iterate-kernel 0.1.0-draft.1

package/README.md

@@ -0,0 +1,56 @@
+# iterate-kernel
+
+The iterate ecosystem's shared semantic kernel: schemas, the evidence → decision
+transcription, the decision-log audit chain, and public validators.
+
+**What it is not.** It carries no verification reasoning. Judging whether a claim is true
+belongs to the engine that produced the evidence; this package transcribes what that engine
+already decided, so that every shell in the ecosystem speaks the same language instead of
+each inventing its own.
+
+## Install
+
+```bash
+npm install iterate-kernel
+```
+
+## Import per module, not through the barrel
+
+```ts
+import { decisionOutcomeFromEvidence } from "iterate-kernel/evidence-decision"
+import { appendDecisionEntry } from "iterate-kernel/decision-log"
+import { parseEvidencePack } from "iterate-kernel/parse"
+```
+
+Each module is its own subpath export. Importing the barrel (`iterate-kernel`) also pulls
+in `schemas`, which reads the JSON Schema files next to the package at load time — fine in a
+repository, but a runtime file read is a trap for anyone bundling to a single file. The
+subpaths avoid it, and they keep a consumer's dependency on this package as narrow as the
+APIs it actually uses.
+
+## The pieces
+
+| Module | What it is for |
+| --- | --- |
+| `evidence-pack` / `parse` | the evidence pack shape, and parsing/validating one |
+| `evidence-decision` | the **transcription**: evidence (attribution level, circuit-breaker level, pass/fail/inconclusive) → a decision outcome and a human summary. It reads fields the engine already decided; it never infers. |
+| `decision-log-entry` / `decision-log` | the append-only decision-log entry and the `opID ↔ entry` hash chain that makes it auditable |
+| `errors` / `schemas` / `canonical-json` / `recipe-config` | `KernelSchemaError`, the JSON Schemas, canonical serialisation, recipe validation |
+
+## Versioning
+
+`0.1.x` is pre-stable. The schemas and the transcription rules are the contract every
+consumer depends on, so a change to either is a minor-version change at minimum, and the
+fixtures in `fixtures/` are the executable statement of what the contract means.
+
+## Consumers
+
+Vendored or installed, a consumer's kernel is one of two things, and the difference is a
+distribution decision rather than a semantic one:
+
+- **vendored source**, hash-pinned per file, with a probe that asks whether the canonical
+  branch has moved (what the GlassPane Harness fork does), or
+- **this package**, pinned by semver.
+
+Either way, run the fixtures: they are how you find out that the kernel you have is not the
+kernel you think you have.

package/dist/canonical-json.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Canonical JSON serialization — the cross-language form used by the C35
+ * dual-binding gate.
+ *
+ * Rules (identical to `engine/Sources/GlassPaneEngine/CanonicalJSON.swift`,
+ * which is the independent Swift implementation; divergence between the two
+ * shows up as a fixture mismatch, not as a silently different digest):
+ *   - object keys sorted by UTF-16 code unit order;
+ *   - no insignificant whitespace;
+ *   - numbers in the host's shortest roundtrip form (integral values print
+ *     without a fraction on both sides);
+ *   - scalars quoted exactly as `JSON.stringify` does (control chars as
+ *     `\u00xx`, `/` and non-ASCII left raw).
+ *
+ * The decision log hashes this form (see `decision-log.ts`), so the digest of
+ * an entry is reproducible from TypeScript, Swift, or `printf … | sha256sum`
+ * given the same bytes. That property is the point: an audit chain nobody else
+ * can recompute is a claim, not evidence.
+ */
+export declare function canonicalJson(value: unknown): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../src/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD"}

package/dist/canonical-json.js

@@ -0,0 +1,31 @@
+/**
+ * Canonical JSON serialization — the cross-language form used by the C35
+ * dual-binding gate.
+ *
+ * Rules (identical to `engine/Sources/GlassPaneEngine/CanonicalJSON.swift`,
+ * which is the independent Swift implementation; divergence between the two
+ * shows up as a fixture mismatch, not as a silently different digest):
+ *   - object keys sorted by UTF-16 code unit order;
+ *   - no insignificant whitespace;
+ *   - numbers in the host's shortest roundtrip form (integral values print
+ *     without a fraction on both sides);
+ *   - scalars quoted exactly as `JSON.stringify` does (control chars as
+ *     `\u00xx`, `/` and non-ASCII left raw).
+ *
+ * The decision log hashes this form (see `decision-log.ts`), so the digest of
+ * an entry is reproducible from TypeScript, Swift, or `printf … | sha256sum`
+ * given the same bytes. That property is the point: an audit chain nobody else
+ * can recompute is a claim, not evidence.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return "[" + value.map((item) => canonicalJson(item)).join(",") + "]";
+    }
+    const record = value;
+    const keys = Object.keys(record).sort();
+    return "{" + keys.map((key) => JSON.stringify(key) + ":" + canonicalJson(record[key])).join(",") + "}";
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../src/canonical-json.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACzG,CAAC"}

