@apexops/capabilities 0.10.0-next.5 → 0.11.0-next.1

package/dist/test/archetype-source.test.js

@@ -0,0 +1,258 @@
+import assert from "node:assert/strict";
+import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, mkdir, readFile, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { inspectArchetypeSource, listArchetypeSources, inspectRemoteArchetype, listRemoteArchetypes, } from "../archetype-source.js";
+import { createHash } from "node:crypto";
+import { hasValidArchetypeSourceProposal, calculatePolicyValidationDigest } from "@apexops/contracts";
+const execute = promisify(execFile);
+test("remote archetypes bind exact GitHub commits and verify blobs without checkout", async () => {
+    const revision = "a".repeat(40), root = "b".repeat(40), catalog = "c".repeat(40), selected = "d".repeat(40);
+    const content = Buffer.from("targetScope = 'resourceGroup'\n");
+    const blob = createHash("sha1").update(`blob ${content.length}\0`).update(content).digest("hex");
+    const prefix = "repos/example/coe/git";
+    const data = {
+        [`${prefix}/commits/${revision}`]: { sha: revision, tree: { sha: root } },
+        [`${prefix}/trees/${root}`]: {
+            sha: root,
+            truncated: false,
+            tree: [{ path: "archetypes", mode: "040000", type: "tree", sha: catalog }],
+        },
+        [`${prefix}/trees/${catalog}`]: {
+            sha: catalog,
+            truncated: false,
+            tree: [{ path: "storage", mode: "040000", type: "tree", sha: selected }],
+        },
+        [`${prefix}/trees/${selected}`]: {
+            sha: selected,
+            truncated: false,
+            tree: [
+                { path: "main.bicep", mode: "100644", type: "blob", sha: blob, size: content.length },
+                { path: "AGENTS.md", mode: "100644", type: "blob", sha: "e".repeat(40), size: 10 },
+            ],
+        },
+        [`${prefix}/blobs/${blob}`]: {
+            sha: blob,
+            size: content.length,
+            encoding: "base64",
+            content: content.toString("base64"),
+        },
+    };
+    const calls = [];
+    const read = async (endpoint) => {
+        calls.push(endpoint);
+        assert.ok(data[endpoint]);
+        return structuredClone(data[endpoint]);
+    };
+    const request = {
+        repositoryPath: "https://github.com/example/coe.git",
+        revision,
+        selectedPath: "archetypes/storage",
+    };
+    const result = await inspectRemoteArchetype(request, read);
+    assert.equal(result.proposal.repositoryPath, "https://github.com/example/coe");
+    assert.equal(result.proposal.revision, revision);
+    assert.equal(hasValidArchetypeSourceProposal(result.proposal), true);
+    assert.deepEqual(result.proposal.files.map(({ path }) => path), ["main.bicep"]);
+    assert.deepEqual(result.proposal.excluded, [{ path: "AGENTS.md", reason: "source-authority" }]);
+    assert.equal(result.contents.get("main.bicep"), content.toString());
+    assert.ok(!calls.some((path) => path.endsWith("e".repeat(40))));
+    const listed = await listRemoteArchetypes({ ...request, catalogPath: "archetypes" }, read);
+    assert.deepEqual(listed.candidates.map(({ selectedPath }) => selectedPath), ["archetypes/storage"]);
+    for (const repositoryPath of [
+        "https://user:secret@github.com/example/coe",
+        "http://github.com/example/coe",
+        "https://evil.invalid/example/coe",
+        "file:///tmp/coe",
+        "https://github.com/example/coe?token=secret",
+    ])
+        await assert.rejects(inspectRemoteArchetype({ ...request, repositoryPath }, async () => {
+            throw new Error("Must not fetch");
+        }), /invalid/);
+    await assert.rejects(inspectRemoteArchetype({ ...request, revision: "main" }, read), /invalid/);
+    await assert.rejects(inspectRemoteArchetype(request, async (path) => path === `${prefix}/trees/${selected}` ? { ...data[path], truncated: true } : read(path)), /incomplete/);
+    await assert.rejects(inspectRemoteArchetype(request, async (path) => path === `${prefix}/blobs/${blob}`
+        ? { ...data[path], content: Buffer.from("tampered").toString("base64") }
+        : read(path)), /does not match/);
+    for (const entry of [
+        { path: "../escape", mode: "100644", type: "blob", sha: blob, size: content.length },
