@0xrama/bnpm 0.0.1

package/dist/src/resolver/source-provider.js

@@ -0,0 +1,336 @@
+import npa from "npm-package-arg";
+import semver from "semver";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
+import { extractPackageArchive } from "../cache/archive.js";
+import { downloadUnverifiedToQuarantine } from "../cache/quarantine.js";
+import { parseManifest } from "../project/manifest.js";
+import { ResolutionError } from "./registry-resolver.js";
+import { packPackage } from "../package/pack.js";
+async function defaultRunGit(args, cwd, signal) {
+    const child = spawn("git", ["-c", "core.hooksPath=/dev/null", "-c", "protocol.file.allow=never", ...args], {
+        cwd,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0", GIT_SSH_COMMAND: "ssh -o BatchMode=yes" },
+    });
+    const stdout = [];
+    let bytes = 0;
+    let exceeded = false;
+    const consume = (chunk, keep) => {
+        bytes += chunk.length;
+        if (bytes > 1024 * 1024) {
+            exceeded = true;
+            child.kill("SIGTERM");
+            return;
+        }
+        if (keep)
+            stdout.push(Buffer.from(chunk));
+    };
+    child.stdout.on("data", (chunk) => consume(chunk, true));
+    child.stderr.on("data", (chunk) => consume(chunk, false));
+    const abort = () => { child.kill("SIGTERM"); };
+    signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(() => child.kill("SIGTERM"), 2 * 60_000);
+    timer.unref();
+    try {
+        const result = await new Promise((resolvePromise, reject) => {
+            child.once("error", reject);
+            child.once("close", (code, closedSignal) => resolvePromise({ code, signal: closedSignal }));
+        });
+        if (signal?.aborted)
+            throw signal.reason;
+        if (exceeded)
+            throw new ResolutionError("git produced more than 1 MiB of output");
+        if (result.code !== 0)
+            throw new ResolutionError(`git ${args[0] ?? "command"} failed (${result.code ?? result.signal})`);
+        return Buffer.concat(stdout).toString("utf8").trim();
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", abort);
+    }
+}
+function gitTagForRange(output, range) {
+    const validRange = semver.validRange(range);
+    if (!validRange)
+        throw new ResolutionError(`invalid git semver range ${range}`);
+    const tags = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const match = /^[a-f0-9]{40}\s+refs\/tags\/(.+?)(?:\^\{\})?$/i.exec(line.trim());
+        const tag = match?.[1];
+        if (!tag)
+            continue;
+        const version = semver.valid(tag);
+        if (version && semver.satisfies(version, validRange))
+            tags.set(tag, version);
+    }
+    const selected = [...tags].sort(([leftTag, leftVersion], [rightTag, rightVersion]) => semver.rcompare(leftVersion, rightVersion) || leftTag.localeCompare(rightTag))[0];
+    if (!selected)
+        throw new ResolutionError(`no git tag satisfies ${range}`);
+    return `refs/tags/${selected[0]}`;
+}
+function safeGitSubdir(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!normalized || normalized.includes("\\") || normalized.split("/").some((part) => !part || part === "." || part === "..") || !/^[A-Za-z0-9._/-]+$/.test(normalized)) {
+        throw new ResolutionError("git package subdirectory is unsafe");
+    }
+    return normalized;
+}
+function gitBuildRequired(manifest) {
+    const scripts = manifest.scripts;
+    const hasBuildScript = typeof scripts === "object" && scripts !== null && !Array.isArray(scripts) && ["preinstall", "install", "postinstall", "prepare"].some((stage) => typeof scripts[stage] === "string");
+    const bundles = manifest.bundleDependencies ?? manifest.bundledDependencies;
+    return hasBuildScript || manifest.workspaces !== undefined || bundles === true || (Array.isArray(bundles) && bundles.length > 0);
+}
+async function gitModules(directory, repository, runGit, signal) {
+    try {
+        if (!(await stat(join(directory, ".gitmodules"))).isFile())
+            return [];
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    const output = await runGit(["config", "--file", ".gitmodules", "--get-regexp", "^submodule\\..*\\.url$"], directory, signal);
+    const names = [];
+    for (const line of output.split(/\r?\n/).filter(Boolean)) {
+        const match = /^submodule\.(.+)\.url\s+(.+)$/.exec(line.trim());
+        if (!match?.[1] || !match[2] || !/^[A-Za-z0-9._/-]+$/.test(match[1]))
+            throw new ResolutionError("git submodule configuration is malformed");
