prismatica 0.2.0

package/dist/planning/validate.js

@@ -0,0 +1,417 @@
+/**
+ * Everything an agent returns is untrusted input. This module is where that
+ * input stops being a suggestion and becomes something deterministic code is
+ * willing to act on — or, far more often, is rejected with a reason.
+ *
+ * It answers only questions that have deterministic answers: does this parse,
+ * is it internally consistent, do the paths it names stay inside the repo, do
+ * the ids it cites exist, and what tier do the files it proposes actually
+ * demand? It deliberately does NOT judge whether the plan is a good one. The
+ * agent's semantic reading is advisory and is labelled advisory; the owner is
+ * the only reader who can accept it.
+ */
+import path from 'node:path';
+import { isDangerousCommand, SECRET_READ_GLOBS } from '../scope.js';
+import picomatch from 'picomatch';
+import { maxTier, tierFromAnswers } from '../tier.js';
+import { StartProposalSchema } from './schema.js';
+/** Zod silently strips this own key instead of reporting it as unknown. */
+export function findOwnProtoPath(value) {
+    const pending = [{ value, path: '' }];
+    const seen = new WeakSet();
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current.value === null || typeof current.value !== 'object' || seen.has(current.value)) {
+            continue;
+        }
+        seen.add(current.value);
+        if (Object.hasOwn(current.value, '__proto__')) {
+            return current.path ? `${current.path}.__proto__` : '__proto__';
+        }
+        for (const [key, child] of Object.entries(current.value)) {
+            const childPath = Array.isArray(current.value)
+                ? `${current.path}[${key}]`
+                : current.path
+                    ? `${current.path}.${key}`
+                    : key;
+            pending.push({ value: child, path: childPath });
+        }
+    }
+    return null;
+}
+// ── Path safety ──────────────────────────────────────────────────────────────
+/**
+ * A proposed glob must describe a place INSIDE this repo. Absolute paths,
+ * `..` traversal, home expansion, and URL-ish strings are rejected outright:
+ * the agent is proposing a contract's scope, and a scope that can name
+ * `/etc/**` or `../../other-repo/**` is not a scope at all.
+ *
+ * `**` is a legitimate and common glob segment, so traversal is judged on the
+ * path's real segments, never on a substring search for "..".
+ */
+export function validateRelativeGlob(glob) {
+    const value = glob.trim();
+    if (value === '') {
+        return 'is empty';
+    }
+    if (path.isAbsolute(value) || /^[a-zA-Z]:[\\/]/.test(value)) {
+        return `is an absolute path ("${glob}") — scope globs are relative to the repo root`;
+    }
+    if (value.startsWith('~')) {
+        return `expands to a home directory ("${glob}")`;
+    }
+    if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(value)) {
+        return `is a URL ("${glob}"), not a path`;
+    }
+    if (value.includes('\0')) {
+        return 'contains a null byte';
+    }
+    const scanned = picomatch.scan(value, { tokens: true, parts: true });
+    const pathCrossingCompound = scanned.tokens?.find((token) => token.value.includes('/'));
+    if (pathCrossingCompound) {
+        return `uses compound glob syntax across path segments ("${pathCrossingCompound.value}") — spell these as separate scope globs`;
+    }
+    const segments = value.split(/[\\/]/);
+    if (segments.includes('..')) {
+        return `escapes the repository ("${glob}")`;
+    }
+    if (segments.includes('.git')) {
+        return `points inside .git ("${glob}")`;
+    }
+    return null;
+}
+/**
+ * Could a proposed SCOPE glob and a tier rule's glob ever name the same file?
+ *
+ * A contract's tier must reflect what its scope PERMITS, not what the agent
+ * happens to intend, so this asks a genuine intersection question: does any
+ * path exist that both patterns match?
+ *
+ * The earlier implementation reduced each glob to a handful of synthetic probe
+ * paths and asked whether a probe of one matched the other. That is unsound in
+ * both directions, and review found it reporting `light` for `src/**\/login.ts`
+ * against the shipped heavy rule `**\/auth/**` — `src/auth/login.ts` matches
+ * both, but no probe happened to be it. Probing cannot be patched into
+ * soundness: the witness path has to be built from BOTH patterns at once.
