@clossys/launcher 0.3.1 → 0.5.0

package/dist/provenance-gate.js

@@ -0,0 +1,324 @@
+// Provenance gate for a change set (RFC apply-approved-plan: V9, D20, D23, T12).
+//
+// Every package version a set installs or pins must have registry provenance
+// that Integrator verifies. The hub pins `@clossys/integrator` (D23), so this
+// runs the hub's own `integrator-provenance-check` bin against the
+// materialized tree, reads its JSON report strictly, and turns it into one V9
+// verdict for the set. The bin is found only inside the hub's own
+// node_modules, never through npx or PATH, and runs under the same literal
+// environment allow-list the lockfile step uses (lockfile-tool-env.ts): no
+// parent credential, proxy, CA-trust or NODE_OPTIONS value reaches it.
+//
+// Every ambiguity refuses. A report that does not parse to exactly the shape
+// the bin prints, or that disagrees with its own exit code, is indeterminate,
+// never trusted as far as it goes. A package version the bin does not verify is
+// never passed by any exception: it stays violated or indeterminate exactly as
+// Integrator reports it.
+//
+// D20's first-identity-publication exception is deliberately not implemented.
+// It needs evidence that a version is a package's first publication, and the
+// registry snapshot cannot give it: a snapshot taken to resolve a plan records
+// only the one version `latest` names, whatever else the package has published,
+// and Integrator reports "attestation failed" (violated) the same way as "no
+// attestation". Any condition built on the snapshot would therefore also pass a
+// package with earlier releases whose latest release fails verification. Until
+// the snapshot contract records evidence of a first publication, an unattested
+// first publication blocks the apply: fail closed. Nothing here fetches,
+// repairs or retries.
+//
+// The RFC and the snapshot contract are in the public repository, not shipped
+// in this package: docs/rfcs/apply-approved-plan.md and
+// docs/contracts/registry-snapshot.json.
+import { lstat, realpath, stat } from "node:fs/promises";
+import { delimiter, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { compareCodeUnits } from "./change-set-contract.js";
+import { readContractDocument } from "./generated/contract-schema.generated.js";
+import { PACKAGE_SCOPE } from "./generated/package-scope.generated.js";
+import { spawnLockfileTool } from "./lockfile-regen.js";
+import { lockfileToolEnv, prepareLockfileScratch } from "./lockfile-tool-env.js";
+import { canonicalDigest } from "./plan-digest.js";
+import { canonicalRegistrySnapshot, registrySnapshotViolations } from "./registry-snapshot.js";
+/** The bin Integrator installs, found under the hub's node_modules/.bin. */
+export const PROVENANCE_CHECK_BIN = "integrator-provenance-check";
+/** How long one run of the bin may take. */
+export const PROVENANCE_CHECK_TIMEOUT_MS = 120_000;
+/** Bytes kept of the bin's stdout; a report at or past this is treated as truncated. */
+export const PROVENANCE_CHECK_MAX_BUFFER = 1_000_000;
+// ---------------------------------------------------------------------------
+// The snapshot digest
+// ---------------------------------------------------------------------------
+/**
+ * The snapshot's digest, as docs/contracts/registry-snapshot.json defines it
+ * (in the public repository, not shipped in this package): `sha256:` and the
+ * SHA-256 of the canonical JSON of `{registry, packages}`, packages sorted by
+ * name, each reduced to name, status, latest and versions, versions sorted by
+ * version and kept whole. fetchedAt, fetchedBy, responseSha256, schemaVersion
+ * and kind are left out. Throws TypeError for a snapshot that does not validate
+ * against the contract: an invalid snapshot has no digest. The gate itself
+ * does not read a snapshot; this is exported for the plan binding that a later
+ * change wires in.
+ */
+export function registrySnapshotDigest(snapshot) {
+    if (registrySnapshotViolations(snapshot).length > 0)
+        throw new TypeError("a snapshot that does not validate against the registry snapshot contract has no digest");
+    const canonical = canonicalRegistrySnapshot(snapshot);
+    return canonicalDigest({
+        registry: canonical.registry,
+        packages: canonical.packages.map((entry) => ({ name: entry.name, status: entry.status, latest: entry.latest, versions: entry.versions })),
+    });
+}
+// ---------------------------------------------------------------------------
+// Verdict plumbing
+// ---------------------------------------------------------------------------
+const indeterminate = (rule) => ({ check: "V9", verdict: "indeterminate", rule });
+const violated = (rule) => ({ check: "V9", verdict: "violated", rule });
+/** The rules behind a failed V9, one entry per distinct rule, in code-unit order. */
+function distinctRules(verdict, rules) {
+    return [...rules].sort(compareCodeUnits).map((rule) => (verdict === "indeterminate" ? indeterminate(rule) : violated(rule)));
+}
+/**
+ * The packages this set installs or pins that its base does not already hold,
+ * by exact name, each once. Only a `satisfiedInBase` of exactly `true` skips an
+ * item: a value other than `true` (`false`, missing, `null`, a string or a
+ * number) is gated. Undefined when one name is gated at two versions: the set
+ * then asks for something no single report can answer.