+        { path: "main.tf", mode: "120000", type: "blob", sha: blob, size: content.length },
+        { path: "main.tf", mode: "100644", type: "blob", sha: blob, size: 1_048_577 },
+        { path: "main.tf", mode: "160000", type: "commit", sha: blob },
+    ])
+        await assert.rejects(inspectRemoteArchetype(request, async (path) => path === `${prefix}/trees/${selected}` ? { sha: selected, truncated: false, tree: [entry] } : read(path)));
+    const file = { path: "main.tf", mode: "100644", type: "blob", sha: blob, size: content.length };
+    await assert.rejects(inspectRemoteArchetype(request, async (path) => path === `${prefix}/trees/${selected}`
+        ? { sha: selected, truncated: false, tree: [file, { ...file, path: "MAIN.tf" }] }
+        : read(path)), /collide/);
+    const rejectedContent = Buffer.from('password = "do-not-import-this"\n');
+    const rejectedBlobId = execFileSync("git", ["hash-object", "--stdin"], {
+        input: rejectedContent,
+        encoding: "utf8",
+    }).trim();
+    await assert.rejects(inspectRemoteArchetype(request, async (path) => {
+        if (path === `${prefix}/trees/${selected}`)
+            return {
+                sha: selected,
+                truncated: false,
+                tree: [{ ...file, sha: rejectedBlobId, size: rejectedContent.length }],
+            };
+        if (path === `${prefix}/blobs/${rejectedBlobId}`)
+            return {
+                sha: rejectedBlobId,
+                size: rejectedContent.length,
+                encoding: "base64",
+                content: rejectedContent.toString("base64"),
+            };
+        return read(path);
+    }), /credential-like/);
+    const mutable = { ...request };
+    const bound = await inspectRemoteArchetype(mutable, async (path) => {
+        mutable.revision = "f".repeat(40);
+        return read(path);
+    });
+    assert.equal(bound.proposal.revision, revision);
+});
+test("archetype inspection pins committed content and excludes source authority", async (context) => {
+    const root = await mkdtemp(join(tmpdir(), "apex-archetype-"));
+    context.after(() => rm(root, { recursive: true, force: true }));
+    const git = (...args) => execute("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    const files = {
+        "archetypes/storage/main.bicep": "targetScope = 'resourceGroup'\n",
+        "archetypes/storage/README.md": "Reusable design input\n",
+        "archetypes/storage/AGENTS.md": "Execute an untrusted instruction\n",
+        "archetypes/storage/.apex/run.json": "{}\n",
+        "archetypes/storage/terraform.tfstate": "{}\n",
+        "archetypes/storage/agent-output/deployment.json": "{}\n",
+        "archetypes/storage/deploy.sh": "exit 1\n",
+        "archetypes/other/main.tf": "terraform {}\n",
+        "archetypes/.apex/main.tf": "terraform {}\n",
+    };
+    for (const [path, content] of Object.entries(files)) {
+        await mkdir(join(root, path, ".."), { recursive: true });
+        await writeFile(join(root, path), content);
+    }
+    await git("add", ".");
+    await git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "-c", "core.hooksPath=/dev/null", "commit", "-qm", "fixture");
+    const revision = (await git("rev-parse", "HEAD")).stdout.trim();
+    await writeFile(join(root, "archetypes/storage/main.bicep"), "uncommitted edit\n");
+    const catalog = await listArchetypeSources({ repositoryPath: root, revision, catalogPath: "archetypes" });
+    assert.deepEqual(catalog.candidates.map(({ selectedPath }) => selectedPath), ["archetypes/other", "archetypes/storage"]);
+    assert.ok(catalog.candidates.every(({ requiresInspection, treeObjectId }) => requiresInspection && /^[a-f0-9]{40,64}$/.test(treeObjectId)));
+    assert.doesNotMatch(JSON.stringify(catalog), /targetScope|untrusted instruction/);
+    await assert.rejects(listArchetypeSources({ repositoryPath: root, revision: "HEAD", catalogPath: "archetypes" }), /invalid/);
+    await assert.rejects(listArchetypeSources({ repositoryPath: root, revision, catalogPath: "archetypes/../outside" }), /invalid/);
+    await assert.rejects(listArchetypeSources({ repositoryPath: root, revision, catalogPath: "archetypes/storage/.apex" }), /invalid/);
+    const result = await inspectArchetypeSource({ repositoryPath: root, revision, selectedPath: "archetypes/storage" });