package/dist/decision-log-entry.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+export declare const DECISION_ENTRY_ID_PATTERN: RegExp;
+/** SHA-256 full hex (64 lowercase chars), or the empty string for the genesis entry. */
+export declare const PREV_ENTRY_HASH_PATTERN: RegExp;
+export declare const SUMMARY_MAX_LENGTH = 2048;
+export declare const DecisionOutcomeSchema: z.ZodEnum<["pass", "fail", "blocked", "inconclusive"]>;
+export type DecisionOutcome = z.infer<typeof DecisionOutcomeSchema>;
+export declare const DecisionLogEntrySchema: z.ZodObject<{
+    entryId: z.ZodString;
+    sequence: z.ZodNumber;
+    prevEntryHash: z.ZodString;
+    operationId: z.ZodOptional<z.ZodString>;
+    summary: z.ZodString;
+    outcome: z.ZodEnum<["pass", "fail", "blocked", "inconclusive"]>;
+    createdAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    createdAt: string;
+    entryId: string;
+    sequence: number;
+    prevEntryHash: string;
+    summary: string;
+    outcome: "pass" | "fail" | "blocked" | "inconclusive";
+    operationId?: string | undefined;
+}, {
+    createdAt: string;
+    entryId: string;
+    sequence: number;
+    prevEntryHash: string;
+    summary: string;
+    outcome: "pass" | "fail" | "blocked" | "inconclusive";
+    operationId?: string | undefined;
+}>;
+export type DecisionLogEntry = z.infer<typeof DecisionLogEntrySchema>;
+//# sourceMappingURL=decision-log-entry.d.ts.map

package/dist/decision-log-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-log-entry.d.ts","sourceRoot":"","sources":["../src/decision-log-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,yBAAyB,QAAgC,CAAC;AAEvE,wFAAwF;AACxF,eAAO,MAAM,uBAAuB,QAAsB,CAAC;AAE3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,eAAO,MAAM,qBAAqB,wDAAsD,CAAC;AACzF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAQjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/decision-log-entry.js

@@ -0,0 +1,17 @@
+import { z } from "zod";
+import { ISO_MILLIS_PATTERN, OPERATION_ID_PATTERN } from "./evidence-pack.js";
+export const DECISION_ENTRY_ID_PATTERN = /^dl_[0-9A-HJKMNP-TV-Z]{26}$/;
+/** SHA-256 full hex (64 lowercase chars), or the empty string for the genesis entry. */
+export const PREV_ENTRY_HASH_PATTERN = /^([0-9a-f]{64})?$/;
+export const SUMMARY_MAX_LENGTH = 2048;
+export const DecisionOutcomeSchema = z.enum(["pass", "fail", "blocked", "inconclusive"]);
+export const DecisionLogEntrySchema = z.strictObject({
+    entryId: z.string().regex(DECISION_ENTRY_ID_PATTERN),
+    sequence: z.number().int().min(0),
+    prevEntryHash: z.string().regex(PREV_ENTRY_HASH_PATTERN),
+    operationId: z.string().regex(OPERATION_ID_PATTERN).optional(),
+    summary: z.string().max(SUMMARY_MAX_LENGTH),
+    outcome: DecisionOutcomeSchema,
+    createdAt: z.string().regex(ISO_MILLIS_PATTERN)
+});
+//# sourceMappingURL=decision-log-entry.js.map

package/dist/decision-log-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-log-entry.js","sourceRoot":"","sources":["../src/decision-log-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AAEvE,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAGzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC3C,OAAO,EAAE,qBAAqB;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;CAChD,CAAC,CAAC"}

