looply-cli 0.0.0-stage → 0.2.0

package/dist/shared-grants.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARED_GRANT_LOCK_WAIT_MS = void 0;
+exports.sharedGrantsPath = sharedGrantsPath;
+exports.readSharedGrants = readSharedGrants;
+exports.liveSharedGrants = liveSharedGrants;
+exports.grantAce = grantAce;
+exports.removeAce = removeAce;
+exports.ensureSharedGrant = ensureSharedGrant;
+exports.ensureSharedAccess = ensureSharedAccess;
+exports.releaseSharedGrants = releaseSharedGrants;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const exclusive_lock_1 = require("./exclusive-lock");
+const untrusted_exec_1 = require("./untrusted-exec");
+function sharedGrantsPath(home = (0, node_os_1.homedir)()) {
+    return (0, node_path_1.join)(home, '.looply', 'container-grants.jsonl');
+}
+/**
+ * F43: HOW LONG ONE GRANT WAITS FOR ANOTHER — longer than an ACL write takes.
+ *
+ * `icacls /grant (OI)(CI)` rewrites the entry on every file under the toolchain
+ * mirror, and the time grows with the list: 8–11 s on 09-15, 26–29 s on 09-26
+ * at ~1,230 entries. The shared mutex's default wait (5 s) is sized for
+ * check-and-claims that take microseconds, so a second identity arriving during
+ * a grant was refused ("could not be serialised") — a gate step or a tool call
+ * that did not run, and in the lane an inconclusive check nobody re-offers.
+ * A holder that dies is still broken at once (`withExclusiveLock`); this only
+ * bounds how long a LIVE holder is waited for.
+ */
+exports.SHARED_GRANT_LOCK_WAIT_MS = 300_000;
+function lockPath(home) {
+    return (0, node_path_1.join)(home, '.looply', 'container-grants.lock');
+}
+/** Every row, oldest first. A row that will not parse is skipped, never fatal. */
+function readSharedGrants(home = (0, node_os_1.homedir)()) {
+    let raw;
+    try {
+        raw = (0, node_fs_1.readFileSync)(sharedGrantsPath(home), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const line of raw.split('\n')) {
+        const s = line.trim();
+        if (s === '')
+            continue;
+        try {
+            const r = JSON.parse(s);
+            if (typeof r.name === 'string' && typeof r.sid === 'string' && typeof r.path === 'string') {
+                out.push(r);
+            }
+        }
+        catch {
+            /* one unreadable row is one lost row, not a lost ledger */
+        }
+    }
+    return out;
+}
+/**
+ * What is still granted: the last state wins, per (sid, path).
+ *
+ * Folded rather than filtered, because a path can legitimately be granted,
+ * released, and granted again when a workspace identity is reused.
+ */
+function liveSharedGrants(home = (0, node_os_1.homedir)()) {
+    const last = new Map();
+    for (const r of readSharedGrants(home))
+        last.set(`${r.sid}|${r.path}`, r);
+    return [...last.values()].filter((r) => r.state === 'granted');
+}
+function append(home, r) {
+    const p = sharedGrantsPath(home);
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(home, '.looply'), { recursive: true });
+    (0, node_fs_1.appendFileSync)(p, `\n${JSON.stringify(r)}`, 'utf8');
+}
+function icacls() {
+    return (0, node_path_1.join)((0, untrusted_exec_1.systemRoot)(), 'System32', 'icacls.exe');
+}
+/**
+ * Add one inheritable read-and-execute ACE for a container SID.
+ *
+ * READ AND EXECUTE ONLY, on both shared paths, because both hold Looply's own
+ * artefacts: a container that could replace `node.exe` or the tool worker would
+ * be choosing what every later execution runs.
+ */
+function grantAce(path, sid) {
+    try {
+        (0, node_child_process_1.execFileSync)(icacls(), [path, '/grant', `*${sid}:(OI)(CI)(RX)`], { stdio: 'ignore' });
+        return { ok: true };
+    }
+    catch (e) {
+        return { ok: false, because: e.message };
+    }
+}
+/**
+ * Remove every granted ACE for one SID from one path, and nothing else.
