prismatica 0.2.0

package/dist/checkengine.js

@@ -0,0 +1,220 @@
+/**
+ * The ONE check engine — run identically by `prismatica check` (local) and
+ * `prismatica gate` (CI). It runs the repo's own tools (tsc, eslint, vitest,
+ * build, Playwright, gitleaks) and adds the deterministic checks Prismatica owns:
+ * the scope backstop, acceptance→test traceability, and the docs delta. It reads
+ * only git and test results — never any agent conversation.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { execa } from 'execa';
+import { listFlows, readRulesFile, verifyFlowIntegrity, verifyRulesIntegrity } from './atlas/store.js';
+import { assessImpact, autoUnresolved, flowReportCommand, reportGaps, } from './atlas/impact.js';
+import { blockingForFraming, classifyDirtyAtlasRecords } from './atlas/hygiene.js';
+import * as git from './git.js';
+import { readFlowReport, reportExists } from './records/store.js';
+import { classifyFiles } from './scope.js';
+import { scanTextForSecrets } from './secrets.js';
+import { parseVitestReport, tracesToPassingTest } from './vitestreport.js';
+function pass(name, detail) {
+    return { name, status: 'pass', detail };
+}
+function fail(name, detail) {
+    return { name, status: 'fail', detail };
+}
+function skip(name, detail) {
+    return { name, status: 'skipped', detail };
+}
+function warn(name, detail) {
+    return { name, status: 'warn', detail };
+}
+/** Run a configured command string in the change's working tree (no shell). */
+async function runCommand(home, name, command) {
+    const [file, ...args] = command.split(/\s+/).filter(Boolean);
+    if (!file) {
+        return { outcome: skip(name, 'no command configured'), stdout: '' };
+    }
+    const result = await execa(file, args, { cwd: home, reject: false, all: true });
+    const outcome = result.failed
+        ? fail(name, `\`${command}\` exited ${result.exitCode ?? 'non-zero'}`)
+        : pass(name, command);
+    return { outcome, stdout: result.all ?? result.stdout ?? '' };
+}
+async function gitleaksAvailable() {
+    const result = await execa('gitleaks', ['version'], { reject: false });
+    return !result.failed;
+}
+export async function runCheckEngine(ctx) {
+    const { home, contract, config } = ctx;
+    const outcomes = [];
+    // The change diff vs the recorded baseline, records excluded (never re-baselined).
+    const changedFiles = await git.changedFilesSince(home, contract.baseline.commit, git.EXCLUDE_RECORDS);
+    // ── External tool checks (only what init detected as runnable) ──────────────
+    let vitestStdout = '';
+    const external = [
+        ['typecheck', config.checks.typecheck],
+        ['lint', config.checks.lint],
+        ['unit', config.checks.unit],
+        ['build', config.checks.build],
+        ['journeys', config.checks.journeys],
+    ];
+    for (const [name, toggle] of external) {
+        if (!toggle.enabled || !toggle.command) {
+            outcomes.push(skip(name, 'not configured at init — reported, never silently skipped'));
+            continue;
+        }
+        const { outcome, stdout } = await runCommand(home, name, toggle.command);
+        if (name === 'unit') {
+            vitestStdout = stdout;
+        }
+        outcomes.push(outcome);
+    }
+    // ── Secret scan (gitleaks when available, else the regex fallback) ──────────
+    outcomes.push(await secretScan(home, config, changedFiles));
+    // ── Scope backstop (the universal, deterministic check) ─────────────────────
+    const verdict = classifyFiles(changedFiles, contract.allowedPaths, contract.forbiddenPaths);
+    outcomes.push(verdict.outOfScope.length === 0
+        ? pass('scope', `${verdict.inScope.length} changed file(s), all in scope`)
+        : fail('scope', `out of scope: ${verdict.outOfScope.join(', ')}`));
+    // ── Acceptance → test traceability ──────────────────────────────────────────
+    outcomes.push(traceability(contract, config, vitestStdout));
+    // ── Docs delta ──────────────────────────────────────────────────────────────
+    outcomes.push(docsDelta(contract, changedFiles));
+    // ── Atlas: main has an approved-but-uncommitted canonical record this lane's
+    // own history could never carry (the release-blocker class: a lane branches
+    // from main's last COMMIT — an uncommitted approval on main simply isn't
+    // reachable from it, so truth-integrity/atlas-impact below would otherwise
