@clossys/launcher 0.3.1 → 0.4.0

package/dist/registry-snapshot.js

@@ -0,0 +1,483 @@
+// The registry snapshot step (issue #1178): the one step of applying a plan
+// that reads the package registry. It fetches each requested package's registry
+// document anonymously, projects it into the shared registry snapshot
+// contract (docs/contracts/registry-snapshot.json, in the public repository,
+// not shipped in this package; its content is packed into src/generated/ at
+// build time), validates the whole snapshot against that contract, and only
+// then writes it, atomically.
+//
+// Credentials: every read goes through an injected `Transport` whose default
+// is Node's own `fetch`. Nothing here runs the npm CLI, reads an `.npmrc`,
+// reads an environment variable, or sets an `Authorization` header; the only
+// headers this step sets are `accept` and `accept-encoding: identity`, and
+// Node's fetch adds its own default, non-credential headers. Identity asks
+// for the body uncompressed, so when the server honours it the hash and the
+// size cap apply to the bytes received. Redirects are refused (`redirect: "error"`, and a
+// 3xx answer from any transport is refused too), each response is read as a
+// stream and abandoned the moment it passes MAX_RESPONSE_BYTES (counted after
+// any decoding, so a server that compresses anyway is still bounded), and each
+// request, body included, is abandoned after a timeout.
+import { createHash, randomBytes } from "node:crypto";
+import { closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { ContractDocumentError, readContractDocument, validateAgainstContract } from "./generated/contract-schema.generated.js";
+import { PACKAGE_SCOPE } from "./generated/package-scope.generated.js";
+import { PLAN_CONTRACTS } from "./generated/plan-contracts.generated.js";
+/** Where the snapshot is written by default, relative to the hub root. */
+export const REGISTRY_SNAPSHOT_REL = "clossys/.state/apply/registry-snapshot.json";
+/** The most bytes read from any one registry response (10 MiB). */
+export const MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
+/** How long one request, its body included, may take. */
+export const DEFAULT_TIMEOUT_MS = 30_000;
+/** Node's own `fetch`. It reads no npm configuration and adds no registry credential (a proxy URL's own username and password, if any, go only to that proxy). */
+export const nodeFetchTransport = (input, init) => fetch(input, init);
+/**
+ * Why the snapshot step stopped. The message names a package only by its
+ * position in the request (`names[<n>]`), never by its name: a name is
+ * request text, and a request is a file anyone could have written. It
+ * never carries registry content either.
+ */
+export class RegistrySnapshotError extends Error {
+}
+function loadContract(name) {
+    const contract = Object.hasOwn(PLAN_CONTRACTS, name) ? PLAN_CONTRACTS[name] : undefined;
+    if (contract === undefined)
+        throw new Error(`no packed contract named ${JSON.stringify(name)}`);
+    return contract;
+}
+function eachRepeat(items, key, onRepeat) {
+    const first = new Map();
+    items.forEach((item, index) => {
+        const value = key(item);
+        const earlier = first.get(value);
+        if (earlier === undefined)
+            first.set(value, index);
+        else
+            onRepeat(index, earlier);
+    });
+}
+/**
+ * Every violation of the registry snapshot contract: its schema, then, only
+ * for a snapshot whose shape is known good, its code rules N1-N3 (no package
+ * named twice, no version recorded twice for one package, no `latest` or
+ * versions for a package that was not found). Implemented separately from
+ * @clossys/advisor's reader; both are tested against the one corpus,
+ * docs/contracts/registry-snapshot.fixture.json (in the public repository,
+ * not shipped in this package). Never throws.
+ */
+export function registrySnapshotViolations(value) {
+    const schema = validateAgainstContract(loadContract("registry-snapshot.json"), value, loadContract);
+    // The shared checker's path and message never carry document text: an undeclared field is placed at its object, by position.
