npm - open-multi-agent-kit - Versions diffs - 0.80.7 → 0.80.8 - Mend

open-multi-agent-kit 0.80.7 → 0.80.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1470) hide show

package/dist/core/package-procurement.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"package-procurement.js","sourceRoot":"","sources":["../../src/core/package-procurement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA+G9C,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAChC,2FAA2F,CAAC;AAE7F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACzB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,SAAS;IACT,QAAQ;IACR,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAOlD,MAAM,UAAU,uBAAuB,CAAC,OAA2B,EAAqB;IACvF,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,KAAK,cAAc,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,+BAA+B,EAAE,CAAC;AAAA,CAC3F;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,0DAA0D,CAAC;AAIpF,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAkB;IACpE,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,mCAAmC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAAA,CACjC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAOvH,MAAM,UAAU,cAAc,CAAC,GAAuB,EAAE,cAAuB,EAAiB;IAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,KAAK,uBAAuB,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,KAAK,+CAA+C,EAAE,CAAC;IAC9G,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,KAAK,wCAAwC,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,MAAM,qBAAqB,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAAA,CAC9D;AAYD,MAAM,UAAU,kBAAkB,CAAC,KAA4B,EAAuB;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,EAAE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,OAAO,SAAS,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvD,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,YAAY,CAAC,OAAO;aAC7B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM;IACN,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE;YACxD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9B;AAED,SAAS,cAAc,CAAC,IAAY,EAAuD;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,CACnE;AAsBD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,cAAc;IACd,cAAc;IACd,YAAY;IACZ,MAAM;IACN,WAAW;IACX,SAAS;IACT,eAAe;IACf,MAAM;IACN,YAAY;IACZ,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3G,SAAS,UAAU,CAAC,OAAe,EAAU;IAC5C,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAyB;IACnF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,OAAO,eAAe,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAwB;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,YAAY,GACjB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9B,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;IAE/G,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,iBAAiB,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,+EAA+E;IAC/E,IACC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QACvC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EACnE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,eAAe,KAAK,iBAAiB,IAAI,eAAe,KAAK,kBAAkB,EAAE,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAClE;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACxD,YAAY;IACZ,SAAS;IACT,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,UAAU;CACV,CAAC;AAqBF,MAAM,UAAU,wBAAwB,CAAC,KAA2B,EAA0B;IAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAAA,CAC5D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAClC,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE,CAAC,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,IAAI,OAAO,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,eAAe,CAAC,EAAE,CAAC;QAChE,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE;gBACR,eAAe;oBACd,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,2DAA2D;aAC9D;SACD,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,MAAM;QACf,eAAe,EAAE,QAAQ;QACzB,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,CAAC,oDAAoD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AA2BD,MAAM,mBAAmB,GAAkB;IAC1C,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE;IACtE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE;IAC7E,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAC/E,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE;IACxF,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACvE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAChG,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;CACtE,CAAC;AAEF,SAAS,aAAa,CAAC,OAAqB,EAAE,KAAoB,EAAiB;IAClF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAClC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAA2B;IACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE5D,IAAI,OAA0B,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,cAAc,CAAC;IAC1B,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QACnB,wFAAwF;QACxF,OAAO,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,CAC7B;AAWD,MAAM,gBAAgB,GAAkB;IACvC,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC9F,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrF;QACC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,6DAA6D;KACtE;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACpG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,sDAAsD,EAAE;IAC5G;QACC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4EAA4E;KACrF;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iFAAiF;KAC1F;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACtG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAC7G,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACtF,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9E,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAClE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE;IAClF,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC5E,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAChG,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACnG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACnE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACjG,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAE;CACjH,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAAwB;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,CAClC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAoB;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACtG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/C,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9D;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAyB,EAAE,EAAa;IAClF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAChH,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACvD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,OAAO,CAAC,CAAY,EAAE,CAAY,EAAa;IACvD,MAAM,IAAI,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAClC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,SAAS,CACxB,YAAsB,EACtB,cAA2B,EAC3B,gBAA6B,EAC7B,UAAiC,EACrB;IACZ,IAAI,IAAI,GAAc,KAAK,CAAC;IAC5B,IACC,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACxE,CAAC;QACF,IAAI,GAAG,MAAM,CAAC;IACf,CAAC;SAAM,IACN,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC1E,CAAC;QACF,IAAI,GAAG,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;AAAA,CACxD;AAyBD,SAAS,eAAe,CAAC,WAAwB,EAAY;IAC5D,QAAQ,WAAW,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY;YAChB,OAAO,QAAQ,CAAC;QACjB,KAAK,iBAAiB;YACrB,OAAO,iBAAiB,CAAC;QAC1B,KAAK,iBAAiB;YACrB,OAAO,mBAAmB,CAAC;QAC5B,KAAK,WAAW;YACf,OAAO,gBAAgB,CAAC;QACzB,KAAK,UAAU;YACd,OAAO,eAAe,CAAC;QACxB,KAAK,aAAa;YACjB,OAAO,aAAa,CAAC;QACtB,KAAK,mBAAmB;YACvB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,MAAsB,EAAE,eAAe,GAAa,EAAE,EAAoB;IAC3F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,CACvG;AAED,SAAS,gBAAgB,CAAC,KAAoB,EAA6B;IAC1E,OAAO,KAAK,CAAC,aAAa,CAAC;AAAA,CAC3B;AAED,SAAS,oBAAoB,CAAC,MAAuC,EAAW;IAC/E,OAAO,OAAO,CACb,MAAM,EAAE,UAAU,KAAK,IAAI;QAC1B,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,MAAM,CAAC,aAAa,KAAK,IAAI;QAC7B,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAClC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB,EAAoB;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClB,IACC,IAAI,KAAK,QAAQ;YACjB,IAAI,KAAK,gBAAgB;YACzB,IAAI,KAAK,eAAe;YACxB,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,mBAAmB,EAC3B,CAAC;YACF,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,iBAAiB,KAAK,cAAc;YAAE,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC5F,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,cAAc,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IAED,IACC,MAAM,EAAE,WAAW,KAAK,eAAe;QACvC,IAAI,KAAK,mBAAmB;QAC5B,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,EACzC,CAAC;QACF,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,IACC,KAAK,CAAC,cAAc,KAAK,QAAQ;YACjC,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YACnC,KAAK,CAAC,iBAAiB,KAAK,SAAS,EACpC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAAA,CACjE;AAwCD,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAqB;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,SAAS,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,iBAAiB,EAAE,MAAM,CAAC,uBAAuB;QACjD,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACrD,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACrC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,IAAI,GACT,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAClH,MAAM,aAAa,GAClB,MAAM,CAAC,aAAa;QACpB,SAAS,CAAC,aAAa;QACvB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa;QACb,OAAO,EAAE,SAAS,CAAC,OAAO;KAC1B,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO;QACN,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC7C,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,qBAAqB,EAAE,OAAO,CAAC,cAAc;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,wBAAwB,EAAE,SAAS,CAAC,eAAe;QACnD,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,qBAAqB,EAAE,aAAa,CAAC,QAAQ;QAC7C,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,kBAAkB,EAAE,YAAY,CAAC,QAAQ;QACzC,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7F,iBAAiB,EAAE,UAAU,CAAC,OAAO;QACrC,cAAc;QACd,eAAe;KACf,CAAC;AAAA,CACF;AAmBD,SAAS,iBAAiB,CACzB,MAAyB,EACzB,MAAsB,EACtB,cAAsB,EACF;IACpB,OAAO;QACN,GAAG,MAAM;QACT,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,MAAM;QACtB,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KAC5D,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,MAAyB,EAAW;IAC9D,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC;AAAA,CACtE;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA4B,EAA0B;IAC3F,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC/B,SAAS;YACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK;YAC/C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,GAAG,EAAE,KAAK,CAAC,GAAG;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC;QACrC,IAAI,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,eAAe,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,KAAK,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;AAAA,CACzD;AAED,SAAS,cAAc,CAAC,UAA4B,EAAU;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAAA,CACnD","sourcesContent":["/*\n Package procurement / exact-pin gate.\n \n Pure, native-only procurement algorithms for OMK package adoption. None of these\n * functions install, fetch, clone, spawn, or touch the filesystem/network. They take\n * already-supplied source-review inputs (manifest fields, license metadata, source\n * text) and return advisory verdicts so an external installer never runs against an\n * unvetted, mutable, or copyleft-contaminated source.\n \n Implements PR A from .omk/runs/omk-pi-package-hardening-plan/{procurement.md,algorithm-plan.md}:\n * - exact npm semver validation (shared pattern with scripts/check-pinned-deps.mjs)\n * - mutable range/tag/branch rejection\n * - candidate input normalization to a canonical pinned source string\n * - license verdict gate (permissive / weak / strong / network copyleft / unknown)\n * - lifecycle-script gate (fail-closed; reviewed allowlist exception only)\n * - .pi/.omk compatibility scan over provided source text\n * - source capability scan (credential reads, sockets, network, exec, fs writes)\n * - risk/adoption decision matrix\n /\n\nimport { parseGitUrl } from \"../utils/git.ts\";\n\n// ---------------------------------------------------------------------------\n// Shared types\n// ---------------------------------------------------------------------------\n\nexport type IntendedUse =\n\t\| \"native\"\n\t\| \"vendor\"\n\t\| \"ephemeral-adopt\"\n\t\| \"permanent-adopt\"\n\t\| \"theme-port\"\n\t\| \"reference\"\n\t\| \"advisory\"\n\t\| \"report-only\"\n\t\| \"measurement-gated\";\nexport type DeclaredUse =\n\t\| \"sandbox\"\n\t\| \"loadout\"\n\t\| \"checkpoint\"\n\t\| \"observability\"\n\t\| \"advisor\"\n\t\| \"quality\"\n\t\| \"memory\"\n\t\| \"workflow-reference\"\n\t\| \"cache-perf\";\nexport type ResourceKind = \"extension\" \| \"skill\" \| \"prompt\" \| \"theme\" \| \"tool\";\nexport type RiskLevel = \"low\" \| \"medium\" \| \"high\";\nexport type GateVerdict = \"pass\" \| \"review\" \| \"reject\";\nexport type PathCompatibility = \"omk-native\" \| \"pi-hardcoded\" \| \"unknown\";\nexport type Adoption =\n\t\| \"native\"\n\t\| \"vendor\"\n\t\| \"ephemeral-trial\"\n\t\| \"permanent-package\"\n\t\| \"reference-only\"\n\t\| \"advisory-only\"\n\t\| \"report-only\"\n\t\| \"measurement-gated\"\n\t\| \"deferred\"\n\t\| \"reject\";\nexport type DeferredReason =\n\t\| \"missing-exact-pin\"\n\t\| \"pending-native-spec\"\n\t\| \"pending-metrics\"\n\t\| \"pending-export-policy\"\n\t\| \"group-excluded\"\n\t\| \"pending-identity-reconciliation\"\n\t\| \"pending-advisory-spec\"\n\t\| \"pending-measurement-plan\"\n\t\| \"pending-sandbox-backend\";\nexport type LifecycleAllowlistMode = \"exact\" \| \"identity\";\nexport type SandboxBackend = \"seatbelt\" \| \"bubblewrap\" \| \"none\";\nexport type MutationMode = \"report-only\";\n\nexport interface NativeSpecPrecondition {\n\texists: boolean;\n\ttrackId?: string;\n\tspecPath?: string;\n}\n\nexport interface MaintainerTrustInput {\n\tscope?: string;\n\tverifiedPublisher?: boolean;\n\taccountAgeDays?: number;\n}\n\nexport interface ExportPolicyOverlay {\n\tdefaultOff: boolean;\n\tofflineDisables: boolean;\n\tdenyRawPrompt: boolean;\n\tdenyRawToolOutput: boolean;\n\tpayloadTier?: \"metadata\" \| \"summary\" \| \"full\";\n}\n\nexport interface PolicyOverlay {\n\tdeclaredUse: DeclaredUse;\n\tsandboxBackend?: SandboxBackend;\n\texportPolicy?: ExportPolicyOverlay;\n\tmutationMode?: MutationMode;\n\tadvisoryOnly?: boolean;\n\treplayInput?: boolean;\n\tactivateAlongsideScheduler?: boolean;\n}\n\nexport interface CandidatePackageInput {\n\tname: string;\n\texactVersion?: string;\n\tgitRepo?: string;\n\tgitRef?: string;\n\t/* Reviewed full commit SHA used to anchor an otherwise-mutable tag. /\n\tresolvedCommit?: string;\n\tintendedUse: IntendedUse;\n\tdeclaredUse?: DeclaredUse;\n\texpectedResources: ResourceKind[];\n\tallowLifecycleScripts?: boolean;\n\trisk?: RiskLevel;\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n\texcludeGroup?: string;\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tmaintainer?: MaintainerTrustInput;\n}\n\nexport interface SourceText {\n\tpath?: string;\n\ttext: string;\n}\n\n// ---------------------------------------------------------------------------\n// Exact npm version validation\n// ---------------------------------------------------------------------------\n\n/* Exact semver shape, identical to scripts/check-pinned-deps.mjs. /\nexport const EXACT_SEMVER_PATTERN =\n\t/^(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;\n\nconst DIST_TAGS = new Set([\n\t\"latest\",\n\t\"next\",\n\t\"beta\",\n\t\"alpha\",\n\t\"canary\",\n\t\"rc\",\n\t\"dev\",\n\t\"nightly\",\n\t\"stable\",\n\t\"experimental\",\n\t\"insiders\",\n]);\n\n// whitespace, range operators (^ ~ > < = ), or a standalone wildcard x/X\nconst RANGE_INDICATOR = /[\\s^~><=\|]\|\\bx\\b\|\\bX\\b/;\n\nexport type NpmVersionRejectReason = \"missing\" \| \"dist-tag\" \| \"range\" \| \"invalid\";\nexport type NpmVersionVerdict =\n\t\| { ok: true; version: string }\n\t\| { ok: false; reason: NpmVersionRejectReason; message: string };\n\nexport function validateExactNpmVersion(version: string \| undefined): NpmVersionVerdict {\n\tconst value = (version ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"exact version is required\" };\n\t}\n\tif (DIST_TAGS.has(value.toLowerCase())) {\n\t\treturn { ok: false, reason: \"dist-tag\", message: `dist-tag \"${value}\" is mutable` };\n\t}\n\tif (EXACT_SEMVER_PATTERN.test(value)) {\n\t\treturn { ok: true, version: value };\n\t}\n\tif (RANGE_INDICATOR.test(value)) {\n\t\treturn { ok: false, reason: \"range\", message: `range/wildcard \"${value}\" is not an exact version` };\n\t}\n\treturn { ok: false, reason: \"invalid\", message: `\"${value}\" is not a valid exact semver` };\n}\n\n// ---------------------------------------------------------------------------\n// npm package name validation\n// ---------------------------------------------------------------------------\n\nconst NPM_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]\\/)?