@descent-vtt/spec-harness 0.9.1 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (33) hide show
  1. package/.claude-plugin/marketplace.json +1 -1
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/CHANGELOG.md +66 -4
  4. package/README.md +54 -13
  5. package/dist/audit.d.ts +9 -2
  6. package/dist/audit.js +31 -1
  7. package/dist/audit.js.map +1 -1
  8. package/dist/cli.d.ts +1 -1
  9. package/dist/cli.js +7 -3
  10. package/dist/cli.js.map +1 -1
  11. package/dist/commands.js +1 -0
  12. package/dist/commands.js.map +1 -1
  13. package/dist/configure.d.ts +25 -2
  14. package/dist/configure.js +44 -4
  15. package/dist/configure.js.map +1 -1
  16. package/dist/index.d.ts +1 -1
  17. package/dist/index.js.map +1 -1
  18. package/dist/manifests.d.ts +31 -4
  19. package/dist/manifests.js +71 -24
  20. package/dist/manifests.js.map +1 -1
  21. package/dist/round.d.ts +3 -1
  22. package/dist/round.js +15 -6
  23. package/dist/round.js.map +1 -1
  24. package/dist/server.js +1 -1
  25. package/dist/server.js.map +1 -1
  26. package/dist/setup.d.ts +3 -1
  27. package/dist/setup.js +13 -14
  28. package/dist/setup.js.map +1 -1
  29. package/package.json +1 -1
  30. package/skills/close-round/SKILL.md +28 -10
  31. package/skills/draft-brief/SKILL.md +24 -6
  32. package/skills/run-round/SKILL.md +22 -4
  33. package/skills/split-goal/SKILL.md +19 -3
package/dist/configure.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAwB,MAAM,eAAe,CAAC;AAI1E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,QAA2B;IAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,GAAG,GAAG,4DAA4D,CAAC;AAEzE,sGAAsG;AACtG,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACrD,MAAM,UAAU,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAE7H,iFAAiF;AACjF,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,kBAAkB,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;AAEnE,SAAS,OAAO,CAAC,IAAa;IAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,sHAAsH;AACtH,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,EAAE,GAAI,KAAc,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAI,IAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC1J,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,mBAAmB,CAAC,OAAa;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAS,EAAE,GAAG,KAAK,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAc,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,8IAA8I;AAC9I,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAa;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,cAAc,IAAI,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,EAAE,GAAI,QAA6B,EAAE,GAAG,SAAS,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC;AAC9I,CAAC;AAED,oGAAoG;AACpG,SAAS,KAAK,CAAC,IAAa,EAAE,GAAW;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,QAAiB;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,IAAI,OAAO,CAAC;AACxD,CAAC;AAcD,+HAA+H;AAC/H,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAkC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,4DAA4D;AAC5D,SAAS,IAAI,CAAC,MAAqB;IACjC,OAAO,kCAAkC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC;AAC1E,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,MAAqB;IACpC,OAAO,mEAAmE,MAAM,CAAC,EAAE,gBAAgB,CAAC;AACtG,CAAC;AAED,MAAM,KAAK,GAAG;IACZ,KAAK,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,8BAA8B,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE;IACrJ,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,gCAAgC,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE;CAC/I,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,IAAwB,EAAE,OAAgB;IAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,OAAO;QAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC,MAAM,gCAAgC,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,yBAAyB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACzK,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,OAAO,gBAAgB,KAAK,CAAC,KAAK,aAAa,KAAK,CAAC,IAAI,qDAAqD,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;AACpN,CAAC;AAaD,yHAAyH;AACzH,MAAM,UAAU,WAAW,CAAC,MAAwB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChJ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,iJAAiJ,CAAC;QAC7K,OAAO,mBAAmB,OAAO,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,4CAA4C,CAAC;IACvF,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,OAAO,KAAK,KAAK,kEAAkE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AACzI,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAEpE,+FAA+F;AAC/F,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;AAE7F,6GAA6G;AAC7G,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE3E,+FAA+F;AAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAEzC,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO;gBAAE,OAAO,QAAQ,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAY,EAAE,YAAY,GAA8B,GAAG,EAAE,CAAC,KAAK;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,SAAkB,EAAW,EAAE,CAC5C,SAAS,KAAK,MAAM,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7I,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,MAAY;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAa,EAAE,IAAI,GAAkB,IAAI,EAAE,YAAwC;IAChH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAc,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,SAAS,GAAS,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAOD,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,2CAA2C,KAAK,CAAC,IAAI,gEAAgE,CAAC;QAC/H,KAAK,YAAY;YACf,OAAO,2HAA2H,MAAM,qBAAqB,KAAK,CAAC,IAAI,oCAAoC,CAAC;QAC9M,KAAK,YAAY;YACf,OAAO,GAAG,KAAK,CAAC,IAAI,uFAAuF,CAAC;QAC9G,KAAK,cAAc;YACjB,OAAO,oIAAoI,CAAC;IAChJ,CAAC;AACH,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,aAAa,+BAA+B,EAAE,CAAC;IAC7I,MAAM,UAAU,GAAG,+DAA+D,CAAC;IACnF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC;QAC9D,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,MAAM,KAAK,KAAK,KAAK,UAAU,8CAA8C,EAAE,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,yCAAyC,CAAC;IACxG,OAAO;QACL,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,wBAAwB,UAAU,SAAS,KAAK,uGAAuG;KAChK,CAAC;AACJ,CAAC;AAKD,MAAM,OAAO,GAAyC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;AAE9I,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,IAAqH;IAChJ,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB,EAAE,MAAe;IAChF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,wEAAwE,CAAC;IAC1G,IAAI,MAAM;QAAE,OAAO,GAAG,IAAI,UAAU,IAAI,EAAE,CAAC;IAC3C,OAAO,GAAG,IAAI,cAAc,IAAI,uGAAuG,CAAC;AAC1I,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0E;IAC3G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,UAAU,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5H,OAAO,CACL,+CAA+C,KAAK,IAAI;QACxD,+LAA+L;QAC/L,wGAAwG,CACzG,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,OAA4D;IAChG,OAAO,cAAc,OAAO,CAAC,IAAI,qBAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAC1E,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,qBAAqB,CAAC,KAAsB;IAC1D,sEAAsE;IACtE,MAAM,OAAO,GAAG,CAAC,KAA2D,EAAU,EAAE,CACtF,eAAe,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;IAClG,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,IAAI;YACP,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,mBAAmB,WAAW,CAAC;QACxF,KAAK,UAAU;YACb,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,mBAAmB,8MAA8M,CAAC;QAC9Q,KAAK,SAAS;YACZ,OAAO,0BAA0B,mBAAmB,oDAAoD,KAAK,CAAC,MAAM,sGAAsG,CAAC;IAC/N,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC;IAChD,OAAO,uCAAuC,KAAK,0KAA0K,CAAC;AAChO,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,4NAA4N;IAC5N,mNAAmN;IACnN,+CAA+C,CAAC;AAElD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAEtE,iDAAiD;AACjD,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,CAAC,IAAI,oBAAoB,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,CAAC,IAAI,wEAAwE,IAAI,CAAC,IAAI,EAAE,CAAC;QACzG,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,CAAC,IAAI,6CAA6C,aAAa,SAAS,CAAC;QACzF,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,4CAA4C,IAAI,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,mBAAmB,GAAsB,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;AAEvI,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,MAAY,EAAE,MAAc;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnJ,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IACvJ,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAc,EAAE,KAAc;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,WAAW,aAAa,CAAC,CAAC,CAAC,GAAG,WAAW,aAAa,CAAC;IACvF,IAAI,KAAK;QAAE,OAAO,GAAG,OAAO,sHAAsH,CAAC;IACnJ,OAAO,GAAG,OAAO,qEAAqE,MAAM,0CAA0C,MAAM,0CAA0C,CAAC;AACzL,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,OAAa,EAAE,WAAmB;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,iBAAiB,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7J,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;AACpE,CAAC","sourcesContent":["/**\n * What `init` writes into each tool's configuration, and what `doctor` says\n * of the result.\n *\n * Pure: `setup.ts` and the command line read the files and ask git, and\n * write what these return, so the core sweep holds these to the unit suite.\n * Each merge keeps what a person wrote and returns `null` when there is\n * nothing to add.\n */\n\nimport { isAbsolute } from 'node:path';\n\nimport type { AllowedSigner } from './signers.js';\nimport { parseGlobList } from './vendor/spec-core/pattern/index.js';\nimport { CLAUDE_CODE_MINIMUM, type ClaudeCodeCheck } from './versions.js';\n\ntype Json = Record<string, unknown>;\n\nfunction isObject(value: unknown): value is Json {\n return typeof value === 'object' && value !== null;\n}\n\nfunction sameStrings(value: unknown, expected: readonly string[]): boolean {\n return Array.isArray(value) && value.length === expected.length && value.every((item, index) => item === expected[index]);\n}\n\n/**\n * The command line as the project installed it. Claude Code starts a plugin's\n * server in the plugin's own directory and a hook wherever the session\n * stands, so neither can rely on `npx` finding the project's install; and on\n * Windows a server's command is started without a shell, where `npx` is a\n * shim that cannot start at all. `node` and the script's path work\n * everywhere.\n */\nconst BIN = 'node_modules/@descent-vtt/spec-harness/bin/spec-harness.js';\n\n/** The project root, as Claude Code substitutes it in a hook's arguments and in a plugin server's. */\nexport const PROJECT_DIR = '${CLAUDE_PROJECT_DIR}';\n\n/**\n * The project root in a project's own `.mcp.json`. Claude Code expands it\n * there from its own environment, which does not hold it, so it needs a\n * default; `.` is right, since a project's server starts in the project.\n */\nexport const PROJECT_DIR_OR_HERE = '${CLAUDE_PROJECT_DIR:-.}';\n\nconst HOOK_MATCHER = 'Edit|Write|MultiEdit|NotebookEdit';\nconst GUARDED_EVENTS = ['PreToolUse', 'PostToolUse'];\nconst GUARD_ARGS: readonly string[] = Object.freeze([`${PROJECT_DIR}/${BIN}`, 'hook', 'claude']);\n\n/**\n * The guard as a Claude Code hook: exec form, `args` given, so the project's\n * path is one argument whatever it holds, and no shell is involved.\n */\nexport const GUARD_HOOK: Readonly<Json> = Object.freeze({ type: 'command', command: 'node', args: GUARD_ARGS, timeout: 60 });\n\n/** What 0.1 installed: an npx command, found from wherever the session stood. */\nconst LEGACY_HOOK = 'npx --no-install spec-harness hook claude';\nconst LEGACY_SERVER_ARGS = ['--no-install', 'spec-harness', 'mcp'];\n\nfunction isGuard(hook: unknown): boolean {\n return isObject(hook) && hook['command'] === 'node' && sameStrings(hook['args'], GUARD_ARGS);\n}\n\nfunction isLegacyGuard(hook: unknown): boolean {\n return isObject(hook) && hook['command'] === LEGACY_HOOK;\n}\n\nfunction hooksOf(group: unknown): unknown[] {\n return isObject(group) && Array.isArray(group['hooks']) ? group['hooks'] : [];\n}\n\n/** A group with 0.1's guard replaced where it stands, keeping its other fields; the group itself when it has none. */\nfunction upgraded(group: unknown): unknown {\n const hooks = hooksOf(group);\n if (!hooks.some(isLegacyGuard)) return group;\n return { ...