instar 1.3.490 → 1.3.491

package/dist/monitoring/guardPosture.js

@@ -0,0 +1,198 @@
+/**
+ * guardPosture — the SINGLE shared definition of "what is a guard and what
+ * does the config say about it" (GUARD-POSTURE-ENDPOINT-SPEC §2.1).
+ *
+ * Consumed by BOTH the boot-time GuardPostureTripwire (transition alarms) and
+ * the GET /guards endpoint (steady-state readability). Never re-derive this
+ * extraction elsewhere — the SafeGitExecutor single-funnel lesson: two copies
+ * of "what counts as a guard" WILL drift, and the drifted one is always the
+ * one watching when the next Mini incident happens.
+ *
+ * Also home of resolveGuardConfigSnapshot(): the one-disk-read resolved-config
+ * snapshot the endpoint derives everything from. Disk, not the in-memory
+ * config object, because the original incident (2026-06-05) was an emergency
+ * DIRECT DISK EDIT invisible to in-memory config until restart.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { getInitDefaults } from '../config/ConfigDefaults.js';
+import { resolveDevAgentGate } from '../core/devAgentGate.js';
+import { DEV_GATED_FEATURES, getConfigByPath } from '../core/devGatedFeatures.js';
+/** Posture keys whose false→true transition is COST-INCREASING and must be
+ *  surfaced as loudly as a guard-disable (FABLE-MODEL-ESCALATION-SPEC §10). */
+export const COST_INCREASING_ENABLE_KEYS = new Set([
+    'models.tierEscalation.enabled',
+]);
+/**
+ * Extract the guard posture from a resolved config object.
+ *
+ * Covered surface (generic by design — a future guard is covered the moment
+ * it follows the `monitoring.<key>.enabled` convention, with no change here):
+ *   - `monitoring.<key>.enabled` (boolean) → `monitoring.<key>.enabled`
+ *   - `monitoring.<key>` (plain boolean)   → `monitoring.<key>`
+ *   - `scheduler.enabled` (boolean)        → `scheduler.enabled`
+ *   - `models.tierEscalation.{enabled,dryRun}`
+ */
+export function extractGuardPosture(config) {
+    const posture = {};
+    if (!config || typeof config !== 'object')
+        return posture;
+    const cfg = config;
+    const monitoring = cfg.monitoring;
+    if (monitoring && typeof monitoring === 'object' && !Array.isArray(monitoring)) {
+        for (const [key, value] of Object.entries(monitoring)) {
+            if (typeof value === 'boolean') {
+                posture[`monitoring.${key}`] = value;
+            }
+            else if (value && typeof value === 'object' && !Array.isArray(value)) {
+                const enabled = value.enabled;
+                if (typeof enabled === 'boolean')
+                    posture[`monitoring.${key}.enabled`] = enabled;
+            }
+        }
+    }
+    const scheduler = cfg.scheduler;
+    if (scheduler && typeof scheduler === 'object' && !Array.isArray(scheduler)) {
+        const enabled = scheduler.enabled;
+        if (typeof enabled === 'boolean')
+            posture['scheduler.enabled'] = enabled;
+    }
+    // Model-tier escalation (FABLE-MODEL-ESCALATION-SPEC §10): a COST-INCREASING
+    // enable gets the same visibility as a guard-disable, and a dryRun-off flip
+    // is the moment real swaps start — both are posture.
+    const models = cfg.models;
+    if (models && typeof models === 'object' && !Array.isArray(models)) {
+        const tierEscalation = models.tierEscalation;
+        if (tierEscalation && typeof tierEscalation === 'object' && !Array.isArray(tierEscalation)) {
+            const te = tierEscalation;
+            if (typeof te.enabled === 'boolean')
+                posture['models.tierEscalation.enabled'] = te.enabled;
+            if (typeof te.dryRun === 'boolean')
+                posture['models.tierEscalation.dryRun'] = te.dryRun;
+        }
+    }
+    return posture;
+}
+/**
+ * Diff two postures. Only keys present in BOTH snapshots can transition —
+ * a key appearing for the first time (new feature) or vanishing (config
+ * cleanup) is a shape change, not a guard flip, and raises nothing.
+ */
+export function diffGuardPosture(prev, cur) {
+    const disabled = [];
+    const enabled = [];
+    for (const key of Object.keys(cur).sort()) {
+        if (!(key in prev))
+            continue;
+        if (prev[key] === true && cur[key] === false)
+            disabled.push(key);
+        else if (prev[key] === false && cur[key] === true)
+            enabled.push(key);
+    }
+    return { disabled, enabled };
+}
+export function guardPostureSnapshotPath(stateDir) {
+    return path.join(stateDir, 'state', 'guard-posture.json');
+}
+/** Read the tripwire's boot-time posture snapshot. null = absent/corrupt —
+ *  callers degrade to `divergence: "snapshot-unavailable"`, never invent. */
+export function readGuardPostureBootSnapshot(stateDir) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(guardPostureSnapshotPath(stateDir), 'utf-8'));
+        if (parsed && typeof parsed === 'object' && parsed.posture && typeof parsed.posture === 'object') {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        // @silent-fallback-ok — absent or corrupt snapshot degrades to
+        // snapshot-unavailable honesty downstream; the tripwire repairs the file
+        // at next boot.
