limen-ai 1.0.0

package/dist/api/chat/technique_injector.d.ts

@@ -0,0 +1,86 @@
+/**
+ * TGP ↔ Pipeline Wire: Technique Injection into System Prompt
+ * Phase 2B: Active prompt_fragment techniques injected at inference time.
+ *
+ * S ref: §31 (technique application), I-54 (overhead boundary), I-96 (candidate exclusion),
+ *        I-94 (content immutability), I-07 (agent isolation), I-63 (audit payload)
+ *
+ * This module:
+ *   1. Queries active prompt_fragment techniques for the executing agent (I-96)
+ *   2. Applies confidence-descending ordering with 20% window truncation (§31)
+ *   3. Assembles technique content into a system prompt section (I-94: verbatim)
+ *   4. Computes technique token cost for systemOverhead (I-54)
+ *   5. Records injection details for audit transparency (I-63)
+ *
+ * Invariants enforced:
+ *   I-96: Only status='active' techniques participate. Candidates, suspended, retired excluded.
+ *   I-94: Technique content inserted verbatim. No transformation.
+ *   I-07: Techniques scoped to executing agent's agentId.
+ *   I-54: Technique token cost is part of systemOverhead, NOT CGP position 1.
+ *   §31:  prompt_fragment type only. Ordered by confidence descending.
+ *         Truncated to 20% of model context window.
+ *
+ * Failure mode:
+ *   TGP failure = empty technique set + trace event. Graceful degradation.
+ *   The model operates without learned techniques. Safe because techniques
+ *   are supplementary optimization, not governance-critical.
+ */
+import type { DatabaseConnection, AgentId, TenantId, Result } from '../../kernel/interfaces/index.js';
+import type { Technique, TechniqueId } from '../../learning/interfaces/index.js';
+/**
+ * Minimal interface for querying active prompt fragments.
+ * Matches TechniqueApplicator.getActivePromptFragments signature.
+ * Injected as a dependency — pipeline never imports TechniqueApplicator directly.
+ */
+export interface TechniqueReader {
+    getActivePromptFragments(conn: DatabaseConnection, agentId: AgentId, tenantId: TenantId, maxTokenBudget: number): Result<readonly Technique[]>;
+}
+/**
+ * Result of technique injection — everything the pipeline needs.
+ */
+export interface TechniqueInjectionResult {
+    /** System prompt section containing injected technique content (empty string if none) */
+    readonly systemPromptSection: string;
+    /** Total token cost of injected techniques (for systemOverhead) */
+    readonly techniqueTokenCost: number;
+    /** Number of techniques injected */
+    readonly count: number;
+    /** Audit details for I-63 overhead breakdown */
+    readonly auditDetails: TechniqueInjectionAudit;
+}
+/**
+ * I-63: Audit record for technique injection.
+ * Enables reconstruction of which techniques were injected and why.
+ */
+export interface TechniqueInjectionAudit {
+    /** IDs of injected techniques, in injection order (confidence descending) */
+    readonly injectedIds: readonly TechniqueId[];
+    /** Per-technique details */
+    readonly techniques: readonly TechniqueAuditEntry[];
+    /** Total token budget available (20% of context window) */
+    readonly tokenBudget: number;
+    /** Total tokens consumed by injected techniques */
+    readonly tokensUsed: number;
+    /** Whether TGP query failed (graceful degradation) */
+    readonly tgpQueryFailed: boolean;
+}
+/**
+ * Per-technique audit entry.
+ */
+export interface TechniqueAuditEntry {
+    readonly id: TechniqueId;
+    readonly confidence: number;
+    readonly tokenCost: number;
+}
+/**
+ * Inject active prompt_fragment techniques into a system prompt section.
+ *
+ * @param reader - TechniqueReader (injected TechniqueApplicator)
+ * @param conn - Database connection
+ * @param agentId - Executing agent's ID (I-07: agent isolation)
+ * @param tenantId - Tenant scope
+ * @param modelContextWindow - Model's total context window in tokens
+ * @returns TechniqueInjectionResult with system prompt section, cost, and audit
+ */
+export declare function injectTechniques(reader: TechniqueReader, conn: DatabaseConnection, agentId: AgentId, tenantId: TenantId, modelContextWindow: number): TechniqueInjectionResult;
+//# sourceMappingURL=technique_injector.d.ts.map

package/dist/api/chat/technique_injector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"technique_injector.d.ts","sourceRoot":"","sources":["../../../src/api/chat/technique_injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AACtG,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAQjF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,wBAAwB,CACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,cAAc,EAAE,MAAM,GACrB,MAAM,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,SAAS,WAAW,EAAE,CAAC;IAC7C,4BAA4B;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,sDAAsD;IACtD,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAcD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,kBAAkB,EAAE,MAAM,GACzB,wBAAwB,CAgF1B"}

package/dist/api/chat/technique_injector.js

@@ -0,0 +1,125 @@
+/**
+ * TGP ↔ Pipeline Wire: Technique Injection into System Prompt
+ * Phase 2B: Active prompt_fragment techniques injected at inference time.