package/dist/decision-log.d.ts

@@ -0,0 +1,142 @@
+import { type DecisionLogEntry, type DecisionOutcome } from "./decision-log-entry.js";
+/**
+ * The decision log: an append-only JSONL ledger whose entries are linked by
+ * `prevEntryHash` — the opID↔decision one-way audit chain that
+ * `kernel/schemas/decision-log-entry.schema.json` describes at the entry level.
+ *
+ * Chain rule, stated so an auditor can recompute it without reading TypeScript:
+ *
+ *   line i        = canonical JSON of entry i (keys sorted, no whitespace)
+ *   sequence      = i (genesis is 0, strictly +1 — no gaps, no reuse)
+ *   prevEntryHash = "" for i = 0, otherwise sha256_hex(canonical JSON of entry i-1)
+ *
+ * Because a line's bytes *are* the canonical form,
+ * `printf '%s' "$(sed -n '2p' ledger.jsonl)" | sha256sum` reproduces the
+ * `prevEntryHash` that entry 3 must carry. A chain only one language can
+ * recompute is a claim, not evidence.
+ *
+ * The write discipline copies the ledgers this ecosystem already runs
+ * (`ApprovalGate.swift`, `mcp-shell/src/project-registry.ts`) instead of
+ * inventing a third: validate before touching disk, refuse on a corrupt tail
+ * rather than "repairing" it, keep the file 0600 in a directory that is not
+ * group/other-writable, fsync, then read back and verify — and never truncate,
+ * because the ledger's job is to record what happened, including a failed write.
+ */
+export declare const DECISION_LOG_CODES: {
+    readonly path: "KERNEL_E_DECISION_LOG_PATH";
+    readonly corrupt: "KERNEL_E_DECISION_LOG_CORRUPT";
+    readonly chain: "KERNEL_E_DECISION_LOG_CHAIN";
+    readonly location: "KERNEL_E_DECISION_LOG_LOCATION";
+    readonly write: "KERNEL_E_DECISION_LOG_WRITE";
+    readonly draft: "KERNEL_E_DECISION_LOG_DRAFT";
+};
+export type KernelDecisionLogCode = (typeof DECISION_LOG_CODES)[keyof typeof DECISION_LOG_CODES];
+/**
+ * Every failure carries `code` + `message` + `remedy`, the same three-field shape
+ * the engine's error frames use: whoever catches this must be able to act on it
+ * without reading this file.
+ */
+export declare class KernelDecisionLogError extends Error {
+    readonly code: KernelDecisionLogCode;
+    readonly path: string;
+    readonly line?: number;
+    readonly remedy: string;
+    constructor(code: KernelDecisionLogCode, path: string, message: string, remedy: string, line?: number);
+}
+/** What a producer supplies; the chain fields are derived from the ledger itself. */
+export interface DecisionLogDraft {
+    readonly entryId: string;
+    readonly summary: string;
+    readonly outcome: DecisionOutcome;
+    readonly createdAt: string;
+    readonly operationId?: string;
+}
+/**
+ * The draft contract, strict. An unknown key is refused rather than dropped:
+ * a producer that spells a field wrong (`operation_id`) would otherwise lose
+ * that information silently into a ledger whose whole purpose is to say what
+ * was decided and why. `sequence`/`prevEntryHash` are deliberately *not*
+ * accepted here — the ledger owns them (see `appendDecisionLogEntry`).
+ */
+export declare const DecisionLogDraftSchema: import("zod").ZodObject<Omit<{
+    entryId: import("zod").ZodString;
+    sequence: import("zod").ZodNumber;
+    prevEntryHash: import("zod").ZodString;
+    operationId: import("zod").ZodOptional<import("zod").ZodString>;
+    summary: import("zod").ZodString;
+    outcome: import("zod").ZodEnum<["pass", "fail", "blocked", "inconclusive"]>;
