@clossys/writer 0.3.2

package/dist/voice/index.js

@@ -0,0 +1,24 @@
+/**
+ * @clossys/writer/voice — public entry point. See README.md for the full
+ * picture: the machinery-vs-values split this package mirrors from
+ * @example/ui/tokens, exactly what `checkCopy` does and does not
+ * attempt, and the `factRef` seam into a separate `strategy` package this
+ * package deliberately does not import from.
+ */
+export { FORMALITY_LEVELS, GLOSSARY_STATUSES, VOICE_SEVERITIES } from "./types.js";
+export { VOICE_FIELDS, TEMPLATE_PLACEHOLDER } from "./fields.js";
+export { validateVoiceRecordShape, parseVoiceRecord } from "./schema.js";
+export { checkCopy, auditClaimsRegister, isCiBlockingSeverity } from "./checker.js";
+// The other half of the seam `@example/strategy`'s
+// `checkBrandCoverage` documents but cannot itself close (it does not, and
+// cannot, import this package) — see `derivation-coverage.ts`'s top-of-file
+// doc comment for the full account of the gap this closes.
+export { checkVoiceDerivationCoverage } from "./derivation-coverage.js";
+// The regex-safety gate itself — exported so a consumer can validate a
+// pattern (e.g. in an editor/CI step, before it ever reaches a VoiceRecord)
+// using the exact same logic schema.ts/checker.ts already run internally,
+// rather than reimplementing or second-guessing it. See
+// `internal/pattern-safety.ts`'s top doc comment for the full, documented
+// regex-safety position this package takes.
+export { checkPatternSafety } from "./internal/pattern-safety.js";
+//# sourceMappingURL=index.js.map

package/dist/voice/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/voice/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAiBnF,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAUpF,mDAAmD;AACnD,2EAA2E;AAC3E,4EAA4E;AAC5E,2DAA2D;AAC3D,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAGxE,uEAAuE;AACvE,4EAA4E;AAC5E,0EAA0E;AAC1E,wDAAwD;AACxD,0EAA0E;AAC1E,4CAA4C;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/voice/internal/parse-template.d.ts

@@ -0,0 +1,27 @@
+/**
+ * A minimal, test-only JSONC reader for `templates/voice-record.template.jsonc`
+ * — NOT part of this package's public API (nothing under `src/internal/` is
+ * reachable from `src/index.ts`, and `package.json#exports` never points
+ * here). It exists solely so `src/field-coverage.test.ts` can parse the
+ * template as data and check it against `src/fields.ts`'s `VOICE_FIELDS`,
+ * without pulling in a real JSONC parser as a dependency this package would
+ * otherwise have zero reason to carry — the same call `@example/ui/tokens`
+ * makes for `src/internal/parse-css.ts`.
+ */
+/** Parses `text` as JSONC (JSON plus `//` and `/* *\/` comments). Throws the underlying `JSON.parse` error, with position information, if the stripped result still isn't valid JSON. */
+export declare function parseTemplate(text: string): unknown;
+/**
+ * Flattens `value` into the set of dot-paths `src/fields.ts`'s `VOICE_FIELDS`
+ * uses, matching its own "a leaf, not a tree" rule: a plain object's keys
+ * are walked recursively, but an ARRAY is recorded as a single path (its
+ * own) and never descended into — `glossary` and `claims` are each one
+ * path, not `glossary.0.term`, `glossary.1.term`, ..., because an array's
+ * LENGTH and CONTENTS are exactly the bindable data a consumer supplies, not
+ * more structure for this function to enumerate. See `fields.ts`'s header
+ * comment, "A leaf, not a tree", for the full reasoning — this function is
+ * that rule's mechanical mirror image, the same relationship
+ * `findAllCustomPropertyNames` in `@example/ui/tokens`' own
+ * `internal/parse-css.ts` has to that package's `brand-template.css`.