[a-z0-9-~][a-z0-9-._~]$/;\n\nexport type NpmNameVerdict = { ok: true; name: string } \| { ok: false; message: string };\n\nexport function validateNpmPackageName(name: string): NpmNameVerdict {\n\tconst value = (name ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, message: \"package name is required\" };\n\t}\n\tif (value.length > 214) {\n\t\treturn { ok: false, message: \"package name exceeds 214 characters\" };\n\t}\n\tif (value !== value.toLowerCase()) {\n\t\treturn { ok: false, message: \"package name must be lowercase\" };\n\t}\n\tif (value.includes(\"..\")) {\n\t\treturn { ok: false, message: \"package name must not contain path traversal\" };\n\t}\n\tif (!NPM_NAME_PATTERN.test(value)) {\n\t\treturn { ok: false, message: `\"${value}\" is not a valid npm package name` };\n\t}\n\treturn { ok: true, name: value };\n}\n\n// ---------------------------------------------------------------------------\n// git ref validation\n// ---------------------------------------------------------------------------\n\nconst FULL_SHA = /^(?:[0-9a-f]{40}\|[0-9a-f]{64})$/;\nconst HEX_ONLY = /^[0-9a-f]+$/;\nconst MUTABLE_BRANCHES = new Set([\"main\", \"master\", \"develop\", \"dev\", \"trunk\", \"head\", \"release\", \"stable\", \"latest\"]);\n\nexport type GitRefRejectReason = \"missing\" \| \"mutable-branch\" \| \"short-sha\" \| \"unresolved-tag\" \| \"invalid\";\nexport type GitRefVerdict =\n\t\| { ok: true; ref: string; commit: string; kind: \"commit\" \| \"resolved-tag\" }\n\t\| { ok: false; reason: GitRefRejectReason; message: string };\n\nexport function validateGitRef(ref: string \| undefined, resolvedCommit?: string): GitRefVerdict {\n\tconst value = (ref ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"git ref is required\" };\n\t}\n\tif (FULL_SHA.test(value)) {\n\t\treturn { ok: true, ref: value, commit: value, kind: \"commit\" };\n\t}\n\n\tconst lower = value.toLowerCase();\n\tif (MUTABLE_BRANCHES.has(lower) \|\| value === \"HEAD\" \|\| value.startsWith(\"refs/heads/\")) {\n\t\treturn { ok: false, reason: \"mutable-branch\", message: `\"${value}\" is a mutable branch` };\n\t}\n\tif (HEX_ONLY.test(lower) && lower.length < 40) {\n\t\treturn { ok: false, reason: \"short-sha\", message: `\"${value}\" is an abbreviated commit; full SHA required` };\n\t}\n\n\t// Treat anything else as a tag: immutable only when anchored to a reviewed full commit.\n\tconst commit = (resolvedCommit ?? \"\").trim();\n\tif (!commit) {\n\t\treturn { ok: false, reason: \"unresolved-tag\", message: `tag \"${value}\" needs a reviewed resolved commit SHA` };\n\t}\n\tif (!FULL_SHA.test(commit)) {\n\t\treturn { ok: false, reason: \"invalid\", message: `resolvedCommit \"${commit}\" is not a full SHA` };\n\t}\n\treturn { ok: true, ref: value, commit, kind: \"resolved-tag\" };\n}\n\n// ---------------------------------------------------------------------------\n// Candidate normalization\n// ---------------------------------------------------------------------------\n\nexport type NormalizedSource =\n\t\| { ok: true; kind: \"npm\"; source: string; name: string; version: string }\n\t\| { ok: true; kind: \"git\"; source: string; repo: string; host: string; path: string; ref: string; commit: string };\n\nexport type NormalizedCandidate = NormalizedSource \| { ok: false; reasons: string[] };\n\nexport function normalizeCandidate(input: CandidatePackageInput): NormalizedCandidate {\n\tconst reasons: string[] = [];\n\tconst hasNpm = Boolean(input.exactVersion);\n\tconst hasGit = Boolean(input.gitRepo \|\| input.gitRef);\n\n\tif (hasNpm && hasGit) {\n\t\treasons.push(\"ambiguous-source: provide either an npm exactVersion or a git repo+ref, not both\");\n\t\treturn { ok: false, reasons };\n\t}\n\tif (!hasNpm && !hasGit) {\n\t\treasons.push(\"missing-source: provide exactVersion (npm) or gitRepo+gitRef (git)\");\n\t\treturn { ok: false, reasons };\n\t}\n\n\tif (hasNpm) {\n\t\tconst nameCheck = validateNpmPackageName(input.name);\n\t\tif (!nameCheck.ok) reasons.push(`invalid-npm-name: ${nameCheck.message}`);\n\t\tconst versionCheck = validateExactNpmVersion(input.exactVersion);\n\t\tif (!versionCheck.ok) reasons.push(`version: ${versionCheck.message}`);\n\t\tif (nameCheck.ok && versionCheck.ok) {\n\t\t\treturn {\n\t\t\t\tok: true,\n\t\t\t\tkind: \"npm\",\n\t\t\t\tsource: `npm:${nameCheck.name}@${versionCheck.version}`,\n\t\t\t\tname: nameCheck.name,\n\t\t\t\tversion: versionCheck.version,\n\t\t\t};\n\t\t}\n\t\treturn { ok: false, reasons };\n\t}\n\n\t// git\n\tconst git = resolveGitRepo(input.gitRepo ?? \"\");\n\tif (!git) reasons.push(\"invalid-git-repo: could not parse a host/org/repo from gitRepo\");\n\tconst refCheck = validateGitRef(input.gitRef, input.resolvedCommit);\n\tif (!refCheck.ok) reasons.push(`git-ref: ${refCheck.message}`);\n\tif (git && refCheck.ok) {\n\t\treturn {\n\t\t\tok: true,\n\t\t\tkind: \"git\",\n\t\t\tsource: `git:${git.host}/${git.path}@${refCheck.commit}`,\n\t\t\trepo: git.repo,\n\t\t\thost: git.host,\n\t\t\tpath: git.path,\n\t\t\tref: refCheck.ref,\n\t\t\tcommit: refCheck.commit,\n\t\t};\n\t}\n\treturn { ok: false, reasons };\n}\n\nfunction resolveGitRepo(repo: string): { repo: string; host: string; path: string } \| null {\n\tconst trimmed = repo.trim();\n\tif (!trimmed) return null;\n\tconst parsed = parseGitUrl(trimmed) ?? parseGitUrl(`git:${trimmed}`);\n\tif (!parsed) return null;\n\treturn { repo: parsed.repo, host: parsed.host, path: parsed.path };\n}\n\n// ---------------------------------------------------------------------------\n// License gate\n// ---------------------------------------------------------------------------\n\nexport type LicenseClassification = \"permissive\" \| \"weak-copyleft\" \| \"strong-copyleft\" \| \"network-copyleft\" \| \"unknown\";\n\nexport interface LicenseInput {\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tintendedUse: IntendedUse;\n}\n\nexport interface LicenseVerdictResult {\n\tverdict: GateVerdict;\n\tclassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\treasons: string[];\n}\n\nconst PERMISSIVE_LICENSES = new Set([\n\t\"MIT\",\n\t\"MIT-0\",\n\t\"ISC\",\n\t\"BSD\",\n\t\"BSD-2-CLAUSE\",\n\t\"BSD-3-CLAUSE\",\n\t\"APACHE-2.0\",\n\t\"0BSD\",\n\t\"UNLICENSE\",\n\t\"CC0-1.0\",\n\t\"BLUEOAK-1.0.0\",\n\t\"ZLIB\",\n\t\"PYTHON-2.0\",\n\t\"WTFPL\",\n]);\n\nconst NOTICE_REQUIRED_LICENSES = new Set([\"APACHE-2.0\", \"BSD\", \"BSD-2-CLAUSE\", \"BSD-3-CLAUSE\", \"MPL-2.0\"]);\n\nfunction licenseKey(license: string): string {\n\treturn license.trim().toUpperCase().replace(/\\s+/g, \"\");\n}\n\nexport function classifyLicense(license: string \| undefined): LicenseClassification {\n\tif (!license \|\| !license.trim()) return \"unknown\";\n\tconst key = licenseKey(license);\n\tif (key.includes(\"AGPL\") \|\| key.includes(\"SSPL\")) return \"network-copyleft\";\n\tif (key.includes(\"LGPL\") \|\| key.includes(\"MPL\") \|\| key.includes(\"EPL\") \|\| key.includes(\"CDDL\")) {\n\t\treturn \"weak-copyleft\";\n\t}\n\tif (key.includes(\"GPL\")) return \"strong-copyleft\";\n\tif (PERMISSIVE_LICENSES.has(key)) return \"permissive\";\n\treturn \"unknown\";\n}\n\nexport function evaluateLicense(input: LicenseInput): LicenseVerdictResult {\n\tconst reasons: string[] = [];\n\tconst classification = classifyLicense(input.declaredLicense);\n\tconst noticeNeeded =\n\t\tBoolean(input.declaredLicense) &&\n\t\t(NOTICE_REQUIRED_LICENSES.has(licenseKey(input.declaredLicense ?? \"\")) \|\| classification === \"weak-copyleft\");\n\n\tif (classification === \"unknown\") {\n\t\treasons.push(input.declaredLicense ? `unrecognized-license: ${input.declaredLicense}` : \"missing-license\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"network-copyleft\" \|\| classification === \"strong-copyleft\") {\n\t\treasons.push(`copyleft-blocks-adoption: ${input.declaredLicense}`);\n\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"weak-copyleft\") {\n\t\treasons.push(`weak-copyleft-needs-review: ${input.declaredLicense}`);\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\n\t// Permissive: runtime/permanent adoption needs a transitive license inventory.\n\tif (\n\t\tinput.intendedUse === \"permanent-adopt\" &&\n\t\t(!input.transitiveLicenses \|\| input.transitiveLicenses.length === 0)\n\t) {\n\t\treasons.push(\"transitive-license-inventory-required\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (input.transitiveLicenses) {\n\t\tfor (const transitive of input.transitiveLicenses) {\n\t\t\tconst transitiveClass = classifyLicense(transitive);\n\t\t\tif (transitiveClass === \"strong-copyleft\" \|\| transitiveClass === \"network-copyleft\") {\n\t\t\t\treasons.push(`transitive-copyleft: ${transitive}`);\n\t\t\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t\tif (transitiveClass === \"unknown\" \|\| transitiveClass === \"weak-copyleft\") {\n\t\t\t\treasons.push(`transitive-needs-review: ${transitive}`);\n\t\t\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t}\n\t}\n\treturn { verdict: \"pass\", classification, noticeNeeded, reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Lifecycle-script gate\n// ---------------------------------------------------------------------------\n\n/** npm/pnpm/bun lifecycle hooks that run automatically during install or pack. /\nexport const LIFECYCLE_SCRIPT_NAMES: readonly string[] = [\n\t\"preinstall\",\n\t\"install\",\n\t\"postinstall\",\n\t\"preuninstall\",\n\t\"uninstall\",\n\t\"postuninstall\",\n\t\"prepare\",\n\t\"prepublish\",\n\t\"prepublishOnly\",\n\t\"prepack\",\n\t\"postpack\",\n];\n\nexport interface LifecycleScriptInput {\n\tpackageJsonScripts?: Record<string, string>;\n\tallowLifecycleScripts?: boolean;\n\treviewedAllowlist?: string[];\n\t/* Full pinned source spec, e.g. npm:pi-sandbox@0.4.3 /\n\tsource?: string;\n\t/* Identity without version/ref, e.g. npm:pi-sandbox /\n\tidentity?: string;\n\t/* Defaults to exact, matching the published shrinkwrap allowlist semantics. /\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n}\n\nexport interface LifecycleVerdictResult {\n\tverdict: GateVerdict;\n\tdeclaredScripts: string[];\n\trequiresException: boolean;\n\treasons: string[];\n}\n\nexport function evaluateLifecycleScripts(input: LifecycleScriptInput): LifecycleVerdictResult {\n\tconst scripts = input.packageJsonScripts ?? {};\n\tconst declared = LIFECYCLE_SCRIPT_NAMES.filter((name) => {\n\t\tconst value = scripts[name];\n\t\treturn typeof value === \"string\" && value.trim().length > 0;\n\t});\n\n\tif (declared.length === 0) {\n\t\treturn { verdict: \"pass\", declaredScripts: [], requiresException: false, reasons: [] };\n\t}\n\n\tif (!input.allowLifecycleScripts) {\n\t\treturn {\n\t\t\tverdict: \"reject\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [`lifecycle-scripts-present: ${declared.join(\", \")}`],\n\t\t};\n\t}\n\n\tconst allow = new Set((input.reviewedAllowlist ?? []).filter((entry) => Boolean(entry?.trim())));\n\tconst exactMatched = Boolean(input.source && allow.has(input.source));\n\tconst identityMatched = Boolean(input.identity && allow.has(input.identity));\n\tconst mode = input.lifecycleAllowlistMode ?? \"exact\";\n\tif (!exactMatched && !(mode === \"identity\" && identityMatched)) {\n\t\treturn {\n\t\t\tverdict: \"review\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [\n\t\t\t\tidentityMatched\n\t\t\t\t\t? \"lifecycle-scripts-require-exact-allowlist-entry\"\n\t\t\t\t\t: \"lifecycle-scripts-opt-in-without-reviewed-allowlist-entry\",\n\t\t\t],\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"pass\",\n\t\tdeclaredScripts: declared,\n\t\trequiresException: true,\n\t\treasons: [`lifecycle-scripts-allowed-by-reviewed-allowlist: ${declared.join(\", \")}`],\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// .pi / .omk compatibility scan\n// ---------------------------------------------------------------------------\n\nexport type FindingSeverity = \"info\" \| \"warn\" \| \"block\";\n\nexport interface ScanFinding {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpath?: string;\n\tline: number;\n\tsnippet: string;\n}\n\nexport interface CompatibilityScanResult {\n\tverdict: PathCompatibility;\n\tfindings: ScanFinding[];\n}\n\ninterface PatternRule {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpattern: RegExp;\n}\n\nconst COMPATIBILITY_RULES: PatternRule[] = [\n\t{ kind: \"pi-home-path\", severity: \"block\", pattern: /~\\/\\.pi(?:\\/\|\\b)/ },\n\t{ kind: \"pi-state-dir\", severity: \"block\", pattern: /\\.pi\\/agents\\b/ },\n\t{ kind: \"pi-project-path\", severity: \"block\", pattern: /(?:^\|[^.\\w])\\.pi\\// },\n\t{ kind: \"pi-coding-agent-path\", severity: \"block\", pattern: /pi-coding-agent/ },\n\t{ kind: \"pi-cli-invocation\", severity: \"block\", pattern: /\\bpi\\s+(?:install\|update)\\b/ },\n\t{ kind: \"pi-env\", severity: \"warn\", pattern: /\\bPI_[A-Z][A-Z0-9_]\\b/ },\n\t{ kind: \"legacy-pi-import\", severity: \"warn\", pattern: /@(?:mariozechner\|earendil-works)\\/pi-/ },\n\t{ kind: \"omk-path\", severity: \"info\", pattern: /(?:^\|[^.\\w])\\.omk\\// },\n];\n\nfunction scanWithRules(sources: SourceText[], rules: PatternRule[]): ScanFinding[] {\n\tconst findings: ScanFinding[] = [];\n\tfor (const source of sources) {\n\t\tconst lines = source.text.split(/\\r?