synorch 0.2.0 → 0.3.0

package/dist/application/generated-skill-doctor.js

@@ -0,0 +1,433 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { GENERATED_SKILL_ACTIVE_BUDGET, GENERATED_SKILL_DIRECTORY, GENERATED_SKILL_MAX_BYTES, generatedSkillFrontmatterSchema, } from "../domain/generated-skill.js";
+import { DIGEST_MIN_LENGTH, OBSERVATION_LEDGER_PATH, observationLedgerSchema, } from "../domain/observation-ledger.js";
+import { isSafeDescendantPath } from "../domain/relative-path.js";
+import { formatZodIssues, partitionZodIssues } from "../domain/zod-issues.js";
+import { parseFrontmatter, splitMarkdownSections, normalizeSectionName, } from "../infrastructure/frontmatter.js";
+import { parseYaml } from "../infrastructure/serialization.js";
+import { resolveSafeRelativePath } from "./safe-path.js";
+import { checkByteCeiling } from "./size-ceiling.js";
+/**
+ * Validate the generated project-skill namespace: the ledger itself, the frontmatter contract of
+ * every `SKILL.md` under `.ai/skills/project/**`, the evidence behind it, and the shape heuristics.
+ * Contract violations are errors; heuristics and staleness are warnings, per design D13.
+ */
+export async function diagnoseGeneratedSkills(fileSystem, rootDirectory) {
+    const root = path.resolve(rootDirectory);
+    const diagnostics = [];
+    const skillDirectories = await listSkillDirectories(fileSystem, root);
+    const ledger = await readLedger(fileSystem, root, skillDirectories.length > 0, diagnostics);
+    const knownTaskIds = collectConfirmingTaskIds(ledger);
+    let activeSkills = 0;
+    const readableSkillIds = new Set();
+    for (const skillId of skillDirectories) {
+        const relativePath = `${GENERATED_SKILL_DIRECTORY}/${skillId}/SKILL.md`;
+        const absolutePath = path.join(root, GENERATED_SKILL_DIRECTORY, skillId, "SKILL.md");
+        if (await isRetiredSkill(fileSystem, root, skillId))
+            readableSkillIds.add(skillId);
+        if (!(await isReadableFileWithinRoot(fileSystem, root, absolutePath)))
+            continue;
+        readableSkillIds.add(skillId);
+        const content = await fileSystem.readText(absolutePath);
+        if (Buffer.byteLength(content, "utf8") > GENERATED_SKILL_MAX_BYTES) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.size-exceeded",
+                message: `Generated skill exceeds the ${GENERATED_SKILL_MAX_BYTES}-byte ceiling: ` +
+                    `${Buffer.byteLength(content, "utf8")} bytes.`,
+                path: relativePath,
+            });
+        }
+        const document = readSkillDocument(content, relativePath, diagnostics);
+        if (document === undefined)
+            continue;
+        const parsed = validateFrontmatter(document.data, skillId, relativePath, diagnostics);
+        reportShapeHeuristics(document.body, parsed, relativePath, diagnostics);
+        if (parsed === undefined)
+            continue;
+        if (parsed.status === "active")
+            activeSkills += 1;
+        await validateEvidence(fileSystem, root, parsed, relativePath, diagnostics);
+        await validateReferences(fileSystem, root, skillId, parsed, relativePath, diagnostics);
+        if (ledger !== undefined) {
+            reportUnknownConfirmations(parsed, knownTaskIds, relativePath, diagnostics);
+        }
+    }
+    reportBrokenPromotionLinks(ledger, readableSkillIds, diagnostics);
+    if (activeSkills > GENERATED_SKILL_ACTIVE_BUDGET) {
+        diagnostics.push({
+            severity: "error",
+            code: "generated.budget-exceeded",
+            message: `Active project skills (${activeSkills}) exceed the budget of ` +
+                `${GENERATED_SKILL_ACTIVE_BUDGET}. Retire one before promoting another.`,
+            path: GENERATED_SKILL_DIRECTORY,
+        });
+    }
+    return diagnostics;
+}
+/** Directory names under `.ai/skills/project`, sorted, so diagnostics keep a stable order. */
