wicked-crew 0.7.1 → 0.7.2

package/dist/qe/conformance.d.ts

@@ -0,0 +1,158 @@
+/**
+ * The acceptance view's CONFORMANCE section (AW-14 / arch-R13a + arch-R16).
+ *
+ * `GET /runs/:id/acceptance` used to resolve ONLY the QE ledger verdict, while
+ * governance conformance claims were served on a separate route
+ * (`/governance/claims`) nobody stands in front of — so a wiki-rule violation
+ * never appeared where humans actually look at a run's "is it done?". This
+ * module derives the missing half and `buildAcceptanceView` serves it BESIDE
+ * the QE gate: two verdicts, one page, deny-dominates on both.
+ *
+ * Three honesty rules, all deny-dominant:
+ *
+ * 1. **Run-scoped claims, cited.** Claims are filtered to THIS run's scope
+ *    (`wicked-agent/<runId>/shared` | `wicked-agent/<runId>/unit/<u>`, the
+ *    engine's `scope.rs` grammar) and each `conform:` obligation is parsed
+ *    back into the wiki/conformance rule it cites (severity, rule id,
+ *    statement — the `attach_recalled_rules` format), so a denial names the
+ *    rule that was violated instead of an opaque string.
+ *
+ * 2. **"Guardrailed" is a verified claim, never a default.** A run whose
+ *    workflow declared governed units but whose CLI has no gate-hook adapter
+ *    runs with UNCHECKED tool calls and only leaves a `governanceUnenforced`
+ *    event behind (gate-hook injection is claude-only — FINDING-063,
+ *    `execute_wrapped.rs`). This section reads the run's durable event log and
+ *    reports `enforcement.status` accordingly; `guardrailed` is true ONLY when
+ *    enforcement was positively observed armed and nothing reported unenforced.
+ *    An unreadable event log is `unverifiable` — unknown is never guardrailed.
+ *
+ * 3. **Unreadable is not clean.** A claims wire that cannot be read yields
+ *    `claimsAvailable: false` plus the error — never an empty list wearing a
+ *    "no denials" face.
+ *
+ * COVERAGE BOUNDARY (write-it-down half of arch-R16): deterministic per-tool-
+ * call input governance exists for claude only. Units routed to any other CLI
+ * (Antigravity, Codex, local, …) get phase-boundary coverage only — the
+ * in-process `apply_unit` output gate and the deliverable floor — which
+ * evaluates the unit's OUTPUT after the fact and cannot block a tool call
+ * mid-flight. A governed unit on a non-claude CLI is therefore reported here
+ * as `unenforced`, not silently folded into "guardrailed". The same boundary
+ * is documented in the README's acceptance section.
+ *
+ * Coordinates crew#311 (vacuous unit completion passes gates): same
+ * gate-honesty seam, different defect — #311 is about "done" being asserted
+ * from an empty turn; this section is about governance claims/enforcement
+ * being invisible or overclaimed. Neither fix closes the other.
+ */
+import type { GovernanceClaim, RecordedEvent } from '../core/types.js';
+/** A wiki/conformance rule cited by a claim's `conform:` obligation. */
+export interface ConformanceRuleCitation {
+    /** `Critical` | `Error` | `Warn` | `Info` — the rule's `ConfSeverity`, as serialized. */
+    severity: string;
+    /** The conformance-rule id (`PAT-*` / `POL-*`) — the wiki rule the claim cites. */
+    ruleId: string;
+    /** The rule's prescriptive statement. */
+    statement: string;
+}
+/** One of this run's governance decisions, run-scoped and with its rule citations parsed. */
+export interface RunConformanceClaimView {
+    claimId: string;
+    scope: string;
+    phase: string;
+    decision: 'allow' | 'deny' | 'allow_with_conditions';
+    policyIds: string[];
+    /** Wiki/conformance rules cited by `conform:` obligations — the ruleset the output had to meet. */
+    rules: ConformanceRuleCitation[];
+    /** Every obligation, verbatim (includes the unparsed originals of `rules`). */
+    obligations: string[];
+    evaluator: string;
+    /** Unix-seconds timestamp of evaluation. */
+    evaluatedAt: number;
+    /**
+     * True for an ADVISORY boundary READ deny: the tool call WAS blocked, but a blocked read leaks
+     * nothing, so it is audit-only and not unit-fatal (core#219). Mirrors the engine's
+     * `is_advisory_boundary_read_deny` exactly — evaluator identity AND claim-id prefix, so a policy
+     * deny can never be downgraded to advisory.