+        return null;
+    }
+}
+function deepMergeInto(target, source, depth = 0) {
+    for (const key of Object.keys(source)) {
+        if (depth < 64 &&
+            typeof target[key] === 'object' && target[key] !== null && !Array.isArray(target[key]) &&
+            typeof source[key] === 'object' && source[key] !== null && !Array.isArray(source[key])) {
+            deepMergeInto(target[key], source[key], depth + 1);
+        }
+        else {
+            // Past the sanity depth a subtree is replaced wholesale — a config
+            // nested >64 levels is not a real agent config, and unbounded
+            // recursion on hostile input is a stack-overflow vector.
+            target[key] = structuredClone(source[key]);
+        }
+    }
+}
+function setConfigByPath(config, dottedPath, value) {
+    const keys = dottedPath.split('.');
+    let cur = config;
+    for (const key of keys.slice(0, -1)) {
+        const next = cur[key];
+        if (!next || typeof next !== 'object' || Array.isArray(next)) {
+            cur[key] = {};
+        }
+        cur = cur[key];
+    }
+    cur[keys[keys.length - 1]] = value;
+}
+/**
+ * Read the on-disk agent config ONCE and resolve it the way the server would:
+ * shared defaults (by agent type) + file deep-merged on top + every
+ * DEV_GATED_FEATURES `enabled` resolved via resolveDevAgentGate (their
+ * convention is to OMIT `enabled` and let the gate decide).
+ *
+ * EXACTLY ONE fs read of config.json per call — the endpoint calls this once
+ * per request (Tier-1 pinned), never per guard.
+ */
+export function resolveGuardConfigSnapshot(projectDir, opts) {
+    const configPath = path.join(projectDir, '.instar', 'config.json');
+    let fileRaw = null;
+    let fileAbsent = true;
+    let readError;
+    try {
+        const text = fs.readFileSync(configPath, 'utf-8');
+        fileAbsent = false;
+        const parsed = JSON.parse(text);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            fileRaw = parsed;
+        }
+        else {
+            readError = `config.json parsed to a non-object (${Array.isArray(parsed) ? 'array' : typeof parsed})`;
+        }
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === 'ENOENT') {
+            fileAbsent = true; // defaults-only snapshot — valid, not an error
+        }
+        else {
+            fileAbsent = false;
+            readError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    const agentType = opts?.agentType ??
+        (fileRaw?.agentType === 'standalone' ? 'standalone' : 'managed-project');
+    const defaults = getInitDefaults(agentType);
+    const resolved = structuredClone(defaults);
+    if (fileRaw)
+        deepMergeInto(resolved, fileRaw);
+    // Dev-gated features deliberately omit `enabled` from defaults; the runtime
+    // resolves them via the dev-agent gate. Mirror that here so a dev-gated
+    // guard appears with its gate-resolved value (spec §2.1) — in BOTH the
+    // resolved view and the defaults baseline (the gate IS the default).
+    const gateSource = { developmentAgent: resolved.developmentAgent };
+    for (const feature of DEV_GATED_FEATURES) {
+        const explicit = getConfigByPath(resolved, feature.configPath);
+        const effective = resolveDevAgentGate(typeof explicit === 'boolean' ? explicit : undefined, gateSource);
+        setConfigByPath(resolved, feature.configPath, effective);
+        const explicitDefault = getConfigByPath(defaults, feature.configPath);
+        if (typeof explicitDefault !== 'boolean') {
+            setConfigByPath(defaults, feature.configPath, resolveDevAgentGate(undefined, gateSource));
+        }
+    }
+    return { resolved, defaults, fileAbsent, readError };
+}
+//# sourceMappingURL=guardPosture.js.map

package/dist/monitoring/guardPosture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardPosture.js","sourceRoot":"","sources":["../../src/monitoring/guardPosture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAkB,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAWlF;+EAC+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IACtE,+BAA+B;CAChC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAE9C,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAClC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAqC,CAAC,EAAE,CAAC;YACjF,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,CAAC,cAAc,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;YACvC,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,MAAM,OAAO,GAAI,KAAiC,CAAC,OAAO,CAAC;gBAC3D,IAAI,OAAO,OAAO,KAAK,SAAS;oBAAE,OAAO,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,OAAO,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,IAAI,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAI,SAAqC,CAAC,OAAO,CAAC;QAC/D,IAAI,OAAO,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC;IAC3E,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