+ */
+export declare function extractFieldPaths(value: unknown, prefix?: string): Set<string>;
+//# sourceMappingURL=parse-template.d.ts.map

package/dist/voice/internal/parse-template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-template.d.ts","sourceRoot":"","sources":["../../../src/voice/internal/parse-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA2DH,yLAAyL;AACzL,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,SAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CA2B1E"}

package/dist/voice/internal/parse-template.js

@@ -0,0 +1,111 @@
+/**
+ * A minimal, test-only JSONC reader for `templates/voice-record.template.jsonc`
+ * — NOT part of this package's public API (nothing under `src/internal/` is
+ * reachable from `src/index.ts`, and `package.json#exports` never points
+ * here). It exists solely so `src/field-coverage.test.ts` can parse the
+ * template as data and check it against `src/fields.ts`'s `VOICE_FIELDS`,
+ * without pulling in a real JSONC parser as a dependency this package would
+ * otherwise have zero reason to carry — the same call `@example/ui/tokens`
+ * makes for `src/internal/parse-css.ts`.
+ */
+/**
+ * Strips `//` line comments and `/* *\/` block comments from `text`,
+ * WITHOUT touching either kind of sequence when it appears inside a JSON
+ * string literal (`"a // not a comment"`, `"a /* not one either *\/"`) —
+ * the one thing a naive regex-replace over the whole file gets wrong. Walks
+ * the text one character at a time, tracking exactly one piece of state
+ * (whether the cursor is inside a string, honoring `\"` escapes) so a `//`
+ * or `/*` that is really just part of a quoted value is copied through
+ * unchanged rather than eaten.
+ */
+function stripJsonComments(text) {
+    let out = "";
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const ch = text[i];
+        const next = text[i + 1];
+        if (inString) {
+            out += ch;
+            if (ch === "\\") {
+                // Copy the escaped character too, unexamined — this is what keeps
+                // `\"` from prematurely ending the string and `\\` from being
+                // mistaken for the start of a second escape.
+                if (i + 1 < text.length) {
+                    out += text[i + 1];
+                    i++;
+                }
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+            out += "\n"; // preserve line numbering for anyone debugging a parse error
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            i += 2;
+            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+                i++;
+            i++; // land on the trailing '/'
+            continue;
+        }
+        out += ch;
+    }
+    return out;
+}
+/** Parses `text` as JSONC (JSON plus `//` and `/* *\/` comments). Throws the underlying `JSON.parse` error, with position information, if the stripped result still isn't valid JSON. */
+export function parseTemplate(text) {
+    return JSON.parse(stripJsonComments(text));
+}
+/**
+ * Flattens `value` into the set of dot-paths `src/fields.ts`'s `VOICE_FIELDS`
+ * uses, matching its own "a leaf, not a tree" rule: a plain object's keys
+ * are walked recursively, but an ARRAY is recorded as a single path (its
+ * own) and never descended into — `glossary` and `claims` are each one
+ * path, not `glossary.0.term`, `glossary.1.term`, ..., because an array's
+ * LENGTH and CONTENTS are exactly the bindable data a consumer supplies, not
+ * more structure for this function to enumerate. See `fields.ts`'s header
+ * comment, "A leaf, not a tree", for the full reasoning — this function is
+ * that rule's mechanical mirror image, the same relationship
+ * `findAllCustomPropertyNames` in `@example/ui/tokens`' own
+ * `internal/parse-css.ts` has to that package's `brand-template.css`.
+ */
+export function extractFieldPaths(value, prefix = "") {
+    const paths = new Set();
+    if (Array.isArray(value)) {
+        if (prefix)
+            paths.add(prefix);
+        return paths;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const [key, nestedValue] of Object.entries(value)) {
+            const path = prefix ? `${prefix}.${key}` : key;
+            const nestedPaths = extractFieldPaths(nestedValue, path);
+            if (nestedPaths.size === 0) {
+                // A leaf with no nested paths of its own (a string, number, boolean,
+                // null, or an empty object) is still a real field — record it directly.
+                paths.add(path);
+            }
+            else {
+                for (const nestedPath of nestedPaths)
+                    paths.add(nestedPath);
+            }
+        }
+        return paths;
+    }
+    // A scalar reached with no prefix (extractFieldPaths called on a bare
+    // string/number/etc. at the root) has nothing to name — nothing to add.