+ */
+function gatedPackages(items) {
+    const versions = new Map();
+    for (const item of items) {
+        if ((item.act !== "install" && item.act !== "pin-starter") || item.satisfiedInBase === true)
+            continue;
+        const earlier = versions.get(item.package.name);
+        if (earlier !== undefined && earlier !== item.package.version)
+            return undefined;
+        versions.set(item.package.name, item.package.version);
+    }
+    return [...versions].map(([name, version]) => ({ name, version }));
+}
+// ---------------------------------------------------------------------------
+// Roots and the bin
+// ---------------------------------------------------------------------------
+/** An absolute path that is its own realpath and names a directory. */
+async function isCanonicalDirectory(path) {
+    if (typeof path !== "string" || !isAbsolute(path))
+        return false;
+    try {
+        if ((await realpath(path)) !== path)
+            return false;
+        return (await stat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether `child` lies strictly inside `parent`; both are already real paths. */
+function isStrictlyInside(parent, child) {
+    const path = relative(parent, child);
+    return path !== "" && path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute(path);
+}
+/**
+ * The verified real path of the hub's Integrator bin, or undefined. The
+ * `.bin` entry must resolve to a regular file strictly inside the real path of
+ * `node_modules/@clossys/integrator`, and that directory's real path must
+ * itself lie strictly inside `<hubRoot>/node_modules`, so a link that leaves
+ * the hub, leaves node_modules, or points at some other package's file is
+ * refused. `hubRoot` is already its own realpath.
+ *
+ * The caller spawns the returned real path, not the `.bin` entry: the launch
+ * then goes to the very file that was checked, and a link swapped in after the
+ * check cannot redirect it.
+ */
+async function verifiedBin(hubRoot) {
+    const nodeModules = join(hubRoot, "node_modules");
+    try {
+        const realBin = await realpath(join(nodeModules, ".bin", PROVENANCE_CHECK_BIN));
+        const realIntegrator = await realpath(join(nodeModules, "@clossys", "integrator"));
+        if (!(await lstat(realBin)).isFile() || !(await lstat(realIntegrator)).isDirectory())
+            return undefined;
+        if (!isStrictlyInside(nodeModules, realIntegrator) || !isStrictlyInside(realIntegrator, realBin))
+            return undefined;
+        return realBin;
+    }
+    catch {
+        return undefined;
+    }
+}
+const REPORT_KEYS = new Set(["state", "registryBaseUrl", "packages"]);
+const PACKAGE_KEYS = new Set(["name", "installedVersion", "latestVersion", "currencyDistance", "state", "reasons"]);
+const isPlainObject = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+const isState = (value) => value === "verified" || value === "violated" || value === "indeterminate";
+const isString = (value) => typeof value === "string";
+/** Whether `value` is an own-keyed plain object whose keys all come from `allowed`. */
+function hasOnlyKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.has(key) && Object.hasOwn(value, key));
+}
+/**
+ * Reads the bin's stdout as the closed report it prints, or undefined. Output
+ * at or past the capture limit is refused as truncated. The text is read with
+ * the same strict reader the contracts use, so a repeated key or a byte order
+ * mark is refused as well as anything JSON.parse refuses; no key outside the
+ * closed sets is accepted, and each field must have the type the bin gives it.
+ * The report's reasons are checked for shape and never used.
