kibi-cli 2.32.0 → 2.35.1

package/dist/public/proof-protocol.js

@@ -63,8 +63,11 @@ export const SUCCESS_POLICIES = [
 /**
  * What a proof contract's checker establishes. Runner kinds (e2e, example,
  * property) sample cases and support tested evidence; certificate kinds
- * (exhaustive, typecheck, arithmetic, smt) cover every case and support
- * proved evidence once Kibi re-checks the certificate the run left.
+ * (exhaustive, typecheck, arithmetic, smt, rule, state_machine, regex,
+ * source) cover every case and support proved evidence once Kibi re-checks
+ * the certificate the run left. A source certificate is Kibi's own read of a
+ * project source (a JSON or YAML file, a glob, an OpenAPI document, the
+ * references the code makes, a data schema, a route table, a validator).
  */
 // implements REQ-kibi-code-proof-kinds
 export const PROOF_KINDS = [
@@ -75,18 +78,27 @@ export const PROOF_KINDS = [
     "typecheck",
     "arithmetic",
     "smt",
+    "rule",
+    "state_machine",
+    "regex",
+    "source",
 ];
-// implements REQ-kibi-code-proof-kinds
+// implements REQ-kibi-code-proof-kinds, REQ-kibi-non-numeric-proof-kinds, REQ-kibi-source-proof-kinds
 export const CERTIFICATE_PROOF_KINDS = [
     "exhaustive",
     "typecheck",
     "arithmetic",
     "smt",
+    "rule",
+    "state_machine",
+    "regex",
+    "source",
 ];
 // implements REQ-kibi-code-proof-kinds
 export function isCertificateProofKind(kind) {
     return CERTIFICATE_PROOF_KINDS.includes(kind);
 }
+import { SOURCE_READERS, normalizeSourceSpec, sourceSpecErrors, } from "./proof-sources.js";
 export const PROOF_RESULT_SCHEMA = {
     type: "object",
     description: "One observed proof result. binding distinguishes native-case observations from aggregate-run bindings; attempts must report facts only.",
@@ -215,6 +227,50 @@ export const PROOF_RUN_ARTIFACT_SCHEMA = {
     },
     additionalProperties: false,
 };
+const SOURCE_REFERENCE_SCHEMA = {
+    type: "object",
+    required: ["symbol_id"],
+    properties: {
+        symbol_id: { type: "string", minLength: 1 },
+        export: { type: "string", minLength: 1 },
+    },
+    additionalProperties: false,
+};
+// implements REQ-kibi-source-proof-kinds
+const SOURCE_SPEC_SCHEMA = {
+    type: "object",
+    description: "A project source Kibi reads by itself. reader json or yaml: {file, path?, select?: keys|values|items}. glob: {pattern, capture?, ignore?} (capture true reads what each * matched). openapi: {file, select?: operations|unsecured_operations|security_schemes|responses}. references: {files, extract: env|imports|calls|string_args|thrown|property, callee?, key?, ignore?}. schema: {format: drizzle|prisma|sql, file (drizzle, prisma) or files (sql migrations), exports?, table?, select?: tables|columns|required_columns|nullable_columns|foreign_keys}. routes: {file, export, framework?: hono|express, path_prefix?, names_from?, select?: routes|middleware}. validator: {file, export, select?: fields|required_fields|optional_fields}. Paths are repository-relative. A member Kibi cannot read statically fails the read with its location.",
+    required: ["reader"],
+    properties: {
+        reader: { type: "string", enum: [...SOURCE_READERS] },
+    },
+    additionalProperties: true,
+};
+const SOURCE_DOMAIN_SCHEMA = {
+    type: "object",
+    required: ["source"],
+    properties: { source: SOURCE_SPEC_SCHEMA },
+    additionalProperties: false,
+};
+const PREDICATE_SOURCE_SCHEMA = {
+    type: "object",
+    required: ["symbol_id"],
+    properties: {
+        symbol_id: { type: "string", minLength: 1 },
+        export: {
+            type: "string",
+            minLength: 1,
+            description: "The exported function's name in the symbol's source file. Without it Kibi reads the export named by the symbol's title.",
+        },
+        harness_for: {
+            type: "array",
+            minItems: 1,
+            items: { type: "string", minLength: 1 },
+            description: "The predicate is a test harness that decides the predicate by driving these code symbols (for example by calling the handler with each role). The symbols must be covered_by the test; a claim the harness proves is bound with scope harness.",
+        },
+    },
+    additionalProperties: false,
+};
 export const PROOF_CONTRACT_SCHEMA = {
     type: "object",
     description: "Semantic proof contract binding a test to explicit proof obligations executed by a configured integration.",
@@ -240,11 +296,15 @@ export const PROOF_CONTRACT_SCHEMA = {
         kind: {