+    if (prefix)
+        paths.add(prefix);
+    return paths;
+}
+//# sourceMappingURL=parse-template.js.map

package/dist/voice/internal/parse-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-template.js","sourceRoot":"","sources":["../../../src/voice/internal/parse-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEzB,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,kEAAkE;gBAClE,8DAA8D;gBAC9D,6CAA6C;gBAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBACxB,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACnB,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YAChD,GAAG,IAAI,IAAI,CAAC,CAAC,6DAA6D;YAC1E,SAAS;QACX,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC/B,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzE,CAAC,EAAE,CAAC,CAAC,2BAA2B;YAChC,SAAS;QACX,CAAC;QAED,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yLAAyL;AACzL,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,MAAM,GAAG,EAAE;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/C,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC3B,qEAAqE;gBACrE,wEAAwE;gBACxE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,UAAU,IAAI,WAAW;oBAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,IAAI,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/voice/internal/pattern-safety.d.ts

@@ -0,0 +1,111 @@
+/**
+ * The regex-safety gate for `PatternRule.pattern` (see `../types.ts`) —
+ * shared by `../schema.ts` (registration-time validation, when a
+ * `VoiceRecord` is parsed from raw data) and `../checker.ts`
+ * (defense-in-depth at check time, since `checkCopy` deliberately does not
+ * trust its `VoiceRecord` argument — see that file's own doc comment).
+ *
+ * THE POSITION THIS PACKAGE TAKES ON REGEX SAFETY, STATED ONCE, IN FULL:
+ * bound the pattern at REGISTRATION TIME, never at run time. There is no
+ * runtime timeout, no worker thread, no execution sandbox anywhere in this
+ * package — Node has no synchronous way to cancel a regex mid-match, and a
+ * background-thread-plus-timeout scheme is real infrastructure this
+ * package's zero-dependency, synchronous, pure-function design (see
+ * `../types.ts`'s header comment) has no room for. Instead, `checkPatternSafety`
+ * below performs a STATIC analysis of the pattern's SOURCE TEXT and refuses
+ * to compile — reports as a finding, never silently drops (see `../schema.ts`
+ * and `../checker.ts`) — any pattern this analysis cannot bound:
+ *
+ *   1. Disallowed flags. Only `i` (case-insensitive), `u` (unicode), and `s`
+ *      (dotAll) are accepted. `g`/`y` (global/sticky) are rejected because
+ *      this package always does its own counting pass (see
+ *      `countPatternMatches`) — accepting a caller's own `g`/`y` would only
+ *      invite `lastIndex`-statefulness bugs for zero benefit. `m`
+ *      (multiline) is rejected too: this package matches a pattern against a
+ *      single piece of copy, never multi-line source text where `^`/`$`
+ *      anchors are meant to bind per-line — accepting `m` would silently
+ *      change what `^`/`$` mean in exactly the case most likely to surprise
+ *      an author.
+ *   2. Pattern length. `source.length > MAX_PATTERN_SOURCE_LENGTH` (200) is
+ *      rejected outright — a voice rule is a short, auditable phrase or
+ *      character ban, never a novel-length expression, and a hard length
+ *      cap bounds every other check's own work too.
+ *   3. Backreferences (`\1`-`\9`, `\k<name>`). A well-known, independent
+ *      source of catastrophic backtracking, and one a voice/glossary rule
+ *      has essentially no legitimate use for — rejected outright, no
+ *      attempt to bound them.
+ *   4. Oversized bounded repetition (`{m,n}` or `{m}` whose effective upper
+ *      bound exceeds `MAX_QUANTIFIER_BOUND`, 50). A large-but-bounded repeat
+ *      count is still a real cost multiplier, especially combined with
+ *      other repeats elsewhere in the same pattern.
+ *   5. NESTED QUANTIFIERS — the classic `(a+)+` / `(a*)*` / `(.*)+` shape
+ *      that causes real exponential-time catastrophic backtracking.
+ *      Detected via a hand-rolled structural scan (`analyzePatternSource`
+ *      below): any quantifier (bounded or unbounded — `*`, `+`, `{m,}`, or
+ *      `{m,n}`) applied to a GROUP whose own top-level content already
+ *      contains an UNBOUNDED quantifier (`*`, `+`, or `{m,}` with no upper
+ *      bound) is rejected. Deliberately conservative in the direction of
+ *      REJECTING more than strictly necessary: a false positive (a pattern
+ *      that would actually have run fine) is merely annoying to its author;
+ *      a false negative here is a hung scanner, which this package will
+ *      never accept as the trade.
