youmd 0.10.0 → 0.10.2

package/dist/lib/brain/safe-file.js

@@ -0,0 +1,564 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrainApplyInterruptedError = exports.BrainSafeFileError = exports.PROJECT_BRAIN_APPLY_JOURNAL_VERSION = exports.PROJECT_BRAIN_APPROVAL_VERSION = void 0;
+exports.readProjectBrainTrustedDeviceIdentity = readProjectBrainTrustedDeviceIdentity;
+exports.deriveProjectBrainApplyCredential = deriveProjectBrainApplyCredential;
+exports.applyProjectBrainSafeFile = applyProjectBrainSafeFile;
+exports.recoverProjectBrainSafeFile = recoverProjectBrainSafeFile;
+exports.projectBrainApplyJournalPath = projectBrainApplyJournalPath;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const vault_1 = require("../vault");
+const canonical_1 = require("./canonical");
+const discovery_1 = require("./discovery");
+const proposal_1 = require("./proposal");
+const types_1 = require("./types");
+exports.PROJECT_BRAIN_APPROVAL_VERSION = "you-md/project-brain-approval/v1";
+exports.PROJECT_BRAIN_APPLY_JOURNAL_VERSION = "you-md/project-brain-apply-journal/v1";
+class BrainSafeFileError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "BrainSafeFileError";
+    }
+}
+exports.BrainSafeFileError = BrainSafeFileError;
+class BrainApplyInterruptedError extends BrainSafeFileError {
+    constructor(phase) {
+        super("PROJECT_BRAIN_APPLY_INTERRUPTED", `project brain apply interrupted at ${phase}`);
+        this.phase = phase;
+    }
+}
+exports.BrainApplyInterruptedError = BrainApplyInterruptedError;
+function brainRoot(value) { return value ? path.resolve(value) : path.join((0, config_1.getWritableHomeBundleDir)(), "brain"); }
+function proposalHex(ref) {
+    const match = /^proposal:brain\/([a-f0-9]{64})$/.exec(ref);
+    if (!match)
+        throw new BrainSafeFileError("PROJECT_BRAIN_INVALID_PROPOSAL", "proposalRef is invalid");
+    return match[1];
+}
+function artifactHex(ref) { return (0, canonical_1.sha256)(ref); }
+function contentHash(value) { return `sha256:${crypto.createHash("sha256").update(value, "utf8").digest("hex")}`; }
+function nonceHash(value) { return `sha256:${(0, canonical_1.sha256)(value)}`; }
+function fsyncDirectory(dir) {
+    let fd;
+    try {
+        fd = fs.openSync(dir, fs.constants.O_RDONLY);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+function ensurePrivateDirectory(dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const stat = fs.lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "private state directory is unsafe");
+    try {
+        fs.chmodSync(dir, 0o700);
+    }
+    catch { /* non-POSIX */ }
+}
+function atomicWrite(file, data, mode = 0o600, privateDirectory = true) {
+    if (privateDirectory)
+        ensurePrivateDirectory(path.dirname(file));
+    else {
+        const directory = fs.lstatSync(path.dirname(file));
+        if (!directory.isDirectory() || directory.isSymbolicLink())
+            throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "target directory is unsafe");
+    }
+    if (fs.existsSync(file)) {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "atomic target is unsafe");
+    }
+    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`);
+    let fd;
+    try {
+        fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, mode);
+        fs.writeFileSync(fd, data);
+        fs.fsyncSync(fd);
+        fs.closeSync(fd);
+        fd = undefined;
+        fs.renameSync(temporary, file);
+        try {
+            fs.chmodSync(file, mode);
+        }
+        catch { /* non-POSIX */ }
+        fsyncDirectory(path.dirname(file));
+    }
+    catch (error) {
+        if (fd !== undefined)
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* closed */ }
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch { /* absent */ }
+        throw error;
+    }
+}
+function atomicJson(file, value) { atomicWrite(file, `${JSON.stringify(value, null, 2)}\n`); }
+function safeReadRegular(file, maxBytes) {
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > maxBytes)
+        throw new BrainSafeFileError("PROJECT_BRAIN_SAFE_OPEN_FAILED", "target is not a bounded regular file");
+    const noFollow = fs.constants.O_NOFOLLOW || 0;
+    let fd;
+    try {
+        fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+        const opened = fs.fstatSync(fd);
+        if (!opened.isFile() || opened.dev !== stat.dev || opened.ino !== stat.ino || opened.size !== stat.size) {
+            throw new BrainSafeFileError("PROJECT_BRAIN_SAFE_OPEN_FAILED", "target changed during safe open");
+        }
+        const buffer = Buffer.alloc(opened.size);
+        let offset = 0;
+        while (offset < opened.size) {
+            const count = fs.readSync(fd, buffer, offset, opened.size - offset, offset);
+            if (!count)
+                break;
+            offset += count;
+        }
+        if (offset !== opened.size)
+            throw new BrainSafeFileError("PROJECT_BRAIN_SAFE_OPEN_FAILED", "target safe read was incomplete");
+        const content = buffer.toString("utf8");
+        if (Buffer.from(content, "utf8").length !== buffer.length || content.includes("\0"))
+            throw new BrainSafeFileError("PROJECT_BRAIN_SAFE_OPEN_FAILED", "target is not safe UTF-8 text");
+        return { content, mode: stat.mode & 0o777 };
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+function assertSafeRootAndTarget(rootValue, relative) {
+    if (!(0, discovery_1.isSafeRelativePath)(relative) || relative.startsWith(".git/") || relative === ".git") {
