@avi770/testteam 3.0.0 → 3.2.0

package/dist/core/feature-bdd/store.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Feature BDD loop — FeatureArtifactStore.
+ *
+ * The ONLY module that touches the filesystem for BDD artifacts. All reads and
+ * writes are funnelled through two containment layers that mirror CanvasStore:
+ *
+ *   Layer 1 — safeKey: strips [^A-Za-z0-9_-], rejects empty/too-long/device names.
+ *   Layer 2a — resolveFeatureDir: path.resolve(root, safeKey) with collapse + escape checks.
+ *   Layer 2b — resolveArtifact: path.resolve(featureDir, basename) with the same checks,
+ *               PLUS basename-only enforcement (rejects separators, '..', bad extensions).
+ *
+ * Parse-before-write discipline:
+ *   writeFeatureFile — Gherkin surface check before disk.
+ *   writeTestFile    — size + extension check before disk.
+ *   writeProvenance  — parseFeatureProvenance() before disk.
+ *
+ * Generated artifacts are UNTRUSTED — this store validates and path-contains; it
+ * never executes anything.
+ */
+import { type FeatureProvenance, type FindingSummary, type RunFailureRecord } from './schema.js';
+export declare class FeatureStorePathError extends Error {
+    constructor(message: string);
+}
+export declare class FeatureStoreValidationError extends Error {
+    constructor(message: string);
+}
+export declare class FeatureArtifactStore {
+    private readonly root;
+    /**
+     * Per-safe-key promise chain serialising read-modify-write operations
+     * (appendFinding) so concurrent calls for the same feature can't lose a write.
+     */
+    private readonly writeChains;
+    constructor(featuresRoot: string);
+    /** Run `fn` after any in-flight write for `safeKey` completes; chain the next on it. */
+    private serialize;
+    /**
+     * Sanitise a feature key to a safe slug.
+     * Throws FeatureStorePathError if nothing usable remains.
+     *
+     * NOTE: keys are case-PRESERVING (mirrors CanvasStore.safeId). On a
+     * case-insensitive filesystem (NTFS/APFS) "MyFeature" and "myfeature" map to
+     * the same directory. This is intentional — the featureKey is the canvas
+     * node's identity and must round-trip unchanged — but callers should treat
+     * feature keys as case-insensitively unique. (Reviewed; deferred not silenced.)
+     */
+    static safeKey(key: string): string;
+    /**
+     * Resolve a feature key to its on-disk directory, guaranteed inside root.
+     * Layer 1 + Layer 2a containment.
+     */
+    private resolveFeatureDir;
+    /**
+     * Public, path-contained feature directory for a key. The single source of
+     * truth for callers (e.g. the BDD runner) — they must NOT re-derive the root
+     * or re-implement the escape checks.
+     */
+    featureDir(featureKey: string): string;
+    /**
+     * Public, path-contained absolute path of an artifact file within a feature.
+     * Re-validates the filename via the same Layer-2b checks (defence in depth).
+     */
+    artifactPath(featureKey: string, filename: string): string;
+    /**
+     * Resolve an artifact filename within a feature directory.
+     * Layer 2b containment — basenames only, extension allowlist.
+     *
+     * Rejects:
+     *  - any path separator (/ or \)
+     *  - '..' as a component
+     *  - absolute paths
+     *  - extensions not in ALLOWED_EXTENSIONS
+     */
+    private resolveArtifact;
+    private ensureFeatureDir;
+    private featureFilename;
+    /**
+     * Whether a feature directory exists.
+     */
+    exists(featureKey: string): Promise<boolean>;
+    /**
+     * Read the Gherkin .feature file for a key. Returns null on ENOENT.
+     */
+    readFeatureFile(featureKey: string): Promise<string | null>;
+    /**
+     * Write a Gherkin .feature file. Validates content before writing.
+     *
+     * Gherkin surface check:
+     *  - non-empty
+     *  - starts with 'Feature:'
+     *  - <= 64 KB
+     *
+     * Returns the resolved file path on success.
+     */
+    writeFeatureFile(featureKey: string, gherkinContent: string): Promise<string>;
+    /**
+     * Read a generated test file by filename. Returns null on ENOENT.
+     */
+    readTestFile(featureKey: string, filename: string): Promise<string | null>;
+    /**
+     * Write a generated test file. Validates before writing.