+ *
+ * `/remove:g` names a single principal. It cannot touch another SID's entry, an
+ * inherited entry, or the owner's own rights — which is what "without changing
+ * unrelated user permissions" has to mean in practice.
+ */
+function removeAce(path, sid) {
+    try {
+        (0, node_child_process_1.execFileSync)(icacls(), [path, '/remove:g', `*${sid}`], { stdio: 'ignore' });
+        return { ok: true };
+    }
+    catch (e) {
+        return { ok: false, because: e.message };
+    }
+}
+/**
+ * Make sure this identity may read a shared path, recording that it now may.
+ *
+ * 🔴 THE SAME LOCK AS THE REMOVAL, WHICH IS THE POINT. `Set-Acl` and `icacls`
+ * are both read-modify-write over one DACL, so an addition racing a removal
+ * loses whichever entry it did not see. Locking only the cleanup would leave
+ * exactly that race open on every launch.
+ *
+ * ⚠️ THE CRITICAL SECTION IS THE ACL WRITE, AND NOTHING MORE. The lock is taken
+ * here and released before the caller launches anything: it is never held
+ * across a provider invocation or a gate step.
+ *
+ * Idempotent: an identity already recorded as holding this path does no ACL work
+ * at all, so the cost is paid once per identity rather than once per launch.
+ */
+function ensureSharedGrant(name, sid, path, deps = {}) {
+    const home = deps.home ?? (0, node_os_1.homedir)();
+    const doGrant = deps.grant ?? grantAce;
+    const now = deps.now ?? (() => new Date());
+    return (0, exclusive_lock_1.withExclusiveLock)(lockPath(home), () => {
+        const already = liveSharedGrants(home).some((r) => r.sid === sid && r.path === path);
+        if (already)
+            return { ok: true };
+        // Intent first: a crash after the ACE lands must not leave it unrecorded.
+        append(home, { name, sid, path, at: now().toISOString(), state: 'granted' });
+        const r = doGrant(path, sid);
+        if (!r.ok) {
+            // The row stays. A recorded grant whose ACE never landed is cleaned up
+            // harmlessly; an ACE with no row is the leak this module removes.
+            return r;
+        }
+        return { ok: true };
+    }, (why) => ({ ok: false, because: `the shared-grant ledger could not be serialised: ${why}` }), exports.SHARED_GRANT_LOCK_WAIT_MS);
+}
+/**
+ * Ensure one container identity may read the shared paths, before it launches.
+ *
+ * ⚠️ THE COMMON CASE COSTS NOTHING. An identity whose rows are already in the
+ * ledger takes no lock, makes no probe and touches no ACL — so the extra round
+ * trip is paid once per identity, not once per launch.
+ */
+async function ensureSharedAccess(backend, name, paths, deps = {}) {
+    /*
+     * ⚠️ NULL MEANS "NOT A WINDOWS DACL BACKEND", NOT "SKIP THE SAFETY".
+     *
+     * Shared-path grants exist because AppContainer identities accumulate ACEs on
+     * a shared directory. A backend that is not the AppContainer one — a test
+     * double, or a future non-Windows boundary — grants nothing and therefore has
+     * nothing to give back. Asking it for a container SID would fail, and turning
+     * that failure into a refused gate step would break every suite that injects a
+     * fake backend while proving nothing about the real one.
+     */
+    if (backend === null)
+        return { ok: true };
+    const home = deps.home ?? (0, node_os_1.homedir)();
+    const wanted = paths.filter((p) => p.length > 0);
+    if (wanted.length === 0)
+        return { ok: true };
+    const live = liveSharedGrants(home).filter((r) => r.name === name);
+    const missing = wanted.filter((p) => !live.some((r) => r.path === p));
+    if (missing.length === 0)
+        return { ok: true };
+    // The numeric SID, from the same helper that derives it for a launch. Asked
+    // for only when something is actually missing.