+ *
+ * So the test is structural instead, a recursion over `/`-separated segments:
+ *
+ *  - both sides exhausted → they meet;
+ *  - one side exhausted → the other must be able to match nothing, i.e. every
+ *    remaining segment is `**`;
+ *  - a leading `**` on either side → try it consuming zero segments, then try
+ *    it consuming one segment of the other side;
+ *  - otherwise both sides have one concrete segment, and they meet only if
+ *    those two segments can match a common name.
+ *
+ * Segment compatibility is where the over-approximation lives. Two literals
+ * must be equal; a literal against a pattern is decided exactly by picomatch;
+ * two patterns (`*.ts` vs `login.*`) are assumed compatible rather than solved.
+ * The error therefore only ever runs toward "these might intersect," which
+ * raises a tier and never lowers one — the direction an agent is allowed to
+ * move it. A broad scope consequently lands high even when the agent means to
+ * touch none of those paths: `docs/**` really does permit creating
+ * `docs/auth/x`, so it really does intersect `**\/auth/**`. Narrow, specific
+ * scopes stay where they belong, which is what makes the result useful:
+ * `src/cli.ts` does not intersect `**\/auth/**`.
+ */
+function globsIntersect(proposed, rule) {
+    const proposedSegments = globSegments(proposed);
+    const ruleSegments = globSegments(rule);
+    // Validation rejects compound syntax that can match a slash. Keep this
+    // private trust boundary fail-closed too: decideTier is exported and must
+    // never return a lower tier merely because a caller skipped validation.
+    if (!proposedSegments || !ruleSegments) {
+        return true;
+    }
+    return segmentsIntersect(proposedSegments, ruleSegments);
+}
+function globSegments(glob) {
+    const scanned = picomatch.scan(glob, { tokens: true, parts: true });
+    if (scanned.tokens?.some((token) => token.value.includes('/'))) {
+        return null;
+    }
+    return scanned.parts && scanned.parts.length > 0 ? scanned.parts : glob.split('/');
+}
+/** True when a single path segment could be matched by both patterns. */
+function segmentsCompatible(a, b) {
+    const aWild = isWildcard(a);
+    const bWild = isWildcard(b);
+    if (!aWild && !bWild) {
+        return a === b;
+    }
+    if (!aWild) {
+        return picomatch.isMatch(a, b, { dot: true });
+    }
+    if (!bWild) {
+        return picomatch.isMatch(b, a, { dot: true });
+    }
+    // Two patterns: over-approximate upward rather than solve pattern∩pattern.
+    return true;
+}
+function isWildcard(segment) {
+    return /[*?[\]{}!+@]/.test(segment);
+}
+function segmentsIntersect(a, b) {
+    if (a.length === 0 && b.length === 0) {
+        return true;
+    }
+    if (a.length === 0) {
+        return b.every((segment) => segment === '**');
+    }
+    if (b.length === 0) {
+        return a.every((segment) => segment === '**');
+    }
+    if (a[0] === '**') {
+        // Zero segments, or one segment of b — the two cases that cover any number.
+        return segmentsIntersect(a.slice(1), b) || segmentsIntersect(a, b.slice(1));
+    }
+    if (b[0] === '**') {
+        return segmentsIntersect(a, b.slice(1)) || segmentsIntersect(a.slice(1), b);
+    }
+    return segmentsCompatible(a[0], b[0]) && segmentsIntersect(a.slice(1), b.slice(1));
+}
+/**
+ * The tier the PROPOSED SCOPE demands. Deliberately separate from `tier.ts`'s
+ * `tierForFiles`, which answers a different question over concrete changed
+ * files and is depended on by the deterministic gate — its semantics are not
+ * ours to change. This one reasons about globs against globs.
+ */
+function tierForProposedScope(allowedPaths, tierRules) {
+    let tier = 'light';
+    for (const rule of tierRules) {
+        const hit = allowedPaths.some((proposed) => rule.paths.some((glob) => globsIntersect(proposed, glob)));
+        if (hit) {
+            tier = maxTier(tier, rule.tier);
+        }
+    }
+    return tier;
+}
+/**
+ * The agent proposes a tier; deterministic code decides it. The floor is the
+ * maximum of the answer-derived tier and the tier the touched paths demand, so
+ * an agent that answers "no auth, copy only" while proposing `src/auth/**`
+ * still lands on whatever `config.tierRules` says `src/auth/**` is worth. An
+ * agent can raise the tier by its answers; it can never lower it.