+     *
+     * Checks:
+     *  - extension allowlist (.ts, .js, .feature, .json)
+     *  - size <= 1 MB
+     *
+     * Returns the resolved file path on success.
+     */
+    writeTestFile(featureKey: string, filename: string, content: string): Promise<string>;
+    /**
+     * Read the provenance record for a feature. Returns null on ENOENT.
+     */
+    readProvenance(featureKey: string): Promise<FeatureProvenance | null>;
+    /**
+     * Validate (parse) then write a provenance record. A malformed provenance
+     * never reaches disk.
+     */
+    writeProvenance(featureKey: string, provenance: unknown): Promise<FeatureProvenance>;
+    /**
+     * Append a FindingSummary to the lastRunFindings ring-buffer (N=20).
+     * Reads current provenance (or creates a blank one), appends the finding,
+     * trims to the ring-buffer limit, then writes.
+     */
+    appendFinding(featureKey: string, finding: FindingSummary): Promise<FeatureProvenance>;
+    /**
+     * Atomically persist the latest run's failures into provenance. Serialised
+     * per feature key (same lock as appendFinding) so concurrent runs of the same
+     * feature can't clobber each other's failures. No-op (returns null) if the
+     * feature has no provenance yet.
+     */
+    recordRunFailures(featureKey: string, failures: readonly RunFailureRecord[]): Promise<FeatureProvenance | null>;
+    /**
+     * List all feature keys with a recognised directory under the root.
+     * Missing root ⇒ empty list. Unreadable entries are skipped silently.
+     */
+    list(): Promise<string[]>;
+    /**
+     * Delete a feature directory and all its artifacts. Idempotent — no-op if
+     * the directory does not exist.
+     *
+     * Returns the resolved feature directory path.
+     */
+    deleteFeature(featureKey: string): Promise<string>;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/core/feature-bdd/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../core/feature-bdd/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAGtB,MAAM,UAAU,CAAC;AAMlB,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,OAAO,EAAE,MAAM;CAI5B;AAuCD,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAE9B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuC;gBAEvD,YAAY,EAAE,MAAM;IAKhC,wFAAwF;IACxF,OAAO,CAAC,SAAS;IAejB;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAgBnC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAItC;;;OAGG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM;IAI1D;;;;;;;;;OASG;IACH,OAAO,CAAC,eAAe;YAiET,gBAAgB;IAI9B,OAAO,CAAC,eAAe;IAQvB;;OAEG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUlD;;OAEG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAYjE;;;;;;;;;OASG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuBnF;;OAEG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAWhF;;;;;;;;OAQG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB3F;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAmB3E;;;OAGG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAU1F;;;;OAIG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAiC5F;;;;;OAKG;IACG,iBAAiB,CACrB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAapC;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA2B/B;;;;;OAKG;IACG,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAoBzD"}

package/dist/core/feature-bdd/store.js

@@ -0,0 +1,470 @@
+/**
+ * Feature BDD loop — FeatureArtifactStore.
+ *
+ * The ONLY module that touches the filesystem for BDD artifacts. All reads and
+ * writes are funnelled through two containment layers that mirror CanvasStore:
+ *
+ *   Layer 1 — safeKey: strips [^A-Za-z0-9_-], rejects empty/too-long/device names.
+ *   Layer 2a — resolveFeatureDir: path.resolve(root, safeKey) with collapse + escape checks.
+ *   Layer 2b — resolveArtifact: path.resolve(featureDir, basename) with the same checks,
+ *               PLUS basename-only enforcement (rejects separators, '..', bad extensions).
+ *
+ * Parse-before-write discipline:
+ *   writeFeatureFile — Gherkin surface check before disk.
+ *   writeTestFile    — size + extension check before disk.
+ *   writeProvenance  — parseFeatureProvenance() before disk.
+ *
+ * Generated artifacts are UNTRUSTED — this store validates and path-contains; it
+ * never executes anything.
+ */
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import { parseFeatureProvenance, FEATURE_BDD_LIMITS, FEATURE_PROVENANCE_VERSION, } from './schema.js';
+// ---------------------------------------------------------------------------
+// Error + constants
+// ---------------------------------------------------------------------------
+export class FeatureStorePathError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'FeatureStorePathError';
+    }
+}
+export class FeatureStoreValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'FeatureStoreValidationError';
+    }
+}
+const KEY_SAFE = /[^A-Za-z0-9_-]/g;
+// Windows reserved device names survive the KEY_SAFE strip (all letters); block them explicitly.
