human-to-code 0.0.1 → 0.1.2

package/dist/validation.js

@@ -0,0 +1,388 @@
+/** Strong, container-only validation with baseline comparison. */
+import { spawn } from "node:child_process";
+import { lstat, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { randomUUID } from "node:crypto";
+import { scanSecrets } from "./context.js";
+const MAX_CAPTURE_BYTES = 1024 * 1024;
+const MIN_TIMEOUT_MS = 1_000;
+const MAX_TIMEOUT_MS = 30 * 60_000;
+const IMAGE_ID = /^(?:sha256:)?[a-f0-9]{64}$/u;
+const SHELL_EXECUTABLES = new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "fish",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "powershell.exe",
+    "pwsh",
+    "npx",
+]);
+export class ValidationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ValidationError";
+        this.code = code;
+    }
+}
+function now() {
+    return new Date().toISOString();
+}
+function executableName(value) {
+    return value.replaceAll("\\", "/").split("/").at(-1)?.toLowerCase() ?? "";
+}
+function validateCommand(command) {
+    if (!command.id || !Array.isArray(command.argv) || command.argv.length === 0) {
+        throw new ValidationError("INVALID_COMMAND", "Validation commands require an id and argv.");
+    }
+    if (command.argv.some((part) => typeof part !== "string" || part.length === 0 || part.includes("\0"))) {
+        throw new ValidationError("INVALID_COMMAND", `Validation command ${command.id} has invalid argv.`);
+    }
+    if (SHELL_EXECUTABLES.has(executableName(command.argv[0]))) {
+        throw new ValidationError("SHELL_COMMAND_BLOCKED", `Validation command ${command.id} invokes a shell or implicit downloader.`);
+    }
+    if (!Number.isInteger(command.timeoutMs) ||
+        command.timeoutMs < MIN_TIMEOUT_MS ||
+        command.timeoutMs > MAX_TIMEOUT_MS) {
+        throw new ValidationError("INVALID_TIMEOUT", `Validation command ${command.id} timeout must be between ${MIN_TIMEOUT_MS} and ${MAX_TIMEOUT_MS} ms.`);
+    }
+    if (isAbsolute(command.cwd) || command.cwd.includes("\0")) {
+        throw new ValidationError("INVALID_CWD", `Validation command ${command.id} cwd must be relative.`);
+    }
+}
+function assertDirectory(path, label) {
+    return lstat(path).then((info) => {
+        if (!info.isDirectory() || info.isSymbolicLink()) {
+            throw new ValidationError("INVALID_ROOT", `${label} must be a real directory.`);
+        }
+    });
+}
+function assertCwd(root, cwd) {
+    const abs = resolve(root, cwd || ".");
+    const rel = relative(root, abs);
+    if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new ValidationError("INVALID_CWD", `Validation cwd escapes the snapshot: ${cwd}.`);
+    }
+    return rel === "" ? "." : rel.split(sep).join("/");
+}
+async function runProcess(executable, args, timeoutMs, maxOutputBytes) {
+    const started = Date.now();
+    return new Promise((resolveResult, reject) => {
+        const child = spawn(executable, args, {
+            stdio: ["ignore", "pipe", "pipe"],
+            env: { PATH: process.env.PATH ?? "" },
+            windowsHide: true,
+        });
+        let stdout = Buffer.alloc(0);
+        let stderr = Buffer.alloc(0);
+        let truncated = false;
+        let timedOut = false;
+        const append = (current, chunk) => {
+            if (current.length >= maxOutputBytes) {
+                truncated = true;
+                return current;
+            }
+            const remaining = maxOutputBytes - current.length;
+            if (chunk.length > remaining)
+                truncated = true;
+            return Buffer.concat([current, chunk.subarray(0, remaining)]);
+        };
+        child.stdout?.on("data", (chunk) => {
+            stdout = append(stdout, chunk);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = append(stderr, chunk);
+        });
+        child.once("error", reject);
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGKILL");
+        }, timeoutMs);
+        timer.unref();
+        child.once("close", (code, signal) => {
+            clearTimeout(timer);
+            resolveResult({
+                code,
+                signal,
+                stdout: stdout.toString("utf8"),
+                stderr: stderr.toString("utf8"),
+                timedOut,
+                outputTruncated: truncated,
+                durationMs: Date.now() - started,
+            });
+        });
+    });
+}
+export async function strongSandboxAvailable(dockerBinary = "docker") {
+    try {
+        const result = await runProcess(dockerBinary, ["version", "--format", "{{.Server.Version}}"], 5_000, 16_384);
+        return result.code === 0 && result.stdout.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+function validateImageReference(image) {
+    if (typeof image !== "string" ||
+        image.length === 0 ||
+        image.length > 512 ||
+        image.startsWith("-") ||
+        /[\0\r\n\t ]/u.test(image)) {
+        throw new ValidationError("INVALID_IMAGE", "Sandbox image must be a bounded container image reference without whitespace or option prefixes.");
+    }
+}
+/**
+ * Resolve a trusted image reference to an already-installed immutable id.