+    if (schema.length > 0)
+        return schema.map((violation) => ({ rule: "schema", path: violation.path, message: violation.message }));
+    const snapshot = value;
+    const violations = [];
+    eachRepeat(snapshot.packages, (entry) => entry.name, (index, first) => violations.push({ rule: "N1", path: `packages[${index}].name`, message: `repeats packages[${first}].name` }));
+    snapshot.packages.forEach((entry, index) => {
+        eachRepeat(entry.versions, (version) => version.version, (position, first) => violations.push({ rule: "N2", path: `packages[${index}].versions[${position}].version`, message: `repeats packages[${index}].versions[${first}].version` }));
+        if (entry.status === "not-found") {
+            if (entry.latest !== null)
+                violations.push({ rule: "N3", path: `packages[${index}].latest`, message: "must be null when the package was not found" });
+            if (entry.versions.length > 0)
+                violations.push({ rule: "N3", path: `packages[${index}].versions`, message: "must be empty when the package was not found" });
+        }
+    });
+    return violations;
+}
+/** Compares strings as sequences of UTF-16 code units, the order the snapshot contract sorts by. */
+function byCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+/** The snapshot in the contract's canonical order: packages sorted by name, each package's versions sorted by version. */
+export function canonicalRegistrySnapshot(snapshot) {
+    return {
+        ...snapshot,
+        packages: [...snapshot.packages]
+            .sort((left, right) => byCodeUnits(left.name, right.name))
+            .map((entry) => ({ ...entry, versions: [...entry.versions].sort((left, right) => byCodeUnits(left.version, right.version)) })),
+    };
+}
+/**
+ * A package name's registry path segment. Copied, unchanged, from
+ * `registryEncodedName` in @clossys/integrator's provenance-check.ts, which
+ * this package must not depend on at runtime; a test compares the two
+ * function bodies so they cannot drift apart. The leading `@` stays literal
+ * and only the slash is percent-encoded (`@scope%2Fname`), the convention
+ * npm-compatible registries share; `encodeURIComponent` on the whole name
+ * would also encode the `@`, which none of them expect.
+ */
+export function registryEncodedName(name) {
+    const slash = name.indexOf("/");
+    if (slash === -1)
+        return encodeURIComponent(name);
+    return `@${encodeURIComponent(name.slice(1, slash))}%2F${encodeURIComponent(name.slice(slash + 1))}`;
+}
+/** The full registry document's URL for `name`: `{registry}/{encoded name}`. */
+export function packumentUrl(registry, name) {
+    return new URL(registryEncodedName(name), registry.endsWith("/") ? registry : `${registry}/`);
+}
+const PACKAGE_NAME = new RegExp(loadContract("registry-snapshot.json").definitions.packageName.pattern);
+/**
+ * The package names in a snapshot request: the report `advisor-package-request`
+ * prints, `{ state: "satisfied", names, findings: [] }`, or just `{ names }`.
+ * Every name must be a scoped package name in the packed publishing scope,
+ * named once. A refusal names positions only, never the request's text.