(group as Json), hooks: hooks.map((hook) => (isLegacyGuard(hook) ? { ...(hook as Json), command: 'node', args: [...GUARD_ARGS] } : hook)) };\n}\n\n/** `.claude/settings.json`, or the plugin's hooks, with the guard hooks merged in; `null` when they are already there. */\nexport function mergeClaudeSettings(current: Json): Json | null {\n const hooks = isObject(current['hooks']) ? current['hooks'] : {};\n let changed = false;\n const next: Json = { ...hooks };\n for (const event of GUARDED_EVENTS) {\n const listed = hooks[event];\n const before: unknown[] = Array.isArray(listed) ? listed : [];\n const groups = before.map(upgraded);\n const replaced = groups.some((group, index) => group !== before[index]);\n const present = groups.some((group) => hooksOf(group).some(isGuard));\n if (!present) groups.push({ matcher: HOOK_MATCHER, hooks: [{ ...GUARD_HOOK, args: [...GUARD_ARGS] }] });\n if (replaced || !present) {\n next[event] = groups;\n changed = true;\n }\n }\n return changed ? { ...current, hooks: next } : null;\n}\n\n/** The server's entry, reading the project at `projectDir`: {@link PROJECT_DIR} for the plugin, {@link PROJECT_DIR_OR_HERE} for a project. */\nexport function mcpServer(projectDir: string): Json {\n return { command: 'node', args: [`${projectDir}/${BIN}`, 'mcp', '--root', projectDir] };\n}\n\nfunction isLegacyServer(server: unknown): boolean {\n return isObject(server) && server['command'] === 'npx' && sameStrings(server['args'], LEGACY_SERVER_ARGS);\n}\n\n/**\n * A project's `.mcp.json` with the harness's server merged in, or `null` when\n * one is registered. A server registered under the name some other way is\n * the person's, and stays; 0.1's npx entry is replaced, keeping its other\n * fields.\n */\nexport function mergeMcp(current: Json): Json | null {\n const servers = isObject(current['mcpServers']) ? current['mcpServers'] : {};\n const existing = servers['spec-harness'];\n if ('spec-harness' in servers && !isLegacyServer(existing)) return null;\n return { ...current, mcpServers: { ...servers, 'spec-harness': { ...(existing as Json | undefined), ...mcpServer(PROJECT_DIR_OR_HERE) } } };\n}\n\n/** A key of a file read as JSON; a file that is missing, or is not a JSON object, holds nothing. */\nfunction field(file: unknown, key: string): unknown {\n return isObject(file) ? file[key] : undefined;\n}\n\n/** Whether Claude Code settings hold the guard hooks, as this release or 0.1 wrote them. */\nexport function holdsGuard(settings: unknown): boolean {\n const hooks = field(settings, 'hooks');\n if (!isObject(hooks)) return false;\n return GUARDED_EVENTS.some((event) => {\n const groups = hooks[event];\n return Array.isArray(groups) && groups.some((group) => hooksOf(group).some((hook) => isGuard(hook) || isLegacyGuard(hook)));\n });\n}\n\n/** Whether a project's `.mcp.json` registers a server under the harness's name, however it runs it. */\nexport function registersServer(mcp: unknown): boolean {\n const servers = field(mcp, 'mcpServers');\n return isObject(servers) && 'spec-harness' in servers;\n}\n\n/** A Claude Code settings file, named as a person finds it, and what reading it gave: an object, or nothing usable. */\nexport interface ClaudeSettings {\n readonly file: string;\n readonly settings: unknown;\n}\n\n/** The plugin's id in `enabledPlugins`, and the settings file that turns it on. */\nexport interface EnabledPlugin {\n readonly id: string;\n readonly file: string;\n}\n\n/** `enabledPlugins` keys a plugin `<name>@<marketplace>`; this repository's marketplace lists the plugin as `spec-harness`. */\nconst PLUGIN_ID = /^spec-harness@[^@]+$/;\n\n/**\n * Whether Claude Code runs this package's plugin, from its settings files\n * given lowest precedence first: user, project, local. Claude Code merges\n * `enabledPlugins` key by key, so for each id the last file that sets it to\n * `true` or `false` decides. A plugin named `spec-harness` counts from any\n * marketplace, since another can list this repository. `null` when no file\n * turns it on.\n */\nexport function enabledPlugin(sources: readonly ClaudeSettings[]): EnabledPlugin | null {\n const decided = new Map<string, EnabledPlugin | null>();\n for (const { file, settings } of sources) {\n const plugins = field(settings, 'enabledPlugins');\n if (!isObject(plugins)) continue;\n for (const [id, on] of Object.entries(plugins)) {\n if (PLUGIN_ID.test(id) && typeof on === 'boolean') decided.set(id, on ? { id, file } : null);\n }\n }\n return [...decided.values()].find((entry) => entry !== null) ?? null;\n}\n\n/** Where the plugin is on, as a person would look it up. */\nfunction isOn(plugin: EnabledPlugin): string {\n return `the spec-harness plugin is on (${plugin.id} in ${plugin.file})`;\n}\n\n/** How to have init's entries in place of the plugin's, for this project alone. */\nfunction turnOff(plugin: EnabledPlugin): string {\n return `turn the plugin off for this project with claude plugin disable ${plugin.id} --scope local`;\n}\n\nconst PARTS = {\n hooks: { brings: 'the guard hooks', twice: 'every write is guarded twice', skipped: 'init writes none', entry: \"spec-harness's hooks\", them: 'them' },\n server: { brings: 'the server', twice: 'the server is registered twice', skipped: 'init registers none', entry: 'the spec-harness server', them: 'it' },\n} as const;\n\n/**\n * What init says of a Claude Code file it leaves alone because the plugin is\n * on and brings the same `part`. A file that holds init's entry already is a\n * double install for the person to settle: init removes nothing, since the\n * file is the repository's and a clone without the plugin relies on it.\n */\nexport function describeSkipped(plugin: EnabledPlugin, part: 'hooks' | 'server', present: boolean): string {\n const words = PARTS[part];\n if (present) return `${isOn(plugin)} and brings ${words.brings} this file holds as well, so ${words.twice}: take ${words.entry} out of this file, or ${turnOff(plugin)}`;\n return `${isOn(plugin)} and brings ${words.brings}, so ${words.skipped}: with both, ${words.twice}. To have ${words.them} here instead, for every clone of the repository, ${turnOff(plugin)} and run init again`;\n}\n\n/** How Claude Code is wired to the harness: the plugin, init's entries, both or neither. */\nexport interface ClaudeCodeWiring {\n readonly plugin: EnabledPlugin | null;\n /** The settings files that hold the guard hooks. */\n readonly hooks: readonly string[];\n /** Whether `.mcp.json` registers the server. */\n readonly server: boolean;\n}\n\nexport type WiringState = 'plugin' | 'init' | 'both' | 'none';\n\n/** Which of the four the wiring is. `both` is a double install, and doctor fails it; either of init's entries counts. */\nexport function wiringState(wiring: ClaudeCodeWiring): WiringState {\n const init = wiring.hooks.length > 0 || wiring.server;\n if (wiring.plugin === null) return init ? 'init' : 'none';\n return init ? 'both' : 'plugin';\n}\n\n/** What `doctor` says of the wiring, and what to do when it is doubled or missing. */\nexport function describeClaudeCode(wiring: ClaudeCodeWiring): string {\n const { plugin } = wiring;\n const entries = [...wiring.hooks.map((file) => `the guard hooks in ${file}`), ...(wiring.server ? ['the server in .mcp.json'] : [])].join(', ');\n if (plugin === null) {\n if (entries === '') return 'neither the spec-harness plugin nor the hooks init writes, so Claude Code guards no write: run spec-harness init --write, or install the plugin';\n return `init's entries: ${entries}`;\n }\n if (entries === '') return `${isOn(plugin)} and brings the guard hooks and the server`;\n const twice = [...(wiring.hooks.length > 0 ? [PARTS.hooks.twice] : []), ...(wiring.server ? [PARTS.server.twice] : [])].join(' and ');\n return `${isOn(plugin)}, beside ${entries}: ${twice}. Keep one: take spec-harness's entries out of those files, or ${turnOff(plugin)}`;\n}\n\n/** The spec-brief plugin this package ships, as spec-brief's `plugins` names it. */\nexport const PLUGIN = '@descent-vtt/spec-harness/spec-brief-plugin';\n\n/** spec-brief's configuration files, in the order spec-brief looks for them in a directory. */\nexport const SPEC_BRIEF_CONFIGS: readonly string[] = ['.spec-brief.json', 'spec-brief.json'];\n\n/** The conditions an import meets in Node, its `defaultConditions`, and `default`, which every one meets. */\nconst IMPORT_CONDITIONS: readonly string[] = ['node', 'import', 'default'];\n\n/** A target Node refuses as invalid, which an array passes over and anything else stops at. */\nconst INVALID = Symbol('invalid target');\n\nfunction resolveTarget(target: unknown): string | null | undefined | typeof INVALID {\n if (typeof target === 'string') return target.startsWith('./') ? target : INVALID;\n if (Array.isArray(target)) {\n for (const item of target) {\n const resolved = resolveTarget(item);\n if (resolved !== undefined && resolved !== INVALID) return resolved;\n }\n return null;\n }\n if (typeof target !== 'object' || target === null) return target === null ? null : INVALID;\n for (const [condition, value] of Object.entries(target)) {\n if (!IMPORT_CONDITIONS.includes(condition)) continue;\n const resolved = resolveTarget(value);\n if (resolved !== undefined) return resolved;\n }\n return undefined;\n}\n\n/**\n * The file a package's `exports` target names for an import, as Node's\n * PACKAGE_TARGET_RESOLVE finds it, or `null` when it names none: a string\n * that starts with `./`; in an object, the target of the first key, in the\n * object's own order, that an import meets - `node`, `import` or\n * `default` - and that resolves to anything, a `null` included; in an\n * array, the first item that resolves, one Node refuses passed over. A\n * `null` target is not exported, and ends the search there, where a\n * condition an import does not meet lets it go on.\n */\nexport function exportedFile(target: unknown): string | null {\n const resolved = resolveTarget(target);\n return typeof resolved === 'string' ? resolved : null;\n}\n\n/**\n * Whether spec-brief's configuration loads the plugin, by name or as\n * `{ module, options }`. spec-brief also loads a plugin by a path, one that\n * starts with `.` or is absolute, read from the root; such a path is the\n * plugin when `isPluginFile` says it names the plugin's file, which only the\n * disk can tell. Without one, no path is: the default's `false` and an\n * `undefined` read the same in `some`, so that mutant is equivalent.\n */\nexport function loadsPlugin(config: Json, isPluginFile: (path: string) => boolean = () => false): boolean {\n const plugins = config['plugins'];\n const names = (specifier: unknown): boolean =>\n specifier === PLUGIN || (typeof specifier === 'string' && (specifier.startsWith('.') || isAbsolute(specifier)) && isPluginFile(specifier));\n return Array.isArray(plugins) && plugins.some((entry) => names(entry) || (isObject(entry) && names(entry['module'])));\n}\n\n/** Whether spec-brief's configuration names the base its archive measures a round from. */\nexport function measuresArchive(config: Json): boolean {\n const archiving = config['archiving'];\n return isObject(archiving) && typeof archiving['base'] === 'string';\n}\n\n/**\n * spec-brief's configuration with the plugin loaded and the archive measured\n * from `base`, or `null` when both already hold. spec-brief's archive\n * refuses a round that changed a protected file, and learns that a signed\n * ruling allows it only by asking the plugin (ADR-0006). It checks the file at\n * all only when it knows the base: without one it warns that the scope went\n * unmeasured and passes, so the gate is open until a base is named. A base a\n * person wrote is kept.