+    let reply;
+    try {
+        reply = await backend.call({ action: 'probe', profile: name });
+    }
+    catch (e) {
+        reply = { ok: false, error: e.message };
+    }
+    const sid = reply.sid;
+    if (!reply.ok || typeof sid !== 'string' || sid.length === 0) {
+        /*
+         * 🔴 NO SID MEANS NO GRANT, WHICH MEANS LESS ACCESS — NOT MORE.
+         *
+         * This is the one place the direction of failure has to be reasoned about
+         * out loud. Refusing the launch here would be safe too, but it would turn
+         * every backend that answers `probe` differently into a broken gate. Going
+         * on without the grant cannot widen anything: the container simply is not
+         * given the shared path, and if it needs it the launch fails at the
+         * boundary rather than succeeding with authority nobody recorded.
+         */
+        return { ok: true, because: `no shared grant: ${reply.error ?? 'the backend returned no sid'}` };
+    }
+    for (const p of missing) {
+        const r = ensureSharedGrant(name, sid, p, deps);
+        if (!r.ok)
+            return r;
+    }
+    return { ok: true };
+}
+/**
+ * Give back every shared-path grant held by these identities.
+ *
+ * 🔴 CALLED ONLY FOR AN IDENTITY WHOSE WORKSPACE IS BEING RETIRED, and the
+ * caller establishes that. This function does not decide liveness; it does the
+ * ACL work for a decision already made, so a caller that skips the check cannot
+ * be rescued here.
+ *
+ * ⚠️ A FAILURE LEAVES THE ROW `granted`, DELIBERATELY. That is the truthful
+ * cleanup-pending state: the next retirement sweep finds the row and tries
+ * again, and nothing ever reports cleanup it did not do.
+ */
+function releaseSharedGrants(names, deps = {}) {
+    const home = deps.home ?? (0, node_os_1.homedir)();
+    const doRemove = deps.remove ?? removeAce;
+    const now = deps.now ?? (() => new Date());
+    const wanted = new Set(names);
+    return (0, exclusive_lock_1.withExclusiveLock)(lockPath(home), () => {
+        const released = [];
+        const pending = [];
+        for (const r of liveSharedGrants(home)) {
+            if (!wanted.has(r.name))
+                continue;
+            const out = doRemove(r.path, r.sid);
+            if (out.ok) {
+                append(home, { ...r, at: now().toISOString(), state: 'released' });
+                released.push({ path: r.path, sid: r.sid });
+            }
+            else {
+                pending.push({ path: r.path, sid: r.sid, because: out.because ?? 'unknown' });
+            }
+        }
+        return { released, pending };
+    }, (why) => ({ released: [], pending: [{ path: '(all)', sid: '(all)', because: why }] }), exports.SHARED_GRANT_LOCK_WAIT_MS);
+}
+//# sourceMappingURL=shared-grants.js.map

package/dist/shared-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-grants.js","sourceRoot":"","sources":["../src/shared-grants.ts"],"names":[],"mappings":";;;AA8DA,4CAEC;AAqBD,4CAqBC;AAQD,4CAIC;AAwBD,4BAOC;AASD,8BAOC;AAyBD,8CA2BC;AAcD,gDAmDC;AAmBD,kDAyBC;AAtUD,2DAAkD;AAClD,qCAAkE;AAClE,qCAAkC;AAClC,yCAAiC;AACjC,qDAAqD;AACrD,qDAA8C;AAyD9C,SAAgB,gBAAgB,CAAC,OAAe,IAAA,iBAAO,GAAE;IACvD,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,yBAAyB,GAAG,OAAO,CAAC;AAEjD,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACxD,CAAC;AAED,kFAAkF;AAClF,SAAgB,gBAAgB,CAAC,OAAe,IAAA,iBAAO,GAAE;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,sBAAY,EAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAsB,CAAC;YAC7C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