             type: "string",
             enum: [...PROOF_KINDS],
-            description: "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic and smt must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved.",
+            description: "What the checker establishes; absent means e2e. exhaustive, typecheck, arithmetic, smt, rule, state_machine and regex must leave a kibi.code-certificate.v1 that Kibi re-checks before the receipt counts as proved. source reads the contract's source itself: the run may leave {version, kind: source, test_id, source} or nothing, and Kibi stores its own read as the certificate.",
+        },
+        source: {
+            ...SOURCE_SPEC_SCHEMA,
+            description: `source: the project source a source proof reads. ${SOURCE_SPEC_SCHEMA.description}`,
         },
         domain_source: {
             type: "object",
-            description: "exhaustive and typecheck: the symbol that defines the finite domain. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.",
+            description: "exhaustive and typecheck: the symbol that defines the finite domain (typecheck: also the type whose fields a required_fields fact names). state_machine: the transition table or next-state function. The proof must import it from its source file; a hand-listed domain downgrades the receipt to example. Kibi reads the export named `export`, or the symbol's title when `export` is absent.",
             required: ["symbol_id"],
             properties: {
                 symbol_id: { type: "string", minLength: 1 },
@@ -265,25 +325,52 @@ export const PROOF_CONTRACT_SCHEMA = {
         },
         proves: {
             type: "array",
-            description: "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt); a claim with no such derivation is only attested and never counts as proved.",
+            description: "Certificate kinds: the requirement claim keys (CLAIM-...) this certificate proves. Each must be a modeled claim of a current requirement the test reaches through its scenarios. Kibi derives what the certificate must establish from the claim's grounding fact (a set fact for exhaustive or typecheck, a numeric fact for arithmetic or smt, a rule, predicate or set fact for rule and state_machine, a string fact for regex); a claim with no such derivation is only attested and never counts as proved.",
             minItems: 1,
             items: { type: "string", pattern: "^CLAIM-" },
             uniqueItems: true,
         },
         value_source: {
             type: "array",
-            description: "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base.",
+            description: "arithmetic and smt: code constants the assumptions read. Kibi evaluates each export at ingest and requires the certificate to assume the variable equals that value, so the proof is about the code and not only the knowledge base. With measure count the value is the size of a list, set, map or object export, so a count claim reads the collection itself. An entry {source, measure: count} counts the members Kibi reads from a project source (routes, tables, environment variables).",
             minItems: 1,
             items: {
                 type: "object",
-                required: ["symbol_id"],
                 properties: {
                     symbol_id: { type: "string", minLength: 1 },
                     export: { type: "string", minLength: 1 },
+                    source: SOURCE_SPEC_SCHEMA,
+                    measure: {
+                        type: "string",
+                        enum: ["value", "count"],
+                        description: "value (default for an export): the export is a number. count (the only measure of a source): the number of members of a list, set, map or object export, or of a source.",
+                    },
                 },
                 additionalProperties: false,
             },
         },
+        predicate_source: {
+            type: "object",
+            description: "rule: the code function behind each predicate a claim's rule, predicate or set fact names, keyed by predicate name. Each export takes the predicate's arguments in order and returns a boolean; Kibi calls it on every combination of its argument domains.",
+            minProperties: 1,
+            additionalProperties: PREDICATE_SOURCE_SCHEMA,
+        },
+        domains: {
+            type: "object",