+async function listSkillDirectories(fileSystem, root) {
+    const directory = path.join(root, GENERATED_SKILL_DIRECTORY);
+    if (!(await fileSystem.exists(directory)) ||
+        !(await fileSystem.isDirectory(directory)) ||
+        !(await isPathWithinRoot(fileSystem, root, directory))) {
+        return [];
+    }
+    return [...(await fileSystem.list(directory))]
+        .filter((entry) => entry.isDirectory)
+        .map((entry) => entry.name)
+        .sort((left, right) => left.localeCompare(right));
+}
+async function readLedger(fileSystem, root, skillsExist, diagnostics) {
+    const absolutePath = path.join(root, OBSERVATION_LEDGER_PATH);
+    if (!(await fileSystem.exists(absolutePath))) {
+        if (skillsExist) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.ledger-invalid",
+                message: "Observation ledger is missing, so generated skill confirmations cannot be verified.",
+                path: OBSERVATION_LEDGER_PATH,
+            });
+        }
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(await fileSystem.readText(absolutePath));
+    }
+    catch (error) {
+        diagnostics.push({
+            severity: "error",
+            code: "generated.ledger-invalid",
+            message: error instanceof Error ? error.message : String(error),
+            path: OBSERVATION_LEDGER_PATH,
+        });
+        return undefined;
+    }
+    const result = observationLedgerSchema.safeParse(parsed);
+    if (!result.success) {
+        diagnostics.push({
+            severity: "error",
+            code: "generated.ledger-invalid",
+            message: `Observation ledger is invalid: ${formatZodIssues(result.error)}`,
+            path: OBSERVATION_LEDGER_PATH,
+        });
+        return undefined;
+    }
+    return result.data;
+}
+/** A retired skill keeps its directory but lives in `RETIRED.md`; the promotion link still holds. */
+async function isRetiredSkill(fileSystem, root, skillId) {
+    const absolutePath = path.join(root, GENERATED_SKILL_DIRECTORY, skillId, "RETIRED.md");
+    return isReadableFileWithinRoot(fileSystem, root, absolutePath);
+}
+/**
+ * The ledger half of the activation record must point at something real.
+ *
+ * Only this direction is enforced. The reverse — every `status: active` skill having a
+ * `promoted_to` observation that names it — would require an observation id and a skill id to
+ * be the same string, which nothing in the design states, and would reject a project skill a
+ * user placed by hand. The confirming task ids already tie a generated skill back to the
+ * ledger through `generated.unknown-confirmation`.
+ */
+function reportBrokenPromotionLinks(ledger, skillIds, diagnostics) {
+    for (const observation of ledger?.observations ?? []) {
+        if (observation.status !== "promoted")
+            continue;
+        const promotedTo = observation.promoted_to;
+        if (promotedTo === undefined || skillIds.has(promotedTo))
+            continue;
+        diagnostics.push({
+            severity: "error",
+            code: "generated.broken-promotion-link",
+            message: `Observation '${observation.id}' is promoted to '${promotedTo}', but ` +
+                `${GENERATED_SKILL_DIRECTORY}/${promotedTo}/SKILL.md does not exist. Restore the skill ` +
+                "or correct the ledger; a promotion that names nothing is not a record.",
+            path: OBSERVATION_LEDGER_PATH,
+        });
+    }
+}
+function collectConfirmingTaskIds(ledger) {
+    const taskIds = new Set();
+    for (const observation of ledger?.observations ?? []) {
+        for (const taskId of observation.confirmed_by)
+            taskIds.add(taskId);
+    }
+    return taskIds;
+}
+/**
+ * Reads the shared canonical frontmatter block. `missing` and `malformed` keep the dedicated
+ * codes the generated namespace already reports, so the two contracts share one parser without
+ * sharing a diagnostic vocabulary.