+     */
+    advisory: boolean;
+}
+/** A unit the workflow declared governed that ran with UNCHECKED tool calls (FINDING-063). */
+export interface UnenforcedUnit {
+    ord: number;
+    attempt: number;
+    cli: string;
+    reason: string;
+}
+/** What the run's durable event log says about whether governance was actually IN FORCE. */
+export interface GovernanceEnforcementView {
+    /**
+     * - `enforced`     — enforcement positively observed armed; nothing reported unenforced.
+     * - `unenforced`   — ≥1 governed unit ran with unchecked tool calls (`governanceUnenforced`).
+     * - `ungoverned`   — the log is readable and carries no governance signal at all: the run never
+     *                    asked for governance. Not a failure — but never "guardrailed" either.
+     * - `unverifiable` — the event log could not be read; unknown is never guardrailed.
+     */
+    status: 'enforced' | 'unenforced' | 'ungoverned' | 'unverifiable';
+    /** The governed-but-unchecked units, verbatim from their events. Empty unless `unenforced`. */
+    unenforced: UnenforcedUnit[];
+    /** Ords of units whose governance context was confirmed armed (`governanceContextArmed`). */
+    armedUnits: number[];
+    /** Why the status is what it is — always populated. */
+    reason: string;
+}
+/** The conformance half of the acceptance view — served beside the QE gate. */
+export interface RunConformance {
+    /** Whether the claims wire could be read at all. False is NOT "no denials". */
+    claimsAvailable: boolean;
+    /** The read failure, when `claimsAvailable` is false for a reason other than a missing binding. */
+    claimsError?: string;
+    /** This run's claims (run-scope filtered), oldest first. */
+    claims: RunConformanceClaimView[];
+    /** Non-advisory deny claims — the ones that stand against the run. */
+    denials: number;
+    /** Advisory boundary-read denies — blocked, audited, not unit-fatal. */
+    advisoryDenials: number;
+    /** Deny-dominates over the run's READ claims: true when any non-advisory deny stands. */
+    denied: boolean;
+    enforcement: GovernanceEnforcementView;
+    /**
+     * The ONE headline, deny-dominates across everything above: true ONLY when the claims wire was
+     * readable, no non-advisory denial stands, AND enforcement was positively verified. An
+     * unenforced, ungoverned, or unverifiable run is NEVER guardrailed (arch-R16).
+     */
+    guardrailed: boolean;
+    /** One honest sentence for the surface beside the QE verdict. */
+    summary: string;
+}
+/** Whether `scope` belongs to run `runId` under the engine's scope grammar. */
+export declare function isRunScope(scope: string, runId: string): boolean;
+/**
+ * Parse one `conform:<Severity>:<id>:<statement>` obligation (the `attach_recalled_rules` format)
+ * into its rule citation. Statements may contain `:` freely — only the first three separators
+ * split. Returns null for any obligation that is not a rule citation (boundary reasons, policy
+ * obligations, free text): those stay visible verbatim in `obligations`.
+ */
+export declare function parseRuleCitation(obligation: string): ConformanceRuleCitation | null;
+/** Mirror of the engine's `is_advisory_boundary_read_deny` (`gate_hook.rs`). */
+export declare function isAdvisoryBoundaryReadDeny(claim: GovernanceClaim): boolean;
+/**
+ * Derive the enforcement view from the run's durable event log.
