hex_focus', {
+        title: 'What the auditor is looking at',
+        description: 'Returns the current selection in the Hex dashboard (function, card, diagram node, code range or invariant), enriched with facts, review state and related cards. Call this whenever the user refers to "this" or "the selected" thing.',
+        inputSchema: {},
+    }, guard(() => {
+        const dir = outDir();
+        const focus = readJson(path.join(dir, 'focus.json'));
+        if (!focus)
+            return { focus: null, hint: 'Nothing selected in the dashboard yet.' };
+        const ageSec = focus.updated_at
+            ? Math.round((Date.now() - Date.parse(focus.updated_at)) / 1000)
+            : null;
+        const out = { focus, age_seconds: ageSec };
+        const facts = loadFacts(dir);
+        if (facts && (focus.kind === 'function' || focus.kind === 'diagram_node')) {
+            const fns = resolveFunctions(facts, focus.ref);
+            if (fns.length) {
+                const review = reviewSummary(dir);
+                out.functions = fns.map((f) => ({
+                    ...f,
+                    review: review.rows.find((r) => r.id === f.id) ?? null,
+                }));
+            }
+        }
+        if (focus.kind === 'card') {
+            const findings = readJson(path.join(dir, 'findings.json'))
+                ?.findings ?? [];
+            const tracking = readJson(path.join(dir, 'tracking.json'))
+                ?.findings ?? [];
+            out.card = {
+                finding: findings.find((f) => f.id === focus.ref) ?? null,
+                tracking: tracking.find((t) => t.id === focus.ref) ?? null,
+            };
+        }
+        return out;
+    }));
+    // ── Facts ─────────────────────────────────────────────────────────
+    server.registerTool('hex_facts_query', {
+        title: 'Exact compiler facts',
+        description: 'Query the compiler AST facts: callers / callees (optionally transitive), readers / writers of a state variable, storage layout, linearization, entry points, which entry points reach a function, or a function record.',
+        inputSchema: {
+            query: z.enum(FACT_QUERIES),
+            ref: z
+                .string()
+                .optional()
+                .describe('Function (Vault.withdraw or Vault.withdraw(uint256) or withdraw), state var (Vault.totalAssets or totalAssets), or contract'),
+            transitive: z.boolean().optional(),
+        },
+    }, guard(({ query, ref, transitive }) => {
+        const facts = loadFacts(outDir());
+        if (!facts)
+            throw new Error('No .hex/facts.json yet. Run `hex facts`.');
+        return {
+            source: facts.source,
+            result: runFactQuery(facts, query, ref, { transitive }),
+        };
+    }));
+    // ── Model + invariants ────────────────────────────────────────────
+    server.registerTool('hex_model_get', {
+        title: 'Protocol model',
+        description: 'The verified protocol model: actors, assets, privileges, trust assumptions, dependencies, state machines, accounting, risky flows.',
+        inputSchema: { section: z.string().optional() },
+    }, guard(({ section }) => {
+        const model = readProtocolModel(outDir());
+        if (!model)
+            throw new Error('No protocol model yet (/init-audit writes .hex/model/protocol.json).');
+        return (section ? model[section] : model);
+    }));
+    server.registerTool('hex_invariant_list', {
+        title: 'Invariants',
+        description: 'List invariants with status and test results.',
+        inputSchema: { status: z.enum(['proposed', 'accepted', 'rejected']).optional() },
+    }, guard(({ status }) => readInvariants(outDir()).invariants.filter((i) => !status || i.status === status)));
+    server.registerTool('hex_invariant_set', {
+        title: 'Update an invariant',
+        description: 'Accept or reject an invariant, or record its test/fuzz result.',
+        inputSchema: {
