oh-my-super-agent 0.1.0

package/dist/src/security/secret-scan.js

@@ -0,0 +1,384 @@
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { assertOpaqueId } from "../domain/records.js";
+import { assertFileInside, openStableDirectory, readImmutableFile, writeImmutableFile, } from "../evidence/immutable-file.js";
+import { findPackageRoot } from "../package-root.js";
+import { runProcess } from "../providers/process.js";
+import { canonicalTimestamp } from "../queue/model.js";
+import { createStableId } from "../runtime/stable-id.js";
+import { isRecord, readJsonFileNoFollow, validateExistingDirectory } from "../utils/fs.js";
+const MAX_SCANNER_OUTPUT_BYTES = 64 * 1024;
+const MAX_EVIDENCE_BYTES = 64 * 1024 * 1024;
+const SHA_PATTERN = /^[a-f0-9]{40}(?:[a-f0-9]{24})?$/u;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/u;
+export function runSecretScan(options) {
+    const packageRoot = validateExistingDirectory(options.packageRoot ?? findPackageRoot(), "package root");
+    const stateRoot = validateExistingDirectory(options.stateRoot, "OMS state root");
+    const worktreeRoot = validateExistingDirectory(options.worktreeRoot, "secret scan worktree root");
+    const evidenceRoot = validateExistingDirectory(join(stateRoot, "evidence"), "secret scan evidence root");
+    const ticketId = assertOpaqueId(options.ticketId, "secret scan ticket id");
+    const baseCommit = assertCommit(options.baseCommit, "secret scan base commit");
+    const verifiedCommit = assertCommit(options.verifiedCommit, "secret scan verified commit");
+    const policy = readSecretScanPolicy(packageRoot);
+    const configurationSha256 = sha256(canonicalJson(policy));
+    const outbound = canonicalJson(options.outbound);
+    const scanId = createStableId("secret-scan", ticketId, options.phase, baseCommit, verifiedCommit, sha256(outbound), configurationSha256);
+    const existing = readSecretScanIfExists(stateRoot, scanId);
+    if (existing)
+        return existing;
+    const runner = options.runner ?? runProcess;
+    const env = scannerEnvironment(options.env ?? process.env);
+    const version = run(runner, {
+        command: policy.scanner,
+        args: ["version"],
+        cwd: worktreeRoot,
+        env,
+        timeoutMs: 10_000,
+        maxBufferBytes: MAX_SCANNER_OUTPUT_BYTES,
+    }, "secret scanner version");
+    const scannerVersion = `${version.stdout}\n${version.stderr}`.trim().replace(/^v/u, "");
+    if (scannerVersion !== policy.version) {
+        throw new Error(`secret scanner version must be exactly ${policy.version}`);
+    }
+    const reportPath = join(stateRoot, "secret-scan", `${scanId}.report.json`);
+    const scopes = [
+        scanScope({
+            scope: "commit-range",
+            inputSha256: sha256(`${baseCommit}\0${verifiedCommit}`),
+            request: scannerRequest(policy, worktreeRoot, [
+                "git",
+                "--no-banner",
+                "--no-color",
+                "--redact=100",
+                "--report-format=json",
+                "--report-path",
+                reportPath,
+                `--log-opts=${baseCommit}..${verifiedCommit}`,
+                worktreeRoot,
+            ], env),
+            runner,
+            reportPath,
+        }),
+        scanScope({
+            scope: "tracked-worktree",
+            inputSha256: gitTreeDigest(worktreeRoot, verifiedCommit, env, runner),
+            request: scannerRequest(policy, worktreeRoot, [
+                "dir",
+                "--no-banner",
+                "--no-color",
+                "--redact=100",
+                "--report-format=json",
+                "--report-path",
+                reportPath,
+                worktreeRoot,
+            ], env),
+            runner,
+            reportPath,
+        }),
+        scanScope({
+            scope: "evidence",
+            inputSha256: directoryDigest(evidenceRoot),
+            request: scannerRequest(policy, worktreeRoot, [
+                "dir",
+                "--no-banner",
+                "--no-color",
+                "--redact=100",
+                "--report-format=json",
+                "--report-path",
+                reportPath,
+                evidenceRoot,
+            ], env),
+            runner,
+            reportPath,
+        }),
+        scanScope({
+            scope: "outbound",
+            inputSha256: sha256(outbound),
+            request: {
+                ...scannerRequest(policy, worktreeRoot, [