+ *
+ * S ref: §31 (technique application), I-54 (overhead boundary), I-96 (candidate exclusion),
+ *        I-94 (content immutability), I-07 (agent isolation), I-63 (audit payload)
+ *
+ * This module:
+ *   1. Queries active prompt_fragment techniques for the executing agent (I-96)
+ *   2. Applies confidence-descending ordering with 20% window truncation (§31)
+ *   3. Assembles technique content into a system prompt section (I-94: verbatim)
+ *   4. Computes technique token cost for systemOverhead (I-54)
+ *   5. Records injection details for audit transparency (I-63)
+ *
+ * Invariants enforced:
+ *   I-96: Only status='active' techniques participate. Candidates, suspended, retired excluded.
+ *   I-94: Technique content inserted verbatim. No transformation.
+ *   I-07: Techniques scoped to executing agent's agentId.
+ *   I-54: Technique token cost is part of systemOverhead, NOT CGP position 1.
+ *   §31:  prompt_fragment type only. Ordered by confidence descending.
+ *         Truncated to 20% of model context window.
+ *
+ * Failure mode:
+ *   TGP failure = empty technique set + trace event. Graceful degradation.
+ *   The model operates without learned techniques. Safe because techniques
+ *   are supplementary optimization, not governance-critical.
+ */
+import { MAX_CONTEXT_WINDOW_RATIO } from '../../learning/interfaces/index.js';
+import { estimateTokens } from '../../learning/applicator/technique_applicator.js';
+// ============================================================================
+// Constants
+// ============================================================================
+/** System prompt section delimiter for technique injection */
+const TECHNIQUE_SECTION_HEADER = '<!-- LEARNED_TECHNIQUES -->';
+const TECHNIQUE_SECTION_FOOTER = '<!-- /LEARNED_TECHNIQUES -->';
+// ============================================================================
+// Injection Logic
+// ============================================================================
+/**
+ * Inject active prompt_fragment techniques into a system prompt section.
+ *
+ * @param reader - TechniqueReader (injected TechniqueApplicator)
+ * @param conn - Database connection
+ * @param agentId - Executing agent's ID (I-07: agent isolation)
+ * @param tenantId - Tenant scope
+ * @param modelContextWindow - Model's total context window in tokens
+ * @returns TechniqueInjectionResult with system prompt section, cost, and audit
+ */
+export function injectTechniques(reader, conn, agentId, tenantId, modelContextWindow) {
+    // §31: Token budget = 20% of model context window
+    const tokenBudget = Math.floor(modelContextWindow * MAX_CONTEXT_WINDOW_RATIO);
+    // Query active prompt_fragment techniques.
+    // getActivePromptFragments enforces:
+    //   - status='active' (I-96: candidates/suspended/retired excluded)
+    //   - type='prompt_fragment' (§31: only prompt_fragments in system prompt)
+    //   - confidence DESC ordering (§31)
+    //   - greedy token-budget fill (DEC-4E2C-002)
+    //   - agent isolation via agentId (I-07)
+    let techniques;
+    let tgpQueryFailed = false;
+    try {
+        const result = reader.getActivePromptFragments(conn, agentId, tenantId, tokenBudget);
+        if (!result.ok) {
+            // TGP failure = graceful degradation. Empty techniques.
+            techniques = [];
+            tgpQueryFailed = true;
+        }
+        else {
+            techniques = result.value;
+        }
+    }
+    catch {
+        // TGP failure = graceful degradation. Empty techniques.
+        techniques = [];
+        tgpQueryFailed = true;
+    }
+    // No techniques = no injection
+    if (techniques.length === 0) {
+        return Object.freeze({
+            systemPromptSection: '',
+            techniqueTokenCost: 0,
+            count: 0,
+            auditDetails: Object.freeze({
+                injectedIds: Object.freeze([]),
+                techniques: Object.freeze([]),
+                tokenBudget,
+                tokensUsed: 0,
+                tgpQueryFailed,
+            }),
+        });
+    }
+    // Build audit entries and compute total cost
+    const auditEntries = [];
+    let totalTokenCost = 0;
+    for (const technique of techniques) {
+        const tokenCost = estimateTokens(technique.content);
+        totalTokenCost += tokenCost;
+        auditEntries.push(Object.freeze({
+            id: technique.id,
+            confidence: technique.confidence,
+            tokenCost,
+        }));
+    }
+    // Assemble system prompt section
+    // I-94: Content inserted verbatim. No transformation.