+ */
+function readReport(stdout) {
+    if (Buffer.byteLength(stdout, "utf8") >= PROVENANCE_CHECK_MAX_BUFFER)
+        return undefined;
+    let value;
+    try {
+        value = readContractDocument(Buffer.from(stdout, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (!isPlainObject(value) || !hasOnlyKeys(value, REPORT_KEYS) || Object.keys(value).length !== REPORT_KEYS.size)
+        return undefined;
+    const { state, registryBaseUrl, packages } = value;
+    if (!isState(state) || registryBaseUrl !== PACKAGE_SCOPE.registry || !Array.isArray(packages))
+        return undefined;
+    const reported = [];
+    for (const entry of packages) {
+        if (!isPlainObject(entry) || !hasOnlyKeys(entry, PACKAGE_KEYS))
+            return undefined;
+        const { name, installedVersion, latestVersion, currencyDistance, state: packageState, reasons } = entry;
+        if (!isString(name) || !isString(installedVersion) || !isState(packageState))
+            return undefined;
+        if (!Array.isArray(reasons) || !reasons.every(isString))
+            return undefined;
+        if (Object.hasOwn(entry, "latestVersion") && !isString(latestVersion))
+            return undefined;
+        if (Object.hasOwn(entry, "currencyDistance") && !isString(currencyDistance))
+            return undefined;
+        reported.push({ name, installedVersion, state: packageState });
+    }
+    return { state, packages: reported };
+}
+/** Whether the report says what its exit code says: exit 0 all verified, exit 1 a violation and nothing indeterminate. */
+function agreesWithExit(status, report) {
+    if (status === 0)
+        return report.state === "verified" && report.packages.length > 0 && report.packages.every((entry) => entry.state === "verified");
+    return report.state === "violated" && report.packages.some((entry) => entry.state === "violated") && report.packages.every((entry) => entry.state !== "indeterminate");
+}
+/** The rule an unsuccessful launch maps to, or undefined when the bin ran to exit 0 or 1 with no failure flag. */
+function launchFailure(result) {
+    if (result.failure === "not-found")
+        return "engine-missing-bin";
+    if (result.failure === "timeout")
+        return "engine-timeout";
+    if (result.failure !== undefined)
+        return "engine-failed";
+    if (result.status === 2)
+        return "engine-indeterminate";
+    if (result.status !== 0 && result.status !== 1)
+        return "engine-failed";
+    return undefined;
+}
+// ---------------------------------------------------------------------------
+// The gate
+// ---------------------------------------------------------------------------
+/**
+ * V9 for one change set. Satisfied without touching anything when the set
+ * installs or pins nothing its base lacks. Otherwise runs the hub's
+ * `integrator-provenance-check` against `tree` and judges each gated package
+ * by exact name and exact version: satisfied only when every one is verified
+ * at that version, with no exception for an unverified one. Other `@clossys`
+ * packages in the report never gate: an unrelated violated legacy pin passes
+ * when every gated package is verified. Indeterminate wins over violated; the
+ * result lists each distinct rule once, in code-unit order, and never mixes a
+ * satisfied entry with a refusal. Never throws for a bad input; everything it
+ * cannot rely on is an indeterminate entry. The input carries no ledger or
+ * snapshot: nothing here reads one.
+ */
+export async function checkSetProvenance(input, ports = {}) {
+    // 1. The gated set.
+    const gated = gatedPackages(input.items);
+    if (gated === undefined)
+        return [indeterminate("gated-package-conflict")];
+    if (gated.length === 0)
+        return [{ check: "V9", verdict: "satisfied" }];
+    // 2 and 3. Roots, then the bin.
+    if (!(await isCanonicalDirectory(input.tree)) || !(await isCanonicalDirectory(input.hubRoot)))
+        return [indeterminate("root-not-canonical")];
+    const command = await verifiedBin(input.hubRoot);
+    if (command === undefined)
+        return [indeterminate("engine-missing-bin")];
+    // 4. Launch, in a scratch working directory, under the allow-list environment.
+    const run = ports.spawn ?? spawnLockfileTool;
+    let scratch;
+    try {
+        scratch = await prepareLockfileScratch();
+    }
+    catch {
+        return [indeterminate("engine-failed")];
+    }
+    let result;
+    try {
+        const env = lockfileToolEnv({ tool: "npm", scratch: scratch.path, registry: PACKAGE_SCOPE.registry, corepack: false, parent: process.env });
+        // The bin's `#!/usr/bin/env node` must find the node that is running this code.
+        env.PATH = `${dirname(process.execPath)}${delimiter}${env.PATH ?? ""}`;
+        result = await run({
+            command,
+            args: ["--cwd", input.tree, "--registry", PACKAGE_SCOPE.registry],
+            cwd: scratch.path,
+            env,
+            timeoutMs: PROVENANCE_CHECK_TIMEOUT_MS,
+            maxBuffer: PROVENANCE_CHECK_MAX_BUFFER,
+        });
+    }
+    catch {
+        result = undefined;
+    }
+    finally {
+        try {
+            await scratch.remove();
+        }
+        catch {
+            // The verdict does not depend on the scratch's removal, and it is under the OS temp root.