+ */
+export function decideTier(answers, allowedPaths, tierRules, defaultTier) {
+    const fromAnswers = tierFromAnswers(answers, defaultTier);
+    const fromFiles = tierForProposedScope(allowedPaths, tierRules);
+    const tier = maxTier(fromAnswers, fromFiles);
+    return { fromAnswers, fromFiles, tier, raisedByFiles: tier !== fromAnswers };
+}
+/**
+ * Parse-then-check. The zod parse rejects missing, malformed, and EXTRA fields
+ * (every object in schema.ts is strict); the checks below cover what a schema
+ * cannot express — cross-field coherence, snapshot binding, path safety, and
+ * referential integrity against records that exist on disk right now.
+ *
+ * THE SECOND ARGUMENT IS A SNAPSHOT, NOT A BAG OF FIELDS. It used to be a
+ * `StartValidationContext` of loose values — known flow ids, known rule ids, the
+ * tier rules, the default tier — and a caller holding an imported document
+ * could assemble one out of what that document happened to say. Taking the
+ * snapshot itself makes that impossible to express: every decision input is
+ * read HERE, from a reading of the repository the caller took fresh.
+ *
+ * The document carries a snapshot of its own, and this function NEVER READS IT.
+ * That is the whole reason the echo is checked elsewhere: an embedded snapshot
+ * is exactly the shape of thing that becomes an authority by accident, and the
+ * only way to be sure it has not is for the code that decides to have no access
+ * to it at all.
+ */
+export function validateStartProposal(raw, snapshot) {
+    const context = {
+        knownFlowIds: snapshot.flows.map((flow) => flow.id),
+        knownRuleIds: snapshot.rules.map((rule) => rule.id),
+        pendingFlowIds: snapshot.pending
+            .filter((item) => item.kind === 'flow')
+            .map((item) => item.id),
+        tierRules: snapshot.tierRules,
+        defaultTier: snapshot.defaultTier,
+    };
+    const ownProtoPath = findOwnProtoPath(raw);
+    if (ownProtoPath) {
+        return {
+            ok: false,
+            problems: [{ field: ownProtoPath, detail: 'Unrecognized key: "__proto__"' }],
+        };
+    }
+    const parsed = StartProposalSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            problems: parsed.error.issues.map((issue) => ({
+                field: issue.path.length > 0 ? issue.path.join('.') : '(root)',
+                detail: issue.message,
+            })),
+        };
+    }
+    const proposal = parsed.data;
+    const problems = [];
+    const warnings = [];
+    // STALENESS IS NOT DECIDED HERE, and deliberately so. The plan echoes the
+    // whole snapshot it was made against; `verifyHandoffSnapshot` proves that
+    // echo is genuine and `compareSnapshots` says what moved since, and the
+    // caller shows the owner those reasons. What this function asks is whether
+    // the plan is ADMISSIBLE against the tree as it is NOW — which is the
+    // question that actually protects anything, and which every check below
+    // answers from the `snapshot` PARAMETER and never from the document. A tree
+    // that merely moved must not refuse a plan that is still entirely valid,
+    // least of all on the recovery path where a lane already exists.
+    // Kind coherence — the three kinds carry genuinely different material, and
+    // a plan that claims one while carrying another is not actionable.