+    const contentLines = techniques.map(t => t.content);
+    const systemPromptSection = [
+        TECHNIQUE_SECTION_HEADER,
+        ...contentLines,
+        TECHNIQUE_SECTION_FOOTER,
+    ].join('\n');
+    return Object.freeze({
+        systemPromptSection,
+        techniqueTokenCost: totalTokenCost,
+        count: techniques.length,
+        auditDetails: Object.freeze({
+            injectedIds: Object.freeze(techniques.map(t => t.id)),
+            techniques: Object.freeze(auditEntries),
+            tokenBudget,
+            tokensUsed: totalTokenCost,
+            tgpQueryFailed,
+        }),
+    });
+}
+//# sourceMappingURL=technique_injector.js.map

package/dist/api/chat/technique_injector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"technique_injector.js","sourceRoot":"","sources":["../../../src/api/chat/technique_injector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,mDAAmD,CAAC;AA4DnF,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,8DAA8D;AAC9D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEhE,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAuB,EACvB,IAAwB,EACxB,OAAgB,EAChB,QAAkB,EAClB,kBAA0B;IAE1B,kDAAkD;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,wBAAwB,CAAC,CAAC;IAE9E,2CAA2C;IAC3C,qCAAqC;IACrC,oEAAoE;IACpE,2EAA2E;IAC3E,qCAAqC;IACrC,8CAA8C;IAC9C,yCAAyC;IACzC,IAAI,UAAgC,CAAC;IACrC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,wDAAwD;YACxD,UAAU,GAAG,EAAE,CAAC;YAChB,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;QACxD,UAAU,GAAG,EAAE,CAAC;QAChB,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,mBAAmB,EAAE,EAAE;YACvB,kBAAkB,EAAE,CAAC;YACrB,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;gBAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,WAAW;gBACX,UAAU,EAAE,CAAC;gBACb,cAAc;aACf,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,6CAA6C;IAC7C,MAAM,YAAY,GAA0B,EAAE,CAAC;IAC/C,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACpD,cAAc,IAAI,SAAS,CAAC;QAC5B,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAC9B,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS;SACV,CAAC,CAAC,CAAC;IACN,CAAC;IAED,iCAAiC;IACjC,sDAAsD;IACtD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,mBAAmB,GAAG;QAC1B,wBAAwB;QACxB,GAAG,YAAY;QACf,wBAAwB;KACzB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB;QACnB,kBAAkB,EAAE,cAAc;QAClC,KAAK,EAAE,UAAU,CAAC,MAAM;QACxB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;YAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YACvC,WAAW;YACX,UAAU,EAAE,cAAc;YAC1B,cAAc;SACf,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/api/data/data_api.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Data management API wrapper for the API surface.
+ * S ref: I-02 (user data ownership), S3.6 (data directory),
+ *        §35 (data retention)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: SDD §7 build order item 13
+ *
+ * Wraps data management operations behind the DataApi interface:
+ *   - export(): Export entire engine state (Permission: 'purge_data')
+ *   - purgeAll(): Purge all data, leaving zero traces (Permission: 'purge_data')
+ *   - purge(): Selective purge by filter (Permission: 'purge_data')
+ *
+ * I-02: All user data must be accessible, exportable, and deletable.
+ * All mutations delegate through the kernel's database lifecycle.
+ *
+ * Invariants enforced: I-02 (user data ownership), I-13 (RBAC)
+ */
+import type { OperationContext, DatabaseConnection, RateLimiter, RbacEngine } from '../../kernel/interfaces/index.js';
+import type { Kernel } from '../../kernel/interfaces/index.js';
+import type { DataApi, PurgeFilter } from '../interfaces/api.js';
+/**
+ * I-02: Data management API implementation.
+ * Ensures all user data is accessible, exportable, and deletable.
+ */
+export declare class DataApiImpl implements DataApi {
+    private readonly rbac;
+    private readonly rateLimiter;
+    private readonly kernel;
+    private readonly getConnection;
+    private readonly getContext;
+    constructor(rbac: RbacEngine, rateLimiter: RateLimiter, kernel: Kernel, getConnection: () => DatabaseConnection, getContext: () => OperationContext);
+    /**
+     * S3.6, I-02: Export entire engine state.
+     * Permission: 'purge_data' (same elevated permission as data deletion)
+     *
+     * Exports the SQLite database and all associated state to the specified path.
+     * The export is a complete, self-contained copy of all engine data.