\n */\nexport function mergeSpecBrief(current: Json, base: string | null = null, isPluginFile?: (path: string) => boolean): Json | null {\n const plugin = loadsPlugin(current, isPluginFile);\n const measure = base !== null && !measuresArchive(current);\n if (plugin && !measure) return null;\n const plugins: unknown[] = Array.isArray(current['plugins']) ? current['plugins'] : [];\n const archiving: Json = isObject(current['archiving']) ? current['archiving'] : {};\n return {\n ...current,\n ...(plugin ? {} : { plugins: [...plugins, PLUGIN] }),\n ...(measure ? { archiving: { ...archiving, base } } : {}),\n };\n}\n\n/** Whether spec-brief loads the plugin, as its configuration at the root says. */\nexport type PluginState =\n | { readonly kind: 'loaded' | 'not-loaded' | 'unreadable'; readonly file: string }\n | { readonly kind: 'unconfigured' };\n\n/** What a person reads about the plugin, and what to do when it is not loaded. */\nexport function describePlugin(state: PluginState): string {\n switch (state.kind) {\n case 'loaded':\n return `spec-brief loads spec-harness's plugin (${state.file}): its archive accepts a protected file a signed ruling allows`;\n case 'not-loaded':\n return `spec-brief does not load spec-harness's plugin, so its archive refuses a protected file whatever ruling is signed: add \"${PLUGIN}\" to \"plugins\" in ${state.file}, or run spec-harness init --write`;\n case 'unreadable':\n return `${state.file} cannot be read as JSON, so whether spec-brief loads spec-harness's plugin is unknown`;\n case 'unconfigured':\n return \"spec-brief has no configuration at the root, so it loads no plugin: spec-harness init --write writes one that loads spec-harness's\";\n }\n}\n\n/** What git says that tells a base apart. */\nexport interface BaseFacts {\n /** The remote's default branch as a local ref, such as `origin/main`, or `null`. */\n readonly remoteDefault: string | null;\n /** The branch checked out, or `null` on a detached head. */\n readonly branch: string | null;\n /** Every local branch. */\n readonly branches: readonly string[];\n}\n\n/** The base `init` names, and why; `base` is `null` when none can be told. */\nexport interface BaseChoice {\n readonly base: string | null;\n readonly detail: string;\n}\n\n/**\n * The base `init` writes into `.spec-harness.json`. Every ruling is verified\n * against the allowed signers on it, so it is named rather than left to be\n * found. The remote's default branch comes first, but git records it when\n * it clones, and before 2.48 not on a fetch: a repository made with `git\n * init` and pushed to a remote often has none. There the branch init runs on\n * is the base when it is `main` or `master`, or the only branch; otherwise\n * the person names it.\n */\nexport function chooseBase(facts: BaseFacts): BaseChoice {\n const { remoteDefault, branch } = facts;\n if (remoteDefault !== null) return { base: remoteDefault, detail: `rounds are measured from ${remoteDefault}, the remote's default branch` };\n const unrecorded = 'no remote records a default branch (refs/remotes/origin/HEAD)';\n if (branch !== null) {\n const conventional = branch === 'main' || branch === 'master';\n if (conventional || facts.branches.every((name) => name === branch)) {\n const which = conventional ? 'the branch init runs on' : 'the only branch';\n return { base: branch, detail: `rounds are measured from ${branch}, ${which}: ${unrecorded}; change \"base\" if rounds merge into another` };\n }\n }\n const where = branch === null ? 'HEAD is detached' : `${branch} is not main, master or the only branch`;\n return {\n base: null,\n detail: `no base can be told: ${unrecorded}, and ${where}; set \"base\" to the branch rounds merge into, or run git remote set-head origin --auto and init again`,\n };\n}\n\n/** Where a base came from: `--base`, the configuration, or the remote. */\nexport type BaseSource = 'flag' | 'config' | 'remote';\n\nconst SOURCES: Readonly<Record<BaseSource, string>> = { flag: '--base', config: '.spec-harness.json', remote: \"the remote's default branch\" };\n\n/** The base a command resolved, and how; or why there is none. */\nexport function describeBase(base: { readonly ref: string; readonly source: BaseSource; readonly mergeBase: string } | { readonly reason: string }): string {\n if ('reason' in base) return `none: ${base.reason}`;\n return `${base.ref} (${SOURCES[base.source]}), merge base ${base.mergeBase.slice(0, 12)}`;\n}\n\n/** Whether the allowed-signers file is on the base, where every ruling's signature is checked against it. */\nexport function describeSigners(file: string, base: string | null, onBase: boolean): string {\n if (base === null) return `${file}, read from the base, which could not be resolved: no ruling can count`;\n if (onBase) return `${file} is on ${base}`;\n return `${file} is not on ${base}, so no ruling can count: commit it there, one line per person: <email> namespaces=\"git\" <public key>`;\n}\n\n/**\n * The note doctor gives on the signers whose key is not FIDO2, or `null`\n * when every one's is. A note, never a failure: ADR-0006 accepts a key the\n * agent's account cannot read too, and a PIV or PKCS#11 hardware key is\n * written as a plain key.\n */\nexport function describeSignerKeys(signers: readonly Pick<AllowedSigner, 'line' | 'principals' | 'keyType'>[]): string | null {\n if (signers.length === 0) return null;\n const named = signers.map((signer) => `${signer.principals.join(',')} (${signer.keyType}, line ${signer.line})`).join(', ');\n return (\n `note: signers whose key is not a FIDO2 key: ${named}. ` +\n \"Where an agent runs as the person, ADR-0006 recommends a FIDO2 key, ssh-keygen -t ed25519-sk, whose signature needs a touch no process can supply, or a key the agent's account cannot read; \" +\n 'a PIV or PKCS#11 hardware key reads as a plain ssh-rsa or ecdsa line, so this is a note, not a failure'\n );\n}\n\n/** The note doctor gives on a line of the allowed-signers file that is not a signer. */\nexport function describeSignerProblem(problem: { readonly line: number; readonly message: string }): string {\n return `note: line ${problem.line} is not a signer: ${problem.message}`;\n}\n\n/** What doctor says of the Claude Code on `PATH`, which runs the guard's hooks only from the minimum on. */\nexport function describeClaudeRelease(check: ClaudeCodeCheck): string {\n // A version read from a package.json says so: nothing ran to tell it.\n const release = (found: { readonly version: string; readonly file?: string }): string =>\n `Claude Code ${found.version}${found.file === undefined ? '' : ` (as ${found.file} declares)`}`;\n switch (check.state) {\n case 'ok':\n return `${release(check)} runs the hooks, which need ${CLAUDE_CODE_MINIMUM} or later`;\n case 'outdated':\n return `${release(check)} is older than ${CLAUDE_CODE_MINIMUM}, which the hooks need: it ignores a hook's args and runs a bare node, which fails, and a PreToolUse hook that fails blocks nothing, so every write passes unguarded: update Claude Code, with claude update`;\n case 'unknown':\n return `whether Claude Code is ${CLAUDE_CODE_MINIMUM} or later, which the hooks need, cannot be told: ${check.reason}; an older release lets every write pass unguarded, so check claude --version where Claude Code runs`;\n }\n}\n\n/** Where git's pre-commit hook stands: git's path for it, shown from the root, and what is there. */\nexport type GitHookState =\n | { readonly state: 'runs' | 'absent' | 'other' | 'inert'; readonly file: string }\n | { readonly state: 'unknown'; readonly reason: string };\n\n/**\n * The advice for a missing hook, which init gives beside the file and doctor\n * with it. The hook is the guard for a write the agent's hooks never see,\n * one made through a shell (ADR-0005).\n */\nexport function missingGitHook(file: string | null): string {\n const where = file === null ? '' : ` (${file})`;\n return `no pre-commit hook runs spec-harness${where}: one refuses a commit that changes what the active brief protects, for any agent or none, a shell's writes included; run spec-harness init --git-hook --write to add it`;\n}\n\n/**\n * How to keep the files the rules live in from changing unread, on each\n * forge, as spec-core's ADR-0005 asks: the forge protects them, and CI checks\n * a change against the base branch's rules. GitLab Free has no Code Owners\n * approval, so there the person who merges is the reviewer.\n */\nexport const PROTECT_RULE_FILES =\n \"Have the forge protect this file, the ADRs, the tool configurations and the CI configuration, so no change to them reaches the base branch without a person, and check each change in CI against the base branch's rules: \" +\n 'on GitHub, CODEOWNERS and a protected branch; on GitLab Premium, Code Owners; on GitLab Free, a protected branch no one pushes to, merged by Maintainers, agents as Developers, and pipelines that must succeed. ' +\n \"spec-core's docs/adopting.md has the settings\";\n\n/** The line to add to a hook the repository has of its own. */\nexport const GIT_HOOK_LINE = 'npx --no-install spec-harness hook git';\n\n/** What doctor says of git's pre-commit hook. */\nexport function describeGitHook(hook: GitHookState): string {\n switch (hook.state) {\n case 'runs':\n return `${hook.file} runs spec-harness`;\n case 'inert':\n return `${hook.file} runs spec-harness, but is not executable, so git skips it: chmod +x ${hook.file}`;\n case 'other':\n return `${hook.file} does not run spec-harness: add the line \"${GIT_HOOK_LINE}\" to it`;\n case 'absent':\n return missingGitHook(hook.file);\n case 'unknown':\n return `where git runs its hooks cannot be told: ${hook.reason}`;\n }\n}\n\n/** spec-graph's configuration files, in the order spec-graph reads them; then a \"spec-graph\" key in package.json. */\nexport const SPEC_GRAPH_CONFIGS: readonly string[] = ['.spec-graph.json', 'spec-graph.config.json'];\n\n/**\n * spec-graph's own patterns when its configuration names none, its\n * DEFAULT_PATTERNS as of 0.9.0. They decide only what init says, never what\n * it writes: `patterns` in the configuration replaces them, so writing the\n * briefs into it would freeze spec-graph's defaults into the file.\n */\nconst SPEC_GRAPH_DEFAULTS: readonly string[] = ['docs/**/*.md', 'doc/**/*.md', 'adr/**/*.md', 'rfcs/**/*.md', 'specs/**/*.md', '*.md'];\n\n/** Whether spec-graph, configured as `config` says, reads the briefs in the directory `briefs`. */\nexport function graphReadsBriefs(config: Json, briefs: string): boolean {\n const configured = Array.isArray(config['patterns']) ? config['patterns'].filter((pattern): pattern is string => typeof pattern === 'string') : [];\n const list = parseGlobList(configured.length > 0 ? configured : SPEC_GRAPH_DEFAULTS, { dialect: 'path', caseSensitive: true, backslash: 'separator' });\n return list.ok && list.list.match(`${briefs}/001_brief.md`);\n}\n\n/**\n * What the history entry does. spec-graph reads a brief whose status says\n * `archived` as a record already; the entry makes one a record whatever word\n * its status uses, or none - and it does anything only where spec-graph\n * reads the briefs, which its defaults do not in `briefs/`.\n */\nexport function describeGraph(archiveGlob: string, briefs: string, reads: boolean, added: boolean): string {\n const history = added ? `read ${archiveGlob} as history` : `${archiveGlob} is history`;\n if (reads) return `${history}: an archived brief is a record whatever its status says, so a live brief that depends on one is not a stale premise`;\n return `${history}, for when spec-graph reads the briefs; its patterns do not reach ${briefs}/, so it checks none of them now: add \"${briefs}/**/*.md\" to its \"patterns\" if it should`;\n}\n\n/** spec-graph's configuration with the archive read as history, or `null` when it already is. */\nexport function mergeSpecGraph(current: Json, archiveGlob: string): Json | null {\n const history = Array.isArray(current['historyPatterns']) ? (current['historyPatterns'] as unknown[]).filter((p): p is string => typeof p === 'string') : [];\n if (history.includes(archiveGlob)) return null;\n return { ...current, historyPatterns: [...history, archiveGlob] };\n}\n"]}