+            id: z.string(),
+            status: z.enum(['proposed', 'accepted', 'rejected']).optional(),
+            reason: z.string().optional(),
+            test_tool: z.enum(['fizz', 'foundry']).optional(),
+            test_status: z.enum(['not_written', 'passing', 'failing', 'broken']).optional(),
+            test_file: z.string().optional(),
+            repro_file: z.string().optional(),
+        },
+    }, guard((a) => {
+        const dir = outDir();
+        if (a.status)
+            setInvariantStatus(dir, a.id, a.status, a.reason);
+        if (a.test_tool || a.test_status || a.test_file || a.repro_file) {
+            setInvariantTest(dir, a.id, {
+                ...(a.test_tool ? { tool: a.test_tool } : {}),
+                ...(a.test_status ? { status: a.test_status } : {}),
+                ...(a.test_file ? { file: a.test_file } : {}),
+                ...(a.repro_file ? { repro_file: a.repro_file } : {}),
+                last_run_at: new Date().toISOString(),
+            });
+        }
+        return readInvariants(dir).invariants.find((i) => i.id === a.id);
+    }));
+    // ── Board ─────────────────────────────────────────────────────────
+    server.registerTool('hex_board_list', {
+        title: 'Board',
+        description: 'Compact list of cards: id, title, severity, status, source, validation verdict.',
+        inputSchema: { status: z.string().optional(), source: z.string().optional() },
+    }, guard(({ status, source }) => {
+        const tracking = readJson(path.join(outDir(), 'tracking.json'))
+            ?.findings ?? [];
+        return tracking
+            .filter((t) => (!status || t.status === status) && (!source || t.source === source))
+            .map((t) => ({
+            id: t.id,
+            title: t.title,
+            severity: t.severity,
+            status: t.status,
+            source: t.source,
+            ...(t.validation ? { verdict: t.validation.verdict } : {}),
+            ...(t.duplicate_of ? { duplicate_of: t.duplicate_of } : {}),
+        }));
+    }));
+    server.registerTool('hex_issue_show', {
+        title: 'Card',
+        description: 'Full finding + tracking record of a card.',
+        inputSchema: { id: z.string() },
+    }, guard(({ id }) => {
+        const dir = outDir();
+        const f = readJson(path.join(dir, 'findings.json'))?.findings.find((x) => x.id === id) ?? null;
+        const t = readJson(path.join(dir, 'tracking.json'))?.findings.find((x) => x.id === id) ?? null;
+        if (!f && !t)
+            throw new Error(`No card ${id}`);
+        return { id, finding: f, tracking: t };
+    }));
+    server.registerTool('hex_issue_new', {
+        title: 'New card',
+        description: 'Create a Potential card with a uniform H-NNN id. Then fill description/recommendation with hex_issue_patch.',
+        inputSchema: {
+            source: z.enum(ISSUE_SOURCES),
+            title: z.string(),
+            severity: z.enum(['Critical', 'High', 'Medium', 'Low', 'Info']).optional(),
+            source_ref: z.string().optional(),
+            files: z.array(z.string()).optional(),
+        },
+    }, guard((a) => ({
+        id: createIssue(outDir(), {
+            source: a.source,
+            title: a.title,
+            severity: a.severity,
+            source_ref: a.source_ref ?? null,
+            files: a.files,
+        }),
+    })));
+    server.registerTool('hex_issue_move', {
+        title: 'Move card',
+        description: 'Move a card between columns (potential | verified | rejected | duplicate). Synced cards are read-only.',
+        inputSchema: {
+            id: z.string(),
+            to: z.enum(Object.keys(COLUMN_TO_STATUS)),
+            duplicate_of: z.string().optional(),
+        },
+    }, guard(({ id, to, duplicate_of }) => moveIssue(outDir(), id, to, duplicate_of)));
+    server.registerTool('hex_issue_patch', {
+        title: 'Edit card',