1F,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,OAAe,IAAA,iBAAO,GAAE;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,CAAoB;IAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjC,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAA,wBAAc,EAAC,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,MAAM;IACb,OAAO,IAAA,gBAAI,EAAC,IAAA,2BAAU,GAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;AACtD,CAAC;AAOD;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,IAAY,EAAE,GAAW;IAChD,IAAI,CAAC;QACH,IAAA,iCAAY,EAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CAAC,IAAY,EAAE,GAAW;IACjD,IAAI,CAAC;QACH,IAAA,iCAAY,EAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACtD,CAAC;AACH,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAC/B,IAAY,EACZ,GAAW,EACX,IAAY,EACZ,OAAwB,EAAE;IAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,IAAA,kCAAiB,EACtB,QAAQ,CAAC,IAAI,CAAC,EACd,GAAG,EAAE;QACH,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACrF,IAAI,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjC,0EAA0E;QAC1E,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oDAAoD,GAAG,EAAE,EAAE,CAAC,EAC5F,iCAAyB,CAC1B,CAAC;AACJ,CAAC;AAOD;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAyB,EACzB,IAAY,EACZ,KAAwB,EACxB,OAAwB,EAAE;IAE1B;;;;;;;;;OASG;IACH,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAE9C,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAI,KAAoD,CAAC;IACzD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D;;;;;;;;;WASG;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,KAAK,CAAC,KAAK,IAAI,6BAA6B,EAAE,EAAE,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CAAC,KAAwB,EAAE,OAAwB,EAAE;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,iBAAO,GAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAA,kCAAiB,EACtB,QAAQ,CAAC,IAAI,CAAC,EACd,GAAG,EAAE;QACH,MAAM,QAAQ,GAAoC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAqD,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;gBACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EACrF,iCAAyB,CAC1B,CAAC;AACJ,CAAC"}

package/dist/signals.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Signal handling (DESIGN §12 case 11): HUP, INT and TERM must end in
+ * `run.ended` with tallies and a notification, never in a silent death.
+ *
+ * Node's default disposition for all three is immediate exit — the ledger's
+ * last line stays `round.phase` forever and the phone hears nothing, which is
+ * exactly the quiet failure the notifier exists to prevent. So the watcher
+ * takes the signals over, and the runner polls `requested()` between rounds:
+ *
+ *   1st signal → graceful. The in-flight round finishes (same finish-the-round
+ *     rule as a budget limit, §12 case 10), the runner stops with stopReason
+ *     `signal`, emits `run.ended` with totals, and the caller notifies.
+ *   2nd signal → force, once. The escape hatch for a round that will not end.
+ *     `onForce` is the caller's emergency path (best-effort run.ended + notify,
+ *     then exit); it fires exactly once because that path sends a message, and
+ *     an impatient thumb on Ctrl-C must not send two.
+ *
+ * On force the watcher also uninstalls itself, so a THIRD signal falls through
+ * to the default disposition and genuinely kills the process. Without this, a
+ * caller whose force path hangs leaves a process nothing short of SIGKILL can
+ * reach.
+ *
+ * Exiting is deliberately not done here: it must happen after the async
+ * run.ended append and notify, so it belongs to the caller. This module stays
+ * synchronous and injectable.
