openplanr 1.25.2 → 2.0.0

package/dist/services/operate/read-only-providers.js

@@ -1,421 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { parseStrictJson } from './evidence-import.js';
-import { minimalSubprocessEnvironment } from './subprocess-env.js';
-import { OperateError } from './types.js';
-const execFileAsync = promisify(execFile);
-const MAX_PROVIDER_OUTPUT = 5 * 1024 * 1024;
-const DEFAULT_REMOTE_TIMEOUT_MS = 20_000;
-const DEFAULT_REMOTE_MAX_BYTES = 5 * 1024 * 1024;
-function minimalEnvironment(extra = {}) {
-    return minimalSubprocessEnvironment(extra);
-}
-const GIT_READ_COMMANDS = new Set([
-    'diff',
-    'log',
-    'show',
-    'status',
-    'tag',
-    'rev-parse',
-    'ls-files',
-    'branch',
-]);
-export function assertGitReadOnlyArgs(args) {
-    const forbiddenRepositoryOverrides = [
-        '-C',
-        '-c',
-        '--git-dir',
-        '--work-tree',
-        '--namespace',
-        '--exec-path',
-        '--config-env',
-    ];
-    if (args.some((argument) => forbiddenRepositoryOverrides.some((option) => argument === option || argument.startsWith(`${option}=`)))) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Git repository and configuration overrides are forbidden for evidence.');
-    }
-    const command = args.find((argument) => !argument.startsWith('-'));
-    if (!command || !GIT_READ_COMMANDS.has(command)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Git operation is not allowlisted for evidence: ${command ?? '(missing)'}.`);
-    }
-    const forbidden = new Set([
-        'commit',
-        'checkout',
-        'switch',
-        'reset',
-        'clean',
-        'push',
-        'pull',
-        'fetch',
-        'merge',
-        'rebase',
-        'cherry-pick',
-        'apply',
-        'am',
-        'gc',
-        'config',
-        'remote',
-    ]);
-    if (args.some((argument) => forbidden.has(argument))) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Git mutation is forbidden.');
-    }
-}
-export async function executeGitReadOnly(projectRoot, args, options = {}) {
-    assertGitReadOnlyArgs(args);
-    const { stdout } = await execFileAsync('git', args, {
-        cwd: projectRoot,
-        env: minimalEnvironment(),
-        maxBuffer: MAX_PROVIDER_OUTPUT,
-        timeout: Math.max(1, Math.min(options.timeoutMs ?? 15_000, 15_000)),
-    });
-    return stdout;
-}
-const GIT_CITATION_REVISION_PATTERN = /^[A-Fa-f0-9]{7,64}$/;
-// Mirrors the `operating-citation@1.4.0` repository-path shape: a bounded,
-// traversal-free, repository-relative path. A leading dot IS permitted so the
-// dot-prefixed roots every advisor mandate authorizes (`.github/`, `.planr/`,
-// `.changeset/`, …) are readable; only a `..` traversal segment stays forbidden.
-const GIT_CITATION_PATH_PATTERN = /^(?!.*\.\.)[A-Za-z0-9.][A-Za-z0-9._/-]*$/;
-// The `.planr/` control-artifact surface is dot-prefixed, so citation-by-artifact
-// reads validate against a distinct, still-bounded `.planr`-rooted pattern.
-const PLANR_CITATION_PATH_PATTERN = /^\.planr(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/;
-const MAX_CITATION_SNAPSHOT_BYTES = 1024 * 1024;
-export function assertGitCitationRevision(revision) {
-    if (typeof revision !== 'string' || !GIT_CITATION_REVISION_PATTERN.test(revision)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Git citation revision must be a bounded hex object name: ${revision ?? '(missing)'}.`);
-    }
-}
-// Exported so the cross-component conformance suite can assert this git-read-layer
-// path validator and the record-time citation anchor accept/reject an identical
-// probe set — the two v1.3-pattern copies that once drifted apart must not again.