,cAAc,GAAI,MAAkC,CAAC,cAAc,CAAC;QAC1E,IAAI,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3F,MAAM,EAAE,GAAG,cAAyC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,CAAC,+BAA+B,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;YAC3F,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAkB,EAAE,GAAiB;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAUD,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AAC5D,CAAC;AAED;6EAC6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,EAAE,CAAC,YAAY,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CACjC,CAAC;QAC9B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjG,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,yEAAyE;QACzE,gBAAgB;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAkBD,SAAS,aAAa,CAAC,MAA+B,EAAE,MAA+B,EAAE,KAAK,GAAG,CAAC;IAChG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IACE,KAAK,GAAG,EAAE;YACV,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtF,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EACtF,CAAC;YACD,aAAa,CAAC,MAAM,CAAC,GAAG,CAA4B,EAAE,MAAM,CAAC,GAAG,CAA4B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3G,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,8DAA8D;YAC9D,yDAAyD;YACzD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B,EAAE,UAAkB,EAAE,KAAc;IAC1F,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,GAAG,GAAG,GAAG,CAAC,GAAG,CAA4B,CAAC;IAC5C,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAkB,EAClB,IAAgC;IAEhC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAEnE,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,IAAI,UAAU,GAAG,IAAI,CAAC;IACtB,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,UAAU,GAAG,KAAK,CAAC;QACnB,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,GAAG,MAAiC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,uCAAuC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC;QACxG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAAyC,EAAE,IAAI,CAAC;QAC9D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,UAAU,GAAG,IAAI,CAAC,CAAC,+CAA+C;QACpE,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,KAAK,CAAC;YACnB,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GACb,IAAI,EAAE,SAAS;QACd,CAAC,OAAO,EAAE,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAe,CAAC;IAE1F,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO;QAAE,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE9C,4EAA4E;IAC5E,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,UAAU,GAAG,EAAE,gBAAgB,EAAG,QAA2C,CAAC,gBAAgB,EAAE,CAAC;IACvG,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,mBAAmB,CACnC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EACpD,UAAU,CACX,CAAC;QACF,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,IAAI,OAAO,eAAe,KAAK,SAAS,EAAE,CAAC;YACzC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC"}

package/dist/monitoring/guardPostureView.d.ts

@@ -0,0 +1,100 @@
+/**
+ * guardPostureView — honest effective-state derivation + strict output
+ * projection for GET /guards (GUARD-POSTURE-ENDPOINT-SPEC §2.2).
+ *
+ * Pure logic, no I/O: callers hand in the one-read resolved-config snapshot,
+ * the tripwire's boot posture snapshot, and a GuardRegistry; this module
+ * derives one closed-vocabulary state per guard via the spec's NORMATIVE
+ * PRECEDENCE TABLE (first match wins) and emits ONLY the closed field set —
+ * the route never spreads source config/runtime objects (several guard
+ * config blocks carry operationally sensitive values; getters are untrusted
+ * producers, this projection is the authority).
+ */
+import { type GuardManifestEntry } from './guardManifest.js';
+import { type GuardPostureBootSnapshot, type ResolvedGuardConfigSnapshot } from './guardPosture.js';
+import type { GuardRegistry, GuardRuntimeRead } from './GuardRegistry.js';
+export type GuardEffectiveState = 'on-confirmed' | 'on-unverified' | 'on-stale' | 'on-dry-run' | 'off' | 'diverged-pending-restart' | 'errored' | 'missing' | 'off-runtime-divergent';
+export type GuardOffClass = 'dark-default' | 'diverged-from-default' | null;
+export type GuardDivergence = 'none' | 'diverged' | 'not-applicable' | 'snapshot-unavailable';
+/** Staleness multiplier over a guard's self-declared cadence (spec §2.2, N=5). */
+export declare const STALE_TICK_MULTIPLIER = 5;
+/** The CLOSED projection — every field a /guards row may carry. Anything not
+ *  named here never leaves the server (Tier-1 allowlist test). */
+export interface GuardRuntimeProjection {
+    enabled: boolean;
+    dryRun?: boolean;
+    lastTickAt?: number;
+    tickAgeMs?: number;
+    stale?: boolean;
+    jobCount?: number;
+    pausedJobCount?: number;
+}
+export interface GuardRow {
+    key: string;
+    configEnabled: boolean | null;
+    defaultEnabled: boolean | null;
+    effective: GuardEffectiveState;
+    offClass: GuardOffClass;
+    divergence: GuardDivergence;