+     */
+    export(outputPath: string): Promise<{
+        path: string;
+        sizeBytes: number;
+    }>;
+    /**
+     * I-02: Purge all data. Leaves zero traces.
+     * Permission: 'purge_data'
+     *
+     * This is a destructive operation.
+     * After this call, the engine is in a clean state as if freshly created.
+     */
+    purgeAll(): Promise<void>;
+    /**
+     * CF-009, I-02: Selective purge by filter.
+     * Permission: 'purge_data'
+     *
+     * Purges data matching the specified filter criteria:
+     *   - sessionId: Purge all data from a specific session
+     *   - missionId: Purge all data from a specific mission (cascading to all child tables)
+     *   - olderThan: Purge data older than the specified ISO timestamp
+     *   - userId: NOT SUPPORTED (no user_id column in schema)
+     *
+     * I-06: Audit log entries are NEVER purged.
+     * I-03: All purge operations are audited in the same transaction.
+     */
+    purge(filter: PurgeFilter): Promise<{
+        purged: number;
+    }>;
+    /**
+     * CF-009: Purge all data associated with a session.
+     * Deletes conversation turns (child FK), conversations, and HITL approvals.
+     */
+    private purgeBySession;
+    /**
+     * CF-009: Purge all data associated with a mission and its descendants.
+     * Cascading delete from all 17+ child tables in FK dependency order.
+     * I-06: NEVER deletes from core_audit_log.
+     */
+    private purgeByMission;
+    /**
+     * CF-009: Find a mission and all its descendants (recursive).
+     * Returns IDs in breadth-first order (children after parents).
+     */
+    private findDescendantMissions;
+    /**
+     * CF-009: Purge data older than the specified ISO timestamp.
+     * Finds all missions older than the cutoff and purges each one,
+     * plus standalone conversations and events.
+     */
+    private purgeByAge;
+}
+//# sourceMappingURL=data_api.d.ts.map

package/dist/api/data/data_api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data_api.d.ts","sourceRoot":"","sources":["../../../src/api/data/data_api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAC9D,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASjE;;;GAGG;AACH,qBAAa,WAAY,YAAW,OAAO;IAEvC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAJV,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,kBAAkB,EACvC,UAAU,EAAE,MAAM,gBAAgB;IAGrD;;;;;;OAMG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAkF9E;;;;;;OAMG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/B;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAoD7D;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0BtB;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAqFtB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;;;OAIG;IACH,OAAO,CAAC,UAAU;CAoCnB"}

package/dist/api/data/data_api.js

@@ -0,0 +1,306 @@
+/**
+ * Data management API wrapper for the API surface.
+ * S ref: I-02 (user data ownership), S3.6 (data directory),
+ *        §35 (data retention)
+ *
+ * Phase: 4 (API Surface)
+ * Implements: SDD §7 build order item 13
+ *
+ * Wraps data management operations behind the DataApi interface:
+ *   - export(): Export entire engine state (Permission: 'purge_data')
+ *   - purgeAll(): Purge all data, leaving zero traces (Permission: 'purge_data')
+ *   - purge(): Selective purge by filter (Permission: 'purge_data')
+ *
+ * I-02: All user data must be accessible, exportable, and deletable.
+ * All mutations delegate through the kernel's database lifecycle.
+ *
+ * Invariants enforced: I-02 (user data ownership), I-13 (RBAC)
+ */
+import { resolve, normalize } from 'node:path';
+import { createRequire } from 'node:module';
+import { unwrapResult, LimenError } from '../errors/limen_error.js';
+import { requirePermission } from '../enforcement/rbac_guard.js';
+import { requireRateLimit } from '../enforcement/rate_guard.js';
+// ============================================================================
+// DataApiImpl
+// ============================================================================
+/**
+ * I-02: Data management API implementation.
+ * Ensures all user data is accessible, exportable, and deletable.
+ */
+export class DataApiImpl {
+    rbac;
+    rateLimiter;
+    kernel;
+    getConnection;
+    getContext;
+    constructor(rbac, rateLimiter, kernel, getConnection, getContext) {
+        this.rbac = rbac;
+        this.rateLimiter = rateLimiter;
+        this.kernel = kernel;
+        this.getConnection = getConnection;
+        this.getContext = getContext;
+    }
+    /**
+     * S3.6, I-02: Export entire engine state.
+     * Permission: 'purge_data' (same elevated permission as data deletion)
+     *
+     * Exports the SQLite database and all associated state to the specified path.
+     * The export is a complete, self-contained copy of all engine data.