+        }
+    }
+    if (result === undefined)
+        return [indeterminate("engine-failed")];
+    const failure = launchFailure(result);
+    if (failure !== undefined)
+        return [indeterminate(failure)];
+    // 5 and 6. The report, and whether it agrees with its exit code.
+    const report = typeof result.stdout === "string" ? readReport(result.stdout) : undefined;
+    if (report === undefined)
+        return [indeterminate("report-unreadable")];
+    if (!agreesWithExit(result.status, report))
+        return [indeterminate("report-contradicts-exit")];
+    // 7 and 8. Each gated package, by exact name and exact version.
+    const indeterminateRules = new Set();
+    const violatedRules = new Set();
+    for (const pkg of gated) {
+        const entries = report.packages.filter((entry) => entry.name === pkg.name);
+        if (entries.length === 0) {
+            indeterminateRules.add("package-not-in-report");
+            continue;
+        }
+        if (entries.some((entry) => entry.installedVersion !== pkg.version)) {
+            violatedRules.add("version-mismatch");
+            continue;
+        }
+        // The report already agrees with its exit code, so no entry is indeterminate; this is the same refusal kept local.
+        if (entries.some((entry) => entry.state === "indeterminate")) {
+            indeterminateRules.add("package-indeterminate");
+            continue;
+        }
+        if (entries.every((entry) => entry.state === "verified"))
+            continue;
+        // Unverified at the act's own version: violated, with no exception.
+        violatedRules.add("provenance-unverified");
+    }
+    // 9. Indeterminate wins over violated; a satisfied entry never sits beside a refusal.
+    if (indeterminateRules.size > 0)
+        return distinctRules("indeterminate", indeterminateRules);
+    if (violatedRules.size > 0)
+        return distinctRules("violated", violatedRules);
+    return [{ check: "V9", verdict: "satisfied" }];
+}
+//# sourceMappingURL=provenance-gate.js.map

package/dist/provenance-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance-gate.js","sourceRoot":"","sources":["../src/provenance-gate.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,mEAAmE;AACnE,8EAA8E;AAC9E,kEAAkE;AAClE,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,+EAA+E;AAC/E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,+EAA+E;AAC/E,yEAAyE;AACzE,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,wDAAwD;AACxD,yCAAyC;AAEzC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAG/F,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAClE,4CAA4C;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,OAAO,CAAC;AACnD,wFAAwF;AACxF,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAgBrD,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA0B;IAC/D,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wFAAwF,CAAC,CAAC;IACnK,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,eAAe,CAAC;QACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC1I,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;AACtG,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAE5F,qFAAqF;AACrF,SAAS,aAAa,CAAC,OAAqC,EAAE,KAA0B;IACtF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/H,CAAC;AAWD;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAA+B;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;YAAE,SAAS;QACtG,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAChF,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,uEAAuE;AACvE,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,MAAc,EAAE,KAAa;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAChF,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,SAAS,CAAC;QACvG,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACnH,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAmBD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3F,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzI,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoC,EAAE;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;IAC1D,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC,CAAC;AACF,MAAM,OAAO,GAAG,CAAC,KAAc,EAAyB,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,eAAe,CAAC;AACrI,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;AAEhF,uFAAuF;AACvF,SAAS,WAAW,CAAC,KAA8B,EAAE,OAA4B;IAC/E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,2BAA2B;QAAE,OAAO,SAAS,CAAC;IACvF,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAClI,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,eAAe,KAAK,aAAa,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAChH,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,QAAqB,EAAE,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QACjF,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACxG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAE,OAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QACxF,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,0HAA0H;AAC1H,SAAS,cAAc,CAAC,MAAa,EAAE,MAAwB;IAC7D,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;IACnJ,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;AACzK,CAAC;AAED,kHAAkH;AAClH,SAAS,aAAa,CAAC,MAA2B;IAChD,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;QAAE,OAAO,oBAAoB,CAAC;IAChE,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA0B,EAAE,QAA6B,EAAE;IAClG,oBAAoB;IACpB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAEvE,gCAAgC;IAChC,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC5I,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAExE,+EAA+E;IAC/E,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,IAAI,iBAAiB,CAAC;IAC7C,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5I,gFAAgF;QAChF,GAAG,CAAC,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,GAAG,MAAM,GAAG,CAAC;YACjB,OAAO;YACP,