+    runtime: GuardRuntimeProjection | null;
+    runtimeReason?: 'not-instrumented' | 'status-error' | 'out-of-process' | 'not-registered';
+    /** Normalized getter-error message (errored state only). */
+    error?: string;
+    process: 'server' | 'lifeline';
+}
+export interface GuardsSummary {
+    onConfirmed: number;
+    onUnverified: number;
+    onStale: number;
+    onDryRun: number;
+    off: number;
+    offDeviant: number;
+    offDarkDefault: number;
+    divergedPendingRestart: number;
+    errored: number;
+    missing: number;
+    offRuntimeDivergent: number;
+    runtimeEnriched: string;
+}
+export interface GuardInventoryResult {
+    guards: GuardRow[];
+    summary: GuardsSummary;
+}
+declare const ROW_FIELD_ALLOWLIST: ReadonlySet<string>;
+declare const RUNTIME_FIELD_ALLOWLIST: ReadonlySet<string>;
+export { ROW_FIELD_ALLOWLIST, RUNTIME_FIELD_ALLOWLIST };
+interface DeriveInput {
+    key: string;
+    manifest: GuardManifestEntry | undefined;
+    configEnabled: boolean | undefined;
+    defaultEnabled: boolean | undefined;
+    configDryRun: boolean | undefined;
+    bootValue: boolean | undefined;
+    bootSnapshotAvailable: boolean;
+    runtime: GuardRuntimeRead;
+    now: number;
+}
+/**
+ * The normative precedence table (spec §2.2) — ONE state per guard, first
+ * match wins:
+ *   errored → missing → off-runtime-divergent → diverged-pending-restart →
+ *   off → on-dry-run → on-stale → on-confirmed → on-unverified
+ */
+export declare function deriveGuardRow(input: DeriveInput): GuardRow;
+/**
+ * Assemble the full inventory: shared extractor (config-derived) ∪ declared
+ * manifest, deduped by key, each row derived through the precedence table.
+ */
+export declare function buildGuardInventory(opts: {
+    snapshot: ResolvedGuardConfigSnapshot;
+    bootSnapshot: GuardPostureBootSnapshot | null;
+    registry: GuardRegistry;
+    now?: number;
+}): GuardInventoryResult;
+/** Compact posture block that rides the capacity heartbeat (spec §2.3).
+ *  The wire shape lives in core/types.ts (GuardPostureSummary) so the
+ *  heartbeat/pool layers don't import from monitoring; this alias keeps the
+ *  spec's name for monitoring-side consumers. */
+export type HeartbeatGuardPosture = import('../core/types.js').GuardPostureSummary;
+export declare function buildHeartbeatPostureBlock(inventory: GuardInventoryResult, generatedAt: string): HeartbeatGuardPosture;
+//# sourceMappingURL=guardPostureView.d.ts.map

package/dist/monitoring/guardPostureView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardPostureView.d.ts","sourceRoot":"","sources":["../../src/monitoring/guardPostureView.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EACjC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,eAAe,GACf,UAAU,GACV,YAAY,GACZ,KAAK,GACL,0BAA0B,GAC1B,SAAS,GACT,SAAS,GACT,uBAAuB,CAAC;AAE5B,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,uBAAuB,GAAG,IAAI,CAAC;AAE5E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;AAE9F,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;kEACkE;AAClE,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,EAAE,aAAa,CAAC;IACxB,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACvC,aAAa,CAAC,EAAE,kBAAkB,GAAG,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;IAC1F,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,QAAQ,GAAG,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,QAAA,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAG3C,CAAC;AACH,QAAA,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAE/C,CAAC;AACH,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC;AAMxD,UAAU,WAAW;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,OAAO,GAAG,SAAS,CAAC;IACpC,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAuI3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,QAAQ,EAAE,2BAA2B,CAAC;IACtC,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC9C,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,oBAAoB,CA2EvB;AAED;;;iDAGiD;AACjD,MAAM,MAAM,qBAAqB,GAAG,OAAO,kBAAkB,EAAE,mBAAmB,CAAC;AAEnF,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,oBAAoB,EAC/B,WAAW,EAAE,MAAM,GAClB,qBAAqB,CAsBvB"}

package/dist/monitoring/guardPostureView.js

@@ -0,0 +1,294 @@
+/**
+ * guardPostureView — honest effective-state derivation + strict output
+ * projection for GET /guards (GUARD-POSTURE-ENDPOINT-SPEC §2.2).
+ *
+ * Pure logic, no I/O: callers hand in the one-read resolved-config snapshot,
+ * the tripwire's boot posture snapshot, and a GuardRegistry; this module
+ * derives one closed-vocabulary state per guard via the spec's NORMATIVE
+ * PRECEDENCE TABLE (first match wins) and emits ONLY the closed field set —
+ * the route never spreads source config/runtime objects (several guard
+ * config blocks carry operationally sensitive values; getters are untrusted
+ * producers, this projection is the authority).