+    // silently treat "flows.length === 0" as "legitimately none" and pass) ──────
+    outcomes.push(await atlasUncommittedMain(home, config));
+    // ── Atlas: canonical truth integrity (Requirement 1) ─────────────────────────
+    const { flows, problems: flowProblems } = listFlows(home);
+    outcomes.push(atlasTruthIntegrity(home, config, flows, flowProblems));
+    // ── Atlas: impact/honesty (WARN only here — the gate decides what it means) ──
+    const impact = assessImpact(changedFiles, flows);
+    outcomes.push(atlasImpactWarning(home, contract, impact, flows.length));
+    const pass_ = outcomes.every((outcome) => outcome.status !== 'fail');
+    return { outcomes, pass: pass_, changedFiles, impact };
+}
+/**
+ * Closes the fail-open class behind the release blocker: `home`'s own
+ * checkout can only ever see Atlas records reachable from ITS git history
+ * (by design — it must match what a fresh CI clone of this branch would
+ * see, Model B's whole point). If main currently has an uncommitted,
+ * approved Flow/Rule/Delta this lane's baseline could never have inherited,
+ * that's not "legitimately no Atlas records" — it's a record that SHOULD
+ * exist here and is silently missing. `git.mainRepoRoot(home)` resolves to
+ * the real main worktree when `home` is a separate lane (locally, where
+ * this is actually checkable); in CI, `home` IS mainRoot (Model B's single
+ * checkout), so this is a harmless no-op there — nothing to compare against.
+ */
+async function atlasUncommittedMain(home, config) {
+    const mainRoot = await git.mainRepoRoot(home);
+    const findings = await classifyDirtyAtlasRecords(mainRoot, config);
+    // A merely-proposed Delta has no bearing on lane-baseline integrity — it's
+    // an everyday, harmless state, never a reason to fail here (it's `next`'s
+    // job to point the owner at `delta approve`, not this check's).
+    const blocking = blockingForFraming(findings);
+    if (blocking.length === 0) {
+        return pass('atlas-uncommitted-main', 'no uncommitted Atlas records on main');
+    }
+    const detail = `main has ${blocking.length} uncommitted Atlas record(s) this lane's history could never carry: ${blocking.map((f) => f.detail).join('; ')} — resolve on main, then re-run`;
+    return config.mode === 'govern' ? fail('atlas-uncommitted-main', detail) : warn('atlas-uncommitted-main', detail);
+}
+function atlasTruthIntegrity(home, config, flows, flowProblems) {
+    const { data: rulesFile } = readRulesFile(home);
+    if (flows.length === 0 && flowProblems.length === 0 && !rulesFile) {
+        return skip('truth-integrity', 'no Atlas flows or rules in this repo');
+    }
+    const brokenFlows = flows
+        .map((flow) => verifyFlowIntegrity(flow, config.mode, config.owner.publicKey))
+        .filter((integrity) => !integrity.ok);
+    const rulesIntegrity = rulesFile ? verifyRulesIntegrity(rulesFile, config.mode, config.owner.publicKey) : null;
+    const problems = [
+        ...flowProblems.map((p) => `"${p.id}" is unreadable (${p.error})`),
+        ...brokenFlows.map((integrity) => integrity.warning ?? 'a flow failed integrity verification'),
+        ...(rulesIntegrity && !rulesIntegrity.ok ? [rulesIntegrity.warning ?? 'app rules failed integrity verification'] : []),
+    ];
+    return problems.length === 0
+        ? pass('truth-integrity', `${flows.length} flow(s)${rulesFile ? ' + rules' : ''} verified`)
+        : fail('truth-integrity', problems.join('; '));
+}
+function atlasImpactWarning(home, contract, impact, flowCount) {
+    if (impact.level === 'none') {
+        return flowCount === 0
+            ? skip('atlas-impact', 'no Atlas flows mapped in this repo')
+            : pass('atlas-impact', 'no mapped flow overlaps this change');
+    }
+    const report = reportExists(home, contract.id) ? readFlowReport(home, contract.id).data : null;
+    const gaps = reportGaps(impact, report);
+    if (gaps.length === 0) {
+        return pass('atlas-impact', 'flow report covers what this change touches');
+    }
+    // `--auto` FIRST, because it is the one step that needs no thought: it writes
+    // the entries the diff already proves, and shrinks what is left to the
+    // questions that genuinely need a person. Those go LAST, as exact commands,
+    // so the thing still on screen when this warning ends is the work only the
+    // reporter can do — not a green summary line it scrolled past.