+ */
+function readSkillDocument(content, relativePath, diagnostics) {
+    const result = parseFrontmatter(content);
+    if (result.kind === "missing") {
+        diagnostics.push({
+            severity: "error",
+            code: "generated.frontmatter-missing",
+            message: "Generated skill has no YAML frontmatter block fenced by '---'.",
+            path: relativePath,
+        });
+        return undefined;
+    }
+    if (result.kind === "malformed") {
+        diagnostics.push({
+            severity: "error",
+            code: "generated.frontmatter-invalid",
+            message: result.message,
+            path: relativePath,
+        });
+        return undefined;
+    }
+    return result;
+}
+/**
+ * Dedicated codes come first so that the priority ceiling, the evidence requirement and an
+ * unsafe reference path are reported as themselves rather than as a generic schema failure.
+ * Each field that got a dedicated diagnostic is then excluded from `generated.contract-invalid`,
+ * so one defect is never reported twice, and the generic code is skipped when nothing is left.
+ */
+function validateFrontmatter(frontmatter, skillId, relativePath, diagnostics) {
+    const reportedFields = [];
+    const name = frontmatter["name"];
+    if (typeof name === "string" && name !== skillId) {
+        reportedFields.push("name");
+        diagnostics.push({
+            severity: "error",
+            code: "generated.name-directory-mismatch",
+            message: `Generated skill name '${name}' must match its project-skill directory '${skillId}'.`,
+            path: relativePath,
+        });
+    }
+    const priority = frontmatter["priority"];
+    if (priority !== "skill") {
+        reportedFields.push("priority");
+        diagnostics.push({
+            severity: "error",
+            code: "generated.priority-ceiling",
+            message: "A generated skill must declare 'priority: skill'; it can never hold constitutional " +
+                `or protocol priority. Received: ${describeValue(priority)}.`,
+            path: relativePath,
+        });
+    }
+    if (!hasCompleteEvidence(frontmatter["evidence"])) {
+        reportedFields.push("evidence");
+        diagnostics.push({
+            severity: "error",
+            code: "generated.missing-evidence",
+            message: "origin: generated requires a non-empty evidence list where every entry carries a " +
+                "claim, a source and a digest.",
+            path: relativePath,
+        });
+    }
+    for (const reference of unsafeReferencePaths(frontmatter["references"])) {
+        reportedFields.push("references");
+        diagnostics.push({
+            severity: "error",
+            code: "generated.unsafe-reference-path",
+            message: "A reference must be a relative path inside the skill's own directory; an absolute " +
+                `path, a drive letter, a UNC root or a '..' segment is rejected: ${reference}`,
+            path: relativePath,
+        });
+    }
+    const result = generatedSkillFrontmatterSchema.safeParse(frontmatter);
+    if (!result.success) {
+        const { remaining } = partitionZodIssues(result.error, reportedFields);
+        if (remaining.length > 0) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.contract-invalid",
+                message: `Generated skill frontmatter is invalid: ${formatZodIssues({ issues: remaining })}`,
+                path: relativePath,
+            });
+        }
+        return undefined;
+    }
+    return result.data;
+}
+/** Reference entries the lexical rule rejects, reported before the schema sees them. */
+function unsafeReferencePaths(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((entry) => typeof entry === "string" && !isSafeDescendantPath(entry));
+}
+/**
+ * The reference half of the contract, mirroring the canonical check in `doctor-service`: a
+ * declared reference must exist, stay inside the skill's own directory both lexically and after
+ * symbolic links are canonicalized, and respect the reference byte ceiling. The lexical rule
+ * already ran in `validateFrontmatter`, so anything reaching here is lexically safe.