-export function assertGitCitationRepositoryPath(relativePath) {
-    if (typeof relativePath !== 'string' ||
-        relativePath.length === 0 ||
-        relativePath.length > 1024 ||
-        relativePath.startsWith('/') ||
-        !GIT_CITATION_PATH_PATTERN.test(relativePath)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Git citation path must be a bounded repository-relative path: ${relativePath ?? '(missing)'}.`);
-    }
-}
-function assertGitPlanrCitationPath(relativePath) {
-    if (typeof relativePath !== 'string' ||
-        relativePath.length === 0 ||
-        relativePath.length > 1024 ||
-        relativePath.startsWith('/') ||
-        relativePath.includes('..') ||
-        !PLANR_CITATION_PATH_PATTERN.test(relativePath)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Planr citation path must be a bounded .planr-relative path: ${relativePath ?? '(missing)'}.`);
-    }
-}
-function countTextLines(content) {
-    if (content.length === 0)
-        return 0;
-    const trimmed = content.endsWith('\n') ? content.slice(0, -1) : content;
-    return trimmed.split('\n').length;
-}
-async function readGitBlob(projectRoot, revision, gitPath, options) {
-    const maxBytes = Math.max(1, Math.min(options.maxBytes ?? MAX_CITATION_SNAPSHOT_BYTES, MAX_PROVIDER_OUTPUT));
-    // `<revision>:<path>` is a single object-name token; the revision and path are
-    // pattern-validated above, so neither can inject a leading `-` git option.
-    try {
-        const stdout = await executeGitReadOnly(projectRoot, ['show', `${revision}:${gitPath}`], {
-            timeoutMs: options.timeoutMs,
-        });
-        if (Buffer.byteLength(stdout, 'utf8') > maxBytes) {
-            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Cited content ${gitPath} exceeds the ${maxBytes}-byte snapshot bound.`);
-        }
-        return { exists: true, content: stdout, lineCount: countTextLines(stdout) };
-    }
-    catch (error) {
-        if (error instanceof OperateError && error.code === 'E_OPERATE_EVIDENCE_REJECTED')
-            throw error;
-        // `git show` exits non-zero when the path or revision is absent — a missing
-        // citation target, not a provider failure, so the resolver can fail closed.
-        return { exists: false, content: null, lineCount: 0 };
-    }
-}
-/**
- * Read one repository-relative file at a pinned revision through the read-only
- * `show` surface for a repository-path citation. Returns `exists: false` when the
- * path is absent at that revision instead of throwing, so a fabricated or drifted
- * citation becomes a fail-closed rejection rather than an error.
- */
-export async function readGitPathAtRevision(projectRoot, revision, relativePath, options = {}) {
-    assertGitCitationRevision(revision);
-    assertGitCitationRepositoryPath(relativePath);
-    return readGitBlob(projectRoot, revision, relativePath, options);
-}
-/** Read a `.planr/`-rooted control artifact at a pinned revision for a planr-artifact citation. */
-export async function readGitPlanrPathAtRevision(projectRoot, revision, planrPath, options = {}) {
-    assertGitCitationRevision(revision);
-    assertGitPlanrCitationPath(planrPath);
-    return readGitBlob(projectRoot, revision, planrPath, options);
-}
-function parseGitTreeListing(stdout) {
-    const entries = [];
-    const lines = stdout.split('\n');
-    for (let index = 0; index < lines.length; index += 1) {
-        // `git show <rev>:<dir>` prefixes the listing with a `tree <rev>:<dir>`
-        // header line followed by a blank line; both are skipped here.
-        if (index === 0 && /^tree \S+:/.test(lines[index]))
-            continue;
-        const name = lines[index].trim();
-        if (name)
-            entries.push(name.replace(/\/$/, ''));
-    }
-    return entries;
-}
-/**
- * List the immediate entry names of a `.planr/`-rooted tree at a pinned revision.
- * Returns an empty list when the tree is absent, so an unresolved planr-artifact
- * citation fails closed rather than throwing.