+     */
+    async export(outputPath) {
+        const conn = this.getConnection();
+        const ctx = this.getContext();
+        requirePermission(this.rbac, ctx, 'purge_data');
+        requireRateLimit(this.rateLimiter, conn, ctx, 'api_calls');
+        // CF-019: Validate outputPath to prevent path traversal.
+        // Resolve the path and ensure it falls within the data directory.
+        const dataDir = conn.dataDir;
+        const resolvedPath = resolve(dataDir, outputPath);
+        const normalizedBase = normalize(dataDir) + '/';
+        if (!resolvedPath.startsWith(normalizedBase)) {
+            throw new LimenError('INVALID_INPUT', `Export path must resolve within data directory. Path traversal detected.`);
+        }
+        // CF-015: Ensure path ends with .limen extension (S3.6 archive format)
+        const archivePath = resolvedPath.endsWith('.limen') ? resolvedPath : resolvedPath + '.limen';
+        // Delegate to kernel database lifecycle for atomic export
+        const result = this.kernel.database.export(conn, archivePath);
+        const exportResult = unwrapResult(result);
+        // CF-015: Stamp exported file with .limen archive metadata (S3.6)
+        // Open the exported SQLite, add metadata table, close.
+        // This enriches the raw SQLite copy with provenance information.
+        try {
+            const require = createRequire(import.meta.url);
+            // eslint-disable-next-line @typescript-eslint/no-require-imports -- synchronous import for export metadata
+            const BetterSqlite3 = require('better-sqlite3');
+            const exportDb = new BetterSqlite3(archivePath);
+            exportDb.exec(`
+        CREATE TABLE IF NOT EXISTS _limen_export_metadata (
+          key   TEXT PRIMARY KEY,
+          value TEXT NOT NULL
+        );
+      `);
+            const insertMeta = exportDb.prepare(`INSERT OR REPLACE INTO _limen_export_metadata (key, value) VALUES (?, ?)`);
+            insertMeta.run('format', 'limen-archive-v1');
+            insertMeta.run('limen_version', '3.2.0');
+            insertMeta.run('schema_version', String(conn.schemaVersion));
+            insertMeta.run('export_date', this.kernel.time.nowISO());
+            insertMeta.run('tenant_id', ctx.tenantId ?? 'global');
+            insertMeta.run('exported_by', ctx.userId ?? 'system');
+            exportDb.close();
+        }
+        catch {
+            // Metadata stamping is non-critical — the export is still valid SQLite
+        }
+        // I-03: Audit the export operation
+        this.kernel.audit.append(conn, {
+            tenantId: ctx.tenantId,
+            actorType: 'user',
+            actorId: ctx.userId ?? 'unknown',
+            operation: 'data_export',
+            resourceType: 'database',
+            resourceId: 'export',
+            detail: {
+                path: archivePath,
+                sizeBytes: exportResult.sizeBytes,
+                format: 'limen-archive-v1',
+            },
+        });
+        return {
+            path: archivePath,
+            sizeBytes: exportResult.sizeBytes,
+        };
+    }
+    /**
+     * I-02: Purge all data. Leaves zero traces.
+     * Permission: 'purge_data'
+     *
+     * This is a destructive operation.
+     * After this call, the engine is in a clean state as if freshly created.
+     */
+    async purgeAll() {
+        const conn = this.getConnection();
+        const ctx = this.getContext();
+        requirePermission(this.rbac, ctx, 'purge_data');
+        requireRateLimit(this.rateLimiter, conn, ctx, 'api_calls');
+        // Execute retention with aggressive purge via kernel
+        const result = this.kernel.retention.executeRetention(conn, ctx);
+        unwrapResult(result);
+    }
+    /**
+     * CF-009, I-02: Selective purge by filter.
+     * Permission: 'purge_data'
+     *
+     * Purges data matching the specified filter criteria:
+     *   - sessionId: Purge all data from a specific session
+     *   - missionId: Purge all data from a specific mission (cascading to all child tables)
+     *   - olderThan: Purge data older than the specified ISO timestamp
+     *   - userId: NOT SUPPORTED (no user_id column in schema)
+     *
+     * I-06: Audit log entries are NEVER purged.
+     * I-03: All purge operations are audited in the same transaction.