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC;YACjE,GAAG,EAAE,OAAO,CAAC,IAAI;YACjB,GAAG;YACH,SAAS,EAAE,2BAA2B;YACtC,SAAS,EAAE,2BAA2B;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;QAC5F,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,iEAAiE;IACjE,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAe,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,aAAa,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAEvG,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,kBAAkB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,KAAK,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,mHAAmH;QACnH,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;YAC7D,kBAAkB,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC;YAAE,SAAS;QACnE,oEAAoE;QACpE,aAAa,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED,sFAAsF;IACtF,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC3F,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC5E,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC"}

package/dist/pull-request-body.d.ts

@@ -0,0 +1,45 @@
+import type { ApprovalBinding, RepositoryChangeSet } from "./change-set-contract.js";
+export type PullRequestRefusalReason = "change-set-invalid" | "title-mismatch" | "binding-invalid" | "binding-phase-mismatch" | "task-record-invalid" | "supersedes-invalid" | "value-unsafe" | "body-invalid" | "render-failed";
+/** A refusal: a fixed token, never a value. */
+export interface PullRequestRefusal {
+    readonly state: "refused";
+    readonly reason: PullRequestRefusalReason;
+}
+export interface RenderPullRequestInput {
+    readonly set: RepositoryChangeSet;
+    /** What admission decided for this set (decideSetBinding). It is shown, not checked here beyond its shape. */
+    readonly binding: ApprovalBinding;
+    /** The number of the task-record issue in the target repository: a positive safe integer. */
+    readonly taskRecord: number;
+    /**
+     * The numbers of the pull requests of older change sets this one replaces (RFC section 6, D6): each a positive safe integer,
+     * none repeated and none the task record. Written ascending under `## Supersedes`. Absent or empty: no such section, and the
+     * body is the one it was without this option.
+     */
+    readonly supersedes?: readonly number[];
+}
+export interface PullRequestText {
+    readonly state: "rendered";
+    readonly title: string;
+    readonly body: string;
+    /** `sha256:` and the hex SHA-256 of the body's UTF-8 bytes. */
+    readonly bodySha256: string;
+}
+/**
+ * The change-set digest a body carries, or null. Exactly one line must be
+ * exactly `<!-- clossys-change-set: sha256:<64 hex> -->`, and the marker's
+ * name must appear nowhere else in the body, so a second marker line, or a
+ * marker inside another line, reads as none.
+ */
+export declare function readChangeSetMarker(body: string): string | null;
+/**
+ * The pull request title and body for one stored change set. The title is
+ * exactly `set.pullRequest.title`, which must be `Clossys: apply plan ` and
+ * the first 12 hex digits of the set's own digest. Refuses a set that fails
+ * validateRepositoryChangeSet or whose digest does not recompute, a malformed
+ * binding, an `admitted` binding on a setup set, a task record that is not a
+ * positive safe integer, and any value it cannot prove safe to write. Never
+ * throws.
+ */
+export declare function renderPullRequest(input: RenderPullRequestInput): PullRequestText | PullRequestRefusal;
+//# sourceMappingURL=pull-request-body.d.ts.map

package/dist/pull-request-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull-request-body.d.ts","sourceRoot":"","sources":["../src/pull-request-body.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,eAAe,EAAiB,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGpG,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,wBAAwB,GACxB,qBAAqB,GACrB,oBAAoB,GACpB,cAAc,GACd,cAAc,GACd,eAAe,CAAC;AAEpB,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,8GAA8G;IAC9G,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAyCD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM/D;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,eAAe,GAAG,kBAAkB,CAMrG"}

package/dist/pull-request-body.js

@@ -0,0 +1,232 @@
+// The title and body of one repository's pull request (issue #1178; the apply
+// RFC's section 6 body marker, threat T6, decision D31 and section 12.7, in the
+// public repository, not shipped in this package). A pure function of three
+// inputs: a stored change set, the ApprovalBinding admission decided for it,
+// and the number of the task-record issue. It reads nothing, writes nothing and
+// opens nothing; a later step decides the binding, passes it in, records
+// `bodySha256` and hands the text to the agent that opens the pull request.
+// The caller may also pass the numbers of the older pull requests this one
+// replaces; they are written ascending under `## Supersedes` and nothing else.
+//
+// This is a public-safety surface, so every ambiguity refuses:
+//
+// - The text carries ids, act names, versions and digests only: never a brief,
+//   plan prose, `texts`, a key value, a path or a file's contents. Every value
+//   is matched against its own strict pattern before it is written, and any
+//   that holds `<`, `>`, a backtick, `|`, a carriage return or a line feed is
+//   refused, so no value can start a marker, close a code span or add a line.
+// - Each value is written inside a code span, so a package name such as
+//   `@scope/name` is never read by GitHub as a mention.
+// - The body opens with the one marker line and holds no other, and it is read
+//   back with readChangeSetMarker before it is returned.
+// - The renderer does not decide the binding: it shows what the caller passes.