+                    "stdin",
+                    "--no-banner",
+                    "--no-color",
+                    "--redact=100",
+                    "--report-format=json",
+                    "--report-path",
+                    reportPath,
+                ], env),
+                input: outbound,
+            },
+            runner,
+            reportPath,
+        }),
+    ];
+    const result = Object.freeze({
+        schema_version: 1,
+        scan_id: scanId,
+        ticket_id: ticketId,
+        phase: options.phase,
+        scanner: "gitleaks",
+        scanner_version: scannerVersion,
+        configuration_sha256: configurationSha256,
+        base_commit: baseCommit,
+        verified_commit: verifiedCommit,
+        scopes: Object.freeze(scopes),
+        passed: scopes.every((scope) => scope.passed),
+        created_at: canonicalTimestamp((options.clock ?? (() => new Date().toISOString()))(), "secret scan timestamp"),
+    });
+    const stored = writeSecretScan(stateRoot, result);
+    if (!stored.result.passed)
+        throw new Error("secret scan rejected the review delivery inputs");
+    return stored;
+}
+export function readSecretScan(stateRoot, reference) {
+    const scanId = assertOpaqueId(reference.scan_id, "secret scan id");
+    if (reference.file_name !== `${scanId}.json` || !SHA256_PATTERN.test(reference.sha256)) {
+        throw new Error("invalid secret scan reference");
+    }
+    const root = openStableDirectory(join(validateExistingDirectory(stateRoot, "OMS state root"), "secret-scan"), "secret scan records root");
+    try {
+        const path = join(root.path, reference.file_name);
+        assertFileInside(root, path);
+        const bytes = readImmutableFile(path, 256 * 1024);
+        if (sha256(bytes) !== reference.sha256)
+            throw new Error("secret scan record digest mismatch");
+        const result = parseSecretScan(parseJson(bytes));
+        if (result.scan_id !== scanId)
+            throw new Error("secret scan reference has the wrong id");
+        return result;
+    }
+    finally {
+        root.close();
+    }
+}
+function readSecretScanIfExists(stateRoot, scanId) {
+    const path = join(stateRoot, "secret-scan", `${scanId}.json`);
+    if (!existsSync(path))
+        return undefined;
+    const bytes = readImmutableFile(path, 256 * 1024);
+    const result = parseSecretScan(parseJson(bytes));
+    if (!result.passed)
+        throw new Error("stored secret scan rejected the review delivery inputs");
+    return Object.freeze({
+        reference: Object.freeze({ scan_id: result.scan_id, sha256: sha256(bytes), file_name: `${result.scan_id}.json` }),
+        result,
+    });
+}
+function writeSecretScan(stateRoot, result) {
+    const root = openStableDirectory(join(stateRoot, "secret-scan"), "secret scan records root");
+    try {
+        const fileName = `${result.scan_id}.json`;
+        const path = join(root.path, fileName);
+        assertFileInside(root, path);
+        const bytes = Buffer.from(`${canonicalJson(result)}\n`, "utf8");
+        writeImmutableFile(path, bytes);
+        const storedBytes = readImmutableFile(path, 256 * 1024);
+        const stored = parseSecretScan(parseJson(storedBytes));
+        return Object.freeze({
+            reference: Object.freeze({ scan_id: stored.scan_id, sha256: sha256(storedBytes), file_name: fileName }),
+            result: stored,
+        });
+    }
+    finally {
+        root.close();
+    }
+}
+function scanScope(options) {
+    removeReport(options.reportPath);
+    let result;
+    try {
+        result = options.runner(options.request);
+    }
+    finally {
+        removeReport(options.reportPath);
+    }
+    if (result.error || result.signal !== null || (result.status !== 0 && result.status !== 1)) {
+        throw new Error(`secret scanner ${options.scope} failed to run`);
+    }
+    return Object.freeze({
+        scope: options.scope,
+        input_sha256: options.inputSha256,
+        argv_sha256: sha256(canonicalJson({ command: options.request.command, args: options.request.args })),
+        passed: result.status === 0,
+    });
+}
+function scannerRequest(policy, cwd, args, env) {
+    if (args.includes("--verbose") || args.some((argument) => argument.startsWith("--redact=") && argument !== `--redact=${policy.redaction_percent}`)) {
+        throw new Error("secret scanner request would expose raw findings");
+    }