1
+ {"version":3,"file":"configure.js","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAGvC,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAwB,MAAM,eAAe,CAAC;AAI1E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,QAA2B;IAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5H,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,GAAG,GAAG,4DAA4D,CAAC;AAEzE,sGAAsG;AACtG,MAAM,CAAC,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAE9D,MAAM,YAAY,GAAG,mCAAmC,CAAC;AACzD,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACrD,MAAM,UAAU,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAmB,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAE7H,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,kBAAkB,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;AAEnE,SAAS,OAAO,CAAC,IAAa;IAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,sHAAsH;AACtH,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,EAAE,GAAI,KAAc,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAI,IAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC1J,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,mBAAmB,CAAC,OAAa;IAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAS,EAAE,GAAG,KAAK,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAc,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,8IAA8I;AAC9I,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,UAAU,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,cAAc,CAAC,MAAe;IACrC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAa;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,cAAc,IAAI,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,EAAE,GAAI,QAA6B,EAAE,GAAG,SAAS,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC;AAC9I,CAAC;AAED,oGAAoG;AACpG,SAAS,KAAK,CAAC,IAAa,EAAE,GAAW;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,QAAiB;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9H,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,cAAc,IAAI,OAAO,CAAC;AACxD,CAAC;AAcD,+HAA+H;AAC/H,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,OAAkC;IAC9D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,OAAO,EAAE,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AACvE,CAAC;AAED,4DAA4D;AAC5D,SAAS,IAAI,CAAC,MAAqB;IACjC,OAAO,kCAAkC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC;AAC1E,CAAC;AAED,mFAAmF;AACnF,SAAS,OAAO,CAAC,MAAqB;IACpC,OAAO,mEAAmE,MAAM,CAAC,EAAE,gBAAgB,CAAC;AACtG,CAAC;AAED,MAAM,KAAK,GAAG;IACZ,KAAK,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,8BAA8B,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE;IACrJ,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,gCAAgC,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,IAAI,EAAE;CAC/I,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAqB,EAAE,IAAwB,EAAE,OAAgB;IAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,OAAO;QAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC,MAAM,gCAAgC,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,yBAAyB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACzK,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,OAAO,gBAAgB,KAAK,CAAC,KAAK,aAAa,KAAK,CAAC,IAAI,qDAAqD,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;AACpN,CAAC;AAaD,yHAAyH;AACzH,MAAM,UAAU,WAAW,CAAC,MAAwB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC;IACtD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClC,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,MAAwB;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChJ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,iJAAiJ,CAAC;QAC7K,OAAO,mBAAmB,OAAO,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,4CAA4C,CAAC;IACvF,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,OAAO,KAAK,KAAK,kEAAkE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AACzI,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAEpE,+FAA+F;AAC/F,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;AAE7F,6GAA6G;AAC7G,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAE3E,+FAA+F;AAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAEzC,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO;gBAAE,OAAO,QAAQ,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAC3F,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAY,EAAE,YAAY,GAA8B,GAAG,EAAE,CAAC,KAAK;IAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,CAAC,SAAkB,EAAW,EAAE,CAC5C,SAAS,KAAK,MAAM,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7I,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxH,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,eAAe,CAAC,MAAY;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAa,EAAE,IAAI,GAAkB,IAAI,EAAE,YAAwC;IAChH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAc,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,MAAM,SAAS,GAAS,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAOD,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,2CAA2C,KAAK,CAAC,IAAI,gEAAgE,CAAC;QAC/H,KAAK,YAAY;YACf,OAAO,2HAA2H,MAAM,qBAAqB,KAAK,CAAC,IAAI,oCAAoC,CAAC;QAC9M,KAAK,YAAY;YACf,OAAO,GAAG,KAAK,CAAC,IAAI,uFAAuF,CAAC;QAC9G,KAAK,cAAc;YACjB,OAAO,oIAAoI,CAAC;IAChJ,CAAC;AACH,CAAC;AAkBD;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACxC,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,aAAa,+BAA+B,EAAE,CAAC;IAC7I,MAAM,UAAU,GAAG,+DAA+D,CAAC;IACnF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,YAAY,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,QAAQ,CAAC;QAC9D,IAAI,YAAY,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,MAAM,KAAK,KAAK,KAAK,UAAU,8CAA8C,EAAE,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,yCAAyC,CAAC;IACxG,OAAO;QACL,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,wBAAwB,UAAU,SAAS,KAAK,uGAAuG;KAChK,CAAC;AACJ,CAAC;AAKD,MAAM,OAAO,GAAyC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;AAE9I,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,IAAqH;IAChJ,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;IACpD,OAAO,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAmB,EAAE,MAAe;IAChF,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,GAAG,IAAI,wEAAwE,CAAC;IAC1G,IAAI,MAAM;QAAE,OAAO,GAAG,IAAI,UAAU,IAAI,EAAE,CAAC;IAC3C,OAAO,GAAG,IAAI,cAAc,IAAI,uGAAuG,CAAC;AAC1I,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA0E;IAC3G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,OAAO,UAAU,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5H,OAAO,CACL,+CAA+C,KAAK,IAAI;QACxD,+LAA+L;QAC/L,wGAAwG,CACzG,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,OAA4D;IAChG,OAAO,cAAc,OAAO,CAAC,IAAI,qBAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAC1E,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,qBAAqB,CAAC,KAAsB;IAC1D,sEAAsE;IACtE,MAAM,OAAO,GAAG,CAAC,KAA2D,EAAU,EAAE,CACtF,eAAe,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;IAClG,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,IAAI;YACP,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,mBAAmB,WAAW,CAAC;QACxF,KAAK,UAAU;YACb,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,mBAAmB,8MAA8M,CAAC;QAC9Q,KAAK,SAAS;YACZ,OAAO,0BAA0B,mBAAmB,oDAAoD,KAAK,CAAC,MAAM,sGAAsG,CAAC;IAC/N,CAAC;AACH,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAmB;IAChD,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC;IAChD,OAAO,uCAAuC,KAAK,0KAA0K,CAAC;AAChO,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,4NAA4N;IAC5N,mNAAmN;IACnN,+CAA+C,CAAC;AAElD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;;;;MAIpB,GAAG;;;;;;CAMR,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,mQAAmQ,aAAa,GAAG,CAAC;AAC7R,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,eAAe,CAAC,IAAkB;IAChD,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,GAAG,IAAI,CAAC,IAAI,oBAAoB,CAAC;QAC1C,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,CAAC,IAAI,wEAAwE,IAAI,CAAC,IAAI,EAAE,CAAC;QACzG,KAAK,OAAO;YACV,OAAO,GAAG,IAAI,CAAC,IAAI,6CAA6C,aAAa,SAAS,CAAC;QACzF,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,4CAA4C,IAAI,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,mBAAmB,GAAsB,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;AAEvI,mGAAmG;AACnG,MAAM,UAAU,gBAAgB,CAAC,MAAY,EAAE,MAAc;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnJ,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;IACvJ,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,MAAc,EAAE,KAAc,EAAE,KAAc;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,WAAW,aAAa,CAAC,CAAC,CAAC,GAAG,WAAW,aAAa,CAAC;IACvF,IAAI,KAAK;QAAE,OAAO,GAAG,OAAO,sHAAsH,CAAC;IACnJ,OAAO,GAAG,OAAO,qEAAqE,MAAM,0CAA0C,MAAM,0CAA0C,CAAC;AACzL,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,OAAa,EAAE,WAAmB;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,iBAAiB,CAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7J,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,CAAC,GAAG,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;AACpE,CAAC","sourcesContent":["/**\n * What `init` writes into each tool's configuration, and what `doctor` says\n * of the result.\n *\n * Pure: `setup.ts` and the command line read the files and ask git, and\n * write what these return, so the core sweep holds these to the unit suite.\n * Each merge keeps what a person wrote and returns `null` when there is\n * nothing to add.\n */\n\nimport { isAbsolute } from 'node:path';\n\nimport type { AllowedSigner } from './signers.js';\nimport { parseGlobList } from './vendor/spec-core/pattern/index.js';\nimport { CLAUDE_CODE_MINIMUM, type ClaudeCodeCheck } from './versions.js';\n\ntype Json = Record<string, unknown>;\n\nfunction isObject(value: unknown): value is Json {\n return typeof value === 'object' && value !== null;\n}\n\nfunction sameStrings(value: unknown, expected: readonly string[]): boolean {\n return Array.isArray(value) && value.length === expected.length && value.every((item, index) => item === expected[index]);\n}\n\n/**\n * The command line as the project installed it. Claude Code starts a plugin's\n * server in the plugin's own directory and a hook wherever the session\n * stands, so neither can rely on `npx` finding the project's install; and on\n * Windows a server's command is started without a shell, where `npx` is a\n * shim that cannot start at all. `node` and the script's path work\n * everywhere. git's hook runs the same script, from the top of the work\n * tree, where git starts it.