+//   It does not check that the task-record issue exists, and it cannot stop a
+//   pull request's body being edited after it is opened; `bodySha256` and the
+//   marker are how a later `status` sees that.
+//
+// A refusal carries a fixed token, never an id, a digest or any input text.
+import { createHash } from "node:crypto";
+import { validateRepositoryChangeSet } from "./change-set-contract.js";
+import { changeSetDigest } from "./change-set-digest.js";
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+const TITLE = /^Clossys: apply plan [0-9a-f]{12}$/u;
+const MARKER_LINE = /^<!-- clossys-change-set: (sha256:[0-9a-f]{64}) -->$/u;
+const REPOSITORY_ID = /^(?:[A-Za-z0-9][A-Za-z0-9-]{0,38}\/)?[A-Za-z0-9._-]{1,100}$/u;
+// 355 characters: a repository id of up to 140, a colon and a package name of up to 214 (the planItem the contract derives, C16).
+const ITEM_ID = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,354}$/u;
+const ID_TOKEN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const PACKAGE_NAME = /^(?=.{1,214}$)@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/u;
+const EXACT_VERSION = /^(?:0|[1-9][0-9]{0,15})\.(?:0|[1-9][0-9]{0,15})\.(?:0|[1-9][0-9]{0,15})$/u;
+const UNSAFE = /[<>`|\r\n]/u;
+const PRINTABLE_LINES = /^[\x20-\x7e\n]*$/u;
+const MARKER_WORD = /clossys-change-set/giu;
+const PHASES = new Set(["setup", "apply"]);
+const ACTS = new Set([
+    "write-record",
+    "compose-skills",
+    "install",
+    "pin-starter",
+    "exempt-release-age",
+    "declare-root-entry",
+    "write-ledger",
+    "add-caller-workflow",
+    "write-starter-request",
+    "add-ci-template",
+    "add-path-scope-job",
+]);
+const refuse = (reason) => ({ state: "refused", reason });
+/** A value that may be interpolated: a string that matches its own pattern and holds nothing that could start a marker, close a code span or add a line. */
+function safe(value, pattern) {
+    return typeof value === "string" && !UNSAFE.test(value) && pattern.test(value);
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const sha256Of = (text) => `sha256:${createHash("sha256").update(Buffer.from(text, "utf8")).digest("hex")}`;
+/**
+ * The change-set digest a body carries, or null. Exactly one line must be
+ * exactly `<!-- clossys-change-set: sha256:<64 hex> -->`, and the marker's
+ * name must appear nowhere else in the body, so a second marker line, or a
+ * marker inside another line, reads as none.
+ */
+export function readChangeSetMarker(body) {
+    if (typeof body !== "string")
+        return null;
+    const found = body.split("\n").flatMap((line) => MARKER_LINE.exec(line)?.[1] ?? []);
+    if (found.length !== 1)
+        return null;
+    if ((body.match(MARKER_WORD) ?? []).length !== 1)
+        return null;
+    return found[0];
+}
+function itemLine(item) {
+    if (!safe(item.id, ITEM_ID) || typeof item.act !== "string" || !ACTS.has(item.act))
+        return null;
+    if (item.act !== "install" && item.act !== "pin-starter")
+        return `- \`${item.id}\` \`${item.act}\``;
+    if (!safe(item.package.name, PACKAGE_NAME) || !safe(item.package.version, EXACT_VERSION))
+        return null;
+    return `- \`${item.id}\` \`${item.act}\` \`${item.package.name}@${item.package.version}\``;
+}
+function bindingLines(binding, set) {
+    if (!isRecord(binding))
+        return refuse("binding-invalid");
+    const keys = Object.keys(binding).sort().join(",");
+    if (binding.kind === "approved") {
+        if (keys !== "kind,subjectDigest" || !safe(binding.subjectDigest, DIGEST))
+            return refuse("binding-invalid");
+        return ["- Binding: `approved`", `- Approved subject: \`${binding.subjectDigest}\``];
+    }
+    if (binding.kind === "admitted") {
+        if (keys !== "kind,setupChangeSet,subjectDigest" || !safe(binding.subjectDigest, DIGEST) || !safe(binding.setupChangeSet, DIGEST))
+            return refuse("binding-invalid");
+        if (set.phase !== "apply")
+            return refuse("binding-phase-mismatch");
+        // Admission never binds a set to itself, or to the bundle that holds the set.