+    return Object.freeze({
+        command: policy.scanner,
+        args: Object.freeze([...args]),
+        cwd,
+        env,
+        timeoutMs: 120_000,
+        maxBufferBytes: MAX_SCANNER_OUTPUT_BYTES,
+    });
+}
+function gitTreeDigest(cwd, commit, env, runner) {
+    const result = run(runner, {
+        command: "git",
+        args: ["rev-parse", `${commit}^{tree}`],
+        cwd,
+        env,
+        timeoutMs: 10_000,
+        maxBufferBytes: MAX_SCANNER_OUTPUT_BYTES,
+    }, "secret scan git tree");
+    const tree = result.stdout.trim();
+    if (!SHA_PATTERN.test(tree))
+        throw new Error("secret scan git tree returned an invalid object id");
+    return sha256(`${commit}\0${tree}`);
+}
+function directoryDigest(rootPath) {
+    const root = openStableDirectory(rootPath, "secret scan digest root");
+    try {
+        const hash = createHash("sha256");
+        let bytesRead = 0;
+        for (const entry of readdirSync(root.path, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name))) {
+            if (!entry.isFile() || !/^[a-z0-9][a-z0-9.-]{0,132}\.json$/u.test(entry.name)) {
+                throw new Error(`unsafe secret scan evidence entry: ${entry.name}`);
+            }
+            const bytes = readImmutableFile(join(root.path, entry.name), MAX_EVIDENCE_BYTES);
+            bytesRead += bytes.byteLength;
+            if (bytesRead > MAX_EVIDENCE_BYTES)
+                throw new Error("secret scan evidence exceeds its aggregate limit");
+            hash.update(entry.name).update("\0").update(sha256(bytes)).update("\0");
+        }
+        root.assertUnchanged();
+        return hash.digest("hex");
+    }
+    finally {
+        root.close();
+    }
+}
+export function readSecretScanPolicy(packageRoot) {
+    const value = readJsonFileNoFollow(join(packageRoot, ".agents", "config", "secret-scan-policy.json"), 16 * 1024);
+    if (!isRecord(value) || Object.keys(value).sort().join("\0") !== [
+        "configuration",
+        "redaction_percent",
+        "scanner",
+        "schema_version",
+        "version",
+    ].join("\0") || value.schema_version !== 1 || value.scanner !== "gitleaks" || value.configuration !== "builtin-default"
+        || value.redaction_percent !== 100 || typeof value.version !== "string" || !/^[0-9]+\.[0-9]+\.[0-9]+$/u.test(value.version)) {
+        throw new Error("invalid secret scan policy");
+    }
+    return Object.freeze({
+        schema_version: 1,
+        scanner: "gitleaks",
+        version: value.version,
+        configuration: "builtin-default",
+        redaction_percent: 100,
+    });
+}
+function parseSecretScan(value) {
+    if (!isRecord(value) || Object.keys(value).sort().join("\0") !== [
+        "base_commit",
+        "configuration_sha256",
+        "created_at",
+        "passed",
+        "phase",
+        "scan_id",
+        "scanner",
+        "scanner_version",
+        "schema_version",
+        "scopes",
+        "ticket_id",
+        "verified_commit",
+    ].join("\0"))
+        throw new Error("invalid secret scan record");
+    if (value.schema_version !== 1
+        || value.scanner !== "gitleaks"
+        || (value.phase !== "preflight" && value.phase !== "final")
+        || typeof value.scanner_version !== "string"
+        || !SHA256_PATTERN.test(String(value.configuration_sha256))
+        || typeof value.passed !== "boolean"
+        || !Array.isArray(value.scopes)
+        || value.scopes.length !== 4)
+        throw new Error("invalid secret scan record");
+    const scopes = value.scopes.map((scope) => {
+        if (!isRecord(scope) || Object.keys(scope).sort().join("\0") !== "argv_sha256\0input_sha256\0passed\0scope") {
+            throw new Error("invalid secret scan scope");
+        }
+        if (!["commit-range", "tracked-worktree", "evidence", "outbound"].includes(String(scope.scope))
+            || !SHA256_PATTERN.test(String(scope.input_sha256)) || !SHA256_PATTERN.test(String(scope.argv_sha256))
+            || typeof scope.passed !== "boolean")
+            throw new Error("invalid secret scan scope");
+        return Object.freeze({
+            scope: scope.scope,
+            input_sha256: String(scope.input_sha256),
+            argv_sha256: String(scope.argv_sha256),
+            passed: scope.passed,
+        });
+    });
+    if (scopes.map((scope) => scope.scope).join("\0") !== "commit-range\0tracked-worktree\0evidence\0outbound") {
+        throw new Error("secret scan scopes are out of order");