\n */\nconst BIN = 'node_modules/@descent-vtt/spec-harness/bin/spec-harness.js';\n\n/** The project root, as Claude Code substitutes it in a hook's arguments and in a plugin server's. */\nexport const PROJECT_DIR = '${CLAUDE_PROJECT_DIR}';\n\n/**\n * The project root in a project's own `.mcp.json`. Claude Code expands it\n * there from its own environment, which does not hold it, so it needs a\n * default; `.` is right, since a project's server starts in the project.\n */\nexport const PROJECT_DIR_OR_HERE = '${CLAUDE_PROJECT_DIR:-.}';\n\nconst HOOK_MATCHER = 'Edit|Write|MultiEdit|NotebookEdit';\nconst GUARDED_EVENTS = ['PreToolUse', 'PostToolUse'];\nconst GUARD_ARGS: readonly string[] = Object.freeze([`${PROJECT_DIR}/${BIN}`, 'hook', 'claude']);\n\n/**\n * The guard as a Claude Code hook: exec form, `args` given, so the project's\n * path is one argument whatever it holds, and no shell is involved.\n */\nexport const GUARD_HOOK: Readonly<Json> = Object.freeze({ type: 'command', command: 'node', args: GUARD_ARGS, timeout: 60 });\n\n// bare-name: what 0.1 installed, an npx command found from wherever the\n// session stood. Read here so that init replaces it, and never run.\nconst LEGACY_HOOK = 'npx --no-install spec-harness hook claude';\nconst LEGACY_SERVER_ARGS = ['--no-install', 'spec-harness', 'mcp'];\n\nfunction isGuard(hook: unknown): boolean {\n return isObject(hook) && hook['command'] === 'node' && sameStrings(hook['args'], GUARD_ARGS);\n}\n\nfunction isLegacyGuard(hook: unknown): boolean {\n return isObject(hook) && hook['command'] === LEGACY_HOOK;\n}\n\nfunction hooksOf(group: unknown): unknown[] {\n return isObject(group) && Array.isArray(group['hooks']) ? group['hooks'] : [];\n}\n\n/** A group with 0.1's guard replaced where it stands, keeping its other fields; the group itself when it has none. */\nfunction upgraded(group: unknown): unknown {\n const hooks = hooksOf(group);\n if (!hooks.some(isLegacyGuard)) return group;\n return { ...(group as Json), hooks: hooks.map((hook) => (isLegacyGuard(hook) ? { ...(hook as Json), command: 'node', args: [...GUARD_ARGS] } : hook)) };\n}\n\n/** `.claude/settings.json`, or the plugin's hooks, with the guard hooks merged in; `null` when they are already there. */\nexport function mergeClaudeSettings(current: Json): Json | null {\n const hooks = isObject(current['hooks']) ? current['hooks'] : {};\n let changed = false;\n const next: Json = { ...hooks };\n for (const event of GUARDED_EVENTS) {\n const listed = hooks[event];\n const before: unknown[] = Array.isArray(listed) ? listed : [];\n const groups = before.map(upgraded);\n const replaced = groups.some((group, index) => group !== before[index]);\n const present = groups.some((group) => hooksOf(group).some(isGuard));\n if (!present) groups.push({ matcher: HOOK_MATCHER, hooks: [{ ...GUARD_HOOK, args: [...GUARD_ARGS] }] });\n if (replaced || !present) {\n next[event] = groups;\n changed = true;\n }\n }\n return changed ? { ...current, hooks: next } : null;\n}\n\n/** The server's entry, reading the project at `projectDir`: {@link PROJECT_DIR} for the plugin, {@link PROJECT_DIR_OR_HERE} for a project. */\nexport function mcpServer(projectDir: string): Json {\n return { command: 'node', args: [`${projectDir}/${BIN}`, 'mcp', '--root', projectDir] };\n}\n\nfunction isLegacyServer(server: unknown): boolean {\n return isObject(server) && server['command'] === 'npx' && sameStrings(server['args'], LEGACY_SERVER_ARGS);\n}\n\n/**\n * A project's `.mcp.json` with the harness's server merged in, or `null` when\n * one is registered. A server registered under the name some other way is\n * the person's, and stays; 0.1's npx entry is replaced, keeping its other\n * fields.\n */\nexport function mergeMcp(current: Json): Json | null {\n const servers = isObject(current['mcpServers']) ? current['mcpServers'] : {};\n const existing = servers['spec-harness'];\n if ('spec-harness' in servers && !isLegacyServer(existing)) return null;\n return { ...current, mcpServers: { ...servers, 'spec-harness': { ...(existing as Json | undefined), ...mcpServer(PROJECT_DIR_OR_HERE) } } };\n}\n\n/** A key of a file read as JSON; a file that is missing, or is not a JSON object, holds nothing. */\nfunction field(file: unknown, key: string): unknown {\n return isObject(file) ? file[key] : undefined;\n}\n\n/** Whether Claude Code settings hold the guard hooks, as this release or 0.1 wrote them. */\nexport function holdsGuard(settings: unknown): boolean {\n const hooks = field(settings, 'hooks');\n if (!isObject(hooks)) return false;\n return GUARDED_EVENTS.some((event) => {\n const groups = hooks[event];\n return Array.isArray(groups) && groups.some((group) => hooksOf(group).some((hook) => isGuard(hook) || isLegacyGuard(hook)));\n });\n}\n\n/** Whether a project's `.mcp.json` registers a server under the harness's name, however it runs it. */\nexport function registersServer(mcp: unknown): boolean {\n const servers = field(mcp, 'mcpServers');\n return isObject(servers) && 'spec-harness' in servers;\n}\n\n/** A Claude Code settings file, named as a person finds it, and what reading it gave: an object, or nothing usable. */\nexport interface ClaudeSettings {\n readonly file: string;\n readonly settings: unknown;\n}\n\n/** The plugin's id in `enabledPlugins`, and the settings file that turns it on. */\nexport interface EnabledPlugin {\n readonly id: string;\n readonly file: string;\n}\n\n/** `enabledPlugins` keys a plugin `<name>@<marketplace>`; this repository's marketplace lists the plugin as `spec-harness`. */\nconst PLUGIN_ID = /^spec-harness@[^@]+$/;\n\n/**\n * Whether Claude Code runs this package's plugin, from its settings files\n * given lowest precedence first: user, project, local. Claude Code merges\n * `enabledPlugins` key by key, so for each id the last file that sets it to\n * `true` or `false` decides. A plugin named `spec-harness` counts from any\n * marketplace, since another can list this repository. `null` when no file\n * turns it on.\n */\nexport function enabledPlugin(sources: readonly ClaudeSettings[]): EnabledPlugin | null {\n const decided = new Map<string, EnabledPlugin | null>();\n for (const { file, settings } of sources) {\n const plugins = field(settings, 'enabledPlugins');\n if (!isObject(plugins)) continue;\n for (const [id, on] of Object.entries(plugins)) {\n if (PLUGIN_ID.test(id) && typeof on === 'boolean') decided.set(id, on ? { id, file } : null);\n }\n }\n return [...decided.values()].find((entry) => entry !== null) ?? null;\n}\n\n/** Where the plugin is on, as a person would look it up. */\nfunction isOn(plugin: EnabledPlugin): string {\n return `the spec-harness plugin is on (${plugin.id} in ${plugin.file})`;\n}\n\n/** How to have init's entries in place of the plugin's, for this project alone. */\nfunction turnOff(plugin: EnabledPlugin): string {\n return `turn the plugin off for this project with claude plugin disable ${plugin.id} --scope local`;\n}\n\nconst PARTS = {\n hooks: { brings: 'the guard hooks', twice: 'every write is guarded twice', skipped: 'init writes none', entry: \"spec-harness's hooks\", them: 'them' },\n server: { brings: 'the server', twice: 'the server is registered twice', skipped: 'init registers none', entry: 'the spec-harness server', them: 'it' },\n} as const;\n\n/**\n * What init says of a Claude Code file it leaves alone because the plugin is\n * on and brings the same `part`. A file that holds init's entry already is a\n * double install for the person to settle: init removes nothing, since the\n * file is the repository's and a clone without the plugin relies on it.\n */\nexport function describeSkipped(plugin: EnabledPlugin, part: 'hooks' | 'server', present: boolean): string {\n const words = PARTS[part];\n if (present) return `${isOn(plugin)} and brings ${words.brings} this file holds as well, so ${words.twice}: take ${words.entry} out of this file, or ${turnOff(plugin)}`;\n return `${isOn(plugin)} and brings ${words.brings}, so ${words.skipped}: with both, ${words.twice}. To have ${words.them} here instead, for every clone of the repository, ${turnOff(plugin)} and run init again`;\n}\n\n/** How Claude Code is wired to the harness: the plugin, init's entries, both or neither. */\nexport interface ClaudeCodeWiring {\n readonly plugin: EnabledPlugin | null;\n /** The settings files that hold the guard hooks. */\n readonly hooks: readonly string[];\n /** Whether `.mcp.json` registers the server. */\n readonly server: boolean;\n}\n\nexport type WiringState = 'plugin' | 'init' | 'both' | 'none';\n\n/** Which of the four the wiring is. `both` is a double install, and doctor fails it; either of init's entries counts. */\nexport function wiringState(wiring: ClaudeCodeWiring): WiringState {\n const init = wiring.hooks.length > 0 || wiring.server;\n if (wiring.plugin === null) return init ? 'init' : 'none';\n return init ? 'both' : 'plugin';\n}\n\n/** What `doctor` says of the wiring, and what to do when it is doubled or missing. */\nexport function describeClaudeCode(wiring: ClaudeCodeWiring): string {\n const { plugin } = wiring;\n const entries = [...wiring.hooks.map((file) => `the guard hooks in ${file}`), ...(wiring.server ? ['the server in .mcp.json'] : [])].join(', ');\n if (plugin === null) {\n if (entries === '') return 'neither the spec-harness plugin nor the hooks init writes, so Claude Code guards no write: run spec-harness init --write, or install the plugin';\n return `init's entries: ${entries}`;\n }\n if (entries === '') return `${isOn(plugin)} and brings the guard hooks and the server`;\n const twice = [...(wiring.hooks.length > 0 ? [PARTS.hooks.twice] : []), ...(wiring.server ? [PARTS.server.twice] : [])].join(' and ');\n return `${isOn(plugin)}, beside ${entries}: ${twice}. Keep one: take spec-harness's entries out of those files, or ${turnOff(plugin)}`;\n}\n\n/** The spec-brief plugin this package ships, as spec-brief's `plugins` names it. */\nexport const PLUGIN = '@descent-vtt/spec-harness/spec-brief-plugin';\n\n/** spec-brief's configuration files, in the order spec-brief looks for them in a directory. */\nexport const SPEC_BRIEF_CONFIGS: readonly string[] = ['.spec-brief.json', 'spec-brief.json'];\n\n/** The conditions an import meets in Node, its `defaultConditions`, and `default`, which every one meets. */\nconst IMPORT_CONDITIONS: readonly string[] = ['node', 'import', 'default'];\n\n/** A target Node refuses as invalid, which an array passes over and anything else stops at. */\nconst INVALID = Symbol('invalid target');\n\nfunction resolveTarget(target: unknown): string | null | undefined | typeof INVALID {\n if (typeof target === 'string') return target.startsWith('./') ? target : INVALID;\n if (Array.isArray(target)) {\n for (const item of target) {\n const resolved = resolveTarget(item);\n if (resolved !== undefined && resolved !== INVALID) return resolved;\n }\n return null;\n }\n if (typeof target !== 'object' || target === null) return target === null ? null : INVALID;\n for (const [condition, value] of Object.entries(target)) {\n if (!IMPORT_CONDITIONS.includes(condition)) continue;\n const resolved = resolveTarget(value);\n if (resolved !== undefined) return resolved;\n }\n return undefined;\n}\n\n/**\n * The file a package's `exports` target names for an import, as Node's\n * PACKAGE_TARGET_RESOLVE finds it, or `null` when it names none: a string\n * that starts with `./`; in an object, the target of the first key, in the\n * object's own order, that an import meets - `node`, `import` or\n * `default` - and that resolves to anything, a `null` included; in an\n * array, the first item that resolves, one Node refuses passed over. A\n * `null` target is not exported, and ends the search there, where a\n * condition an import does not meet lets it go on.