\\n/);\n\t\tfor (let i = 0; i < lines.length; i++) {\n\t\t\tconst line = lines[i];\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (rule.pattern.test(line)) {\n\t\t\t\t\tfindings.push({\n\t\t\t\t\t\tkind: rule.kind,\n\t\t\t\t\t\tseverity: rule.severity,\n\t\t\t\t\t\tpath: source.path,\n\t\t\t\t\t\tline: i + 1,\n\t\t\t\t\t\tsnippet: line.trim().slice(0, 200),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn findings;\n}\n\nexport function scanPiOmkCompatibility(sources: SourceText[]): CompatibilityScanResult {\n\tconst findings = scanWithRules(sources, COMPATIBILITY_RULES);\n\tconst hasBlock = findings.some((f) => f.severity === \"block\");\n\tconst hasOmk = findings.some((f) => f.kind === \"omk-path\");\n\tconst hasWarn = findings.some((f) => f.severity === \"warn\");\n\n\tlet verdict: PathCompatibility;\n\tif (hasBlock) {\n\t\tverdict = \"pi-hardcoded\";\n\t} else if (hasOmk) {\n\t\t// OMK paths present and no hardcoded Pi state: legacy imports are loader-alias covered.\n\t\tverdict = \"omk-native\";\n\t} else if (hasWarn) {\n\t\tverdict = \"unknown\";\n\t} else {\n\t\tverdict = \"unknown\";\n\t}\n\treturn { verdict, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Source capability scan\n// ---------------------------------------------------------------------------\n\nexport interface CapabilityScanResult {\n\tcapabilities: string[];\n\tfindings: ScanFinding[];\n}\n\nconst CAPABILITY_RULES: PatternRule[] = [\n\t// Credential / secret file reads are the hard blocker.\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /[\"'`][^\"'`]\\.env(?:\\.[\\w-]+)?[\"'`]/ },\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /auth\\.json\|\\.npmrc\|\\.netrc/ },\n\t{\n\t\tkind: \"credential-read\",\n\t\tseverity: \"block\",\n\t\tpattern: /id_rsa\|id_ed25519\|\\.ssh\\/\|\\.aws\\/credentials\|\\.kube\\/config/,\n\t},\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /BEGIN\\s+(?:RSA\\s+\|EC\\s+\|OPENSSH\\s+)?PRIVATE\\s+KEY/ },\n\t{ kind: \"host-socket\", severity: \"block\", pattern: /\\/var\\/run\\/docker\\.sock\|dockerode\|kubeconfig/ },\n\t{ kind: \"child-process\", severity: \"warn\", pattern: /child_process\|\\bspawn\\s\\(\|\\bexec(?:Sync\|File)?\\s\\(/ },\n\t{\n\t\tkind: \"network\",\n\t\tseverity: \"warn\",\n\t\tpattern: /\\bfetch\\s\\(\\s[\"'`]?https?:\|https?\\.request\|node-fetch\|axios\|undici\|got\\(/,\n\t},\n\t{\n\t\tkind: \"filesystem-write\",\n\t\tseverity: \"warn\",\n\t\tpattern: /writeFileSync\|appendFileSync\|\\bfs\\.(?:write\|append)\|rmSync\|unlinkSync\|mkdirSync/,\n\t},\n\t{ kind: \"browser-control\", severity: \"warn\", pattern: /puppeteer\|playwright\|chrome-devtools\|:9222\\b/ },\n\t{ kind: \"telemetry\", severity: \"warn\", pattern: /\\btelemetry\\b\|posthog\|segment\\.io\|@braintrust\|analytics\\b/ },\n\t{ kind: \"setFooter\", severity: \"info\", pattern: /\\bsetFooter\\s\\(/ },\n\t{ kind: \"setHeader\", severity: \"info\", pattern: /\\bsetHeader\\s\\(/ },\n\t{ kind: \"setEditorComponent\", severity: \"info\", pattern: /\\bsetEditorComponent\\s\\(/ },\n\t{ kind: \"setStatus\", severity: \"info\", pattern: /\\bsetStatus\\s\\(/ },\n\t{ kind: \"setActiveTools\", severity: \"info\", pattern: /\\bsetActiveTools\\s\\(/ },\n\t{ kind: \"setModel\", severity: \"warn\", pattern: /\\bsetModel\\s\\(/ },\n\t{ kind: \"setThinkingLevel\", severity: \"warn\", pattern: /\\bsetThinkingLevel\\s\\(/ },\n\t{ kind: \"renderCall\", severity: \"info\", pattern: /\\brenderCall\\s[:(]/ },\n\t{ kind: \"renderResult\", severity: \"info\", pattern: /\\brenderResult\\s[:(]/ },\n\t{ kind: \"registerMessageRenderer\", severity: \"info\", pattern: /\\bregisterMessageRenderer\\s\\(/ },\n\t{ kind: \"before_provider_request\", severity: \"warn\", pattern: /[\"'`]before_provider_request[\"'`]/ },\n\t{ kind: \"context\", severity: \"warn\", pattern: /[\"'`]context[\"'`]/ },\n\t{ kind: \"session_before_compact\", severity: \"warn\", pattern: /[\"'`]session_before_compact[\"'`]/ },\n\t{ kind: \"env-secret-access\", severity: \"info\", pattern: /process\\.env\\.[A-Z0-9_](?:TOKEN\|SECRET\|KEY\|PASSWORD)/ },\n];\n\nexport function scanSourceCapabilities(sources: SourceText[]): CapabilityScanResult {\n\tconst findings = scanWithRules(sources, CAPABILITY_RULES);\n\tconst capabilities = [...new Set(findings.map((f) => f.kind))];\n\treturn { capabilities, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Release-age and maintainer trust gates\n// ---------------------------------------------------------------------------\n\nexport type ReleaseAgeVerdict = \"pass\" \| \"review\" \| \"defer\";\n\nexport interface ReleaseAgeInput {\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tnow?: Date;\n}\n\nexport interface ReleaseAgeResult {\n\tverdict: ReleaseAgeVerdict;\n\treason?: string;\n\tageDays?: number;\n}\n\nexport function evaluateReleaseAge(input: ReleaseAgeInput): ReleaseAgeResult {\n\tconst minAge = input.minReleaseAgeDays ?? 0;\n\tif (minAge <= 0) return { verdict: \"pass\", reason: \"release-age-not-required\" };\n\tif (!input.publishedAt) return { verdict: \"review\", reason: \"release-age-published-at-missing\" };\n\tconst published = Date.parse(input.publishedAt);\n\tif (Number.isNaN(published)) return { verdict: \"review\", reason: \"release-age-invalid-published-at\" };\n\tconst now = input.now?.getTime() ?? Date.now();\n\tconst ageDays = (now - published) / 86_400_000;\n\tif (ageDays < minAge) {\n\t\treturn { verdict: \"defer\", reason: `release-age-below-${minAge}-days`, ageDays };\n\t}\n\treturn { verdict: \"pass\", reason: \"release-age-ok\", ageDays };\n}\n\nexport function assessMaintainerTrust(input: MaintainerTrustInput = {}): RiskLevel {\n\tif (input.verifiedPublisher === true) return \"low\";\n\tif (input.verifiedPublisher === false && (input.accountAgeDays ?? Number.POSITIVE_INFINITY) < 60) return \"high\";\n\tif (input.verifiedPublisher === false) return \"medium\";\n\treturn \"low\";\n}\n\nfunction maxRisk(a: RiskLevel, b: RiskLevel): RiskLevel {\n\tconst rank: Record<RiskLevel, number> = { low: 0, medium: 1, high: 2 };\n\treturn rank[a] >= rank[b] ? a : b;\n}\n\n// ---------------------------------------------------------------------------\n// Risk inference\n// ---------------------------------------------------------------------------\n\nconst HIGH_RISK_CAPABILITIES = new Set([\"credential-read\", \"host-socket\"]);\nconst MEDIUM_RISK_CAPABILITIES = new Set([\"child-process\", \"network\", \"browser-control\"]);\n\nexport function inferRisk(\n\tcapabilities: string[],\n\tlicenseVerdict: GateVerdict,\n\tlifecycleVerdict: GateVerdict,\n\tmaintainer?: MaintainerTrustInput,\n): RiskLevel {\n\tlet risk: RiskLevel = \"low\";\n\tif (\n\t\tlicenseVerdict === \"reject\" \|\|\n\t\tlifecycleVerdict === \"reject\" \|\|\n\t\tcapabilities.some((capability) => HIGH_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"high\";\n\t} else if (\n\t\tlicenseVerdict === \"review\" \|\|\n\t\tlifecycleVerdict === \"review\" \|\|\n\t\tcapabilities.some((capability) => MEDIUM_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"medium\";\n\t}\n\treturn maxRisk(risk, assessMaintainerTrust(maintainer));\n}\n\n// ---------------------------------------------------------------------------\n// Adoption decision matrix\n// ---------------------------------------------------------------------------\n\nexport interface AdoptionInput {\n\tintendedUse: IntendedUse;\n\trisk: RiskLevel;\n\tpinOk: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlifecycleVerdict: GateVerdict;\n\tpathCompatibility: PathCompatibility;\n\tcapabilities: string[];\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n}\n\nexport interface AdoptionDecision {\n\tadoption: Adoption;\n\trejectedReasons: string[];\n\tdeferredReason?: DeferredReason;\n}\n\nfunction baseAdoptionFor(intendedUse: IntendedUse): Adoption {\n\tswitch (intendedUse) {\n\t\tcase \"native\":\n\t\t\treturn \"native\";\n\t\tcase \"vendor\":\n\t\tcase \"theme-port\":\n\t\t\treturn \"vendor\";\n\t\tcase \"ephemeral-adopt\":\n\t\t\treturn \"ephemeral-trial\";\n\t\tcase \"permanent-adopt\":\n\t\t\treturn \"permanent-package\";\n\t\tcase \"reference\":\n\t\t\treturn \"reference-only\";\n\t\tcase \"advisory\":\n\t\t\treturn \"advisory-only\";\n\t\tcase \"report-only\":\n\t\t\treturn \"report-only\";\n\t\tcase \"measurement-gated\":\n\t\t\treturn \"measurement-gated\";\n\t}\n}\n\nfunction deferred(reason: DeferredReason, rejectedReasons: string[] = []): AdoptionDecision {\n\treturn { adoption: \"deferred\", deferredReason: reason, rejectedReasons: [reason, ...rejectedReasons] };\n}\n\nfunction policyOverlayFor(input: AdoptionInput): PolicyOverlay \| undefined {\n\treturn input.policyOverlay;\n}\n\nfunction hasValidExportPolicy(policy: ExportPolicyOverlay \| undefined): boolean {\n\treturn Boolean(\n\t\tpolicy?.defaultOff === true &&\n\t\t\tpolicy.offlineDisables === true &&\n\t\t\tpolicy.denyRawPrompt === true &&\n\t\t\tpolicy.denyRawToolOutput === true,\n\t);\n}\n\nexport function decideAdoption(input: AdoptionInput): AdoptionDecision {\n\tconst reasons: string[] = [];\n\tconst base = baseAdoptionFor(input.intendedUse);\n\tconst policy = policyOverlayFor(input);\n\n\tif (!input.pinOk) {\n\t\tif (\n\t\t\tbase === \"native\" \|\|\n\t\t\tbase === \"reference-only\" \|\|\n\t\t\tbase === \"advisory-only\" \|\|\n\t\t\tbase === \"report-only\" \|\|\n\t\t\tbase === \"measurement-gated\"\n\t\t) {\n\t\t\treturn deferred(\"missing-exact-pin\");\n\t\t}\n\t\treasons.push(\"exact-pin-required\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"native\") {\n\t\tif (input.nativeSpec?.exists === false) return deferred(\"pending-native-spec\");\n\t\tif (input.capabilities.includes(\"credential-read\")) reasons.push(\"reads-credentials-upstream\");\n\t\tif (input.licenseVerdict === \"reject\") reasons.push(\"license-blocked-upstream\");\n\t\tif (input.lifecycleVerdict === \"reject\") reasons.push(\"lifecycle-scripts-blocked-upstream\");\n\t\tif (input.pathCompatibility === \"pi-hardcoded\") reasons.push(\"pi-hardcoded-paths-upstream\");\n\t\tif (policy?.declaredUse === \"sandbox\" && !policy.sandboxBackend) return deferred(\"pending-sandbox-backend\");\n\t\tif (policy?.declaredUse === \"sandbox\") reasons.push(\"sandbox-risk-floor-high\");\n\t\treturn { adoption: \"native\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"memory\" && input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"memory-credential-read-rejected\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"reads-credentials\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.licenseVerdict === \"reject\") {\n\t\treasons.push(\"license-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.lifecycleVerdict === \"reject\") {\n\t\treasons.push(\"lifecycle-scripts-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.pathCompatibility === \"pi-hardcoded\") {\n\t\treasons.push(\"pi-hardcoded-paths\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"workflow-reference\") {\n\t\tif (policy.activateAlongsideScheduler === true) {\n\t\t\treturn { adoption: \"reject\", rejectedReasons: [\"scheduler-coexistence-denied\"] };\n\t\t}\n\t\treturn { adoption: \"reference-only\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"sandbox\") {\n\t\tif (!policy.sandboxBackend) {\n\t\t\treasons.push(\"sandbox-requires-backend\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\treasons.push(\"sandbox-risk-floor-high\");\n\t}\n\n\tif (\n\t\tpolicy?.declaredUse === \"observability\" &&\n\t\tbase === \"permanent-package\" &&\n\t\t!hasValidExportPolicy(policy.exportPolicy)\n\t) {\n\t\treturn deferred(\"pending-export-policy\");\n\t}\n\n\tif (policy?.declaredUse === \"advisor\" \|\| policy?.declaredUse === \"quality\") {\n\t\tif (input.capabilities.includes(\"filesystem-write\") \|\| input.capabilities.includes(\"child-process\")) {\n\t\t\treasons.push(\"report-only-mutation-denied\");\n\t\t}\n\t\treturn { adoption: \"report-only\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"measurement-gated\") {\n\t\tif (!input.metrics \|\| input.metrics.length === 0) return deferred(\"pending-metrics\");\n\t\treturn { adoption: \"measurement-gated\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"reference-only\" \|\| base === \"advisory-only\" \|\| base === \"report-only\") {\n\t\treturn { adoption: base, rejectedReasons: reasons };\n\t}\n\n\tif (base === \"permanent-package\") {\n\t\tif (input.risk === \"high\") {\n\t\t\treasons.push(\"high-risk-permanent-blocked\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\tif (\n\t\t\tinput.licenseVerdict === \"review\" \|\|\n\t\t\tinput.lifecycleVerdict === \"review\" \|\|\n\t\t\tinput.pathCompatibility === \"unknown\"\n\t\t) {\n\t\t\treasons.push(\"needs-review-before-permanent\");\n\t\t\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n\t\t}\n\t\treturn { adoption: \"permanent-package\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"vendor\") {\n\t\tif (input.licenseVerdict === \"review\") reasons.push(\"license-review-before-vendor\");\n\t\treturn { adoption: \"vendor\", rejectedReasons: reasons };\n\t}\n\n\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Top-level procurement review\n// ---------------------------------------------------------------------------\n\nexport interface ProcurementReviewInputs {\n\tcandidate: CandidatePackageInput;\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tpolicyOverlay?: PolicyOverlay;\n\tnow?: Date;\n}\n\nexport interface ProcurementReview {\n\tcandidate: CandidatePackageInput;\n\tnormalized: NormalizedSource \| null;\n\tpinned: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlicenseClassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\tlifecycleVerdict: GateVerdict;\n\tdeclaredLifecycleScripts: string[];\n\tpathCompatibility: PathCompatibility;\n\tcompatibilityFindings: ScanFinding[];\n\tcapabilities: string[];\n\tcapabilityFindings: ScanFinding[];\n\trisk: RiskLevel;\n\tadoption: Adoption;\n\tdeferredReason?: DeferredReason;\n\treleaseAgeVerdict: ReleaseAgeVerdict;\n\tmaintainerRisk: RiskLevel;\n\trejectedReasons: string[];\n}\n\nexport function procureCandidate(inputs: ProcurementReviewInputs): ProcurementReview {\n\tconst candidate = inputs.candidate;\n\tconst normalized = normalizeCandidate(candidate);\n\tconst pinned = normalized.ok;\n\n\tconst license = evaluateLicense({\n\t\tdeclaredLicense: inputs.declaredLicense,\n\t\tlicenseFiles: inputs.licenseFiles,\n\t\ttransitiveLicenses: inputs.transitiveLicenses,\n\t\tintendedUse: candidate.intendedUse,\n\t});\n\n\tconst lifecycle = evaluateLifecycleScripts({\n\t\tpackageJsonScripts: inputs.packageJsonScripts,\n\t\tallowLifecycleScripts: candidate.allowLifecycleScripts,\n\t\treviewedAllowlist: inputs.reviewedScriptAllowlist,\n\t\tsource: normalized.ok ? normalized.source : undefined,\n\t\tidentity: normalized.ok ? sourceIdentity(normalized) : undefined,\n\t\tlifecycleAllowlistMode: inputs.lifecycleAllowlistMode,\n\t});\n\n\tconst sources = inputs.sources ?? [];\n\tconst compatibility = scanPiOmkCompatibility(sources);\n\tconst capabilities = scanSourceCapabilities(sources);\n\tconst releaseAge = evaluateReleaseAge({\n\t\tpublishedAt: candidate.publishedAt,\n\t\tminReleaseAgeDays: candidate.minReleaseAgeDays,\n\t\tnow: inputs.now,\n\t});\n\tconst maintainerRisk = assessMaintainerTrust(candidate.maintainer);\n\tconst risk =\n\t\tcandidate.risk ?? inferRisk(capabilities.capabilities, license.verdict, lifecycle.verdict, candidate.maintainer);\n\tconst policyOverlay =\n\t\tinputs.policyOverlay ??