+        const raw = match[2];
+        let url;
+        try {
+            if (raw.startsWith("./") || raw.startsWith("../"))
+                url = new URL(raw, `${repository.href.replace(/\/+$/, "")}/`);
+            else
+                url = new URL(raw);
+        }
+        catch {
+            throw new ResolutionError(`git submodule ${match[1]} has an invalid URL`);
+        }
+        if (!secureGitUrl(url))
+            throw new ResolutionError(`git submodule ${match[1]} must use HTTPS or SSH without embedded passwords`);
+        names.push(match[1]);
+    }
+    if (names.length === 0)
+        throw new ResolutionError(".gitmodules does not declare any valid submodule URLs");
+    return names.sort((left, right) => left.localeCompare(right));
+}
+async function findGitModuleRoots(root) {
+    const found = [];
+    let directories = 0;
+    const walk = async (directory) => {
+        directories += 1;
+        if (directories > 20_000)
+            throw new ResolutionError("git submodule scan exceeds 20,000 directories");
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            if (entry.name === ".git" || entry.name === "node_modules")
+                continue;
+            if (entry.isFile() && entry.name === ".gitmodules")
+                found.push(directory);
+            else if (entry.isDirectory())
+                await walk(join(directory, entry.name));
+        }
+    };
+    await walk(root);
+    return found.sort((left, right) => left.localeCompare(right));
+}
+async function initializeSubmodules(checkout, repository, runGit, signal) {
+    const names = await gitModules(checkout, repository, runGit, signal);
+    if (names.length === 0)
+        return;
+    const overrides = names.flatMap((name) => ["-c", `submodule.${name}.update=checkout`]);
+    await runGit([...overrides, "submodule", "update", "--init", "--depth=1"], checkout, signal);
+    for (const directory of await findGitModuleRoots(checkout)) {
+        if (directory === checkout)
+            continue;
+        const originValue = await runGit(["remote", "get-url", "origin"], directory, signal);
+        const origin = new URL(originValue);
+        if (!secureGitUrl(origin))
+            throw new ResolutionError("nested git submodule origin must use HTTPS or SSH without embedded passwords");
+        await gitModules(directory, origin, runGit, signal);
+    }
+    await runGit([...overrides, "submodule", "update", "--init", "--recursive", "--depth=1"], checkout, signal);
+}
+function gitRepository(parsed) {
+    const hosted = parsed.hosted;
+    const value = typeof parsed.fetchSpec === "string" ? parsed.fetchSpec : hosted?.https({ noCommittish: true, noGitPlus: true });
+    let url;
+    try {
+        url = new URL(value ?? "");
+    }
+    catch {
+        throw new ResolutionError("git dependency does not provide a valid HTTPS repository URL");
+    }
+    if (!secureGitUrl(url))
+        throw new ResolutionError("git dependencies must use HTTPS or SSH without embedded passwords, query, or fragment");
+    return url;
+}
+function secureGitUrl(url) {
+    return (url.protocol === "https:" || url.protocol === "ssh:") && !url.password && !url.search && !url.hash && (url.protocol === "ssh:" || !url.username);
+}
+export class RemoteSourceProvider {
+    options;
+    #pending = new Map();
+    #temporaryDirectories = new Set();
+    constructor(options) {
+        this.options = options;
+    }
+    async resolve(name, specifier, fromDirectory, signal) {
+        let parsed;
+        try {
+            parsed = npa.resolve(name, specifier, fromDirectory);
+        }
+        catch {
+            return undefined;
+        }
+        if (parsed.type !== "remote" && parsed.type !== "git" && parsed.type !== "file")
+            return undefined;
+        if (parsed.type === "file") {
+            const path = typeof parsed.fetchSpec === "string" ? parsed.fetchSpec : "";
+            const canonical = resolve(path);
+            const key = pathToFileURL(canonical).href;
+            let pending = this.#pending.get(key);
+            if (!pending) {
+                pending = this.#materializeLocalArchive(name, canonical);
+                this.#pending.set(key, pending);
+            }
+            try {
+                return await pending;
+            }
+            catch (error) {
+                this.#pending.delete(key);
+                throw error;
+            }
+        }
+        const url = parsed.type === "remote" ? new URL(parsed.fetchSpec) : gitRepository(parsed);