+        throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "target path is unsafe");
+    }
+    const root = path.resolve(rootValue);
+    const rootStat = fs.lstatSync(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+        throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "repository root is unsafe");
+    let current = root;
+    for (const segment of relative.split("/")) {
+        current = path.join(current, segment);
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink())
+            throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "target path crosses a symlink");
+        if (current !== path.join(root, relative) && !stat.isDirectory())
+            throw new BrainSafeFileError("PROJECT_BRAIN_UNSAFE_PATH", "target parent is not a directory");
+    }
+    return { root, target: current };
+}
+function matchesGenerated(relative, pattern) {
+    if (pattern.startsWith("**/")) {
+        const segment = pattern.slice(3).replace(/\/\*\*$/, "");
+        return relative === segment || relative.startsWith(`${segment}/`) || relative.includes(`/${segment}/`);
+    }
+    const prefix = pattern.replace(/\/\*\*$/, "");
+    return relative === prefix || relative.startsWith(`${prefix}/`);
+}
+function applyUnifiedDiff(base, patch) {
+    if (!base.endsWith("\n") || patch.hunks.some((hunk) => hunk.lines.some((line) => line.startsWith("\\")))) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_PATCH_UNSUPPORTED", "safe apply requires newline-terminated text without no-newline directives");
+    }
+    const source = base.slice(0, -1).split("\n");
+    const output = [];
+    let cursor = 0;
+    for (const hunk of patch.hunks) {
+        const start = hunk.oldStart === 0 ? 0 : hunk.oldStart - 1;
+        if (start < cursor || start > source.length)
+            throw new BrainSafeFileError("PROJECT_BRAIN_PATCH_MISMATCH", "unified diff hunks overlap or exceed the base");
+        output.push(...source.slice(cursor, start));
+        let sourceIndex = start;
+        for (const line of hunk.lines) {
+            const marker = line[0];
+            const text = line.slice(1);
+            if (marker === " " || marker === "-") {
+                if (source[sourceIndex] !== text)
+                    throw new BrainSafeFileError("PROJECT_BRAIN_PATCH_MISMATCH", "unified diff context does not match the exact base");
+                if (marker === " ")
+                    output.push(text);
+                sourceIndex += 1;
+            }
+            else if (marker === "+")
+                output.push(text);
+            else
+                throw new BrainSafeFileError("PROJECT_BRAIN_PATCH_UNSUPPORTED", "unified diff line marker is unsupported");
+        }
+        cursor = sourceIndex;
+    }
+    output.push(...source.slice(cursor));
+    return `${output.join("\n")}\n`;
+}
+function assertMarkerBounded(before, after, artifactRef) {
+    const start = `<!-- you.md:managed:start ${artifactRef} -->`;
+    const end = `<!-- you.md:managed:end ${artifactRef} -->`;
+    const beforeStart = before.indexOf(start);
+    const beforeEnd = before.indexOf(end);
+    const afterStart = after.indexOf(start);
+    const afterEnd = after.indexOf(end);
+    if (beforeStart < 0 || beforeEnd <= beforeStart || afterStart < 0 || afterEnd <= afterStart
+        || before.indexOf(start, beforeStart + 1) >= 0 || before.indexOf(end, beforeEnd + 1) >= 0
+        || after.indexOf(start, afterStart + 1) >= 0 || after.indexOf(end, afterEnd + 1) >= 0) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_MARKER_REQUIRED", "managed_write requires exactly one matching marker boundary");
+    }
+    const beforePrefix = before.slice(0, beforeStart + start.length);
+    const afterPrefix = after.slice(0, afterStart + start.length);
+    const beforeSuffix = before.slice(beforeEnd);
+    const afterSuffix = after.slice(afterEnd);
+    if (beforePrefix !== afterPrefix || beforeSuffix !== afterSuffix) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_MARKER_ESCAPE", "unified diff changes content outside the managed marker boundary");
+    }
+}
+function deviceKeyPath() { return path.join((0, config_1.getWritableHomeBundleDir)(), "secret-vault", "devices", "current-device-key.json"); }
+function loadTrustedDeviceKey() {
+    const file = deviceKeyPath();
+    const read = safeReadRegular(file, 128 * 1024);
+    const stat = fs.statSync(file);
+    if (process.platform !== "win32" && (stat.mode & 0o077) !== 0)
+        throw new BrainSafeFileError("PROJECT_BRAIN_ENCRYPTION_REQUIRED", "trusted-device key permissions are unsafe");
+    let key;
+    try {
+        key = JSON.parse(read.content);
+    }
+    catch {
+        throw new BrainSafeFileError("PROJECT_BRAIN_ENCRYPTION_REQUIRED", "trusted-device key is invalid");
+    }
+    if (key.schemaVersion !== "you-md/secret-vault-device-key/v1" || key.keyAlgorithm !== "rsa-oaep-sha256"
+        || !key.deviceId || !key.publicKeyPem || !key.privateKeyPem)
+        throw new BrainSafeFileError("PROJECT_BRAIN_ENCRYPTION_REQUIRED", "trusted-device key is incomplete");
+    return key;
+}
+function readProjectBrainTrustedDeviceIdentity() {
+    const key = loadTrustedDeviceKey();
+    return {
+        deviceId: key.deviceId,
+        deviceKeyFingerprint: `sha256:${(0, canonical_1.sha256)(key.publicKeyPem)}`,
+    };
+}
+/**
+ * Derive a retry-stable, device-bound apply credential without persisting its
+ * preimage. Only the SHA-256 hash is sent during claim; the credential itself
+ * is used for that exact attempt's lifecycle events.