+    if (proposal.kind === 'existing-flow') {
+        if (!proposal.flowId) {
+            problems.push({ field: 'flowId', detail: 'an existing-Flow change must name the Flow it changes' });
+        }
+        else if (!context.knownFlowIds.includes(proposal.flowId)) {
+            problems.push({
+                field: 'flowId',
+                detail: `no canonical Flow "${proposal.flowId}" exists (known: ${context.knownFlowIds.join(', ') || 'none'})`,
+            });
+        }
+        if (!proposal.delta) {
+            problems.push({ field: 'delta', detail: 'an existing-Flow change must carry a complete Delta' });
+        }
+        if (proposal.plannedFlow) {
+            problems.push({ field: 'plannedFlow', detail: 'an existing-Flow change must not also define a new Flow' });
+        }
+    }
+    if (proposal.kind === 'new-flow') {
+        if (!proposal.plannedFlow) {
+            problems.push({ field: 'plannedFlow', detail: 'a new-Flow change must carry the complete Planned Flow' });
+        }
+        else {
+            const id = proposal.plannedFlow.id;
+            if (context.knownFlowIds.includes(id)) {
+                problems.push({
+                    field: 'plannedFlow.id',
+                    detail: `"${id}" is already a canonical Flow — this is a change to an existing Flow, not a new one`,
+                });
+            }
+            if (context.pendingFlowIds.includes(id)) {
+                problems.push({
+                    field: 'plannedFlow.id',
+                    detail: `"${id}" already has a pending proposal — review that one first`,
+                });
+            }
+            if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(id)) {
+                problems.push({ field: 'plannedFlow.id', detail: `"${id}" is not a kebab-case id` });
+            }
+        }
+        if (proposal.delta) {
+            problems.push({ field: 'delta', detail: 'a new Flow has nothing to delta against' });
+        }
+        if (proposal.flowId) {
+            problems.push({ field: 'flowId', detail: 'a new-Flow change must not cite an existing Flow id' });
+        }
+    }
+    if (proposal.kind === 'technical') {
+        // Honest technical work invents no product Flow. This is the check that
+        // keeps "refactor the build script" from growing a fictional user journey.
+        if (proposal.plannedFlow) {
+            problems.push({ field: 'plannedFlow', detail: 'technical work must not invent a product Flow' });
+        }
+        if (proposal.delta) {
+            problems.push({ field: 'delta', detail: 'technical work changes no Flow truth, so it carries no Delta' });
+        }
+        if (proposal.flowId) {
+            problems.push({ field: 'flowId', detail: 'technical work must not claim to change a Flow' });
+        }
+    }
+    // Any Flow/Rule id the plan cites anywhere must actually exist.
+    for (const [index, ruleId] of proposal.desiredRules.entries()) {
+        if (ruleId.startsWith('r-') && !context.knownRuleIds.includes(ruleId)) {
+            // Desired rules are usually NEW, so an unknown id is expected and fine;
+            // it just must not be mistaken for a citation of existing truth.
+            warnings.push(`desiredRules[${index}] "${ruleId}" does not exist yet — it stays a contract constraint until the work is built and rediscovered`);
+        }
+    }
+    if (proposal.plannedFlow) {
+        for (const [index, rule] of proposal.plannedFlow.truth.rules.entries()) {
+            if (rule.startsWith('r-') && !context.knownRuleIds.includes(rule)) {
+                problems.push({
+                    field: `plannedFlow.truth.rules.${index}`,
+                    detail: `cites rule "${rule}", which does not exist`,
+                });
+            }
+        }
+    }
+    // Scope paths — every allow and forbid glob.
+    for (const [index, glob] of proposal.scope.allow.entries()) {
+        const problem = validateRelativeGlob(glob);
+        if (problem) {
+            problems.push({ field: `scope.allow.${index}`, detail: `"${glob}" ${problem}` });
+            continue;
+        }
+        if (SECRET_READ_GLOBS.some((secret) => globsIntersect(glob, secret))) {
+            problems.push({ field: `scope.allow.${index}`, detail: `"${glob}" matches a secret file` });
+        }
+        if (isDangerousCommand(glob)) {
+            problems.push({ field: `scope.allow.${index}`, detail: `"${glob}" is not a path` });
+        }
+    }
+    for (const [index, glob] of proposal.scope.forbid.entries()) {
+        const problem = validateRelativeGlob(glob);
+        if (problem) {
+            problems.push({ field: `scope.forbid.${index}`, detail: `"${glob}" ${problem}` });
+        }
+    }
+    // Each docs file becomes a contract requirement the check engine enforces by
+    // path, so it gets the same path safety as a scope glob.