+ */
+export function requestedPackageNames(request, scope = PACKAGE_SCOPE.scope) {
+    if (typeof request !== "object" || request === null || Array.isArray(request))
+        throw new RegistrySnapshotError("the request must be a JSON object with a names array");
+    const record = request;
+    if (Object.keys(record).some((key) => key !== "state" && key !== "names" && key !== "findings")) {
+        throw new RegistrySnapshotError("the request has a field other than state, names and findings");
+    }
+    if (Object.hasOwn(record, "state") && record.state !== "satisfied") {
+        throw new RegistrySnapshotError("the request's state is not satisfied: fix the plan and run advisor-package-request again");
+    }
+    if (Object.hasOwn(record, "findings") && !(Array.isArray(record.findings) && record.findings.length === 0)) {
+        throw new RegistrySnapshotError("the request's findings must be an empty array");
+    }
+    const names = Object.hasOwn(record, "names") ? record.names : undefined;
+    if (!Array.isArray(names) || names.length === 0)
+        throw new RegistrySnapshotError("the request's names must be a non-empty array");
+    const seen = new Map();
+    for (let index = 0; index < names.length; index += 1) {
+        if (!Object.hasOwn(names, index))
+            throw new RegistrySnapshotError(`names[${index}] is missing`);
+        const name = names[index];
+        if (typeof name !== "string" || !PACKAGE_NAME.test(name) || !name.startsWith(`${scope}/`)) {
+            throw new RegistrySnapshotError(`names[${index}] is not a package name in the ${scope} scope`);
+        }
+        const earlier = seen.get(name);
+        if (earlier !== undefined)
+            throw new RegistrySnapshotError(`names[${index}] repeats names[${earlier}]`);
+        seen.set(name, index);
+    }
+    return names;
+}
+/** A registry document that cannot be projected. `what` is fixed text, never the document's. */
+class PackumentShapeError extends Error {
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** An own member only: a registry document's inherited members are never read. */
+function own(record, key) {
+    return Object.hasOwn(record, key) ? record[key] : undefined;
+}
+/** An own member that must be a plain object when present; absent or null reads as undefined. */
+function optionalObject(record, key, what) {
+    const value = own(record, key);
+    if (value === undefined || value === null)
+        return undefined;
+    if (!isPlainObject(value))
+        throw new PackumentShapeError(what);
+    return value;
+}
+function optionalString(record, key, what) {
+    const value = own(record, key);
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value !== "string")
+        throw new PackumentShapeError(what);
+    return value;
+}
+/**
+ * Projects a registry document into one snapshot entry's `latest` and
+ * `versions`, reading only what the contract records: the version the
+ * `latest` dist-tag names, and that one version's integrity, tarball,
+ * deprecation, publish time and attestation presence. Every other version,
+ * dist-tag and field is ignored. When `latest` names a version the document
+ * does not list, `versions` is empty, so a resolver refuses it by name.
+ */
+export function projectPackument(name, document) {
+    if (!isPlainObject(document))
+        throw new PackumentShapeError("is not a JSON object");
+    if (own(document, "name") !== name)
+        throw new PackumentShapeError("does not name the package that was requested");
+    const distTags = optionalObject(document, "dist-tags", "has dist-tags that are not an object");
+    const latest = distTags === undefined ? null : optionalString(distTags, "latest", "has a latest dist-tag that is not a string");
+    if (latest === null)
+        return { latest: null, versions: [] };
+    const versions = optionalObject(document, "versions", "has versions that are not an object");
+    const entry = versions === undefined ? undefined : own(versions, latest);
+    if (entry === undefined)
+        return { latest, versions: [] };
+    if (!isPlainObject(entry))
+        throw new PackumentShapeError("lists the latest version as something that is not an object");
+    if (own(entry, "version") !== latest)
+        throw new PackumentShapeError("lists the latest version under a different version number");
+    const dist = optionalObject(entry, "dist", "has a latest version whose dist is not an object") ?? {};
+    const tarball = own(dist, "tarball");
+    if (typeof tarball !== "string")
+        throw new PackumentShapeError("has a latest version with no tarball URL");
+    const deprecation = own(entry, "deprecated");
+    let deprecated;
+    if (deprecation === undefined || deprecation === null)
+        deprecated = false;
+    else if (typeof deprecation === "boolean")
+        deprecated = deprecation;
+    // npm treats an empty deprecation message as no deprecation, and any other message as one.
+    else if (typeof deprecation === "string")
+        deprecated = deprecation !== "";
+    else
+        throw new PackumentShapeError("marks the latest version deprecated with something that is neither text nor a boolean");
+    const attestations = own(dist, "attestations");
+    if (attestations !== undefined && attestations !== null && !isPlainObject(attestations)) {
+        throw new PackumentShapeError("has latest-version attestations that are not an object");
+    }
+    const time = optionalObject(document, "time", "has a time field that is not an object");
+    return {
+        latest,
+        versions: [
+            {
+                version: latest,
+                integrity: optionalString(dist, "integrity", "has a latest-version integrity that is not a string"),
+                tarball,
+                deprecated,
+                publishedAt: time === undefined ? null : optionalString(time, latest, "has a latest-version publish time that is not a string"),
+                // Listed only when the registry names where the attestations are: an empty object lists none.