\n */\nexport function exportedFile(target: unknown): string | null {\n const resolved = resolveTarget(target);\n return typeof resolved === 'string' ? resolved : null;\n}\n\n/**\n * Whether spec-brief's configuration loads the plugin, by name or as\n * `{ module, options }`. spec-brief also loads a plugin by a path, one that\n * starts with `.` or is absolute, read from the root; such a path is the\n * plugin when `isPluginFile` says it names the plugin's file, which only the\n * disk can tell. Without one, no path is: the default's `false` and an\n * `undefined` read the same in `some`, so that mutant is equivalent.\n */\nexport function loadsPlugin(config: Json, isPluginFile: (path: string) => boolean = () => false): boolean {\n const plugins = config['plugins'];\n const names = (specifier: unknown): boolean =>\n specifier === PLUGIN || (typeof specifier === 'string' && (specifier.startsWith('.') || isAbsolute(specifier)) && isPluginFile(specifier));\n return Array.isArray(plugins) && plugins.some((entry) => names(entry) || (isObject(entry) && names(entry['module'])));\n}\n\n/** Whether spec-brief's configuration names the base its archive measures a round from. */\nexport function measuresArchive(config: Json): boolean {\n const archiving = config['archiving'];\n return isObject(archiving) && typeof archiving['base'] === 'string';\n}\n\n/**\n * spec-brief's configuration with the plugin loaded and the archive measured\n * from `base`, or `null` when both already hold. spec-brief's archive\n * refuses a round that changed a protected file, and learns that a signed\n * ruling allows it only by asking the plugin (ADR-0006). It checks the file at\n * all only when it knows the base: without one it warns that the scope went\n * unmeasured and passes, so the gate is open until a base is named. A base a\n * person wrote is kept.\n */\nexport function mergeSpecBrief(current: Json, base: string | null = null, isPluginFile?: (path: string) => boolean): Json | null {\n const plugin = loadsPlugin(current, isPluginFile);\n const measure = base !== null && !measuresArchive(current);\n if (plugin && !measure) return null;\n const plugins: unknown[] = Array.isArray(current['plugins']) ? current['plugins'] : [];\n const archiving: Json = isObject(current['archiving']) ? current['archiving'] : {};\n return {\n ...current,\n ...(plugin ? {} : { plugins: [...plugins, PLUGIN] }),\n ...(measure ? { archiving: { ...archiving, base } } : {}),\n };\n}\n\n/** Whether spec-brief loads the plugin, as its configuration at the root says. */\nexport type PluginState =\n | { readonly kind: 'loaded' | 'not-loaded' | 'unreadable'; readonly file: string }\n | { readonly kind: 'unconfigured' };\n\n/** What a person reads about the plugin, and what to do when it is not loaded. */\nexport function describePlugin(state: PluginState): string {\n switch (state.kind) {\n case 'loaded':\n return `spec-brief loads spec-harness's plugin (${state.file}): its archive accepts a protected file a signed ruling allows`;\n case 'not-loaded':\n return `spec-brief does not load spec-harness's plugin, so its archive refuses a protected file whatever ruling is signed: add \"${PLUGIN}\" to \"plugins\" in ${state.file}, or run spec-harness init --write`;\n case 'unreadable':\n return `${state.file} cannot be read as JSON, so whether spec-brief loads spec-harness's plugin is unknown`;\n case 'unconfigured':\n return \"spec-brief has no configuration at the root, so it loads no plugin: spec-harness init --write writes one that loads spec-harness's\";\n }\n}\n\n/** What git says that tells a base apart. */\nexport interface BaseFacts {\n /** The remote's default branch as a local ref, such as `origin/main`, or `null`. */\n readonly remoteDefault: string | null;\n /** The branch checked out, or `null` on a detached head. */\n readonly branch: string | null;\n /** Every local branch. */\n readonly branches: readonly string[];\n}\n\n/** The base `init` names, and why; `base` is `null` when none can be told. */\nexport interface BaseChoice {\n readonly base: string | null;\n readonly detail: string;\n}\n\n/**\n * The base `init` writes into `.spec-harness.json`. Every ruling is verified\n * against the allowed signers on it, so it is named rather than left to be\n * found. The remote's default branch comes first, but git records it when\n * it clones, and before 2.48 not on a fetch: a repository made with `git\n * init` and pushed to a remote often has none. There the branch init runs on\n * is the base when it is `main` or `master`, or the only branch; otherwise\n * the person names it.\n */\nexport function chooseBase(facts: BaseFacts): BaseChoice {\n const { remoteDefault, branch } = facts;\n if (remoteDefault !== null) return { base: remoteDefault, detail: `rounds are measured from ${remoteDefault}, the remote's default branch` };\n const unrecorded = 'no remote records a default branch (refs/remotes/origin/HEAD)';\n if (branch !== null) {\n const conventional = branch === 'main' || branch === 'master';\n if (conventional || facts.branches.every((name) => name === branch)) {\n const which = conventional ? 'the branch init runs on' : 'the only branch';\n return { base: branch, detail: `rounds are measured from ${branch}, ${which}: ${unrecorded}; change \"base\" if rounds merge into another` };\n }\n }\n const where = branch === null ? 'HEAD is detached' : `${branch} is not main, master or the only branch`;\n return {\n base: null,\n detail: `no base can be told: ${unrecorded}, and ${where}; set \"base\" to the branch rounds merge into, or run git remote set-head origin --auto and init again`,\n };\n}\n\n/** Where a base came from: `--base`, the configuration, or the remote. */\nexport type BaseSource = 'flag' | 'config' | 'remote';\n\nconst SOURCES: Readonly<Record<BaseSource, string>> = { flag: '--base', config: '.spec-harness.json', remote: \"the remote's default branch\" };\n\n/** The base a command resolved, and how; or why there is none. */\nexport function describeBase(base: { readonly ref: string; readonly source: BaseSource; readonly mergeBase: string } | { readonly reason: string }): string {\n if ('reason' in base) return `none: ${base.reason}`;\n return `${base.ref} (${SOURCES[base.source]}), merge base ${base.mergeBase.slice(0, 12)}`;\n}\n\n/** Whether the allowed-signers file is on the base, where every ruling's signature is checked against it. */\nexport function describeSigners(file: string, base: string | null, onBase: boolean): string {\n if (base === null) return `${file}, read from the base, which could not be resolved: no ruling can count`;\n if (onBase) return `${file} is on ${base}`;\n return `${file} is not on ${base}, so no ruling can count: commit it there, one line per person: <email> namespaces=\"git\" <public key>`;\n}\n\n/**\n * The note doctor gives on the signers whose key is not FIDO2, or `null`\n * when every one's is. A note, never a failure: ADR-0006 accepts a key the\n * agent's account cannot read too, and a PIV or PKCS#11 hardware key is\n * written as a plain key.\n */\nexport function describeSignerKeys(signers: readonly Pick<AllowedSigner, 'line' | 'principals' | 'keyType'>[]): string | null {\n if (signers.length === 0) return null;\n const named = signers.map((signer) => `${signer.principals.join(',')} (${signer.keyType}, line ${signer.line})`).join(', ');\n return (\n `note: signers whose key is not a FIDO2 key: ${named}. ` +\n \"Where an agent runs as the person, ADR-0006 recommends a FIDO2 key, ssh-keygen -t ed25519-sk, whose signature needs a touch no process can supply, or a key the agent's account cannot read; \" +\n 'a PIV or PKCS#11 hardware key reads as a plain ssh-rsa or ecdsa line, so this is a note, not a failure'\n );\n}\n\n/** The note doctor gives on a line of the allowed-signers file that is not a signer. */\nexport function describeSignerProblem(problem: { readonly line: number; readonly message: string }): string {\n return `note: line ${problem.line} is not a signer: ${problem.message}`;\n}\n\n/** What doctor says of the Claude Code on `PATH`, which runs the guard's hooks only from the minimum on. */\nexport function describeClaudeRelease(check: ClaudeCodeCheck): string {\n // A version read from a package.json says so: nothing ran to tell it.\n const release = (found: { readonly version: string; readonly file?: string }): string =>\n `Claude Code ${found.version}${found.file === undefined ? '' : ` (as ${found.file} declares)`}`;\n switch (check.state) {\n case 'ok':\n return `${release(check)} runs the hooks, which need ${CLAUDE_CODE_MINIMUM} or later`;\n case 'outdated':\n return `${release(check)} is older than ${CLAUDE_CODE_MINIMUM}, which the hooks need: it ignores a hook's args and runs a bare node, which fails, and a PreToolUse hook that fails blocks nothing, so every write passes unguarded: update Claude Code, with claude update`;\n case 'unknown':\n return `whether Claude Code is ${CLAUDE_CODE_MINIMUM} or later, which the hooks need, cannot be told: ${check.reason}; an older release lets every write pass unguarded, so check claude --version where Claude Code runs`;\n }\n}\n\n/** Where git's pre-commit hook stands: git's path for it, shown from the root, and what is there. */\nexport type GitHookState =\n | { readonly state: 'runs' | 'absent' | 'other' | 'inert'; readonly file: string }\n | { readonly state: 'unknown'; readonly reason: string };\n\n/**\n * The advice for a missing hook, which init gives beside the file and doctor\n * with it. The hook is the guard for a write the agent's hooks never see,\n * one made through a shell (ADR-0005).\n */\nexport function missingGitHook(file: string | null): string {\n const where = file === null ? '' : ` (${file})`;\n return `no pre-commit hook runs spec-harness${where}: one refuses a commit that changes what the active brief protects, for any agent or none, a shell's writes included; run spec-harness init --git-hook --write to add it`;\n}\n\n/**\n * How to keep the files the rules live in from changing unread, on each\n * forge, as spec-core's ADR-0005 asks: the forge protects them, and CI checks\n * a change against the base branch's rules. GitLab Free has no Code Owners\n * approval, so there the person who merges is the reviewer.\n */\nexport const PROTECT_RULE_FILES =\n \"Have the forge protect this file, the ADRs, the tool configurations and the CI configuration, so no change to them reaches the base branch without a person, and check each change in CI against the base branch's rules: \" +\n 'on GitHub, CODEOWNERS and a protected branch; on GitLab Premium, Code Owners; on GitLab Free, a protected branch no one pushes to, merged by Maintainers, agents as Developers, and pipelines that must succeed. ' +\n \"spec-core's docs/adopting.md has the settings\";\n\n/**\n * The line to add to a hook the repository has of its own: node and the\n * script in the project's install, as Claude Code's hooks are run. git starts\n * a pre-commit hook at the top of the work tree it commits in, a linked\n * worktree's own, wherever the hook is kept, so the path is read from there.\n */\nexport const GIT_HOOK_LINE = `node ${BIN} hook git`;\n\n/**\n * The hook init writes. It is a POSIX sh script on every platform, since Git\n * for Windows runs a hook with the sh it ships. Where the project's install\n * is not in the work tree - a linked worktree nobody installed into, a\n * repository that shares its hooks with one that uses the harness - node\n * would end on a stack trace, so the hook says what is missing and where, and\n * the commit waits, as it did when npx found nothing to run.