+    createdAt: import("zod").ZodString;
+}, "sequence" | "prevEntryHash">, "strict", import("zod").ZodTypeAny, {
+    createdAt: string;
+    entryId: string;
+    summary: string;
+    outcome: "pass" | "fail" | "blocked" | "inconclusive";
+    operationId?: string | undefined;
+}, {
+    createdAt: string;
+    entryId: string;
+    summary: string;
+    outcome: "pass" | "fail" | "blocked" | "inconclusive";
+    operationId?: string | undefined;
+}>;
+export interface AppendedDecisionLogEntry {
+    readonly entry: DecisionLogEntry;
+    /** sha256 of the entry's canonical JSON — what the *next* entry must carry as `prevEntryHash`. */
+    readonly hash: string;
+    /** 1-based line the entry now occupies. */
+    readonly line: number;
+    readonly bytesWritten: number;
+}
+export interface DecisionLogVerification {
+    readonly ok: boolean;
+    readonly entries: readonly DecisionLogEntry[];
+    /** 1-based line of the first problem, when there is one. */
+    readonly firstBrokenLine?: number;
+    /** `corrupt` = bytes that are not a valid entry; `chain` = a valid entry that does not link. */
+    readonly brokenKind?: "corrupt" | "chain";
+    readonly reason?: string;
+}
+/** Canonical JSON of an entry — the exact bytes that are hashed and stored. */
+export declare function serializeDecisionLogEntry(entry: DecisionLogEntry): string;
+/** sha256 over `serializeDecisionLogEntry`, lowercase full hex. */
+export declare function decisionLogEntryHash(entry: DecisionLogEntry): string;
+/**
+ * Crockford-base32 ULID (26 chars; alphabet excludes I/L/O/U) with the `dl_`
+ * prefix the schema requires: 48-bit ms timestamp + 80-bit randomness. Same
+ * shape as the engine's `op_` ids so a reader can sort and compare them.
+ */
+export declare function newDecisionEntryId(timestampMs?: number): string;
+/**
+ * Parse and verify ledger *text* — the pure half, so a reader can verify a string
+ * obtained anywhere (a CI artifact, a pasted excerpt, a Swift-written file).
+ * Never throws: a broken chain is a result, because the auditor's job is to say
+ * where it broke.
+ */
+export declare function verifyDecisionLogText(text: string): DecisionLogVerification;
+/** Read + verify a ledger file. A missing file is an empty chain, not an error. */
+export declare function readDecisionLog(logPath: string): DecisionLogVerification;
+/** The chain fields the next entry must carry, taken from the ledger itself. */
+export declare function decisionLogHead(logPath: string): {
+    sequence: number;
+    prevEntryHash: string;
+};
+/**
+ * Validate a draft plus its chain fields into a strict `DecisionLogEntry`, before
+ * any disk access. `operationId` is omitted rather than written as null, matching
+ * the schema and the engine's Codable binding.
+ */
+export declare function buildDecisionLogEntry(draft: DecisionLogDraft, chain: {
+    sequence: number;
+    prevEntryHash: string;
+}): DecisionLogEntry;
+/**
+ * Append one entry and return what was written. The chain fields come from the
+ * ledger, so a caller cannot choose them.
+ *
+ * Single-writer assumption, stated plainly: concurrent appends from two
+ * processes can interleave. This function does not pretend to solve that — it
+ * detects it (read-back + verify) and reports it, and the next writer refuses to
+ * build on the damaged tail.
+ */
+export declare function appendDecisionLogEntry(logPath: string, draft: DecisionLogDraft): AppendedDecisionLogEntry;
+//# sourceMappingURL=decision-log.d.ts.map