+                hasAttestations: isPlainObject(attestations) && typeof own(attestations, "url") === "string" && /\S/.test(own(attestations, "url")),
+            },
+        ],
+    };
+}
+const TIMED_OUT = Symbol("timed out");
+/** Settles with `promise`, or rejects with TIMED_OUT as soon as `signal` aborts, whether or not the transport honours the signal. */
+function untilAborted(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(TIMED_OUT);
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(TIMED_OUT);
+        signal.addEventListener("abort", onAbort, { once: true });
+        promise.then((value) => {
+            signal.removeEventListener("abort", onAbort);
+            resolve(value);
+        }, (error) => {
+            signal.removeEventListener("abort", onAbort);
+            reject(error);
+        });
+    });
+}
+/**
+ * The body's bytes, read chunk by chunk. The read stops, and the stream is
+ * cancelled, the moment the running total passes `cap`, so an oversize body
+ * is never buffered past it.
+ */
+async function readCapped(body, cap, signal) {
+    if (body === null)
+        return new Uint8Array(0);
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await untilAborted(reader.read(), signal);
+            if (done)
+                break;
+            if (!(value instanceof Uint8Array))
+                throw new TypeError("a response chunk is not bytes");
+            total += value.byteLength;
+            if (total > cap)
+                return "too-large";
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.cancel().catch(() => undefined);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+/**
+ * The request options this step sets on every registry read: `accept`, and
+ * `accept-encoding: identity` so that a server that honours it sends the body
+ * uncompressed and `responseSha256` and the size cap apply to the exact bytes
+ * received; no credential, no redirect. Node's fetch adds its own default,
+ * non-credential headers.
+ */
+function requestInit(signal) {
+    return { method: "GET", headers: { accept: "application/json", "accept-encoding": "identity" }, redirect: "error", credentials: "omit", signal };
+}
+async function fetchOne(transport, url, where, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    const seconds = `${timeoutMs / 1000} s`;
+    try {
+        let response;
+        try {
+            response = await untilAborted(transport(url, requestInit(controller.signal)), controller.signal);
+        }
+        catch {
+            if (controller.signal.aborted)
+                throw new RegistrySnapshotError(`${where}: the registry did not answer within ${seconds}`);
+            throw new RegistrySnapshotError(`${where}: the registry could not be reached, or answered with a redirect, which is refused`);
+        }
+        const { status } = response;
+        const discard = () => {
+            response.body?.cancel().catch(() => undefined);
+        };
+        if (response.redirected || (status >= 300 && status < 400)) {
+            discard();
+            throw new RegistrySnapshotError(`${where}: the registry answered with a redirect${response.redirected ? "" : ` (HTTP ${status})`}, which is refused and never followed`);
+        }
+        if (status !== 200 && status !== 404) {
+            discard();
+            throw new RegistrySnapshotError(`${where}: the registry answered HTTP ${status}; only 200 and 404 are recorded`);
+        }
+        const tooLarge = `${where}: the registry's response is larger than ${MAX_RESPONSE_BYTES / (1024 * 1024)} MiB and was not read past that`;
+        const declared = response.headers.get("content-length");
+        if (declared !== null && /^\d+$/.test(declared.trim()) && Number(declared.trim()) > MAX_RESPONSE_BYTES) {
+            discard();
+            throw new RegistrySnapshotError(tooLarge);
+        }
+        let bytes;
+        try {
+            bytes = await readCapped(response.body, MAX_RESPONSE_BYTES, controller.signal);
+        }
+        catch {
+            if (controller.signal.aborted)
+                throw new RegistrySnapshotError(`${where}: the registry did not finish its response within ${seconds}`);
+            throw new RegistrySnapshotError(`${where}: the registry's response could not be read`);
+        }
+        if (bytes === "too-large")
+            throw new RegistrySnapshotError(tooLarge);
+        return { status, bytes };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function strictJsonReason(cause) {
+    if (!(cause instanceof ContractDocumentError))
+        return "is not strict JSON";
+    const where = cause.position === undefined ? "" : ` at position ${cause.position}`;
+    const why = cause.reason === "encoding" ? "is not valid UTF-8" : cause.reason === "repeated-key" ? "repeats a key in one object" : "is not valid JSON";
+    return `${why}${where}`;
+}
+let ownIdentity;
+/** This package's own name and version, from the package.json it ships with. */
+function launcherIdentity() {
+    if (ownIdentity === undefined) {
+        const manifest = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+        if (typeof manifest.name !== "string" || typeof manifest.version !== "string")
+            throw new RegistrySnapshotError("this package's own package.json has no name and version");
+        ownIdentity = { name: manifest.name, version: manifest.version };
+    }
+    return ownIdentity;
+}
+/**
+ * Fetches every named package's full registry document, one at a time, and
+ * returns the snapshot in canonical order, validated against the contract.