+        description: 'Edit card fields (title, severity, description, recommendation, resolution, update_from_client, notes, files).',
+        inputSchema: {
+            id: z.string(),
+            title: z.string().optional(),
+            severity: z.enum(['Critical', 'High', 'Medium', 'Low', 'Info']).optional(),
+            description: z.string().optional(),
+            recommendation: z.string().optional(),
+            resolution: z.string().optional(),
+            update_from_client: z.string().optional(),
+            notes: z.string().optional(),
+            files: z.array(z.string()).optional(),
+        },
+    }, guard(({ id, ...fields }) => {
+        const updates = Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== undefined));
+        return patchIssue(outDir(), id, updates);
+    }));
+    server.registerTool('hex_issue_validation', {
+        title: 'Record validation',
+        description: 'Record a verdict, memo and PoC result. With auto_move (agents only) a conclusive verdict moves the card: reproduced + passing PoC + reality gate → Verified; refuted by 2 independent refuters → Rejected.',
+        inputSchema: {
+            id: z.string(),
+            verdict: z.enum(['reproduced', 'refuted', 'uncertain', 'valid_no_poc']),
+            by: z.enum(['auditor', 'agent']),
+            memo: z.string().optional(),
+            poc_file: z.string().optional(),
+            poc_status: z.enum(['passing', 'failing', 'not_started']).optional(),
+            refuters: z.number().int().optional(),
+            reality_gate: z.boolean().optional(),
+            auto_move: z.boolean().optional(),
+        },
+    }, guard((a) => {
+        const r = recordValidation(outDir(), a.id, {
+            verdict: a.verdict,
+            validated_by: a.by,
+            memo: a.memo,
+            poc_file: a.poc_file,
+            poc_status: a.poc_status,
+            refuters: a.refuters,
+            reality_gate: a.reality_gate,
+        }, { autoMove: a.auto_move });
+        return { id: a.id, moved_to: r.movedTo };
+    }));
+    server.registerTool('hex_issue_dedup', {
+        title: 'Duplicate candidates',
+        description: 'Cards that may duplicate this one (exact-function overlap first), plus the match rules and triage rules.',
+        inputSchema: { id: z.string() },
+    }, guard(({ id }) => {
+        const dir = outDir();
+        return { ...dedupCandidates(dir, id), triage_rules: readRules(dir) };
+    }));
+    server.registerTool('hex_issue_mark_duplicate', {
+        title: 'Mark duplicate',
+        description: 'Move a card to Duplicate of a canonical card and record the match signals.',
+        inputSchema: {
+            id: z.string(),
+            of: z.string(),
+            same_contract: z.boolean(),
+            same_function: z.boolean(),
+            root_cause: z.enum(['same', 'overlapping', 'different']),
+            attack_vector: z.enum(['same', 'overlapping', 'different']),
+            reasoning: z.string(),
+            confidence: z.enum(['high', 'medium', 'low']).default('high'),
+        },
+    }, guard((a) => {
+        markDuplicate(outDir(), a.id, a.of, {
+            signals: {
+                contract: a.same_contract,
+                function: a.same_function,
+                root_cause: a.root_cause,
+                attack_vector: a.attack_vector,
+            },
+            reasoning: a.reasoning,
+            confidence: a.confidence,
+        });
+        return { id: a.id, duplicate_of: a.of };
+    }));
+    // ── Review map ────────────────────────────────────────────────────
+    server.registerTool('hex_review_mark', {
+        title: 'Mark review state',
+        description: 'Set functions (or every function of a contract) to unread / read / questioned / cleared.',
+        inputSchema: {
+            refs: z.array(z.string()),
+            state: z.enum(REVIEW_STATES),
+            note: z.string().optional(),
+            by: z.enum(['auditor', 'diane', 'dashboard', 'agent']).default('auditor'),