+ */
+function deriveProjectBrainApplyCredential(proposalId, applyId) {
+    const key = loadTrustedDeviceKey();
+    const digest = crypto.createHmac("sha256", key.privateKeyPem)
+        .update(`you-md/project-brain-apply-credential/v1\0${proposalId}\0${applyId}`, "utf8")
+        .digest("hex");
+    return `apply_${digest}`;
+}
+function encryptRollback(content, key) {
+    const dataKey = (0, vault_1.generateVaultKey)();
+    const encrypted = (0, vault_1.encryptData)(content, dataKey);
+    const wrapped = crypto.publicEncrypt({ key: key.publicKeyPem, oaepHash: "sha256", padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, Buffer.from(dataKey));
+    return {
+        schemaVersion: "you-md/project-brain-rollback/v1",
+        deviceId: key.deviceId,
+        algorithm: "rsa-oaep-sha256+aes-256-gcm",
+        wrappedKeyBase64: wrapped.toString("base64"),
+        ivBase64: Buffer.from(encrypted.iv).toString("base64"),
+        ciphertextBase64: Buffer.from(encrypted.ciphertext).toString("base64"),
+        plaintextHash: contentHash(content),
+    };
+}
+function decryptRollback(envelope, key) {
+    if (envelope.schemaVersion !== "you-md/project-brain-rollback/v1" || envelope.deviceId !== key.deviceId
+        || envelope.algorithm !== "rsa-oaep-sha256+aes-256-gcm")
+        throw new BrainSafeFileError("PROJECT_BRAIN_ROLLBACK_FAILED", "rollback envelope is invalid for this trusted device");
+    const dataKey = crypto.privateDecrypt({ key: key.privateKeyPem, oaepHash: "sha256", padding: crypto.constants.RSA_PKCS1_OAEP_PADDING }, Buffer.from(envelope.wrappedKeyBase64, "base64"));
+    const plaintext = (0, vault_1.decryptData)(Buffer.from(envelope.ciphertextBase64, "base64"), Buffer.from(envelope.ivBase64, "base64"), dataKey);
+    if (contentHash(plaintext) !== envelope.plaintextHash)
+        throw new BrainSafeFileError("PROJECT_BRAIN_ROLLBACK_FAILED", "rollback plaintext hash does not match");
+    return plaintext;
+}
+function journalPaths(root, proposalRef, artifactRef) {
+    const hex = proposalHex(proposalRef);
+    return {
+        journal: path.join(root, "audit", "apply", `${hex}.json`),
+        rollback: path.join(root, "audit", "apply", `${hex}.rollback.enc.json`),
+        freeze: artifactRef ? path.join(root, "failures", `frozen-${artifactHex(artifactRef)}.json`) : undefined,
+    };
+}
+function readJsonSafe(file, maxBytes = 1024 * 1024) {
+    return JSON.parse(safeReadRegular(file, maxBytes).content);
+}
+function assertApproval(proposal, approval, now, root) {
+    const exact = approval?.schemaVersion === exports.PROJECT_BRAIN_APPROVAL_VERSION && approval.kind === "project-brain-approval"
+        && approval.proposalRef === proposal.proposalRef && approval.decision === "approved" && approval.revoked === false
+        && approval.bindings?.projectRef === proposal.projectRef && approval.bindings.machineRef === proposal.machineRef
+        && approval.bindings.workspaceRef === proposal.workspaceRef && approval.bindings.baseRevision === proposal.baseRevision
+        && approval.bindings.baseContentHash === proposal.target.baseContentHash
+        && approval.bindings.sourceRevision === proposal.source.sourceRevision && approval.bindings.patchFormat === proposal.patchFormat
+        && approval.bindings.patchDigest === proposal.patchDigest && /^[A-Za-z0-9._:-]{8,160}$/.test(approval.approverRef || "")
+        && /^[A-Za-z0-9_-]{24,160}$/.test(approval.nonce || "");
+    const approvedAt = Date.parse(approval?.approvedAt || "");
+    const expiresAt = Date.parse(approval?.expiresAt || "");
+    if (!exact || !Number.isFinite(approvedAt) || !Number.isFinite(expiresAt) || approvedAt > now.getTime()
+        || expiresAt < now.getTime() || expiresAt - approvedAt > 900000) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_APPROVAL_INVALID", "fresh exact approval is missing, expired, revoked, or mismatched");
+    }
+    const used = nonceHash(approval.nonce);
+    const audit = path.join(root, "audit", "apply");
+    try {
+        for (const name of fs.readdirSync(audit)) {
+            if (!/^[a-f0-9]{64}\.json$/.test(name))
+                continue;
+            const journal = readJsonSafe(path.join(audit, name));
+            if (journal.nonceHash === used)
+                throw new BrainSafeFileError("PROJECT_BRAIN_APPROVAL_REPLAY", "approval nonce was already consumed");
+        }
+    }
+    catch (error) {
+        if (error instanceof BrainSafeFileError)
+            throw error;
+    }
+}
+function validateGrant(options) {
+    const { proposal, scan } = options;
+    const validation = (0, proposal_1.validateProjectBrainProposal)(proposal);
+    if (!validation.valid || proposal.proposalType !== "artifact_update" || proposal.patchFormat !== "unified_diff") {
+        throw new BrainSafeFileError("PROJECT_BRAIN_APPLY_NOT_SUPPORTED", "safe apply accepts only valid unified-diff artifact_update proposals");
+    }
+    if (proposal.machineRef !== scan.workspaceIdentity.machineRef || proposal.workspaceRef !== scan.workspaceRef
+        || proposal.baseRevision !== scan.revision.digest)
+        throw new BrainSafeFileError("PROJECT_BRAIN_STALE_BASE", "proposal is not bound to this exact machine, worktree, branch, and scan revision");
+    const project = scan.projects.find((candidate) => candidate.projectRef === proposal.projectRef);