+ */
+import { GUARD_MANIFEST, } from './guardManifest.js';
+import { getConfigByPath } from '../core/devGatedFeatures.js';
+import { extractGuardPosture, } from './guardPosture.js';
+/** Staleness multiplier over a guard's self-declared cadence (spec §2.2, N=5). */
+export const STALE_TICK_MULTIPLIER = 5;
+const ROW_FIELD_ALLOWLIST = new Set([
+    'key', 'configEnabled', 'defaultEnabled', 'effective', 'offClass',
+    'divergence', 'runtime', 'runtimeReason', 'error', 'process',
+]);
+const RUNTIME_FIELD_ALLOWLIST = new Set([
+    'enabled', 'dryRun', 'lastTickAt', 'tickAgeMs', 'stale', 'jobCount', 'pausedJobCount',
+]);
+export { ROW_FIELD_ALLOWLIST, RUNTIME_FIELD_ALLOWLIST };
+function asBool(v) {
+    return typeof v === 'boolean' ? v : undefined;
+}
+/**
+ * The normative precedence table (spec §2.2) — ONE state per guard, first
+ * match wins:
+ *   errored → missing → off-runtime-divergent → diverged-pending-restart →
+ *   off → on-dry-run → on-stale → on-confirmed → on-unverified
+ */
+export function deriveGuardRow(input) {
+    const { key, manifest, runtime, now } = input;
+    const isCodeDefault = manifest?.kind === 'code-default';
+    const configEnabled = input.configEnabled ?? (isCodeDefault ? manifest.defaultEnabled : undefined);
+    const defaultEnabled = input.defaultEnabled ?? manifest?.defaultEnabled;
+    const process = manifest?.process ?? 'server';
+    // ── Disk-vs-boot divergence classification (input to two states below) ──
+    let divergence;
+    if (isCodeDefault) {
+        divergence = 'not-applicable';
+    }
+    else if (manifest?.liveConfig) {
+        // Component re-reads config per use — a disk change is already live, the
+        // diverged-pending-restart state would lie in the false-positive direction.
+        divergence = 'none';
+    }
+    else if (!input.bootSnapshotAvailable || input.bootValue === undefined) {
+        // Absent snapshot or older-inventory snapshot (key missing): suppressed
+        // AND flagged — degraded honestly, never silently clean.
+        divergence = 'snapshot-unavailable';
+    }
+    else if (configEnabled !== undefined && input.bootValue !== configEnabled) {
+        divergence = 'diverged';
+    }
+    else {
+        divergence = 'none';
+    }
+    // Runtime projection (closed fields only).
+    let runtimeProjection = null;
+    let runtimeReason;
+    let error;
+    if (process === 'lifeline') {
+        // Out-of-process guards are config-derived ONLY (spec §2.1): the sync
+        // in-memory getter contract cannot cross processes.
+        runtimeReason = 'out-of-process';
+    }
+    else if (runtime.kind === 'ok') {
+        const s = runtime.status;
+        runtimeProjection = { enabled: s.enabled };
+        if (typeof s.dryRun === 'boolean')
+            runtimeProjection.dryRun = s.dryRun;
+        if (typeof s.lastTickAt === 'number') {
+            runtimeProjection.lastTickAt = s.lastTickAt;
+            if (s.lastTickAt > 0)
+                runtimeProjection.tickAgeMs = Math.max(0, now - s.lastTickAt);
+        }
+        if (typeof s.jobCount === 'number')
+            runtimeProjection.jobCount = s.jobCount;
+        if (typeof s.pausedJobCount === 'number')
+            runtimeProjection.pausedJobCount = s.pausedJobCount;
+    }
+    else if (runtime.kind === 'error') {
+        runtimeReason = 'status-error';
+        error = runtime.message;
+    }
+    else {
+        runtimeReason = manifest?.expectRuntime ? 'not-registered' : 'not-instrumented';
+    }
+    // Staleness only applies where the guard self-declares a cadence.
+    let stale = false;
+    if (runtime.kind === 'ok' &&
+        runtime.status.enabled &&
+        manifest?.expectedTickMs !== undefined) {
+        const lastTickAt = runtime.status.lastTickAt;
+        if (!lastTickAt || lastTickAt <= 0) {
+            stale = true; // constructed-but-never-ticking reports stale, never "on"
+        }
+        else if (now - lastTickAt > STALE_TICK_MULTIPLIER * manifest.expectedTickMs) {
+            stale = true;
+        }
+    }
+    if (runtimeProjection && manifest?.expectedTickMs !== undefined && runtime.kind === 'ok' && runtime.status.enabled) {
+        runtimeProjection.stale = stale;
+    }
+    const dryRun = (runtime.kind === 'ok' ? asBool(runtime.status.dryRun) : undefined) ?? input.configDryRun ?? false;
+    // ── Precedence table — first match wins ──
+    let effective;
+    let offClass = null;
+    const diskDivergenceDetected = divergence === 'diverged';
+    const noDetectedDiskDivergence = !diskDivergenceDetected; // snapshot-unavailable counts as none
+    if (runtime.kind === 'error') {
+        effective = 'errored';
+    }
+    else if (manifest?.expectRuntime === true &&
+        process === 'server' &&
+        configEnabled === true &&
+        runtime.kind === 'unregistered' &&
+        input.bootValue !== false) {
+        // Declared for this host, config says on, but no runtime registered at
+        // boot (crash-before-register / unconfigured adapter): a STATE, never a
+        // silent omission. The `bootValue !== false` clause keeps this honest: a
+        // guard that was OFF at boot and flipped on-disk since was never expected
+        // to construct — that case falls through to diverged-pending-restart,
+        // which describes it truthfully (missing would be a false crash alarm).