+        if (parsed.type === "remote" && (url.protocol !== "https:" || url.username || url.password || url.hash))
+            throw new ResolutionError(`remote tarball for ${name} must be an HTTPS URL without credentials or fragment`);
+        const gitSubdir = safeGitSubdir(parsed.gitSubdir);
+        const key = parsed.type === "git" ? `${url.href}#${parsed.gitRange === undefined ? parsed.gitCommittish ?? "HEAD" : `semver:${parsed.gitRange}`}:${gitSubdir ?? ""}` : url.href;
+        let pending = this.#pending.get(key);
+        if (!pending) {
+            pending = parsed.type === "git" ? this.#materializeGit(name, url, parsed.gitCommittish ?? "HEAD", parsed.gitRange ?? undefined, gitSubdir, signal) : this.#materialize(name, url, signal);
+            this.#pending.set(key, pending);
+        }
+        try {
+            return await pending;
+        }
+        catch (error) {
+            this.#pending.delete(key);
+            throw error;
+        }
+    }
+    async #materializeLocalArchive(requestedName, archive) {
+        const info = await stat(archive);
+        if (!info.isFile() || info.size > 512 * 1024 * 1024)
+            throw new ResolutionError(`local package archive for ${requestedName} is invalid or exceeds 512 MiB`);
+        const bytes = await readFile(archive);
+        const integrity = `sha512-${createHash("sha512").update(bytes).digest("base64")}`;
+        await mkdir(this.options.quarantineRoot, { recursive: true, mode: 0o700 });
+        const directory = await mkdtemp(join(this.options.quarantineRoot, "file-"));
+        const extractedPath = join(directory, "extracted");
+        try {
+            const extracted = await extractPackageArchive(archive, extractedPath);
+            const manifestPath = join(extracted.path, "package.json");
+            const raw = JSON.parse(await readFile(manifestPath, "utf8"));
+            parseManifest(JSON.stringify(raw), manifestPath);
+            if (typeof raw.name !== "string" || typeof raw.version !== "string" || !semver.valid(raw.version))
+                throw new ResolutionError(`local package archive ${archive} requires a valid package name and semantic version`);
+            this.#temporaryDirectories.add(directory);
+            return { actualName: raw.name, version: raw.version, manifest: { ...raw, dist: { integrity, tarball: pathToFileURL(archive).href } }, integrity, tarball: pathToFileURL(archive), preparedPath: extracted.path, source: "tarball" };
+        }
+        catch (error) {
+            await rm(directory, { recursive: true, force: true });
+            throw error;
+        }
+    }
+    async cleanup() {
+        const paths = [...this.#temporaryDirectories];
+        this.#temporaryDirectories.clear();
+        await Promise.all(paths.map((path) => rm(path, { recursive: true, force: true })));
+    }
+    async #materialize(requestedName, url, signal) {
+        const quarantined = await downloadUnverifiedToQuarantine(url, {
+            root: this.options.quarantineRoot,
+            ...(this.options.fetch === undefined ? {} : { fetch: this.options.fetch }),
+            headers: (target) => this.options.registryConfiguration.headersFor(target),
+            ...(signal === undefined ? {} : { signal }),
+        });
+        const directory = dirname(quarantined.path);
+        const extractedPath = join(directory, "extracted");
+        try {
+            const extracted = await extractPackageArchive(quarantined.path, extractedPath);
+            const manifestPath = join(extracted.path, "package.json");
+            const bytes = await readFile(manifestPath, "utf8");
+            parseManifest(bytes, manifestPath);
+            const raw = JSON.parse(bytes);
+            if (typeof raw.name !== "string" || typeof raw.version !== "string" || !semver.valid(raw.version)) {
+                throw new ResolutionError(`remote tarball ${url.href} requires a valid package name and semantic version`);
+            }
+            const manifest = { ...raw, dist: { integrity: quarantined.integrity, tarball: url.href } };
+            this.#temporaryDirectories.add(directory);
+            return {
+                actualName: raw.name,
+                version: raw.version,
+                manifest,
+                integrity: quarantined.integrity,
+                tarball: url,
+                preparedPath: extracted.path,
+                source: "tarball",
+            };
+        }
+        catch (error) {
+            await rm(directory, { recursive: true, force: true });