\n\t\tcandidate.policyOverlay ??\n\t\t(candidate.declaredUse === undefined ? undefined : { declaredUse: candidate.declaredUse });\n\n\tconst decision = decideAdoption({\n\t\tintendedUse: candidate.intendedUse,\n\t\trisk,\n\t\tpinOk: pinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcapabilities: capabilities.capabilities,\n\t\tnativeSpec: candidate.nativeSpec,\n\t\tpolicyOverlay,\n\t\tmetrics: candidate.metrics,\n\t});\n\n\tconst rejectedReasons = [...decision.rejectedReasons];\n\tif (!normalized.ok) {\n\t\trejectedReasons.push(...normalized.reasons);\n\t}\n\n\treturn {\n\t\tcandidate,\n\t\tnormalized: normalized.ok ? normalized : null,\n\t\tpinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlicenseClassification: license.classification,\n\t\tnoticeNeeded: license.noticeNeeded,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tdeclaredLifecycleScripts: lifecycle.declaredScripts,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcompatibilityFindings: compatibility.findings,\n\t\tcapabilities: capabilities.capabilities,\n\t\tcapabilityFindings: capabilities.findings,\n\t\trisk,\n\t\tadoption: decision.adoption,\n\t\t...(decision.deferredReason === undefined ? {} : { deferredReason: decision.deferredReason }),\n\t\treleaseAgeVerdict: releaseAge.verdict,\n\t\tmaintainerRisk,\n\t\trejectedReasons,\n\t};\n}\n\nexport interface ProcurementBatchInput {\n\tcandidates: readonly CandidatePackageInput[];\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tnow?: Date;\n}\n\nexport interface ProcurementBatchResult {\n\tcoverage: ProcurementReview[];\n\tglobalBlockers: string[];\n\tselectedByGroup: Record<string, string>;\n}\n\nfunction withBatchDeferral(\n\treview: ProcurementReview,\n\treason: DeferredReason,\n\trejectedReason: string,\n): ProcurementReview {\n\treturn {\n\t\t...review,\n\t\tadoption: \"deferred\",\n\t\tdeferredReason: reason,\n\t\trejectedReasons: [...review.rejectedReasons, rejectedReason],\n\t};\n}\n\nfunction isAdoptedForGroup(review: ProcurementReview): boolean {\n\treturn review.adoption !== \"reject\" && review.adoption !== \"deferred\";\n}\n\nexport function procureCandidateBatch(input: ProcurementBatchInput): ProcurementBatchResult {\n\tconst selectedByGroup: Record<string, string> = {};\n\tconst coverage: ProcurementReview[] = [];\n\tfor (const candidate of input.candidates) {\n\t\tconst review = procureCandidate({\n\t\t\tcandidate,\n\t\t\tpackageJsonScripts: input.packageJsonScripts,\n\t\t\tdeclaredLicense: input.declaredLicense ?? \"MIT\",\n\t\t\ttransitiveLicenses: input.transitiveLicenses,\n\t\t\tsources: input.sources,\n\t\t\treviewedScriptAllowlist: input.reviewedScriptAllowlist,\n\t\t\tlifecycleAllowlistMode: input.lifecycleAllowlistMode,\n\t\t\tnow: input.now,\n\t\t});\n\t\tconst group = candidate.excludeGroup;\n\t\tif (group && isAdoptedForGroup(review)) {\n\t\t\tif (selectedByGroup[group] === undefined) {\n\t\t\t\tselectedByGroup[group] = candidate.name;\n\t\t\t\tcoverage.push(review);\n\t\t\t} else {\n\t\t\t\tcoverage.push(withBatchDeferral(review, \"group-excluded\", `group-exclusion: ${group}`));\n\t\t\t}\n\t\t} else {\n\t\t\tcoverage.push(review);\n\t\t}\n\t}\n\treturn { coverage, globalBlockers: [], selectedByGroup };\n}\n\nfunction sourceIdentity(normalized: NormalizedSource): string {\n\tif (normalized.kind === \"npm\") {\n\t\treturn `npm:${normalized.name}`;\n\t}\n\treturn `git:${normalized.host}/${normalized.path}`;\n}\n"]}
1	+ {"version":3,"file":"package-procurement.js","sourceRoot":"","sources":["../../src/core/package-procurement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA+G9C,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAChC,2FAA2F,CAAC;AAE7F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACzB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,SAAS;IACT,QAAQ;IACR,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAOlD,MAAM,UAAU,uBAAuB,CAAC,OAA2B,EAAqB;IACvF,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,KAAK,cAAc,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,+BAA+B,EAAE,CAAC;AAAA,CAC3F;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,0DAA0D,CAAC;AAIpF,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAkB;IACpE,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,mCAAmC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAAA,CACjC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAOvH,MAAM,UAAU,cAAc,CAAC,GAAuB,EAAE,cAAuB,EAAiB;IAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,KAAK,uBAAuB,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,KAAK,+CAA+C,EAAE,CAAC;IAC9G,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,KAAK,wCAAwC,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,MAAM,qBAAqB,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAAA,CAC9D;AAYD,MAAM,UAAU,kBAAkB,CAAC,KAA4B,EAAuB;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,EAAE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,OAAO,SAAS,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvD,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,YAAY,CAAC,OAAO;aAC7B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM;IACN,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE;YACxD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9B;AAED,SAAS,cAAc,CAAC,IAAY,EAAuD;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,CACnE;AAsBD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,cAAc;IACd,cAAc;IACd,YAAY;IACZ,MAAM;IACN,WAAW;IACX,SAAS;IACT,eAAe;IACf,MAAM;IACN,YAAY;IACZ,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3G,SAAS,UAAU,CAAC,OAAe,EAAU;IAC5C,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAyB;IACnF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,OAAO,eAAe,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAwB;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,YAAY,GACjB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9B,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;IAE/G,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,iBAAiB,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,+EAA+E;IAC/E,IACC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QACvC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EACnE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,eAAe,KAAK,iBAAiB,IAAI,eAAe,KAAK,kBAAkB,EAAE,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAClE;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACxD,YAAY;IACZ,SAAS;IACT,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,UAAU;CACV,CAAC;AAqBF,MAAM,UAAU,wBAAwB,CAAC,KAA2B,EAA0B;IAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAAA,CAC5D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAClC,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE,CAAC,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,IAAI,OAAO,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,eAAe,CAAC,EAAE,CAAC;QAChE,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE;gBACR,eAAe;oBACd,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,2DAA2D;aAC9D;SACD,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,MAAM;QACf,eAAe,EAAE,QAAQ;QACzB,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,CAAC,oDAAoD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AA2BD,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,mBAAmB,GAAkB;IAC1C;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,OAAO,GAAG,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA,WAAW,EAAE,CAAC;KAC5F;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI,GAAG,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA,YAAY,EAAE,CAAC;KAC1F;IACD;QACC,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,gBAAgB,GAAG,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI,EAAE,CAAC;KAC9F;IACD,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAC9E,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC5F,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAC3E,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC9F,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;CACtE,CAAC;AAEF,SAAS,aAAa,CAAC,OAAqB,EAAE,KAAoB,EAAiB;IAClF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAClC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAqB,EAA2B;IAC1F,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE5D,IAAI,OAA0B,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,kBAAkB,CAAC;IAC9B,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QACnB,OAAO,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,CAC7B;AAWD,MAAM,gBAAgB,GAAkB;IACvC,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC9F,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrF;QACC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,6DAA6D;KACtE;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACpG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,sDAAsD,EAAE;IAC5G;QACC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4EAA4E;KACrF;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iFAAiF;KAC1F;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACtG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAC7G,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACtF,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9E,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAClE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE;IAClF,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC5E,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAChG,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACnG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACnE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACjG,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAE;CACjH,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAAwB;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,CAClC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAoB;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACtG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/C,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9D;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAyB,EAAE,EAAa;IAClF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAChH,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACvD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,OAAO,CAAC,CAAY,EAAE,CAAY,EAAa;IACvD,MAAM,IAAI,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAClC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,SAAS,CACxB,YAAsB,EACtB,cAA2B,EAC3B,gBAA6B,EAC7B,UAAiC,EACrB;IACZ,IAAI,IAAI,GAAc,KAAK,CAAC;IAC5B,IACC,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACxE,CAAC;QACF,IAAI,GAAG,MAAM,CAAC;IACf,CAAC;SAAM,IACN,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC1E,CAAC;QACF,IAAI,GAAG,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;AAAA,CACxD;AAyBD,SAAS,eAAe,CAAC,WAAwB,EAAY;IAC5D,QAAQ,WAAW,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY;YAChB,OAAO,QAAQ,CAAC;QACjB,KAAK,iBAAiB;YACrB,OAAO,iBAAiB,CAAC;QAC1B,KAAK,iBAAiB;YACrB,OAAO,mBAAmB,CAAC;QAC5B,KAAK,WAAW;YACf,OAAO,gBAAgB,CAAC;QACzB,KAAK,UAAU;YACd,OAAO,eAAe,CAAC;QACxB,KAAK,aAAa;YACjB,OAAO,aAAa,CAAC;QACtB,KAAK,mBAAmB;YACvB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,MAAsB,EAAE,eAAe,GAAa,EAAE,EAAoB;IAC3F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,CACvG;AAED,SAAS,gBAAgB,CAAC,KAAoB,EAA6B;IAC1E,OAAO,KAAK,CAAC,aAAa,CAAC;AAAA,CAC3B;AAED,SAAS,oBAAoB,CAAC,MAAuC,EAAW;IAC/E,OAAO,OAAO,CACb,MAAM,EAAE,UAAU,KAAK,IAAI;QAC1B,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,MAAM,CAAC,aAAa,KAAK,IAAI;QAC7B,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAClC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB,EAAoB;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClB,IACC,IAAI,KAAK,QAAQ;YACjB,IAAI,KAAK,gBAAgB;YACzB,IAAI,KAAK,eAAe;YACxB,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,mBAAmB,EAC3B,CAAC;YACF,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,iBAAiB,KAAK,kBAAkB;YAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpG,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,kBAAkB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IAED,IACC,MAAM,EAAE,WAAW,KAAK,eAAe;QACvC,IAAI,KAAK,mBAAmB;QAC5B,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,EACzC,CAAC;QACF,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,IACC,KAAK,CAAC,cAAc,KAAK,QAAQ;YACjC,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YACnC,KAAK,CAAC,iBAAiB,KAAK,SAAS,EACpC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAAA,CACjE;AAwCD,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAqB;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,SAAS,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,iBAAiB,EAAE,MAAM,CAAC,uBAAuB;QACjD,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACrD,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACrC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,IAAI,GACT,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAClH,MAAM,aAAa,GAClB,MAAM,CAAC,aAAa;QACpB,SAAS,CAAC,aAAa;QACvB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa;QACb,OAAO,EAAE,SAAS,CAAC,OAAO;KAC1B,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO;QACN,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC7C,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,qBAAqB,EAAE,OAAO,CAAC,cAAc;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,wBAAwB,EAAE,SAAS,CAAC,eAAe;QACnD,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,qBAAqB,EAAE,aAAa,CAAC,QAAQ;QAC7C,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,kBAAkB,EAAE,YAAY,CAAC,QAAQ;QACzC,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7F,iBAAiB,EAAE,UAAU,CAAC,OAAO;QACrC,cAAc;QACd,eAAe;KACf,CAAC;AAAA,CACF;AAmBD,SAAS,iBAAiB,CACzB,MAAyB,EACzB,MAAsB,EACtB,cAAsB,EACF;IACpB,OAAO;QACN,GAAG,MAAM;QACT,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,MAAM;QACtB,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KAC5D,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,MAAyB,EAAW;IAC9D,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC;AAAA,CACtE;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA4B,EAA0B;IAC3F,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC/B,SAAS;YACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK;YAC/C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,GAAG,EAAE,KAAK,CAAC,GAAG;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC;QACrC,IAAI,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,eAAe,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,KAAK,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;AAAA,CACzD;AAED,SAAS,cAAc,CAAC,UAA4B,EAAU;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAAA,CACnD","sourcesContent":["/*\n Package procurement / exact-pin gate.