+const WINDOWS_DEVICES = /^(CON|AUX|NUL|PRN|COM[1-9]|LPT[1-9])$/i;
+/** Filename characters that signal a path-traversal attempt. */
+const FILENAME_SEP_RE = /[/\\]/;
+/** Control characters (incl. NUL) — reach fs.* as untyped Node errors; reject early. */
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS_RE = /[\x00-\x1f]/;
+/**
+ * Strict allow-list for artifact filenames: ASCII letters, digits, '_', '.', '-'.
+ * Catch-all after the specific checks — also rejects spaces and any unicode
+ * lookalike-separator (e.g. U+2215) that the FS could interpret oddly.
+ */
+const FILENAME_SAFE_RE = /[^A-Za-z0-9_.-]/;
+/** Allowed extensions for generated test files. */
+const ALLOWED_EXTENSIONS = new Set(['.ts', '.js', '.feature', '.json']);
+/**
+ * Test-runner config filenames (P2-1). The BDD runner spawns vitest with
+ * `cwd = featureDir`; vitest/vite auto-discover a config named like these from
+ * cwd and EXECUTE it at load time — before, and outside of, the explicit list
+ * of test files. An LLM-generated (or otherwise persisted) artifact with such a
+ * name would therefore run arbitrary code even though it is not a listed test.
+ * Match by stem so both `vitest.config.ts` and `.js` are blocked.
+ */
+const RUNNER_CONFIG_STEM_RE = /^(?:vite|vitest|jest)\.config$|^(?:vite|vitest)\.workspace$/i;
+const PROVENANCE_FILENAME = 'provenance.json';
+// ---------------------------------------------------------------------------
+// FeatureArtifactStore
+// ---------------------------------------------------------------------------
+export class FeatureArtifactStore {
+    root;
+    /**
+     * Per-safe-key promise chain serialising read-modify-write operations
+     * (appendFinding) so concurrent calls for the same feature can't lose a write.
+     */
+    writeChains = new Map();
+    constructor(featuresRoot) {
+        // Normalise once; all containment checks compare against this absolute root.
+        this.root = path.resolve(featuresRoot);
+    }
+    /** Run `fn` after any in-flight write for `safeKey` completes; chain the next on it. */
+    serialize(safeKey, fn) {
+        const prior = this.writeChains.get(safeKey) ?? Promise.resolve();
+        // Swallow the prior result/rejection so one failure doesn't poison the chain.
+        const next = prior.then(fn, fn);
+        this.writeChains.set(safeKey, next.then(() => undefined, () => undefined));
+        return next;
+    }
+    // -------------------------------------------------------------------------
+    // Key sanitisation (identical rules to CanvasStore.safeId)
+    // -------------------------------------------------------------------------
+    /**
+     * Sanitise a feature key to a safe slug.
+     * Throws FeatureStorePathError if nothing usable remains.
+     *
+     * NOTE: keys are case-PRESERVING (mirrors CanvasStore.safeId). On a
+     * case-insensitive filesystem (NTFS/APFS) "MyFeature" and "myfeature" map to
+     * the same directory. This is intentional — the featureKey is the canvas
+     * node's identity and must round-trip unchanged — but callers should treat
+     * feature keys as case-insensitively unique. (Reviewed; deferred not silenced.)
+     */
+    static safeKey(key) {
+        const safe = key.replace(KEY_SAFE, '');
+        if (safe.length === 0)
+            throw new FeatureStorePathError('feature key has no safe characters');
+        if (safe.length > FEATURE_BDD_LIMITS.maxKeyLen) {
+            throw new FeatureStorePathError('feature key too long');
+        }
+        if (WINDOWS_DEVICES.test(safe)) {
+            throw new FeatureStorePathError('feature key is a reserved device name');
+        }
+        return safe;
+    }
+    // -------------------------------------------------------------------------
+    // Two-level containment
+    // -------------------------------------------------------------------------
+    /**
+     * Resolve a feature key to its on-disk directory, guaranteed inside root.
+     * Layer 1 + Layer 2a containment.
+     */
+    resolveFeatureDir(featureKey) {
+        const safe = FeatureArtifactStore.safeKey(featureKey);
+        const target = path.resolve(this.root, safe);
+        // Collapse check: path.resolve should equal path.join for a simple segment.