+ *
+ * `events === null` means the log could NOT be read (no binding, or the loader was not wired) —
+ * which is `unverifiable`, never a quiet "enforced". An empty log is a real answer: no governance
+ * signal ⇒ `ungoverned`.
+ */
+export declare function resolveEnforcement(events: RecordedEvent[] | null): GovernanceEnforcementView;
+/**
+ * Assemble the conformance section: run-scoped claims + enforcement, resolved deny-dominates.
+ *
+ * `claims === null` means the claims wire could not be read (`claimsError` says why when known) —
+ * reported as unavailable, never as an empty clean list.
+ */
+export declare function resolveConformance(opts: {
+    runId: string;
+    claims: GovernanceClaim[] | null;
+    claimsError?: string;
+    events: RecordedEvent[] | null;
+}): RunConformance;
+//# sourceMappingURL=conformance.d.ts.map

package/dist/qe/conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.d.ts","sourceRoot":"","sources":["../../src/qe/conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAUvE,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,yFAAyF;IACzF,QAAQ,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6FAA6F;AAC7F,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,uBAAuB,CAAC;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,mGAAmG;IACnG,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACjC,+EAA+E;IAC/E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,WAAW,yBAAyB;IACxC;;;;;;OAMG;IACH,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,cAAc,CAAC;IAClE,+FAA+F;IAC/F,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,mGAAmG;IACnG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMhE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAYpF;AAED,gFAAgF;AAChF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAM1E;AA+BD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,GAAG,yBAAyB,CAyE5F;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;CAChC,GAAG,cAAc,CA6CjB"}

package/dist/qe/conformance.js

@@ -0,0 +1,244 @@
+/**
+ * The acceptance view's CONFORMANCE section (AW-14 / arch-R13a + arch-R16).
+ *
+ * `GET /runs/:id/acceptance` used to resolve ONLY the QE ledger verdict, while
+ * governance conformance claims were served on a separate route
+ * (`/governance/claims`) nobody stands in front of — so a wiki-rule violation
+ * never appeared where humans actually look at a run's "is it done?". This
+ * module derives the missing half and `buildAcceptanceView` serves it BESIDE
+ * the QE gate: two verdicts, one page, deny-dominates on both.
+ *
+ * Three honesty rules, all deny-dominant:
+ *
+ * 1. **Run-scoped claims, cited.** Claims are filtered to THIS run's scope
+ *    (`wicked-agent/<runId>/shared` | `wicked-agent/<runId>/unit/<u>`, the
+ *    engine's `scope.rs` grammar) and each `conform:` obligation is parsed
+ *    back into the wiki/conformance rule it cites (severity, rule id,
+ *    statement — the `attach_recalled_rules` format), so a denial names the
+ *    rule that was violated instead of an opaque string.
+ *
+ * 2. **"Guardrailed" is a verified claim, never a default.** A run whose
+ *    workflow declared governed units but whose CLI has no gate-hook adapter
+ *    runs with UNCHECKED tool calls and only leaves a `governanceUnenforced`
+ *    event behind (gate-hook injection is claude-only — FINDING-063,
+ *    `execute_wrapped.rs`). This section reads the run's durable event log and
+ *    reports `enforcement.status` accordingly; `guardrailed` is true ONLY when
+ *    enforcement was positively observed armed and nothing reported unenforced.
+ *    An unreadable event log is `unverifiable` — unknown is never guardrailed.
+ *
+ * 3. **Unreadable is not clean.** A claims wire that cannot be read yields
+ *    `claimsAvailable: false` plus the error — never an empty list wearing a
+ *    "no denials" face.
+ *
+ * COVERAGE BOUNDARY (write-it-down half of arch-R16): deterministic per-tool-
+ * call input governance exists for claude only. Units routed to any other CLI
+ * (Antigravity, Codex, local, …) get phase-boundary coverage only — the
+ * in-process `apply_unit` output gate and the deliverable floor — which
+ * evaluates the unit's OUTPUT after the fact and cannot block a tool call
+ * mid-flight. A governed unit on a non-claude CLI is therefore reported here
+ * as `unenforced`, not silently folded into "guardrailed". The same boundary
+ * is documented in the README's acceptance section.