+            throw error;
+        }
+    }
+    async #materializeGit(requestedName, repository, ref, range, subdir, signal) {
+        await mkdir(this.options.quarantineRoot, { recursive: true });
+        const directory = await mkdtemp(join(this.options.quarantineRoot, "git-"));
+        const checkout = join(directory, "checkout");
+        await mkdir(checkout);
+        const runGit = this.options.runGit ?? defaultRunGit;
+        try {
+            await runGit(["init", "--quiet"], checkout, signal);
+            await runGit(["remote", "add", "origin", repository.href], checkout, signal);
+            const selectedRef = range === undefined ? ref : gitTagForRange(await runGit(["ls-remote", "--tags", "origin"], checkout, signal), range);
+            await runGit(["fetch", "--quiet", "--depth=1", "--filter=blob:none", "origin", selectedRef], checkout, signal);
+            await runGit(["checkout", "--quiet", "--detach", "FETCH_HEAD"], checkout, signal);
+            await initializeSubmodules(checkout, repository, runGit, signal);
+            const commit = await runGit(["rev-parse", "--verify", "HEAD"], checkout, signal);
+            if (!/^[a-f0-9]{40}$/i.test(commit))
+                throw new ResolutionError("git did not resolve an exact commit");
+            const packageRoot = subdir === undefined ? checkout : resolve(checkout, ...subdir.split("/"));
+            if (packageRoot !== checkout && !packageRoot.startsWith(`${checkout}${sep}`))
+                throw new ResolutionError("git package subdirectory escapes the checkout");
+            const sourceManifest = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8"));
+            if (gitBuildRequired(sourceManifest)) {
+                if (!this.options.prepareGit)
+                    throw new ResolutionError("git package requires a build but no approved build workflow is available");
+                await this.options.prepareGit(packageRoot, sourceManifest, signal);
+            }
+            const artifact = await packPackage(packageRoot);
+            const tarballPath = join(directory, "package.tgz");
+            await writeFile(tarballPath, artifact.tarball, { flag: "wx", mode: 0o600 });
+            const extracted = await extractPackageArchive(tarballPath, join(directory, "extracted"));
+            await rm(checkout, { recursive: true, force: true });
+            const exactUrl = new URL(`git+${repository.href}#${commit}${subdir === undefined ? "" : `::path:${subdir}`}`);
+            const manifest = { ...artifact.manifest, name: artifact.name, version: artifact.version, dist: { integrity: artifact.integrity, tarball: exactUrl.href } };
+            this.#temporaryDirectories.add(directory);
+            return { actualName: artifact.name, version: artifact.version, manifest, integrity: artifact.integrity, tarball: exactUrl, preparedPath: extracted.path, source: "git" };
+        }
+        catch (error) {
+            await rm(directory, { recursive: true, force: true });
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=source-provider.js.map

package/dist/src/resolver/source-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-provider.js","sourceRoot":"","sources":["../../../src/resolver/source-provider.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,iBAAiB,CAAC;AAClC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGvD,OAAO,EAAE,eAAe,EAAkD,MAAM,wBAAwB,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAYjD,KAAK,UAAU,aAAa,CAAC,IAAuB,EAAE,GAAW,EAAE,MAAoB;IACrF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,2BAA2B,EAAE,GAAG,IAAI,CAAC,EAAE;QACzG,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,IAAI;QACjB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,eAAe,EAAE,sBAAsB,EAAE;KACpH,CAAC,CAAC;IACH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAa,EAAQ,EAAE;QACrD,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5E,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;IAClE,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAyD,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;YAClH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC;QACzC,IAAI,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,wCAAwC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,YAAY,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACzH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,KAAa;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxK,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC1E,OAAO,aAAa,