+     */
+    async purge(filter) {
+        const conn = this.getConnection();
+        const ctx = this.getContext();
+        requirePermission(this.rbac, ctx, 'purge_data');
+        requireRateLimit(this.rateLimiter, conn, ctx, 'api_calls');
+        // CF-009: userId is not supported — no user_id column exists in schema
+        if (filter.userId) {
+            throw new LimenError('INVALID_INPUT', 'userId filter not supported: no user_id column in current schema. Use sessionId or missionId.');
+        }
+        // CF-009: At least one filter field required for selective purge
+        if (!filter.sessionId && !filter.missionId && !filter.olderThan) {
+            throw new LimenError('INVALID_INPUT', 'At least one filter field required (sessionId, missionId, olderThan). Use purgeAll() for full purge.');
+        }
+        let totalPurged = 0;
+        conn.transaction(() => {
+            if (filter.sessionId) {
+                totalPurged += this.purgeBySession(conn, filter.sessionId);
+            }
+            if (filter.missionId) {
+                totalPurged += this.purgeByMission(conn, filter.missionId);
+            }
+            if (filter.olderThan) {
+                totalPurged += this.purgeByAge(conn, filter.olderThan);
+            }
+            // I-03: Audit the purge operation
+            this.kernel.audit.append(conn, {
+                tenantId: ctx.tenantId,
+                actorType: 'user',
+                actorId: ctx.userId ?? 'unknown',
+                operation: 'selective_purge',
+                resourceType: 'data',
+                resourceId: 'purge',
+                detail: {
+                    sessionId: filter.sessionId ?? null,
+                    missionId: filter.missionId ?? null,
+                    olderThan: filter.olderThan ?? null,
+                    recordsPurged: totalPurged,
+                },
+            });
+        });
+        return { purged: totalPurged };
+    }
+    /**
+     * CF-009: Purge all data associated with a session.
+     * Deletes conversation turns (child FK), conversations, and HITL approvals.
+     */
+    purgeBySession(conn, sid) {
+        let purged = 0;
+        // Delete conversation turns first (child FK to core_conversations)
+        const convs = conn.query('SELECT id FROM core_conversations WHERE session_id = ?', [sid]);
+        for (const conv of convs) {
+            purged += conn.run('DELETE FROM core_conversation_turns WHERE conversation_id = ?', [conv.id]).changes;
+        }
+        // Delete conversations
+        purged += conn.run('DELETE FROM core_conversations WHERE session_id = ?', [sid]).changes;
+        // Delete HITL approvals for this session
+        purged += conn.run('DELETE FROM hitl_approval_queue WHERE session_id = ?', [sid]).changes;
+        return purged;
+    }
+    /**
+     * CF-009: Purge all data associated with a mission and its descendants.
+     * Cascading delete from all 17+ child tables in FK dependency order.
+     * I-06: NEVER deletes from core_audit_log.
+     */
+    purgeByMission(conn, mid) {
+        // Find all descendant mission IDs (recursive)
+        const missionIds = this.findDescendantMissions(conn, mid);
+        let purged = 0;
+        for (const mId of missionIds) {
+            // Delete task dependencies (via task FK — must delete before tasks)
+            const tasks = conn.query('SELECT id FROM core_tasks WHERE mission_id = ?', [mId]);
+            for (const task of tasks) {
+                purged += conn.run('DELETE FROM core_task_dependencies WHERE from_task = ? OR to_task = ?', [task.id, task.id]).changes;
+            }
+            // Delete artifact dependencies (via artifact FK — must delete before artifacts)
+            const artifacts = conn.query('SELECT id FROM core_artifacts WHERE mission_id = ?', [mId]);
+            for (const art of artifacts) {
+                purged += conn.run('DELETE FROM core_artifact_dependencies WHERE artifact_id = ?', [art.id]).changes;
+            }
+            // Also delete dependencies where this mission is the reader
+            purged += conn.run('DELETE FROM core_artifact_dependencies WHERE reading_mission_id = ?', [mId]).changes;
+            // Delete tasks
+            purged += conn.run('DELETE FROM core_tasks WHERE mission_id = ?', [mId]).changes;
+            // Delete task graphs
+            purged += conn.run('DELETE FROM core_task_graphs WHERE mission_id = ?', [mId]).changes;
+            // Delete artifacts
+            purged += conn.run('DELETE FROM core_artifacts WHERE mission_id = ?', [mId]).changes;
+            // Delete checkpoints
+            purged += conn.run('DELETE FROM core_checkpoints WHERE mission_id = ?', [mId]).changes;
+            // Delete resources
+            purged += conn.run('DELETE FROM core_resources WHERE mission_id = ?', [mId]).changes;
+            // Delete mission goals
+            purged += conn.run('DELETE FROM core_mission_goals WHERE mission_id = ?', [mId]).changes;
+            // Delete mission results
+            purged += conn.run('DELETE FROM core_mission_results WHERE mission_id = ?', [mId]).changes;
+            // Delete compaction log
+            purged += conn.run('DELETE FROM core_compaction_log WHERE mission_id = ?', [mId]).changes;
+            // Delete tree counts
+            purged += conn.run('DELETE FROM core_tree_counts WHERE root_mission_id = ?', [mId]).changes;
+            // Delete events (nullable mission_id)
+            purged += conn.run('DELETE FROM obs_events WHERE mission_id = ?', [mId]).changes;
+            // Delete interaction accounting
+            purged += conn.run('DELETE FROM meter_interaction_accounting WHERE mission_id = ?', [mId]).changes;
+            // Delete LLM request log
+            purged += conn.run('DELETE FROM core_llm_request_log WHERE mission_id = ?', [mId]).changes;
+            // Delete task queue
+            purged += conn.run('DELETE FROM core_task_queue WHERE mission_id = ?', [mId]).changes;
+            // Delete events log
+            purged += conn.run('DELETE FROM core_events_log WHERE mission_id = ?', [mId]).changes;
+            // Delete HITL approvals
+            purged += conn.run('DELETE FROM hitl_approval_queue WHERE mission_id = ?', [mId]).changes;
+        }
+        // Delete missions (children first, then parent — reverse order for FK safety)
+        for (const mId of [...missionIds].reverse()) {
+            purged += conn.run('DELETE FROM core_missions WHERE id = ?', [mId]).changes;
+        }
+        return purged;
+    }
+    /**
+     * CF-009: Find a mission and all its descendants (recursive).