package/dist/decision-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-log.d.ts","sourceRoot":"","sources":["../src/decision-log.ts"],"names":[],"mappings":"AAKA,OAAO,EAA0B,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG9G;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,kBAAkB;;;;;;;CAOrB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAEjG;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGtB,IAAI,EAAE,qBAAqB,EAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM;CAShB;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;EAGjC,CAAC;AAEH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC9C,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,gGAAgG;IAChG,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAEzE;AAED,mEAAmE;AACnE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAEpE;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,GAAE,MAAmB,GAAG,MAAM,CAc3E;AAWD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CA0D3E;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAiBxE;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAgB5F;AAqBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACjD,gBAAgB,CAmClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,gBAAgB,GACtB,wBAAwB,CA0F1B"}

package/dist/decision-log.js

@@ -0,0 +1,288 @@
+import { createHash, randomBytes } from "node:crypto";
+import { closeSync, fchmodSync, fsyncSync, openSync, readFileSync, statSync, writeSync } from "node:fs";
+import { dirname } from "node:path";
+import { canonicalJson } from "./canonical-json.js";
+import { DecisionLogEntrySchema } from "./decision-log-entry.js";
+import { parseDecisionLogEntry } from "./parse.js";
+/**
+ * The decision log: an append-only JSONL ledger whose entries are linked by
+ * `prevEntryHash` — the opID↔decision one-way audit chain that
+ * `kernel/schemas/decision-log-entry.schema.json` describes at the entry level.
+ *
+ * Chain rule, stated so an auditor can recompute it without reading TypeScript:
+ *
+ *   line i        = canonical JSON of entry i (keys sorted, no whitespace)
+ *   sequence      = i (genesis is 0, strictly +1 — no gaps, no reuse)
+ *   prevEntryHash = "" for i = 0, otherwise sha256_hex(canonical JSON of entry i-1)
+ *
+ * Because a line's bytes *are* the canonical form,
+ * `printf '%s' "$(sed -n '2p' ledger.jsonl)" | sha256sum` reproduces the
+ * `prevEntryHash` that entry 3 must carry. A chain only one language can
+ * recompute is a claim, not evidence.
+ *
+ * The write discipline copies the ledgers this ecosystem already runs
+ * (`ApprovalGate.swift`, `mcp-shell/src/project-registry.ts`) instead of
+ * inventing a third: validate before touching disk, refuse on a corrupt tail
+ * rather than "repairing" it, keep the file 0600 in a directory that is not
+ * group/other-writable, fsync, then read back and verify — and never truncate,
+ * because the ledger's job is to record what happened, including a failed write.
+ */
+export const DECISION_LOG_CODES = {
+    path: "KERNEL_E_DECISION_LOG_PATH",
+    corrupt: "KERNEL_E_DECISION_LOG_CORRUPT",
+    chain: "KERNEL_E_DECISION_LOG_CHAIN",
+    location: "KERNEL_E_DECISION_LOG_LOCATION",
+    write: "KERNEL_E_DECISION_LOG_WRITE",
+    draft: "KERNEL_E_DECISION_LOG_DRAFT",
+};
+/**
+ * Every failure carries `code` + `message` + `remedy`, the same three-field shape
+ * the engine's error frames use: whoever catches this must be able to act on it
+ * without reading this file.
+ */
+export class KernelDecisionLogError extends Error {
+    code;
+    path;
+    line;
+    remedy;
+    constructor(code, path, message, remedy, line) {
+        super(`${code}: ${message}`);
+        this.name = "KernelDecisionLogError";
+        this.code = code;
+        this.path = path;
+        this.remedy = remedy;
+        if (line !== undefined)
+            this.line = line;
+    }
+}
+/**
+ * The draft contract, strict. An unknown key is refused rather than dropped:
+ * a producer that spells a field wrong (`operation_id`) would otherwise lose
+ * that information silently into a ledger whose whole purpose is to say what
+ * was decided and why. `sequence`/`prevEntryHash` are deliberately *not*
+ * accepted here — the ledger owns them (see `appendDecisionLogEntry`).
+ */
+export const DecisionLogDraftSchema = DecisionLogEntrySchema.omit({
+    sequence: true,
+    prevEntryHash: true,
+});
+/** Canonical JSON of an entry — the exact bytes that are hashed and stored. */
+export function serializeDecisionLogEntry(entry) {
+    return canonicalJson(entry);
+}
+/** sha256 over `serializeDecisionLogEntry`, lowercase full hex. */
+export function decisionLogEntryHash(entry) {
+    return createHash("sha256").update(serializeDecisionLogEntry(entry), "utf8").digest("hex");
+}
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+/**
+ * Crockford-base32 ULID (26 chars; alphabet excludes I/L/O/U) with the `dl_`
+ * prefix the schema requires: 48-bit ms timestamp + 80-bit randomness. Same
+ * shape as the engine's `op_` ids so a reader can sort and compare them.
+ */
+export function newDecisionEntryId(timestampMs = Date.now()) {
+    if (!Number.isInteger(timestampMs) || timestampMs < 0 || timestampMs > 0xffffffffffff) {
+        throw new RangeError(`entryId timestamp must be an integer in [0, 2^48): got ${timestampMs}`);
+    }
+    let out = "";