+        effective = 'missing';
+    }
+    else if (configEnabled === true &&
+        runtime.kind === 'ok' &&
+        runtime.status.enabled === false &&
+        noDetectedDiskDivergence) {
+        // The in-memory load-shed class: config says ON, disk matches boot, but
+        // the live runtime self-reports off — the strongest "the config is lying
+        // to you" signal; never folds into on-unverified.
+        effective = 'off-runtime-divergent';
+    }
+    else if (diskDivergenceDetected) {
+        effective = 'diverged-pending-restart';
+    }
+    else if (configEnabled === false) {
+        effective = 'off';
+        offClass = defaultEnabled === false ? 'dark-default' : 'diverged-from-default';
+    }
+    else if (dryRun && configEnabled === true) {
+        effective = 'on-dry-run'; // watching but toothless; stale stays visible in the runtime block
+    }
+    else if (stale) {
+        effective = 'on-stale';
+    }
+    else if (runtime.kind === 'ok' && runtime.status.enabled) {
+        effective = 'on-confirmed';
+    }
+    else {
+        // Config on, no live runtime surface. NEVER counted or rendered as
+        // confirmed-on — a guard that crashed mid-init lands here, and painting
+        // it green is the Mini bug with extra steps.
+        effective = 'on-unverified';
+    }
+    const row = {
+        key,
+        configEnabled: configEnabled ?? null,
+        defaultEnabled: defaultEnabled ?? null,
+        effective,
+        offClass,
+        divergence,
+        runtime: runtimeProjection,
+        process,
+    };
+    if (runtimeReason)
+        row.runtimeReason = runtimeReason;
+    if (error)
+        row.error = error;
+    return row;
+}
+/**
+ * Assemble the full inventory: shared extractor (config-derived) ∪ declared
+ * manifest, deduped by key, each row derived through the precedence table.
+ */
+export function buildGuardInventory(opts) {
+    const now = opts.now ?? Date.now();
+    const extractedCurrent = extractGuardPosture(opts.snapshot.resolved);
+    const extractedDefaults = extractGuardPosture(opts.snapshot.defaults);
+    const manifestMap = new Map();
+    for (const entry of GUARD_MANIFEST)
+        manifestMap.set(entry.key, entry);
+    const keys = [...new Set([...Object.keys(extractedCurrent), ...manifestMap.keys()])].sort();
+    const guards = [];
+    for (const key of keys) {
+        const manifest = manifestMap.get(key);
+        let configEnabled = asBool(extractedCurrent[key]);
+        let defaultEnabled = asBool(extractedDefaults[key]);
+        if (configEnabled === undefined && manifest?.configPath) {
+            configEnabled = asBool(getConfigByPath(opts.snapshot.resolved, manifest.configPath));
+        }
+        if (defaultEnabled === undefined && manifest?.configPath) {
+            defaultEnabled = asBool(getConfigByPath(opts.snapshot.defaults, manifest.configPath));
+        }
+        if (defaultEnabled === undefined && manifest)
+            defaultEnabled = manifest.defaultEnabled;
+        // The resolved snapshot normally contains every default key (defaults are
+        // merged in), but a degraded/partial snapshot must still yield the
+        // default-resolved state — a guard can never drop out of the inventory.