+        if (target !== path.join(this.root, safe)) {
+            throw new FeatureStorePathError('feature dir path escapes features root');
+        }
+        // Escape check.
+        if (target !== this.root && !target.startsWith(this.root + path.sep)) {
+            throw new FeatureStorePathError('feature dir path escapes features root');
+        }
+        return target;
+    }
+    /**
+     * Public, path-contained feature directory for a key. The single source of
+     * truth for callers (e.g. the BDD runner) — they must NOT re-derive the root
+     * or re-implement the escape checks.
+     */
+    featureDir(featureKey) {
+        return this.resolveFeatureDir(featureKey);
+    }
+    /**
+     * Public, path-contained absolute path of an artifact file within a feature.
+     * Re-validates the filename via the same Layer-2b checks (defence in depth).
+     */
+    artifactPath(featureKey, filename) {
+        return this.resolveArtifact(this.resolveFeatureDir(featureKey), filename);
+    }
+    /**
+     * Resolve an artifact filename within a feature directory.
+     * Layer 2b containment — basenames only, extension allowlist.
+     *
+     * Rejects:
+     *  - any path separator (/ or \)
+     *  - '..' as a component
+     *  - absolute paths
+     *  - extensions not in ALLOWED_EXTENSIONS
+     */
+    resolveArtifact(featureDir, filename) {
+        // basename-only checks first (fast-fail before path.resolve).
+        if (filename.length === 0) {
+            throw new FeatureStorePathError('artifact filename must not be empty');
+        }
+        if (FILENAME_SEP_RE.test(filename)) {
+            throw new FeatureStorePathError('artifact filename must be a basename (no separators)');
+        }
+        // Null bytes / control chars otherwise reach fs.* as an untyped Node error
+        // (ERR_INVALID_ARG_VALUE) — reject up front as a typed path error.
+        if (CONTROL_CHARS_RE.test(filename)) {
+            throw new FeatureStorePathError('artifact filename must not contain control characters');
+        }
+        // Colon guards Windows drive specifiers (C:foo) AND NTFS alternate data
+        // streams (name:stream.ts), which would create a hidden write channel.
+        if (filename.includes(':')) {
+            throw new FeatureStorePathError('artifact filename must not contain ":"');
+        }
+        // Strict allow-list catch-all: reject spaces + any unicode lookalike-separator.
+        if (FILENAME_SAFE_RE.test(filename)) {
+            throw new FeatureStorePathError('artifact filename contains disallowed characters');
+        }
+        // With separators already blocked, only a bare "." / ".." is a traversal
+        // component; "test..ts" is a legitimate name, so do NOT substring-match "..".
+        if (filename === '.' || filename === '..') {
+            throw new FeatureStorePathError('artifact filename must not be "." or ".."');
+        }
+        if (path.isAbsolute(filename)) {
+            throw new FeatureStorePathError('artifact filename must not be an absolute path');
+        }
+        if (filename.length > FEATURE_BDD_LIMITS.maxFilenameLen) {
+            throw new FeatureStorePathError('artifact filename too long');
+        }
+        // Extension allowlist.
+        const ext = path.extname(filename).toLowerCase();
+        if (!ALLOWED_EXTENSIONS.has(ext)) {
+            throw new FeatureStorePathError(`artifact filename extension "${ext}" not allowed; permitted: ${[...ALLOWED_EXTENSIONS].join(', ')}`);
+        }
+        // Windows reserved device names survive the extension (writing NUL.ts still
+        // targets the NUL device and silently discards data); block the stem.
+        if (WINDOWS_DEVICES.test(path.basename(filename, path.extname(filename)))) {
+            throw new FeatureStorePathError('artifact filename is a reserved device name');
+        }
+        // Runner-config injection (P2-1): reject vitest/vite/jest config filenames —
+        // the runner's cwd is this dir and it would auto-load + EXECUTE them.
+        if (RUNNER_CONFIG_STEM_RE.test(path.basename(filename, path.extname(filename)))) {
+            throw new FeatureStorePathError('artifact filename must not be a test-runner config file');
+        }
+        // Path-resolve containment within the feature directory.