+    let value = timestampMs;
+    for (let i = 0; i < 10; i++) {
+        out = CROCKFORD.charAt(value & 0x1f) + out;
+        value = Math.floor(value / 32);
+    }
+    for (const byte of randomBytes(10)) {
+        out += CROCKFORD.charAt((byte & 0xe0) >> 5) + CROCKFORD.charAt(byte & 0x1f);
+    }
+    return `dl_${out.slice(0, 26)}`;
+}
+function broken(entries, kind, line, reason) {
+    return { ok: false, entries, firstBrokenLine: line, brokenKind: kind, reason };
+}
+/**
+ * Parse and verify ledger *text* — the pure half, so a reader can verify a string
+ * obtained anywhere (a CI artifact, a pasted excerpt, a Swift-written file).
+ * Never throws: a broken chain is a result, because the auditor's job is to say
+ * where it broke.
+ */
+export function verifyDecisionLogText(text) {
+    const body = text.endsWith("\n") ? text.slice(0, -1) : text;
+    if (body.length === 0) {
+        return { ok: true, entries: [] };
+    }
+    const lines = body.split("\n");
+    const entries = [];
+    for (let i = 0; i < lines.length; i++) {
+        const lineNumber = i + 1;
+        const raw = lines[i] ?? "";
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (error) {
+            return broken(entries, "corrupt", lineNumber, `line ${lineNumber} is not valid JSON (${error.message})`);
+        }
+        let entry;
+        try {
+            entry = parseDecisionLogEntry(parsed);
+        }
+        catch (error) {
+            return broken(entries, "corrupt", lineNumber, `line ${lineNumber} is not a valid DecisionLogEntry: ${error.message}`);
+        }
+        if (entry.sequence !== i) {
+            return broken(entries, "chain", lineNumber, `line ${lineNumber} declares sequence ${entry.sequence}, expected ${i} (sequences start at 0 and rise by one)`);
+        }
+        if (canonicalJson(entry) !== raw) {
+            return broken(entries, "corrupt", lineNumber, `line ${lineNumber} is not stored in canonical JSON form, so its hash cannot be recomputed from the bytes on disk`);
+        }
+        const previous = i === 0 ? undefined : entries[i - 1];
+        const expectedPrev = previous === undefined ? "" : decisionLogEntryHash(previous);
+        if (entry.prevEntryHash !== expectedPrev) {
+            return broken(entries, "chain", lineNumber, i === 0
+                ? `line 1 is the genesis entry and must carry an empty prevEntryHash, found "${entry.prevEntryHash}"`
+                : `line ${lineNumber} links to ${entry.prevEntryHash}, but the entry on line ${lineNumber - 1} hashes to ${expectedPrev}`);
+        }
+        entries.push(entry);
+    }
+    return { ok: true, entries };
+}
+/** Read + verify a ledger file. A missing file is an empty chain, not an error. */
+export function readDecisionLog(logPath) {
+    requireAbsolutePath(logPath);
+    let text;
+    try {
+        text = readFileSync(logPath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return { ok: true, entries: [] };
+        }
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.location, logPath, `cannot read the ledger (${error.message})`, `fix the permissions or ownership on ${logPath} — this is evidence, so repair access rather than deleting the file`);
+    }
+    return verifyDecisionLogText(text);
+}
+/** The chain fields the next entry must carry, taken from the ledger itself. */
+export function decisionLogHead(logPath) {
+    const verified = readDecisionLog(logPath);
+    if (!verified.ok) {
+        throw new KernelDecisionLogError(verified.brokenKind === "chain" ? DECISION_LOG_CODES.chain : DECISION_LOG_CODES.corrupt, logPath, verified.reason ?? "the ledger is not verifiable", `the ledger stops being trustworthy at line ${verified.firstBrokenLine}; preserve the file and investigate — appending on top of a broken link would forge its continuity`, verified.firstBrokenLine);
+    }
+    const tail = verified.entries[verified.entries.length - 1];
+    return {
+        sequence: verified.entries.length,
+        prevEntryHash: tail === undefined ? "" : decisionLogEntryHash(tail),
+    };
+}
+function requireAbsolutePath(logPath) {
+    if (typeof logPath !== "string" || logPath.length === 0) {
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.path, String(logPath), "the ledger path must be an explicit non-empty string", "pass the resolved absolute path the caller was configured with; this API deliberately has no default location");
+    }
+    if (!logPath.startsWith("/")) {
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.path, logPath, "the ledger path must be absolute", `resolve '${logPath}' against a configured data directory first — a CWD-relative ledger silently lands inside whatever repository the agent happened to run from`);
+    }
+}
+/**
+ * Validate a draft plus its chain fields into a strict `DecisionLogEntry`, before
+ * any disk access. `operationId` is omitted rather than written as null, matching
+ * the schema and the engine's Codable binding.
+ */
+export function buildDecisionLogEntry(draft, chain) {
+    const checked = DecisionLogDraftSchema.safeParse(draft);
+    if (!checked.success) {
+        const detail = checked.error.issues
+            .map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`)
+            .join("; ");