+        },
+    }, guard(({ refs, state, note, by, }) => {
+        const dir = outDir();
+        const facts = loadFacts(dir);
+        if (!facts)
+            throw new Error('No .hex/facts.json yet. Run `hex facts`.');
+        const ids = new Set();
+        const missing = [];
+        for (const ref of refs) {
+            const byContract = facts.functions.filter((f) => f.contract === ref && f.in_scope);
+            const hits = byContract.length
+                ? byContract
+                : resolveFunctions(facts, ref).filter((f) => f.in_scope);
+            if (!hits.length)
+                missing.push(ref);
+            for (const f of hits)
+                ids.add(f.id);
+        }
+        if (missing.length)
+            throw new Error(`Unknown function(s): ${missing.join(', ')}`);
+        markFunctions(dir, [...ids], state, by, note);
+        return { marked: [...ids], state };
+    }));
+    server.registerTool('hex_review_status', {
+        title: 'Review progress',
+        description: 'Cleared nSLOC, per-state counts and the top blind spots.',
+        inputSchema: { blind_spots: z.number().int().optional() },
+    }, guard(({ blind_spots }) => {
+        const s = reviewSummary(outDir(), { blindSpots: blind_spots ?? 10 });
+        return {
+            pct: s.pct,
+            cleared_nsloc: s.cleared_nsloc,
+            total_nsloc: s.total_nsloc,
+            counts: s.counts,
+            blind_spots: s.blind_spots,
+        };
+    }));
+    // ── Notes + rules ─────────────────────────────────────────────────
+    server.registerTool('hex_note_show', {
+        title: 'Contract note',
+        description: "A contract's structured note: description, questions, leads.",
+        inputSchema: { contract: z.string() },
+    }, guard(({ contract }) => {
+        const dir = outDir();
+        return readContractNote(dir, resolveNoteTarget(dir, contract));
+    }));
+    server.registerTool('hex_code_comments', {
+        title: 'Code comments',
+        description: "The auditor's comments pinned to lines of source in the dashboard's code viewer, at the lines their code sits on now (stale = the code changed). Omit file for all files.",
+        inputSchema: { file: z.string().optional() },
+    }, guard(({ file }) => {
+        const dir = outDir();
+        const files = file ? [file] : [...new Set(readComments(dir).map((c) => c.file))].sort();
+        return files.flatMap((f) => commentsForFile(dir, f));
+    }));
+    server.registerTool('hex_note_lead', {
+        title: 'Add lead',
+        description: 'Add an open lead to a contract note (idempotent on source + source_ref).',
+        inputSchema: {
+            contract: z.string(),
+            text: z.string(),
+            source: z.string().optional(),
+            source_ref: z.string().optional(),
+        },
+    }, guard(({ contract, text, source, source_ref, }) => {
+        const dir = outDir();
+        const { lead, created } = addLeadIdempotent(dir, resolveNoteTarget(dir, contract), text, {
+            source,
+            source_ref,
+        });
+        return { lead, created };
+    }));
+    server.registerTool('hex_rules_list', {
+        title: 'Triage rules',
+        description: "The auditor's standing decisions (out of scope, trusted roles, by design, known issues).",
+        inputSchema: {},
+    }, guard(() => readRules(outDir())));
+    server.registerTool('hex_rules_add', {
+        title: 'Add triage rule',
+        description: 'Record a standing decision so AI runs stop raising it. Ask the auditor before adding one.',
+        inputSchema: {
+            kind: z.enum(['out_of_scope', 'trusted_role', 'by_design', 'known_issue']),
+            text: z.string(),
+            scope: z.array(z.string()).optional(),
+            created_from: z.string().optional(),
+        },
+    }, guard((a) => addRule(outDir(), a)));
+    return server;
+}
+//# sourceMappingURL=server.js.map