+ */
+export declare const STOP_SIGNALS: readonly ["SIGHUP", "SIGINT", "SIGTERM"];
+export type StopSignal = (typeof STOP_SIGNALS)[number];
+/** The slice of `process` the watcher needs, injectable for tests. */
+export interface SignalSource {
+    on(signal: StopSignal, handler: () => void): void;
+    off(signal: StopSignal, handler: () => void): void;
+}
+export interface SignalWatcherDeps {
+    proc: SignalSource;
+    /** First signal seen. Log "finishing the round — again to force" here. */
+    onGraceful?(signal: StopSignal): void;
+    /** Second signal seen. The caller's flush-and-exit path. Called once. */
+    onForce?(signal: StopSignal): void;
+}
+export declare class SignalWatcher {
+    private readonly deps;
+    private readonly handlers;
+    private received;
+    private forced;
+    constructor(deps: SignalWatcherDeps);
+    install(): void;
+    uninstall(): void;
+    /** Polled by the runner between rounds. */
+    requested(): boolean;
+    get signal(): StopSignal | null;
+    private onSignal;
+}
+export declare function nodeSignalSource(proc?: NodeJS.Process): SignalSource;
+//# sourceMappingURL=signals.d.ts.map

package/dist/signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.d.ts","sourceRoot":"","sources":["../src/signals.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,eAAO,MAAM,YAAY,0CAA2C,CAAC;AACrE,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAClD,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,YAAY,CAAC;IACnB,0EAA0E;IAC1E,UAAU,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,OAAO,CAAC,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC;CACpC;AAED,qBAAa,aAAa;IAKZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,QAAQ,CAA2B;IAC3C,OAAO,CAAC,MAAM,CAAS;gBAEM,IAAI,EAAE,iBAAiB;IAEpD,OAAO,IAAI,IAAI;IAWf,SAAS,IAAI,IAAI;IAKjB,2CAA2C;IAC3C,SAAS,IAAI,OAAO;IAIpB,IAAI,MAAM,IAAI,UAAU,GAAG,IAAI,CAE9B;IAED,OAAO,CAAC,QAAQ;CAcjB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAAM,CAAC,OAAiB,GAAG,YAAY,CAK7E"}

package/dist/signals.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Signal handling (DESIGN §12 case 11): HUP, INT and TERM must end in
+ * `run.ended` with tallies and a notification, never in a silent death.
+ *
+ * Node's default disposition for all three is immediate exit — the ledger's
+ * last line stays `round.phase` forever and the phone hears nothing, which is
+ * exactly the quiet failure the notifier exists to prevent. So the watcher
+ * takes the signals over, and the runner polls `requested()` between rounds:
+ *
+ *   1st signal → graceful. The in-flight round finishes (same finish-the-round
+ *     rule as a budget limit, §12 case 10), the runner stops with stopReason
+ *     `signal`, emits `run.ended` with totals, and the caller notifies.
+ *   2nd signal → force, once. The escape hatch for a round that will not end.
+ *     `onForce` is the caller's emergency path (best-effort run.ended + notify,
+ *     then exit); it fires exactly once because that path sends a message, and
+ *     an impatient thumb on Ctrl-C must not send two.
+ *
+ * On force the watcher also uninstalls itself, so a THIRD signal falls through
+ * to the default disposition and genuinely kills the process. Without this, a
+ * caller whose force path hangs leaves a process nothing short of SIGKILL can
+ * reach.
+ *
+ * Exiting is deliberately not done here: it must happen after the async
+ * run.ended append and notify, so it belongs to the caller. This module stays
+ * synchronous and injectable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignalWatcher = exports.STOP_SIGNALS = void 0;
+exports.nodeSignalSource = nodeSignalSource;
+exports.STOP_SIGNALS = ['SIGHUP', 'SIGINT', 'SIGTERM'];
+class SignalWatcher {
+    deps;
+    handlers = new Map();
+    received = null;
+    forced = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    install() {
+        // Idempotent: a double install would register two handlers per signal, and
+        // one Ctrl-C would then count as both the graceful and the force press.
+        if (this.handlers.size > 0)
+            return;
+        for (const sig of exports.STOP_SIGNALS) {
+            const handler = () => this.onSignal(sig);
+            this.handlers.set(sig, handler);
+            this.deps.proc.on(sig, handler);
+        }
+    }
+    uninstall() {
+        for (const [sig, handler] of this.handlers)
+            this.deps.proc.off(sig, handler);
+        this.handlers.clear();
+    }
+    /** Polled by the runner between rounds. */
+    requested() {
+        return this.received !== null;
+    }
+    get signal() {
+        return this.received;
+    }
+    onSignal(sig) {
+        if (this.received === null) {
+            this.received = sig;
+            this.deps.onGraceful?.(sig);
+            return;
+        }
+        if (!this.forced) {
+            this.forced = true;
+            // Re-arm the default disposition BEFORE the force path runs: from here on
+            // the next signal must kill, no matter what onForce does or fails to do.