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.draft, "", `refusing to log a decision whose draft is not schema-valid: ${detail}`, "fix the producer — `sequence` and `prevEntryHash` are derived from the ledger and must not be sent, and an unrecognised key means the field name is wrong, not that it is optional");
+    }
+    const candidate = {
+        entryId: checked.data.entryId,
+        sequence: chain.sequence,
+        prevEntryHash: chain.prevEntryHash,
+        summary: checked.data.summary,
+        outcome: checked.data.outcome,
+        createdAt: checked.data.createdAt,
+    };
+    if (checked.data.operationId !== undefined)
+        candidate.operationId = checked.data.operationId;
+    const parsed = DecisionLogEntrySchema.safeParse(candidate);
+    if (!parsed.success) {
+        const detail = parsed.error.issues
+            .map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`)
+            .join("; ");
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.draft, "", `refusing to log a decision that is not schema-valid: ${detail}`, "fix the entry at the producer — a ledger line that fails the schema can never be verified again");
+    }
+    return parsed.data;
+}
+/**
+ * Append one entry and return what was written. The chain fields come from the
+ * ledger, so a caller cannot choose them.
+ *
+ * Single-writer assumption, stated plainly: concurrent appends from two
+ * processes can interleave. This function does not pretend to solve that — it
+ * detects it (read-back + verify) and reports it, and the next writer refuses to
+ * build on the damaged tail.
+ */
+export function appendDecisionLogEntry(logPath, draft) {
+    requireAbsolutePath(logPath);
+    // 1. Read and verify first: refuse to append onto a tail we cannot re-hash.
+    const head = decisionLogHead(logPath);
+    // 2. Validate in memory. Nothing touches the disk if the entry is not valid.
+    const entry = buildDecisionLogEntry(draft, head);
+    // 3. Location hygiene. The ledger is audit data, so it must not be
+    //    group/other-readable, and a group/other-writable *directory* would let
+    //    anyone swap the file out from under the chain.
+    const parent = dirname(logPath);
+    let dirMode;
+    try {
+        dirMode = statSync(parent).mode;
+    }
+    catch {
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.location, logPath, `the ledger's directory ${parent} does not exist`, "create it (0700) or point the ledger at a directory you control; this API will not create state directories behind the caller's back");
+    }
+    if ((dirMode & 0o022) !== 0) {
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.location, logPath, `${parent} is writable by group or other (mode ${(dirMode & 0o777).toString(8)})`, "an audit ledger in a group/other-writable directory can be replaced wholesale; move it, or chmod 0700 the directory");
+    }
+    const line = serializeDecisionLogEntry(entry);
+    const payload = `${line}\n`;
+    const expectedBytes = Buffer.byteLength(payload, "utf8");
+    let fd;
+    try {
+        fd = openSync(logPath, "a", 0o600);
+        fchmodSync(fd, 0o600);
+        const written = writeSync(fd, payload, null, "utf8");
+        fsyncSync(fd);
+        if (written !== expectedBytes) {
+            throw new KernelDecisionLogError(DECISION_LOG_CODES.write, logPath, `short write: ${written} of ${expectedBytes} bytes reached the fd`, `the tail may be torn — do not delete ${logPath}; call readDecisionLog() to see where verification stops, then investigate before producing more decisions`);
+        }
+    }
+    catch (error) {
+        if (error instanceof KernelDecisionLogError)
+            throw error;
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.write, logPath, `append failed: ${error.message}`, `nothing was recorded for ${draft.entryId}; report this as a failed write instead of continuing as if the decision had been logged`);
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+    // 4. Read back and verify. A ledger that lies about having been written is
+    //    worse than one that refuses; so on mismatch we keep the bytes and shout.
+    const after = (readFileSync(logPath, "utf8").match(/^.*$/gm) ?? []).filter((value, index, all) => !(index === all.length - 1 && value === ""));
+    const lineNumber = after.length;
+    const tailLine = after[lineNumber - 1] ?? "";
+    if (tailLine !== line) {
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.write, logPath, `read-back mismatch at line ${lineNumber}: the bytes on disk are not what this call wrote`, `another writer may have interleaved — preserve ${logPath} and re-verify the chain from line ${lineNumber}`, lineNumber);
+    }
+    const verified = verifyDecisionLogText(after.join("\n") + "\n");
+    if (!verified.ok) {
+        throw new KernelDecisionLogError(DECISION_LOG_CODES.write, logPath, `the ledger fails its own verification immediately after a successful append (line ${verified.firstBrokenLine}): ${verified.reason}`, `preserve the file; check the file mode (${modeOf(logPath).toString(8)}) and the raw tail before anything else`, verified.firstBrokenLine);
+    }
+    return { entry, hash: decisionLogEntryHash(entry), line: lineNumber, bytesWritten: expectedBytes };
+}
+function modeOf(path) {
+    try {
+        return statSync(path).mode & 0o777;
+    }
+    catch {
+        return 0;
+    }
+}
+//# sourceMappingURL=decision-log.js.map