\n */\nexport const PRE_COMMIT = `#!/bin/sh\n# spec-harness: refuse a commit that changes what the active brief protects.\n# git runs this at the top of the work tree it commits in, a linked worktree's\n# own, wherever the hook is kept: the project's install is read from there.\nbin=${BIN}\nif [ ! -f \"$bin\" ]; then\n printf '%s\\\\n' \"spec-harness: $bin is not in $PWD, the work tree git commits in: install the project's dependencies there, as with npm ci, and commit again\" >&2\n exit 2\nfi\nexec node \"$bin\" hook git\n`;\n\n/**\n * What doctor and init add of a hook whose text runs the harness through\n * npx: the hook init wrote through 0.9.1, or the line it advised for a hook\n * of the repository's own. A note, never a failure: the hook guards as it\n * did. npx starts npm to start node, and npm 12 says on stderr what it runs,\n * twice a commit. A comment that names the command runs nothing, and neither\n * does another runner's line, which is the repository's to choose.\n */\nexport function gitHookNote(text: string): string | null {\n const npx = text.split('\\n').some((line) => /^[^#]*\\bnpx\\b.*\\bspec-harness\\s+hook\\s+git\\b/.test(line));\n if (!npx) return null;\n return `it runs spec-harness through npx, which starts npm to start node on every commit, and under npm 12 prints two \"npm notice run\" lines each time: to run it with node from the project's install, as Claude Code's hooks are, replace the npx command there with \"${GIT_HOOK_LINE}\"`;\n}\n\n/** What doctor says of git's pre-commit hook. */\nexport function describeGitHook(hook: GitHookState): string {\n switch (hook.state) {\n case 'runs':\n return `${hook.file} runs spec-harness`;\n case 'inert':\n return `${hook.file} runs spec-harness, but is not executable, so git skips it: chmod +x ${hook.file}`;\n case 'other':\n return `${hook.file} does not run spec-harness: add the line \"${GIT_HOOK_LINE}\" to it`;\n case 'absent':\n return missingGitHook(hook.file);\n case 'unknown':\n return `where git runs its hooks cannot be told: ${hook.reason}`;\n }\n}\n\n/** spec-graph's configuration files, in the order spec-graph reads them; then a \"spec-graph\" key in package.json. */\nexport const SPEC_GRAPH_CONFIGS: readonly string[] = ['.spec-graph.json', 'spec-graph.config.json'];\n\n/**\n * spec-graph's own patterns when its configuration names none, its\n * DEFAULT_PATTERNS as of 0.9.0. They decide only what init says, never what\n * it writes: `patterns` in the configuration replaces them, so writing the\n * briefs into it would freeze spec-graph's defaults into the file.\n */\nconst SPEC_GRAPH_DEFAULTS: readonly string[] = ['docs/**/*.md', 'doc/**/*.md', 'adr/**/*.md', 'rfcs/**/*.md', 'specs/**/*.md', '*.md'];\n\n/** Whether spec-graph, configured as `config` says, reads the briefs in the directory `briefs`. */\nexport function graphReadsBriefs(config: Json, briefs: string): boolean {\n const configured = Array.isArray(config['patterns']) ? config['patterns'].filter((pattern): pattern is string => typeof pattern === 'string') : [];\n const list = parseGlobList(configured.length > 0 ? configured : SPEC_GRAPH_DEFAULTS, { dialect: 'path', caseSensitive: true, backslash: 'separator' });\n return list.ok && list.list.match(`${briefs}/001_brief.md`);\n}\n\n/**\n * What the history entry does. spec-graph reads a brief whose status says\n * `archived` as a record already; the entry makes one a record whatever word\n * its status uses, or none - and it does anything only where spec-graph\n * reads the briefs, which its defaults do not in `briefs/`.\n */\nexport function describeGraph(archiveGlob: string, briefs: string, reads: boolean, added: boolean): string {\n const history = added ? `read ${archiveGlob} as history` : `${archiveGlob} is history`;\n if (reads) return `${history}: an archived brief is a record whatever its status says, so a live brief that depends on one is not a stale premise`;\n return `${history}, for when spec-graph reads the briefs; its patterns do not reach ${briefs}/, so it checks none of them now: add \"${briefs}/**/*.md\" to its \"patterns\" if it should`;\n}\n\n/** spec-graph's configuration with the archive read as history, or `null` when it already is. */\nexport function mergeSpecGraph(current: Json, archiveGlob: string): Json | null {\n const history = Array.isArray(current['historyPatterns']) ? (current['historyPatterns'] as unknown[]).filter((p): p is string => typeof p === 'string') : [];\n if (history.includes(archiveGlob)) return null;\n return { ...current, historyPatterns: [...history, archiveGlob] };\n}\n"]}
package/dist/index.d.ts CHANGED
@@ -22,7 +22,7 @@ export type { HookRequest, HookResponse } from './hooks.js';
22
22
  export { readJUnit } from './junit.js';
23
23
  export type { JUnitCase, JUnitRead } from './junit.js';
24
24
  export { diffManifest, ecosystemOf, manifestMatcher, readManifest, readManifestNames } from './manifests.js';
25
- export type { Dependency, DependencyChange, Ecosystem, ManifestNames } from './manifests.js';
25
+ export type { Dependency, DependencyChange, Ecosystem, InstallScriptChange, InstallScriptEntry, InstallScriptVerdict, ManifestNames, ManifestRead } from './manifests.js';
26
26
  export { classify, readProbes, renderEvidence, verdictOf } from './probe.js';
27
27
  export type { Classified, CodeBlock, ProbeFile, ProbeResult, ProbeRun, ProbeSet, ProbeSpec } from './probe.js';
28
28
  export { createReader } from './reader.js';
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAG5F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7G,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["/**\n * Programmatic API. The command line is a thin shell over these; a harness of\n * another kind - a CI job, an orchestrator - can ask the same questions.\n */\n\nexport { main, run, EXIT_ERROR, EXIT_FAILED, EXIT_OK, UsageError, version } from './cli.js';\nexport type { CliIO } from './cli.js';\n\nexport { audit, describeMeasured } from './audit.js';\nexport type { AssertionOutcome, AuditInput, AuditReport, Measured, UnreadableAssertion } from './audit.js';\nexport { briefIdFromBranch, idFromBranch, sameId, templateError } from './branch.js';\nexport { findActive, parseBriefList, SiblingOutputError, SUPPORTED_SCHEMA_VERSIONS } from './briefs.js';\nexport type { ActiveBrief, ActiveSource } from './briefs.js';\nexport { ConfigError, CONFIG_FILE, DEFAULT_CONFIG, parseConfig, SIBLINGS } from './config.js';\nexport type { HarnessConfig, OutOfScope, SiblingName } from './config.js';\nexport { renderContext } from './context.js';\nexport type { CitedDocument, ContextInput, ContextPacket, RuleInForce, RulingInForce, UnreadablePattern, UnreadableRulingPath } from './context.js';\nexport { formatFindings, formatGithub, formatGitlab, formatSarif } from './formats.js';\nexport type { FindingFormat, FormatOptions } from './formats.js';\nexport { decide } from './guard.js';\nexport type { Decision, GuardInput, Reason, Verdict, VerifiedRuling } from './guard.js';\nexport { claudeResponse, gitResponse, parseClaudeHook, WRITING_TOOLS } from './hooks.js';\nexport type { HookRequest, HookResponse } from './hooks.js';\nexport { readJUnit } from './junit.js';\nexport type { JUnitCase, JUnitRead } from './junit.js';\nexport { diffManifest, ecosystemOf, manifestMatcher, readManifest, readManifestNames } from './manifests.js';\nexport type { Dependency, DependencyChange, Ecosystem, ManifestNames } from './manifests.js';\nexport { classify, readProbes, renderEvidence, verdictOf } from './probe.js';\nexport type { Classified, CodeBlock, ProbeFile, ProbeResult, ProbeRun, ProbeSet, ProbeSpec } from './probe.js';\nexport { createReader } from './reader.js';\nexport { addRulingRow, nextId, pathsOf, readRulings, renderMemo, renderRow } from './rulings.js';\nexport type { EscalationOption, EscalationRequest, RulingRow, TableView } from './rulings.js';\nexport { buildContext, checkPaths, checkRulings, raiseEscalation, recordRuling, resolveBase, runAudit } from './round.js';\nexport { GUARD_HOOK, mcpServer, mergeClaudeSettings, mergeMcp, mergeSpecGraph, PROJECT_DIR, PROJECT_DIR_OR_HERE } from './configure.js';\nexport type { BriefRow, FileChange, Finding, Severity } from './types.js';\n"]}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAG5F,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvF,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE7G,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE7E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC","sourcesContent":["/**\n * Programmatic API. The command line is a thin shell over these; a harness of\n * another kind - a CI job, an orchestrator - can ask the same questions.\n */\n\nexport { main, run, EXIT_ERROR, EXIT_FAILED, EXIT_OK, UsageError, version } from './cli.js';\nexport type { CliIO } from './cli.js';\n\nexport { audit, describeMeasured } from './audit.js';\nexport type { AssertionOutcome, AuditInput, AuditReport, Measured, UnreadableAssertion } from './audit.js';\nexport { briefIdFromBranch, idFromBranch, sameId, templateError } from './branch.js';\nexport { findActive, parseBriefList, SiblingOutputError, SUPPORTED_SCHEMA_VERSIONS } from './briefs.js';\nexport type { ActiveBrief, ActiveSource } from './briefs.js';\nexport { ConfigError, CONFIG_FILE, DEFAULT_CONFIG, parseConfig, SIBLINGS } from './config.js';\nexport type { HarnessConfig, OutOfScope, SiblingName } from './config.js';\nexport { renderContext } from './context.js';\nexport type { CitedDocument, ContextInput, ContextPacket, RuleInForce, RulingInForce, UnreadablePattern, UnreadableRulingPath } from './context.js';\nexport { formatFindings, formatGithub, formatGitlab, formatSarif } from './formats.js';\nexport type { FindingFormat, FormatOptions } from './formats.js';\nexport { decide } from './guard.js';\nexport type { Decision, GuardInput, Reason, Verdict, VerifiedRuling } from './guard.js';\nexport { claudeResponse, gitResponse, parseClaudeHook, WRITING_TOOLS } from './hooks.js';\nexport type { HookRequest, HookResponse } from './hooks.js';\nexport { readJUnit } from './junit.js';\nexport type { JUnitCase, JUnitRead } from './junit.js';\nexport { diffManifest, ecosystemOf, manifestMatcher, readManifest, readManifestNames } from './manifests.js';\nexport type { Dependency, DependencyChange, Ecosystem, InstallScriptChange, InstallScriptEntry, InstallScriptVerdict, ManifestNames, ManifestRead } from './manifests.js';\nexport { classify, readProbes, renderEvidence, verdictOf } from './probe.js';\nexport type { Classified, CodeBlock, ProbeFile, ProbeResult, ProbeRun, ProbeSet, ProbeSpec } from './probe.js';\nexport { createReader } from './reader.js';\nexport { addRulingRow, nextId, pathsOf, readRulings, renderMemo, renderRow } from './rulings.js';\nexport type { EscalationOption, EscalationRequest, RulingRow, TableView } from './rulings.js';\nexport { buildContext, checkPaths, checkRulings, raiseEscalation, recordRuling, resolveBase, runAudit } from './round.js';\nexport { GUARD_HOOK, mcpServer, mergeClaudeSettings, mergeMcp, mergeSpecGraph, PROJECT_DIR, PROJECT_DIR_OR_HERE } from './configure.js';\nexport type { BriefRow, FileChange, Finding, Severity } from './types.js';\n"]}
package/dist/manifests.d.ts CHANGED
@@ -8,6 +8,11 @@
8
8
  * declares dependencies and nothing more - no resolver, no lockfile, no
9
9
  * network. A manifest it cannot read is reported as unread, never as clean,
10
10
  * and so is a configured name it cannot read.