+    }
+    if (value.passed !== scopes.every((scope) => scope.passed))
+        throw new Error("secret scan outcome is inconsistent");
+    const scanId = assertOpaqueId(value.scan_id, "secret scan id");
+    const ticketId = assertOpaqueId(value.ticket_id, "secret scan ticket id");
+    const baseCommit = assertCommit(value.base_commit, "secret scan base commit");
+    const verifiedCommit = assertCommit(value.verified_commit, "secret scan verified commit");
+    const configurationSha256 = String(value.configuration_sha256);
+    const expectedScanId = createStableId("secret-scan", ticketId, value.phase, baseCommit, verifiedCommit, scopes[3].input_sha256, configurationSha256);
+    if (scanId !== expectedScanId)
+        throw new Error("secret scan id does not match its bound inputs");
+    return Object.freeze({
+        schema_version: 1,
+        scan_id: scanId,
+        ticket_id: ticketId,
+        phase: value.phase,
+        scanner: "gitleaks",
+        scanner_version: value.scanner_version,
+        configuration_sha256: configurationSha256,
+        base_commit: baseCommit,
+        verified_commit: verifiedCommit,
+        scopes: Object.freeze(scopes),
+        passed: value.passed,
+        created_at: canonicalTimestamp(String(value.created_at), "secret scan timestamp"),
+    });
+}
+function scannerEnvironment(input) {
+    const env = {};
+    for (const key of ["PATH", "HOME", "TMPDIR", "LANG", "NO_COLOR"])
+        if (input[key] !== undefined)
+            env[key] = input[key];
+    return env;
+}
+function run(runner, request, label) {
+    const result = runner(request);
+    if (result.error || result.status !== 0 || result.signal !== null)
+        throw new Error(`${label} failed`);
+    return result;
+}
+function removeReport(path) {
+    if (existsSync(path))
+        unlinkSync(path);
+}
+function assertCommit(value, label) {
+    if (typeof value !== "string" || !SHA_PATTERN.test(value))
+        throw new Error(`invalid ${label}`);
+    return value;
+}
+function canonicalJson(value) {
+    if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (!isRecord(value))
+        throw new Error("secret scan input must be JSON data");
+    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+function parseJson(bytes) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        throw new Error("invalid secret scan JSON");
+    }
+}
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/src/security/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../../src/security/secret-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAA2C,MAAM,yBAAyB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3C,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,WAAW,GAAG,kCAAkC,CAAC;AACvD,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAoCzC,MAAM,UAAU,aAAa,CAAC,OAY7B;IACC,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,CAAC,WAAW,IAAI,eAAe,EAAE,EAAE,cAAc,CAAC,CAAC;IACxG,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACjF,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,2BAA2B,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,cAAc,EAAE,6BAA6B,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,cAAc,CAC3B,aAAa,EACb,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,UAAU,EACV,cAAc,EACd,MAAM,CAAC,QAAQ,CAAC,EAChB,mBAAmB,CACpB,CAAC;IACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC;IAC5C,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,CAAC,SAAS,CAAC;QACjB,GAAG,EAAE,YAAY;QACjB,GAAG;QACH,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,wBAAwB;KACzC,EAAE,wBAAwB,CAAC,CAAC;IAC7B,MAAM,cAAc,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxF,IAAI,cAAc,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG;QACb,SAAS,CAAC;YACR,KAAK,EAAE,cAAc;YACrB,WAAW,EAAE,MAAM,CAAC,GAAG,UAAU,KAAK,cAAc,EAAE,CAAC;YACvD,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE;gBAC5C,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,cAAc;gBACd,sBAAsB;gBACtB,eAAe;gBACf,UAAU;gBACV,cAAc,UAAU,KAAK,cAAc,EAAE;gBAC7C,YAAY;aACb,EAAE,GAAG,CAAC;YACP,MAAM;YACN,UAAU;SACX,CAAC;QACF,SAAS,CAAC;YACR,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC;YACrE,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE;gBAC5C,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,cAAc;gBACd,sBAAsB;gBACtB,eAAe;gBACf,UAAU;gBACV,YAAY;aACb,EAAE,GAAG,CAAC;YACP,MAAM;YACN,UAAU;SACX,CAAC;QACF,SAAS,CAAC;YACR,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,eAAe,CAAC,YAAY,CAAC;YAC1C,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE;gBAC5C,KAAK;gBACL,aAAa;gBACb,YAAY;gBACZ,cAAc;gBACd,sBAAsB;gBACtB,eAAe;gBACf,UAAU;gBACV,YAAY;aACb,EAAE,GAAG,CAAC;YACP,MAAM;YACN,UAAU;SACX,CAAC;QACF,SAAS,CAAC;YACR,KAAK,EAAE,UAAU;YACjB,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE;gBACP,GAAG,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE;oBACtC,OAAO;oBACP,aAAa;oBACb,YAAY;oBACZ,cAAc;oBACd,sBAAsB;oBACtB,eAAe;oBACf,UAAU;iBACX,EAAE,GAAG,CAAC;gBACP,KAAK,EAAE,QAAQ;aAChB;YACD,MAAM;YACN,UAAU;SACX,CAAC;KACM,CAAC;IAEX,MAAM,MAAM,GAAqB,MAAM,CAAC,MAAM,CAAC;QAC7C,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,UAAU;QACnB,eAAe,EAAE,cAAc;QAC/B,oBAAoB,EAAE,mBAAmB;QACzC,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7C,UAAU,EAAE,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,uBAAuB,CAAC;KAC/G,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,SAA8B;IAC9E,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,SAAS,KAAK,GAAG,MAAM,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAC9B,IAAI,CAAC,yBAAyB,CAAC,SAAS,EAAE,gBAAgB,CAAC,EAAE,aAAa,CAAC,EAC3E,0BAA0B,CAC3B,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAClD,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;QAClD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAAiB,EACjB,MAAc;IAEd,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,OAAO,OAAO,EAAE,CAAC;QACjH,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,SAAiB,EACjB,MAAwB;IAExB,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,OAAO,OAAO,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChE,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YACvG,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,OAMlB;IACC,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,MAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CACrB,MAAwB,EACxB,GAAW,EACX,IAAuB,EACvB,GAAsB;IAEtB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,QAAQ,KAAK,YAAY,MAAM,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QACnJ,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,GAAG;QACH,GAAG;QACH,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,wBAAwB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,MAAc,EAAE,GAAsB,EAAE,MAAqB;IAC/F,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE;QACzB,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,MAAM,SAAS,CAAC;QACvC,GAAG;QACH,GAAG;QACH,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,wBAAwB;KACzC,EAAE,sBAAsB,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC,GAAG,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC/H,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACjF,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC;YAC9B,IAAI,SAAS,GAAG,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACxG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,yBAAyB,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IACjH,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAC/D,eAAe;QACf,mBAAmB;QACnB,SAAS;QACT,gBAAgB;QAChB,SAAS;KACV,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,KAAK,CAAC,aAAa,KAAK,iBAAiB;WAClH,KAAK,CAAC,iBAAiB,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,iBAAiB;QAChC,iBAAiB,EAAE,GAAG;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAC/D,aAAa;QACb,sBAAsB;QACtB,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,SAAS;QACT,SAAS;QACT,iBAAiB;QACjB,gBAAgB;QAChB,QAAQ;QACR,WAAW;QACX,iBAAiB;KAClB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,IACE,KAAK,CAAC,cAAc,KAAK,CAAC;WACvB,KAAK,CAAC,OAAO,KAAK,UAAU;WAC5B,CAAC,KAAK,CAAC,KAAK,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC;WACxD,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ;WACzC,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;WACxD,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;WACjC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;WAC5B,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,0CAA0C,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,CAAC,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;eAC1F,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;eACnG,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACrF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,KAAoD;YACjE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;YACxC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,oDAAoD,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;IAC1F,MAAM,mBAAmB,GAAG,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,cAAc,CACnC,aAAa,EACb,QAAQ,EACR,KAAK,CAAC,KAAK,EACX,UAAU,EACV,cAAc,EACd,MAAM,CAAC,CAAC,CAAE,CAAC,YAAY,EACvB,mBAAmB,CACpB,CAAC;IACF,IAAI,MAAM,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,cAAc,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM;QACf,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,UAAU;QACnB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,oBAAoB,EAAE,mBAAmB;QACzC,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC;KAClF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAwB;IAClD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC;QAAE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACtH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,MAAqB,EAAE,OAAuB,EAAE,KAAa;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,KAAa;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC7E,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACxH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/src/sessions/registry.d.ts

@@ -0,0 +1,89 @@
+import { type RuntimeRecord } from "../domain/records.js";
+import { type Engine, type RoleId, type TrackedRolePolicyGate } from "../domain/role-policy.js";
+import { type TransitionResult } from "../runtime/record-store.js";
+import { type RuntimeComposition } from "../runtime/composition.js";
+declare const SESSION_REGISTRY: unique symbol;
+export type SessionState = "running" | "parked" | "stalled" | "stopped";
+export type SessionMode = "pane" | "goal" | "exec";
+export type SessionPayload = Record<string, unknown> & {
+    session_id: string;
+    role_id: RoleId;
+    engine: Engine;
+    mode: SessionMode;
+    transport: "claude_interactive" | "codex_goal" | "codex_exec";
+    run_id: string | null;
+    ticket_id: string | null;
+    native_session_ref: string;
+    provider_native_session_sha256: string | null;
+    tmux_pane_id: string | null;
+    policy_version: 2;
+    policy_digest: string;
+    started_at: string;
+    last_observed_at: string;
+    heartbeat_deadline_at: string | null;
+    parked_until: string | null;
+    stop_reason: string | null;
+    ended_at: string | null;
+    source_event_id: string;
+    last_event_id: string;
+};
+export type SessionRecord = RuntimeRecord<SessionState, SessionPayload>;
+export interface RegisterSessionInput {
+    readonly sessionId: string;
+    readonly roleId: string;
+    readonly engine: Engine;
+    readonly mode: SessionMode;
+    readonly runId: string | null;
+    readonly ticketId: string | null;
+    readonly nativeSessionRef: string;
+    readonly tmuxPaneId: string | null;
+    readonly actorId: string;
+    readonly sourceEventId: string;
+    readonly observedAt: string;
+    readonly heartbeatDeadlineAt: string;
+}
+export interface SessionMutationInput {
+    readonly sessionId: string;
+    readonly operationId: string;
+    readonly actorId: string;
+    readonly eventId: string;
+    readonly observedAt: string;
+    readonly expectedVersion: number;
+}
+export interface SessionRegistry {
+    readonly [SESSION_REGISTRY]: true;
+    register(input: RegisterSessionInput): Readonly<{
+        status: "created" | "replayed";
+        record: SessionRecord;
+    }>;
+    heartbeat(input: SessionMutationInput & {
+        heartbeatDeadlineAt: string;
+    }): TransitionResult<SessionState, SessionPayload>;
+    bindNativeSession(input: SessionMutationInput & {
+        nativeSessionSha256: string;
+        heartbeatDeadlineAt: string;
+    }): TransitionResult<SessionState, SessionPayload>;
+    park(input: SessionMutationInput & {
+        parkedUntil: string;
+    }): TransitionResult<SessionState, SessionPayload>;
+    resume(input: SessionMutationInput & {
+        heartbeatDeadlineAt: string;
+    }): TransitionResult<SessionState, SessionPayload>;
+    markStalled(input: SessionMutationInput): TransitionResult<SessionState, SessionPayload>;
+    stop(input: SessionMutationInput & {
+        reason: string;
+    }): TransitionResult<SessionState, SessionPayload>;
+    read(sessionId: string): SessionRecord;
+    readIfExists(sessionId: string): SessionRecord | undefined;
+    list(): readonly SessionRecord[];
+}
+export declare function createSessionRegistry(options: {
+    recordsRoot: string;
+    locksRoot: string;
+    packageRoot: string;
+    policyRoot: string;
+    policyGate: TrackedRolePolicyGate;
+    composition?: RuntimeComposition;
+}): SessionRegistry;
+export declare function assertSessionRegistry(value: unknown): asserts value is SessionRegistry;
+export {};