+ * Validation never lets Docker/Podman pull an image as a side effect.
+ */
+async function localSandboxRuntime(dockerBinary, image) {
+    validateImageReference(image);
+    let versionResult;
+    let imageResult;
+    try {
+        [versionResult, imageResult] = await Promise.all([
+            runProcess(dockerBinary, ["version", "--format", "{{.Server.Version}}"], 5_000, 16_384),
+            runProcess(dockerBinary, ["image", "inspect", "--format", "{{.Id}}", image], 10_000, 16_384),
+        ]);
+    }
+    catch {
+        return undefined;
+    }
+    const version = versionResult.stdout.trim();
+    const rawId = imageResult.stdout.trim().toLowerCase();
+    if (versionResult.code !== 0 ||
+        version.length === 0 ||
+        imageResult.code !== 0 ||
+        !IMAGE_ID.test(rawId)) {
+        return undefined;
+    }
+    const imageId = rawId.startsWith("sha256:") ? rawId : `sha256:${rawId}`;
+    return { binary: dockerBinary, version, imageId };
+}
+function safeEnvironment(environment) {
+    const args = ["-e", "HOME=/tmp/human-to-code-home", "-e", "CI=1"];
+    for (const [key, value] of Object.entries(environment ?? {}).sort(([a], [b]) => a.localeCompare(b))) {
+        if (!/^[A-Z_][A-Z0-9_]*$/.test(key)) {
+            throw new ValidationError("INVALID_ENV", `Invalid sandbox environment name: ${key}.`);
+        }
+        if (/TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL/i.test(key)) {
+            throw new ValidationError("SECRET_ENV", `Credential-like environment variable is blocked: ${key}.`);
+        }
+        if (value.includes("\0") || value.length > 16_384) {
+            throw new ValidationError("INVALID_ENV", `Invalid sandbox environment value for ${key}.`);
+        }
+        args.push("-e", `${key}=${value}`);
+    }
+    return args;
+}
+async function runInStrongSandbox(rootInput, command, options) {
+    validateCommand(command);
+    const root = resolve(rootInput);
+    await assertDirectory(root, "Validation snapshot");
+    const cwd = assertCwd(root, command.cwd);
+    const cwdInfo = await stat(resolve(root, cwd)).catch(() => undefined);
+    if (!cwdInfo?.isDirectory()) {
+        throw new ValidationError("INVALID_CWD", `Validation cwd does not exist: ${command.cwd}.`);
+    }
+    const name = `human-to-code-${randomUUID()}`;
+    const docker = options.dockerBinary ?? "docker";
+    const args = [
+        "run",
+        "--rm",
+        "--pull",
+        "never",
+        "--name",
+        name,
+        "--network",
+        "none",
+        "--read-only",
+        "--cap-drop",
+        "ALL",
+        "--security-opt",
+        "no-new-privileges",
+        "--pids-limit",
+        String(options.pidsLimit ?? 256),
+        "--memory",
+        options.memory ?? "2g",
+        "--cpus",
+        String(options.cpus ?? 2),
+        "--tmpfs",
+        "/tmp:rw,nosuid,nodev,noexec,size=536870912",
+        "--mount",
+        `type=bind,src=${root},dst=/workspace,rw`,
+        "--workdir",
+        cwd === "." ? "/workspace" : `/workspace/${cwd}`,
+        ...safeEnvironment(options.environment),
+        options.image,
+        ...command.argv,
+    ];
+    const startedAt = now();
+    let result;
+    try {
+        result = await runProcess(docker, args, command.timeoutMs, options.maxOutputBytes ?? MAX_CAPTURE_BYTES);
+    }
+    catch (error) {
+        return {
+            id: command.id,
+            status: "error",
+            exitCode: null,
+            signal: null,
+            durationMs: 0,
+            stdout: "",
+            stderr: String(error),
+            timedOut: false,
+            flaky: false,
+            outputTruncated: false,
+            startedAt,
+            finishedAt: now(),
+        };
+    }
+    if (result.timedOut) {
+        await runProcess(docker, ["rm", "-f", name], 10_000, 32_768).catch(() => undefined);
+    }
+    const secretOutput = scanSecrets(result.stdout).length > 0 || scanSecrets(result.stderr).length > 0;
+    return {
+        id: command.id,
+        status: secretOutput ? "error" : result.code === 0 && !result.timedOut ? "passed" : "failed",
+        exitCode: result.code,
+        signal: result.signal,
+        durationMs: result.durationMs,
+        stdout: secretOutput ? "" : result.stdout,
+        stderr: secretOutput ? "SECURITY_BLOCKED: credential-like validation output was discarded before report persistence." : result.stderr,
+        timedOut: result.timedOut,
+        flaky: false,