package/dist/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,SAAS,EACT,UAAU,EACV,gBAAgB,GAIjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAoB,MAAM,mBAAmB,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAE3B,MAAM,YAAY,GAAG;;;;sIAIiH,CAAC;AAIvI,SAAS,EAAE,CAAC,IAAU;IACpB,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;aACtE;SACF;KACF,CAAC;AACJ,CAAC;AACD,SAAS,GAAG,CAAC,OAAe;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChF,CAAC;AAED,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACzD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC5F,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GACT,CAAI,EAAqB,EAAE,EAAE,CAC7B,KAAK,EAAE,IAAO,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IAEJ,qEAAqE;IACrE,MAAM,CAAC,YAAY,CACjB,WAAW,EACX;QACE,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,CAAC,GAAG,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,QAAQ,CAQnB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC;QACnF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU;YAC7B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC;YAChE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,GAAG,GAA4B,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,EAAE,CAAC;YAC1E,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBAClC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9B,GAAG,CAAC;oBACJ,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI;iBACvD,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GACZ,QAAQ,CAAsC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC5E,EAAE,QAAQ,IAAI,EAAE,CAAC;YACrB,MAAM,QAAQ,GACZ,QAAQ,CAAsC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;gBAC5E,EAAE,QAAQ,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,GAAG;gBACT,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI;gBACzD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI;aAC3D,CAAC;QACJ,CAAC;QACD,OAAO,GAAW,CAAC;IACrB,CAAC,CAAC,CACH,CAAC;IAEF,qEAAqE;IACrE,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,yNAAyN;QAC3N,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;YAC3B,GAAG,EAAE,CAAC;iBACH,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,6HAA6H,CAC9H;YACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SACnC;KACF,EACD,KAAK,CACH,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAA4D,EAAE,EAAE;QACvF,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACxE,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,CAAS;SAChE,CAAC;IACJ,CAAC,CACF,CACF,CAAC;IAEF,qEAAqE;IACrE,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,oIAAoI;QACtI,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAChD,EACD,KAAK,CAAC,CAAC,EAAE,OAAO,EAAwB,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,OAAO,CAAC,OAAO,CAAC,CAAC,CAAE,KAAiC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAS,CAAC;IACjF,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,+CAA+C;QAC5D,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;KACjF,EACD,KAAK,CACH,CAAC,EAAE,MAAM,EAAuB,EAAE,EAAE,CAClC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAS,CAC5F,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;YACjD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC;KACF,EACD,KAAK,CACH,CAAC,CAQA,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM;YAAE,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAChE,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAoB,CAAC;IACtF,CAAC,CACF,CACF,CAAC;IAEF,qEAAqE;IACrE,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,OAAO;QACd,WAAW,EACT,iFAAiF;QACnF,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC9E,EACD,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAwC,EAAE,EAAE;QACjE,MAAM,QAAQ,GACZ,QAAQ,CAA+C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;YAC1F,EAAE,QAAQ,IAAI,EAAE,CAAC;QACrB,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;aACnF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAG,CAAC,CAAC,UAAmC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,2CAA2C;QACxD,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KAChC,EACD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,CAAC,GACL,QAAQ,CACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAChC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QAC/C,MAAM,CAAC,GACL,QAAQ,CACN,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAChC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;QAC/C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAqB,CAAC;IAC5D,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,6GAA6G;QAC/G,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAA2D,CAAC;YAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SACtC;KACF,EACD,KAAK,CACH,CAAC,CAMA,EAAE,EAAE,CAAC,CAAC;QACL,EAAE,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;YAChC,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC;KACH,CAAC,CACH,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,WAAW;QAClB,WAAW,EACT,wGAAwG;QAC1G,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAA0B,CAAC;YAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACpC;KACF,EACD,KAAK,CACH,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,EAAqD,EAAE,EAAE,CAC9E,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAiB,EAAE,YAAY,CAAoB,CAC9E,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,WAAW;QAClB,WAAW,EACT,gHAAgH;QAClH,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;SACtC;KACF,EACD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,EAA4C,EAAE,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAC9F,OAAO,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAoB,CAAC;IAC9D,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,4MAA4M;QAC9M,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;YACvE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC/B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;YACpE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;YACrC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;YACpC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAClC;KACF,EACD,KAAK,CACH,CAAC,CAUA,EAAE,EAAE;QACH,MAAM,CAAC,GAAG,gBAAgB,CACxB,MAAM,EAAE,EACR,CAAC,CAAC,EAAE,EACJ;YACE,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,YAAY,EAAE,CAAC,CAAC,EAAE;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,EACD,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAC1B,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,CAAC,CACF,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,0GAA0G;QAC5G,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KAChC,EACD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAkB,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,EAAqB,CAAC;IAC1F,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,4EAA4E;QACzF,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;YAC1B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;YAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;YAC3D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;YACrB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;SAC9D;KACF,EACD,KAAK,CACH,CAAC,CASA,EAAE,EAAE;QACH,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,OAAO,EAAE;gBACP,QAAQ,EAAE,CAAC,CAAC,aAAa;gBACzB,QAAQ,EAAE,CAAC,CAAC,aAAa;gBACzB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,aAAa,EAAE,CAAC,CAAC,aAAa;aAC/B;YACD,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,UAAU;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAC1C,CAAC,CACF,CACF,CAAC;IAEF,qEAAqE;IACrE,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,0FAA0F;QAC5F,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,aAA2D,CAAC;YAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC3B,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;SAC1E;KACF,EACD,KAAK,CACH,CAAC,EACC,IAAI,EACJ,KAAK,EACL,IAAI,EACJ,EAAE,GAMH,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM;gBAC5B,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,aAAa,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC,CACF,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,0DAA0D;QACvE,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC1D,EACD,KAAK,CAAC,CAAC,EAAE,WAAW,EAA4B,EAAE,EAAE;QAClD,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW;SACR,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEF,qEAAqE;IACrE,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,8DAA8D;QAC3E,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;KACtC,EACD,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAwB,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAoB,CAAC;IACpF,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,2KAA2K;QAC7K,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;KAC7C,EACD,KAAK,CAAC,CAAC,EAAE,IAAI,EAAqB,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAoB,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,0EAA0E;QACvF,WAAW,EAAE;YACX,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAClC;KACF,EACD,KAAK,CACH,CAAC,EACC,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,UAAU,GAMX,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;QACrB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE;YACvF,MAAM;YACN,UAAU;SACX,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAqB,CAAC;IAC9C,CAAC,CACF,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,0FAA0F;QAC5F,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,CAAoB,CAAC,CACpD,CAAC;IACF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,2FAA2F;QAC7F,WAAW,EAAE;YACX,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SACpC;KACF,EACD,KAAK,CACH,CAAC,CAKA,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAoB,CAC9C,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/skills/ai-audit/SKILL.md