+            description: "rule: the finite domain of each argument type, keyed by type name (an array, Set, Map or object export, or a Python list, set, dict or Enum), or {source} for the members Kibi reads from a project source (every route, every table, every environment variable). state_machine with a next-state function: the `state` and `event` domains it is called on.",
+            minProperties: 1,
+            additionalProperties: {
+                anyOf: [SOURCE_REFERENCE_SCHEMA, SOURCE_DOMAIN_SCHEMA],
+            },
+        },
+        initial_source: {
+            ...SOURCE_REFERENCE_SCHEMA,
+            description: "state_machine: the export holding the initial state (or states), needed for initial_states and reachable_states facts.",
+        },
+        pattern_source: {
+            ...SOURCE_REFERENCE_SCHEMA,
+            description: "regex: the export holding the code's pattern (a RegExp, or a Python re.Pattern) or string constant that a string fact is about.",
+        },
         constraint_source: {
             type: "object",
             description: "arithmetic and smt: the typed numeric property_value facts the certificate's assumptions come from. Kibi checks the assumptions (or the query's assertions) are exactly these facts' constraints, so the proof is about the knowledge base, not numbers the test chose.",
@@ -591,19 +678,37 @@ function proofContractKindErrors(contract) {
         errors.push(`proof_contract.constraint_source or value_source is required for kind ${String(kind)}: name the typed facts or code constants its assumptions come from`);
     const valueSource = contract.value_source;
     if (valueSource !== undefined) {
+        if (Array.isArray(valueSource))
+            valueSource.forEach((entry, index) => {
+                const row = record(entry);
+                if (row === null || row.source === undefined)
+                    return;
+                errors.push(...sourceSpecErrors(row.source, `proof_contract.value_source[${index}].source`));
+                if (row.symbol_id !== undefined || row.export !== undefined)
+                    errors.push(`proof_contract.value_source[${index}] names a source, so it takes no symbol_id or export`);
+                if (row.measure !== undefined && row.measure !== "count")
+                    errors.push(`proof_contract.value_source[${index}].measure must be count for a source: Kibi counts the members it reads`);
+            });
         if (!Array.isArray(valueSource) ||
             valueSource.length === 0 ||
             !valueSource.every((entry) => {
                 const row = record(entry);
+                if (row !== null && row.source !== undefined)
+                    return true;
                 return (row !== null &&
                     nonEmptyString(row.symbol_id) &&
                     (row.export === undefined || nonEmptyString(row.export)) &&
-                    Object.keys(row).every((key) => key === "symbol_id" || key === "export"));
+                    (row.measure === undefined ||
+                        row.measure === "value" ||
+                        row.measure === "count") &&
+                    Object.keys(row).every((key) => key === "symbol_id" || key === "export" || key === "measure"));
             }))
-            errors.push("proof_contract.value_source must be [{symbol_id, export?}] naming the code constants the assumptions read");
+            errors.push("proof_contract.value_source must be [{symbol_id, export?, measure?: value|count} or {source, measure?: count}] naming the code constants or project sources the assumptions read");
         else if (kind !== "arithmetic" && kind !== "smt")
             errors.push(`proof_contract.value_source applies only to kind arithmetic or smt, not ${String(kind ?? "e2e")}`);
     }
+    errors.push(...nonNumericContractErrors(contract));
+    errors.push(...sourceContractErrors(contract));
     const proves = contract.proves;
     if (proves !== undefined) {
         if (!Array.isArray(proves) ||
@@ -612,8 +717,104 @@ function proofContractKindErrors(contract) {
             new Set(proves).size !== proves.length)
             errors.push("proof_contract.proves must be a non-empty list of distinct claim keys (CLAIM-...) the certificate proves");
         else if (!isCertificateProofKind(kind))
-            errors.push(`proof_contract.proves applies only to certificate kinds (exhaustive, typecheck, arithmetic, smt), not ${String(kind ?? "e2e")}`);
+            errors.push(`proof_contract.proves applies only to certificate kinds (${CERTIFICATE_PROOF_KINDS.join(", ")}), not ${String(kind ?? "e2e")}`);
+    }
+    return errors;
