@dzhechkov/harness-core 0.3.124 → 0.3.126

package/dist/release.js

@@ -0,0 +1,509 @@
+/**
+ * Verified-release engine (`dz release`, feature release-verified, ADR-001).
+ *
+ * VERIFY phase of the DETECT→VERIFY→ANALYZE→RELEASE conveyor (grounded in open-claude-code
+ * ADR-003 nightly-verified-release): four HARD gates — tests / audit / syntax / smoke-boot —
+ * planned and classified here as PURE functions over injected data, executed only by the CLI.
+ *
+ * Architecture contract (ADR-001, D1–D4):
+ * - NO `node:child_process` anywhere in this file — the engine plans commands as DATA
+ *   (`GateStep.cmd` strings a test can assert, `publishArgv` precedent) and classifies
+ *   injected execution results. The CLI (`cmdRelease`) is the single executor.
+ * - The only fs access lives in {@link collectPackageFacts} (readFileSync/readdirSync/statSync,
+ *   `discoverPackages` precedent); everything downstream of the facts is pure.
+ * - The existing publish gates (guard, claim-check, signature, provenance, files-whitelist)
+ *   are NEVER duplicated here: a green release hands off to the untouched `dz publish`,
+ *   and an anti-duplication test greps every planned command for gate keywords.
+ * - Fail-closed: any `fail` ⇒ `publishAction: 'blocked'`; a planned-but-unexecuted step is a
+ *   FAILURE (an under-executed plan can never pass); all-skip is NOT `proceed` (nothing
+ *   verified is not verified).
+ *
+ * @packageDocumentation
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { discoverPackages, orderByDependencies } from './publish.js';
+/** Order the CLI executes and the verdict reports gates in. */
+export const RELEASE_GATE_ORDER = ['tests', 'audit', 'syntax', 'smoke'];
+/** Default per-step timeouts (NFR-4: a hung child is a classified failure, not a hung release). */
+export const RELEASE_TIMEOUTS = {
+    testMs: 600_000,
+    auditMs: 120_000,
+    syntaxMs: 30_000,
+    smokeMs: 20_000,
+};
+/* ------------------------------------------------------------------ */
+/*  DETECT — facts collection (the only fs in this file)               */
+/* ------------------------------------------------------------------ */
+/** Recursively list `*.js` files under `dir`, returned relative to `base`. */
+function listJsFiles(base, dir) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out; // unreadable dir → no files (dist absence is reported by the plan, not here)
+    }
+    for (const e of entries) {
+        const full = join(dir, e.name);
+        if (e.isDirectory())
+            out.push(...listJsFiles(base, full));
+        else if (e.isFile() && e.name.endsWith('.js'))
+            out.push(full.slice(base.length + 1));
+    }
+    return out;
+}
+/** Newest file mtime (ms) under `dir`, recursively; 0 when empty/unreadable. */
+function newestMtime(dir) {
+    let newest = 0;
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return newest;
+    }
+    for (const e of entries) {
+        const full = join(dir, e.name);
+        try {
+            if (e.isDirectory())
+                newest = Math.max(newest, newestMtime(full));
+            else if (e.isFile())
+                newest = Math.max(newest, statSync(full).mtimeMs);
+        }
+        catch {
+            /* raced/unreadable entry — skip */
+        }
+    }
+    return newest;
+}
+/**
+ * Gather {@link ReleasePackageFacts} for the release set: `discoverPackages` +
+ * `orderByDependencies` (imported from publish — reuse, never copy: G9) plus each package's
+ * `scripts.test` / `bin` / `dist/**\/*.js` and dist-vs-src staleness (AM-3 input).
+ *
+ * `filter` mirrors `dz publish --filter` substring semantics (name OR dir); an explicitly
+ * empty filter is REJECTED (throws) — "match all on empty" was the publish P0 this mirrors.
+ *
+ * Failure contract (load-bearing path — fail FAST, not open): a corrupt `package.json`
+ * throws up to the caller; a missing/foreign root degrades to `[]` per the
+ * `discoverPackages` contract (the CLI reports "no publishable packages" and exits non-zero).
+ */
+export function collectPackageFacts(monorepoRoot, filter) {
+    if (filter !== undefined && filter.length === 0) {
+        throw new Error('release: --filter requires a non-empty list of package-name substrings (empty would match ALL packages)');
+    }
+    const discovered = discoverPackages(monorepoRoot);
+    const selected = filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => p.name.includes(f) || p.dir.includes(f)));
+    const ordered = orderByDependencies(selected);
+    return ordered.map((p) => {
+        const pkgJson = JSON.parse(readFileSync(join(p.dir, 'package.json'), 'utf-8'));
+        const bins = [];
+        if (typeof pkgJson.bin === 'string') {
+            // `"bin": "cli.js"` — bin name defaults to the package basename; path may lack `./` (G3).