+    for (const [index, file] of proposal.docsDelta.entries()) {
+        const problem = validateRelativeGlob(file);
+        if (problem) {
+            problems.push({ field: `docsDelta.${index}`, detail: `"${file}" ${problem}` });
+        }
+    }
+    if (proposal.plannedFlow) {
+        for (const [index, touchpoint] of proposal.plannedFlow.mechanics.touchpoints.entries()) {
+            const problem = validateRelativeGlob(touchpoint);
+            if (problem) {
+                problems.push({ field: `plannedFlow.mechanics.touchpoints.${index}`, detail: `"${touchpoint}" ${problem}` });
+            }
+        }
+    }
+    // Acceptance checks: each must name a traceable test or an explicit manual
+    // owner check. A bare description with no proof route is not a check.
+    for (const [index, check] of proposal.acceptance.entries()) {
+        const test = check.test.trim();
+        if (test.startsWith('manual:')) {
+            if (test.slice('manual:'.length).trim() === '') {
+                problems.push({ field: `acceptance.${index}.test`, detail: 'a manual check must name who verifies it' });
+            }
+            continue;
+        }
+        const problem = validateRelativeGlob(test);
+        if (problem) {
+            problems.push({ field: `acceptance.${index}.test`, detail: `"${check.test}" ${problem}` });
+            continue;
+        }
+        if (!/\.(test|spec)\.[cm]?[jt]sx?$/.test(test)) {
+            problems.push({
+                field: `acceptance.${index}.test`,
+                detail: `"${check.test}" is neither a test file nor a "manual:OWNER" check`,
+            });
+        }
+    }
+    // Delta step numbers are bounded by the schema (>= 1); anything finer needs
+    // the flow itself and is checked by `delta new` when the record is written.
+    if (proposal.delta && proposal.delta.today.trim() === proposal.delta.instead.trim()) {
+        problems.push({ field: 'delta.instead', detail: 'the delta proposes no actual change' });
+    }
+    if (problems.length > 0) {
+        return { ok: false, problems };
+    }
+    const tier = decideTier({
+        touchesAuth: proposal.risk.touchesAuth,
+        touchesPayments: proposal.risk.touchesPayments,
+        touchesSavedData: proposal.risk.touchesSavedData,
+        copyOnly: proposal.risk.copyOnly,
+    }, proposal.scope.allow, context.tierRules, context.defaultTier);
+    if (tier.raisedByFiles) {
+        warnings.push(`risk tier raised to "${tier.tier}" — the files this change proposes to touch demand it, whatever the answers said`);
+    }
+    return { ok: true, value: { proposal, tier }, warnings };
+}
+//# sourceMappingURL=validate.js.map

package/dist/planning/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/planning/validate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAoB,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAsB,MAAM,aAAa,CAAC;AAYtE,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,MAAM,OAAO,GAAuC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IAEnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAClE,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;gBAC5C,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,GAAG;gBAC3B,CAAC,CAAC,OAAO,CAAC,IAAI;oBACZ,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE;oBAC1B,CAAC,CAAC,GAAG,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,yBAAyB,IAAI,gDAAgD,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,iCAAiC,IAAI,IAAI,CAAC;IACnD,CAAC;IACD,IAAI,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,cAAc,IAAI,gBAAgB,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,oBAAoB,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,oDAAoD,oBAAoB,CAAC,KAAK,0CAA0C,CAAC;IAClI,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,4BAA4B,IAAI,IAAI,CAAC;IAC9C,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,wBAAwB,IAAI,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,iBAAiB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,2EAA2E;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAW,EAAE,CAAW;IACjD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClB,4EAA4E;QAC5E,OAAO,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAsB,EAAE,SAAqB;IACzE,IAAI,IAAI,GAAa,OAAO,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CACzC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAC1D,CAAC;QACF,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,OAAoB,EACpB,YAAsB,EACtB,SAAqB,EACrB,WAAqB;IAErB,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;AAC/E,CAAC;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAY,EACZ,QAA0B;IAE1B,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,cAAc,EAAE,QAAQ,CAAC,OAAO;aAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;aACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5C,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ;gBAC9D,MAAM,