@@ -19,7 +19,7 @@ You are the orchestrator of a parallelized smart contract security audit.
   - **Differential audit** — `project.mode` is `diff`: scan only the in-scope files that hold changed or impacted code. Get the list from the CLI, never by reading `diff.json` by eye:
 
     ```bash
-    npx hex diff --scan-files
+    npx --no-install hex diff --scan-files
     ```
 
     It recomputes `.hex/diff.json` and prints the files, space separated, on one line, in scope order. `{mode}` is `diff`. Turn 2 also writes `{bundle_dir}/diff-focus.md` (Turn 2 step 1b). If the command fails, print its error and stop: a differential scan without the diff is a full scan under a wrong label.
@@ -70,7 +70,7 @@ The pass count the scan runs is `{passes}` — settled in Turn 1b, 1 or more. Th
 
 **Turn 1 — Discover.** Print the banner, then make these parallel tool calls in one message:
 
-a. The in-scope file list, per Mode Selection. In a Hex project this depends on step d, so it may take a second message: `hex-scope` mode needs no Bash (the list is `project.scope`), `diff` mode runs `npx hex diff --scan-files`, and only the upstream default mode runs the `find`. Everything else in this turn stays parallel.
+a. The in-scope file list, per Mode Selection. In a Hex project this depends on step d, so it may take a second message: `hex-scope` mode needs no Bash (the list is `project.scope`), `diff` mode runs `npx --no-install hex diff --scan-files`, and only the upstream default mode runs the `find`. Everything else in this turn stays parallel.
 b. Resolve `{resolved_path}` — the `references/` directory next to this `SKILL.md`. Claude Code prints the skill's base directory when it loads the skill (`Base directory for this skill: …`); `{resolved_path}` is that directory plus `/references`. Only when no base directory was printed, Glob for exactly `.claude/skills/ai-audit/references/hacking-agents/shared-rules.md` and take the directory two levels up. **Never Glob `**/references/hacking-agents/shared-rules.md`**: it also matches pashov's own `solidity-auditor`, a `node_modules/hex-audit` copy or a `lib/` vendor, and the scan would then run another skill's assembler.
 c. ToolSearch `select:Agent`
 d. Read `.hex/config.json` — it settles Mode Selection (`project.scope`, `project.mode`). Absent → the upstream default mode.
@@ -100,7 +100,7 @@ printf '%s\t%s\n' files "{file list}"    >> .hex/ai-audit/runs/{stamp}/scope.tsv
 >
 > `name` and `mode` are the **only two keys a model types**. Everything else is either shell knowledge or read by the assembler for itself: the threshold from the constant, `N` in `seen in k/N runs` from counting run files, the stamp from the directory's own name.
 