\n \n Pure, native-only procurement algorithms for OMK package adoption. None of these\n * functions install, fetch, clone, spawn, or touch the filesystem/network. They take\n * already-supplied source-review inputs (manifest fields, license metadata, source\n * text) and return advisory verdicts so an external installer never runs against an\n * unvetted, mutable, or copyleft-contaminated source.\n \n Implements PR A from .omk/runs/omk-package-hardening-plan/{procurement.md,algorithm-plan.md}:\n * - exact npm semver validation (shared pattern with scripts/check-pinned-deps.mjs)\n * - mutable range/tag/branch rejection\n * - candidate input normalization to a canonical pinned source string\n * - license verdict gate (permissive / weak / strong / network copyleft / unknown)\n * - lifecycle-script gate (fail-closed; reviewed allowlist exception only)\n * - legacy/OMK compatibility scan over provided source text\n * - source capability scan (credential reads, sockets, network, exec, fs writes)\n * - risk/adoption decision matrix\n /\n\nimport { parseGitUrl } from \"../utils/git.ts\";\n\n// ---------------------------------------------------------------------------\n// Shared types\n// ---------------------------------------------------------------------------\n\nexport type IntendedUse =\n\t\| \"native\"\n\t\| \"vendor\"\n\t\| \"ephemeral-adopt\"\n\t\| \"permanent-adopt\"\n\t\| \"theme-port\"\n\t\| \"reference\"\n\t\| \"advisory\"\n\t\| \"report-only\"\n\t\| \"measurement-gated\";\nexport type DeclaredUse =\n\t\| \"sandbox\"\n\t\| \"loadout\"\n\t\| \"checkpoint\"\n\t\| \"observability\"\n\t\| \"advisor\"\n\t\| \"quality\"\n\t\| \"memory\"\n\t\| \"workflow-reference\"\n\t\| \"cache-perf\";\nexport type ResourceKind = \"extension\" \| \"skill\" \| \"prompt\" \| \"theme\" \| \"tool\";\nexport type RiskLevel = \"low\" \| \"medium\" \| \"high\";\nexport type GateVerdict = \"pass\" \| \"review\" \| \"reject\";\nexport type PathCompatibility = \"omk-native\" \| \"legacy-hardcoded\" \| \"unknown\";\nexport type Adoption =\n\t\| \"native\"\n\t\| \"vendor\"\n\t\| \"ephemeral-trial\"\n\t\| \"permanent-package\"\n\t\| \"reference-only\"\n\t\| \"advisory-only\"\n\t\| \"report-only\"\n\t\| \"measurement-gated\"\n\t\| \"deferred\"\n\t\| \"reject\";\nexport type DeferredReason =\n\t\| \"missing-exact-pin\"\n\t\| \"pending-native-spec\"\n\t\| \"pending-metrics\"\n\t\| \"pending-export-policy\"\n\t\| \"group-excluded\"\n\t\| \"pending-identity-reconciliation\"\n\t\| \"pending-advisory-spec\"\n\t\| \"pending-measurement-plan\"\n\t\| \"pending-sandbox-backend\";\nexport type LifecycleAllowlistMode = \"exact\" \| \"identity\";\nexport type SandboxBackend = \"seatbelt\" \| \"bubblewrap\" \| \"none\";\nexport type MutationMode = \"report-only\";\n\nexport interface NativeSpecPrecondition {\n\texists: boolean;\n\ttrackId?: string;\n\tspecPath?: string;\n}\n\nexport interface MaintainerTrustInput {\n\tscope?: string;\n\tverifiedPublisher?: boolean;\n\taccountAgeDays?: number;\n}\n\nexport interface ExportPolicyOverlay {\n\tdefaultOff: boolean;\n\tofflineDisables: boolean;\n\tdenyRawPrompt: boolean;\n\tdenyRawToolOutput: boolean;\n\tpayloadTier?: \"metadata\" \| \"summary\" \| \"full\";\n}\n\nexport interface PolicyOverlay {\n\tdeclaredUse: DeclaredUse;\n\tsandboxBackend?: SandboxBackend;\n\texportPolicy?: ExportPolicyOverlay;\n\tmutationMode?: MutationMode;\n\tadvisoryOnly?: boolean;\n\treplayInput?: boolean;\n\tactivateAlongsideScheduler?: boolean;\n}\n\nexport interface CandidatePackageInput {\n\tname: string;\n\texactVersion?: string;\n\tgitRepo?: string;\n\tgitRef?: string;\n\t/* Reviewed full commit SHA used to anchor an otherwise-mutable tag. /\n\tresolvedCommit?: string;\n\tintendedUse: IntendedUse;\n\tdeclaredUse?: DeclaredUse;\n\texpectedResources: ResourceKind[];\n\tallowLifecycleScripts?: boolean;\n\trisk?: RiskLevel;\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n\texcludeGroup?: string;\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tmaintainer?: MaintainerTrustInput;\n}\n\nexport interface SourceText {\n\tpath?: string;\n\ttext: string;\n}\n\n// ---------------------------------------------------------------------------\n// Exact npm version validation\n// ---------------------------------------------------------------------------\n\n/* Exact semver shape, identical to scripts/check-pinned-deps.mjs. /\nexport const EXACT_SEMVER_PATTERN =\n\t/^(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)\\.(?:0\|[1-9]\\d)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;\n\nconst DIST_TAGS = new Set([\n\t\"latest\",\n\t\"next\",\n\t\"beta\",\n\t\"alpha\",\n\t\"canary\",\n\t\"rc\",\n\t\"dev\",\n\t\"nightly\",\n\t\"stable\",\n\t\"experimental\",\n\t\"insiders\",\n]);\n\n// whitespace, range operators (^ ~ > < = ), or a standalone wildcard x/X\nconst RANGE_INDICATOR = /[\\s^~><=\|]\|\\bx\\b\|\\bX\\b/;\n\nexport type NpmVersionRejectReason = \"missing\" \| \"dist-tag\" \| \"range\" \| \"invalid\";\nexport type NpmVersionVerdict =\n\t\| { ok: true; version: string }\n\t\| { ok: false; reason: NpmVersionRejectReason; message: string };\n\nexport function validateExactNpmVersion(version: string \| undefined): NpmVersionVerdict {\n\tconst value = (version ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"exact version is required\" };\n\t}\n\tif (DIST_TAGS.has(value.toLowerCase())) {\n\t\treturn { ok: false, reason: \"dist-tag\", message: `dist-tag \"${value}\" is mutable` };\n\t}\n\tif (EXACT_SEMVER_PATTERN.test(value)) {\n\t\treturn { ok: true, version: value };\n\t}\n\tif (RANGE_INDICATOR.test(value)) {\n\t\treturn { ok: false, reason: \"range\", message: `range/wildcard \"${value}\" is not an exact version` };\n\t}\n\treturn { ok: false, reason: \"invalid\", message: `\"${value}\" is not a valid exact semver` };\n}\n\n// ---------------------------------------------------------------------------\n// npm package name validation\n// ---------------------------------------------------------------------------\n\nconst NPM_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]\\/)?[a-z0-9-~][a-z0-9-._~]$/;\n\nexport type NpmNameVerdict = { ok: true; name: string } \| { ok: false; message: string };\n\nexport function validateNpmPackageName(name: string): NpmNameVerdict {\n\tconst value = (name ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, message: \"package name is required\" };\n\t}\n\tif (value.length > 214) {\n\t\treturn { ok: false, message: \"package name exceeds 214 characters\" };\n\t}\n\tif (value !== value.toLowerCase()) {\n\t\treturn { ok: false, message: \"package name must be lowercase\" };\n\t}\n\tif (value.includes(\"..\")) {\n\t\treturn { ok: false, message: \"package name must not contain path traversal\" };\n\t}\n\tif (!NPM_NAME_PATTERN.test(value)) {\n\t\treturn { ok: false, message: `\"${value}\" is not a valid npm package name` };\n\t}\n\treturn { ok: true, name: value };\n}\n\n// ---------------------------------------------------------------------------\n// git ref validation\n// ---------------------------------------------------------------------------\n\nconst FULL_SHA = /^(?:[0-9a-f]{40}\|[0-9a-f]{64})$/;\nconst HEX_ONLY = /^[0-9a-f]+$/;\nconst MUTABLE_BRANCHES = new Set([\"main\", \"master\", \"develop\", \"dev\", \"trunk\", \"head\", \"release\", \"stable\", \"latest\"]);\n\nexport type GitRefRejectReason = \"missing\" \| \"mutable-branch\" \| \"short-sha\" \| \"unresolved-tag\" \| \"invalid\";\nexport type GitRefVerdict =\n\t\| { ok: true; ref: string; commit: string; kind: \"commit\" \| \"resolved-tag\" }\n\t\| { ok: false; reason: GitRefRejectReason; message: string };\n\nexport function validateGitRef(ref: string \| undefined, resolvedCommit?: string): GitRefVerdict {\n\tconst value = (ref ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"git ref is required\" };\n\t}\n\tif (FULL_SHA.test(value)) {\n\t\treturn { ok: true, ref: value, commit: value, kind: \"commit\" };\n\t}\n\n\tconst lower = value.toLowerCase();\n\tif (MUTABLE_BRANCHES.has(lower) \|\| value === \"HEAD\" \|\| value.startsWith(\"refs/heads/\")) {\n\t\treturn { ok: false, reason: \"mutable-branch\", message: `\"${value}\" is a mutable branch` };\n\t}\n\tif (HEX_ONLY.test(lower) && lower.length < 40) {\n\t\treturn { ok: false, reason: \"short-sha\", message: `\"${value}\" is an abbreviated commit; full SHA required` };\n\t}\n\n\t// Treat anything else as a tag: immutable only when anchored to a reviewed full commit.\n\tconst commit = (resolvedCommit ?? \"\").trim();\n\tif (!commit) {\n\t\treturn { ok: false, reason: \"unresolved-tag\", message: `tag \"${value}\" needs a reviewed resolved commit SHA` };\n\t}\n\tif (!FULL_SHA.test(commit)) {\n\t\treturn { ok: false, reason: \"invalid\", message: `resolvedCommit \"${commit}\" is not a full SHA` };\n\t}\n\treturn { ok: true, ref: value, commit, kind: \"resolved-tag\" };\n}\n\n// ---------------------------------------------------------------------------\n// Candidate normalization\n// ---------------------------------------------------------------------------\n\nexport type NormalizedSource =\n\t\| { ok: true; kind: \"npm\"; source: string; name: string; version: string }\n\t\| { ok: true; kind: \"git\"; source: string; repo: string; host: string; path: string; ref: string; commit: string };\n\nexport type NormalizedCandidate = NormalizedSource \| { ok: false; reasons: string[] };\n\nexport function normalizeCandidate(input: CandidatePackageInput): NormalizedCandidate {\n\tconst reasons: string[] = [];\n\tconst hasNpm = Boolean(input.exactVersion);\n\tconst hasGit = Boolean(input.gitRepo \|\| input.gitRef);\n\n\tif (hasNpm && hasGit) {\n\t\treasons.push(\"ambiguous-source: provide either an npm exactVersion or a git repo+ref, not both\");\n\t\treturn { ok: false, reasons };\n\t}\n\tif (!hasNpm && !hasGit) {\n\t\treasons.push(\"missing-source: provide exactVersion (npm) or gitRepo+gitRef (git)\");\n\t\treturn { ok: false, reasons };\n\t}\n\n\tif (hasNpm) {\n\t\tconst nameCheck = validateNpmPackageName(input.name);\n\t\tif (!nameCheck.ok) reasons.push(`invalid-npm-name: ${nameCheck.message}`);\n\t\tconst versionCheck = validateExactNpmVersion(input.exactVersion);\n\t\tif (!versionCheck.ok) reasons.push(`version: ${versionCheck.message}`);\n\t\tif (nameCheck.ok && versionCheck.ok) {\n\t\t\treturn {\n\t\t\t\tok: true,\n\t\t\t\tkind: \"npm\",\n\t\t\t\tsource: `npm:${nameCheck.name}@${versionCheck.version}`,\n\t\t\t\tname: nameCheck.name,\n\t\t\t\tversion: versionCheck.version,\n\t\t\t};\n\t\t}\n\t\treturn { ok: false, reasons };\n\t}\n\n\t// git\n\tconst git = resolveGitRepo(input.gitRepo ?? \"\");\n\tif (!git) reasons.push(\"invalid-git-repo: could not parse a host/org/repo from gitRepo\");\n\tconst refCheck = validateGitRef(input.gitRef, input.resolvedCommit);\n\tif (!refCheck.ok) reasons.push(`git-ref: ${refCheck.message}`);\n\tif (git && refCheck.ok) {\n\t\treturn {\n\t\t\tok: true,\n\t\t\tkind: \"git\",\n\t\t\tsource: `git:${git.host}/${git.path}@${refCheck.commit}`,\n\t\t\trepo: git.repo,\n\t\t\thost: git.host,\n\t\t\tpath: git.path,\n\t\t\tref: refCheck.ref,\n\t\t\tcommit: refCheck.commit,\n\t\t};\n\t}\n\treturn { ok: false, reasons };\n}\n\nfunction resolveGitRepo(repo: string): { repo: string; host: string; path: string } \| null {\n\tconst trimmed = repo.trim();\n\tif (!trimmed) return null;\n\tconst parsed = parseGitUrl(trimmed) ?? parseGitUrl(`git:${trimmed}`);\n\tif (!parsed) return null;\n\treturn { repo: parsed.repo, host: parsed.host, path: parsed.path };\n}\n\n// ---------------------------------------------------------------------------\n// License gate\n// ---------------------------------------------------------------------------\n\nexport type LicenseClassification = \"permissive\" \| \"weak-copyleft\" \| \"strong-copyleft\" \| \"network-copyleft\" \| \"unknown\";\n\nexport interface LicenseInput {\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tintendedUse: IntendedUse;\n}\n\nexport interface LicenseVerdictResult {\n\tverdict: GateVerdict;\n\tclassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\treasons: string[];\n}\n\nconst PERMISSIVE_LICENSES = new Set([\n\t\"MIT\",\n\t\"MIT-0\",\n\t\"ISC\",\n\t\"BSD\",\n\t\"BSD-2-CLAUSE\",\n\t\"BSD-3-CLAUSE\",\n\t\"APACHE-2.0\",\n\t\"0BSD\",\n\t\"UNLICENSE\",\n\t\"CC0-1.0\",\n\t\"BLUEOAK-1.0.0\",\n\t\"ZLIB\",\n\t\"PYTHON-2.0\",\n\t\"WTFPL\",\n]);\n\nconst NOTICE_REQUIRED_LICENSES = new Set([\"APACHE-2.0\", \"BSD\", \"BSD-2-CLAUSE\", \"BSD-3-CLAUSE\", \"MPL-2.0\"]);\n\nfunction licenseKey(license: string): string {\n\treturn license.trim().toUpperCase().replace(/\\s+/g, \"\");\n}\n\nexport function classifyLicense(license: string \| undefined): LicenseClassification {\n\tif (!license \|\| !license.trim()) return \"unknown\";\n\tconst key = licenseKey(license);\n\tif (key.includes(\"AGPL\") \|\| key.includes(\"SSPL\")) return \"network-copyleft\";\n\tif (key.includes(\"LGPL\") \|\| key.includes(\"MPL\") \|\| key.includes(\"EPL\") \|\| key.includes(\"CDDL\")) {\n\t\treturn \"weak-copyleft\";\n\t}\n\tif (key.includes(\"GPL\")) return \"strong-copyleft\";\n\tif (PERMISSIVE_LICENSES.has(key)) return \"permissive\";\n\treturn \"unknown\";\n}\n\nexport function evaluateLicense(input: LicenseInput): LicenseVerdictResult {\n\tconst reasons: string[] = [];\n\tconst classification = classifyLicense(input.declaredLicense);\n\tconst noticeNeeded =\n\t\tBoolean(input.declaredLicense) &&\n\t\t(NOTICE_REQUIRED_LICENSES.has(licenseKey(input.declaredLicense ?? \"\")) \|\| classification === \"weak-copyleft\");\n\n\tif (classification === \"unknown\") {\n\t\treasons.push(input.declaredLicense ? `unrecognized-license: ${input.declaredLicense}` : \"missing-license\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"network-copyleft\" \|\| classification === \"strong-copyleft\") {\n\t\treasons.push(`copyleft-blocks-adoption: ${input.declaredLicense}`);\n\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"weak-copyleft\") {\n\t\treasons.push(`weak-copyleft-needs-review: ${input.declaredLicense}`);\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\n\t// Permissive: runtime/permanent adoption needs a transitive license inventory.