+ */
+async function validateReferences(fileSystem, root, skillId, frontmatter, relativePath, diagnostics) {
+    const skillDirectory = path.join(root, GENERATED_SKILL_DIRECTORY, skillId);
+    for (const reference of frontmatter.references ?? []) {
+        const resolved = resolveSafeRelativePath(skillDirectory, reference);
+        if (resolved === undefined) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.unsafe-reference-path",
+                message: `Reference escapes the skill directory: ${reference}`,
+                path: relativePath,
+            });
+            continue;
+        }
+        if (!(await fileSystem.exists(resolved.absolute)) ||
+            (await fileSystem.isDirectory(resolved.absolute))) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.missing-reference-file",
+                message: `Declared reference is not an existing file: ${reference}`,
+                path: relativePath,
+            });
+            continue;
+        }
+        if (!(await isPathWithinRoot(fileSystem, skillDirectory, resolved.absolute)) ||
+            !(await isPathWithinRoot(fileSystem, root, resolved.absolute))) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.unsafe-reference-path",
+                message: `Reference escapes the skill directory through a link: ${reference}`,
+                path: relativePath,
+            });
+            continue;
+        }
+        checkByteCeiling(`${GENERATED_SKILL_DIRECTORY}/${skillId}/${resolved.relative}`, await fileSystem.readText(resolved.absolute), "skillReference", diagnostics, "generated.reference-size");
+    }
+}
+function hasCompleteEvidence(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return false;
+    return value.every((entry) => {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry))
+            return false;
+        const record = entry;
+        return (typeof record["claim"] === "string" &&
+            typeof record["source"] === "string" &&
+            typeof record["digest"] === "string");
+    });
+}
+async function validateEvidence(fileSystem, root, frontmatter, relativePath, diagnostics) {
+    for (const evidence of frontmatter.evidence) {
+        const resolved = resolveSafeRelativePath(root, evidence.source)?.absolute;
+        if (resolved === undefined || !(await isPathWithinRoot(fileSystem, root, resolved))) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.unsafe-source",
+                message: `Evidence source must stay inside the target root: ${evidence.source}`,
+                path: relativePath,
+            });
+            continue;
+        }
+        if (!(await fileSystem.exists(resolved)) ||
+            (await fileSystem.isDirectory(resolved))) {
+            diagnostics.push({
+                severity: "error",
+                code: "generated.missing-source",
+                message: `Evidence source is not an existing regular file: ${evidence.source}`,
+                path: relativePath,
+            });
+            continue;
+        }
+        const current = digestOf(await fileSystem.readText(resolved));
+        if (!matchesRecordedDigest(evidence.digest, current)) {
+            diagnostics.push({
+                severity: "warning",
+                code: "generated.stale-evidence",
+                message: `Evidence source changed since the skill was verified: ${evidence.source} is now ` +
+                    `${current}. Re-verify the claim or retire the skill.`,
+                path: relativePath,
+            });
+        }
+    }
+}
+function reportUnknownConfirmations(frontmatter, knownTaskIds, relativePath, diagnostics) {
+    for (const taskId of frontmatter.confirmed_by) {
+        if (knownTaskIds.has(taskId))
+            continue;
+        diagnostics.push({
+            severity: "error",
+            code: "generated.unknown-confirmation",
+            message: `Confirming task id '${taskId}' does not appear in the observation ledger.`,
+            path: relativePath,
+        });
+    }
+}
+const PAST_TENSE_MARKERS = /\b(?:was|were|had|did|failed|crashed|broke|discovered|noticed|turned out|we (?:saw|hit|found|tried|ran))\b/gi;
+const TASK_REFERENCE = /\btask-\d+\b/i;
+const DATE_REFERENCE = /\b\d{4}-\d{2}-\d{2}\b/;
+const PATH_LIKE_CODE_SPAN = /`([^`\n]+)`/g;
+/** The section that states when the skill applies; fenced examples of it do not count. */
+const ACTIVATION_SECTION = "When this applies";
+/** Taste-level signals from design §7. They warn; they never block. */
+function reportShapeHeuristics(body, frontmatter, relativePath, diagnostics) {
+    if (!splitMarkdownSections(body).has(normalizeSectionName(ACTIVATION_SECTION))) {
+        diagnostics.push({
+            severity: "warning",
+            code: "shape.no-trigger",
+            message: "No explicit activation condition: add a 'When this applies' section so the skill can " +
+                "be matched without reading it.",
+            path: relativePath,
+        });
+    }
+    const pastTenseMarkers = body.match(PAST_TENSE_MARKERS)?.length ?? 0;
+    if (pastTenseMarkers >= 3 && (TASK_REFERENCE.test(body) || DATE_REFERENCE.test(body))) {
+        diagnostics.push({
+            severity: "warning",
+            code: "shape.incident-log-shape",