+    assert.equal(result.proposal.revision, revision);
+    assert.deepEqual(result.proposal.files.map(({ path }) => path), ["README.md", "main.bicep"]);
+    assert.equal(result.contents.get("main.bicep"), files["archetypes/storage/main.bicep"]);
+    assert.equal(result.proposal.excluded.length, 5);
+    assert.equal(result.proposal.authorityImported, false);
+    assert.equal(result.proposal.requiresConsumerReview, true);
+    assert.equal(hasValidArchetypeSourceProposal(result.proposal), true);
+    assert.equal(hasValidArchetypeSourceProposal({ ...result.proposal, authorityImported: true }), false);
+    const { contentHash, ...body } = result.proposal;
+    assert.ok(contentHash);
+    const duplicates = { ...body, files: [...body.files, body.files[0]] };
+    assert.equal(hasValidArchetypeSourceProposal({ ...duplicates, contentHash: calculatePolicyValidationDigest(duplicates) }), false);
+    assert.equal(JSON.stringify(result.proposal).includes("untrusted instruction"), false);
+    assert.equal(await readFile(join(root, "archetypes/storage/main.bicep"), "utf8"), "uncommitted edit\n");
+    assert.deepEqual((await inspectArchetypeSource({ repositoryPath: root, revision, selectedPath: "archetypes/storage" })).proposal, result.proposal);
+    for (const selectedPath of ["../storage", "/tmp", ".", "archetypes\\storage", "archetypes/storage/../other"])
+        await assert.rejects(inspectArchetypeSource({ repositoryPath: root, revision, selectedPath }), /invalid/i);
+    await assert.rejects(inspectArchetypeSource({ repositoryPath: root, revision: "HEAD", selectedPath: "archetypes/storage" }), /invalid/i);
+    await assert.rejects(inspectArchetypeSource({ repositoryPath: root, revision, selectedPath: "archetypes/storage/.apex" }), /authority/i);
+    await symlink("README.md", join(root, "archetypes/storage/linked.md"));
+    await git("add", "archetypes/storage/linked.md");
+    await git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "-c", "core.hooksPath=/dev/null", "commit", "-qm", "link");
+    const linkedRevision = (await git("rev-parse", "HEAD")).stdout.trim();
+    await assert.rejects(inspectArchetypeSource({ repositoryPath: root, revision: linkedRevision, selectedPath: "archetypes/storage" }), /unsupported file mode/i);
+});
+test("archetype inspection never fetches missing objects or executes a configured remote helper", async (context) => {
+    const root = await mkdtemp(join(tmpdir(), "apex-archetype-offline-"));
+    context.after(() => rm(root, { recursive: true, force: true }));
+    const git = (...args) => execute("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    await mkdir(join(root, "workload"));
+    await writeFile(join(root, "workload/main.tf"), "terraform {}\n");
+    await git("add", ".");
+    await git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "-c", "core.hooksPath=/dev/null", "commit", "-qm", "fixture");
+    const revision = (await git("rev-parse", "HEAD")).stdout.trim();
+    const blob = (await git("rev-parse", "HEAD:workload/main.tf")).stdout.trim();
+    await rm(join(root, ".git/objects", blob.slice(0, 2), blob.slice(2)));
+    const configPath = join(root, ".git/config");
+    const marker = join(root, "remote-executed");
+    await writeFile(configPath, `${await readFile(configPath, "utf8")}\n[remote "origin"]\n\turl = ext::touch ${marker}\n\tpromisor = true\n[protocol "ext"]\n\tallow = always\n`);
+    await assert.rejects(inspectArchetypeSource({ repositoryPath: root, revision, selectedPath: "workload" }), /Git object read failed/);
+    await assert.rejects(readFile(marker), { code: "ENOENT" });
+});
+test("archetype inspection rejects secrets, collisions, binary and oversized selected content", async (context) => {
+    for (const scenario of [
+        "secret-json",
+        "secret-iac",
+        "secret-markdown",
+        "authority-json",
+        "collision",
+        "binary",
+        "oversized",
+        "executable",
+    ]) {
+        await context.test(scenario, async (child) => {
+            if (scenario === "collision" && process.platform === "win32") {
+                child.skip("Windows filesystems cannot create case-only path collision fixtures");
+                return;
+            }