+        outputTruncated: result.outputTruncated,
+        startedAt,
+        finishedAt: now(),
+    };
+}
+async function runPlan(root, plan, options, retryFailedOnce) {
+    const results = [];
+    for (const command of plan.commands) {
+        let result = await runInStrongSandbox(root, command, options);
+        if (retryFailedOnce && result.status === "failed") {
+            const retry = await runInStrongSandbox(root, command, options);
+            if (retry.status === "passed")
+                result = { ...retry, flaky: true };
+        }
+        results.push(result);
+    }
+    return results;
+}
+function resultFailed(result) {
+    return result.status !== "passed" || result.flaky || result.outputTruncated;
+}
+export async function validateBaselineAndCandidate(plan, options) {
+    const startedAt = now();
+    if (plan.schemaVersion !== 1 || !Array.isArray(plan.commands) || plan.commands.length === 0) {
+        throw new ValidationError("INVALID_PLAN", "ValidationPlanV1 must contain at least one command.");
+    }
+    for (const command of plan.commands)
+        validateCommand(command);
+    await Promise.all([
+        assertDirectory(resolve(options.baselineRoot), "Baseline snapshot"),
+        assertDirectory(resolve(options.candidateRoot), "Candidate snapshot"),
+    ]);
+    const available = await strongSandboxAvailable(options.dockerBinary);
+    if (!available) {
+        return {
+            schemaVersion: 1,
+            status: "unvalidated",
+            sandbox: "none",
+            baseline: [],
+            candidate: [],
+            repairs: [],
+            manualChecks: plan.manualChecks.map((description) => ({
+                description,
+                status: "pending",
+            })),
+            diagnostics: ["A strong Docker sandbox is unavailable; no project command was executed."],
+            startedAt,
+            finishedAt: now(),
+        };
+    }
+    const dockerBinary = options.dockerBinary ?? "docker";
+    const runtime = await localSandboxRuntime(dockerBinary, options.image);
+    if (!runtime) {
+        return {
+            schemaVersion: 1,
+            status: "unvalidated",
+            sandbox: "none",
+            baseline: [],
+            candidate: [],
+            repairs: [],
+            manualChecks: plan.manualChecks.map((description) => ({
+                description,
+                status: "pending",
+            })),
+            diagnostics: [
+                "The configured validation image is not already installed as a locally inspectable immutable image; no image was pulled and no project command was executed.",
+            ],
+            startedAt,
+            finishedAt: now(),
+        };
+    }
+    const sandboxOptions = {
+        image: runtime.imageId,
+        dockerBinary: runtime.binary,
+        cpus: options.cpus,
+        memory: options.memory,
+        pidsLimit: options.pidsLimit,
+        maxOutputBytes: options.maxOutputBytes,
+        environment: options.environment,
+    };
+    const retry = options.retryFailedOnce ?? true;
+    const baseline = await runPlan(options.baselineRoot, plan, sandboxOptions, retry);
+    const candidate = await runPlan(options.candidateRoot, plan, sandboxOptions, retry);
+    const requiredIds = new Set(plan.commands.filter((command) => command.required).map((command) => command.id));
+    const requiredCandidate = candidate.filter((result) => requiredIds.has(result.id));
+    const baselineFailures = baseline.filter((result) => requiredIds.has(result.id) && resultFailed(result));
+    const candidateFailures = requiredCandidate.filter(resultFailed);
+    const diagnostics = [];
+    diagnostics.push(`Sandbox runtime ${runtime.version}; locally installed image ${runtime.imageId}; image pulling disabled.`);
+    let status;
+    if (candidateFailures.length === 0 && baselineFailures.length === 0) {
+        status = plan.manualChecks.length === 0 ? "validated" : "unvalidated";
+        if (plan.manualChecks.length > 0)
+            diagnostics.push("Manual acceptance checks remain incomplete.");
+    }
+    else if (candidateFailures.length === 0 && baselineFailures.length > 0) {
+        status = "non_regression_only";
+        diagnostics.push("The baseline was unhealthy; candidate checks passed but cannot be certified automatically.");
+    }
+    else {
+        const baselineIds = new Set(baselineFailures.map((result) => result.id));
+        const onlyExisting = candidateFailures.every((result) => baselineIds.has(result.id));