+}
+function isSourceReference(value) {
+    const row = record(value);
+    return (row !== null &&
+        nonEmptyString(row.symbol_id) &&
+        (row.export === undefined || nonEmptyString(row.export)) &&
+        Object.keys(row).every((key) => key === "symbol_id" || key === "export"));
+}
+function isSourceMap(value, accepts = isSourceReference) {
+    const row = record(value);
+    return (row !== null &&
+        Object.keys(row).length > 0 &&
+        Object.entries(row).every(([key, entry]) => key.trim() !== "" && accepts(entry)));
+}
+function isPredicateReference(value) {
+    const row = record(value);
+    if (row === null || row.harness_for === undefined)
+        return isSourceReference(value);
+    const { harness_for: harness, ...reference } = row;
+    return (isSourceReference(reference) &&
+        Array.isArray(harness) &&
+        harness.length > 0 &&
+        harness.every(nonEmptyString));
+}
+function isSourceDomain(value) {
+    const row = record(value);
+    return (row !== null && Object.keys(row).length === 1 && row.source !== undefined);
+}
+/**
+ * The source kind and the source-backed rule domains: a well-formed source
+ * spec, required for kind source and only there.
+ */
+// implements REQ-kibi-source-proof-kinds
+function sourceContractErrors(contract) {
+    const errors = [];
+    const kind = contract.kind;
+    if (contract.source !== undefined) {
+        errors.push(...sourceSpecErrors(contract.source, "proof_contract.source"));
+        if (kind !== "source")
+            errors.push(`proof_contract.source applies only to kind source, not ${String(kind ?? "e2e")}`);
+    }
+    else if (kind === "source")
+        errors.push("proof_contract.source is required for kind source: name the project source Kibi reads (reader json, yaml, glob, openapi, references, schema, routes or validator)");
+    const domains = record(contract.domains);
+    for (const [type, entry] of Object.entries(domains ?? {}))
+        if (isSourceDomain(entry)) {
+            errors.push(...sourceSpecErrors(record(entry)?.source, `proof_contract.domains.${type}.source`));
+            if (kind !== "rule")
+                errors.push(`proof_contract.domains.${type}.source applies only to kind rule: a state machine's domains are the code's`);
+        }
+    return errors;
+}
+/**
+ * The contract fields of the rule, state_machine and regex kinds: where the
+ * code Kibi evaluates lives, and only on the kinds that read it.
+ */
+// implements REQ-kibi-non-numeric-proof-kinds
+function nonNumericContractErrors(contract) {
+    const errors = [];
+    const kind = contract.kind;
+    const only = (field, kinds) => {
+        if (contract[field] !== undefined && !kinds.includes(String(kind)))
+            errors.push(`proof_contract.${field} applies only to kind ${kinds.join(" or ")}, not ${String(kind ?? "e2e")}`);
+    };
+    if (contract.predicate_source !== undefined &&
+        !isSourceMap(contract.predicate_source, isPredicateReference))
+        errors.push("proof_contract.predicate_source must map each predicate name to {symbol_id, export?, harness_for?} naming the function that decides it");
+    if (contract.domains !== undefined &&
+        !isSourceMap(contract.domains, (entry) => isSourceReference(entry) || isSourceDomain(entry)))
+        errors.push("proof_contract.domains must map each argument type to {symbol_id, export?} naming the export that lists its values, or {source} naming the project source Kibi reads them from");
+    for (const field of ["initial_source", "pattern_source"])
+        if (contract[field] !== undefined && !isSourceReference(contract[field]))
+            errors.push(`proof_contract.${field} must be {symbol_id, export?} naming the export Kibi reads`);
+    only("predicate_source", ["rule"]);
+    only("domains", ["rule", "state_machine"]);
+    only("initial_source", ["state_machine"]);
+    only("pattern_source", ["regex"]);
+    if (kind === "rule") {
+        if (contract.predicate_source === undefined)
+            errors.push("proof_contract.predicate_source is required for kind rule: name the function behind each predicate the claims use");
+        if (contract.domains === undefined)
+            errors.push("proof_contract.domains is required for kind rule: name the export listing each argument type's values");
+    }
+    if (kind === "state_machine") {
+        if (contract.domain_source === undefined)
+            errors.push("proof_contract.domain_source is required for kind state_machine: name the transition table or next-state function");