11
+ *
12
+ * The same holds for the one line that lets a dependency run code when it is
13
+ * installed. npm 12 runs a dependency's install scripts only where the root
14
+ * package's `allowScripts` allows the package, so an entry a round adds
15
+ * there turns on code that is nowhere in its diff.
11
16
  */
12
17
  export type Ecosystem = 'npm' | 'cargo' | 'go' | 'pip' | 'python' | 'nuget' | 'bundler';
13
18
  export interface Dependency {
@@ -26,9 +31,29 @@ export interface DependencyChange {
26
31
  /** `null` when the dependency was removed. */
27
32
  readonly after: string | null;
28
33
  }
34
+ /** What an entry of an install-script policy says of the package it names. */
35
+ export type InstallScriptVerdict = 'allowed' | 'denied';
36
+ export interface InstallScriptEntry {
37
+ /** The field that holds the policy, `allowScripts`. */
38
+ readonly section: string;
39
+ /** The entry's key as written: a package, or a package at the versions it names. */
40
+ readonly name: string;
41
+ readonly verdict: InstallScriptVerdict;
42
+ }
43
+ export interface InstallScriptChange {
44
+ readonly file: string;
45
+ readonly ecosystem: Ecosystem;
46
+ readonly section: string;
47
+ readonly name: string;
48
+ /** `null` when the policy had no such entry. */
49
+ readonly before: InstallScriptVerdict | null;
50
+ /** `null` when the entry was removed. */
51
+ readonly after: InstallScriptVerdict | null;
52
+ }
29
53
  export type ManifestRead = {
30
54
  readonly ok: true;
31
55
  readonly dependencies: readonly Dependency[];
56
+ readonly installScripts: readonly InstallScriptEntry[];
32
57
  } | {
33
58
  readonly ok: false;
34
59
  readonly error: string;
@@ -61,15 +86,17 @@ export declare function readManifestNames(patterns: readonly string[]): Manifest
61
86
  export declare function manifestMatcher(patterns: readonly string[]): (path: string) => boolean;
62
87
  /** The name a PEP 508 requirement names, normalised as PEP 503 says. */
63
88
  export declare function pythonName(requirement: string): string;
64
- /** Reads the dependencies a manifest declares. */
89
+ /** Reads the dependencies a manifest declares, and the entries of its install-script policy where its format has one. */
65
90
  export declare function readManifest(ecosystem: Ecosystem, text: string): ManifestRead;
66
91
  /**
67
- * What changed between two versions of one manifest. `null` text is a file
68
- * that does not exist on that side. Returns the error instead when either
69
- * side cannot be read.
92
+ * What changed between two versions of one manifest: its dependencies, and
93
+ * the entries of its install-script policy. `null` text is a file that does
94
+ * not exist on that side. Returns the error instead when either side cannot
95
+ * be read.
70
96
  */
71
97
  export declare function diffManifest(file: string, ecosystem: Ecosystem, before: string | null, after: string | null): {
72
98
  readonly changes: readonly DependencyChange[];
99
+ readonly installScripts: readonly InstallScriptChange[];
73
100
  } | {
74
101
  readonly error: string;
75
102
  };
package/dist/manifests.js CHANGED
@@ -8,6 +8,11 @@
8
8
  * declares dependencies and nothing more - no resolver, no lockfile, no
9
9
  * network. A manifest it cannot read is reported as unread, never as clean,
10
10
  * and so is a configured name it cannot read.
11
+ *
12
+ * The same holds for the one line that lets a dependency run code when it is
13
+ * installed. npm 12 runs a dependency's install scripts only where the root
14
+ * package's `allowScripts` allows the package, so an entry a round adds
15
+ * there turns on code that is nowhere in its diff.
11
16
  */
12
17
  import { globAlternatives, parseGlob } from './vendor/spec-core/pattern/index.js';
13
18
  /** The ecosystem a manifest file name belongs to, or `null`. */
@@ -82,7 +87,35 @@ function readNpm(text) {
82
87
  for (const [name, version] of Object.entries(table))
83
88
  out.push({ section, name, version: String(version) });
84
89
  }
85
- return { ok: true, dependencies: out };
90
+ return { ok: true, dependencies: out, installScripts: npmInstallScripts(value) };
91
+ }
92
+ /**
93
+ * npm 12's install-script policy, where `npm install-scripts approve` and
94
+ * `deny` write it: a package, or a package at exact versions, to `true` or
95
+ * `false`.
96
+ */
97
+ const NPM_INSTALL_SCRIPTS = 'allowScripts';
98
+ /**
99
+ * The entries of `allowScripts`, read as npm reads them. It takes the field
100
+ * only when it is an object and an entry only when its value is `true` or
101
+ * `false`: anything else approves nothing and denies nothing, so it is no
102
+ * entry here either, and never a manifest that cannot be read. Each key is
103
+ * kept as written. Telling `canvas@1.2.3` from `canvas@^1`, which npm
104
+ * passes over, is npm's own reading of a package spec, and the audit names
105
+ * the entry for a person to read.
106
+ */
107
+ function npmInstallScripts(manifest) {
108
+ const policy = manifest[NPM_INSTALL_SCRIPTS];
109
+ if (typeof policy !== 'object' || policy === null)
110
+ return [];
111
+ const out = [];
112
+ for (const [name, value] of Object.entries(policy)) {
113
+ if (value === true)
114
+ out.push({ section: NPM_INSTALL_SCRIPTS, name, verdict: 'allowed' });
115
+ else if (value === false)
116
+ out.push({ section: NPM_INSTALL_SCRIPTS, name, verdict: 'denied' });
117
+ }
118
+ return out;
86
119
  }
87
120
  /* -------------------------------------------------------------------- TOML */
88
121
  /** A TOML value on one line, or the start of a multi-line array. Comments and quotes read the way TOML reads them. */
@@ -312,11 +345,15 @@ function readGemfile(text) {
312
345
  }
313
346
  return { ok: true, dependencies: out };
314
347
  }
315
- /** Reads the dependencies a manifest declares. */
348
+ /** Reads the dependencies a manifest declares, and the entries of its install-script policy where its format has one. */
316
349
  export function readManifest(ecosystem, text) {
350
+ if (ecosystem === 'npm')
351
+ return readNpm(text);
352
+ const read = readDependencies(ecosystem, text);
353
+ return read.ok ? { ...read, installScripts: [] } : read;
354
+ }
355
+ function readDependencies(ecosystem, text) {
317
356
  switch (ecosystem) {
318
- case 'npm':
319
- return readNpm(text);
320
357
  case 'cargo':
321
358
  return readCargo(text);
322
359
  case 'go':
@@ -331,17 +368,36 @@ export function readManifest(ecosystem, text) {
331
368
  return readGemfile(text);
332
369
  }
333
370
  }
371
+ /** The entries added or said differently, in the order written, then those removed. */
372
+ function moved(old, now) {
373
+ const key = (entry) => `${entry.section}\u0000${entry.name}`;
374
+ const was = new Map(old.map((entry) => [key(entry), entry]));
375
+ const is = new Map(now.map((entry) => [key(entry), entry]));
376
+ const out = [];
377
+ for (const [id, entry] of is) {
378
+ const previous = was.get(id);
379
+ if (previous === undefined || previous.value !== entry.value) {
380
+ out.push({ section: entry.section, name: entry.name, before: previous?.value ?? null, after: entry.value });
381
+ }
382
+ }
383
+ for (const [id, entry] of was) {
384
+ if (!is.has(id))
385
+ out.push({ section: entry.section, name: entry.name, before: entry.value, after: null });
386
+ }
387
+ return out;
388
+ }
334
389
  /**
335
- * What changed between two versions of one manifest. `null` text is a file
336
- * that does not exist on that side. Returns the error instead when either
337
- * side cannot be read.
390
+ * What changed between two versions of one manifest: its dependencies, and
391
+ * the entries of its install-script policy. `null` text is a file that does
392
+ * not exist on that side. Returns the error instead when either side cannot
393
+ * be read.
338
394
  */
339
395
  export function diffManifest(file, ecosystem, before, after) {
340
396
  const read = (text, side) => {
341
397
  if (text === null)
342
- return [];
398
+ return { dependencies: [], installScripts: [] };
343
399
  const result = readManifest(ecosystem, text);
344
- return result.ok ? result.dependencies : `${file} (${side}): ${result.error}`;
400
+ return result.ok ? result : `${file} (${side}): ${result.error}`;
345
401
  };
346
402
  const old = read(before, 'before');
347
403
  if (typeof old === 'string')
@@ -349,20 +405,11 @@ export function diffManifest(file, ecosystem, before, after) {
349
405
  const now = read(after, 'after');
350
406
  if (typeof now === 'string')
351
407
  return { error: now };
352
- const key = (d) => `${d.section}\u0000${d.name}`;
353
- const was = new Map(old.map((d) => [key(d), d]));
354
- const is = new Map(now.map((d) => [key(d), d]));
355
- const changes = [];
356
- for (const [id, dependency] of is) {
357
- const previous = was.get(id);
358
- if (previous === undefined || previous.version !== dependency.version) {
359
- changes.push({ file, ecosystem, section: dependency.section, name: dependency.name, before: previous?.version ?? null, after: dependency.version });
360
- }
361
- }
362
- for (const [id, dependency] of was) {
363
- if (!is.has(id))
364
- changes.push({ file, ecosystem, section: dependency.section, name: dependency.name, before: dependency.version, after: null });
365
- }
366
- return { changes };
408
+ const versions = (side) => side.dependencies.map((d) => ({ section: d.section, name: d.name, value: d.version }));
409
+ const verdicts = (side) => side.installScripts.map((e) => ({ section: e.section, name: e.name, value: e.verdict }));
410
+ return {
411
+ changes: moved(versions(old), versions(now)).map((change) => ({ file, ecosystem, ...change })),
412
+ installScripts: moved(verdicts(old), verdicts(now)).map((change) => ({ file, ecosystem, ...change })),
413
+ };
367
414
  }
368
415
  //# sourceMappingURL=manifests.js.map