+ *
+ * Coordinates crew#311 (vacuous unit completion passes gates): same
+ * gate-honesty seam, different defect — #311 is about "done" being asserted
+ * from an empty turn; this section is about governance claims/enforcement
+ * being invisible or overclaimed. Neither fix closes the other.
+ */
+/** Scope prefix the engine stamps on every run-scoped governance artifact (`scope.rs`). */
+const RUN_SCOPE_PREFIX = 'wicked-agent/';
+/** Evaluator identity of filesystem-boundary denies (`gate_hook.rs` BOUNDARY_EVALUATOR). */
+const BOUNDARY_EVALUATOR = 'wicked-governance-boundary';
+/** Claim-id prefix of an ADVISORY boundary READ deny (`gate_hook.rs` BOUNDARY_READ_DENY_PREFIX). */
+const BOUNDARY_READ_DENY_PREFIX = 'boundary-read-deny:';
+/** Whether `scope` belongs to run `runId` under the engine's scope grammar. */
+export function isRunScope(scope, runId) {
+    if (!scope.startsWith(RUN_SCOPE_PREFIX))
+        return false;
+    const rest = scope.slice(RUN_SCOPE_PREFIX.length);
+    // `<runId>/shared` or `<runId>/unit/<discriminator>` — exact segment match, so run id `r-1`
+    // can never claim `r-10`'s scope by prefix accident.
+    return rest === `${runId}/shared` || rest.startsWith(`${runId}/unit/`);
+}
+/**
+ * Parse one `conform:<Severity>:<id>:<statement>` obligation (the `attach_recalled_rules` format)
+ * into its rule citation. Statements may contain `:` freely — only the first three separators
+ * split. Returns null for any obligation that is not a rule citation (boundary reasons, policy
+ * obligations, free text): those stay visible verbatim in `obligations`.
+ */
+export function parseRuleCitation(obligation) {
+    if (!obligation.startsWith('conform:'))
+        return null;
+    const rest = obligation.slice('conform:'.length);
+    const sevEnd = rest.indexOf(':');
+    if (sevEnd <= 0)
+        return null;
+    const idEnd = rest.indexOf(':', sevEnd + 1);
+    if (idEnd <= sevEnd + 1)
+        return null;
+    const severity = rest.slice(0, sevEnd);
+    const ruleId = rest.slice(sevEnd + 1, idEnd);
+    const statement = rest.slice(idEnd + 1);
+    if (statement === '')
+        return null;
+    return { severity, ruleId, statement };
+}
+/** Mirror of the engine's `is_advisory_boundary_read_deny` (`gate_hook.rs`). */
+export function isAdvisoryBoundaryReadDeny(claim) {
+    return (claim.decision === 'deny' &&
+        claim.evaluator_identity === BOUNDARY_EVALUATOR &&
+        claim.claim_id.startsWith(BOUNDARY_READ_DENY_PREFIX));
+}
+/** Map one store claim to its view row (citations parsed, advisory flagged). */
+function toClaimView(claim) {
+    const rules = [];
+    for (const ob of claim.obligations) {
+        const cite = parseRuleCitation(ob);
+        if (cite !== null)
+            rules.push(cite);
+    }
+    return {
+        claimId: claim.claim_id,
+        scope: claim.scope,
+        phase: claim.phase,
+        decision: claim.decision,
+        policyIds: claim.policy_ids,
+        rules,
+        obligations: claim.obligations,
+        evaluator: claim.evaluator_identity,
+        evaluatedAt: claim.evaluated_at,
+        advisory: isAdvisoryBoundaryReadDeny(claim),
+    };
+}
+/** Safe field reads off the loose `RecordedEvent` bag. */
+function num(v) {
+    return typeof v === 'number' && Number.isFinite(v) ? v : -1;
+}
+function str(v) {
+    return typeof v === 'string' ? v : '';
+}
+/**
+ * Derive the enforcement view from the run's durable event log.