+        const target = path.resolve(featureDir, filename);
+        if (target !== path.join(featureDir, filename)) {
+            throw new FeatureStorePathError('artifact path escapes feature directory');
+        }
+        if (!target.startsWith(featureDir + path.sep)) {
+            throw new FeatureStorePathError('artifact path escapes feature directory');
+        }
+        return target;
+    }
+    // -------------------------------------------------------------------------
+    // Helpers
+    // -------------------------------------------------------------------------
+    async ensureFeatureDir(featureDir) {
+        await fs.mkdir(featureDir, { recursive: true });
+    }
+    featureFilename(safeKey) {
+        return `${safeKey}.feature`;
+    }
+    // -------------------------------------------------------------------------
+    // Public API
+    // -------------------------------------------------------------------------
+    /**
+     * Whether a feature directory exists.
+     */
+    async exists(featureKey) {
+        const dir = this.resolveFeatureDir(featureKey);
+        try {
+            await fs.access(dir);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Read the Gherkin .feature file for a key. Returns null on ENOENT.
+     */
+    async readFeatureFile(featureKey) {
+        const featureDir = this.resolveFeatureDir(featureKey);
+        const safe = FeatureArtifactStore.safeKey(featureKey);
+        const file = this.resolveArtifact(featureDir, this.featureFilename(safe));
+        try {
+            return await fs.readFile(file, 'utf-8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    }
+    /**
+     * Write a Gherkin .feature file. Validates content before writing.
+     *
+     * Gherkin surface check:
+     *  - non-empty
+     *  - starts with 'Feature:'
+     *  - <= 64 KB
+     *
+     * Returns the resolved file path on success.
+     */
+    async writeFeatureFile(featureKey, gherkinContent) {
+        // Gherkin surface validation (parse-before-write).
+        if (typeof gherkinContent !== 'string' || gherkinContent.length === 0) {
+            throw new FeatureStoreValidationError('Gherkin content must be a non-empty string');
+        }
+        if (!gherkinContent.trimStart().startsWith('Feature:')) {
+            throw new FeatureStoreValidationError('Gherkin content must start with "Feature:"');
+        }
+        const byteLen = Buffer.byteLength(gherkinContent, 'utf-8');
+        if (byteLen > FEATURE_BDD_LIMITS.maxGherkinBytes) {
+            throw new FeatureStoreValidationError(`Gherkin content exceeds max size (${FEATURE_BDD_LIMITS.maxGherkinBytes} bytes)`);
+        }
+        const featureDir = this.resolveFeatureDir(featureKey);
+        const safe = FeatureArtifactStore.safeKey(featureKey);
+        const file = this.resolveArtifact(featureDir, this.featureFilename(safe));
+        await this.ensureFeatureDir(featureDir);
+        await fs.writeFile(file, gherkinContent, 'utf-8');
+        return file;
+    }
+    /**
+     * Read a generated test file by filename. Returns null on ENOENT.
+     */
+    async readTestFile(featureKey, filename) {
+        const featureDir = this.resolveFeatureDir(featureKey);
+        const file = this.resolveArtifact(featureDir, filename);
+        try {
+            return await fs.readFile(file, 'utf-8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+    }
+    /**
+     * Write a generated test file. Validates before writing.
+     *
+     * Checks:
+     *  - extension allowlist (.ts, .js, .feature, .json)
+     *  - size <= 1 MB
+     *
+     * Returns the resolved file path on success.
+     */
+    async writeTestFile(featureKey, filename, content) {
+        const featureDir = this.resolveFeatureDir(featureKey);
+        // resolveArtifact performs extension and basename checks.
+        const file = this.resolveArtifact(featureDir, filename);
+        // Size check (parse-before-write).
+        const byteLen = Buffer.byteLength(content, 'utf-8');
+        if (byteLen > FEATURE_BDD_LIMITS.maxTestFileBytes) {
+            throw new FeatureStoreValidationError(`test file content exceeds max size (${FEATURE_BDD_LIMITS.maxTestFileBytes} bytes)`);
+        }
+        await this.ensureFeatureDir(featureDir);
+        await fs.writeFile(file, content, 'utf-8');
+        return file;
+    }
+    /**
+     * Read the provenance record for a feature. Returns null on ENOENT.
+     */
+    async readProvenance(featureKey) {
+        const featureDir = this.resolveFeatureDir(featureKey);
+        const file = this.resolveArtifact(featureDir, PROVENANCE_FILENAME);
+        let raw;
+        try {
+            raw = await fs.readFile(file, 'utf-8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error('provenance invalid JSON on disk');
+        }
+        return parseFeatureProvenance(parsed);
+    }
+    /**
+     * Validate (parse) then write a provenance record. A malformed provenance
+     * never reaches disk.