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACvK,MAAM,IAAI,eAAe,CAAC,oCAAoC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA2C;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,cAAc,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAQ,OAAmC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC1O,MAAM,OAAO,GAAG,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,mBAAmB,CAAC;IAC5E,OAAO,cAAc,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnI,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,UAAe,EAAE,MAAuF,EAAE,MAAoB;IACzK,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,CAAC;IAAC,CAAC;IAC9E,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,cAAc,EAAE,wBAAwB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;QAC5I,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;;gBAC5G,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,IAAI,eAAe,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAAC,CAAC;QACtF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC;QAChI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,uDAAuD,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,EAAE,SAAiB,EAAiB,EAAE;QACtD,WAAW,IAAI,CAAC,CAAC;QACjB,IAAI,WAAW,GAAG,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,+CAA+C,CAAC,CAAC;QACrG,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YACrE,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;iBACrE,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,UAAe,EAAE,MAAuF,EAAE,MAAoB;IAClL,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,IAAI,kBAAkB,CAAC,CAAC,CAAC;IACvF,MAAM,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7F,KAAK,MAAM,SAAS,IAAI,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,IAAI,SAAS,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,8EAA8E,CAAC,CAAC;QACrI,MAAM,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,aAAa,CAAC,MAAkB;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAkG,CAAC;IACzH,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/H,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,8DAA8D,CAAC,CAAC;IAAC,CAAC;IACxI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,uFAAuF,CAAC,CAAC;IAC3I,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ;IAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3J,CAAC;AAED,MAAM,OAAO,oBAAoB;IAGV,OAAO;IAFnB,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IACrD,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IACnD,YAAqB,OAAoC;uBAApC,OAAO;IAAgC,CAAC;IAE7D,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAAiB,EAAE,aAAqB,EAAE,MAAoB;QACxF,IAAI,MAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,SAAS,CAAC;QAAC,CAAC;QACzF,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAClG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;YACtJ,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAAC,CAAC;YAClJ,IAAI,CAAC;gBAAC,OAAO,MAAM,OAAO,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACnG,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,sBAAsB,IAAI,uDAAuD,CAAC,CAAC;QACtN,MAAM,SAAS,GAAG,aAAa,CAAE,MAAuD,CAAC,SAAS,CAAC,CAAC;QACpG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,QAAQ,EAAE,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAChL,IAAI,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1L,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAC;QAAC,CAAC;QAC7B,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,wBAAwB,CAAC,aAAqB,EAAE,OAAe;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,6BAA6B,aAAa,gCAAgC,CAAC,CAAC;QAC7L,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,MAAM,SAAS,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAChI,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAAC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAA2B,CAAC;YACzN,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;YACjD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,yBAAyB,OAAO,qDAAqD,CAAC,CAAC;YACpN,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACtO,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC9C,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,aAAqB,EAAE,GAAQ,EAAE,MAAoB;QACtE,MAAM,WAAW,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE;YAC5D,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;YACjC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1E,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1E,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACnD,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA2B,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClG,MAAM,IAAI,eAAe,CAAC,kBAAkB,GAAG,CAAC,IAAI,qDAAqD,