+        status = onlyExisting ? "non_regression_only" : "failed";
+        diagnostics.push(onlyExisting
+            ? "Required failures existed in the baseline and remain; the result is not verified."
+            : "The candidate introduced or retained required validation failures.");
+    }
+    if ([...baseline, ...candidate].some((result) => result.flaky)) {
+        status = "unvalidated";
+        diagnostics.push("At least one validation command was flaky (failed and then passed).");
+    }
+    if ([...baseline, ...candidate].some((result) => result.stderr.startsWith("SECURITY_BLOCKED:"))) {
+        status = "failed";
+        diagnostics.push("SECURITY_BLOCKED: validation emitted credential-like content; captured output was discarded.");
+    }
+    return {
+        schemaVersion: 1,
+        status,
+        sandbox: "strong",
+        baseline,
+        candidate,
+        repairs: [],
+        manualChecks: plan.manualChecks.map((description) => ({
+            description,
+            status: "pending",
+        })),
+        diagnostics,
+        startedAt,
+        finishedAt: now(),
+    };
+}
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,iBAAiB,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAE/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,MAAM;IACN,KAAK;CACN,CAAC,CAAC;AA2BH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,GAAG;IACV,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,eAAe,CAAC,OAA4B;IACnD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,6CAA6C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,eAAe,CAAC,iBAAiB,EAAE,sBAAsB,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CACvB,uBAAuB,EACvB,sBAAsB,OAAO,CAAC,EAAE,0CAA0C,CAC3E,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,OAAO,CAAC,SAAS,GAAG,cAAc;QAClC,OAAO,CAAC,SAAS,GAAG,cAAc,EAClC,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,iBAAiB,EACjB,sBAAsB,OAAO,CAAC,EAAE,4BAA4B,cAAc,QAAQ,cAAc,MAAM,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,sBAAsB,OAAO,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IAClD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,GAAG,KAAK,4BAA4B,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,GAAW;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,wCAAwC,GAAG,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAYD,KAAK,UAAU,UAAU,CACvB,UAAkB,EAClB,IAAc,EACd,SAAiB,EACjB,cAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,OAAO,IAAI,OAAO,CAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACpC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,IAAI,MAAM,GAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,MAAM,GAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,MAAM,GAAG,CACb,OAAgC,EAChC,KAA8B,EACL,EAAE;YAC3B,IAAI,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;gBACrC,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,SAAS,GAAG,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,SAAS,GAAG,IAAI,CAAC;YAC/C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAA8B,EAAE,EAAE;YAC1D,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAA8B,EAAE,EAAE;YAC1D,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE5B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACnC,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,aAAa,CAAC;gBACZ,IAAI;gBACJ,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC/B,QAAQ;gBACR,eAAe,EAAE,SAAS;gBAC1B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;aACjC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAY,GAAG,QAAQ;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAC7B,YAAY,EACZ,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAC9C,KAAK,EACL,MAAM,CACP,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,MAAM,GAAG,GAAG;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,eAAe,CACvB,eAAe,EACf,kGAAkG,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAAoB,EACpB,KAAa;IAEb,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,aAA4B,CAAC;IACjC,IAAI,WAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/C,UAAU,CACR,YAAY,EACZ,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAC9C,KAAK,EACL,MAAM,CACP;YACD,UAAU,CACR,YAAY,EACZ,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,EAClD,MAAM,EACN,MAAM,CACP;SACF,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IACE,aAAa,CAAC,IAAI,KAAK,CAAC;QACxB,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,WAAW,CAAC,IAAI,KAAK,CAAC;QACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,WAA+C;IACtE,MAAM,IAAI,GAAa,CAAC