+ *
+ * `events === null` means the log could NOT be read (no binding, or the loader was not wired) —
+ * which is `unverifiable`, never a quiet "enforced". An empty log is a real answer: no governance
+ * signal ⇒ `ungoverned`.
+ */
+export function resolveEnforcement(events) {
+    if (events === null) {
+        return {
+            status: 'unverifiable',
+            unenforced: [],
+            armedUnits: [],
+            reason: 'run event log unavailable — enforcement cannot be verified (unknown is never guardrailed)',
+        };
+    }
+    const unenforced = [];
+    const armed = new Set();
+    let governedSignal = false;
+    for (const ev of events) {
+        switch (ev.type) {
+            case 'governanceUnenforced':
+                unenforced.push({
+                    ord: num(ev['ord']),
+                    attempt: num(ev['attempt']),
+                    cli: str(ev['cli']),
+                    reason: str(ev['reason']),
+                });
+                break;
+            case 'governanceContextArmed':
+                armed.add(num(ev['ord']));
+                governedSignal = true;
+                break;
+            case 'governanceHookFired':
+            case 'validationPinAttached':
+                governedSignal = true;
+                break;
+            case 'unitOutputCaptured':
+                if (ev['governed'] === true)
+                    governedSignal = true;
+                break;
+            default:
+                break;
+        }
+    }
+    const armedUnits = [...armed].sort((a, b) => a - b);
+    if (unenforced.length > 0) {
+        // Deny-dominates: ONE unchecked governed unit breaks the whole run's guardrail claim, even
+        // when every other unit was armed — a chain with a named missing link.
+        const clis = [...new Set(unenforced.map((u) => u.cli))].join(', ');
+        return {
+            status: 'unenforced',
+            unenforced,
+            armedUnits,
+            reason: `${unenforced.length} governed unit(s) ran with UNCHECKED tool calls on ${clis} ` +
+                '(gate-hook injection is claude-only; phase-boundary output gating still applied)',
+        };
+    }
+    if (governedSignal) {
+        return {
+            status: 'enforced',
+            unenforced: [],
+            armedUnits,
+            reason: armedUnits.length > 0
+                ? `input governance confirmed armed for unit(s) ${armedUnits.join(', ')}; none reported unenforced`
+                : 'governance activity recorded and no unit reported unenforced',
+        };
+    }
+    return {
+        status: 'ungoverned',
+        unenforced: [],
+        armedUnits: [],
+        reason: 'the run recorded no governance signal — nothing was enforced, so nothing is claimed guardrailed',
+    };
+}
+/**
+ * Assemble the conformance section: run-scoped claims + enforcement, resolved deny-dominates.
+ *
+ * `claims === null` means the claims wire could not be read (`claimsError` says why when known) —
+ * reported as unavailable, never as an empty clean list.
+ */
+export function resolveConformance(opts) {
+    const enforcement = resolveEnforcement(opts.events);
+    const claimsAvailable = opts.claims !== null;
+    const claims = (opts.claims ?? [])
+        .filter((c) => isRunScope(c.scope, opts.runId))
+        .sort((a, b) => a.evaluated_at - b.evaluated_at)
+        .map(toClaimView);
+    const denials = claims.filter((c) => c.decision === 'deny' && !c.advisory).length;
+    const advisoryDenials = claims.filter((c) => c.decision === 'deny' && c.advisory).length;
+    const denied = denials > 0;
+    // The headline. Every conjunct is a positive verification; absence of evidence never passes.