+ * Throws RegistrySnapshotError, having fetched no further, on the first
+ * package whose read fails: a transport error, a timeout, a redirect, an
+ * answer other than 200 or 404, a body over MAX_RESPONSE_BYTES, a 200 body
+ * that is not strict JSON or not a registry document for that package, or a
+ * projection the contract refuses. A 404 records `status: "not-found"`.
+ * `names` must already have passed `requestedPackageNames()`.
+ */
+export async function takeRegistrySnapshot(names, options = {}) {
+    const transport = options.transport ?? nodeFetchTransport;
+    const { registry } = PACKAGE_SCOPE;
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const fetchedBy = options.fetchedBy ?? launcherIdentity();
+    const ordered = names.map((name, index) => ({ name, index })).sort((left, right) => byCodeUnits(left.name, right.name));
+    const packages = [];
+    for (const { name, index } of ordered) {
+        // The position only: the name itself is request text.
+        const where = `names[${index}]`;
+        const { status, bytes } = await fetchOne(transport, packumentUrl(registry, name), where, timeoutMs);
+        const responseSha256 = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+        if (status === 404) {
+            packages.push({ name, status: "not-found", latest: null, versions: [], responseSha256 });
+            continue;
+        }
+        let document;
+        try {
+            document = readContractDocument(bytes);
+        }
+        catch (cause) {
+            throw new RegistrySnapshotError(`${where}: the registry's response ${strictJsonReason(cause)}`);
+        }
+        try {
+            packages.push({ name, status: "found", ...projectPackument(name, document), responseSha256 });
+        }
+        catch (cause) {
+            if (cause instanceof PackumentShapeError)
+                throw new RegistrySnapshotError(`${where}: the registry's document ${cause.message}`);
+            throw cause;
+        }
+    }
+    const snapshot = canonicalRegistrySnapshot({
+        schemaVersion: 1,
+        kind: "clossys.registry-snapshot",
+        registry,
+        fetchedAt: (options.now ?? (() => new Date().toISOString()))(),
+        fetchedBy: { name: fetchedBy.name, version: fetchedBy.version },
+        packages,
+    });
+    assertValidSnapshot(snapshot);
+    return snapshot;
+}
+function assertValidSnapshot(value) {
+    const violations = registrySnapshotViolations(value);
+    if (violations.length > 0) {
+        const listed = violations.map((violation) => `snapshot${violation.path === "" ? "" : violation.path.startsWith("[") ? violation.path : `.${violation.path}`} ${violation.message} (rule ${violation.rule})`);
+        throw new RegistrySnapshotError(`the snapshot does not validate against the registry snapshot contract, so none is written: ${listed.join("; ")}`);
+    }
+}
+/** The snapshot's file text: two-space JSON with a final newline, in the order given. */
+export function serializeRegistrySnapshot(snapshot) {
+    return `${JSON.stringify(snapshot, null, 2)}\n`;
+}
+/**
+ * Writes `text` to `path` so that a reader sees the old file or the whole
+ * new one, never part of it: the bytes go to a new temporary file in the same
+ * directory, are flushed to disk, and the temporary file is then renamed over
+ * `path`. On any failure the temporary file is removed and `path` is left as
+ * it was.