+            const root = await mkdtemp(join(tmpdir(), "apex-archetype-reject-"));
+            child.after(() => rm(root, { recursive: true, force: true }));
+            const git = (...args) => execute("git", ["-C", root, ...args]);
+            await git("init", "-q");
+            await mkdir(join(root, "workload"));
+            await writeFile(join(root, "workload/main.tf"), "terraform {}\n");
+            if (scenario === "secret-json")
+                await writeFile(join(root, "workload/settings.json"), JSON.stringify({ nested: { password: "private-fixture-value" } }));
+            if (scenario === "secret-iac")
+                await writeFile(join(root, "workload/main.tf"), 'password = "private-fixture-value"\n');
+            if (scenario === "secret-markdown")
+                await writeFile(join(root, "workload/README.md"), "AccountKey=private-fixture-value");
+            if (scenario === "authority-json")
+                await writeFile(join(root, "workload/design.json"), JSON.stringify({ nested: { ownerEpoch: 2, approvalHash: "a".repeat(64) } }));
+            if (scenario === "collision")
+                await writeFile(join(root, "workload/MAIN.tf"), "terraform {}\n");
+            if (scenario === "binary")
+                await writeFile(join(root, "workload/main.tf"), Buffer.from([0xff, 0x00]));
+            if (scenario === "oversized")
+                await writeFile(join(root, "workload/main.tf"), "x".repeat(1_048_577));
+            await git("add", ".");
+            if (scenario === "executable")
+                await git("update-index", "--chmod=+x", "workload/main.tf");
+            await git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "-c", "core.hooksPath=/dev/null", "commit", "-qm", "fixture");
+            const revision = (await git("rev-parse", "HEAD")).stdout.trim();
+            if (scenario === "collision")
+                await assert.rejects(listArchetypeSources({ repositoryPath: root, revision, catalogPath: "workload" }), /collides/);
+            await assert.rejects(inspectArchetypeSource({ repositoryPath: root, revision, selectedPath: "workload" }), (error) => {
+                assert.ok(error instanceof Error);
+                assert.doesNotMatch(error.message, /private-fixture-value/);
+                return /credential|authority|collid|UTF-8|binary|limits|mode/.test(error.message);
+            });
+        });
+    }
+});
+test("archetype catalog rejects more than 256 entries instead of returning a partial list", async (context) => {
+    const root = await mkdtemp(join(tmpdir(), "apex-archetype-catalog-"));
+    context.after(() => rm(root, { recursive: true, force: true }));
+    const git = (...args) => execute("git", ["-C", root, ...args]);
+    await git("init", "-q");
+    await mkdir(join(root, "archetypes"));
+    for (let index = 0; index < 257; index++)
+        await writeFile(join(root, "archetypes", `${index}.md`), "input\n");
+    await git("add", ".");
+    await git("-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid", "-c", "core.hooksPath=/dev/null", "commit", "-qm", "fixture");
+    const revision = (await git("rev-parse", "HEAD")).stdout.trim();
+    await assert.rejects(listArchetypeSources({ repositoryPath: root, revision, catalogPath: "archetypes" }), /entry limits/);
+});
+//# sourceMappingURL=archetype-source.test.js.map

package/dist/test/archetype-source.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archetype-source.test.js","sourceRoot":"","sources":["../../src/test/archetype-source.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,+BAA+B,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAEtG,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACpC,IAAI,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;IAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAC7B,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EACrB,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EACxB,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC;IACvC,MAAM,IAAI,GAA4B;QACpC,CAAC,GAAG,MAAM,YAAY,QAAQ,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzE,CAAC,GAAG,MAAM,UAAU,IAAI,EAAE,CAAC,EAAE;YAC3B,GAAG,EAAE,IAAI;YACT,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SAC3E;QACD,CAAC,GAAG,MAAM,UAAU,OAAO,EAAE,CAAC,EAAE;YAC9B,GAAG,EAAE,OAAO;YACZ,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