+    const artifact = project?.artifacts.find((candidate) => candidate.artifactRef === proposal.target.artifactRef);
+    if (!project || project.management !== "declared" || !artifact || artifact.path !== proposal.target.path
+        || artifact.owner !== proposal.target.owner || artifact.authority !== proposal.target.authority
+        || artifact.provenance.sourceRevision !== proposal.source.sourceRevision) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_UNGRANTED_CAPABILITY", "proposal target is not the exact declared artifact evidence");
+    }
+    if (types_1.GENERATED_EXCLUDES.some((pattern) => matchesGenerated(artifact.path, pattern))) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_GENERATED_ARTIFACT", "generated paths are never writable through Project Brain apply");
+    }
+    if (artifact.writePolicy === "managed_write")
+        return { artifactRef: artifact.artifactRef, targetPath: artifact.path, policy: "managed_write" };
+    if (artifact.writePolicy === "task_write" && artifact.kind === "tasks" && artifact.path === `${project.contextRoot}/tasks.json`
+        && project.taskWrite.enabled && project.taskWrite.artifactRef === artifact.artifactRef) {
+        return { artifactRef: artifact.artifactRef, targetPath: artifact.path, policy: "task_write" };
+    }
+    throw new BrainSafeFileError("PROJECT_BRAIN_UNGRANTED_CAPABILITY", "artifact lacks managed_write or exact task_write authority");
+}
+function result(journal) {
+    return {
+        status: journal.state,
+        proposalRef: journal.proposalRef,
+        artifactRef: journal.artifactRef,
+        targetPath: journal.targetPath,
+        beforeHash: journal.beforeHash,
+        afterHash: journal.afterHash,
+        rollbackCiphertextHash: journal.rollbackCiphertextHash,
+        manualRecoveryRequired: journal.manualRecoveryRequired,
+    };
+}
+function writeTarget(target, content, mode) {
+    const current = safeReadRegular(target, 16 * 1024 * 1024);
+    void current;
+    atomicWrite(target, content, mode || 0o600, false);
+}
+function freeze(paths, journal) {
+    const updated = {
+        ...journal, state: "rollback_failed", manualRecoveryRequired: true,
+        errorCode: "manual_recovery_required", updatedAt: new Date().toISOString(),
+    };
+    atomicJson(paths.journal, updated);
+    if (paths.freeze)
+        atomicJson(paths.freeze, {
+            schemaVersion: "you-md/project-brain-write-freeze/v1",
+            artifactRef: journal.artifactRef,
+            proposalRef: journal.proposalRef,
+            code: "manual_recovery_required",
+            beforeHash: journal.beforeHash,
+            afterHash: journal.afterHash,
+        });
+}
+async function applyProjectBrainSafeFile(options) {
+    const stateRoot = brainRoot(options.brainRoot);
+    const grant = validateGrant(options);
+    const paths = journalPaths(stateRoot, options.proposal.proposalRef, grant.artifactRef);
+    if (paths.freeze && fs.existsSync(paths.freeze))
+        throw new BrainSafeFileError("PROJECT_BRAIN_ARTIFACT_FROZEN", "artifact is frozen pending manual recovery");
+    if (fs.existsSync(paths.journal))
+        throw new BrainSafeFileError("PROJECT_BRAIN_PROPOSAL_REPLAY", "proposal already has an apply journal");
+    const safe = assertSafeRootAndTarget(options.root, grant.targetPath);
+    const before = safeReadRegular(safe.target, 16 * 1024 * 1024);
+    if (contentHash(before.content) !== options.proposal.target.baseContentHash)
+        throw new BrainSafeFileError("PROJECT_BRAIN_BASE_CONTENT_MISMATCH", "target content no longer matches the exact proposal base");
+    const normalized = (0, proposal_1.validateProjectBrainUnifiedDiffPatch)(options.proposal.patch, options.proposal.proposalRef);
+    if (!normalized.valid || !normalized.patch || normalized.patchDigest !== options.proposal.patchDigest) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_PATCH_MISMATCH", "unified diff is invalid or its digest changed");
+    }
+    const after = applyUnifiedDiff(before.content, normalized.patch);
+    if (contentHash(after) !== options.proposal.diff.afterDigest)
+        throw new BrainSafeFileError("PROJECT_BRAIN_PATCH_MISMATCH", "patched content does not match the approved result digest");
+    if (grant.policy === "managed_write")
+        assertMarkerBounded(before.content, after, grant.artifactRef);
+    assertApproval(options.proposal, options.approval, options.now || new Date(), stateRoot);
+    const device = loadTrustedDeviceKey();
+    const rollback = encryptRollback(before.content, device);
+    const rollbackCiphertextHash = `sha256:${(0, canonical_1.sha256)(Buffer.from(rollback.ciphertextBase64, "base64"))}`;
+    const now = (options.now || new Date()).toISOString();
+    const journal = {
+        schemaVersion: exports.PROJECT_BRAIN_APPLY_JOURNAL_VERSION,
+        kind: "project-brain-apply-journal",
+        proposalRef: options.proposal.proposalRef,
+        projectRef: options.proposal.projectRef,
+        artifactRef: grant.artifactRef,
+        targetPath: grant.targetPath,
+        machineRef: options.scan.workspaceIdentity.machineRef,
+        workspaceRef: options.scan.workspaceRef,
+        repositoryRef: options.scan.workspaceIdentity.repositoryRef,