+    const outstanding = autoUnresolved(impact, report)
+        .map((gap) => flowReportCommand(gap.flowId))
+        .join('  ');
+    const then = outstanding === '' ? '' : ` — then, flow by flow: ${outstanding}`;
+    return warn('atlas-impact', `run \`prismatica flow report --auto\` first (it records what the diff proves; it never decides whether behaviour changed): ${gaps.join('; ')} — the gate will require this${then}`);
+}
+async function secretScan(home, config, changedFiles) {
+    if (!config.checks.secrets.enabled) {
+        return skip('secrets', 'disabled in config');
+    }
+    if (config.checks.secrets.mode === 'gitleaks' && (await gitleaksAvailable())) {
+        const result = await execa('gitleaks', ['detect', '--no-banner', '--redact'], {
+            cwd: home,
+            reject: false,
+        });
+        return result.failed
+            ? fail('secrets', 'gitleaks found potential secrets')
+            : pass('secrets', 'gitleaks: clean');
+    }
+    // Regex fallback over changed code files.
+    const findings = [];
+    for (const file of changedFiles) {
+        const full = path.join(home, file);
+        if (!fs.existsSync(full) || fs.statSync(full).isDirectory()) {
+            continue;
+        }
+        const matches = scanTextForSecrets(file, fs.readFileSync(full, 'utf8'));
+        findings.push(...matches.map((m) => `${m.file} (${m.rule})`));
+    }
+    return findings.length === 0
+        ? pass('secrets', 'regex fallback: clean')
+        : fail('secrets', `possible secrets: ${findings.join(', ')}`);
+}
+function traceability(contract, config, vitestStdout) {
+    const manual = contract.acceptanceChecks.filter((check) => check.test.startsWith('manual:'));
+    const automated = contract.acceptanceChecks.filter((check) => !check.test.startsWith('manual:'));
+    if (automated.length === 0) {
+        return pass('traceability', `${manual.length} manual check(s) — owner attests at accept`);
+    }
+    // Fail closed: an acceptance check that names a test but has no test runner to
+    // prove it is unproven, not "skipped". Configure a unit runner, or mark it manual.
+    if (!config.checks.unit.enabled) {
+        return fail('traceability', `${automated.length} acceptance check(s) reference tests, but no unit runner is configured to prove them — add one, or mark them manual:OWNER`);
+    }
+    const summary = parseVitestReport(vitestStdout);
+    if (!summary) {
+        return fail('traceability', 'could not read the test report to trace acceptance checks');
+    }
+    const untraced = automated.filter((check) => !tracesToPassingTest(summary, check.test));
+    return untraced.length === 0
+        ? pass('traceability', `${automated.length} acceptance check(s) trace to passing tests`)
+        : fail('traceability', `no passing test found for: ${untraced.map((check) => `${check.id} (${check.test})`).join(', ')}`);
+}
+function docsDelta(contract, changedFiles) {
+    if (contract.docsDelta.length === 0) {
+        return pass('docs-delta', 'no docs delta required');
+    }
+    const changedSet = new Set(changedFiles);
+    const missing = contract.docsDelta.filter((doc) => !changedSet.has(doc));
+    return missing.length === 0
+        ? pass('docs-delta', 'all required docs were updated')
+        : fail('docs-delta', `docs not updated: ${missing.join(', ')}`);
+}
+//# sourceMappingURL=checkengine.js.map

package/dist/checkengine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkengine.js","sourceRoot":"","sources":["../src/checkengine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,oBAAoB,EAAqB,MAAM,kBAAkB,CAAC;AAC1H,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,UAAU,GAEX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAW3E,SAAS,IAAI,CAAC,IAAY,EAAE,MAAe;IACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AACD,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AACD,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AACD,SAAS,IAAI,CAAC,IAAY,EAAE,MAAc;IACxC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,IAAY,EACZ,OAAe;IAEf,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM;QAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,OAAO,aAAa,MAAM,CAAC,QAAQ,IAAI,UAAU,EAAE,CAAC;QACtE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;AACxB,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAiB;IACpD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,mFAAmF;IACnF,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAC9C,IAAI,EACJ,QAAQ,CAAC,QAAQ,CAAC,MAAM,EACxB,GAAG,CAAC,eAAe,CACpB,CAAC;IAEF,+EAA+E;IAC/E,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAuD;QACnE,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACtC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC9B,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KACrC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,2DAA2D,CAAC,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,YAAY,GAAG,MAAM,CAAC;QACxB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAE5D,+EAA+E;IAC/E,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5F,QAAQ,CAAC,IAAI,CACX,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,gCAAgC,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CACpE,CAAC;IAEF,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAE5D,