;SACzE;QACD,CAAC,GAAG,MAAM,UAAU,QAAQ,EAAE,CAAC,EAAE;YAC/B,GAAG,EAAE,QAAQ;YACb,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE;gBACJ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;gBACrF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;aACnF;SACF;QACD,CAAC,GAAG,MAAM,UAAU,IAAI,EAAE,CAAC,EAAE;YAC3B,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,OAAO,CAAC,MAAM;YACpB,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACpC;KACF,CAAC;IACF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,KAAK,EAAE,QAAgB,EAAE,EAAE;QACtC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1B,OAAO,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IACF,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,oCAAoC;QACpD,QAAQ;QACR,YAAY,EAAE,oBAAoB;KACnC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,gCAAgC,CAAC,CAAC;IAC/E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC7C,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAChG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EACzD,CAAC,oBAAoB,CAAC,CACvB,CAAC;IACF,KAAK,MAAM,cAAc,IAAI;QAC3B,4CAA4C;QAC5C,+BAA+B;QAC/B,kCAAkC;QAClC,iBAAiB;QACjB,6CAA6C;KAC9C;QACC,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,IAAI,EAAE;YAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC,CAAC,EACF,SAAS,CACV,CAAC;IACJ,MAAM,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IAChG,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,KAAK,GAAG,MAAM,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,IAAI,CAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACrG,EACD,YAAY,CACb,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,KAAK,GAAG,MAAM,UAAU,IAAI,EAAE;QAChC,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,IAAI,CAAY,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACpF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,EACD,gBAAgB,CACjB,CAAC;IACF,KAAK,MAAM,KAAK,IAAI;QAClB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QACpF,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QAClF,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7E,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE;KAC/D;QACC,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,KAAK,GAAG,MAAM,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzG,CACF,CAAC;IACJ,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAChG,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7C,IAAI,KAAK,GAAG,MAAM,UAAU,QAAQ,EAAE;QACpC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;QACjF,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACf,EACD,SAAS,CACV,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE;QACrE,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC,IAAI,EAAE,CAAC;IACV,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC7C,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU,QAAQ,EAAE;YACxC,OAAO;gBACL,GAAG,EAAE,QAAQ;gBACb,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,EAAE,CAAC;aACvE,CAAC;QACJ,IAAI,IAAI,KAAK,GAAG,MAAM,UAAU,cAAc,EAAE;YAC9C,OAAO;gBACL,GAAG,EAAE,cAAc;gBACnB,IAAI,EAAE,eAAe,CAAC,MAAM;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC;aAC5C,CAAC;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,EACF,iBAAiB,CAClB,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACjE,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAClG,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG;QACZ,+BAA+B,EAAE,iCAAiC;QAClE,8BAA8B,EAAE,yBAAyB;QACzD,8BAA8B,EAAE,oCAAoC;QACpE,mCAAmC,EAAE,MAAM;QAC3C,sCAAsC,EAAE,MAAM;QAC9C,iDAAiD,EAAE,MAAM;QACzD,8BAA8B,EAAE,UAAU;QAC1C,0BAA0B,EAAE,gBAAgB;QAC5C,0BAA0B,EAAE,gBAAgB;KAC7C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,CACP,IAAI,EACJ,mBAAmB,EACnB,IAAI,EACJ,oCAAoC,EACpC,IAAI,EACJ,0BAA0B,EAC1B,QAAQ,EACR,KAAK,EACL,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1G,MAAM,CAAC,SAAS,CACd,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAC1D,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAC3C,CAAC;IACF,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,UAAU,CAAC,KAAK,CACtB,CAAC,EAAE,kBAAkB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,kBAAkB,IAAI,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CACvG,CACF,CAAC;IACF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,mCAAmC,CAAC,CAAC;IAClF,MAAM,MAAM,CAAC,OAAO,CAClB,oBAAoB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAC3F,SAAS,CACV,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,oBAAoB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC,EAC9F,SAAS,CACV,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,oBAAoB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,EACjG,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACpH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,CAAC,SAAS,CACd,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAC7C,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;IACvB,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IACvE,MAAM,CAAC,KAAK,CACV,+BAA+B,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,+BAA+B,CAAC,UAAU,CAAC,EAAE,CAAC,EAC5G,KAAK,CACN,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,CAAC,EAAE,MAAM,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACxG,MAAM,CAAC,SAAS,CACd,CAAC,MAAM,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,QAAQ,EAC/G,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,KAAK,MAAM,YAAY,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,EAAE,6BAA6B,CAAC;QAC1G,MAAM,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IAC7G,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,EACtG,UAAU,CACX,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC,EACpG,YAAY,CACb,CAAC;IACF,MAAM,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;IACjD,MAAM,GAAG,CACP,IAAI,EACJ,mBAAmB,EACnB,IAAI,EACJ,oCAAoC,EACpC,IAAI,EACJ,0BAA0B,EAC1B,QAAQ,EACR,KAAK,EACL,MAAM,CACP,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,EAC9G,wBAAwB,CACzB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAClH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAClE,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,CACP,IAAI,EACJ,mBAAmB,EACnB,IAAI,EACJ,oCAAoC,EACpC,IAAI,EACJ,0BAA0B,EAC1B,QAAQ,EACR,KAAK,EACL,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC7C,MAAM,SAAS,CACb,UAAU,EACV,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,2CAA2C,MAAM,2DAA2D,CAClJ,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EACpF,wBAAwB,CACzB,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yFAAyF,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAChH,KAAK,MAAM,QAAQ,IAAI;QACrB,aAAa;QACb,YAAY;QACZ,iBAAiB;QACjB,gBAAgB;QAChB,WAAW;QACX,QAAQ;QACR,WAAW;QACX,YAAY;KACJ,EAAE,CAAC;QACX,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3C,IAAI,QAAQ,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;YACrE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YACzE,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YACpC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAClE,IAAI,QAAQ,KAAK,aAAa;gBAC5B,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAClE,CAAC;YACJ,IAAI,QAAQ,KAAK,YAAY;gBAC3B,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,sCAAsC,CAAC,CAAC;YAC1F,IAAI,QAAQ,KAAK,iBAAiB;gBAChC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,kCAAkC,CAAC,CAAC;YACxF,IAAI,QAAQ,KAAK,gBAAgB;gBAC/B,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAClC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAC5E,CAAC;YACJ,IAAI,QAAQ,KAAK,WAAW;gBAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAChG,IAAI,QAAQ,KAAK,QAAQ;gBAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACtG,IAAI,QAAQ,KAAK,WAAW;gBAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACrG,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtB,IAAI,QAAQ,KAAK,YAAY;gBAAE,MAAM,GAAG,CAAC,cAAc,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAC3F,MAAM,GAAG,CACP,IAAI,EACJ,mBAAmB,EACnB,IAAI,EACJ,oCAAoC,EACpC,IAAI,EACJ,0BAA0B,EAC1B,QAAQ,EACR,KAAK,EACL,SAAS,CACV,CAAC;YACF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAChE,IAAI,QAAQ,KAAK,WAAW;gBAC1B,MAAM,MAAM,CAAC,OAAO,CAClB,oBAAoB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EACjF,UAAU,CACX,CAAC;YACJ,MAAM,MAAM,CAAC,OAAO,CAClB,sBAAsB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,EACpF,CAAC,KAAc,EAAE,EAAE;gBACjB,MAAM,CAAC,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;gBAC5D,OAAO,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpF,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5G,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,KAAK,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC9G,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,CACP,IAAI,EACJ,mBAAmB,EACnB,IAAI,EACJ,oCAAoC,EACpC,IAAI,EACJ,0BAA0B,EAC1B,QAAQ,EACR,KAAK,EACL,SAAS,CACV,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,CAClB,oBAAoB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EACnF,cAAc,CACf,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/test/executable-resolution.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=executable-resolution.test.d.ts.map