+     * Returns IDs in breadth-first order (children after parents).
+     */
+    findDescendantMissions(conn, rootMissionId) {
+        const result = [rootMissionId];
+        let queue = [rootMissionId];
+        while (queue.length > 0) {
+            const nextQueue = [];
+            for (const parentId of queue) {
+                const children = conn.query('SELECT id FROM core_missions WHERE parent_id = ?', [parentId]);
+                for (const child of children) {
+                    result.push(child.id);
+                    nextQueue.push(child.id);
+                }
+            }
+            queue = nextQueue;
+        }
+        return result;
+    }
+    /**
+     * CF-009: Purge data older than the specified ISO timestamp.
+     * Finds all missions older than the cutoff and purges each one,
+     * plus standalone conversations and events.
+     */
+    purgeByAge(conn, olderThan) {
+        let purged = 0;
+        // Find and purge old missions (cascading via purgeByMission)
+        const oldMissions = conn.query('SELECT id FROM core_missions WHERE created_at < ? AND parent_id IS NULL', [olderThan]);
+        for (const m of oldMissions) {
+            purged += this.purgeByMission(conn, m.id);
+        }
+        // Purge old conversations not tied to missions
+        const oldConvs = conn.query('SELECT id FROM core_conversations WHERE created_at < ?', [olderThan]);
+        for (const conv of oldConvs) {
+            purged += conn.run('DELETE FROM core_conversation_turns WHERE conversation_id = ?', [conv.id]).changes;
+        }
+        purged += conn.run('DELETE FROM core_conversations WHERE created_at < ?', [olderThan]).changes;
+        // Purge old events not tied to missions
+        purged += conn.run('DELETE FROM obs_events WHERE created_at < ? AND mission_id IS NULL', [olderThan]).changes;
+        // Purge old LLM request logs
+        purged += conn.run('DELETE FROM core_llm_request_log WHERE created_at < ?', [olderThan]).changes;
+        return purged;
+    }
+}
+//# sourceMappingURL=data_api.js.map

package/dist/api/data/data_api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data_api.js","sourceRoot":"","sources":["../../../src/api/data/data_api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAM5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,OAAO,WAAW;IAEH;IACA;IACA;IACA;IACA;IALnB,YACmB,IAAgB,EAChB,WAAwB,EACxB,MAAc,EACd,aAAuC,EACvC,UAAkC;QAJlC,SAAI,GAAJ,IAAI,CAAY;QAChB,gBAAW,GAAX,WAAW,CAAa;QACxB,WAAM,GAAN,MAAM,CAAQ;QACd,kBAAa,GAAb,aAAa,CAA0B;QACvC,eAAU,GAAV,UAAU,CAAwB;IAClD,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE9B,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAChD,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAE3D,yDAAyD;QACzD,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,UAAU,CAAC,eAAe,EAClC,0EAA0E,CAAC,CAAC;QAChF,CAAC;QAED,uEAAuE;QACvE,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,QAAQ,CAAC;QAE7F,0DAA0D;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAE1C,kEAAkE;QAClE,uDAAuD;QACvD,iEAAiE;QACjE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,2GAA2G;YAC3G,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAM7C,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;YAEhD,QAAQ,CAAC,IAAI,CAAC;;;;;OAKb,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CACjC,0EAA0E,CAC3E,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC7C,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACzC,UAAU,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YAC7D,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC;YACtD,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;YAEtD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,uEAAuE;QACzE,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;YAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,GAAG,CAAC,MAAgB,IAAI,SAAS;YAC1C,SAAS,EAAE,aAAa;YACxB,YAAY,EAAE,UAAU;YACxB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE;gBACN,IAAI,EAAE,WAAW;gBACjB,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE9B,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAChD,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAE3D,qDAAqD;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,YAAY,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,MAAmB;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE9B,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAChD,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QAE3D,uEAAuE;QACvE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,IAAI,UAAU,CAAC,eAAe,EAClC,+FAA+F,CAAC,CAAC;QACrG,CAAC;QAED,iEAAiE;QACjE,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,UAAU,CAAC,eAAe,EAClC,sGAAsG,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE;YACpB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,WAAW,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,SAAmB,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,WAAW,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,SAAmB,