+            message: "The body reads as a narrated past incident (past-tense narration plus a task id or " +
+                "date) instead of a repeatable procedure.",
+            path: relativePath,
+        });
+    }
+    if (frontmatter === undefined)
+        return;
+    const sources = new Set(frontmatter.evidence.map((evidence) => evidence.source));
+    const unsourced = [...body.matchAll(PATH_LIKE_CODE_SPAN)]
+        .map((match) => match[1] ?? "")
+        .filter((value) => isPathLike(value) && !sources.has(value))
+        .sort((left, right) => left.localeCompare(right));
+    const firstUnsourced = unsourced[0];
+    if (firstUnsourced !== undefined) {
+        diagnostics.push({
+            severity: "warning",
+            code: "shape.unsourced-claim",
+            message: `The body cites '${firstUnsourced}', which no evidence entry backs. Add it to evidence ` +
+                "with a digest or drop the claim.",
+            path: relativePath,
+        });
+    }
+}
+function isPathLike(value) {
+    return /^[\w.@/-]+$/.test(value) && value.includes("/") && !value.endsWith("/");
+}
+/** Digests are taken over line-ending-normalized text so they are stable across platforms. */
+function digestOf(content) {
+    return `sha256:${createHash("sha256").update(content.replaceAll("\r\n", "\n"), "utf8").digest("hex")}`;
+}
+/**
+ * A recorded digest may be truncated, so a prefix of the current digest is a match — but only a
+ * prefix long enough to mean something. Anything shorter than the schema floor is treated as no
+ * match, so a deliberately short digest cannot silence the staleness check.
+ */
+function matchesRecordedDigest(recorded, current) {
+    return recorded.length >= DIGEST_MIN_LENGTH && current.startsWith(recorded);
+}
+function describeValue(value) {
+    return typeof value === "string" ? `'${value}'` : JSON.stringify(value) ?? "undefined";
+}
+async function isReadableFileWithinRoot(fileSystem, root, absolutePath) {
+    return ((await fileSystem.exists(absolutePath)) &&
+        !(await fileSystem.isDirectory(absolutePath)) &&
+        (await isPathWithinRoot(fileSystem, root, absolutePath)));
+}
+async function isPathWithinRoot(fileSystem, root, absolutePath) {
+    try {
+        await fileSystem.assertPathWithinRoot(root, absolutePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=generated-skill-doctor.js.map

package/dist/application/generated-skill-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-skill-doctor.js","sourceRoot":"","sources":["../../src/application/generated-skill-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,GAEhC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,GAExB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,GAErB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAE/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAsB,EACtB,aAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,WAAW,GAAiB,EAAE,CAAC;IAErC,MAAM,gBAAgB,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,GAAG,yBAAyB,IAAI,OAAO,WAAW,CAAC;QACxE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QACrF,IAAI,MAAM,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,wBAAwB,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YAAE,SAAS;QAChF,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;YACnE,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EACL,+BAA+B,yBAAyB,iBAAiB;oBACzE,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS;gBAChD,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACvE,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAEtF,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QAEnC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;YAAE,YAAY,IAAI,CAAC,CAAC;QAClD,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAC5E,MAAM,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,0BAA0B,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,0BAA0B,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;IAElE,IAAI,YAAY,GAAG,6BAA6B,EAAE,CAAC;QACjD,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EACL,0BAA0B,YAAY,yBAAyB;gBAC/D,GAAG,6BAA6B,wCAAwC;YAC1E,IAAI,EAAE,yBAAyB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,oBAAoB,CACjC,UAAsB,EACtB,IAAY;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IAC7D,IACE,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,EACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;SACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,UAAsB,EACtB,IAAY,EACZ,WAAoB,EACpB,WAAyB;IAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC7C,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EACL,qFAAqF;gBACvF,IAAI,EAAE,uBAAuB;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,kCAAkC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAC1E,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,cAAc,CAC3B,UAAsB,EACtB,IAAY,EACZ,OAAe;IAEf,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;IACvF,OAAO,wBAAwB,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,MAAqC,EACrC,QAA6B,EAC7B,WAAyB;IAEzB,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAChD,MAAM,UAAU,GAAG,WAAW,CAAC,WAAW,CAAC;QAC3C,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,SAAS;QACnE,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EACL,gBAAgB,WAAW,CAAC,EAAE,qBAAqB,UAAU,SAAS;gBACtE,GAAG,yBAAyB,IAAI,UAAU,8CAA8C;gBACxF,wEAAwE;YAC1E,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAqC;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,WAAW,IAAI,MAAM,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;QACrD,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,OAAe,EACf,YAAoB,EACpB,WAAyB;IAEzB,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,gEAAgE;YACzE,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,WAAoC,EACpC,OAAe,EACf,YAAoB,EACpB,WAAyB;IAEzB,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACjD,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,mCAAmC;YACzC,OAAO,EACL,yBAAyB,IAAI,6CAA6C,OAAO,IAAI;YACvF,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EACL,qFAAqF;gBACrF,mCAAmC,aAAa,CAAC,QAAQ,CAAC,GAAG;YAC/D,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAClD,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EACL,mFAAmF;gBACnF,+BAA+B;YACjC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QACxE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EACL,oFAAoF;gBACpF,mEAAmE,SAAS,EAAE;YAChF,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,2CAA2C,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE;gBAC5F,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,wFAAwF;AACxF,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CACtF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,UAAsB,EACtB,IAAY,EACZ,OAAe,EACf,WAAsC,EACtC,YAAoB,EACpB,WAAyB;IAEzB,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,0CAA0C,SAAS,EAAE;gBAC9D,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IACE,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EACjD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,+CAA+C,SAAS,EAAE;gBACnE,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IACE,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxE,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAC9D,CAAC;YACD,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,yDAAyD,SAAS,EAAE;gBAC7E,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,gBAAgB,CACd,GAAG,yBAAyB,IAAI,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAC9D,MAAM,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC5C,gBAAgB,EAChB,WAAW,EACX,0BAA0B,CAC3B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtF,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,CACL,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CACrC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAsB,EACtB,IAAY,EACZ,WAAsC,EACtC,YAAoB,EACpB,WAAyB;IAEzB,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpF,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,qDAAqD,QAAQ,CAAC,MAAM,EAAE;gBAC/E,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IACE,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EACxC,CAAC;YACD,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,oDAAoD,QAAQ,CAAC,MAAM,EAAE;gBAC9E,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YACrD,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EACL,yDAAyD,QAAQ,CAAC,MAAM,UAAU;oBAClF,GAAG,OAAO,4CAA4C;gBACxD,IAAI,EAAE,YAAY;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,WAAsC,EACtC,YAAiC,EACjC,YAAoB,EACpB,WAAyB;IAEzB,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9C,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,uBAAuB,MAAM,8CAA8C;YACpF,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GACtB,8GAA8G,CAAC;AACjH,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAE3C,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,uEAAuE;AACvE,SAAS,qBAAqB,CAC5B,IAAY,EACZ,WAAkD,EAClD,YAAoB,EACpB,WAAyB;IAEzB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QAC/E,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EACL,uFAAuF;gBACvF,gCAAgC;YAClC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IACrE,IAAI,gBAAgB,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtF,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EACL,qFAAqF;gBACrF,0CAA0C;YAC5C,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SAC3D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EACL,mBAAmB,cAAc,uDAAuD;gBACxF,kCAAkC;YACpC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACzG,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,QAAgB,EAAE,OAAe;IAC9D,OAAO,QAAQ,CAAC,MAAM,IAAI,iBAAiB,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,UAAsB,EACtB,IAAY,EACZ,YAAoB;IAEpB,OAAO,CACL,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAsB,EACtB,IAAY,EACZ,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/application/project-discovery.d.ts

@@ -3,6 +3,8 @@ import type { FileSystem } from "../infrastructure/file-system.ts";
 export interface SyncResult {
     readonly projects: readonly ProjectRecord[];
     readonly writtenFiles: readonly string[];
+    /** Observations removed from the ledger because they expired; 0 when there is no ledger. */
+    readonly prunedObservations: number;
 }
 export interface SyncOptions {
     readonly force?: boolean;
@@ -11,6 +13,11 @@ export declare class ProjectDiscoveryService {
     private readonly fileSystem;
     constructor(fileSystem: FileSystem);
     sync(targetDirectory: string, options?: SyncOptions): Promise<SyncResult>;
+    /**
+     * Prune expired observations from the ledger. The ledger is optional: a project that has never
+     * recorded one syncs exactly as before. Returns undefined when there is nothing to rewrite.