+    const guardrailed = claimsAvailable && !denied && enforcement.status === 'enforced';
+    let summary;
+    if (!claimsAvailable) {
+        summary = `conformance claims unreadable${opts.claimsError !== undefined ? `: ${opts.claimsError}` : ''} — not claimed clean (unreadable is not clean)`;
+    }
+    else if (denied) {
+        const cited = claims
+            .filter((c) => c.decision === 'deny' && !c.advisory)
+            .flatMap((c) => c.rules.map((r) => r.ruleId));
+        summary =
+            `${denials} governance denial(s) stand against this run` +
+                (cited.length > 0 ? ` (rules cited: ${[...new Set(cited)].join(', ')})` : '') +
+                ` — deny-dominates`;
+    }
+    else if (enforcement.status === 'enforced') {
+        summary = `guardrailed — enforcement verified and ${claims.length} claim(s) carry no standing denial`;
+    }
+    else {
+        // No denial read, but enforcement not verified: the enforcement reason IS the story.
+        summary = `no standing denial, but NOT guardrailed — ${enforcement.reason}`;
+    }
+    return {
+        claimsAvailable,
+        ...(opts.claimsError !== undefined ? { claimsError: opts.claimsError } : {}),
+        claims,
+        denials,
+        advisoryDenials,
+        denied,
+        enforcement,
+        guardrailed,
+        summary,
+    };
+}
+//# sourceMappingURL=conformance.js.map

package/dist/qe/conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.js","sourceRoot":"","sources":["../../src/qe/conformance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH,2FAA2F;AAC3F,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEzC,4FAA4F;AAC5F,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AACxD,oGAAoG;AACpG,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAsFxD,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,KAAa;IACrD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClD,4FAA4F;IAC5F,qDAAqD;IACrD,OAAO,IAAI,KAAK,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5C,IAAI,KAAK,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CAAC,KAAsB;IAC/D,OAAO,CACL,KAAK,CAAC,QAAQ,KAAK,MAAM;QACzB,KAAK,CAAC,kBAAkB,KAAK,kBAAkB;QAC/C,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,yBAAyB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,QAAQ;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,KAAK;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,kBAAkB;QACnC,WAAW,EAAE,KAAK,CAAC,YAAY;QAC/B,QAAQ,EAAE,0BAA0B,CAAC,KAAK,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA8B;IAC/D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EACJ,2FAA2F;SAC9F,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YAChB,KAAK,sBAAsB;gBACzB,UAAU,CAAC,IAAI,CAAC;oBACd,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBACnB,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC3B,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;iBAC1B,CAAC,CAAC;gBACH,MAAM;YACR,KAAK,wBAAwB;gBAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,qBAAqB,CAAC;YAC3B,KAAK,uBAAuB;gBAC1B,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,oBAAoB;gBACvB,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI;oBAAE,cAAc,GAAG,IAAI,CAAC;gBACnD,MAAM;YACR;gBACE,MAAM;QACV,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,2FAA2F;QAC3F,uEAAuE;QACvE,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,UAAU;YACV,UAAU;YACV,MAAM,EACJ,GAAG,UAAU,CAAC,MAAM,sDAAsD,IAAI,GAAG;gBACjF,kFAAkF;SACrF,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,UAAU,EAAE,EAAE;YACd,UAAU;YACV,MAAM,EACJ,UAAU,CAAC,MAAM,GAAG,CAAC;gBACnB,CAAC,CAAC,gDAAgD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B;gBACnG,CAAC,CAAC,8DAA8D;SACrE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,EAAE;QACd,MAAM,EACJ,iGAAiG;KACpG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;SAC/C,GAAG,CAAC,WAAW,CAAC,CAAC;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAClF,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IACzF,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,CAAC;IAE3B,6FAA6F;IAC7F,MAAM,WAAW,GAAG,eAAe,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,CAAC;IAEpF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,GAAG,gCAAgC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,gDAAgD,CAAC;IAC1J,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM;aACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;aACnD,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,OAAO;YACL,GAAG,OAAO,8CAA8C;gBACxD,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,mBAAmB,CAAC;IACxB,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,GAAG,0CAA0C,MAAM,CAAC,MAAM,oCAAoC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,qFAAqF;QACrF,OAAO,GAAG,6CAA6C,WAAW,CAAC,MAAM,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,eAAe;QACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM;QACN,OAAO;QACP,eAAe;QACf,MAAM;QACN,WAAW;QACX,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC"}