+        const domains = record(contract.domains);
+        if (domains !== null &&
+            (Object.keys(domains).length !== 2 ||
+                domains.state === undefined ||
+                domains.event === undefined))
+            errors.push("proof_contract.domains for kind state_machine must name exactly the state and event domains a next-state function is called on");
     }
+    if (kind === "regex" && contract.pattern_source === undefined)
+        errors.push("proof_contract.pattern_source is required for kind regex: name the export holding the pattern or string");
     return errors;
 }
 /**
@@ -642,15 +843,99 @@ export function optionalProofContractFields(contract) {
     if (Array.isArray(contract.value_source))
         fields.value_source = contract.value_source
             .map((entry) => record(entry))
-            .filter((row) => row !== null && typeof row.symbol_id === "string")
-            .map((row) => ({
-            symbol_id: String(row.symbol_id),
-            ...(typeof row.export === "string" ? { export: row.export } : {}),
-        }));
+            .map((row) => {
+            if (row === null)
+                return null;
+            const spec = normalizeSourceSpec(row.source);
+            if (spec !== undefined)
+                return { source: spec, measure: "count" };
+            if (typeof row.symbol_id !== "string")
+                return null;
+            return {
+                symbol_id: row.symbol_id,
+                ...(typeof row.export === "string" ? { export: row.export } : {}),
+                ...(row.measure === "value" || row.measure === "count"
+                    ? { measure: row.measure }
+                    : {}),
+            };
+        })
+            .filter((row) => row !== null);
     if (Array.isArray(contract.proves))
         fields.proves = contract.proves.filter((key) => typeof key === "string");
+    const predicates = predicateMap(contract.predicate_source);
+    if (predicates !== undefined)
+        fields.predicate_source = predicates;
+    const domains = domainMap(contract.domains);
+    if (domains !== undefined)
+        fields.domains = domains;
+    const spec = normalizeSourceSpec(contract.source);
+    if (spec !== undefined)
+        fields.source = spec;
+    const initial = sourceReference(contract.initial_source);
+    if (initial !== undefined)
+        fields.initial_source = initial;
+    const pattern = sourceReference(contract.pattern_source);
+    if (pattern !== undefined)
+        fields.pattern_source = pattern;
     return fields;
 }
+function predicateMap(value) {
+    const row = record(value);
+    if (!row)
+        return undefined;
+    const out = {};
+    for (const [key, entry] of Object.entries(row)) {
+        const reference = sourceReference(entry);
+        if (reference === undefined)
+            continue;
+        const harness = record(entry)?.harness_for;
+        out[key] = Array.isArray(harness)
+            ? {
+                ...reference,
+                harness_for: harness.filter((id) => typeof id === "string"),
+            }
+            : reference;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function domainMap(value) {
+    const row = record(value);
+    if (!row)
+        return undefined;
+    const out = {};
+    for (const [key, entry] of Object.entries(row)) {
+        const spec = normalizeSourceSpec(record(entry)?.source);
+        if (spec !== undefined) {
+            out[key] = { source: spec };
+            continue;
+        }
+        const reference = sourceReference(entry);
+        if (reference !== undefined)
+            out[key] = reference;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function sourceReference(value) {
+    const row = record(value);
+    if (!row || typeof row.symbol_id !== "string")
+        return undefined;
+    return {
+        symbol_id: row.symbol_id,
+        ...(typeof row.export === "string" ? { export: row.export } : {}),
+    };
+}
+function sourceMap(value) {
+    const row = record(value);
+    if (!row)
+        return undefined;
+    const out = {};
+    for (const [key, entry] of Object.entries(row)) {
+        const reference = sourceReference(entry);
+        if (reference !== undefined)
+            out[key] = reference;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
 export function proofBindingsErrors(value) {
     if (!Array.isArray(value))
         return ["proof_bindings must be an array of binding objects"];