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;IAEjD,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAExD,gFAAgF;IAChF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IAEtE,gFAAgF;IAChF,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAExE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAc;IAC9D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnE,2EAA2E;IAC3E,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,wBAAwB,EAAE,sCAAsC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,QAAQ,CAAC,MAAM,uEAAuE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC;IAC3L,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAY,EACZ,MAAc,EACd,KAAa,EACb,YAA4B;IAE5B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,WAAW,GAAG,KAAK;SACtB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;SAC7E,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,QAAQ,GAAG;QACf,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,KAAK,GAAG,CAAC;QAClE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,IAAI,sCAAsC,CAAC;QAC9F,GAAG,CAAC,cAAc,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,IAAI,yCAAyC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvH,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,KAAK,CAAC,MAAM,WAAW,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC;QAC3F,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,QAAkB,EAClB,MAAwB,EACxB,SAAiB;IAEjB,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,SAAS,KAAK,CAAC;YACpB,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,oCAAoC,CAAC;YAC5D,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,cAAc,EAAE,6CAA6C,CAAC,CAAC;IAC7E,CAAC;IACD,8EAA8E;IAC9E,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC;SAC/C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;SAC3C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B,WAAW,EAAE,CAAC;IAC/E,OAAO,IAAI,CACT,cAAc,EACd,8HAA8H,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,IAAI,EAAE,CACpL,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,MAAc,EACd,YAAsB;IAEtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE;YAC5E,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM;YAClB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,kCAAkC,CAAC;YACrD,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IACzC,CAAC;IACD,0CAA0C;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB,EAAE,MAAc,EAAE,YAAoB;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,GAAG,MAAM,CAAC,MAAM,4CAA4C,CAAC,CAAC;IAC5F,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,OAAO,IAAI,CACT,cAAc,EACd,GAAG,SAAS,CAAC,MAAM,2HAA2H,CAC/I,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,cAAc,EAAE,2DAA2D,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,SAAS,CAAC,MAAM,6CAA6C,CAAC;QACxF,CAAC,CAAC,IAAI,CACF,cAAc,EACd,8BAA8B,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;AACR,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB,EAAE,YAAsB;IAC3D,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,gCAAgC,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/claudehook.js

@@ -0,0 +1,189 @@
+/**
+ * Generate the Claude Code scope hook for a worktree lane. This is the quality
+ * layer that stops an agent from straying in the first place; the universal
+ * git-diff check in `check`/`gate` is the real, deterministic backstop.
+ *
+ * The generated script is self-contained (no runtime dependency on picomatch or
+ * on Prismatica): each contract glob is compiled to a RegExp here, at generation
+ * time, and the source is embedded. A PreToolUse hook that exits 2 blocks the
+ * tool call.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import picomatch from 'picomatch';
+import { ATLAS_CANONICAL_GLOBS, ATLAS_PROPOSAL_GLOBS } from './paths.js';
+import { DANGEROUS_COMMAND_PATTERNS, SECRET_READ_GLOBS } from './scope.js';
+function compileGlobs(globs) {
+    return globs.map((glob) => {
+        const regex = picomatch.makeRe(glob, { dot: true });
+        return { source: regex.source, flags: regex.flags };
+    });
+}
+function serialiseRegexArray(regexes) {
+    return `[${regexes.map((r) => `[${JSON.stringify(r.source)}, ${JSON.stringify(r.flags)}]`).join(', ')}]`;
+}
+export function generateScopeHookScript(input) {
+    const allowed = serialiseRegexArray(compileGlobs(input.allowedPaths));
+    const forbidden = serialiseRegexArray(compileGlobs(input.forbiddenPaths));
+    const proposals = serialiseRegexArray(compileGlobs(ATLAS_PROPOSAL_GLOBS));
+    const canonical = serialiseRegexArray(compileGlobs(ATLAS_CANONICAL_GLOBS));
+    const secrets = serialiseRegexArray(compileGlobs(SECRET_READ_GLOBS));
+    const dangerous = `[${DANGEROUS_COMMAND_PATTERNS.map((p) => `[${JSON.stringify(p.source)}, ${JSON.stringify(p.flags)}]`).join(', ')}]`;
+    return `#!/usr/bin/env node
+/* eslint-disable no-undef -- generated, plain-JS Node script: the repo's own
+   eslint.config.js gives TypeScript files a "no-undef" exemption (redundant
+   next to tsc's own checking) but never configured Node globals for plain
+   .js/.mjs files, so a bare "process" reference here would otherwise trip
+   "no-undef" under any repo's default ESLint config, including this one's. */
+// GENERATED by Prismatica for contract ${input.contractId}. Do not edit by hand;
+// it is regenerated whenever the contract's scope is amended.