+ *
+ * WHAT THIS DOES NOT CATCH — stated honestly, not silently:
+ *
+ *   - Overlapping-alternation blowup (`(a|a)+`, `(a|ab)*`) that involves no
+ *     nested quantifier at all. A real, known ReDoS shape this static scan
+ *     does not detect — a full fix requires real regex-AST analysis (what
+ *     tools like `safe-regex` do), which this package's zero-dependency,
+ *     hand-rolled-scanner design does not attempt. Bounded in practice by
+ *     the length cap (rule 2) and the fact that this package only ever
+ *     matches a pattern against one short piece of product/marketing copy,
+ *     never arbitrary-length adversarial input — but this is a mitigation,
+ *     not a guarantee.
+ *   - Aggregate cost across many pattern rules evaluated against the same
+ *     `copy` string. Each pattern is bounded individually; the total cost of
+ *     a large `patterns` list is a volume concern for the record's author,
+ *     not something this gate polices.
+ *
+ * This is a real, bounded, DOCUMENTED static gate — not a general ReDoS
+ * detector, and this file does not claim to be one.
+ */
+/** Regex flags this package will construct a `RegExp` with. Anything else is rejected — see this file's top doc comment, point 1. */
+export declare const PATTERN_ALLOWED_FLAGS: ReadonlySet<string>;
+/** Hard cap on `pattern.source.length` — see this file's top doc comment, point 2. */
+export declare const MAX_PATTERN_SOURCE_LENGTH = 200;
+/** Hard cap on a bounded quantifier's effective upper bound (`{m,n}`/`{m}`) — see this file's top doc comment, point 4. */
+export declare const MAX_QUANTIFIER_BOUND = 50;
+export type PatternSafetyIssue = "pattern-source-shape" | "pattern-flags-shape" | "pattern-too-long" | "pattern-backreference" | "pattern-quantifier-bound-too-large" | "pattern-nested-quantifier" | "pattern-does-not-compile";
+export interface PatternSafetyOk {
+    ok: true;
+    regex: RegExp;
+}
+export interface PatternSafetyFailure {
+    ok: false;
+    issue: PatternSafetyIssue;
+    detail: string;
+}
+export type PatternSafetyResult = PatternSafetyOk | PatternSafetyFailure;
+/**
+ * The full registration-time (and defense-in-depth check-time) safety gate
+ * for one `VoicePattern`. `pattern` is `unknown`, not the `{ source, flags
+ * }` shape it will usually already be — this is called from both
+ * `../schema.ts` (validating raw, untrusted JSON, where `pattern` may be
+ * anything) and `../checker.ts` (re-checking a typed `VoiceRecord` this
+ * package's own `checkCopy` does not otherwise trust — see that file's doc
+ * comment; a hostile or malformed in-memory record could still hand this a
+ * non-object). Never throws, for any input.
+ */
+export declare function checkPatternSafety(pattern: unknown): PatternSafetyResult;
+/**
+ * Runs an ALREADY-SAFE (passed `checkPatternSafety`) regex against `copy`,
+ * counting non-overlapping matches — the pattern-rule analog of
+ * `../checker.ts`'s own `countMatches`, except this never wraps the source
+ * in `\b...\b`: a pattern rule's whole point is that the caller's regex IS
+ * the expression, unmodified. Always adds "g" for counting, regardless of
+ * what flags were validated — "g" is never an allowed caller-supplied flag
+ * (see `checkPatternSafety`), so this is the one place it is ever added,
+ * and only for this internal counting pass.
+ */
+export declare function countPatternMatches(copy: string, regex: RegExp): number;
+//# sourceMappingURL=pattern-safety.d.ts.map

package/dist/voice/internal/pattern-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-safety.d.ts","sourceRoot":"","sources":["../../../src/voice/internal/pattern-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,qIAAqI;AACrI,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CAA4B,CAAC;AAEnF,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,2HAA2H;AAC3H,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,MAAM,kBAAkB,GAC1B,sBAAsB,GACtB,qBAAqB,GACrB,kBAAkB,GAClB,uBAAuB,GACvB,oCAAoC,GACpC,2BAA2B,GAC3B,0BAA0B,CAAC;AAE/B,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG,eAAe,GAAG,oBAAoB,CAAC;AAyKzE;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAuCxE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvE"}

package/dist/voice/internal/pattern-safety.js

@@ -0,0 +1,278 @@
+/**
+ * The regex-safety gate for `PatternRule.pattern` (see `../types.ts`) —
+ * shared by `../schema.ts` (registration-time validation, when a
+ * `VoiceRecord` is parsed from raw data) and `../checker.ts`
+ * (defense-in-depth at check time, since `checkCopy` deliberately does not
+ * trust its `VoiceRecord` argument — see that file's own doc comment).