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACzD,CAAC;YAED,kCAAkC;YAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,SAAS,EAAE,MAAM;gBACjB,OAAO,EAAE,GAAG,CAAC,MAAgB,IAAI,SAAS;gBAC1C,SAAS,EAAE,iBAAiB;gBAC5B,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE;oBACN,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;oBACnC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;oBACnC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;oBACnC,aAAa,EAAE,WAAW;iBAC3B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,IAAwB,EAAE,GAAW;QAC1D,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,mEAAmE;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,wDAAwD,EAAE,CAAC,GAAG,CAAC,CAChE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,+DAA+D,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC;QACZ,CAAC;QAED,uBAAuB;QACvB,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,qDAAqD,EAAE,CAAC,GAAG,CAAC,CAC7D,CAAC,OAAO,CAAC;QAEV,yCAAyC;QACzC,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,sDAAsD,EAAE,CAAC,GAAG,CAAC,CAC9D,CAAC,OAAO,CAAC;QAEV,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAAwB,EAAE,GAAW;QAC1D,8CAA8C;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,oEAAoE;YACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,gDAAgD,EAAE,CAAC,GAAG,CAAC,CACxD,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,uEAAuE,EACvE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CACnB,CAAC,OAAO,CAAC;YACZ,CAAC;YAED,gFAAgF;YAChF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC1B,oDAAoD,EAAE,CAAC,GAAG,CAAC,CAC5D,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,8DAA8D,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CACzE,CAAC,OAAO,CAAC;YACZ,CAAC;YACD,4DAA4D;YAC5D,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,qEAAqE,EAAE,CAAC,GAAG,CAAC,CAC7E,CAAC,OAAO,CAAC;YAEV,eAAe;YACf,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEjF,qBAAqB;YACrB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,mDAAmD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEvF,mBAAmB;YACnB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,iDAAiD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAErF,qBAAqB;YACrB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,mDAAmD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEvF,mBAAmB;YACnB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,iDAAiD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAErF,uBAAuB;YACvB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,qDAAqD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEzF,yBAAyB;YACzB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,uDAAuD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAE3F,wBAAwB;YACxB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,sDAAsD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAE1F,qBAAqB;YACrB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,wDAAwD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAE5F,sCAAsC;YACtC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,6CAA6C,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEjF,gCAAgC;YAChC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,+DAA+D,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEnG,yBAAyB;YACzB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,uDAAuD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAE3F,oBAAoB;YACpB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,kDAAkD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEtF,oBAAoB;YACpB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,kDAAkD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAEtF,wBAAwB;YACxB,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,sDAAsD,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5F,CAAC;QAED,8EAA8E;QAC9E,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,wCAAwC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,IAAwB,EAAE,aAAqB;QAC5E,MAAM,MAAM,GAAa,CAAC,aAAa,CAAC,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC,aAAa,CAAC,CAAC;QAE5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,kDAAkD,EAAE,CAAC,QAAQ,CAAC,CAC/D,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACtB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,IAAwB,EAAE,SAAiB;QAC5D,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,6DAA6D;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAC5B,yEAAyE,EAAE,CAAC,SAAS,CAAC,CACvF,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CACzB,wDAAwD,EAAE,CAAC,SAAS,CAAC,CACtE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,+DAA+D,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC3E,CAAC,OAAO,CAAC;QACZ,CAAC;QACD,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,qDAAqD,EAAE,CAAC,SAAS,CAAC,CACnE,CAAC,OAAO,CAAC;QAEV,wCAAwC;QACxC,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,oEAAoE,EAAE,CAAC,SAAS,CAAC,CAClF,CAAC,OAAO,CAAC;QAEV,6BAA6B;QAC7B,MAAM,IAAI,IAAI,CAAC,GAAG,CAChB,uDAAuD,EAAE,CAAC,SAAS,CAAC,CACrE,CAAC,OAAO,CAAC;QAEV,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}