+        if (binding.setupChangeSet === set.changeSetDigest || binding.subjectDigest === set.bundle)
+            return refuse("binding-invalid");
+        return ["- Binding: `admitted`", `- Admitted subject: \`${binding.subjectDigest}\``, `- Setup change set: \`${binding.setupChangeSet}\``];
+    }
+    return refuse("binding-invalid");
+}
+/**
+ * The pull request title and body for one stored change set. The title is
+ * exactly `set.pullRequest.title`, which must be `Clossys: apply plan ` and
+ * the first 12 hex digits of the set's own digest. Refuses a set that fails
+ * validateRepositoryChangeSet or whose digest does not recompute, a malformed
+ * binding, an `admitted` binding on a setup set, a task record that is not a
+ * positive safe integer, and any value it cannot prove safe to write. Never
+ * throws.
+ */
+export function renderPullRequest(input) {
+    try {
+        return render(input);
+    }
+    catch {
+        return refuse("render-failed");
+    }
+}
+function render(input) {
+    const { taskRecord } = input;
+    if (typeof taskRecord !== "number" || !Number.isSafeInteger(taskRecord) || taskRecord < 1)
+        return refuse("task-record-invalid");
+    // Read once, like the set: what is checked is what is written. Only a list of distinct positive safe integers other than the task record passes.
+    let supersedes = [];
+    if (input.supersedes !== undefined) {
+        let read;
+        try {
+            read = JSON.parse(JSON.stringify(input.supersedes));
+        }
+        catch {
+            return refuse("supersedes-invalid");
+        }
+        if (!Array.isArray(read))
+            return refuse("supersedes-invalid");
+        for (const entry of read)
+            if (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 1 || entry === taskRecord)
+                return refuse("supersedes-invalid");
+        supersedes = read.slice().sort((left, right) => left - right);
+        if (supersedes.some((entry, index) => index > 0 && entry === supersedes[index - 1]))
+            return refuse("supersedes-invalid");
+    }
+    // One snapshot, so a getter or a proxy cannot show the checks one value and the text another.
+    let set;
+    let binding;
+    try {
+        set = JSON.parse(JSON.stringify(input.set));
+    }
+    catch {
+        return refuse("change-set-invalid");
+    }
+    try {
+        binding = JSON.parse(JSON.stringify(input.binding));
+    }
+    catch {
+        return refuse("binding-invalid");
+    }
+    if (!validateRepositoryChangeSet(set).valid || changeSetDigest(set) !== set.changeSetDigest)
+        return refuse("change-set-invalid");
+    // The contract's rule C5 already ties the title to the digest; this is the same rule, held here too.
+    const digest = set.changeSetDigest;
+    if (!safe(digest, DIGEST))
+        return refuse("change-set-invalid");
+    if (!safe(set.pullRequest.title, TITLE) || set.pullRequest.title !== `Clossys: apply plan ${digest.slice("sha256:".length, "sha256:".length + 12)}`)
+        return refuse("title-mismatch");
+    const bound = bindingLines(binding, set);
+    if (!Array.isArray(bound))
+        return bound;
+    const repositoryId = set.repository.id;
+    if (!safe(repositoryId, REPOSITORY_ID) || repositoryId === "." || repositoryId === ".." || repositoryId.endsWith("/.") || repositoryId.endsWith("/.."))
+        return refuse("value-unsafe");
+    if (typeof set.phase !== "string" || !PHASES.has(set.phase))
+        return refuse("value-unsafe");
+    if (!safe(set.planDigest, DIGEST) || !safe(set.bundle, DIGEST))
+        return refuse("value-unsafe");
+    const items = [];
+    for (const item of set.items) {
+        const line = itemLine(item);
+        if (line === null)
+            return refuse("value-unsafe");
+        items.push(line);
+    }
+    const notes = [];
+    for (const deferral of set.deferred) {
+        if (!safe(deferral.planItem, ITEM_ID) || !safe(deferral.reason, ID_TOKEN))
+            return refuse("value-unsafe");
+        notes.push(`- Deferred: \`${deferral.planItem}\` \`${deferral.reason}\``);
+    }
+    for (const refusal of set.refused) {
+        if (!safe(refusal.item, ITEM_ID) || !safe(refusal.reason, ID_TOKEN))
+            return refuse("value-unsafe");
+        notes.push(`- Refused: \`${refusal.item}\` \`${refusal.reason}\``);
+    }
+    const lines = [
+        `<!-- clossys-change-set: ${digest} -->`,
+        "",
+        "## Change set",
+        "",
+        `- Repository: \`${repositoryId}\``,
+        `- Phase: \`${set.phase}\``,
+        `- Change set: \`${digest}\``,
+        `- Plan: \`${set.planDigest}\``,
+        `- Bundle: \`${set.bundle}\``,
+        "",
+        "## Binding",
+        "",
+        ...bound,
+        "",
+        "## Items",
+        "",
+        ...items,
+        ...(notes.length === 0 ? [] : ["", "## Not applied", "", ...notes]),
+        ...(supersedes.length === 0 ? [] : ["", "## Supersedes", "", ...supersedes.map((number) => `- #${number}`)]),
+        "",
+        "## Task record",
+        "",
+        `- #${taskRecord}`,
+    ];
+    const body = `${lines.join("\n")}\n`;
+    // The last word: printable ASCII and line feeds only, no line feed at the end but one, and the marker reads back as this set's digest.