+        if (configEnabled === undefined)
+            configEnabled = defaultEnabled;
+        const configDryRun = manifest?.dryRunConfigPath
+            ? asBool(getConfigByPath(opts.snapshot.resolved, manifest.dryRunConfigPath))
+            : undefined;
+        const bootPosture = opts.bootSnapshot?.posture;
+        guards.push(deriveGuardRow({
+            key,
+            manifest,
+            configEnabled,
+            defaultEnabled,
+            configDryRun,
+            bootValue: bootPosture ? asBool(bootPosture[key]) : undefined,
+            bootSnapshotAvailable: !!bootPosture,
+            runtime: opts.registry.read(key),
+            now,
+        }));
+    }
+    const summary = {
+        onConfirmed: 0, onUnverified: 0, onStale: 0, onDryRun: 0,
+        off: 0, offDeviant: 0, offDarkDefault: 0,
+        divergedPendingRestart: 0, errored: 0, missing: 0, offRuntimeDivergent: 0,
+        runtimeEnriched: '',
+    };
+    let enriched = 0;
+    for (const g of guards) {
+        if (g.runtime)
+            enriched++;
+        switch (g.effective) {
+            case 'on-confirmed':
+                summary.onConfirmed++;
+                break;
+            case 'on-unverified':
+                summary.onUnverified++;
+                break;
+            case 'on-stale':
+                summary.onStale++;
+                break;
+            case 'on-dry-run':
+                summary.onDryRun++;
+                break;
+            case 'off':
+                summary.off++;
+                if (g.offClass === 'diverged-from-default')
+                    summary.offDeviant++;
+                else
+                    summary.offDarkDefault++;
+                break;
+            case 'diverged-pending-restart':
+                summary.divergedPendingRestart++;
+                break;
+            case 'errored':
+                summary.errored++;
+                break;
+            case 'missing':
+                summary.missing++;
+                break;
+            case 'off-runtime-divergent':
+                summary.offRuntimeDivergent++;
+                break;
+        }
+    }
+    summary.runtimeEnriched = `${enriched}/${guards.length}`;
+    return { guards, summary };
+}
+export function buildHeartbeatPostureBlock(inventory, generatedAt) {
+    const offDeviantKeys = inventory.guards
+        .filter(g => g.effective === 'off' && g.offClass === 'diverged-from-default')
+        .map(g => g.key);
+    const offRuntimeDivergentKeys = inventory.guards
+        .filter(g => g.effective === 'off-runtime-divergent')
+        .map(g => g.key);
+    const s = inventory.summary;
+    return {
+        onConfirmed: s.onConfirmed,
+        onUnverified: s.onUnverified,
+        onStale: s.onStale,
+        onDryRun: s.onDryRun,
+        offDeviant: s.offDeviant,
+        offDeviantKeys,
+        offRuntimeDivergent: s.offRuntimeDivergent,
+        offRuntimeDivergentKeys,
+        divergedPendingRestart: s.divergedPendingRestart,
+        errored: s.errored,
+        missing: s.missing,
+        generatedAt,
+    };
+}
+//# sourceMappingURL=guardPostureView.js.map

package/dist/monitoring/guardPostureView.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardPostureView.js","sourceRoot":"","sources":["../../src/monitoring/guardPostureView.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,mBAAmB,GAGpB,MAAM,mBAAmB,CAAC;AAkB3B,kFAAkF;AAClF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAgDvC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACvD,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU;IACjE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS;CAC7D,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB;CACtF,CAAC,CAAC;AACH,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,CAAC;AAExD,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAcD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,aAAa,GAAG,QAAQ,EAAE,IAAI,KAAK,cAAc,CAAC;IACxD,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAS,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,QAAQ,EAAE,cAAc,CAAC;IACxE,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,QAAQ,CAAC;IAE9C,2EAA2E;IAC3E,IAAI,UAA2B,CAAC;IAChC,IAAI,aAAa,EAAE,CAAC;QAClB,UAAU,GAAG,gBAAgB,CAAC;IAChC,CAAC;SAAM,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;QAChC,yEAAyE;QACzE,4EAA4E;QAC5E,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,UAAU,GAAG,sBAAsB,CAAC;IACtC,CAAC;SAAM,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;QAC5E,UAAU,GAAG,UAAU,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;IAED,2CAA2C;IAC3C,IAAI,iBAAiB,GAAkC,IAAI,CAAC;IAC5D,IAAI,aAAwC,CAAC;IAC7C,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,sEAAsE;QACtE,oDAAoD;QACpD,aAAa,GAAG,gBAAgB,CAAC;IACnC,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QACzB,iBAAiB,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACvE,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACrC,iBAAiB,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YAC5C,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;gBAAE,iBAAiB,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,iBAAiB,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC5E,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;YAAE,iBAAiB,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;IAChG,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACpC,aAAa,GAAG,cAAc,CAAC;QAC/B,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAClF,CAAC;IAED,kEAAkE;IAClE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IACE,OAAO,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,CAAC,MAAM,CAAC,OAAO;QACtB,QAAQ,EAAE,cAAc,KAAK,SAAS,EACtC,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YACnC,KAAK,GAAG,IAAI,CAAC,CAAC,0DAA0D;QAC1E,CAAC;aAAM,IAAI,GAAG,GAAG,UAAU,GAAG,qBAAqB,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC9E,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,iBAAiB,IAAI,QAAQ,EAAE,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACnH,iBAAiB,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GACV,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC;IAErG,4CAA4C;IAC5C,IAAI,SAA8B,CAAC;IACnC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAEnC,MAAM,sBAAsB,GAAG,UAAU,KAAK,UAAU,CAAC;IACzD,MAAM,wBAAwB,GAAG,CAAC,sBAAsB,CAAC,CAAC,sCAAsC;IAEhG,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,SAAS,GAAG,SAAS,CAAC;IACxB,CAAC;SAAM,IACL,QAAQ,EAAE,aAAa,KAAK,IAAI;QAChC,OAAO,KAAK,QAAQ;QACpB,aAAa,KAAK,IAAI;QACtB,OAAO,CAAC,IAAI,KAAK,cAAc;QAC/B,KAAK,CAAC,SAAS,KAAK,KAAK,EACzB,CAAC;QACD,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,wEAAwE;QACxE,SAAS,GAAG,SAAS,CAAC;IACxB,CAAC;SAAM,IACL,aAAa,KAAK,IAAI;QACtB,OAAO,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK;QAChC,wBAAwB,EACxB,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,kDAAkD;QAClD,SAAS,GAAG,uBAAuB,CAAC;IACtC,CAAC;SAAM,IAAI,sBAAsB,EAAE,CAAC;QAClC,SAAS,GAAG,0BAA0B,CAAC;IACzC,CAAC;SAAM,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;QACnC,SAAS,GAAG,KAAK,CAAC;QAClB,QAAQ,GAAG,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,uBAAuB,CAAC;IACjF,CAAC;SAAM,IAAI,MAAM,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC5C,SAAS,GAAG,YAAY,CAAC,CAAC,mEAAmE;IAC/F,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,SAAS,GAAG,UAAU,CAAC;IACzB,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC3D,SAAS,GAAG,cAAc,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,wEAAwE;QACxE,6CAA6C;QAC7C,SAAS,GAAG,eAAe,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAa;QACpB,GAAG;QACH,aAAa,EAAE,aAAa,IAAI,IAAI;QACpC,cAAc,EAAE,cAAc,IAAI,IAAI;QACtC,SAAS;QACT,QAAQ;QACR,UAAU;QACV,OAAO,EAAE,iBAAiB;QAC1B,OAAO;KACR,CAAC;IACF,IAAI,aAAa;QAAE,GAAG,CAAC,aAAa,GAAG,aAAa,CAAC;IACrD,IAAI,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,cAAc;QAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE5F,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtC,IAAI,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,cAAc,GAAG,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,IAAI,aAAa,KAAK,SAAS,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;YACxD,aAAa,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,cAAc,KAAK,SAAS,IAAI,QAAQ,EAAE,UAAU,EAAE,CAAC;YACzD,cAAc,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,cAAc,KAAK,SAAS,IAAI,QAAQ;YAAE,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;QACvF,0EAA0E;QAC1E,mEAAmE;QACnE,wEAAwE;QACxE,IAAI,aAAa,KAAK,SAAS;YAAE,aAAa,GAAG,cAAc,CAAC;QAEhE,MAAM,YAAY,GAAG,QAAQ,EAAE,gBAAgB;YAC7C,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAC5E,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;QAC/C,MAAM,CAAC,IAAI,CACT,cAAc,CAAC;YACb,GAAG;YACH,QAAQ;YACR,aAAa;YACb,cAAc;YACd,YAAY;YACZ,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,qBAAqB,EAAE,CAAC,CAAC,WAAW;YACpC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAChC,GAAG;SACJ,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;QACxD,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;QACxC,sBAAsB,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC;QACzE,eAAe,EAAE,EAAE;KACpB,CAAC;IACF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,OAAO;YAAE,QAAQ,EAAE,CAAC;QAC1B,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,cAAc;gBAAE,OAAO,CAAC,WAAW,EAAE,CAAC;gBAAC,MAAM;YAClD,KAAK,eAAe;gBAAE,OAAO,CAAC,YAAY,EAAE,CAAC;gBAAC,MAAM;YACpD,KAAK,UAAU;gBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YAC1C,KAAK,YAAY;gBAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAAC,MAAM;YAC7C,KAAK,KAAK;gBACR,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,IAAI,CAAC,CAAC,QAAQ,KAAK,uBAAuB;oBAAE,OAAO,CAAC,UAAU,EAAE,CAAC;;oBAC5D,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC9B,MAAM;YACR,KAAK,0BAA0B;gBAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAAC,MAAM;YACzE,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YACzC,KAAK,SAAS;gBAAE,OAAO,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM;YACzC,KAAK,uBAAuB;gBAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAAC,MAAM;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,eAAe,GAAG,GAAG,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;IAEzD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAQD,MAAM,UAAU,0BAA0B,CACxC,SAA+B,EAC/B,WAAmB;IAEnB,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,uBAAuB,CAAC;SAC5E,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,uBAAuB,GAAG,SAAS,CAAC,MAAM;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,uBAAuB,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;IAC5B,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,cAAc;QACd,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,uBAAuB;QACvB,sBAAsB,EAAE,CAAC,CAAC,sBAAsB;QAChD,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,WAAW;KACZ,CAAC;AACJ,CAAC"}