+//
+// A Claude Code PreToolUse hook. Reads the tool call on stdin and exits 2 to
+// block edits/writes outside the contract's allowed files, reads of secrets,
+// and dangerous shell commands. Prismatica never reads agent chat — only this
+// single tool call, and only to decide allow/block.
+import fs from 'node:fs';
+import path from 'node:path';
+
+const build = (pairs) => pairs.map(([s, f]) => new RegExp(s, f));
+const ALLOWED = build(${allowed});
+const FORBIDDEN = build(${forbidden});
+const PROPOSALS = build(${proposals});
+const CANONICAL = build(${canonical});
+const SECRETS = build(${secrets});
+const DANGEROUS = build(${dangerous});
+
+// Resolve symlinks in the longest existing prefix of a path, then re-append the
+// rest (the file being written may not exist yet). This makes comparison robust
+// to symlinked roots like macOS /tmp → /private/tmp, so an allowed file passed
+// as /tmp/... is not mistaken for being outside the lane.
+function realish(target) {
+  let current = path.resolve(target);
+  const tail = [];
+  for (;;) {
+    try {
+      return path.join(fs.realpathSync(current), ...tail.reverse());
+    } catch {
+      const parent = path.dirname(current);
+      if (parent === current) return path.resolve(target);
+      tail.push(path.basename(current));
+      current = parent;
+    }
+  }
+}
+
+const WORKTREE = realish(${JSON.stringify(input.worktreeRoot)});
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let data = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => (data += chunk));
+    process.stdin.on('end', () => resolve(data));
+    if (process.stdin.isTTY) resolve('');
+  });
+}
+
+function block(message) {
+  process.stderr.write('[prismatica] blocked: ' + message + '\\n');
+  process.exit(2);
+}
+
+function toRel(filePath) {
+  const abs = realish(path.isAbsolute(filePath) ? filePath : path.join(WORKTREE, filePath));
+  return path.relative(WORKTREE, abs).split(path.sep).join('/');
+}
+
+const raw = await readStdin();
+let payload = {};
+try {
+  payload = raw ? JSON.parse(raw) : {};
+} catch {
+  process.exit(0); // never our job to fail a call we cannot parse
+}
+
+const tool = payload.tool_name || '';
+const ti = payload.tool_input || {};
+const EDIT_TOOLS = ['Write', 'Edit', 'MultiEdit', 'NotebookEdit'];
+
+if (EDIT_TOOLS.includes(tool) && ti.file_path) {
+  const rel = toRel(ti.file_path);
+  if (rel.startsWith('..')) block('editing outside this lane is not allowed: ' + ti.file_path);
+  // Canonical Flow/Rule records (truth + approval) are never editable from a
+  // lane, unconditionally — this wins even if the contract's allowedPaths
+  // would otherwise match. The only writer is the approve path on main.
+  if (CANONICAL.some((re) => re.test(rel)))
+    block(
+      '"' +
+        rel +
+        '" is a canonical Flow/Rule record — agents cannot edit it from a lane; write a proposal instead and have the owner approve it',
+    );
+  if (FORBIDDEN.some((re) => re.test(rel)))
+    block('"' + rel + '" is on the contract\\'s forbidden list');
+  // Flow/Rule proposals are always writable from a lane, regardless of the
+  // contract's allowedPaths (but not exempt from FORBIDDEN above).