- */
-export async function listGitPlanrTreeAtRevision(projectRoot, revision, planrTreePath, options = {}) {
-    assertGitCitationRevision(revision);
-    assertGitPlanrCitationPath(planrTreePath);
-    try {
-        const stdout = await executeGitReadOnly(projectRoot, ['show', `${revision}:${planrTreePath}`], {
-            timeoutMs: options.timeoutMs,
-        });
-        return parseGitTreeListing(stdout);
-    }
-    catch {
-        return [];
-    }
-}
-/** Whether a cited revision resolves to a commit object, using the read-only rev-parse surface. */
-export async function gitRevisionResolves(projectRoot, revision, options = {}) {
-    assertGitCitationRevision(revision);
-    try {
-        const stdout = await executeGitReadOnly(projectRoot, ['rev-parse', '--verify', '--quiet', `${revision}^{commit}`], { timeoutMs: options.timeoutMs });
-        return stdout.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-/** A compact, snapshot-safe commit summary (hash, ISO commit date, subject) for a git-revision citation. */
-export async function readGitCommitSummary(projectRoot, revision, options = {}) {
-    assertGitCitationRevision(revision);
-    try {
-        const stdout = await executeGitReadOnly(projectRoot, ['log', '-1', '--no-color', '--format=%H%n%cI%n%s', revision], { timeoutMs: options.timeoutMs });
-        return stdout.trim().length > 0 ? stdout.trim() : null;
-    }
-    catch {
-        return null;
-    }
-}
-const GH_READ_COMMANDS = {
-    issue: new Set(['list', 'view']),
-    pr: new Set(['list', 'view', 'checks']),
-    release: new Set(['list', 'view']),
-    run: new Set(['list', 'view']),
-    repo: new Set(['view']),
-    auth: new Set(['status', 'token']),
-};
-export function assertGitHubReadOnlyArgs(args) {
-    const [resource, action] = args;
-    if (!resource || !action || !GH_READ_COMMANDS[resource]?.has(action)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `GitHub operation is not allowlisted for evidence: ${resource ?? ''} ${action ?? ''}`.trim());
-    }
-    if (args.includes('--web') || args.includes('--jq') || args.includes('--template')) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'GitHub evidence cannot open browsers or execute output templates.');
-    }
-}
-export async function executeGitHubReadOnly(projectRoot, args, options = {}) {
-    assertGitHubReadOnlyArgs(args);
-    const host = process.env.GH_HOST ?? 'github.com';
-    const allowedHosts = options.allowedHosts ?? ['github.com'];
-    if (!allowedHosts.includes(host)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `GitHub host ${host} is not allowlisted.`);
-    }
-    const { stdout } = await execFileAsync('gh', args, {
-        cwd: projectRoot,
-        env: minimalEnvironment({ GH_HOST: host, GH_PROMPT_DISABLED: '1' }),
-        maxBuffer: MAX_PROVIDER_OUTPUT,
-        timeout: Math.max(1, Math.min(options.timeoutMs ?? 20_000, 20_000)),
-    });
-    return stdout;
-}
-function normalizedAllowedHosts(hosts) {
-    return new Set(hosts.map((host) => host.trim().toLowerCase()).filter(Boolean));
-}
-export function assertReadOnlyRestRequest(endpoint, method, allowedHosts) {
-    const url = new URL(endpoint);
-    const normalizedMethod = method.toUpperCase();
-    if (normalizedMethod !== 'GET' && normalizedMethod !== 'HEAD') {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Remote evidence permits GET and HEAD only, not ${normalizedMethod}.`);
-    }
-    if (url.protocol !== 'https:' ||
-        url.username ||
-        url.password ||
-        (url.port && url.port !== '443') ||
-        !normalizedAllowedHosts(allowedHosts).has(url.hostname.toLowerCase())) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', `Remote evidence host is not allowlisted: ${url.hostname || '(missing)'}.`);
-    }
-    return url;
-}
-function boundedPositiveInteger(value, fallback, maximum) {
-    if (value === undefined)
-        return fallback;
-    if (!Number.isSafeInteger(value) || value < 1) {
-        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence limits must be positive integers.');
-    }
-    return Math.min(value, maximum);
-}
-async function readBoundedResponseText(response, maxBytes) {
-    if (response.redirected || (response.status >= 300 && response.status < 400)) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Remote evidence redirects are forbidden.');
-    }
-    if (!response.ok) {
-        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Remote evidence request failed with HTTP ${response.status}.`);
-    }
-    const rawLength = response.headers.get('content-length');
-    if (rawLength !== null) {
-        if (!/^\d+$/.test(rawLength) || Number(rawLength) > maxBytes) {
-            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence Content-Length is invalid or exceeds the configured limit.');
-        }
-    }
-    if (!response.body)
-        return '';
-    const reader = response.body.getReader();
-    const chunks = [];
-    let bytes = 0;
-    try {
-        while (true) {
-            const next = await reader.read();
-            if (next.done)
-                break;
-            bytes += next.value.byteLength;
-            if (bytes > maxBytes) {
-                await reader
-                    .cancel('OpenPlanr remote evidence byte limit exceeded.')