+     */
+    async writeProvenance(featureKey, provenance) {
+        // parse-before-write
+        const valid = parseFeatureProvenance(provenance);
+        const featureDir = this.resolveFeatureDir(featureKey);
+        const file = this.resolveArtifact(featureDir, PROVENANCE_FILENAME);
+        await this.ensureFeatureDir(featureDir);
+        await fs.writeFile(file, JSON.stringify(valid, null, 2), 'utf-8');
+        return valid;
+    }
+    /**
+     * Append a FindingSummary to the lastRunFindings ring-buffer (N=20).
+     * Reads current provenance (or creates a blank one), appends the finding,
+     * trims to the ring-buffer limit, then writes.
+     */
+    async appendFinding(featureKey, finding) {
+        const safeKey = FeatureArtifactStore.safeKey(featureKey);
+        // Serialise the read-modify-write so concurrent appends to the same feature
+        // can't read the same base and clobber each other (lost-finding race).
+        return this.serialize(safeKey, async () => {
+            const now = new Date().toISOString();
+            const existing = await this.readProvenance(featureKey);
+            const base = existing ?? {
+                version: FEATURE_PROVENANCE_VERSION,
+                featureKey: safeKey,
+                bddSpec: null,
+                testFiles: [],
+                lastRunFindings: [],
+                lastRunFailures: [],
+                createdAt: now,
+                updatedAt: now,
+            };
+            const newFindings = [...base.lastRunFindings, finding].slice(-FEATURE_BDD_LIMITS.findingsRingBuffer);
+            const updated = {
+                ...base,
+                lastRunFindings: newFindings,
+                updatedAt: now,
+            };
+            return this.writeProvenance(featureKey, updated);
+        });
+    }
+    /**
+     * Atomically persist the latest run's failures into provenance. Serialised
+     * per feature key (same lock as appendFinding) so concurrent runs of the same
+     * feature can't clobber each other's failures. No-op (returns null) if the
+     * feature has no provenance yet.
+     */
+    async recordRunFailures(featureKey, failures) {
+        const safeKey = FeatureArtifactStore.safeKey(featureKey);
+        return this.serialize(safeKey, async () => {
+            const existing = await this.readProvenance(featureKey);
+            if (existing === null)
+                return null;
+            return this.writeProvenance(featureKey, {
+                ...existing,
+                lastRunFailures: failures,
+                updatedAt: new Date().toISOString(),
+            });
+        });
+    }
+    /**
+     * List all feature keys with a recognised directory under the root.
+     * Missing root ⇒ empty list. Unreadable entries are skipped silently.
+     */
+    async list() {
+        let entries;
+        try {
+            entries = await fs.readdir(this.root);
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return [];
+            throw err;
+        }
+        const out = [];
+        for (const entry of entries) {
+            try {
+                // Must be a directory named after a safe key.
+                const safe = FeatureArtifactStore.safeKey(entry);
+                if (safe !== entry)
+                    continue; // not a clean safe key — skip
+                const dir = this.resolveFeatureDir(entry);
+                // lstat (not stat): a symlinked alias must not be reported as a feature.
+                const stat = await fs.lstat(dir);
+                if (stat.isDirectory()) {
+                    out.push(entry);
+                }
+            }
+            catch {
+                // Skip unreadable / invalid entries rather than failing the whole list.
+            }
+        }
+        return out;
+    }
+    /**
+     * Delete a feature directory and all its artifacts. Idempotent — no-op if
+     * the directory does not exist.
+     *
+     * Returns the resolved feature directory path.
+     */
+    async deleteFeature(featureKey) {
+        const featureDir = this.resolveFeatureDir(featureKey);
+        try {
+            // Refuse to follow a symlink: an attacker who swapped the feature dir for a
+            // symlink could otherwise make `recursive: true` rm delete an arbitrary
+            // target outside the features root (TOCTOU). lstat does not follow links.
+            const stat = await fs.lstat(featureDir);
+            if (stat.isSymbolicLink()) {
+                throw new FeatureStorePathError('refusing to delete: feature path is a symbolic link');
+            }
+            await fs.rm(featureDir, { recursive: true, force: true });
+        }
+        catch (err) {
+            if (err.code === 'ENOENT') {
+                // Already gone — idempotent.