+            this.uninstall();
+            this.deps.onForce?.(sig);
+        }
+    }
+}
+exports.SignalWatcher = SignalWatcher;
+function nodeSignalSource(proc = process) {
+    return {
+        on: (sig, handler) => void proc.on(sig, handler),
+        off: (sig, handler) => void proc.removeListener(sig, handler),
+    };
+}
+//# sourceMappingURL=signals.js.map

package/dist/signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.js","sourceRoot":"","sources":["../src/signals.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;;AAmEH,4CAKC;AAtEY,QAAA,YAAY,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAiBrE,MAAa,aAAa;IAKK;IAJZ,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACtD,QAAQ,GAAsB,IAAI,CAAC;IACnC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAA6B,IAAuB;QAAvB,SAAI,GAAJ,IAAI,CAAmB;IAAG,CAAC;IAExD,OAAO;QACL,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO;QACnC,KAAK,MAAM,GAAG,IAAI,oBAAY,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,SAAS;QACP,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,2CAA2C;IAC3C,SAAS;QACP,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,QAAQ,CAAC,GAAe;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,0EAA0E;YAC1E,yEAAyE;YACzE,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF;AA9CD,sCA8CC;AAED,SAAgB,gBAAgB,CAAC,OAAuB,OAAO;IAC7D,OAAO;QACL,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC;QAChD,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC"}

package/dist/source-cmd.d.ts

@@ -0,0 +1,201 @@
+import { type Attestation, type Classification, type CoverageKind, type Disposition, type RequirementCoverage, type ProjectIndexSnapshot, type Source, type SourceKind, type SourceStatement } from '@looply/core';
+import { type PdfTextResult } from './pdf-text';
+import { type VerdictDeps } from './source-verdict';
+/**
+ * `looply source` — hand a document to the project from the machine that holds it.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * WHY THIS IS A CLI VERB AND NOT A PHONE SCREEN
+ *
+ * A plan lives beside the repository, on the developer's disk. Handing it over
+ * is a file operation, and the machine that holds the file is the natural
+ * caller — the same reason project creation is a machine act. The phone reads
+ * what was handed over; it does not type documents.
+ *
+ * ⚠️ LOCAL REFUSALS COME FIRST. The kind is decided from the extension, the
+ * file is read, and the same `whyUnreadable` and size bound the server applies
+ * are applied HERE, before pairing is even looked at — so a person gets the
+ * real answer ("no text layer", "this file has a NUL byte") without a network
+ * round trip, and an unpaired machine is told to pair only when the document
+ * itself was fine.
+ *
+ * A PDF is read HERE, on the machine that holds it (`pdf-text.ts`): its text
+ * layer goes to the server page by page, and the file's own sha256 travels
+ * beside it as provenance. A scanned PDF — no text layer — is refused with
+ * the reason, never sent as an empty document.
+ *
+ * 🔴 THE CONTENT IS DATA. Nothing in this file interprets the document. The
+ * text goes to the server verbatim; the server derives the statements with the
+ * same extractor the fixture tests hold to account.
+ *
+ * `clientRef` is derived from the content's sha256, so running the command
+ * twice on the same file is the same request twice — the server answers with
+ * the source it already has and this prints "already stored".
+ *
+ * `looply source reconcile <id>` measures where each requirement stands against
+ * THIS repository: the project index of HEAD's tree (the same one a run
+ * builds) is read here, `@looply/core`'s reconciler decides — absent, a
+ * candidate place to look, conflicting, or blocked — and the result is handed
+ * over keyed by the tree. Nothing here, on the machine or on the server, says
+ * "implemented": that is a person's attestation with evidence, a later verb.