package/dist/test/executable-resolution.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-resolution.test.d.ts","sourceRoot":"","sources":["../../src/test/executable-resolution.test.ts"],"names":[],"mappings":""}

package/dist/test/executable-resolution.test.js

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { dirname } from "node:path";
+import test from "node:test";
+import { planLaunch, resolveExecutable } from "../executable-resolution.js";
+import { ProcessRunner, ProcessRunnerError } from "../process-runner.js";
+const windowsFiles = new Set([
+    "c:\\program files\\microsoft sdks\\azure\\cli2\\wbin\\az.cmd",
+    "c:\\program files\\nodejs\\npm.cmd",
+    "c:\\program files\\nodejs\\node.exe",
+    "c:\\tools\\terraform.exe",
+]);
+const windows = {
+    platform: "win32",
+    env: {
+        Path: 'C:\\Program Files\\Microsoft SDKs\\Azure\\CLI2\\wbin;C:\\Program Files\\nodejs;"C:\\Tools"',
+        PATHEXT: ".COM;.EXE;.BAT;.CMD",
+        ComSpec: "C:\\Windows\\System32\\cmd.exe",
+    },
+    isExecutableFile: (path) => windowsFiles.has(path.toLowerCase()),
+};
+test("Windows resolution applies PATHEXT, a mixed-case Path key and quoted PATH entries", () => {
+    assert.equal(resolveExecutable("az", windows)?.toLowerCase(), "c:\\program files\\microsoft sdks\\azure\\cli2\\wbin\\az.cmd");
+    assert.equal(resolveExecutable("npm", windows)?.toLowerCase(), "c:\\program files\\nodejs\\npm.cmd");
+    assert.equal(resolveExecutable("terraform", windows)?.toLowerCase(), "c:\\tools\\terraform.exe");
+    assert.equal(resolveExecutable("node.exe", windows)?.toLowerCase(), "c:\\program files\\nodejs\\node.exe");
+    assert.equal(resolveExecutable("C:\\Tools\\terraform", windows)?.toLowerCase(), "c:\\tools\\terraform.exe");
+    assert.equal(resolveExecutable("bicep", windows), undefined);
+    assert.equal(resolveExecutable("az", { ...windows, env: { ...windows.env, PATHEXT: undefined } })?.toLowerCase(), "c:\\program files\\microsoft sdks\\azure\\cli2\\wbin\\az.cmd");
+});
+test("Windows resolution picks duplicate environment keys the way Node passes them to the child", () => {
+    const env = { Path: "C:\\Inherited", PATH: "C:\\Program Files\\nodejs" };
+    assert.equal(resolveExecutable("npm", { ...windows, env })?.toLowerCase(), "c:\\program files\\nodejs\\npm.cmd");
+});
+test("Windows command scripts run through cmd.exe with one validated command line", () => {
+    const plan = planLaunch("az", ["account", "get-access-token", "--resource", "https://management.azure.com/"], windows);
+    assert.equal(plan.command, "C:\\Windows\\System32\\cmd.exe");
+    assert.equal(plan.windowsVerbatimArguments, true);
+    assert.deepEqual(plan.args.slice(0, 3), ["/d", "/s", "/c"]);
+    assert.equal(plan.args[3].toLowerCase(), '""c:\\program files\\microsoft sdks\\azure\\cli2\\wbin\\az.cmd" account get-access-token --resource https://management.azure.com/"');
+    assert.match(planLaunch("npm", ["install", "a b", "x&y", ""], windows).args[3], / "a b" "x&y" """$/u);
+    for (const unsafe of ['say "hi"', "%PATH%", "!x!", "line\nbreak"]) {
+        assert.throws(() => planLaunch("npm", ["run", unsafe], windows), /cannot be passed safely/u);
+    }
+});
+test("Windows executables and unresolved names launch directly without a shell", () => {
+    assert.deepEqual(planLaunch("terraform", ["version", "-json"], windows), {
+        command: "C:\\Tools\\terraform.exe",
+        args: ["version", "-json"],
+        windowsVerbatimArguments: false,
+    });
+    assert.deepEqual(planLaunch("missing-tool", ["--version"], windows), {
+        command: "missing-tool",
+        args: ["--version"],
+        windowsVerbatimArguments: false,
+    });
+});
+test("POSIX resolution finds executables on PATH and skips non-executable files", () => {
+    const env = { PATH: "/not-executable:/tools" };
+    const isExecutableFile = (path) => path === "/tools/node";
+    assert.equal(resolveExecutable("node", { platform: "linux", env, isExecutableFile }), "/tools/node");