,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,qCAAqC,GAAG,GAAG,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,8DAA8D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,eAAe,CAAC,YAAY,EAAE,oDAAoD,GAAG,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,yCAAyC,GAAG,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,OAA4B,EAC5B,OAA6B;IAE7B,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,eAAe,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,kCAAkC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,UAAU,EAAE,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC;IAChD,MAAM,IAAI,GAAG;QACX,KAAK;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,IAAI;QACJ,WAAW;QACX,MAAM;QACN,aAAa;QACb,YAAY;QACZ,KAAK;QACL,gBAAgB;QAChB,mBAAmB;QACnB,cAAc;QACd,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC;QAChC,UAAU;QACV,OAAO,CAAC,MAAM,IAAI,IAAI;QACtB,QAAQ;QACR,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;QACzB,SAAS;QACT,4CAA4C;QAC5C,SAAS;QACT,iBAAiB,IAAI,oBAAoB;QACzC,WAAW;QACX,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,GAAG,EAAE;QAChD,GAAG,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,OAAO,CAAC,KAAK;QACb,GAAG,OAAO,CAAC,IAAI;KAChB,CAAC;IAEF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CACvB,MAAM,EACN,IAAI,EACJ,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,IAAI,iBAAiB,CAC5C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;YACrB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK;YACZ,eAAe,EAAE,KAAK;YACtB,SAAS;YACT,UAAU,EAAE,GAAG,EAAE;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpG,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;QAC5F,QAAQ,EAAE,MAAM,CAAC,IAAI;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QACzC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,8FAA8F,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;QACrI,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,KAAK;QACZ,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS;QACT,UAAU,EAAE,GAAG,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,IAAsB,EACtB,OAA6B,EAC7B,eAAwB;IAExB,MAAM,OAAO,GAAgC,EAAE,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,MAAiC;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,eAAe,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAsB,EACtB,OAAoC;IAEpC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,eAAe,CAAC,cAAc,EAAE,qDAAqD,CAAC,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,eAAe,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;QACnE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;KACtE,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACpD,WAAW;gBACX,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;YACH,WAAW,EAAE,CAAC,0EAA0E,CAAC;YACzF,SAAS;YACT,UAAU,EAAE,GAAG,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,EAAE;YACb,OAAO,EAAE,EAAE;YACX,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;gBACpD,WAAW;gBACX,MAAM,EAAE,SAAkB;aAC3B,CAAC,CAAC;YACH,WAAW,EAAE;gBACX,6JAA6J;aAC9J;YACD,SAAS;YACT,UAAU,EAAE,GAAG,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAyB;QAC3C,KAAK,EAAE,OAAO,CAAC,OAAO;QACtB,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAEpF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,iBAAiB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACzG,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,WAAW,CAAC,IAAI,CACd,mBAAmB,OAAO,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,2BAA2B,CAC1G,CAAC;IACF,IAAI,MAAoC,CAAC;IAEzC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;QACtE,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACpG,CAAC;SAAM,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,GAAG,qBAAqB,CAAC;QAC/B,WAAW,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;IACjH,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzD,WAAW,CAAC,IAAI,CACd,YAAY;YACV,CAAC,CAAC,mFAAmF;YACrF,CAAC,CAAC,oEAAoE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,aAAa,CAAC;QACvB,WAAW,CAAC,IAAI,CAAC,qEAAqE,CAAE,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,GAAG,QAAQ,EAAE,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,GAAG,QAAQ,CAAC;QAClB,WAAW,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;IACnH,CAAC;IAED,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,MAAM;QACN,OAAO,EAAE,QAAQ;QACjB,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACpD,WAAW;YACX,MAAM,EAAE,SAAkB;SAC3B,CAAC,CAAC;QACH,WAAW;QACX,SAAS;QACT,UAAU,EAAE,GAAG,EAAE;KAClB,CAAC;AACJ,CAAC"}

package/dist/workflow.d.ts

@@ -0,0 +1,65 @@
+/** Auditable generation, isolated validation, and explicit application workflow. */