-> **No upstream version check.** Upstream compares a local `VERSION` file against pashov/skills on every scan. Hex ships this skill inside `hex-audit`, so `npx hex update` is the upgrade path and the check is removed.
+> **No upstream version check.** Upstream compares a local `VERSION` file against pashov/skills on every scan. Hex ships this skill inside `hex-audit`, so `npx --no-install hex update` is the upgrade path and the check is removed.
 
 **Turn 1b — Model and pass count.** This turn asks **two questions in one `AskUserQuestion` call**: which model the 12 agents use, and how many passes the scan runs. The runner is interrupted once, before any work starts.
 
@@ -279,10 +279,19 @@ Then build `source.md`, run the memory step, and only then cat the bundles — i
    1b. **Differential audit only** (`{mode}` is `diff`) — write the agents' focus brief, once per scan, from the CLI:
 
    ```bash
-   npx hex diff --focus {bundle_dir}/diff-focus.md
+   npx --no-install hex diff --focus {bundle_dir}/diff-focus.md
    ```
 
    It lists the changed entities, the storage-layout changes and the impacted functions with their reason chains, then the in-scope patch, and opens with the rule the agents follow: effort on the change and the flows it reaches; a bug in unchanged code is reported only when the change makes it reachable or worse. Do not write or edit this file by hand.
+
+   1c. **Hex project only** — the auditor's decisions, once per scan, from the CLI:
+
+   ```bash
+   npx --no-install hex invariant export > {bundle_dir}/invariants.md
+   npx --no-install hex rules export > {bundle_dir}/triage-rules.md
+   ```
+
+   Both print nothing when there is nothing to say (no accepted invariants, no rules); delete an empty file rather than appending it, because an empty section sends agents hunting.
 2. **Turn 2 step 2 — Name map, prune and known findings** (below). SKIPPED whole when memory is off. Parts a and b run once per scan; part c runs **every pass**, because the ledger it reads grows as the loop learns.
 3. **Every pass.** Agent bundles, in a single Bash command using `cat` (not shell variables or heredocs) = `source.md` + agent-specific files:
 
@@ -302,9 +311,10 @@ Then build `source.md`, run the memory step, and only then cat the bundles — i
 | `agent-12-bundle.md`  | `source.md` + `senior-auditor-sop.md` + `hacking-agents/flow-gap-agent.md` + `hacking-agents/shared-rules.md`                                  |
 | **every one of the 12** | **+ `report-language.md`, appended after `shared-rules.md`** — unconditional, every mode, every pass. The agent's `description:` is the seed of the report's Description, so the language rule has to reach the writer and not only the editor. |
 | **every one of the 12** | **+ `{bundle_dir}/diff-focus.md`, appended after `report-language.md`** — only in a differential audit (`{mode}` is `diff`). Before the known findings, which stay last. |
+| **every one of the 12** | **+ `{bundle_dir}/invariants.md` and `{bundle_dir}/triage-rules.md`**, after `diff-focus.md` — only when step 1c wrote them. Accepted invariants are properties a finding can break; triage rules are what the auditor already decided not to report. |
 | **every one of the 12** | **+ `{bundle_dir}/known-findings.md`, appended last** — only when memory is on **and** step 2 wrote that file. Never appended on a plain scan, and never appended when the ledger holds no record. |
 
-Each bundle = source.md + SOP + specialty + shared-rules + report-language (+ diff focus, in a differential audit) (+ known findings, when there are any). Agents read the bundle; no Read/Grep needed for the initial scan. Targeted Read/Grep allowed for cross-file investigation.
+Each bundle = source.md + SOP + specialty + shared-rules + report-language (+ diff focus, in a differential audit) (+ invariants and triage rules, in a Hex project that has them) (+ known findings, when there are any). Agents read the bundle; no Read/Grep needed for the initial scan. Targeted Read/Grep allowed for cross-file investigation.
 
 **Turn 2 step 2 — Name map, prune and known findings.** **SKIP this step entirely when memory is off.** It lives in Turn 2 and not in a turn of its own because all three parts read `source.md`, which Turn 2 has just built — a separate turn would only carry that file across a boundary. It is numbered **2**, ahead of the bundle cat, because part c writes a file every bundle carries; a pruned record must never reach an agent.
 