+     */
+    private pruneObservationLedger;
     private readPreviousDetectedAt;
     private findCandidates;
     private isProject;
@@ -20,4 +27,9 @@ export declare class ProjectDiscoveryService {
     private findDiscoveryFileNames;
     private inspectModule;
 }
+/**
+ * Resolve a sync-generated path inside the root. Exported so the protected-namespace guard can
+ * be asserted directly rather than only through a full `sync`.
+ */
+export declare function resolveWithinRoot(root: string, relativePath: string): string;
 //# sourceMappingURL=project-discovery.d.ts.map

package/dist/application/project-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-discovery.d.ts","sourceRoot":"","sources":["../../src/application/project-discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,aAAa,EAId,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAkDnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAErB,UAAU,EAAE,UAAU;IAI5B,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;YAsK5E,sBAAsB;YA4BtB,cAAc;YAwBd,SAAS;YAOT,cAAc;YAsBd,eAAe;YA0Df,2BAA2B;YAoC3B,sBAAsB;YAQtB,aAAa;CA+H5B"}
+{"version":3,"file":"project-discovery.d.ts","sourceRoot":"","sources":["../../src/application/project-discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAGV,aAAa,EAId,MAAM,qBAAqB,CAAC;AAS7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAkDnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,4FAA4F;IAC5F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAcD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAYD,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAa;gBAErB,UAAU,EAAE,UAAU;IAI5B,IAAI,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;IAuL1F;;;OAGG;YACW,sBAAsB;YA+BtB,sBAAsB;YA4BtB,cAAc;YAwBd,SAAS;YAOT,cAAc;YAsBd,eAAe;YA0Df,2BAA2B;YAoC3B,sBAAsB;YAQtB,aAAa;CA+H5B;AA6WD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAW5E"}

package/dist/application/project-discovery.js

@@ -1,6 +1,8 @@
 import path from "node:path";
 import { workspaceSchema } from "../domain/config.js";
 import { CliError } from "../domain/errors.js";
+import { OBSERVATION_LEDGER_PATH, observationLedgerSchema, pruneExpiredObservations, } from "../domain/observation-ledger.js";
+import { formatZodIssues } from "../domain/zod-issues.js";
 import { loadBundledSkillPool } from "../infrastructure/bundled-skill-library.js";
 import { parseYaml, stringifyYaml } from "../infrastructure/serialization.js";
 import { resolveSkillPacks } from "./skill-resolver.js";
@@ -48,6 +50,12 @@ const SOURCE_TREE_DIRECTORIES = new Set([
 const MAX_DISCOVERY_DEPTH = 6;
 const MAX_DISCOVERED_DIRECTORIES = 2_000;
 const MAX_SOURCE_TREE_DIRECTORIES = 2_000;
+/**
+ * Paths `sync` must never create, overwrite or delete, with or without `--force`. Generated
+ * project skills are authored by a worker and approved by the user, so they are not generated
+ * output and no regeneration may touch them.