+        branchRef: options.scan.workspaceIdentity.branchRef,
+        baseRevision: options.scan.revision.digest,
+        sourceRevision: options.proposal.source.sourceRevision,
+        beforeHash: contentHash(before.content),
+        afterHash: contentHash(after),
+        patchDigest: options.proposal.patchDigest,
+        nonceHash: nonceHash(options.approval.nonce),
+        rollbackFile: path.basename(paths.rollback),
+        rollbackCiphertextHash,
+        state: "prepared",
+        preparedAt: now,
+        updatedAt: now,
+        manualRecoveryRequired: false,
+    };
+    atomicJson(paths.rollback, rollback);
+    atomicJson(paths.journal, journal);
+    await options.onPrepared?.({
+        proposalRef: journal.proposalRef,
+        artifactRef: journal.artifactRef,
+        targetPath: journal.targetPath,
+        beforeHash: journal.beforeHash,
+        afterHash: journal.afterHash,
+        rollbackCiphertextHash: journal.rollbackCiphertextHash,
+    });
+    if (options.faultInjection === "after_journal")
+        throw new BrainApplyInterruptedError("after_journal");
+    try {
+        const recheck = safeReadRegular(safe.target, 16 * 1024 * 1024);
+        if (contentHash(recheck.content) !== journal.beforeHash)
+            throw new BrainSafeFileError("PROJECT_BRAIN_BASE_CONTENT_MISMATCH", "target changed after journal preparation");
+        writeTarget(safe.target, after, before.mode);
+        if (options.faultInjection === "crash_after_target")
+            throw new BrainApplyInterruptedError("after_target");
+        if (options.faultInjection === "rollback_failure")
+            throw new Error("fault after target");
+        const applied = { ...journal, state: "applied", updatedAt: new Date().toISOString() };
+        atomicJson(paths.journal, applied);
+        return result(applied);
+    }
+    catch (error) {
+        if (error instanceof BrainApplyInterruptedError)
+            throw error;
+        try {
+            if (options.faultInjection === "rollback_failure")
+                throw new Error("injected rollback failure");
+            const current = safeReadRegular(safe.target, 16 * 1024 * 1024);
+            if (contentHash(current.content) === journal.afterHash)
+                writeTarget(safe.target, before.content, before.mode);
+        }
+        catch {
+            freeze(paths, journal);
+            throw new BrainSafeFileError("PROJECT_BRAIN_ROLLBACK_FAILED", "rollback failed; artifact is frozen for manual recovery");
+        }
+        throw error;
+    }
+}
+function recoverProjectBrainSafeFile(options) {
+    const stateRoot = brainRoot(options.brainRoot);
+    const preliminary = journalPaths(stateRoot, options.proposalRef);
+    const journal = readJsonSafe(preliminary.journal);
+    const paths = journalPaths(stateRoot, options.proposalRef, journal.artifactRef);
+    if (journal.schemaVersion !== exports.PROJECT_BRAIN_APPLY_JOURNAL_VERSION || journal.proposalRef !== options.proposalRef
+        || journal.machineRef !== options.scan.workspaceIdentity.machineRef || journal.workspaceRef !== options.scan.workspaceRef
+        || journal.repositoryRef !== options.scan.workspaceIdentity.repositoryRef || journal.branchRef !== options.scan.workspaceIdentity.branchRef) {
+        throw new BrainSafeFileError("PROJECT_BRAIN_RECOVERY_BINDING_MISMATCH", "journal is not bound to this exact machine, repository, worktree, and branch");
+    }
+    if (journal.state === "applied" || journal.state === "rolled_back" || journal.state === "recovered_noop")
+        return result(journal);
+    const safe = assertSafeRootAndTarget(options.root, journal.targetPath);
+    try {
+        const current = safeReadRegular(safe.target, 16 * 1024 * 1024);
+        const currentHash = contentHash(current.content);
+        if (currentHash === journal.beforeHash) {
+            const recovered = { ...journal, state: "recovered_noop", manualRecoveryRequired: false, errorCode: undefined, updatedAt: new Date().toISOString() };
+            atomicJson(paths.journal, recovered);
+            if (paths.freeze)
+                try {
+                    fs.unlinkSync(paths.freeze);
+                }
+                catch { /* absent */ }
+            return result(recovered);
+        }
+        if (currentHash !== journal.afterHash)
+            throw new Error("target is neither approved before nor after state");
+        if (options.faultInjection === "rollback_failure")
+            throw new Error("injected rollback failure");
+        const device = loadTrustedDeviceKey();
+        const rollback = decryptRollback(readJsonSafe(paths.rollback), device);
+        if (contentHash(rollback) !== journal.beforeHash)
+            throw new Error("rollback does not match journal");
+        writeTarget(safe.target, rollback, current.mode);
+        const restored = safeReadRegular(safe.target, 16 * 1024 * 1024);
+        if (contentHash(restored.content) !== journal.beforeHash)
+            throw new Error("rollback verification failed");
+        const recovered = { ...journal, state: "rolled_back", manualRecoveryRequired: false, errorCode: undefined, updatedAt: new Date().toISOString() };
+        atomicJson(paths.journal, recovered);
+        if (paths.freeze)
+            try {
+                fs.unlinkSync(paths.freeze);