+            const rel = pkgJson.bin.replace(/^\.\//, '');
+            const abs = join(p.dir, rel);
+            bins.push({ name: p.name.split('/').pop() ?? p.name, path: abs, exists: existsSync(abs) });
+        }
+        else if (pkgJson.bin !== undefined && pkgJson.bin !== null && typeof pkgJson.bin === 'object') {
+            for (const [name, relRaw] of Object.entries(pkgJson.bin)) {
+                const rel = String(relRaw).replace(/^\.\//, '');
+                const abs = join(p.dir, rel);
+                bins.push({ name, path: abs, exists: existsSync(abs) });
+            }
+        }
+        const distDir = join(p.dir, 'dist');
+        const srcDir = join(p.dir, 'src');
+        const distJs = existsSync(distDir) ? listJsFiles(p.dir, distDir).sort() : [];
+        let srcNewerThanDist;
+        if (existsSync(distDir) && existsSync(srcDir)) {
+            srcNewerThanDist = newestMtime(srcDir) > newestMtime(distDir);
+        }
+        return {
+            name: p.name,
+            dir: p.dir,
+            version: p.version,
+            hasTestScript: typeof pkgJson.scripts?.['test'] === 'string' && pkgJson.scripts['test'].trim().length > 0,
+            hasBuildScript: typeof pkgJson.scripts?.['build'] === 'string' && pkgJson.scripts['build'].trim().length > 0,
+            bins,
+            distJs,
+            srcNewerThanDist,
+        };
+    });
+}
+/**
+ * AM-8: affected-package selection is a PURE function of an injected changed-file list.
+ * `null` (diff unavailable), an empty list, or a list matching zero packages all FAIL OPEN
+ * to the full set — a release can never pass on zero verified packages.
+ */
+export function selectAffectedPackages(changedFiles, facts) {
+    if (changedFiles === null || changedFiles.length === 0)
+        return [...facts];
+    const norm = (s) => s.replace(/\\/g, '/');
+    const affected = facts.filter((f) => {
+        const dir = norm(f.dir).replace(/\/$/, '');
+        const tail = dir.split('/').slice(-3).join('/'); // packages/@dzhechkov/<name>
+        return changedFiles.some((file) => {
+            const nf = norm(String(file));
+            return nf.startsWith(dir + '/') || nf === dir || nf.includes(tail + '/');
+        });
+    });
+    return affected.length === 0 ? [...facts] : affected;
+}
+/**
+ * Plan the four gates from injected facts. Pure: same facts ⇒ byte-identical plan; nothing
+ * is executed; every command is an assertable string. Anti-duplication (ADR D1): no step may
+ * re-enact a publish gate — the dedicated test greps `cmd`s for guard/claim/sign/provenance.
+ */
+export function planReleaseGates(facts, opts) {
+    const steps = [];
+    const skips = [];
+    const t = {
+        tests: opts.testTimeoutMs ?? RELEASE_TIMEOUTS.testMs,
+        audit: opts.auditTimeoutMs ?? RELEASE_TIMEOUTS.auditMs,
+        syntax: opts.syntaxTimeoutMs ?? RELEASE_TIMEOUTS.syntaxMs,
+        smoke: opts.smokeTimeoutMs ?? RELEASE_TIMEOUTS.smokeMs,
+    };
+    // Gate 1 — tests: the package's FULL suite via its own `test` script (pnpm test → vitest run).
+    for (const f of facts) {
+        if (f.hasTestScript) {
+            steps.push({
+                id: `tests:${f.name}`,
+                gate: 'tests',
+                pkg: f.name,
+                cmd: 'pnpm test',
+                cwd: f.dir,
+                timeoutMs: t.tests,
+                reason: 'full package test suite must pass',
+                kind: 'exec',
+            });
+        }
+        else {
+            // AM-2: an explicit, named skip — never a silent pass.
+            skips.push({
+                gate: 'tests',
+                pkg: f.name,
+                reason: 'no "test" script in package.json — nothing was verified for this package',
+                class: 'SKIP_NO_TEST_SCRIPT',
+            });
+        }
+    }
+    // Gate 2 — audit: ONE workspace-level step (AM-1: pnpm primary; npm only without pnpm-lock).