+ */
+export declare const SOURCE_USAGE = "usage:\n  looply source add <file> [--name <name>]   hand a Markdown (.md), plain-text (.txt) or PDF (.pdf, with a text layer) document to this project\n  looply source list                         what this project has been given\n  looply source show <id>                    one source: its statements, what each one IS, where it came from, and where each requirement stands\n  looply source reconcile <id>               measure where each requirement stands against this repository (HEAD's tree), and record it\n  looply source coverage <id>                which requirements no goal serves, which are served, and which a person evidenced\n  looply source plan <id> [--dry-run]        propose goals from this document\u2019s requirements, grouped by its headings, and set them\n  looply source verdict <id>                 the final verdict on the integrated tree: COMPLETE, or every unmet requirement\n";
+/** Exit codes, in the sysexits tradition the rest of the CLI follows for 64. */
+export declare const EXIT: {
+    readonly ok: 0;
+    readonly refused: 1;
+    readonly usage: 64;
+    readonly unreadable: 65;
+    readonly noInput: 66;
+    readonly unavailable: 69;
+};
+export type Identity = {
+    kind: 'unpaired';
+} | {
+    kind: 'unregistered';
+} | {
+    kind: 'ok';
+    serverUrl: string;
+    token: string;
+    projectId: string;
+};
+export interface SourceClient {
+    createSource(projectId: string, input: {
+        clientRef: string;
+        name: string;
+        kind: SourceKind;
+        content?: string;
+        pages?: {
+            page: number;
+            text: string;
+        }[];
+        originSha256?: string;
+    }): Promise<{
+        source: Source;
+        statements: SourceStatement[];
+        deduplicated: boolean;
+    }>;
+    sources(projectId: string): Promise<{
+        sources: Omit<Source, 'content'>[];
+    }>;
+    sourceDetail(projectId: string, sourceId: string): Promise<SourceDetail>;
+    reconcileSource(projectId: string, sourceId: string, input: {
+        treeSha: string;
+        reconcilerVersion: number;
+        dispositions: Disposition[];
+    }): Promise<{
+        dispositions: Disposition[];
+        treeSha: string;
+        reconcilerVersion: number;
+        created: boolean;
+    }>;
+    coverage(projectId: string, sourceId: string): Promise<SourceCoverage>;
+    createGoal(projectId: string, input: {
+        clientRef: string;
+        text: string;
+        dependsOn?: readonly string[];
+        surfaces?: readonly string[];
+        requirements?: readonly {
+            sourceId: string;
+            ordinal: number;
+        }[];
+    }): Promise<{
+        goal: {
+            id: string;
+        };
+        deduplicated: boolean;
+    }>;
+}
+/** What is covered and by whom, as the server answers it. */
+export interface SourceCoverage {
+    sourceId: string;
+    name: string;
+    reconciledAt: {
+        treeSha: string;
+        reconcilerVersion: number;
+        createdAt: string;
+    } | null;
+    requirements: RequirementCoverage[];
+    tally: Record<CoverageKind, number>;
+}
+/** What the server answers for one source. */
+export interface SourceDetail {
+    source: Source;
+    statements: SourceStatement[];
+    classifications: Classification[];
+    classifierVersion: number | null;
+    dispositions: Disposition[];
+    reconciledAt: {
+        treeSha: string;
+        reconcilerVersion: number;
+        createdAt: string;
+    } | null;
+    /** What people attested — the latest per statement. Read here; never written from the machine. */
+    attestations: Attestation[];
+}
+/** HEAD's tree and its project index, as the machine that holds the repository can produce them. */
+export type IndexAtHead = {
+    ok: true;
+    treeSha: string;
+    snapshot: ProjectIndexSnapshot;
+    cached: boolean;
+} | {
+    ok: false;
+    because: string;
+};
+export interface SourceCmdDeps {
+    cwd: () => string;
+    /** Reads a file as UTF-8; throws when it cannot. */
+    readFile: (absolutePath: string) => string;
+    /** Reads a file's bytes; throws when it cannot. */
+    readBytes: (absolutePath: string) => Uint8Array;
+    /** The PDF reader (a child process in production; a fake in tests). */
+    pdfPages: (bytes: Uint8Array) => Promise<PdfTextResult>;
+    identity: () => Identity;
+    /** The repository's index at HEAD (built or cached, as a run does it), or why there is none. */
+    index: (cwd: string) => Promise<IndexAtHead>;
+    client: (serverUrl: string, token: string) => SourceClient;
+    out: (line: string) => void;
+    err: (line: string) => void;
+    /** F32: the integration lane, git and the server, for the final verdict. Absent: this build cannot judge. */