+ *
+ * THE POSITION THIS PACKAGE TAKES ON REGEX SAFETY, STATED ONCE, IN FULL:
+ * bound the pattern at REGISTRATION TIME, never at run time. There is no
+ * runtime timeout, no worker thread, no execution sandbox anywhere in this
+ * package — Node has no synchronous way to cancel a regex mid-match, and a
+ * background-thread-plus-timeout scheme is real infrastructure this
+ * package's zero-dependency, synchronous, pure-function design (see
+ * `../types.ts`'s header comment) has no room for. Instead, `checkPatternSafety`
+ * below performs a STATIC analysis of the pattern's SOURCE TEXT and refuses
+ * to compile — reports as a finding, never silently drops (see `../schema.ts`
+ * and `../checker.ts`) — any pattern this analysis cannot bound:
+ *
+ *   1. Disallowed flags. Only `i` (case-insensitive), `u` (unicode), and `s`
+ *      (dotAll) are accepted. `g`/`y` (global/sticky) are rejected because
+ *      this package always does its own counting pass (see
+ *      `countPatternMatches`) — accepting a caller's own `g`/`y` would only
+ *      invite `lastIndex`-statefulness bugs for zero benefit. `m`
+ *      (multiline) is rejected too: this package matches a pattern against a
+ *      single piece of copy, never multi-line source text where `^`/`$`
+ *      anchors are meant to bind per-line — accepting `m` would silently
+ *      change what `^`/`$` mean in exactly the case most likely to surprise
+ *      an author.
+ *   2. Pattern length. `source.length > MAX_PATTERN_SOURCE_LENGTH` (200) is
+ *      rejected outright — a voice rule is a short, auditable phrase or
+ *      character ban, never a novel-length expression, and a hard length
+ *      cap bounds every other check's own work too.
+ *   3. Backreferences (`\1`-`\9`, `\k<name>`). A well-known, independent
+ *      source of catastrophic backtracking, and one a voice/glossary rule
+ *      has essentially no legitimate use for — rejected outright, no
+ *      attempt to bound them.
+ *   4. Oversized bounded repetition (`{m,n}` or `{m}` whose effective upper
+ *      bound exceeds `MAX_QUANTIFIER_BOUND`, 50). A large-but-bounded repeat
+ *      count is still a real cost multiplier, especially combined with
+ *      other repeats elsewhere in the same pattern.
+ *   5. NESTED QUANTIFIERS — the classic `(a+)+` / `(a*)*` / `(.*)+` shape
+ *      that causes real exponential-time catastrophic backtracking.
+ *      Detected via a hand-rolled structural scan (`analyzePatternSource`
+ *      below): any quantifier (bounded or unbounded — `*`, `+`, `{m,}`, or
+ *      `{m,n}`) applied to a GROUP whose own top-level content already
+ *      contains an UNBOUNDED quantifier (`*`, `+`, or `{m,}` with no upper
+ *      bound) is rejected. Deliberately conservative in the direction of
+ *      REJECTING more than strictly necessary: a false positive (a pattern
+ *      that would actually have run fine) is merely annoying to its author;
+ *      a false negative here is a hung scanner, which this package will
+ *      never accept as the trade.
+ *
+ * WHAT THIS DOES NOT CATCH — stated honestly, not silently:
+ *
+ *   - Overlapping-alternation blowup (`(a|a)+`, `(a|ab)*`) that involves no
+ *     nested quantifier at all. A real, known ReDoS shape this static scan
+ *     does not detect — a full fix requires real regex-AST analysis (what
+ *     tools like `safe-regex` do), which this package's zero-dependency,
+ *     hand-rolled-scanner design does not attempt. Bounded in practice by
+ *     the length cap (rule 2) and the fact that this package only ever
+ *     matches a pattern against one short piece of product/marketing copy,
+ *     never arbitrary-length adversarial input — but this is a mitigation,
+ *     not a guarantee.
+ *   - Aggregate cost across many pattern rules evaluated against the same
+ *     `copy` string. Each pattern is bounded individually; the total cost of
+ *     a large `patterns` list is a volume concern for the record's author,
+ *     not something this gate polices.
+ *
+ * This is a real, bounded, DOCUMENTED static gate — not a general ReDoS
+ * detector, and this file does not claim to be one.