@@ -463,7 +473,7 @@ Then, after the loop body has run `{passes}` times (or stopped early), go to Tur
 
 Follow `{resolved_path}/dedup-and-assembly.md`, section **"Turn 5"**, step by step. Its step 1 is SKIPPED when memory is off; its step 4 runs only when `--file-output` was passed.
 
-**Turn 6 — Publish to the Hex board.** Runs **once per scan**, after Turn 5, at any pass count — a scan that raised nothing publishes nothing and says so. SKIPPED only when there is no `.hex/config.json` (the upstream default mode, outside a Hex project). Read `{resolved_path}/hex-board.md` now, not earlier, and follow it step by step. It is the only turn that writes outside `.hex/ai-audit/`: board cards through `npx hex issue`, leads through `npx hex note lead`, and the raw records in `.hex/ai-results/ai-audit/`. It never edits the report Turn 5 printed.
+**Turn 6 — Publish to the Hex board.** Runs **once per scan**, after Turn 5, at any pass count — a scan that raised nothing publishes nothing and says so. SKIPPED only when there is no `.hex/config.json` (the upstream default mode, outside a Hex project). Read `{resolved_path}/hex-board.md` now, not earlier, and follow it step by step. It is the only turn that writes outside `.hex/ai-audit/`: board cards through `npx --no-install hex issue`, leads through `npx --no-install hex note lead`, and the raw records in `.hex/ai-results/ai-audit/`. It never edits the report Turn 5 printed.
 
 ## Banner
 

package/dist/skills/ai-audit/UPSTREAM.md

@@ -27,12 +27,14 @@ By hand:
 
 - `SKILL.md` — `name: ai-audit` and a Hex description; a "Hex fork" note; Mode Selection gains
   `hex-scope` (files from `.hex/config.json` → `project.scope`) and `diff` (changed + impacted
-  files from `npx hex diff --scan-files`), with upstream's `find` kept as the fallback outside a
+  files from `npx --no-install hex diff --scan-files`), with upstream's `find` kept as the fallback outside a
   Hex project; Turn 1 resolves `{resolved_path}` from the skill's base directory (never a
   `**/references/...` Glob, which matches other copies of this skill) and drops the `VERSION`
-  check against pashov/skills; Turn 2 step 1b writes `diff-focus.md` via `npx hex diff --focus`
+  check against pashov/skills; Turn 2 step 1b writes `diff-focus.md` via `npx --no-install hex diff --focus`
   and the bundle table appends it in a differential audit; the prune does not run in `diff`
   mode; **Turn 6** publishes to the Hex board; a one-line Hex banner replaces the ASCII banner.
+- `SKILL.md` Turn 2 step 1c — accepted invariants (`hex invariant export`) and triage rules
+  (`hex rules list`) are appended to every bundle when the Hex project has them.
 - `references/agent-prompts.md` — a "differential audit" paragraph in both prompt templates,
   included only when `diff-focus.md` is appended.
 - `references/dedup-and-assembly.md` — Turn 4 step 5a: the `key` is built on every scan (memory
@@ -41,6 +43,9 @@ By hand:
   `{dir}/winners.tsv` before the work dir is deleted. The report it writes is unchanged apart
   from the disclaimer.
 - New: `references/hex-export.sh` (winners → `hex-digest.md`) and `references/hex-board.md`
-  (Turn 6: digest → raw records → `hex issue new` cards with dedup; leads → `hex note lead`).
+  (Turn 6: digest → raw records → `hex issue new` cards; triage-rule exclusions; dedup through
+  the shared `hex issue dedup` / `mark-duplicate` engine; leads → `hex note lead`; then
+  `/prevalidate` on the new cards).
+- Every Hex command is `npx --no-install hex …` (an unrelated npm package is named `hex`).
 - Removed: upstream `README.md` and `VERSION` (Hex ships the skill inside `hex-audit`; use
-  `npx hex update`).
+  `npx --no-install hex update`).