-                    .catch(() => undefined);
-                throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence streamed response exceeds the configured byte limit.');
-            }
-            chunks.push(next.value);
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-    const merged = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)), bytes);
-    try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(merged);
-    }
-    catch {
-        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence is not valid UTF-8.');
-    }
-}
-async function fetchBoundedJson(endpoint, init, options) {
-    const timeoutMs = boundedPositiveInteger(options.timeoutMs, DEFAULT_REMOTE_TIMEOUT_MS, 60_000);
-    const maxBytes = boundedPositiveInteger(options.maxBytes, DEFAULT_REMOTE_MAX_BYTES, DEFAULT_REMOTE_MAX_BYTES);
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-        const response = await (options.fetchImpl ?? fetch)(endpoint, {
-            ...init,
-            redirect: 'error',
-            signal: controller.signal,
-        });
-        if (response.redirected || (response.status >= 300 && response.status < 400)) {
-            throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Remote evidence redirects are forbidden.');
-        }
-        const contentType = response.headers.get('content-type') ?? '';
-        if (response.status !== 204 &&
-            contentType &&
-            !/(?:application\/json|\+json)\b/i.test(contentType)) {
-            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence response is not JSON.');
-        }
-        const body = await readBoundedResponseText(response, maxBytes);
-        if (!body && response.status === 204)
-            return null;
-        try {
-            return parseStrictJson(body, {
-                maxBytes,
-                maxDepth: 64,
-                maxScalars: 100_000,
-                maxStringLength: maxBytes,
-            });
-        }
-        catch (error) {
-            if (error instanceof OperateError)
-                throw error;
-            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Remote evidence response contains malformed JSON.');
-        }
-    }
-    catch (error) {
-        if (error.name === 'AbortError') {
-            throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', `Remote evidence request exceeded the ${timeoutMs}ms timeout.`);
-        }
-        throw error;
-    }
-    finally {
-        clearTimeout(timer);
-    }
-}
-export async function executeRestReadOnlyJson(endpoint, options) {
-    const method = options.method ?? 'GET';
-    const url = assertReadOnlyRestRequest(endpoint, method, options.allowedHosts);
-    return fetchBoundedJson(url, {
-        method,
-        headers: options.headers,
-    }, options);
-}
-function stripGraphqlComments(query) {
-    return query.replace(/#[^\r\n]*/g, '').trim();
-}
-export function assertLinearReadOnlyQuery(endpoint, query) {
-    const url = new URL(endpoint);
-    if (url.protocol !== 'https:' ||
-        url.hostname !== 'api.linear.app' ||
-        url.pathname !== '/graphql' ||
-        url.username ||
-        url.password ||
-        (url.port && url.port !== '443') ||
-        url.search ||
-        url.hash) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Linear evidence endpoint must be https://api.linear.app/graphql.');
-    }
-    const normalized = stripGraphqlComments(query);
-    if (/\b(?:mutation|subscription)\b/i.test(normalized) ||
-        (!normalized.startsWith('query') && !normalized.startsWith('{'))) {
-        throw new OperateError('E_OPERATE_PROVIDER_READ_ONLY', 'Linear evidence permits GraphQL query operations only.');
-    }
-}
-export class ReadOnlyLinearTransport {
-    transport;
-    constructor(transport) {
-        this.transport = transport;
-    }
-    async query(query, variables) {
-        assertLinearReadOnlyQuery(this.transport.endpoint, query);
-        return this.transport.query(query, variables);
-    }
-}
-export async function executeLinearReadOnlyQuery(input) {
-    const endpoint = input.endpoint ?? 'https://api.linear.app/graphql';
-    assertLinearReadOnlyQuery(endpoint, input.query);
-    if (!input.token.trim()) {
-        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Linear evidence credentials are unavailable.');
-    }
-    const requestBody = JSON.stringify({
-        query: input.query,
-        variables: input.variables ?? {},
-    });
-    if (Buffer.byteLength(requestBody) > 256 * 1024) {
-        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Linear evidence query exceeds the request-size limit.');
-    }