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,iEAAiE;IAEjE,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC,CAAC;QACtG,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,QAAQ;gBACf,MAAM,EAAE,sBAAsB,QAAQ,CAAC,MAAM,oBAAoB,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACtC,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,gBAAgB;oBACvB,MAAM,EAAE,IAAI,EAAE,qFAAqF;iBACpG,CAAC,CAAC;YACL,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,gBAAgB;oBACvB,MAAM,EAAE,IAAI,EAAE,0DAA0D;iBACzE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAClC,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,wEAAwE;YACxE,iEAAiE;YACjE,QAAQ,CAAC,IAAI,CACX,gBAAgB,KAAK,MAAM,MAAM,gGAAgG,CAClI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,2BAA2B,KAAK,EAAE;oBACzC,MAAM,EAAE,eAAe,IAAI,yBAAyB;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,yBAAyB,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,yDAAyD;IACzD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YACvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,UAAU,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;YAC/G,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,KAAK,OAAO,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,KAAK,OAAO,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,cAAc,KAAK,OAAO;gBACjC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,qDAAqD;aAC5E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CACrB;QACE,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW;QACtC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe;QAC9C,gBAAgB,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB;QAChD,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;KACjC,EACD,QAAQ,CAAC,KAAK,CAAC,KAAK,EACpB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,CACpB,CAAC;IACF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,wBAAwB,IAAI,CAAC,IAAI,kFAAkF,CACpH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;AAC3D,CAAC"}

package/dist/prepush.js

@@ -0,0 +1,192 @@
+/**
+ * The pure pre-push verifier the generated git hook calls (see
+ * `templates.ts`'s `prePushHookScript`). It makes NO durable writes — no
+ * evidence, no ledger entry, no contract-stage advance — so a WIP push never
+ * looks like a rework loop the way running mutating `check` from the hook
+ * used to.
+ *
+ * A real git pre-push hook is told EXACTLY what is being pushed on stdin —
+ * one `<local ref> <local sha> <remote ref> <remote sha>` line per ref —
+ * and this is the only trustworthy source of that fact: the currently
+ * checked-out branch/HEAD can differ from what's actually being pushed
+ * (`git push origin some-other-branch`, a detached HEAD, a stale local
+ * checkout). `verifyPrePush` parses that stdin and verifies each ref update
+ * independently; ANY failure blocks the whole push.
+ *
+ * Branch identity is always read from `remoteRef`, not `localRef` — a
+ * deletion reports `localRef` as the literal string `(delete)`, and `ship`'s
+ * own push (`git push origin <sha>:refs/heads/<branch>`) makes `localRef` a
+ * raw SHA rather than a ref path, so `localRef` alone cannot be trusted to
+ * name the branch being changed in either case.
+ *
+ * Two ref classes are understood; every other ref passes through
+ * unexamined, since Prismatica claims no authority over it (`frame` itself
+ * tells an owner with a dirty base to push a scratch `rescue/wip` branch —
+ * that must never be blocked):
+ *
+ *  - `refs/heads/change/<id>`: re-runs the same deterministic check engine
+ *    `check` runs, discarding the result instead of recording it. Refuses
+ *    if the pushed SHA isn't this lane's current HEAD — the working tree
+ *    the engine reads is only ever a trustworthy stand-in for the EXACT
+ *    commit being pushed when the two are the same commit. Deleting a
+ *    change branch passes through untouched — ordinary post-merge cleanup,
+ *    never something this verifier blocks.
+ *  - the configured main branch: the outgoing diff, computed against the
+ *    remote's OWN reported SHA for that ref (never a possibly-stale local
+ *    `origin/<mainBranch>` tracking ref), must be exactly one of the two
+ *    narrow record-only shapes Prismatica itself needs to land on main
+ *    directly (see `assurance/mainpush.ts`); anything else fails closed.
+ *    Deleting the main branch itself always fails closed — there is no
+ *    record shape a branch deletion could ever satisfy.
+ *
+ * The config is read from the COMMITTED tree at HEAD, not from disk. It names
+ * which branch is main, so a working-tree edit renaming `mainBranch` would
+ * otherwise route a genuine main push past the classifier altogether — a
+ * bypass, not a verdict. The same object is what `classifyMainPush` then
+ * verifies against, and what the lane's check engine runs with: a push is a
+ * statement about committed state, and every input to judging it is committed
+ * too.