\n\tif (\n\t\tinput.intendedUse === \"permanent-adopt\" &&\n\t\t(!input.transitiveLicenses \|\| input.transitiveLicenses.length === 0)\n\t) {\n\t\treasons.push(\"transitive-license-inventory-required\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (input.transitiveLicenses) {\n\t\tfor (const transitive of input.transitiveLicenses) {\n\t\t\tconst transitiveClass = classifyLicense(transitive);\n\t\t\tif (transitiveClass === \"strong-copyleft\" \|\| transitiveClass === \"network-copyleft\") {\n\t\t\t\treasons.push(`transitive-copyleft: ${transitive}`);\n\t\t\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t\tif (transitiveClass === \"unknown\" \|\| transitiveClass === \"weak-copyleft\") {\n\t\t\t\treasons.push(`transitive-needs-review: ${transitive}`);\n\t\t\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t}\n\t}\n\treturn { verdict: \"pass\", classification, noticeNeeded, reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Lifecycle-script gate\n// ---------------------------------------------------------------------------\n\n/** npm/pnpm/bun lifecycle hooks that run automatically during install or pack. /\nexport const LIFECYCLE_SCRIPT_NAMES: readonly string[] = [\n\t\"preinstall\",\n\t\"install\",\n\t\"postinstall\",\n\t\"preuninstall\",\n\t\"uninstall\",\n\t\"postuninstall\",\n\t\"prepare\",\n\t\"prepublish\",\n\t\"prepublishOnly\",\n\t\"prepack\",\n\t\"postpack\",\n];\n\nexport interface LifecycleScriptInput {\n\tpackageJsonScripts?: Record<string, string>;\n\tallowLifecycleScripts?: boolean;\n\treviewedAllowlist?: string[];\n\t/* Full pinned source spec, e.g. npm:pi-sandbox@0.4.3 /\n\tsource?: string;\n\t/* Identity without version/ref, e.g. npm:pi-sandbox /\n\tidentity?: string;\n\t/* Defaults to exact, matching the published shrinkwrap allowlist semantics. /\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n}\n\nexport interface LifecycleVerdictResult {\n\tverdict: GateVerdict;\n\tdeclaredScripts: string[];\n\trequiresException: boolean;\n\treasons: string[];\n}\n\nexport function evaluateLifecycleScripts(input: LifecycleScriptInput): LifecycleVerdictResult {\n\tconst scripts = input.packageJsonScripts ?? {};\n\tconst declared = LIFECYCLE_SCRIPT_NAMES.filter((name) => {\n\t\tconst value = scripts[name];\n\t\treturn typeof value === \"string\" && value.trim().length > 0;\n\t});\n\n\tif (declared.length === 0) {\n\t\treturn { verdict: \"pass\", declaredScripts: [], requiresException: false, reasons: [] };\n\t}\n\n\tif (!input.allowLifecycleScripts) {\n\t\treturn {\n\t\t\tverdict: \"reject\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [`lifecycle-scripts-present: ${declared.join(\", \")}`],\n\t\t};\n\t}\n\n\tconst allow = new Set((input.reviewedAllowlist ?? []).filter((entry) => Boolean(entry?.trim())));\n\tconst exactMatched = Boolean(input.source && allow.has(input.source));\n\tconst identityMatched = Boolean(input.identity && allow.has(input.identity));\n\tconst mode = input.lifecycleAllowlistMode ?? \"exact\";\n\tif (!exactMatched && !(mode === \"identity\" && identityMatched)) {\n\t\treturn {\n\t\t\tverdict: \"review\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [\n\t\t\t\tidentityMatched\n\t\t\t\t\t? \"lifecycle-scripts-require-exact-allowlist-entry\"\n\t\t\t\t\t: \"lifecycle-scripts-opt-in-without-reviewed-allowlist-entry\",\n\t\t\t],\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"pass\",\n\t\tdeclaredScripts: declared,\n\t\trequiresException: true,\n\t\treasons: [`lifecycle-scripts-allowed-by-reviewed-allowlist: ${declared.join(\", \")}`],\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Legacy / OMK compatibility scan\n// ---------------------------------------------------------------------------\n\nexport type FindingSeverity = \"info\" \| \"warn\" \| \"block\";\n\nexport interface ScanFinding {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpath?: string;\n\tline: number;\n\tsnippet: string;\n}\n\nexport interface CompatibilityScanResult {\n\tverdict: PathCompatibility;\n\tfindings: ScanFinding[];\n}\n\ninterface PatternRule {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpattern: RegExp;\n}\n\nconst LEGACY_CONFIG_DIR_NAME = \"pi\";\n\nconst COMPATIBILITY_RULES: PatternRule[] = [\n\t{\n\t\tkind: \"legacy-home-path\",\n\t\tseverity: \"block\",\n\t\tpattern: new RegExp(`${String.raw`~\\/\\.`}${LEGACY_CONFIG_DIR_NAME}${String.raw`(?:\\/\|\\b)`}`),\n\t},\n\t{\n\t\tkind: \"legacy-state-dir\",\n\t\tseverity: \"block\",\n\t\tpattern: new RegExp(`${String.raw`\\.`}${LEGACY_CONFIG_DIR_NAME}${String.raw`\\/agents\\b`}`),\n\t},\n\t{\n\t\tkind: \"legacy-project-path\",\n\t\tseverity: \"block\",\n\t\tpattern: new RegExp(`${String.raw`(?:^\|[^.\\w])\\.`}${LEGACY_CONFIG_DIR_NAME}${String.raw`\\/`}`),\n\t},\n\t{ kind: \"legacy-package-path\", severity: \"block\", pattern: /pi-coding-agent/ },\n\t{ kind: \"legacy-cli-invocation\", severity: \"block\", pattern: /\\bpi\\s+(?:install\|update)\\b/ },\n\t{ kind: \"legacy-env\", severity: \"warn\", pattern: /\\bPI_[A-Z][A-Z0-9_]\\b/ },\n\t{ kind: \"legacy-import\", severity: \"block\", pattern: /@(?:mariozechner\|earendil-works)\\/pi-/ },\n\t{ kind: \"omk-path\", severity: \"info\", pattern: /(?:^\|[^.\\w])\\.omk\\// },\n];\n\nfunction scanWithRules(sources: SourceText[], rules: PatternRule[]): ScanFinding[] {\n\tconst findings: ScanFinding[] = [];\n\tfor (const source of sources) {\n\t\tconst lines = source.text.split(/\\r?\\n/);\n\t\tfor (let i = 0; i < lines.length; i++) {\n\t\t\tconst line = lines[i];\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (rule.pattern.test(line)) {\n\t\t\t\t\tfindings.push({\n\t\t\t\t\t\tkind: rule.kind,\n\t\t\t\t\t\tseverity: rule.severity,\n\t\t\t\t\t\tpath: source.path,\n\t\t\t\t\t\tline: i + 1,\n\t\t\t\t\t\tsnippet: line.trim().slice(0, 200),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn findings;\n}\n\nexport function scanLegacyOmkCompatibility(sources: SourceText[]): CompatibilityScanResult {\n\tconst findings = scanWithRules(sources, COMPATIBILITY_RULES);\n\tconst hasBlock = findings.some((f) => f.severity === \"block\");\n\tconst hasOmk = findings.some((f) => f.kind === \"omk-path\");\n\tconst hasWarn = findings.some((f) => f.severity === \"warn\");\n\n\tlet verdict: PathCompatibility;\n\tif (hasBlock) {\n\t\tverdict = \"legacy-hardcoded\";\n\t} else if (hasOmk) {\n\t\tverdict = \"omk-native\";\n\t} else if (hasWarn) {\n\t\tverdict = \"unknown\";\n\t} else {\n\t\tverdict = \"unknown\";\n\t}\n\treturn { verdict, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Source capability scan\n// ---------------------------------------------------------------------------\n\nexport interface CapabilityScanResult {\n\tcapabilities: string[];\n\tfindings: ScanFinding[];\n}\n\nconst CAPABILITY_RULES: PatternRule[] = [\n\t// Credential / secret file reads are the hard blocker.\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /[\"'`][^\"'`]\\.env(?:\\.[\\w-]+)?[\"'`]/ },\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /auth\\.json\|\\.npmrc\|\\.netrc/ },\n\t{\n\t\tkind: \"credential-read\",\n\t\tseverity: \"block\",\n\t\tpattern: /id_rsa\|id_ed25519\|\\.ssh\\/\|\\.aws\\/credentials\|\\.kube\\/config/,\n\t},\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /BEGIN\\s+(?:RSA\\s+\|EC\\s+\|OPENSSH\\s+)?PRIVATE\\s+KEY/ },\n\t{ kind: \"host-socket\", severity: \"block\", pattern: /\\/var\\/run\\/docker\\.sock\|dockerode\|kubeconfig/ },\n\t{ kind: \"child-process\", severity: \"warn\", pattern: /child_process\|\\bspawn\\s\\(\|\\bexec(?:Sync\|File)?\\s\\(/ },\n\t{\n\t\tkind: \"network\",\n\t\tseverity: \"warn\",\n\t\tpattern: /\\bfetch\\s\\(\\s[\"'`]?https?:\|https?\\.request\|node-fetch\|axios\|undici\|got\\(/,\n\t},\n\t{\n\t\tkind: \"filesystem-write\",\n\t\tseverity: \"warn\",\n\t\tpattern: /writeFileSync\|appendFileSync\|\\bfs\\.(?:write\|append)\|rmSync\|unlinkSync\|mkdirSync/,\n\t},\n\t{ kind: \"browser-control\", severity: \"warn\", pattern: /puppeteer\|playwright\|chrome-devtools\|:9222\\b/ },\n\t{ kind: \"telemetry\", severity: \"warn\", pattern: /\\btelemetry\\b\|posthog\|segment\\.io\|@braintrust\|analytics\\b/ },\n\t{ kind: \"setFooter\", severity: \"info\", pattern: /\\bsetFooter\\s\\(/ },\n\t{ kind: \"setHeader\", severity: \"info\", pattern: /\\bsetHeader\\s\\(/ },\n\t{ kind: \"setEditorComponent\", severity: \"info\", pattern: /\\bsetEditorComponent\\s\\(/ },\n\t{ kind: \"setStatus\", severity: \"info\", pattern: /\\bsetStatus\\s\\(/ },\n\t{ kind: \"setActiveTools\", severity: \"info\", pattern: /\\bsetActiveTools\\s\\(/ },\n\t{ kind: \"setModel\", severity: \"warn\", pattern: /\\bsetModel\\s\\(/ },\n\t{ kind: \"setThinkingLevel\", severity: \"warn\", pattern: /\\bsetThinkingLevel\\s\\(/ },\n\t{ kind: \"renderCall\", severity: \"info\", pattern: /\\brenderCall\\s[:(]/ },\n\t{ kind: \"renderResult\", severity: \"info\", pattern: /\\brenderResult\\s[:(]/ },\n\t{ kind: \"registerMessageRenderer\", severity: \"info\", pattern: /\\bregisterMessageRenderer\\s\\(/ },\n\t{ kind: \"before_provider_request\", severity: \"warn\", pattern: /[\"'`]before_provider_request[\"'`]/ },\n\t{ kind: \"context\", severity: \"warn\", pattern: /[\"'`]context[\"'`]/ },\n\t{ kind: \"session_before_compact\", severity: \"warn\", pattern: /[\"'`]session_before_compact[\"'`]/ },\n\t{ kind: \"env-secret-access\", severity: \"info\", pattern: /process\\.env\\.[A-Z0-9_](?:TOKEN\|SECRET\|KEY\|PASSWORD)/ },\n];\n\nexport function scanSourceCapabilities(sources: SourceText[]): CapabilityScanResult {\n\tconst findings = scanWithRules(sources, CAPABILITY_RULES);\n\tconst capabilities = [...new Set(findings.map((f) => f.kind))];\n\treturn { capabilities, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Release-age and maintainer trust gates\n// ---------------------------------------------------------------------------\n\nexport type ReleaseAgeVerdict = \"pass\" \| \"review\" \| \"defer\";\n\nexport interface ReleaseAgeInput {\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tnow?: Date;\n}\n\nexport interface ReleaseAgeResult {\n\tverdict: ReleaseAgeVerdict;\n\treason?: string;\n\tageDays?: number;\n}\n\nexport function evaluateReleaseAge(input: ReleaseAgeInput): ReleaseAgeResult {\n\tconst minAge = input.minReleaseAgeDays ?? 0;\n\tif (minAge <= 0) return { verdict: \"pass\", reason: \"release-age-not-required\" };\n\tif (!input.publishedAt) return { verdict: \"review\", reason: \"release-age-published-at-missing\" };\n\tconst published = Date.parse(input.publishedAt);\n\tif (Number.isNaN(published)) return { verdict: \"review\", reason: \"release-age-invalid-published-at\" };\n\tconst now = input.now?.getTime() ?? Date.now();\n\tconst ageDays = (now - published) / 86_400_000;\n\tif (ageDays < minAge) {\n\t\treturn { verdict: \"defer\", reason: `release-age-below-${minAge}-days`, ageDays };\n\t}\n\treturn { verdict: \"pass\", reason: \"release-age-ok\", ageDays };\n}\n\nexport function assessMaintainerTrust(input: MaintainerTrustInput = {}): RiskLevel {\n\tif (input.verifiedPublisher === true) return \"low\";\n\tif (input.verifiedPublisher === false && (input.accountAgeDays ?? Number.POSITIVE_INFINITY) < 60) return \"high\";\n\tif (input.verifiedPublisher === false) return \"medium\";\n\treturn \"low\";\n}\n\nfunction maxRisk(a: RiskLevel, b: RiskLevel): RiskLevel {\n\tconst rank: Record<RiskLevel, number> = { low: 0, medium: 1, high: 2 };\n\treturn rank[a] >= rank[b] ? a : b;\n}\n\n// ---------------------------------------------------------------------------\n// Risk inference\n// ---------------------------------------------------------------------------\n\nconst HIGH_RISK_CAPABILITIES = new Set([\"credential-read\", \"host-socket\"]);\nconst MEDIUM_RISK_CAPABILITIES = new Set([\"child-process\", \"network\", \"browser-control\"]);\n\nexport function inferRisk(\n\tcapabilities: string[],\n\tlicenseVerdict: GateVerdict,\n\tlifecycleVerdict: GateVerdict,\n\tmaintainer?: MaintainerTrustInput,\n): RiskLevel {\n\tlet risk: RiskLevel = \"low\";\n\tif (\n\t\tlicenseVerdict === \"reject\" \|\|\n\t\tlifecycleVerdict === \"reject\" \|\|\n\t\tcapabilities.some((capability) => HIGH_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"high\";\n\t} else if (\n\t\tlicenseVerdict === \"review\" \|\|\n\t\tlifecycleVerdict === \"review\" \|\|\n\t\tcapabilities.some((capability) => MEDIUM_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"medium\";\n\t}\n\treturn maxRisk(risk, assessMaintainerTrust(maintainer));\n}\n\n// ---------------------------------------------------------------------------\n// Adoption decision matrix\n// ---------------------------------------------------------------------------\n\nexport interface AdoptionInput {\n\tintendedUse: IntendedUse;\n\trisk: RiskLevel;\n\tpinOk: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlifecycleVerdict: GateVerdict;\n\tpathCompatibility: PathCompatibility;\n\tcapabilities: string[];\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n}\n\nexport interface AdoptionDecision {\n\tadoption: Adoption;\n\trejectedReasons: string[];\n\tdeferredReason?: DeferredReason;\n}\n\nfunction baseAdoptionFor(intendedUse: IntendedUse): Adoption {\n\tswitch (intendedUse) {\n\t\tcase \"native\":\n\t\t\treturn \"native\";\n\t\tcase \"vendor\":\n\t\tcase \"theme-port\":\n\t\t\treturn \"vendor\";\n\t\tcase \"ephemeral-adopt\":\n\t\t\treturn \"ephemeral-trial\";\n\t\tcase \"permanent-adopt\":\n\t\t\treturn \"permanent-package\";\n\t\tcase \"reference\":\n\t\t\treturn \"reference-only\";\n\t\tcase \"advisory\":\n\t\t\treturn \"advisory-only\";\n\t\tcase \"report-only\":\n\t\t\treturn \"report-only\";\n\t\tcase \"measurement-gated\":\n\t\t\treturn \"measurement-gated\";\n\t}\n}\n\nfunction deferred(reason: DeferredReason, rejectedReasons: string[] = []): AdoptionDecision {\n\treturn { adoption: \"deferred\", deferredReason: reason, rejectedReasons: [reason, ...rejectedReasons] };\n}\n\nfunction policyOverlayFor(input: AdoptionInput): PolicyOverlay \| undefined {\n\treturn input.policyOverlay;\n}\n\nfunction hasValidExportPolicy(policy: ExportPolicyOverlay \| undefined): boolean {\n\treturn Boolean(\n\t\tpolicy?.defaultOff === true &&\n\t\t\tpolicy.offlineDisables === true &&\n\t\t\tpolicy.denyRawPrompt === true &&\n\t\t\tpolicy.denyRawToolOutput === true,\n\t);\n}\n\nexport function decideAdoption(input: AdoptionInput): AdoptionDecision {\n\tconst reasons: string[] = [];\n\tconst base = baseAdoptionFor(input.intendedUse);\n\tconst policy = policyOverlayFor(input);\n\n\tif (!input.pinOk) {\n\t\tif (\n\t\t\tbase === \"native\" \|\|\n\t\t\tbase === \"reference-only\" \|\|\n\t\t\tbase === \"advisory-only\" \|\|\n\t\t\tbase === \"report-only\" \|\|\n\t\t\tbase === \"measurement-gated\"\n\t\t) {\n\t\t\treturn deferred(\"missing-exact-pin\");\n\t\t}\n\t\treasons.push(\"exact-pin-required\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"native\") {\n\t\tif (input.nativeSpec?.exists === false) return deferred(\"pending-native-spec\");\n\t\tif (input.capabilities.includes(\"credential-read\")) reasons.push(\"reads-credentials-upstream\");\n\t\tif (input.licenseVerdict === \"reject\") reasons.push(\"license-blocked-upstream\");\n\t\tif (input.lifecycleVerdict === \"reject\") reasons.push(\"lifecycle-scripts-blocked-upstream\");\n\t\tif (input.pathCompatibility === \"legacy-hardcoded\") reasons.push(\"legacy-hardcoded-paths-upstream\");\n\t\tif (policy?.declaredUse === \"sandbox\" && !policy.sandboxBackend) return deferred(\"pending-sandbox-backend\");\n\t\tif (policy?.declaredUse === \"sandbox\") reasons.push(\"sandbox-risk-floor-high\");\n\t\treturn { adoption: \"native\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"memory\" && input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"memory-credential-read-rejected\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"reads-credentials\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.licenseVerdict === \"reject\") {\n\t\treasons.push(\"license-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.lifecycleVerdict === \"reject\") {\n\t\treasons.push(\"lifecycle-scripts-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.pathCompatibility === \"legacy-hardcoded\") {\n\t\treasons.push(\"legacy-hardcoded-paths\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"workflow-reference\") {\n\t\tif (policy.activateAlongsideScheduler === true) {\n\t\t\treturn { adoption: \"reject\", rejectedReasons: [\"scheduler-coexistence-denied\"] };\n\t\t}\n\t\treturn { adoption: \"reference-only\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"sandbox\") {\n\t\tif (!policy.sandboxBackend) {\n\t\t\treasons.push(\"sandbox-requires-backend\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\treasons.push(\"sandbox-risk-floor-high\");\n\t}\n\n\tif (\n\t\tpolicy?.declaredUse === \"observability\" &&\n\t\tbase === \"permanent-package\" &&\n\t\t!hasValidExportPolicy(policy.exportPolicy)\n\t) {\n\t\treturn deferred(\"pending-export-policy\");\n\t}\n\n\tif (policy?.declaredUse === \"advisor\" \|\| policy?.declaredUse === \"quality\") {\n\t\tif (input.capabilities.includes(\"filesystem-write\") \|\| input.capabilities.includes(\"child-process\")) {\n\t\t\treasons.push(\"report-only-mutation-denied\");\n\t\t}\n\t\treturn { adoption: \"report-only\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"measurement-gated\") {\n\t\tif (!input.metrics \|\| input.metrics.length === 0) return deferred(\"pending-metrics\");\n\t\treturn { adoption: \"measurement-gated\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"reference-only\" \|\| base === \"advisory-only\" \|\| base === \"report-only\") {\n\t\treturn { adoption: base, rejectedReasons: reasons };\n\t}\n\n\tif (base === \"permanent-package\") {\n\t\tif (input.risk === \"high\") {\n\t\t\treasons.push(\"high-risk-permanent-blocked\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\tif (\n\t\t\tinput.licenseVerdict === \"review\" \|\|\n\t\t\tinput.lifecycleVerdict === \"review\" \|\|\n\t\t\tinput.pathCompatibility === \"unknown\"\n\t\t) {\n\t\t\treasons.push(\"needs-review-before-permanent\");\n\t\t\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n\t\t}\n\t\treturn { adoption: \"permanent-package\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"vendor\") {\n\t\tif (input.licenseVerdict === \"review\") reasons.push(\"license-review-before-vendor\");\n\t\treturn { adoption: \"vendor\", rejectedReasons: reasons };\n\t}\n\n\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Top-level procurement review\n// ---------------------------------------------------------------------------\n\nexport interface ProcurementReviewInputs {\n\tcandidate: CandidatePackageInput;\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tpolicyOverlay?: PolicyOverlay;\n\tnow?: Date;\n}\n\nexport interface ProcurementReview {\n\tcandidate: CandidatePackageInput;\n\tnormalized: NormalizedSource \| null;\n\tpinned: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlicenseClassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\tlifecycleVerdict: GateVerdict;\n\tdeclaredLifecycleScripts: string[];\n\tpathCompatibility: PathCompatibility;\n\tcompatibilityFindings: ScanFinding[];\n\tcapabilities: string[];\n\tcapabilityFindings: ScanFinding[];\n\trisk: RiskLevel;\n\tadoption: Adoption;\n\tdeferredReason?: DeferredReason;\n\treleaseAgeVerdict: ReleaseAgeVerdict;\n\tmaintainerRisk: RiskLevel;\n\trejectedReasons: string[];\n}\n\nexport function procureCandidate(inputs: ProcurementReviewInputs): ProcurementReview {\n\tconst candidate = inputs.candidate;\n\tconst normalized = normalizeCandidate(candidate);\n\tconst pinned = normalized.ok;\n\n\tconst license = evaluateLicense({\n\t\tdeclaredLicense: inputs.declaredLicense,\n\t\tlicenseFiles: inputs.licenseFiles,\n\t\ttransitiveLicenses: inputs.transitiveLicenses,\n\t\tintendedUse: candidate.intendedUse,\n\t});\n\n\tconst lifecycle = evaluateLifecycleScripts({\n\t\tpackageJsonScripts: inputs.packageJsonScripts,\n\t\tallowLifecycleScripts: candidate.allowLifecycleScripts,\n\t\treviewedAllowlist: inputs.reviewedScriptAllowlist,\n\t\tsource: normalized.ok ? normalized.source : undefined,\n\t\tidentity: normalized.ok ? sourceIdentity(normalized) : undefined,\n\t\tlifecycleAllowlistMode: inputs.lifecycleAllowlistMode,\n\t});\n\n\tconst sources = inputs.sources ?? [];\n\tconst compatibility = scanLegacyOmkCompatibility(sources);\n\tconst capabilities = scanSourceCapabilities(sources);\n\tconst releaseAge = evaluateReleaseAge({\n\t\tpublishedAt: candidate.publishedAt,\n\t\tminReleaseAgeDays: candidate.minReleaseAgeDays,\n\t\tnow: inputs.now,\n\t});\n\tconst maintainerRisk = assessMaintainerTrust(candidate.maintainer);\n\tconst risk =\n\t\tcandidate.risk ?? inferRisk(capabilities.capabilities, license.verdict, lifecycle.verdict, candidate.maintainer);\n\tconst policyOverlay =\n\t\tinputs.policyOverlay ??\n\t\tcandidate.policyOverlay ??\n\t\t(candidate.declaredUse === undefined ? undefined : { declaredUse: candidate.declaredUse });\n\n\tconst decision = decideAdoption({\n\t\tintendedUse: candidate.intendedUse,\n\t\trisk,\n\t\tpinOk: pinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcapabilities: capabilities.capabilities,\n\t\tnativeSpec: candidate.nativeSpec,\n\t\tpolicyOverlay,\n\t\tmetrics: candidate.metrics,\n\t});\n\n\tconst rejectedReasons = [...decision.rejectedReasons];\n\tif (!normalized.ok) {\n\t\trejectedReasons.push(...normalized.reasons);\n\t}\n\n\treturn {\n\t\tcandidate,\n\t\tnormalized: normalized.ok ? normalized : null,\n\t\tpinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlicenseClassification: license.classification,\n\t\tnoticeNeeded: license.noticeNeeded,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tdeclaredLifecycleScripts: lifecycle.declaredScripts,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcompatibilityFindings: compatibility.findings,\n\t\tcapabilities: capabilities.capabilities,\n\t\tcapabilityFindings: capabilities.findings,\n\t\trisk,\n\t\tadoption: decision.adoption,\n\t\t...(decision.deferredReason === undefined ? {} : { deferredReason: decision.deferredReason }),\n\t\treleaseAgeVerdict: releaseAge.verdict,\n\t\tmaintainerRisk,\n\t\trejectedReasons,\n\t};\n}\n\nexport interface ProcurementBatchInput {\n\tcandidates: readonly CandidatePackageInput[];\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tnow?: Date;\n}\n\nexport interface ProcurementBatchResult {\n\tcoverage: ProcurementReview[];\n\tglobalBlockers: string[];\n\tselectedByGroup: Record<string, string>;\n}\n\nfunction withBatchDeferral(\n\treview: ProcurementReview,\n\treason: DeferredReason,\n\trejectedReason: string,\n): ProcurementReview {\n\treturn {\n\t\t...review,\n\t\tadoption: \"deferred\",\n\t\tdeferredReason: reason,\n\t\trejectedReasons: [...review.rejectedReasons, rejectedReason],\n\t};\n}\n\nfunction isAdoptedForGroup(review: ProcurementReview): boolean {\n\treturn review.adoption !== \"reject\" && review.adoption !== \"deferred\";\n}\n\nexport function procureCandidateBatch(input: ProcurementBatchInput): ProcurementBatchResult {\n\tconst selectedByGroup: Record<string, string> = {};\n\tconst coverage: ProcurementReview[] = [];\n\tfor (const candidate of input.candidates) {\n\t\tconst review = procureCandidate({\n\t\t\tcandidate,\n\t\t\tpackageJsonScripts: input.packageJsonScripts,\n\t\t\tdeclaredLicense: input.declaredLicense ?? \"MIT\",\n\t\t\ttransitiveLicenses: input.transitiveLicenses,\n\t\t\tsources: input.sources,\n\t\t\treviewedScriptAllowlist: input.reviewedScriptAllowlist,\n\t\t\tlifecycleAllowlistMode: input.lifecycleAllowlistMode,\n\t\t\tnow: input.now,\n\t\t});\n\t\tconst group = candidate.excludeGroup;\n\t\tif (group && isAdoptedForGroup(review)) {\n\t\t\tif (selectedByGroup[group] === undefined) {\n\t\t\t\tselectedByGroup[group] = candidate.name;\n\t\t\t\tcoverage.push(review);\n\t\t\t} else {\n\t\t\t\tcoverage.push(withBatchDeferral(review, \"group-excluded\", `group-exclusion: ${group}`));\n\t\t\t}\n\t\t} else {\n\t\t\tcoverage.push(review);\n\t\t}\n\t}\n\treturn { coverage, globalBlockers: [], selectedByGroup };\n}\n\nfunction sourceIdentity(normalized: NormalizedSource): string {\n\tif (normalized.kind === \"npm\") {\n\t\treturn `npm:${normalized.name}`;\n\t}\n\treturn `git:${normalized.host}/${normalized.path}`;\n}\n"]}

package/dist/core/provider-attribution.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-import type { Api, Model } from "@earendil-works/omk-ai";
+import type { Api, Model } from "omk-ai";
 import type { SettingsManager } from "./settings-manager.ts";
 export declare function mergeProviderAttributionHeaders(model: Model<Api>, settingsManager: SettingsManager, sessionId: string | undefined, ...headerSources: Array<Record<string, string> | undefined>): Record<string, string> | undefined;
 //# sourceMappingURL=provider-attribution.d.ts.map

package/dist/core/provider-attribution.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-attribution.d.ts","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,~~wBAAwB~~,CAAC;~~AACzD~~,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA6E7D,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAapC","sourcesContent":["import type { Api, Model } from \"~~@earendil-works/~~omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" \|\| model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" \|\| matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" \|\|\n\t\tmodel.provider === \"cloudflare-ai-gateway\" \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> \| undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string \| undefined): Record<string, string> \| undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string \| undefined,\n\t...headerSources: Array<Record<string, string> \| undefined>\n): Record<string, string> \| undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}
1	+ {"version":3,"file":"provider-attribution.d.ts","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA6E7D,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAapC","sourcesContent":["import type { Api, Model } from \"omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" \|\| model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" \|\| matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" \|\|\n\t\tmodel.provider === \"cloudflare-ai-gateway\" \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> \| undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string \| undefined): Record<string, string> \| undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string \| undefined,\n\t...headerSources: Array<Record<string, string> \| undefined>\n): Record<string, string> \| undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}

package/dist/core/provider-attribution.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"provider-attribution.js","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAC/D,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,SAAS,WAAW,CAAC,OAAe,EAAE,YAAoB,EAAW;IACpE,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,gBAAgB,CAAC,KAAiB,EAAW;IACrD,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAC/C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC,CACtD,CAAC;AAAA,CACF;AAED,SAAS,4BAA4B,CACpC,KAAiB,EACjB,eAAgC,EACK;IACrC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,cAAc,EAAE,+BAA+B;YAC/C,oBAAoB,EAAE,KAAK;YAC3B,yBAAyB,EAAE,WAAW;SACtC,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,yBAAyB,EAAE,KAAK;SAChC,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,YAAY,EAAE,sBAAsB;SACpC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAE,SAA6B,EAAsC;IAChH,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IACC,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC7B,KAAK,CAAC,QAAQ,KAAK,aAAa;QAChC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,EACzC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAAA,CACvE;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAAiB,EACjB,eAAgC,EAChC,SAA6B,EAC7B,GAAG,aAAwD,EACtB;IACrC,MAAM,MAAM,GAAG;QACd,GAAG,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;QACtC,GAAG,4BAA4B,CAAC,KAAK,EAAE,eAAe,CAAC;KACvD,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC3D","sourcesContent":["import type { Api, Model } from \"~~@earendil-works/~~omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" \|\| model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" \|\| matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" \|\|\n\t\tmodel.provider === \"cloudflare-ai-gateway\" \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> \| undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string \| undefined): Record<string, string> \| undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string \| undefined,\n\t...headerSources: Array<Record<string, string> \| undefined>\n): Record<string, string> \| undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}
1	+ {"version":3,"file":"provider-attribution.js","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAC/D,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,SAAS,WAAW,CAAC,OAAe,EAAE,YAAoB,EAAW;IACpE,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,gBAAgB,CAAC,KAAiB,EAAW;IACrD,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAC/C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC,CACtD,CAAC;AAAA,CACF;AAED,SAAS,4BAA4B,CACpC,KAAiB,EACjB,eAAgC,EACK;IACrC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,cAAc,EAAE,+BAA+B;YAC/C,oBAAoB,EAAE,KAAK;YAC3B,yBAAyB,EAAE,WAAW;SACtC,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,yBAAyB,EAAE,KAAK;SAChC,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,YAAY,EAAE,sBAAsB;SACpC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAE,SAA6B,EAAsC;IAChH,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IACC,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC7B,KAAK,CAAC,QAAQ,KAAK,aAAa;QAChC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,EACzC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAAA,CACvE;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAAiB,EACjB,eAAgC,EAChC,SAA6B,EAC7B,GAAG,aAAwD,EACtB;IACrC,MAAM,MAAM,GAAG;QACd,GAAG,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;QACtC,GAAG,4BAA4B,CAAC,KAAK,EAAE,eAAe,CAAC;KACvD,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC3D","sourcesContent":["import type { Api, Model } from \"omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" \|\| model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" \|\| matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" \|\|\n\t\tmodel.provider === \"cloudflare-ai-gateway\" \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) \|\|\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> \| undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string \| undefined): Record<string, string> \| undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string \| undefined,\n\t...headerSources: Array<Record<string, string> \| undefined>\n): Record<string, string> \| undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}

package/dist/core/read-anchors.d.ts CHANGED Viewed

@@ -13,7 +13,7 @@
  * Side-effect free: no filesystem access; `node:crypto` only.