package/dist/public/proof-receipt.d.ts

@@ -200,7 +200,7 @@ export declare const PROOF_RECEIPT_SCHEMA: {
         };
         readonly kind: {
             readonly type: "string";
-            readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt"];
+            readonly enum: readonly ["e2e", "example", "property", "exhaustive", "typecheck", "arithmetic", "smt", "rule", "state_machine", "regex", "source"];
         };
         readonly evidence_level: {
             readonly type: "string";
@@ -242,7 +242,7 @@ export declare const PROOF_RECEIPT_SCHEMA: {
                     };
                     readonly scope: {
                         readonly type: "string";
-                        readonly enum: readonly ["code", "intent"];
+                        readonly enum: readonly ["code", "source", "harness", "intent"];
                     };
                     readonly obligation: {
                         readonly type: "object";
@@ -339,7 +339,8 @@ export type ClaimBinding = Readonly<{
     requirement_id?: string;
     fact_id?: string;
     binding: ClaimBindingVerdict;
-    scope?: "code" | "intent";
+    /** What the proof rests on: evaluated code, project files Kibi read (source), a test harness, or the knowledge base alone (intent). */
+    scope?: "code" | "source" | "harness" | "intent";
     obligation?: Readonly<Record<string, unknown>>;
     reason?: string;
 }>;

package/dist/public/proof-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof-receipt.d.ts","sourceRoot":"","sources":["../../src/public/proof-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;;GAIG;AAEH,eAAO,MAAM,sBAAsB,8CAIzB,CAAC;AAGX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB,8FAQzB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoKvB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,SAAS;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,eAAe,CAAC;QAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EACb;YACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;YAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;gBACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;aAC/B,EAAE,CAAC;SACL,GACD;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;SAAE,CAAC;KACxC,EAAE,CAAC;IACJ,IAAI,CAAC,EAAE,SAAS;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,EAAE,CAAC;IACJ,mDAAmD;IACnD,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,kFAAkF;IAClF,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,cAAc,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEH,4EAA4E;AAE5E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC1B,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAET;AA6ED,sEAAsE;AACtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAsET;AAoDD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GACrD,SAAS,MAAM,EAAE,CAuCnB;AAED,qFAAqF;AACrF,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,QAAQ,CAAC,EAAE,aAAa,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,SAAS,MAAM,EAAE,CAgCnB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAoBrC,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,EACtD,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,SAAS,GAC7D,SAAS,MAAM,EAAE,CAqBnB"}
+{"version":3,"file":"proof-receipt.d.ts","sourceRoot":"","sources":["../../src/public/proof-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,0BAA0B,EAGhC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;;GAIG;AAEH,eAAO,MAAM,sBAAsB,8CAIzB,CAAC;AAGX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB,8FAQzB,CAAC;AAEX,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuKvB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,YAAY,CAAC;IAC7C,OAAO,EAAE,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;IACjD,aAAa,EAAE,SAAS;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,eAAe,CAAC;QAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,EACb;YACE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;YAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS;gBACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;gBACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;aAC/B,EAAE,CAAC;SACL,GACD;YAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;SAAE,CAAC;KACxC,EAAE,CAAC;IACJ,IAAI,CAAC,EAAE,SAAS;QACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,EAAE,CAAC;IACJ,mDAAmD;IACnD,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,kFAAkF;IAClF,cAAc,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,cAAc,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C,CAAC,CAAC;AAEH,4EAA4E;AAE5E,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,mBAAmB,CAAC;IAC7B,uIAAuI;IACvI,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACjD,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAET;AA6ED,sEAAsE;AACtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAsET;AAsDD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GACrD,SAAS,MAAM,EAAE,CAuCnB;AAED,qFAAqF;AACrF,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,iBAAiB,EAAE,OAAO,EAC1B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,QAAQ,CAAC,EAAE,aAAa,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,SAAS,MAAM,EAAE,CAgCnB;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAoBrC,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,EACtD,IAAI,EAAE,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,GAAG,SAAS,GAC7D,SAAS,MAAM,EAAE,CAqBnB"}

package/dist/public/proof-receipt.js

@@ -161,7 +161,10 @@ export const PROOF_RECEIPT_SCHEMA = {
                         type: "string",
                         enum: [...CLAIM_BINDING_VERDICTS],
                     },
-                    scope: { type: "string", enum: ["code", "intent"] },
+                    scope: {
+                        type: "string",
+                        enum: ["code", "source", "harness", "intent"],
+                    },
                     obligation: { type: "object" },
                     reason: { type: "string", minLength: 1 },
                 },
@@ -340,6 +343,8 @@ function validClaimBindings(value) {
             CLAIM_BINDING_VERDICTS.includes(entry.binding) &&
             (entry.scope === undefined ||
                 entry.scope === "code" ||
+                entry.scope === "source" ||
+                entry.scope === "harness" ||
                 entry.scope === "intent") &&
             (entry.obligation === undefined || isRecord(entry.obligation)) &&
             (entry.reason === undefined || nonEmptyString(entry.reason))));

package/dist/public/proof-sources.d.ts

@@ -0,0 +1,102 @@
+export declare const SOURCE_READERS: readonly ["json", "yaml", "glob", "openapi", "references", "schema", "routes", "validator"];
+export type SourceReader = (typeof SOURCE_READERS)[number];
+/** A source spec as a proof contract states it; see sourceSpecErrors. */
+export type SourceSpec = Readonly<Record<string, unknown>> & Readonly<{
+    reader: SourceReader;
+}>;
+/** A column of a table, or a field of a validator object. */
+export type SourceColumn = {
+    name: string;
+    nullable: boolean;
+    optional: boolean;
+};
+/** A table (schema reader) or object (validator reader). */
+export type SourceEntity = {
+    name: string;
+    columns: SourceColumn[];
+    foreign_keys: string[];
+};
+/** One endpoint of a route table and the middleware that runs before it. */
+export type SourceRoute = {
+    method: string;
+    path: string;
+    middleware: string[];
+};
+/**
+ * What Kibi read: the selected members (sorted, unique), and for schema,
+ * validator and routes readers the structure the field and middleware
+ * obligations are decided on.
+ */
+export type SourceModel = {
+    members: string[];
+    entities?: SourceEntity[];
+    routes?: SourceRoute[];
+};
+export type SourceRead = {
+    ok: true;
+    model: SourceModel;
+} | {
+    ok: false;
+    reason: string;
+};
+/** A place in a file Kibi could not read statically. */
+export type UnresolvedReference = Readonly<{
+    file: string;
+    line: number;
+    text: string;
+}>;
+export declare const REFERENCE_EXTRACTS: readonly ["env", "imports", "calls", "string_args", "thrown", "property"];
+/**
+ * Why a source spec is not one Kibi can read, or [] when it is. `label`
+ * names the field in the messages (proof_contract.source, ...).
+ */
+export declare function sourceSpecErrors(value: unknown, label: string): string[];
+/** The spec with only the keys its reader takes, for contract hashing. */
+export declare function normalizeSourceSpec(value: unknown): SourceSpec | undefined;
+/** Workspace-relative files a glob list matches, sorted. */
+export declare function matchWorkspaceFiles(workspaceRoot: string, patterns: readonly string[], ignore?: readonly string[]): string[];
+export type SourceDependency = Readonly<{
+    id: string;
+    hash: string;
+}>;
+/**
+ * What a read of `spec` depends on, so a receipt goes stale when any of it
+ * changes: each file the reader parses (its contents), the set of files a
+ * glob matches (their paths), and for the readers that evaluate a module
+ * (drizzle schemas, route tables, validators) every workspace module that
+ * module imports through relative or tsconfig path imports.