+ */
+import { classifyMainPush, readCommittedConfig } from './assurance/mainpush.js';
+import { resolveChangeHome } from './change.js';
+import { runCheckEngine } from './checkengine.js';
+import * as git from './git.js';
+import { contractExists, readContract } from './records/store.js';
+const ZERO_SHA = '0'.repeat(40);
+const REFS_HEADS = 'refs/heads/';
+/** Parses git's real pre-push stdin protocol: one ref update per line, NUL/whitespace separated. */
+export function parsePrePushStdin(input) {
+    return input
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .map((line) => {
+        const [localRef, localSha, remoteRef, remoteSha] = line.split(/\s+/);
+        return {
+            localRef: localRef ?? '',
+            localSha: localSha ?? '',
+            remoteRef: remoteRef ?? '',
+            remoteSha: remoteSha ?? '',
+        };
+    });
+}
+async function verifyChangeBranchUpdate(cwd, config, update, contractId) {
+    const home = await resolveChangeHome(cwd, contractId);
+    const laneHead = await git.revParse(home, 'HEAD');
+    if (update.localSha !== laneHead) {
+        return {
+            ok: false,
+            reason: `refusing: pushing ${update.localSha.slice(0, 12)}, but the lane's checked-out HEAD is ${laneHead.slice(0, 12)} — check out the exact commit being pushed first`,
+        };
+    }
+    if (!contractExists(home, contractId)) {
+        return {
+            ok: false,
+            reason: `no contract "${contractId}" found for this branch — run \`prismatica frame\` first`,
+        };
+    }
+    const { data: contract } = readContract(home, contractId);
+    const result = await runCheckEngine({ home, contract, config });
+    return result.pass
+        ? { ok: true, reason: 'checks pass' }
+        : {
+            ok: false,
+            reason: `checks fail: ${result.outcomes
+                .filter((outcome) => outcome.status === 'fail')
+                .map((outcome) => outcome.name)
+                .join(', ')}`,
+        };
+}
+async function verifyMainBranchUpdate(mainRoot, config, update) {
+    if (update.remoteSha === ZERO_SHA) {
+        return {
+            ok: false,
+            reason: 'refusing: this push would create the main branch ref for the first time — cannot verify a narrow diff against nothing',
+        };
+    }
+    const mainHead = await git.revParse(mainRoot, 'HEAD');
+    if (update.localSha !== mainHead) {
+        return {
+            ok: false,
+            reason: `refusing: pushing ${update.localSha.slice(0, 12)}, but main's checked-out HEAD is ${mainHead.slice(0, 12)} — check out the exact commit being pushed first`,
+        };
+    }
+    // The remote's OWN reported SHA for this ref — always current, never a
+    // possibly-stale local `origin/<mainBranch>` tracking ref that would need
+    // a `git fetch` first to be trustworthy. `mainHead` rather than the literal
+    // `HEAD`: it is the same commit, already resolved, and naming it makes the
+    // "every byte comes from these two commits" property visible at the call.
+    return classifyMainPush(mainRoot, config, update.remoteSha, mainHead);
+}
+function branchFromRef(ref) {
+    return ref.startsWith(REFS_HEADS) ? ref.slice(REFS_HEADS.length) : null;
+}
+/**
+ * Branch identity is always read from `remoteRef`, never `localRef`:
+ * `localRef` is the literal string `(delete)` for a deletion, and `ship`'s
+ * own push (`git push origin <sha>:refs/heads/<branch>`) makes `localRef`
+ * the raw SHA rather than a `refs/heads/...` path — in both cases the only
+ * name git reliably reports for the branch being changed is `remoteRef`.
+ */
+async function verifyRefUpdate(cwd, mainRoot, config, update) {
+    const branch = branchFromRef(update.remoteRef);
+    const isDelete = update.localSha === ZERO_SHA;
+    if (branch === config.mainBranch) {
+        if (isDelete) {
+            return {
+                ok: false,
+                reason: `refusing: deleting the protected branch "${branch}" is not a Prismatica-managed operation`,
+            };
+        }
+        return verifyMainBranchUpdate(mainRoot, config, update);
+    }
+    if (branch?.startsWith('change/')) {
+        if (isDelete) {
+            // Never Prismatica's concern: `close` never deletes a remote branch
+            // itself, so cleaning one up afterward (GitHub's UI, a manual
+            // `git push --delete`) is ordinary post-merge housekeeping, not a
+            // push this verifier has any authority — or reason — to block.