+ */
+/** Regex flags this package will construct a `RegExp` with. Anything else is rejected — see this file's top doc comment, point 1. */
+export const PATTERN_ALLOWED_FLAGS = new Set(["i", "u", "s"]);
+/** Hard cap on `pattern.source.length` — see this file's top doc comment, point 2. */
+export const MAX_PATTERN_SOURCE_LENGTH = 200;
+/** Hard cap on a bounded quantifier's effective upper bound (`{m,n}`/`{m}`) — see this file's top doc comment, point 4. */
+export const MAX_QUANTIFIER_BOUND = 50;
+function fail(issue, detail) {
+    return { ok: false, issue, detail };
+}
+/**
+ * Structural scan for backreferences and nested/oversized quantifiers — see
+ * this file's top doc comment for exactly what is and is not caught. Walks
+ * `source` one character at a time, tracking character-class state (`[...]`)
+ * and a group-nesting stack, exactly the same bounded, hand-rolled style
+ * `../../scan.ts`'s own tokenizer uses for JS/JSX (see that file's top doc
+ * comment) — no regex-of-regexes, no parser library. Returns the FIRST
+ * issue found, or `undefined` if the source passes this scan (compilation
+ * itself is checked separately, by the caller, via `new RegExp`).
+ */
+function analyzePatternSource(source) {
+    const n = source.length;
+    let i = 0;
+    let inClass = false;
+    const stack = [{ hasUnboundedQuantifier: false }];
+    // The frame belonging to the group that was JUST closed by the immediately
+    // preceding ")" — cleared by every other kind of token, since only a
+    // quantifier reading this value RIGHT AFTER a ")" means "applies to that
+    // group".
+    let lastClosedGroupFrame;
+    const applyUnboundedQuantifier = () => {
+        if (lastClosedGroupFrame?.hasUnboundedQuantifier) {
+            return fail("pattern-nested-quantifier", `a quantifier at offset ${i} applies to a group that itself contains an unbounded quantifier — this is the classic catastrophic-backtracking shape (e.g. "(a+)+"); rejected without attempting to run it`);
+        }
+        const top = stack[stack.length - 1];
+        if (top)
+            top.hasUnboundedQuantifier = true;
+        return undefined;
+    };
+    while (i < n) {
+        const c = source[i];
+        if (inClass) {
+            if (c === "\\") {
+                i += 2;
+            }
+            else if (c === "]") {
+                inClass = false;
+                i++;
+            }
+            else {
+                i++;
+            }
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        if (c === "\\") {
+            const next = source[i + 1];
+            if (next !== undefined && next >= "1" && next <= "9") {
+                return fail("pattern-backreference", `backreference "\\${next}" at offset ${i} — a known independent source of catastrophic backtracking, rejected outright`);
+            }
+            if (next === "k" && source[i + 2] === "<") {
+                return fail("pattern-backreference", `named backreference "\\k<...>" at offset ${i} — a known independent source of catastrophic backtracking, rejected outright`);
+            }
+            i += 2;
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        if (c === "[") {
+            inClass = true;
+            i++;
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        if (c === "(") {
+            stack.push({ hasUnboundedQuantifier: false });
+            i++;
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        if (c === ")") {
+            const closed = stack.pop();
+            if (!closed)
+                return fail("pattern-does-not-compile", `unmatched ")" at offset ${i}`);
+            i++;
+            lastClosedGroupFrame = closed;
+            continue;
+        }
+        if (c === "*" || c === "+") {
+            const issue = applyUnboundedQuantifier();
+            if (issue)
+                return issue;
+            i++;
+            if (source[i] === "?")
+                i++; // lazy modifier — still unbounded, does not change the analysis
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        if (c === "?") {
+            // A bounded (0-1) quantifier on the previous atom/group. Never marks
+            // the enclosing frame as unbounded, and a group with an inner
+            // unbounded quantifier wrapped as "(...)?" (applied at most once) is
+            // NOT the nested-quantifier shape this scan exists to catch.
+            i++;
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        if (c === "{") {
+            const close = source.indexOf("}", i);
+            const body = close === -1 ? undefined : source.slice(i + 1, close);
+            const match = body === undefined ? null : /^(\d+)(,(\d*))?$/.exec(body);
+            if (!match) {
+                // Not valid `{n}`/`{n,}`/`{n,m}` quantifier syntax — JS treats a
+                // lone "{" that doesn't form one of these as a literal character,
+                // not an error, so this scan does the same.