+ */
+export declare function sourceDependencies(workspaceRoot: string, spec: SourceSpec): SourceDependency[];
+/**
+ * The workspace modules `file` imports, directly or not, through relative
+ * imports, the nearest tsconfig's `paths` aliases (following `extends`) and
+ * workspace packages linked into node_modules (packages installed from a
+ * registry are left out: a lockfile change stales nothing here).
+ */
+export declare function importClosure(workspaceRoot: string, file: string): string[];
+/** The entities (tables or validator objects) a spec's table filter selects. */
+export declare function selectedEntities(spec: SourceSpec, model: SourceModel): SourceEntity[];
+/** The routes a spec's path_prefix selects. */
+export declare function selectedRoutes(spec: SourceSpec, routes: SourceRoute[]): SourceRoute[];
+/**
+ * Read `spec` from the workspace. Readers that evaluate code (drizzle
+ * schemas, route tables, validators) and the references reader go through
+ * `evaluate`, which the CLI supplies; a read without it refuses those.
+ */
+export declare function readSource(workspaceRoot: string, spec: SourceSpec, evaluate?: SourceCodeEvaluator): Promise<SourceRead>;
+/** What the CLI's code evaluator returns for a reader that runs code. */
+export type SourceCodeEvaluation = {
+    ok: true;
+    members?: string[];
+    entities?: SourceEntity[];
+    routes?: SourceRoute[];
+} | {
+    ok: false;
+    reason: string;
+};
+export type SourceCodeEvaluator = (workspaceRoot: string, spec: SourceSpec) => Promise<SourceCodeEvaluation>;
+/** A short description of a spec, for messages. */
+export declare function describeSource(spec: SourceSpec): string;
+/** Unresolved references, as one rejection reason naming the first few. */
+export declare function unresolvedReason(what: string, unresolved: readonly UnresolvedReference[]): string;
+//# sourceMappingURL=proof-sources.d.ts.map

package/dist/public/proof-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof-sources.d.ts","sourceRoot":"","sources":["../../src/public/proof-sources.ts"],"names":[],"mappings":"AAwCA,eAAO,MAAM,cAAc,6FASjB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,yEAAyE;AAEzE,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxD,QAAQ,CAAC;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC,CAAC;AAErC,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AAEH,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wDAAwD;AACxD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAAC;AAsBH,eAAO,MAAM,kBAAkB,2EAOrB,CAAC;AAuCX;;;GAGG;AAEH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CA6IxE;AAED,0EAA0E;AAE1E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAS1E;AASD,4DAA4D;AAE5D,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,GAAE,SAAS,MAAM,EAAO,GAC7B,MAAM,EAAE,CAWV;AAgBD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEtE;;;;;;GAMG;AAEH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,UAAU,GACf,gBAAgB,EAAE,CA4EpB;AA2MD;;;;;GAKG;AAEH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB3E;AAkvBD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,WAAW,GACjB,YAAY,EAAE,CAKhB;AAmED,+CAA+C;AAC/C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,WAAW,EAAE,GACpB,WAAW,EAAE,CAWf;AAED;;;;GAIG;AAEH,wBAAsB,UAAU,CAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,UAAU,EAChB,QAAQ,CAAC,EAAE,mBAAmB,GAC7B,OAAO,CAAC,UAAU,CAAC,CA6DrB;AAED,yEAAyE;AACzE,MAAM,MAAM,oBAAoB,GAC5B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,MAAM,MAAM,mBAAmB,GAAG,CAChC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,UAAU,KACb,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAiBvD;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,mBAAmB,EAAE,GACzC,MAAM,CAMR"}