-    const response = await fetchBoundedJson(new URL(endpoint), {
-        method: 'POST',
-        headers: {
-            authorization: input.token,
-            'content-type': 'application/json',
-        },
-        body: requestBody,
-    }, input);
-    if (response.errors?.length || response.data === undefined) {
-        throw new OperateError('E_OPERATE_EVIDENCE_REJECTED', 'Linear evidence query returned a GraphQL error.');
-    }
-    return response.data;
-}
-//# sourceMappingURL=read-only-providers.js.map

package/dist/services/operate/read-only-providers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"read-only-providers.js","sourceRoot":"","sources":["../../../src/services/operate/read-only-providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC1C,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,SAAS,kBAAkB,CAAC,QAA2B,EAAE;IACvD,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,KAAK;IACL,WAAW;IACX,UAAU;IACV,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,4BAA4B,GAAG;QACnC,IAAI;QACJ,IAAI;QACJ,WAAW;QACX,aAAa;QACb,aAAa;QACb,aAAa;QACb,cAAc;KACf,CAAC;IACF,IACE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACrB,4BAA4B,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CACrE,CACF,EACD,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,kDAAkD,OAAO,IAAI,WAAW,GAAG,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,OAAO;QACP,OAAO;QACP,MAAM;QACN,MAAM;QACN,OAAO;QACP,OAAO;QACP,QAAQ;QACR,aAAa;QACb,OAAO;QACP,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,YAAY,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,IAAc,EACd,UAAkC,EAAE;IAEpC,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAClD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,kBAAkB,EAAE;QACzB,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;KACpE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AAC5D,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAC7E,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,2BAA2B,GAAG,4CAA4C,CAAC;AACjF,MAAM,2BAA2B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,4DAA4D,QAAQ,IAAI,WAAW,GAAG,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,UAAU,+BAA+B,CAAC,YAAoB;IAClE,IACE,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,IAAI;QAC1B,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5B,CAAC,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,iEAAiE,YAAY,IAAI,WAAW,GAAG,CAChG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,IACE,OAAO,YAAY,KAAK,QAAQ;QAChC,YAAY,CAAC,MAAM,KAAK,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,IAAI;QAC1B,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;QAC5B,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC3B,CAAC,2BAA2B,CAAC,IAAI,CAAC,YAAY,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,+DAA+D,YAAY,IAAI,WAAW,GAAG,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC;AAQD,KAAK,UAAU,WAAW,CACxB,WAAmB,EACnB,QAAgB,EAChB,OAAe,EACf,OAAkD;IAElD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,2BAA2B,EAAE,mBAAmB,CAAC,CAC/E,CAAC;IACF,+EAA+E;IAC/E,2EAA2E;IAC3E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,EAAE;YACvF,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,iBAAiB,OAAO,gBAAgB,QAAQ,uBAAuB,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,6BAA6B;YAAE,MAAM,KAAK,CAAC;QAC/F,4EAA4E;QAC5E,4EAA4E;QAC5E,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,QAAgB,EAChB,YAAoB,EACpB,UAAqD,EAAE;IAEvD,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,+BAA+B,CAAC,YAAY,CAAC,CAAC;IAC9C,OAAO,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,QAAgB,EAChB,SAAiB,EACjB,UAAqD,EAAE;IAEvD,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,KAAK,KAAK,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,QAAgB,EAChB,aAAqB,EACrB,UAAkC,EAAE;IAEpC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,0BAA0B,CAAC,aAAa,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,IAAI,aAAa,EAAE,CAAC,EAAE;YAC7F,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;QACH,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,QAAgB,EAChB,UAAkC,EAAE;IAEpC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,WAAW,EACX,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,EAC5D,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,QAAgB,EAChB,UAAkC,EAAE;IAEpC,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,WAAW,EACX,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,EAAE,QAAQ,CAAC,EAC7D,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAgC;IACpD,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,EAAE,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAEF,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,qDAAqD,QAAQ,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,mEAAmE,CACpE