package/dist/decision-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision-log.js","sourceRoot":"","sources":["../src/decision-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAA+C,MAAM,yBAAyB,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,4BAA4B;IAClC,OAAO,EAAE,+BAA+B;IACxC,KAAK,EAAE,6BAA6B;IACpC,QAAQ,EAAE,gCAAgC;IAC1C,KAAK,EAAE,6BAA6B;IACpC,KAAK,EAAE,6BAA6B;CAC5B,CAAC;AAIX;;;;GAIG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAAwB;IAC5B,IAAI,CAAS;IACb,IAAI,CAAU;IACd,MAAM,CAAS;IAExB,YACE,IAA2B,EAC3B,IAAY,EACZ,OAAe,EACf,MAAc,EACd,IAAa;QAEb,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3C,CAAC;CACF;AAWD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,sBAAsB,CAAC,IAAI,CAAC;IAChE,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAqBH,+EAA+E;AAC/E,MAAM,UAAU,yBAAyB,CAAC,KAAuB;IAC/D,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,KAAuB;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAsB,IAAI,CAAC,GAAG,EAAE;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,cAAc,EAAE,CAAC;QACtF,MAAM,IAAI,UAAU,CAAC,0DAA0D,WAAW,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAG,WAAW,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAC3C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,MAAM,CACb,OAAoC,EACpC,IAAyB,EACzB,IAAY,EACZ,MAAc;IAEd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,UAAU,uBAAwB,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,KAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,MAAM,CACX,OAAO,EACP,SAAS,EACT,UAAU,EACV,QAAQ,UAAU,qCAAsC,KAAe,CAAC,OAAO,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CACX,OAAO,EACP,OAAO,EACP,UAAU,EACV,QAAQ,UAAU,sBAAsB,KAAK,CAAC,QAAQ,cAAc,CAAC,yCAAyC,CAC/G,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO,MAAM,CACX,OAAO,EACP,SAAS,EACT,UAAU,EACV,QAAQ,UAAU,gGAAgG,CACnH,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YACzC,OAAO,MAAM,CACX,OAAO,EACP,OAAO,EACP,UAAU,EACV,CAAC,KAAK,CAAC;gBACL,CAAC,CAAC,6EAA6E,KAAK,CAAC,aAAa,GAAG;gBACrG,CAAC,CAAC,QAAQ,UAAU,aAAa,KAAK,CAAC,aAAa,2BAA2B,UAAU,GAAG,CAAC,cAAc,YAAY,EAAE,CAC5H,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,QAAQ,EAC3B,OAAO,EACP,2BAA4B,KAAe,CAAC,OAAO,GAAG,EACtD,uCAAuC,OAAO,qEAAqE,CACpH,CAAC;IACJ,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,sBAAsB,CAC9B,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EACvF,OAAO,EACP,QAAQ,CAAC,MAAM,IAAI,8BAA8B,EACjD,8CAA8C,QAAQ,CAAC,eAAe,oGAAoG,EAC1K,QAAQ,CAAC,eAAe,CACzB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;QACjC,aAAa,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,IAAI,EACvB,MAAM,CAAC,OAAO,CAAC,EACf,sDAAsD,EACtD,+GAA+G,CAChH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,IAAI,EACvB,OAAO,EACP,kCAAkC,EAClC,YAAY,OAAO,8IAA8I,CAClK,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAuB,EACvB,KAAkD;IAElD,MAAM,OAAO,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC9F,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,KAAK,EACxB,EAAE,EACF,+DAA+D,MAAM,EAAE,EACvE,oLAAoL,CACrL,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAA4B;QACzC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;QAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;QAC7B,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO;QAC7B,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;KAClC,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS,CAAC,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;IAC7F,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC9F,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,KAAK,EACxB,EAAE,EACF,wDAAwD,MAAM,EAAE,EAChE,iGAAiG,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,KAAuB;IAEvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAE7B,4EAA4E;IAC5E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAEtC,6EAA6E;IAC7E,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAEjD,mEAAmE;IACnE,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,QAAQ,EAC3B,OAAO,EACP,0BAA0B,MAAM,iBAAiB,EACjD,sIAAsI,CACvI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,QAAQ,EAC3B,OAAO,EACP,GAAG,MAAM,wCAAwC,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EACjF,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC;IAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACrD,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC9B,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,KAAK,EACxB,OAAO,EACP,gBAAgB,OAAO,OAAO,aAAa,uBAAuB,EAClE,wCAAwC,OAAO,4GAA4G,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,sBAAsB;YAAE,MAAM,KAAK,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,KAAK,EACxB,OAAO,EACP,kBAAmB,KAAe,CAAC,OAAO,EAAE,EAC5C,4BAA4B,KAAK,CAAC,OAAO,0FAA0F,CACpI,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACxE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC,CACnE,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,KAAK,EACxB,OAAO,EACP,8BAA8B,UAAU,kDAAkD,EAC1F,kDAAkD,OAAO,sCAAsC,UAAU,EAAE,EAC3G,UAAU,CACX,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,sBAAsB,CAC9B,kBAAkB,CAAC,KAAK,EACxB,OAAO,EACP,qFAAqF,QAAQ,CAAC,eAAe,MAAM,QAAQ,CAAC,MAAM,EAAE,EACpI,2CAA2C,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,yCAAyC,EAC/G,QAAQ,CAAC,eAAe,CACzB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}