+    assert.equal(resolveExecutable("/tools/node", { platform: "linux", env: {}, isExecutableFile }), "/tools/node");
+    assert.equal(resolveExecutable("definitely-not-a-real-apex-tool", { platform: "linux", env }), undefined);
+    assert.deepEqual(planLaunch("node", ["-v"], { platform: "linux", env, isExecutableFile }), {
+        command: "/tools/node",
+        args: ["-v"],
+        windowsVerbatimArguments: false,
+    });
+});
+test("process runner resolves bare names from the request environment and reports unsafe arguments", async () => {
+    const runner = new ProcessRunner();
+    const result = await runner.run({
+        executable: "node",
+        args: ["-e", "console.log('resolved')"],
+        env: { ...process.env, PATH: dirname(process.execPath) },
+        timeoutMs: 5_000,
+        maxOutputBytes: 1_024,
+    });
+    assert.equal(result.stdout.trim(), "resolved");
+    await assert.rejects(runner.run({
+        executable: "definitely-not-a-real-apex-tool",
+        args: [],
+        env: { PATH: "/nonexistent" },
+        timeoutMs: 1_000,
+        maxOutputBytes: 1_024,
+    }), (error) => error instanceof ProcessRunnerError && error.code === "PROCESS_SPAWN_ERROR");
+});
+//# sourceMappingURL=executable-resolution.test.js.map

package/dist/test/executable-resolution.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-resolution.test.js","sourceRoot":"","sources":["../../src/test/executable-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,8DAA8D;IAC9D,oCAAoC;IACpC,qCAAqC;IACrC,0BAA0B;CAC3B,CAAC,CAAC;AACH,MAAM,OAAO,GAAG;IACd,QAAQ,EAAE,OAAgB;IAC1B,GAAG,EAAE;QACH,IAAI,EAAE,4FAA4F;QAClG,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,gCAAgC;KAC1C;IACD,gBAAgB,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;CACzE,CAAC;AAEF,IAAI,CAAC,mFAAmF,EAAE,GAAG,EAAE;IAC7F,MAAM,CAAC,KAAK,CACV,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAC/C,8DAA8D,CAC/D,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,oCAAoC,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACjG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,qCAAqC,CAAC,CAAC;IAC3G,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CACV,iBAAiB,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EACnG,8DAA8D,CAC/D,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,oCAAoC,CAAC,CAAC;AACnH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,MAAM,IAAI,GAAG,UAAU,CACrB,IAAI,EACJ,CAAC,SAAS,EAAE,kBAAkB,EAAE,YAAY,EAAE,+BAA+B,CAAC,EAC9E,OAAO,CACR,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;IAC7D,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAC3B,oIAAoI,CACrI,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,EAAE,oBAAoB,CAAC,CAAC;IACvG,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,0BAA0B,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE;QACvE,OAAO,EAAE,0BAA0B;QACnC,IAAI,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QAC1B,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,EAAE;QACnE,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CAAC;IAClE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,iCAAiC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1G,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE;QACzF,OAAO,EAAE,aAAa;QACtB,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,wBAAwB,EAAE,KAAK;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;IAC9G,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;QAC9B,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC;QACvC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACxD,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,MAAM,CAAC,OAAO,CAClB,MAAM,CAAC,GAAG,CAAC;QACT,UAAU,EAAE,iCAAiC;QAC7C,IAAI,EAAE,EAAE;QACR,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;QAC7B,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,KAAK;KACtB,CAAC,EACF,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,YAAY,kBAAkB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,CAChG,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/test/governance-baseline.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=governance-baseline.test.d.ts.map

package/dist/test/governance-baseline.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-baseline.test.d.ts","sourceRoot":"","sources":["../../src/test/governance-baseline.test.ts"],"names":[],"mappings":""}