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,IAAc,EACd,UAA2D,EAAE;IAE7D,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,eAAe,IAAI,sBAAsB,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE;QACjD,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;QACnE,SAAS,EAAE,mBAAmB;QAC9B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;KACpE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAcD,SAAS,sBAAsB,CAAC,KAAwB;IACtD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAsB,EACtB,MAAc,EACd,YAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;QAC9D,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,kDAAkD,gBAAgB,GAAG,CACtE,CAAC;IACJ,CAAC;IACD,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;QAChC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,4CAA4C,GAAG,CAAC,QAAQ,IAAI,WAAW,GAAG,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAC7B,KAAyB,EACzB,QAAgB,EAChB,OAAe;IAEf,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,QAAkB,EAAE,QAAgB;IACzE,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,4CAA4C,QAAQ,CAAC,MAAM,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACzD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,4EAA4E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,MAAM;qBACT,MAAM,CAAC,gDAAgD,CAAC;qBACxD,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,sEAAsE,CACvE,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EACzC,KAAK,CACN,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,qCAAqC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,QAAa,EACb,IAAiB,EACjB,OAAoC;IAEpC,MAAM,SAAS,GAAG,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG,sBAAsB,CACrC,OAAO,CAAC,QAAQ,EAChB,wBAAwB,EACxB,wBAAwB,CACzB,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE;YAC5D,GAAG,IAAI;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;YACvB,WAAW;YACX,CAAC,iCAAiC,CAAC,IAAI,CAAC,WAAW,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAS,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,IAAI,EAAE;gBAC3B,QAAQ;gBACR,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,OAAO;gBACnB,eAAe,EAAE,QAAQ;aAC1B,CAAM,CAAC;QACV,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY;gBAAE,MAAM,KAAK,CAAC;YAC/C,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,mDAAmD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAAe,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC3C,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,wCAAwC,SAAS,aAAa,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAsB,EACtB,OAGC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,gBAAgB,CACrB,GAAG,EACH;QACE,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,KAAa;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,gBAAgB;QACjC,GAAG,CAAC,QAAQ,KAAK,UAAU;QAC3B,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC;QAChC,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI,EACR,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,IACE,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QACjD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,YAAY,CACpB,8BAA8B,EAC9B,wDAAwD,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,SAA+B;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAEhE,KAAK,CAAC,KAAK,CAAI,KAAa,EAAE,SAA6C;QACzE,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAI,KAAK,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAKC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gCAAgC,CAAC;IACpE,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;KACjC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAIrC,IAAI,GAAG,CAAC,QAAQ,CAAC,EACjB;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,KAAK,CAAC,KAAK;YAC1B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,WAAW;KAClB,EACD,KAAK,CACN,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC"}

package/dist/services/operate/redaction.d.ts

@@ -1,74 +0,0 @@
-import { type CollectedEvidenceItem, type OperatingEvidenceItem, type OperatingSensitivity } from './types.js';
-export interface SecretDetectionMetadata {
-    ruleId: string;
-    category: 'assignment' | 'known-token' | 'authorization' | 'private-key' | 'jwt' | 'credential-url' | 'structured-secret';
-    line: number;
-    hardBlock: boolean;
-}
-export declare function compareSensitivity(left: OperatingSensitivity, right: OperatingSensitivity): number;
-export declare function maximumSensitivity(values: readonly OperatingSensitivity[]): OperatingSensitivity;
-export declare function assertSensitivityAllowed(sensitivity: OperatingSensitivity, ceiling: OperatingSensitivity): void;
-export declare function normalizeUntrustedText(value: string): string;
-/**
- * Truncate by UTF-16 storage units without splitting a valid Unicode scalar.
- *
- * Operating evidence is later serialized with RFC 8785/JCS, which correctly
- * rejects lone surrogate units. JavaScript's String#slice can manufacture one
- * when a supplementary character (for example an emoji) straddles the limit.
- */
-export declare function truncateUnicodeScalarText(value: string, maximumCodeUnits: number): string;
-export interface RedactionResult {
-    value: string;
-    redactions: string[];
-    inputDigest: `sha256:${string}`;
-}
-export interface EmbeddedInstructionInspection {
-    annotations: string[];
-    quarantined: boolean;
-}
-/**
- * Classify instruction-shaped text before it is exposed through a bounded mandate read.
- *
- * Evidence is allowed to discuss prompts and tools, so ordinary control-like
- * prose is annotated and then inert-framed. Direct tool/credential
- * exfiltration instructions are quarantined instead of being sent to a model.
- */
-export declare function inspectEmbeddedInstructions(input: string): EmbeddedInstructionInspection;
-export interface AdvisorEvidenceText {
-    value: string;
-    annotations: string[];
-    quarantined: boolean;
-    reason: string | null;
-}
-/**
- * Redact, inspect, and deterministically frame one evidence excerpt.
- *
- * The digest-derived boundary prevents evidence from manufacturing a matching
- * closing marker. The framed value remains untrusted citation text inside the
- * runtime mandate and is never promoted to a system/developer instruction.
- */
-export declare function prepareAdvisorEvidenceText(input: {
-    evidenceId: string;
-    digest: `sha256:${string}`;
-    value: string;
-}): AdvisorEvidenceText;
-export declare function redactSensitiveText(input: string, options?: {
-    redactPii?: boolean;
-}): RedactionResult;
-export declare function detectSecretMetadata(value: string): SecretDetectionMetadata[];
-/**
- * The detections that must REFUSE the content outright — a known token, an
- * authorization header, a private key, a JWT, or a credential URL.
- *
- * The remaining categories (`assignment`, `structured-secret`) are secret-SHAPED
- * rather than secret: a `token: write` workflow permission or a `password:` key
- * quoted from public configuration matches them. Those are exactly what the
- * redaction path is built to rewrite in place, so a caller that rejects on ANY
- * detection discards legitimate content. Callers that must fail closed rather
- * than redact filter on this set, as the citation resolver does.
- */
-export declare function hardBlockedSecretDetections(value: string): SecretDetectionMetadata[];
-export declare function containsSecret(value: string): boolean;
-export declare function sanitizeEvidenceItem(input: CollectedEvidenceItem): OperatingEvidenceItem;
-export declare function sanitizeGeneratedPlainText(value: string): string;
-//# sourceMappingURL=redaction.d.ts.map

package/dist/services/operate/redaction.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/services/operate/redaction.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,qBAAqB,EAE1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AAuFpB,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EACJ,YAAY,GACZ,aAAa,GACb,eAAe,GACf,aAAa,GACb,KAAK,GACL,gBAAgB,GAChB,mBAAmB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAqID,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,oBAAoB,GAC1B,MAAM,CAER;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,GAAG,oBAAoB,CAKhG;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,oBAAoB,EACjC,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAON;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,UAAU,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,6BAA6B,CAcxF;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,MAAM,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,mBAAmB,CAqDtB;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,eAAe,CA+BjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,EAAE,CA2B7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAEpF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,qBAAqB,CAmCxF;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhE"}