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,QAAQ,GAA2B,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACnH,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO;gBACL,UAAU,EAAE,GAAG,CAAC,IAAI;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,QAAQ;gBACR,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,OAAO,EAAE,GAAG;gBACZ,YAAY,EAAE,SAAS,CAAC,IAAI;gBAC5B,MAAM,EAAE,SAAS;aAClB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,aAAqB,EAAE,UAAe,EAAE,GAAW,EAAE,KAAyB,EAAE,MAA0B,EAAE,MAAoB;QACpJ,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7E,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YACzI,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC/G,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAClF,MAAM,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjF,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;YACtG,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9F,IAAI,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,+CAA+C,CAAC,CAAC;YACzJ,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAsC,CAAC;YAClI,IAAI,gBAAgB,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;oBAAE,MAAM,IAAI,eAAe,CAAC,0EAA0E,CAAC,CAAC;gBACpI,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACnD,MAAM,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACzF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,UAAU,CAAC,IAAI,IAAI,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9G,MAAM,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAuC,CAAC;YAChM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3K,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/src/resolver/types.d.ts

@@ -0,0 +1,28 @@
+import type { PackageVersionManifest } from "../registry/types.js";
+export interface Requirement {
+    name: string;
+    specifier: string;
+    kind: "dependency" | "dev" | "optional" | "peer" | "workspace";
+    importer?: string;
+}
+export interface ResolvedPackage {
+    id: string;
+    name: string;
+    version: string;
+    integrity: string;
+    tarball: URL;
+    localPath?: string;
+    preparedPath?: string;
+    source?: "registry" | "directory" | "tarball" | "git";
+    publishedAt?: Date;
+    manifest: PackageVersionManifest;
+    dependencies: ReadonlyMap<string, string>;
+}
+export interface ResolutionGraph {
+    roots: ReadonlyMap<string, string>;
+    packages: ReadonlyMap<string, ResolvedPackage>;
+    importers?: ReadonlyMap<string, ReadonlyMap<string, string>>;
+}
+export interface Resolver {
+    resolve(requirements: readonly Requirement[], signal?: AbortSignal): Promise<ResolutionGraph>;
+}

package/dist/src/resolver/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/resolver/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/resolver/types.ts"],"names":[],"mappings":""}

package/dist/src/security/analyzer.d.ts

@@ -0,0 +1,38 @@
+import type { PackageAnalysis } from "./findings.js";
+export declare const lifecycleStages: readonly ["preinstall", "install", "postinstall"];
+export declare const gitBuildStages: readonly ["preinstall", "install", "postinstall", "prepare"];
+export type LifecycleStage = (typeof gitBuildStages)[number] | "prepack" | "postpack" | "prepublishOnly" | "publish" | "postpublish";
+export interface LifecycleFact {
+    readonly packageName: string;
+    readonly packageVersion: string;
+    readonly integrity: string;
+    readonly stage: LifecycleStage;
+    readonly command: string;
+    readonly commandHash: string;
+    readonly contentHash: string;
+    readonly referencedFiles: readonly string[];
+}
+export interface AnalyzedPackage {
+    readonly analysis: PackageAnalysis;
+    readonly lifecycles: readonly LifecycleFact[];
+    readonly capabilities?: readonly ExecutionCapability[];
+}
+export type ExecutionCapabilityKind = "ai-history-read" | "credential-read" | "network-access" | "local-write" | "process-spawn" | "native-code";
+export interface ExecutionCapability {
+    readonly kind: ExecutionCapabilityKind;
+    readonly severity: "notice" | "warning";
+    readonly packageName: string;
+    readonly packageVersion: string;
+    readonly behavior: string;
+    readonly evidence: readonly string[];
+}
+export declare function analyzePackage(options: {
+    readonly root: string;
+    readonly packageName: string;
+    readonly packageVersion: string;
+    readonly integrity: string;
+    readonly scripts?: Readonly<Record<string, string>>;
+    readonly stages?: readonly LifecycleStage[];
+    readonly maxFiles?: number;
+    readonly maxBytes?: number;
+}): Promise<AnalyzedPackage>;