+    if (!PRINTABLE_LINES.test(body) || body.endsWith("\n\n") || readChangeSetMarker(body) !== digest || !body.startsWith(`<!-- clossys-change-set: ${digest} -->\n`))
+        return refuse("body-invalid");
+    return { state: "rendered", title: set.pullRequest.title, body, bodySha256: sha256Of(body) };
+}
+//# sourceMappingURL=pull-request-body.js.map

package/dist/pull-request-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull-request-body.js","sourceRoot":"","sources":["../src/pull-request-body.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,+EAA+E;AAC/E,EAAE;AACF,+DAA+D;AAC/D,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,wDAAwD;AACxD,+EAA+E;AAC/E,yDAAyD;AACzD,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,+CAA+C;AAC/C,EAAE;AACF,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAyCzD,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,KAAK,GAAG,qCAAqC,CAAC;AACpD,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAC5E,MAAM,aAAa,GAAG,8DAA8D,CAAC;AACrF,kIAAkI;AAClI,MAAM,OAAO,GAAG,wCAAwC,CAAC;AACzD,MAAM,QAAQ,GAAG,6BAA6B,CAAC;AAC/C,MAAM,YAAY,GAAG,6DAA6D,CAAC;AACnF,MAAM,aAAa,GAAG,2EAA2E,CAAC;AAClG,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAC5C,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,MAAM,IAAI,GAAwB,IAAI,GAAG,CAAC;IACxC,cAAc;IACd,gBAAgB;IAChB,SAAS;IACT,aAAa;IACb,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,qBAAqB;IACrB,uBAAuB;IACvB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,MAAgC,EAAsB,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAExG,4JAA4J;AAC5J,SAAS,IAAI,CAAC,KAAc,EAAE,OAAe;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE5I,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAE5H;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAmB;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChG,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa;QAAE,OAAO,OAAO,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,GAAG,IAAI,CAAC;IACpG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACtG,OAAO,OAAO,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB,EAAE,GAAwB;IAC9D,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,oBAAoB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC5G,OAAO,CAAC,uBAAuB,EAAE,yBAAyB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,mCAAmC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACpK,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;QACnE,8EAA8E;QAC9E,IAAI,OAAO,CAAC,cAAc,KAAK,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,aAAa,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC7H,OAAO,CAAC,uBAAuB,EAAE,yBAAyB,OAAO,CAAC,aAAa,IAAI,EAAE,yBAAyB,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAA6B;IAC3C,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEhI,iJAAiJ;IACjJ,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,IAAiB;YAAE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,UAAU;gBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC/K,UAAU,GAAI,IAAiB,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3H,CAAC;IAED,8FAA8F;IAC9F,IAAI,GAAwB,CAAC;IAC7B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAwB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,eAAe;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEjI,qGAAqG;IACrG,MAAM,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAErL,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,MAAM,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,IAAI,YAAY,KAAK,GAAG,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IACtL,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAC3F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAE9F,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QACzG,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,QAAQ,QAAQ,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QACnG,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,QAAQ,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,4BAA4B,MAAM,MAAM;QACxC,EAAE;QACF,eAAe;QACf,EAAE;QACF,mBAAmB,YAAY,IAAI;QACnC,cAAc,GAAG,CAAC,KAAK,IAAI;QAC3B,mBAAmB,MAAM,IAAI;QAC7B,aAAa,GAAG,CAAC,UAAU,IAAI;QAC/B,eAAe,GAAG,CAAC,MAAM,IAAI;QAC7B,EAAE;QACF,YAAY;QACZ,EAAE;QACF,GAAG,KAAK;QACR,EAAE;QACF,UAAU;QACV,EAAE;QACF,GAAG,KAAK;QACR,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC;QACnE,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5G,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,MAAM,UAAU,EAAE;KACnB,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAErC,uIAAuI;IACvI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,4BAA4B,MAAM,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IAChM,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/F,CAAC"}