+            }
+            catch { /* absent */ }
+        return result(recovered);
+    }
+    catch {
+        freeze(paths, journal);
+        throw new BrainSafeFileError("PROJECT_BRAIN_ROLLBACK_FAILED", "recovery failed; artifact remains frozen for manual recovery");
+    }
+}
+function projectBrainApplyJournalPath(brainRootValue, proposalRef) {
+    return journalPaths(path.resolve(brainRootValue), proposalRef).journal;
+}
+//# sourceMappingURL=safe-file.js.map

package/dist/lib/brain/safe-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-file.js","sourceRoot":"","sources":["../../../src/lib/brain/safe-file.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkTA,sFAMC;AAOD,8EAMC;AAgID,8DA6EC;AAED,kEAqCC;AAED,oEAEC;AA7jBD,+CAAiC;AACjC,uCAAyB;AACzB,2CAA6B;AAC7B,sCAAqD;AACrD,oCAAsE;AACtE,2CAAmD;AACnD,2CAAiD;AACjD,yCAKoB;AACpB,mCAA+D;AAElD,QAAA,8BAA8B,GAAG,kCAA2C,CAAC;AAC7E,QAAA,mCAAmC,GAAG,uCAAgD,CAAC;AAiGpG,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAqB,IAAY,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAhD,SAAI,GAAJ,IAAI,CAAQ;QAAqC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAAC,CAAC;CAC1G;AAFD,gDAEC;AAED,MAAa,0BAA2B,SAAQ,kBAAkB;IAChE,YAAqB,KAAa;QAAI,KAAK,CAAC,iCAAiC,EAAE,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAAzG,UAAK,GAAL,KAAK,CAAQ;IAA6F,CAAC;CACjI;AAFD,gEAEC;AAoBD,SAAS,SAAS,CAAC,KAAc,IAAY,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAA,iCAAwB,GAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACnI,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,EAAE,wBAAwB,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,SAAS,WAAW,CAAC,GAAW,IAAY,OAAO,IAAA,kBAAM,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjE,SAAS,WAAW,CAAC,KAAa,IAAY,OAAO,UAAU,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACnI,SAAS,SAAS,CAAC,KAAa,IAAY,OAAO,UAAU,IAAA,kBAAM,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAE/E,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QAAC,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAC/D,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACrD,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,mCAAmC,CAAC,CAAC;IACjJ,IAAI,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAqB,EAAE,IAAI,GAAG,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAC7F,IAAI,gBAAgB;QAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;SAC5D,CAAC;QACJ,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,4BAA4B,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,yBAAyB,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvI,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACtG,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,EAAE,GAAG,SAAS,CAAC;QACf,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC3D,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,EAAE,KAAK,SAAS;YAAE,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAc,IAAU,WAAW,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAErH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,EAAE,sCAAsC,CAAC,CAAC;IAC5K,MAAM,QAAQ,GAAI,EAAE,CAAC,SAAoC,CAAC,UAAU,IAAI,CAAC,CAAC;IAC1E,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACxG,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5E,IAAI,CAAC,KAAK;gBAAE,MAAM;YAClB,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,EAAE,iCAAiC,CAAC,CAAC;QAC9H,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,EAAE,+BAA+B,CAAC,CAAC;QACrL,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QAAC,IAAI,EAAE,KAAK,SAAS;YAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AACvD,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAiB,EAAE,QAAgB;IAClE,IAAI,CAAC,IAAA,8BAAkB,EAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzF,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;IACjJ,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,+BAA+B,CAAC,CAAC;QACtH,IAAI,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,EAAE,kCAAkC,CAAC,CAAC;IAClK,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAAe;IACzD,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAmC;IACzE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,EAAE,2EAA2E,CAAC,CAAC;IAC/I,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,MAAM,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,+CAA+C,CAAC,CAAC;QAC3J,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI;oBAAE,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,oDAAoD,CAAC,CAAC;gBACrJ,IAAI,MAAM,KAAK,GAAG;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACtC,WAAW,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;gBACxC,MAAM,IAAI,kBAAkB,CAAC,iCAAiC,EAAE,yCAAyC,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,KAAa,EAAE,WAAmB;IAC7E,MAAM,KAAK,GAAG,6BAA6B,WAAW,MAAM,CAAC;IAC7D,MAAM,GAAG,GAAG,2BAA2B,WAAW,MAAM,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,WAAW,GAAG,CAAC,IAAI,SAAS,IAAI,WAAW,IAAI,UAAU,GAAG,CAAC,IAAI,QAAQ,IAAI,UAAU;WACtF,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;WACtF,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,6DAA6D,CAAC,CAAC;IAC/H,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,YAAY,KAAK,WAAW,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,EAAE,kEAAkE,CAAC,CAAC;IAClI,CAAC;AACH,CAAC;AAED,SAAS,aAAa,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,iCAAwB,GAAE,EAAE,cAAc,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC;AACxI,SAAS,oBAAoB;IAC3B,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,2CAA2C,CAAC,CAAC;IAC9K,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAqB,CAAC;IAAC,CAAC;IAC3D,MAAM,CAAC;QAAC,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,+BAA+B,CAAC,CAAC;IAAC,CAAC;IAC7G,IAAI,GAAG,CAAC,aAAa,KAAK,mCAAmC,IAAI,GAAG,CAAC,YAAY,KAAK,iBAAiB;WAClG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,kCAAkC,CAAC,CAAC;IACrK,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,qCAAqC;IACnD,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;IACnC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,oBAAoB,EAAE,UAAU,IAAA,kBAAM,EAAC,GAAG,CAAC,YAAY,CAAC,EAAE;KAC3D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,iCAAiC,CAAC,UAAkB,EAAE,OAAe;IACnF,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC;SAC1D,MAAM,CAAC,6CAA6C,UAAU,KAAK,OAAO,EAAE,EAAE,MAAM,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,SAAS,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,GAAqB;IAC7D,MAAM,OAAO,GAAG,IAAA,wBAAgB,GAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAA,mBAAW,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5J,OAAO;QACL,aAAa,EAAE,kCAAkC;QACjD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,6BAA6B;QACxC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtE,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA0B,EAAE,GAAqB;IACxE,IAAI,QAAQ,CAAC,aAAa,KAAK,kCAAkC,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;WAClG,QAAQ,CAAC,SAAS,KAAK,6BAA6B;QAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,sDAAsD,CAAC,CAAC;IACjL,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC1L,MAAM,SAAS,GAAG,IAAA,mBAAW,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IACnI,IAAI,WAAW,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,aAAa;QAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,wCAAwC,CAAC,CAAC;IAC/J,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,WAAmB,EAAE,WAAoB;IAC3E,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC;QACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,CAAC;QACvE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KACzG,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAI,IAAY,EAAE,QAAQ,GAAG,IAAI,GAAG,IAAI;IAC3D,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAM,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,QAA8B,EAAE,QAAmC,EAAE,GAAS,EAAE,IAAY;IAClH,MAAM,KAAK,GAAG,QAAQ,EAAE,aAAa,KAAK,sCAA8B,IAAI,QAAQ,CAAC,IAAI,KAAK,wBAAwB;WACjH,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;WAC/G,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;WAC7G,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;WACpH,QAAQ,CAAC,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,MAAM,CAAC,eAAe;WACrE,QAAQ,CAAC,QAAQ,CAAC,cAAc,KAAK,QAAQ,CAAC,MAAM,CAAC,cAAc,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;WAC7H,QAAQ,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;WACrH,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE;WAClG,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,GAAG,UAAU,GAAG,MAAO,EAAE,CAAC;QACnE,MAAM,IAAI,kBAAkB,CAAC,gCAAgC,EAAE,kEAAkE,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YACjD,MAAM,OAAO,GAAG,YAAY,CAA2B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI;gBAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC;QACvI,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB;YAAE,MAAM,KAAK,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAiC;IACtD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACnC,MAAM,UAAU,GAAG,IAAA,uCAA4B,EAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,iBAAiB,IAAI,QAAQ,CAAC,WAAW,KAAK,cAAc,EAAE,CAAC;QAChH,MAAM,IAAI,kBAAkB,CAAC,mCAAmC,EAAE,sEAAsE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,iBAAiB,CAAC,UAAU,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;WACvG,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,EAAE,kFAAkF,CAAC,CAAC;IAClM,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/G,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI;WACnG,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,CAAC,SAAS;WAC5F,QAAQ,CAAC,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,EAAE,6DAA6D,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,0BAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,EAAE,gEAAgE,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,eAAe;QAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC/I,IAAI,QAAQ,CAAC,WAAW,KAAK,YAAY,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,WAAW,aAAa;WAC1H,OAAO,CAAC,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzF,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,EAAE,4DAA4D,CAAC,CAAC;AACnI,CAAC;AAED,SAAS,MAAM,CAAC,OAAiC;IAC/C,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,KAAK;QACrB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe,EAAE,IAAY;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,OAAO,CAAC;IACb,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,IAAI,KAAK,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,KAAsC,EAAE,OAAiC;IACvF,MAAM,OAAO,GAA6B;QACxC,GAAG,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,IAAI;QAClE,SAAS,EAAE,0BAA0B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC3E,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM;QAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE;YACzC,aAAa,EAAE,sCAAsC;YACrD,