+ */
+export function writeFileAtomically(path, text) {
+    const directory = dirname(path);
+    mkdirSync(directory, { recursive: true });
+    const temporary = join(directory, `.${basename(path)}.${randomBytes(8).toString("hex")}.tmp`);
+    const bytes = Buffer.from(text, "utf8");
+    let descriptor;
+    try {
+        descriptor = openSync(temporary, "wx", 0o644);
+        let written = 0;
+        while (written < bytes.length)
+            written += writeSync(descriptor, bytes, written, bytes.length - written);
+        fsyncSync(descriptor);
+        closeSync(descriptor);
+        descriptor = undefined;
+        renameSync(temporary, path);
+    }
+    catch (cause) {
+        if (descriptor !== undefined) {
+            try {
+                closeSync(descriptor);
+            }
+            catch {
+                // Already failing; the original error is the one reported.
+            }
+        }
+        rmSync(temporary, { force: true });
+        throw cause;
+    }
+}
+/**
+ * Serializes a snapshot, re-reads that exact text strictly and validates it
+ * against the contract, and only then writes it atomically to `path`. The
+ * bytes on disk are therefore exactly the bytes that validated.
+ */
+export function writeRegistrySnapshot(path, snapshot) {
+    const text = serializeRegistrySnapshot(snapshot);
+    assertValidSnapshot(readContractDocument(Buffer.from(text, "utf8")));
+    writeFileAtomically(path, text);
+}
+//# sourceMappingURL=registry-snapshot.js.map

package/dist/registry-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-snapshot.js","sourceRoot":"","sources":["../src/registry-snapshot.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,gFAAgF;AAChF,sEAAsE;AACtE,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,8BAA8B;AAC9B,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,0FAA0F;AAC1F,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,wDAAwD;AAExD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEhI,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAEzE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,qBAAqB,GAAG,6CAA6C,CAAC;AAEnF,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AASzC,kKAAkK;AAClK,MAAM,CAAC,MAAM,kBAAkB,GAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAwCjF;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;CAAG;AAEnD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,UAAU,CAAI,KAAmB,EAAE,GAAwB,EAAE,QAAqD;IACzH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;;YAC9C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,wBAAwB,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACpG,6HAA6H;IAC7H,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,QAAQ,GAAG,KAAyB,CAAC;IAC3C,MAAM,UAAU,GAAgC,EAAE,CAAC;IACnD,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACpE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,KAAK,QAAQ,EAAE,OAAO,EAAE,oBAAoB,KAAK,QAAQ,EAAE,CAAC,CAC7G,CAAC;IACF,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAC3E,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,KAAK,cAAc,QAAQ,WAAW,EAAE,OAAO,EAAE,oBAAoB,KAAK,cAAc,KAAK,WAAW,EAAE,CAAC,CAC5J,CAAC;QACF,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,KAAK,UAAU,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC,CAAC;YACtJ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,KAAK,YAAY,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC/J,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,yBAAyB,CAAC,QAA0B;IAClE,OAAO;QACL,GAAG,QAAQ;QACX,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;aAC7B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;KACjI,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACvG,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IACzD,OAAO,IAAI,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,MAAM,CAC3B,YAAY,CAAC,wBAAwB,CAAC,CAAC,WAAmD,CAAC,WAAmC,CAAC,OAAO,CACzI,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,QAAgB,aAAa,CAAC,KAAK;IACzF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,CAAC,CAAC;IACvK,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,qBAAqB,CAAC,8DAA8D,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACnE,MAAM,IAAI,qBAAqB,CAAC,0FAA0F,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,qBAAqB,CAAC,+CAA+C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,+CAA+C,CAAC,CAAC;IAClI,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC;QAChG,MAAM,IAAI,GAAY,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,kCAAkC,KAAK,QAAQ,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,KAAK,mBAAmB,OAAO,GAAG,CAAC,CAAC;QACxG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,KAAiB,CAAC;AAC3B,CAAC;AAED,gGAAgG;AAChG,MAAM,mBAAoB,SAAQ,KAAK;CAAG;AAE1C,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,kFAAkF;AAClF,SAAS,GAAG,CAAC,MAA+B,EAAE,GAAW;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,iGAAiG;AACjG,SAAS,cAAc,CAAC,MAA+B,EAAE,GAAW,EAAE,IAAY;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,GAAW,EAAE,IAAY;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAiB;IAC9D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;IACpF,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,sCAAsC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,4CAA4C,CAAC,CAAC;IAChI,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,qCAAqC,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,6DAA6D,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,mBAAmB,CAAC,2DAA2D,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,kDAAkD,CAAC,IAAI,EAAE,CAAC;IACrG,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;IAC3G,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,UAAmB,CAAC;IACxB,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;QAAE,UAAU,GAAG,KAAK,CAAC;SACrE,IAAI,OAAO,WAAW,KAAK,SAAS;QAAE,UAAU,GAAG,WAAW,CAAC;IACpE,2FAA2F;SACtF,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,UAAU,GAAG,WAAW,KAAK,EAAE,CAAC;;QACrE,MAAM,IAAI,mBAAmB,CAAC,uFAAuF,CAAC,CAAC;IAC5H,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,mBAAmB,CAAC,wDAAwD,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,wCAAwC,CAAC,CAAC;IACxF,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR;gBACE,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,WAAW,EAAE,qDAAqD,CAAC;gBACnG,OAAO;gBACP,UAAU;gBACV,WAAW,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,wDAAwD,CAAC;gBAC/H,8FAA8F;gBAC9F,eAAe,EAAE,aAAa,CAAC,YAAY,CAAC,IAAI,OAAO,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAW,CAAC;aAC9I;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAEtC,qIAAqI;AACrI,SAAS,YAAY,CAAI,OAAmB,EAAE,MAAmB;IAC/D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,IAAuC,EAAE,GAAW,EAAE,MAAmB;IACjG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;YACzF,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,GAAG;gBAAE,OAAO,WAAW,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACnJ,CAAC;AAaD,KAAK,UAAU,QAAQ,CAAC,SAAoB,EAAE,GAAQ,EAAE,KAAa,EAAE,SAAiB;IACtF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,SAAS,GAAG,IAAI,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACnG,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,wCAAwC,OAAO,EAAE,CAAC,CAAC;YAC1H,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,oFAAoF,CAAC,CAAC;QAChI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC;QACF,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,CAAC;YACV,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,0CAA0C,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,uCAAuC,CAAC,CAAC;QAC3K,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO,EAAE,CAAC;YACV,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,gCAAgC,MAAM,iCAAiC,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,KAAK,4CAA4C,kBAAkB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,iCAAiC,CAAC;QACzI,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;YACvG,OAAO,EAAE,CAAC;YACV,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,qDAAqD,OAAO,EAAE,CAAC,CAAC;YACvI,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,6CAA6C,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,KAAK,KAAK,WAAW;YAAE,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC;QAAE,OAAO,oBAAoB,CAAC;IAC3E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACvJ,OAAO,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED,IAAI,WAA0D,CAAC;AAE/D,gFAAgF;AAChF,SAAS,gBAAgB;IACvB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA0C,CAAC;QACxI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,qBAAqB,CAAC,yDAAyD,CAAC,CAAC;QAC1K,WAAW,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAwB,EAAE,UAAgC,EAAE;IACrG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxH,MAAM,QAAQ,GAA8B,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,sDAAsD;QACtD,MAAM,KAAK,GAAG,SAAS,KAAK,GAAG,CAAC;QAChC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QACpG,MAAM,cAAc,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACzF,SAAS;QACX,CAAC;QACD,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