  *
  * Derived clean-room from the lane C plan
- * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`); no Pi
+ * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy
  * package source is imported or copied.
  */
 export declare const READ_ANCHOR_SCHEMA_VERSION = "omk.read-anchor.v1";

package/dist/core/read-anchors.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"read-anchors.d.ts","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAqCD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAWzE;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,GAAG,sBAAsB,CAcnG;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,CA+BlH;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAeD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAwDzF","sourcesContent":["/*\n `omk.read-anchor` — pure hash-anchored read/edit primitives.\n \n A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n \n All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n \n Side-effect free: no filesystem access; `node:crypto` only.\n \n Derived clean-room from the lane C plan\n * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`); no Pi\n * package source is imported or copied.\n /\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/* 1-indexed start line (resolved). /\n\treadonly offset: number;\n\t/* Number of lines included in the block (resolved). /\n\treadonly limit: number;\n\t/* 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. /\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/* SHA-256 (hex) of the newline-normalized full file content. /\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/* SHA-256 (hex) of the newline-normalized read block content. /\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/\n Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n /\nfunction extractBlock(normalized: string, offset: number \| undefined, limit: number \| undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/* Full file content as read. /\n\treadonly content: string;\n\t/* 1-indexed start line; defaults to 1 (whole file). /\n\treadonly offset?: number;\n\t/* Maximum number of lines; defaults to the rest of the file. /\n\treadonly limit?: number;\n\t/* Optional deterministic id (otherwise a UUID is generated). /\n\treadonly readId?: string;\n}\n\n/\n Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n /\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/\n Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n /\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/* Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. /\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" \|\| value === null \|\| Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" \|\| anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" \|\| anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" \|\| !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" \|\| !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" \|\| range === null \|\| Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" \|\| !Number.isInteger(r[key]) \|\| (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" \| \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" \| \"allow-lenient\" \| \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/* Current full file content at edit time. /\n\treadonly currentContent: string;\n\t/* Defaults to `strict`. /\n\treadonly mode?: AnchoredEditMode;\n\t/\n\t The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t /\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/* Lenient mode only: whether the anchored block was uniquely relocated. /\n\treadonly blockRelocated?: boolean;\n\t/* Lenient mode only: occurrences of the anchored block in current content. /\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/\n Decide whether an anchored edit may proceed.\n \n - Unchanged file -> `allow` (the common fast path).\n * - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n * - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n * text is supplied, hashes to the recorded `blockSha256`, and still occurs\n * exactly once in the current content (unique, non-overlapping relocation).\n * Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined \|\| blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}
1	+ {"version":3,"file":"read-anchors.d.ts","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAqCD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAWzE;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,GAAG,sBAAsB,CAcnG;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,CA+BlH;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAeD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAwDzF","sourcesContent":["/*\n `omk.read-anchor` — pure hash-anchored read/edit primitives.\n \n A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n \n All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n \n Side-effect free: no filesystem access; `node:crypto` only.\n \n Derived clean-room from the lane C plan\n * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy\n * package source is imported or copied.\n /\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/* 1-indexed start line (resolved). /\n\treadonly offset: number;\n\t/* Number of lines included in the block (resolved). /\n\treadonly limit: number;\n\t/* 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. /\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/* SHA-256 (hex) of the newline-normalized full file content. /\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/* SHA-256 (hex) of the newline-normalized read block content. /\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/\n Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n /\nfunction extractBlock(normalized: string, offset: number \| undefined, limit: number \| undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/* Full file content as read. /\n\treadonly content: string;\n\t/* 1-indexed start line; defaults to 1 (whole file). /\n\treadonly offset?: number;\n\t/* Maximum number of lines; defaults to the rest of the file. /\n\treadonly limit?: number;\n\t/* Optional deterministic id (otherwise a UUID is generated). /\n\treadonly readId?: string;\n}\n\n/\n Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n /\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/\n Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n /\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/* Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. /\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" \|\| value === null \|\| Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" \|\| anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" \|\| anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" \|\| !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" \|\| !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" \|\| range === null \|\| Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" \|\| !Number.isInteger(r[key]) \|\| (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" \| \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" \| \"allow-lenient\" \| \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/* Current full file content at edit time. /\n\treadonly currentContent: string;\n\t/* Defaults to `strict`. /\n\treadonly mode?: AnchoredEditMode;\n\t/\n\t The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t /\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/* Lenient mode only: whether the anchored block was uniquely relocated. /\n\treadonly blockRelocated?: boolean;\n\t/* Lenient mode only: occurrences of the anchored block in current content. /\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/\n Decide whether an anchored edit may proceed.\n \n - Unchanged file -> `allow` (the common fast path).\n * - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n * - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n * text is supplied, hashes to the recorded `blockSha256`, and still occurs\n * exactly once in the current content (unique, non-overlapping relocation).\n * Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined \|\| blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}

package/dist/core/read-anchors.js CHANGED Viewed

@@ -13,7 +13,7 @@
  * Side-effect free: no filesystem access; `node:crypto` only.
  *
  * Derived clean-room from the lane C plan
- * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`); no Pi
+ * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy
  * package source is imported or copied.
  */
 import { createHash, randomUUID } from "node:crypto";

package/dist/core/read-anchors.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"read-anchors.js","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAsB/D,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAEhC,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAAA,CAC3D;AAED,SAAS,SAAS,CAAC,OAAe,EAAU;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAClE;AAOD;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,MAA0B,EAAE,KAAyB,EAAkB;IAChH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7D,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE;KAClE,CAAC;AAAA,CACF;AAcD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B,EAAc;IAC1E,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO;QACN,aAAa,EAAE,0BAA0B;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC;AAAA,CACF;AAUD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,cAAsB,EAA0B;IACpG,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,iBAAiB,KAAK,MAAM,CAAC,UAAU,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,KAAK,MAAM,CAAC,WAAW,CAAC;IAC/D,OAAO;QACN,EAAE,EAAE,WAAW,IAAI,YAAY;QAC/B,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;KAClB,CAAC;AAAA,CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAmE;IACnH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,KAAK,0BAA0B,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,yBAAyB,0BAA0B,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAClD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAChH,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACP,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAK,CAAC,CAAC,GAAG,CAAY,GAAG,CAAC,EAAE,CAAC;gBACvF,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,iCAAiC,CAAC,CAAC;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAA8B,EAAE,CAAC;AAAA,CACxE;AA+BD,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAU;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,iBAAiB,GAAG,iFAAiF,CAAC;AAE5G;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgC,EAAwB;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IAElE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,qDAAqD;YAC7D,iBAAiB;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO;YACN,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,4DAA4D;YACpE,iBAAiB;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,iEAAiE;YACzE,iBAAiB;YACjB,WAAW;YACX,cAAc,EAAE,IAAI;YACpB,WAAW;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,cAAc;QACvB,MAAM,EACL,WAAW,KAAK,CAAC;YAChB,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,oEAAoE;QACxE,iBAAiB;QACjB,WAAW;QACX,cAAc,EAAE,KAAK;QACrB,WAAW;KACX,CAAC;AAAA,CACF","sourcesContent":["/*\n `omk.read-anchor` — pure hash-anchored read/edit primitives.\n \n A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n \n All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n \n Side-effect free: no filesystem access; `node:crypto` only.\n \n Derived clean-room from the lane C plan\n * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`); no Pi\n * package source is imported or copied.\n /\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/* 1-indexed start line (resolved). /\n\treadonly offset: number;\n\t/* Number of lines included in the block (resolved). /\n\treadonly limit: number;\n\t/* 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. /\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/* SHA-256 (hex) of the newline-normalized full file content. /\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/* SHA-256 (hex) of the newline-normalized read block content. /\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/\n Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n /\nfunction extractBlock(normalized: string, offset: number \| undefined, limit: number \| undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/* Full file content as read. /\n\treadonly content: string;\n\t/* 1-indexed start line; defaults to 1 (whole file). /\n\treadonly offset?: number;\n\t/* Maximum number of lines; defaults to the rest of the file. /\n\treadonly limit?: number;\n\t/* Optional deterministic id (otherwise a UUID is generated). /\n\treadonly readId?: string;\n}\n\n/\n Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n /\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/\n Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n /\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/* Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. /\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" \|\| value === null \|\| Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" \|\| anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" \|\| anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" \|\| !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" \|\| !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" \|\| range === null \|\| Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" \|\| !Number.isInteger(r[key]) \|\| (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" \| \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" \| \"allow-lenient\" \| \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/* Current full file content at edit time. /\n\treadonly currentContent: string;\n\t/* Defaults to `strict`. /\n\treadonly mode?: AnchoredEditMode;\n\t/\n\t The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t /\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/* Lenient mode only: whether the anchored block was uniquely relocated. /\n\treadonly blockRelocated?: boolean;\n\t/* Lenient mode only: occurrences of the anchored block in current content. /\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/\n Decide whether an anchored edit may proceed.\n \n - Unchanged file -> `allow` (the common fast path).\n * - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n * - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n * text is supplied, hashes to the recorded `blockSha256`, and still occurs\n * exactly once in the current content (unique, non-overlapping relocation).\n * Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined \|\| blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}
1	+ {"version":3,"file":"read-anchors.js","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAsB/D,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAEhC,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAAA,CAC3D;AAED,SAAS,SAAS,CAAC,OAAe,EAAU;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAClE;AAOD;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,MAA0B,EAAE,KAAyB,EAAkB;IAChH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7D,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE;KAClE,CAAC;AAAA,CACF;AAcD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B,EAAc;IAC1E,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO;QACN,aAAa,EAAE,0BAA0B;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC;AAAA,CACF;AAUD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,cAAsB,EAA0B;IACpG,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,iBAAiB,KAAK,MAAM,CAAC,UAAU,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,KAAK,MAAM,CAAC,WAAW,CAAC;IAC/D,OAAO;QACN,EAAE,EAAE,WAAW,IAAI,YAAY;QAC/B,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;KAClB,CAAC;AAAA,CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAmE;IACnH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,KAAK,0BAA0B,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,yBAAyB,0BAA0B,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAClD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAChH,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACP,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAK,CAAC,CAAC,GAAG,CAAY,GAAG,CAAC,EAAE,CAAC;gBACvF,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,iCAAiC,CAAC,CAAC;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAA8B,EAAE,CAAC;AAAA,CACxE;AA+BD,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAU;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,iBAAiB,GAAG,iFAAiF,CAAC;AAE5G;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgC,EAAwB;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IAElE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,qDAAqD;YAC7D,iBAAiB;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO;YACN,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,4DAA4D;YACpE,iBAAiB;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,iEAAiE;YACzE,iBAAiB;YACjB,WAAW;YACX,cAAc,EAAE,IAAI;YACpB,WAAW;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,cAAc;QACvB,MAAM,EACL,WAAW,KAAK,CAAC;YAChB,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,oEAAoE;QACxE,iBAAiB;QACjB,WAAW;QACX,cAAc,EAAE,KAAK;QACrB,WAAW;KACX,CAAC;AAAA,CACF","sourcesContent":["/*\n `omk.read-anchor` — pure hash-anchored read/edit primitives.\n \n A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n \n All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n \n Side-effect free: no filesystem access; `node:crypto` only.\n \n Derived clean-room from the lane C plan\n * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy\n * package source is imported or copied.\n /\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/* 1-indexed start line (resolved). /\n\treadonly offset: number;\n\t/* Number of lines included in the block (resolved). /\n\treadonly limit: number;\n\t/* 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. /\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/* SHA-256 (hex) of the newline-normalized full file content. /\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/* SHA-256 (hex) of the newline-normalized read block content. /\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/\n Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n /\nfunction extractBlock(normalized: string, offset: number \| undefined, limit: number \| undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/* Full file content as read. /\n\treadonly content: string;\n\t/* 1-indexed start line; defaults to 1 (whole file). /\n\treadonly offset?: number;\n\t/* Maximum number of lines; defaults to the rest of the file. /\n\treadonly limit?: number;\n\t/* Optional deterministic id (otherwise a UUID is generated). /\n\treadonly readId?: string;\n}\n\n/\n Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n /\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/\n Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n /\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/* Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. /\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" \|\| value === null \|\| Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" \|\| anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" \|\| anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" \|\| !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" \|\| !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" \|\| range === null \|\| Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" \|\| !Number.isInteger(r[key]) \|\| (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" \| \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" \| \"allow-lenient\" \| \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/* Current full file content at edit time. /\n\treadonly currentContent: string;\n\t/* Defaults to `strict`. /\n\treadonly mode?: AnchoredEditMode;\n\t/\n\t The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t /\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/* Lenient mode only: whether the anchored block was uniquely relocated. /\n\treadonly blockRelocated?: boolean;\n\t/* Lenient mode only: occurrences of the anchored block in current content. /\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/\n Decide whether an anchored edit may proceed.\n \n - Unchanged file -> `allow` (the common fast path).\n * - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n * - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n * text is supplied, hashes to the recorded `blockSha256`, and still occurs\n * exactly once in the current content (unique, non-overlapping relocation).\n * Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined \|\| blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}

package/dist/core/recovery-checkpoint.d.ts CHANGED Viewed

@@ -11,8 +11,8 @@
  * the observed state (git status, per-file hashes) and for executing the plan.
  *
  * Derived clean-room from the lane C plan
- * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`) and the
- * adoption algorithm plan; no Pi package source is imported or copied.
+ * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`) and the
+ * adoption algorithm plan; no legacy package source is imported or copied.
  *
  * Dependency-free apart from `node:path` (pure path math, no I/O).
  */