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,0BAA0B;YAChC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAAC,OAAiC;IAC/E,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACvF,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,4CAA4C,CAAC,CAAC;IAC7J,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,uCAAuC,CAAC,CAAC;IACzI,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe;QAAE,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,EAAE,0DAA0D,CAAC,CAAC;IAC7M,MAAM,UAAU,GAAG,IAAA,+CAAoC,EAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9G,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtG,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,+CAA+C,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,EAAE,2DAA2D,CAAC,CAAC;IACxL,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;QAAE,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,sBAAsB,GAAG,UAAU,IAAA,kBAAM,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,OAAO,GAA6B;QACxC,aAAa,EAAE,2CAAmC;QAClD,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;QACzC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;QACvC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU;QACrD,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY;QACvC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa;QAC3D,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS;QACnD,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC1C,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc;QACtD,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;QACvC,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;QAC7B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;QACzC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5C,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,sBAAsB;QACtB,KAAK,EAAE,UAAU;QACjB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;QACd,sBAAsB,EAAE,KAAK;KAC9B,CAAC;IACF,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;KACvD,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,cAAc,KAAK,eAAe;QAAE,MAAM,IAAI,0BAA0B,CAAC,eAAe,CAAC,CAAC;IACtG,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC/D,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU;YAAE,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,EAAE,0CAA0C,CAAC,CAAC;QACzK,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,cAAc,KAAK,oBAAoB;YAAE,MAAM,IAAI,0BAA0B,CAAC,cAAc,CAAC,CAAC;QAC1G,IAAI,OAAO,CAAC,cAAc,KAAK,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACzF,MAAM,OAAO,GAA6B,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAChH,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,0BAA0B;YAAE,MAAM,KAAK,CAAC;QAC7D,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,cAAc,KAAK,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAChG,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;YAC/D,IAAI,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,yDAAyD,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,2BAA2B,CAAC,OAAmC;IAC7E,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,CAA2B,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,aAAa,KAAK,2CAAmC,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;WAC3G,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,YAAY;WACtH,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,aAAa,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,CAAC;QAC9I,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,EAAE,8EAA8E,CAAC,CAAC;IAC1J,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,IAAI,OAAO,CAAC,KAAK,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,WAAW,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,SAAS,GAA6B,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9K,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACrC,IAAI,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC;oBAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC7E,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,WAAW,KAAK,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC5G,IAAI,OAAO,CAAC,cAAc,KAAK,kBAAkB;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,eAAe,CAAC,YAAY,CAAmB,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACzF,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;QAChE,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC1G,MAAM,SAAS,GAA6B,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3K,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,EAAE,8DAA8D,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED,SAAgB,4BAA4B,CAAC,cAAsB,EAAE,WAAmB;IACtF,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC;AACzE,CAAC"}

package/dist/lib/brain/safety.d.ts

@@ -0,0 +1,8 @@
+import { ProjectBrainScan } from "./types";
+export declare class BrainSafetyError extends Error {
+    readonly code = "brain_safety_gate_failed";
+    constructor(message: string);
+}
+/** Must run over the complete payload before any persistent path is created. */
+export declare function assertBrainPayloadSafe(scan: ProjectBrainScan, canaries?: string[]): string;
+//# sourceMappingURL=safety.d.ts.map

package/dist/lib/brain/safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../../src/lib/brain/safety.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,8BAA8B;gBAC/B,OAAO,EAAE,MAAM;CAC5B;AAeD,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,gBAAgB,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,MAAM,CAQ9F"}