+ */
+const PROTECTED_WRITE_PREFIXES = [".ai/skills/project"];
 export class ProjectDiscoveryService {
     fileSystem;
     constructor(fileSystem) {
@@ -139,8 +147,12 @@ export class ProjectDiscoveryService {
             await resolveSafeGeneratedPath(this.fileSystem, root, prepared.record.skill_registry);
         }
         await resolveSafeGeneratedPath(this.fileSystem, root, ".ai/workspace.yaml");
+        const ledgerPrune = await this.pruneObservationLedger(root, new Date());
         const writtenFiles = [];
         const writtenFileSet = new Set();
+        if (ledgerPrune !== undefined) {
+            await writeIfChanged(this.fileSystem, root, resolveWithinRoot(root, OBSERVATION_LEDGER_PATH), ledgerPrune.content, OBSERVATION_LEDGER_PATH, writtenFiles, writtenFileSet);
+        }
         for (const skill of skillWrites) {
             await assertSafeGeneratedPath(this.fileSystem, root, skill.absolutePath, skill.relativePath);
             await this.fileSystem.writeText(skill.absolutePath, skill.content);
@@ -164,7 +176,36 @@ export class ProjectDiscoveryService {
         for (const prepared of preparedProjects) {
             await writeIfChanged(this.fileSystem, root, resolveWithinRoot(root, prepared.record.skill_registry), stringifyYaml(prepared.registry), prepared.record.skill_registry, writtenFiles, writtenFileSet);
         }
-        return { projects, writtenFiles };
+        return {
+            projects,
+            writtenFiles,
+            prunedObservations: ledgerPrune?.expired.length ?? 0,
+        };
+    }
+    /**
+     * Prune expired observations from the ledger. The ledger is optional: a project that has never
+     * recorded one syncs exactly as before. Returns undefined when there is nothing to rewrite.
+     */
+    async pruneObservationLedger(root, now) {
+        const absolutePath = await resolveSafeGeneratedPath(this.fileSystem, root, OBSERVATION_LEDGER_PATH);
+        if (!(await this.fileSystem.exists(absolutePath)))
+            return undefined;
+        let parsed;
+        try {
+            parsed = parseYaml(await this.fileSystem.readText(absolutePath));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new CliError(`Invalid observation ledger at ${OBSERVATION_LEDGER_PATH}: ${detail}`, 2);
+        }
+        const ledger = observationLedgerSchema.safeParse(parsed);
+        if (!ledger.success) {
+            throw new CliError(`Invalid observation ledger at ${OBSERVATION_LEDGER_PATH}: ${formatZodIssues(ledger.error)}`, 2);
+        }
+        const pruned = pruneExpiredObservations(ledger.data, now);
+        if (pruned.expired.length === 0)
+            return undefined;
+        return { content: stringifyYaml(pruned.ledger), expired: pruned.expired };
     }
     async readPreviousDetectedAt(root, workspace, identity) {
         const entry = workspace.projects.find((project) => project.id === identity.id && project.path === identity.path);
@@ -687,10 +728,15 @@ function assertUniqueModuleIdentifiers(projectId, modules) {
         pathsById.set(module.id, module.path);
     }
 }
-function resolveWithinRoot(root, relativePath) {
+/**
+ * Resolve a sync-generated path inside the root. Exported so the protected-namespace guard can
+ * be asserted directly rather than only through a full `sync`.
+ */
+export function resolveWithinRoot(root, relativePath) {
     if (path.isAbsolute(relativePath)) {
         throw new CliError(`Generated path must be relative: ${relativePath}`, 2);
     }
+    assertWritablePath(relativePath);
     const resolved = path.resolve(root, relativePath);
     const boundary = path.relative(root, resolved);
     if (boundary === ".." || boundary.startsWith(`..${path.sep}`) || path.isAbsolute(boundary)) {
@@ -698,6 +744,23 @@ function resolveWithinRoot(root, relativePath) {
     }
     return resolved;
 }
+/**
+ * The single choke point for the generated-skill namespace: every sync write resolves its path
+ * here, so no regeneration path — including `--force` — can reach `.ai/skills/project/**`.
+ */
+function assertWritablePath(relativePath) {
+    const normalized = relativePath
+        .replaceAll("\\", "/")
+        .replace(/\/+/g, "/")
+        .replace(/^(?:\.\/)+/, "")
+        .replace(/\/$/, "")
+        .toLowerCase();
+    for (const prefix of PROTECTED_WRITE_PREFIXES) {
+        if (normalized === prefix || normalized.startsWith(`${prefix}/`)) {
+            throw new CliError(`Sync must never write inside the generated skill namespace: ${relativePath}`, 2);
+        }
+    }
+}
 async function resolveSafeGeneratedPath(fileSystem, root, relativePath) {
     const absolutePath = resolveWithinRoot(root, relativePath);
     await assertSafeGeneratedPath(fileSystem, root, absolutePath, relativePath);