+                i++;
+                lastClosedGroupFrame = undefined;
+                continue;
+            }
+            const hasComma = match[2] !== undefined;
+            const upperText = match[3];
+            const unbounded = hasComma && (upperText === undefined || upperText === "");
+            if (unbounded) {
+                const issue = applyUnboundedQuantifier();
+                if (issue)
+                    return issue;
+            }
+            else {
+                const upper = hasComma ? Number(upperText) : Number(match[1]);
+                if (upper > MAX_QUANTIFIER_BOUND) {
+                    return fail("pattern-quantifier-bound-too-large", `quantifier "{${body}}" at offset ${i} has an upper bound of ${upper}, exceeding the maximum of ${MAX_QUANTIFIER_BOUND}`);
+                }
+                if (lastClosedGroupFrame?.hasUnboundedQuantifier) {
+                    return fail("pattern-nested-quantifier", `quantifier "{${body}}" at offset ${i} applies to a group that itself contains an unbounded quantifier`);
+                }
+            }
+            i = close + 1;
+            if (source[i] === "?")
+                i++;
+            lastClosedGroupFrame = undefined;
+            continue;
+        }
+        i++;
+        lastClosedGroupFrame = undefined;
+    }
+    if (stack.length !== 1) {
+        return fail("pattern-does-not-compile", `unbalanced "(" — ${stack.length - 1} group(s) never closed`);
+    }
+    return undefined;
+}
+/**
+ * The full registration-time (and defense-in-depth check-time) safety gate
+ * for one `VoicePattern`. `pattern` is `unknown`, not the `{ source, flags
+ * }` shape it will usually already be — this is called from both
+ * `../schema.ts` (validating raw, untrusted JSON, where `pattern` may be
+ * anything) and `../checker.ts` (re-checking a typed `VoiceRecord` this
+ * package's own `checkCopy` does not otherwise trust — see that file's doc
+ * comment; a hostile or malformed in-memory record could still hand this a
+ * non-object). Never throws, for any input.
+ */
+export function checkPatternSafety(pattern) {
+    if (typeof pattern !== "object" || pattern === null || Array.isArray(pattern)) {
+        return fail("pattern-source-shape", `pattern must be an object with a "source" string, got ${JSON.stringify(pattern)}`);
+    }
+    const source = pattern.source;
+    if (typeof source !== "string" || source.length === 0) {
+        return fail("pattern-source-shape", `pattern.source must be a non-empty string, got ${JSON.stringify(source)}`);
+    }
+    if (source.length > MAX_PATTERN_SOURCE_LENGTH) {
+        return fail("pattern-too-long", `pattern.source is ${source.length} character(s), exceeding the maximum of ${MAX_PATTERN_SOURCE_LENGTH}`);
+    }
+    const flags = pattern.flags;
+    if (flags !== undefined) {
+        if (typeof flags !== "string") {
+            return fail("pattern-flags-shape", `pattern.flags must be a string when present, got ${JSON.stringify(flags)}`);
+        }
+        for (const flag of flags) {
+            if (!PATTERN_ALLOWED_FLAGS.has(flag)) {
+                return fail("pattern-flags-shape", `pattern.flags "${flags}" contains "${flag}", which is not one of the allowed flags (${[...PATTERN_ALLOWED_FLAGS].join(", ")}) — see this file's top doc comment for why "g"/"y"/"m" are rejected`);
+            }
+        }
+    }
+    const structuralIssue = analyzePatternSource(source);
+    if (structuralIssue)
+        return structuralIssue;
+    try {
+        const regex = new RegExp(source, flags ?? "");
+        return { ok: true, regex };
+    }
+    catch (error) {
+        return fail("pattern-does-not-compile", error instanceof Error ? error.message : String(error));
+    }
+}
+/**
+ * Runs an ALREADY-SAFE (passed `checkPatternSafety`) regex against `copy`,
+ * counting non-overlapping matches — the pattern-rule analog of
+ * `../checker.ts`'s own `countMatches`, except this never wraps the source
+ * in `\b...\b`: a pattern rule's whole point is that the caller's regex IS
+ * the expression, unmodified. Always adds "g" for counting, regardless of
+ * what flags were validated — "g" is never an allowed caller-supplied flag
+ * (see `checkPatternSafety`), so this is the one place it is ever added,
+ * and only for this internal counting pass.