+import { type ProjectProfileV1 } from "./analyzer.ts";
+import { type ConfigV1 } from "./config.ts";
+import { type ChangeContractV1, type PatchSetV1, type RunStatus, type ValidationPlanV1, type ValidationReportV1 } from "./contracts.ts";
+import { type ContextManifestV1 } from "./context.ts";
+import { type ProviderAdapter } from "./provider.ts";
+import { RunStore } from "./run-store.ts";
+import { validateBaselineAndCandidate } from "./validation.ts";
+export interface ProviderCertificationV1 {
+    matrixKey: string;
+    certified: boolean;
+    reason: string;
+}
+export interface RunCertificationV1 {
+    schemaVersion: 1;
+    supportMatrixVersion: string;
+    provider: ProviderCertificationV1;
+    profileCertified: boolean;
+    certified: boolean;
+    reasons: string[];
+}
+export interface GenerateRunOptions {
+    root: string;
+    profile: ProjectProfileV1;
+    contract: ChangeContractV1;
+    config: ConfigV1;
+    provider: ProviderAdapter;
+    store?: RunStore;
+    offline?: boolean;
+    signal?: AbortSignal;
+}
+export interface WorkflowOutcome {
+    runId: string;
+    status: RunStatus;
+    diagnostics: string[];
+    diff?: string;
+    report?: ValidationReportV1;
+    /** Fixed CLI exit code when the status alone cannot distinguish dependency/partial failures. */
+    exitCode?: number;
+}
+export interface ValidateStoredRunOptions {
+    runId: string;
+    store?: RunStore;
+    sandboxImage?: string;
+    dockerBinary?: string;
+    manualChecksPassed?: boolean;
+    /** Present only for guided validation; standalone validate never guesses credentials. */
+    provider?: ProviderAdapter;
+    /** Must exactly match the configuration persisted during generation. */
+    config?: ConfigV1;
+    signal?: AbortSignal;
+    /** Deterministic test seam; production always uses the strong-sandbox runner. */
+    validationRunner?: typeof validateBaselineAndCandidate;
+}
+/** Resolve per-workspace policy conservatively for one atomic contract. */
+export declare function resolveWorkspaceConfig(config: ConfigV1, profile: ProjectProfileV1, contract: ChangeContractV1): ConfigV1;
+export declare function createValidationPlan(profile: ProjectProfileV1, contract: ChangeContractV1): ValidationPlanV1;
+export declare function buildContextPreview(rootInput: string, profile: ProjectProfileV1, contract: ChangeContractV1, config: ConfigV1, offline?: boolean): Promise<ContextManifestV1>;
+export declare function renderPatchDiff(patch: PatchSetV1): string;
+export declare function generateRun(input: GenerateRunOptions): Promise<WorkflowOutcome>;
+export declare function validateStoredRun(options: ValidateStoredRunOptions): Promise<WorkflowOutcome>;
+export declare function applyVerifiedRun(runId: string, store?: RunStore): Promise<WorkflowOutcome>;
+export declare function rollbackAppliedRun(runId: string, store?: RunStore): Promise<WorkflowOutcome>;
+export declare function rootRelative(root: string, path: string): string;
+//# sourceMappingURL=workflow.d.ts.map

package/dist/workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAMpF,OAAO,EAA0C,KAAK,gBAAgB,EAA2B,MAAM,eAAe,CAAC;AAIvH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,UAAU,EAIf,KAAK,SAAS,EAEd,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAML,KAAK,eAAe,EAGrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAI1C,OAAO,EAA0B,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAEvF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,CAAC,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,uBAAuB,CAAC;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA+BD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,wEAAwE;IACxE,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,OAAO,4BAA4B,CAAC;CACxD;AAMD,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,GACzB,QAAQ,CAwCV;AAiBD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,CAsB5G;AAuND,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,EAAE,QAAQ,EAChB,OAAO,UAA0C,GAChD,OAAO,CAAC,iBAAiB,CAAC,CAsB5B;AAqRD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAoBzD;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoKrF;AAuqBD,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC,CAGnG;AAoJD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,WAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+CtG;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,WAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6CxG;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/D"}