+            return { ok: true, reason: `deleting change branch "${branch}" — ordinary lane cleanup, not Prismatica-managed` };
+        }
+        return verifyChangeBranchUpdate(cwd, config, update, branch.slice('change/'.length));
+    }
+    return { ok: true, reason: `not a Prismatica-managed branch (${update.localRef}) — nothing to verify` };
+}
+/**
+ * `stdinText` is git's real pre-push stdin (see module comment) — the
+ * generated hook's `exec prismatica prepush` inherits stdin unchanged, so
+ * the CLI entry point reads it and passes it straight through here.
+ */
+export async function verifyPrePush(cwd, stdinText) {
+    const updates = parsePrePushStdin(stdinText);
+    if (updates.length === 0) {
+        return { ok: true, reason: 'nothing to push' };
+    }
+    const mainRoot = await git.mainRepoRoot(cwd);
+    // The COMMITTED config, never `loadConfig`'s working-tree read. It decides
+    // which branch is main — so a config edited on disk to rename `mainBranch`
+    // would otherwise route a real main push past `classifyMainPush` entirely,
+    // which is a bypass rather than a verdict — and it carries the mode and
+    // owner key that verdict then depends on. A push is about committed state;
+    // an uncommitted config is not part of it.
+    const config = await readCommittedConfig(mainRoot, 'HEAD');
+    if (!config) {
+        return {
+            ok: false,
+            reason: 'refusing: no readable .prismatica/config.json committed at HEAD — a push cannot be verified against a config that is not itself committed',
+        };
+    }
+    const verdicts = [];
+    for (const update of updates) {
+        const verdict = await verifyRefUpdate(cwd, mainRoot, config, update);
+        if (!verdict.ok) {
+            return verdict;
+        }
+        verdicts.push(verdict);
+    }
+    // A single ref update keeps its own specific reason; only a genuinely
+    // multi-ref push (rare — `git push` normally updates one branch) gets the
+    // generic aggregate summary instead of concatenating N unrelated reasons.
+    return verdicts.length === 1 ? verdicts[0] : { ok: true, reason: `verified ${verdicts.length} ref update(s)` };
+}
+//# sourceMappingURL=prepush.js.map

package/dist/prepush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepush.js","sourceRoot":"","sources":["../src/prepush.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAelE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAChC,MAAM,UAAU,GAAG,aAAa,CAAC;AAEjC,oGAAoG;AACpG,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO;YACL,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,QAAQ,EAAE,QAAQ,IAAI,EAAE;YACxB,SAAS,EAAE,SAAS,IAAI,EAAE;YAC1B,SAAS,EAAE,SAAS,IAAI,EAAE;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,GAAW,EACX,MAAc,EACd,MAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,wCAAwC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kDAAkD;SACzK,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB,UAAU,0DAA0D;SAC7F,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI;QAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE;QACrC,CAAC,CAAC;YACE,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gBAAgB,MAAM,CAAC,QAAQ;iBACpC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;iBAC9C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC9B,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;AACR,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAgB,EAChB,MAAc,EACd,MAAwB;IAExB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,uHAAuH;SAChI,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,oCAAoC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,kDAAkD;SACrK,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,OAAO,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAW,EACX,QAAgB,EAChB,MAAc,EACd,MAAwB;IAExB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,IAAI,MAAM,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,4CAA4C,MAAM,yCAAyC;aACpG,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,oEAAoE;YACpE,8DAA8D;YAC9D,kEAAkE;YAClE,+DAA+D;YAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,MAAM,mDAAmD,EAAE,CAAC;QACpH,CAAC;QACD,OAAO,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,QAAQ,uBAAuB,EAAE,CAAC;AAC1G,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,SAAiB;IAChE,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,2IAA2I;SAC9I,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,sEAAsE;IACtE,0EAA0E;IAC1E,0EAA0E;IAC1E,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,QAAQ,CAAC,MAAM,gBAAgB,EAAE,CAAC;AAClH,CAAC"}