,6BAA6B,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,6BAA6B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChI,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC;QACzC,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,2BAA2B;QACjC,QAAQ;QACR,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE;QAC9D,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE;QAC/D,QAAQ;KACT,CAAC,CAAC;IACH,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,SAAS,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,OAAO,UAAU,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7M,MAAM,IAAI,qBAAqB,CAAC,8FAA8F,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrJ,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,QAA0B;IAClE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAY;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;QACxG,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,UAAU,GAAG,SAAS,CAAC;QACvB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;QACD,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAA0B;IAC5E,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACjD,mBAAmB,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACrE,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC"}

package/dist/release-age-edit.d.ts

@@ -0,0 +1,52 @@
+import { type ExemptionSurfaceKind } from "./change-set-contract.js";
+export type ReleaseAgeEditRefusalReason = "release-age-surface-unparseable" | "release-age-surface-conflict";
+/** The outcome of editing: the new text, nothing to do, or a refusal that leaves the file alone. */
+export type ReleaseAgeEdit = {
+    readonly kind: "edited";
+    readonly text: string;
+} | {
+    readonly kind: "unchanged";
+} | {
+    readonly kind: "refused";
+    readonly reason: ReleaseAgeEditRefusalReason;
+};
+export interface ReleaseAgeEditInput {
+    readonly surface: ExemptionSurfaceKind;
+    /** The surface file's text, or null when the file does not exist. */
+    readonly text: string | null;
+    /** The repository's .npmrc text (null or absent: none); read for the pnpm surface only. */
+    readonly npmrc?: string | null;
+}
+export interface ReleaseAgeVerifyInput {
+    readonly surface: ExemptionSurfaceKind;
+    readonly before: string | null;
+    readonly after: string;
+    readonly npmrc?: string | null;
+}
+/** Verified only when `after` is `before` plus exactly the one scope entry; `value` is the ledger entries row value. */
+export type ReleaseAgeVerdict = {
+    readonly verified: true;
+    readonly value: string;
+} | {
+    readonly verified: false;
+};
+/**
+ * Adds the scope entry to the surface's exemption list. A missing file or key
+ * is created or appended with a two-space list; an existing block sequence
+ * gains one line after its last item, in its own indent, and nothing else
+ * changes. An already-present entry is unchanged. Refuses a pnpm `.npmrc`
+ * that sets the same list (conflict) or has any line outside the fixed safe
+ * grammar (unparseable), and any file the restricted reader does not fully
+ * recognise (flow lists, comments inside the list, anchors, aliases, tags,
+ * block scalars, multiple documents, tabs, CRLF, repeated keys, and more).
+ */
+export declare function editReleaseAgeExemption(input: ReleaseAgeEditInput): ReleaseAgeEdit;
+/**
+ * Whether `after` is `before` plus exactly the one scope entry, judged by its
+ * own structural comparison of the two texts (and, as a second check, by the
+ * edit function reproducing `after`). The entry must sit after the last
+ * existing item, in the list's indent and the surface's quoting, with every
+ * other byte, including the final newline, unchanged.
+ */
+export declare function verifyReleaseAgeExemption(input: ReleaseAgeVerifyInput): ReleaseAgeVerdict;
+//# sourceMappingURL=release-age-edit.d.ts.map

package/dist/release-age-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-age-edit.d.ts","sourceRoot":"","sources":["../src/release-age-edit.ts"],"names":[],"mappings":"AAUA,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAGzF,MAAM,MAAM,2BAA2B,GAAG,iCAAiC,GAAG,8BAA8B,CAAC;AAE7G,oGAAoG;AACpG,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAE/E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,wHAAwH;AACxH,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAC;AAmUnH;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAkBlF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,iBAAiB,CAgCzF"}