+                return featureDir;
+            }
+            throw err;
+        }
+        return featureDir;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/core/feature-bdd/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../core/feature-bdd/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,sBAAsB,EAItB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,UAAU,CAAC;AAElB,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AACnC,iGAAiG;AACjG,MAAM,eAAe,GAAG,wCAAwC,CAAC;AAEjE,gEAAgE;AAChE,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,wFAAwF;AACxF,4CAA4C;AAC5C,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,8DAA8D,CAAC;AAE7F,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,OAAO,oBAAoB;IACd,IAAI,CAAS;IAE9B;;;OAGG;IACc,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnE,YAAY,YAAoB;QAC9B,6EAA6E;QAC7E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAED,wFAAwF;IAChF,SAAS,CAAI,OAAe,EAAE,EAAoB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjE,8EAA8E;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CACrC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,2DAA2D;IAC3D,4EAA4E;IAE5E;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,CAAC,GAAW;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,oCAAoC,CAAC,CAAC;QAC7F,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAE5E;;;OAGG;IACK,iBAAiB,CAAC,UAAkB;QAC1C,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,4EAA4E;QAC5E,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,qBAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QACD,gBAAgB;QAChB,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,qBAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,UAAkB;QAC3B,OAAO,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,UAAkB,EAAE,QAAgB;QAC/C,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;;;;OASG;IACK,eAAe,CAAC,UAAkB,EAAE,QAAgB;QAC1D,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAqB,CAAC,uDAAuD,CAAC,CAAC;QAC3F,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;QACD,gFAAgF;QAChF,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAqB,CAAC,kDAAkD,CAAC,CAAC;QACtF,CAAC;QACD,yEAAyE;QACzE,8EAA8E;QAC9E,IAAI,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,qBAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,qBAAqB,CAAC,gDAAgD,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,kBAAkB,CAAC,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QACD,uBAAuB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,qBAAqB,CAC7B,gCAAgC,GAAG,6BAA6B,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,6EAA6E;QAC7E,sEAAsE;QACtE,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,qBAAqB,CAAC,yDAAyD,CAAC,CAAC;QAC7F,CAAC;QACD,yDAAyD;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,qBAAqB,CAAC,yCAAyC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAEpE,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,eAAe,CAAC,OAAe;QACrC,OAAO,GAAG,OAAO,UAAU,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAE5E;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CAAC,UAAkB,EAAE,cAAsB;QAC/D,mDAAmD;QACnD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,2BAA2B,CAAC,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,2BAA2B,CAAC,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,GAAG,kBAAkB,CAAC,eAAe,EAAE,CAAC;YACjD,MAAM,IAAI,2BAA2B,CACnC,qCAAqC,kBAAkB,CAAC,eAAe,SAAS,CACjF,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,QAAgB;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,QAAgB,EAAE,OAAe;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,0DAA0D;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAExD,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,OAAO,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,CAAC;YAClD,MAAM,IAAI,2BAA2B,CACnC,uCAAuC,kBAAkB,CAAC,gBAAgB,SAAS,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACnE,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAClE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB,EAAE,UAAmB;QAC3D,qBAAqB;QACrB,MAAM,KAAK,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,OAAuB;QAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,4EAA4E;QAC5E,uEAAuE;QACvE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAsB,QAAQ,IAAI;gBAC1C,OAAO,EAAE,0BAA0B;gBACnC,UAAU,EAAE,OAAO;gBACnB,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,EAAE;gBACb,eAAe,EAAE,EAAE;gBACnB,eAAe,EAAE,EAAE;gBACnB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC;YAEF,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,KAAK,CAC1D,CAAC,kBAAkB,CAAC,kBAAkB,CACvC,CAAC;YAEF,MAAM,OAAO,GAAsB;gBACjC,GAAG,IAAI;gBACP,eAAe,EAAE,WAAW;gBAC5B,SAAS,EAAE,GAAG;aACf,CAAC;YAEF,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,UAAkB,EAClB,QAAqC;QAErC,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE;gBACtC,GAAG,QAAQ;gBACX,eAAe,EAAE,QAAQ;gBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,8CAA8C;gBAC9C,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,IAAI,KAAK,KAAK;oBAAE,SAAS,CAAC,8BAA8B;gBAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAC1C,yEAAyE;gBACzE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;YAC1E,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,4EAA4E;YAC5E,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,qBAAqB,CAAC,qDAAqD,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,6BAA6B;gBAC7B,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}