+  const isProposal = PROPOSALS.some((re) => re.test(rel));
+  if (!isProposal && !ALLOWED.some((re) => re.test(rel)))
+    block('"' + rel + '" is outside the contract\\'s allowed files — amend the contract to widen scope');
+}
+
+if (tool === 'Read' && ti.file_path) {
+  const rel = toRel(ti.file_path);
+  if (SECRETS.some((re) => re.test(rel))) block('reading secrets is not allowed: ' + rel);
+}
+
+if (tool === 'Bash' && ti.command) {
+  if (DANGEROUS.some((re) => re.test(ti.command))) block('dangerous command: ' + ti.command);
+}
+
+process.exit(0);
+`;
+}
+export const HOOK_SCRIPT_NAME = 'prismatica-scope-hook.mjs';
+// Local, uncommitted settings — Claude Code honours hooks here, and it never
+// enters the PR or merges to main (it embeds a lane-specific absolute path).
+export const HOOK_SETTINGS_NAME = 'settings.local.json';
+/** The lane-local hook artifacts that must stay out of git. */
+export const HOOK_IGNORE_PATHS = [`.claude/${HOOK_SCRIPT_NAME}`, `.claude/${HOOK_SETTINGS_NAME}`];
+export const SCOPE_HOOK_MATCHER = 'Write|Edit|MultiEdit|NotebookEdit|Read|Bash';
+/**
+ * The exact settings entry Prismatica owns. Kept as one pure renderer so
+ * installation and `close`'s content-aware disposal check cannot drift.
+ */
+export function generatedScopeHookEntry(worktreeRoot) {
+    const scriptPath = path.join(worktreeRoot, '.claude', HOOK_SCRIPT_NAME);
+    return {
+        matcher: SCOPE_HOOK_MATCHER,
+        hooks: [{ type: 'command', command: `node ${JSON.stringify(scriptPath)}` }],
+    };
+}
+/**
+ * Write the scope hook into `<worktree>/.claude/`, merging into any existing
+ * local settings rather than clobbering it. The hook lives in settings.local.json
+ * (uncommitted) so it enforces scope during the build but never rides the PR or
+ * merges to main. Returns the hook script path.
+ */
+export function installScopeHook(input) {
+    const claudeDir = path.join(input.worktreeRoot, '.claude');
+    fs.mkdirSync(claudeDir, { recursive: true });
+    const scriptPath = path.join(claudeDir, HOOK_SCRIPT_NAME);
+    fs.writeFileSync(scriptPath, generateScopeHookScript(input), { mode: 0o755 });
+    const settingsPath = path.join(claudeDir, HOOK_SETTINGS_NAME);
+    let settings = {};
+    if (fs.existsSync(settingsPath)) {
+        try {
+            settings = JSON.parse(fs.readFileSync(settingsPath, 'utf8'));
+        }
+        catch {
+            settings = {};
+        }
+    }
+    settings.hooks ??= {};
+    const entry = generatedScopeHookEntry(input.worktreeRoot);
+    const preToolUse = (settings.hooks.PreToolUse ?? []).filter((hook) => !JSON.stringify(hook).includes(HOOK_SCRIPT_NAME));
+    preToolUse.push(entry);
+    settings.hooks.PreToolUse = preToolUse;
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+    return { scriptPath, settingsPath };
+}
+//# sourceMappingURL=claudehook.js.map

package/dist/claudehook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudehook.js","sourceRoot":"","sources":["../src/claudehook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAO3E,SAAS,YAAY,CAAC,KAAe;IACnC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAwB;IACnD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3G,CAAC;AASD,MAAM,UAAU,uBAAuB,CAAC,KAAqB;IAC3D,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,mBAAmB,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,0BAA0B,CAAC,GAAG,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CACnE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IAEhB,OAAO;;;;;;0CAMiC,KAAK,CAAC,UAAU;;;;;;;;;;;wBAWlC,OAAO;0BACL,SAAS;0BACT,SAAS;0BACT,SAAS;wBACX,OAAO;0BACL,SAAS;;;;;;;;;;;;;;;;;;;;;2BAqBR,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiE5D,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAC5D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAW,gBAAgB,EAAE,EAAE,WAAW,kBAAkB,EAAE,CAAC,CAAC;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AAEhF;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAI1D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACxE,OAAO;QACL,OAAO,EAAE,kBAAkB;QAC3B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAYD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IAIpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3D,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,IAAI,QAAQ,GAAmB,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAmB,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CACzD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAC3D,CAAC;IACF,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAEzE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AACtC,CAAC"}