+    verdict?: (cwd: string, who: {
+        readonly serverUrl: string;
+        readonly token: string;
+        readonly projectId: string;
+    }) => VerdictDeps;
+}
+/** Which kind a file is, decided from its extension alone — and by name what it is not. */
+export declare function kindForFile(path: string): {
+    ok: true;
+    kind: SourceKind;
+} | {
+    ok: false;
+    because: string;
+};
+/** The idempotency key for a document: its own bytes. */
+export declare function clientRefFor(sha256: string): string;
+export declare function sourceCommand(argv: string[], deps: SourceCmdDeps): Promise<number>;
+/** Where a statement is, in the reader's own terms: `p2 L4-5` for a pdf, `L7` otherwise. */
+export declare function anchorLabel(s: SourceStatement): string;
+/** Where a requirement stands, on one line under it: what was found, or why nothing could be said. */
+export declare function dispositionLabel(d: Disposition): string;
+/** A person's word, on one line: what they said, who, at which tree, and the first place they pointed at. */
+export declare function attestationLabel(a: Attestation, earlierTree: boolean): string;
+/**
+ * One source, as a person reads it: requirements first (what is forbidden
+ * marked as such), then constraints, questions, exclusions (which need
+ * authority), duplicates pointing at their first occurrence, and how much is
+ * context. Every line carries its anchor so the document can be opened to it;
+ * every requirement and constraint carries where it stands against the
+ * repository, when that was measured.
+ */
+export declare function renderSource(detail: SourceDetail): string[];
+/**
+ * What is covered and by whom, as a person reads it: what NOBODY serves first,
+ * then what is served but not yet evidenced, then partial, then evidenced —
+ * each with its anchor and the goals that name it. Nothing here counts a
+ * finished queue as coverage.
+ */
+export declare function renderCoverage(c: SourceCoverage): string[];
+export declare function nodeSourceDeps(): SourceCmdDeps;
+//# sourceMappingURL=source-cmd.d.ts.map

package/dist/source-cmd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-cmd.d.ts","sourceRoot":"","sources":["../src/source-cmd.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EAIrB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EAAiD,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,eAAO,MAAM,YAAY,+4BAQxB,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,IAAI;;;;;;;CAOP,CAAC;AAEX,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,WAAW,YAAY;IAC3B,YAAY,CACV,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,UAAU,CAAC;QACjB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACzC,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACA,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,eAAe,EAAE,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5E,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzE,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,WAAW,EAAE,CAAA;KAAE,GACjF,OAAO,CAAC;QAAE,YAAY,EAAE,WAAW,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC1G,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvE,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC9B,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7B,YAAY,CAAC,EAAE,SAAS;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACjE,GACA,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC7D;AAED,6DAA6D;AAC7D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvF,YAAY,EAAE,mBAAmB,EAAE,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,8CAA8C;AAC9C,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,YAAY,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvF,kGAAkG;IAClG,YAAY,EAAE,WAAW,EAAE,CAAC;CAC7B;AAED,oGAAoG;AACpG,MAAM,MAAM,WAAW,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,oDAAoD;IACpD,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC3C,mDAAmD;IACnD,SAAS,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,UAAU,CAAC;IAChD,uEAAuE;IACvE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IACxD,QAAQ,EAAE,MAAM,QAAQ,CAAC;IACzB,gGAAgG;IAChG,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,YAAY,CAAC;IAC3D,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,6GAA6G;IAC7G,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,WAAW,CAAC;CACjI;AAED,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAOzG;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxF;AAyID,4FAA4F;AAC5F,wBAAgB,WAAW,CAAC,CAAC,EAAE,eAAe,GAAG,MAAM,CAGtD;AAOD,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAyBvD;AAED,6GAA6G;AAC7G,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAM7E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CA4E3D;AAuFD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,EAAE,CA0C1D;AAsKD,wBAAgB,cAAc,IAAI,aAAa,CA2B9C"}