+ */
+export function countPatternMatches(copy, regex) {
+    const counting = new RegExp(regex.source, regex.flags.includes("g") ? regex.flags : `${regex.flags}g`);
+    const matches = copy.match(counting);
+    return matches ? matches.length : 0;
+}
+//# sourceMappingURL=pattern-safety.js.map

package/dist/voice/internal/pattern-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pattern-safety.js","sourceRoot":"","sources":["../../../src/voice/internal/pattern-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,qIAAqI;AACrI,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEnF,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C,2HAA2H;AAC3H,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAwBvC,SAAS,IAAI,CAAC,KAAyB,EAAE,MAAc;IACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAOD;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAiB,CAAC,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,UAAU;IACV,IAAI,oBAA4C,CAAC;IAEjD,MAAM,wBAAwB,GAAG,GAAqC,EAAE;QACtE,IAAI,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;YACjD,OAAO,IAAI,CACT,2BAA2B,EAC3B,0BAA0B,CAAC,8KAA8K,CAC1M,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG;YAAE,GAAG,CAAC,sBAAsB,GAAG,IAAI,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAE9B,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO,GAAG,KAAK,CAAC;gBAChB,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,CAAC,EAAE,CAAC;YACN,CAAC;YACD,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;gBACrD,OAAO,IAAI,CACT,uBAAuB,EACvB,oBAAoB,IAAI,eAAe,CAAC,+EAA+E,CACxH,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1C,OAAO,IAAI,CACT,uBAAuB,EACvB,4CAA4C,CAAC,+EAA+E,CAC7H,CAAC;YACJ,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;YACP,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,OAAO,GAAG,IAAI,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9C,CAAC,EAAE,CAAC;YACJ,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,0BAA0B,EAAE,2BAA2B,CAAC,EAAE,CAAC,CAAC;YACrF,CAAC,EAAE,CAAC;YACJ,oBAAoB,GAAG,MAAM,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,wBAAwB,EAAE,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,CAAC,EAAE,CAAC;YACJ,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC,CAAC,gEAAgE;YAC5F,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,qEAAqE;YACrE,8DAA8D;YAC9D,qEAAqE;YACrE,6DAA6D;YAC7D,CAAC,EAAE,CAAC;YACJ,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,iEAAiE;gBACjE,kEAAkE;gBAClE,4CAA4C;gBAC5C,CAAC,EAAE,CAAC;gBACJ,oBAAoB,GAAG,SAAS,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,QAAQ,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,wBAAwB,EAAE,CAAC;gBACzC,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9D,IAAI,KAAK,GAAG,oBAAoB,EAAE,CAAC;oBACjC,OAAO,IAAI,CACT,oCAAoC,EACpC,gBAAgB,IAAI,gBAAgB,CAAC,0BAA0B,KAAK,8BAA8B,oBAAoB,EAAE,CACzH,CAAC;gBACJ,CAAC;gBACD,IAAI,oBAAoB,EAAE,sBAAsB,EAAE,CAAC;oBACjD,OAAO,IAAI,CACT,2BAA2B,EAC3B,gBAAgB,IAAI,gBAAgB,CAAC,kEAAkE,CACxG,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,CAAC,GAAI,KAAgB,GAAG,CAAC,CAAC;YAC1B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;YAC3B,oBAAoB,GAAG,SAAS,CAAC;YACjC,SAAS;QACX,CAAC;QAED,CAAC,EAAE,CAAC;QACJ,oBAAoB,GAAG,SAAS,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,0BAA0B,EAAE,oBAAoB,KAAK,CAAC,MAAM,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,sBAAsB,EAAE,yDAAyD,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,MAAM,GAAI,OAAgC,CAAC,MAAM,CAAC;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,sBAAsB,EAAE,kDAAkD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QAC9C,OAAO,IAAI,CACT,kBAAkB,EAClB,qBAAqB,MAAM,CAAC,MAAM,2CAA2C,yBAAyB,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAI,OAA+B,CAAC,KAAK,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,qBAAqB,EAAE,oDAAoD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,IAAI,CACT,qBAAqB,EACrB,kBAAkB,KAAK,eAAe,IAAI,6CAA6C,CAAC,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sEAAsE,CACnM,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,0BAA0B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,KAAa;IAC7D,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC"}