+    const dev = opts.includeDevDeps === true;
+    steps.push({
+        id: 'audit:workspace',
+        gate: 'audit',
+        cmd: opts.pnpmLockPresent
+            ? `pnpm audit${dev ? '' : ' --prod'} --audit-level high`
+            : `npm audit${dev ? '' : ' --omit=dev'} --audit-level=high`,
+        cwd: opts.monorepoRoot,
+        timeoutMs: t.audit,
+        reason: dev
+            ? 'no >=high advisories across ALL workspace dependencies (dev included via --audit-dev)'
+            : 'no >=high advisories in production dependencies (dev-only chains excluded — widen with --audit-dev)',
+        kind: 'exec',
+    });
+    // Gates 3+4 — per package. AM-3: a stale dist is NEVER checked/booted as-is.
+    for (const f of facts) {
+        if (f.srcNewerThanDist === true) {
+            steps.push({
+                id: `syntax:${f.name}:stale-dist`,
+                gate: 'syntax',
+                pkg: f.name,
+                cmd: '',
+                cwd: f.dir,
+                timeoutMs: 0,
+                reason: 'dist/ is OLDER than src/ — rebuild before release; a stale dist is not checked as-is',
+                kind: 'synthetic-fail',
+                failClass: 'STALE_DIST',
+            });
+            if (f.bins.length > 0) {
+                steps.push({
+                    id: `smoke:${f.name}:stale-dist`,
+                    gate: 'smoke',
+                    pkg: f.name,
+                    cmd: '',
+                    cwd: f.dir,
+                    timeoutMs: 0,
+                    reason: 'dist/ is OLDER than src/ — rebuild before release; a stale bin is not booted as-is',
+                    kind: 'synthetic-fail',
+                    failClass: 'STALE_DIST',
+                });
+            }
+            continue;
+        }
+        // AM-10 — the fail-closed INVERSE of AM-3: a package that DECLARES a build but has zero
+        // dist JS was never built — zero syntax/smoke steps must read as a FAILURE, never as a
+        // clean gate (the dead-SKIP_NO_ARTIFACTS defect Step-8 QE + the delivery gate both caught).
+        // A pack with no build script, no artifacts and no bins is a template-only pack: an honest
+        // NAMED skip (AM-2), never a silent zero-step pass.
+        if (f.distJs.length === 0) {
+            if (f.hasBuildScript === true) {
+                steps.push({
+                    id: `syntax:${f.name}:missing-dist`,
+                    gate: 'syntax',
+                    pkg: f.name,
+                    cmd: '',
+                    cwd: f.dir,
+                    timeoutMs: 0,
+                    reason: 'package declares a "build" script but dist/ contains no JS — build before release; an unbuilt package must be impossible to ship',
+                    kind: 'synthetic-fail',
+                    failClass: 'MISSING_DIST',
+                });
+            }
+            else if (f.bins.length === 0) {
+                skips.push({
+                    gate: 'syntax',
+                    pkg: f.name,
+                    reason: 'no dist/ JS, no bin, no build script — template-only pack; nothing to syntax-check or boot',
+                    class: 'SKIP_NO_ARTIFACTS',
+                });
+            }
+        }
+        // Gate 3 — syntax: node --check every dist/**/*.js and every existing bin file (deduped).
+        const checked = new Set();
+        for (const rel of f.distJs) {
+            const abs = join(f.dir, rel);
+            checked.add(abs);
+            steps.push({
+                id: `syntax:${f.name}:${rel}`,
+                gate: 'syntax',
+                pkg: f.name,
+                cmd: `node --check "${abs}"`,
+                cwd: f.dir,
+                timeoutMs: t.syntax,
+                reason: `dist file must parse (${rel})`,
+                kind: 'exec',
+            });
+        }
+        for (const bin of f.bins) {
+            if (bin.exists && !checked.has(bin.path)) {
+                checked.add(bin.path);
+                steps.push({
+                    id: `syntax:${f.name}:bin:${bin.name}`,
+                    gate: 'syntax',
+                    pkg: f.name,
+                    cmd: `node --check "${bin.path}"`,
+                    cwd: f.dir,
+                    timeoutMs: t.syntax,
+                    reason: `bin file must parse (${bin.name})`,
+                    kind: 'exec',
+                });
+            }
+        }
+        // Gate 4 — smoke-boot: node <bin> --help, DIRECT node (never npx: signals reach the wrapper,
+        // not the child), temp cwd + timeout (AM-4). A missing bin file is a synthetic MISSING_BIN.
+        for (const bin of f.bins) {
+            if (!bin.exists) {
+                steps.push({
+                    id: `smoke:${f.name}:${bin.name}:missing`,
+                    gate: 'smoke',
+                    pkg: f.name,
+                    cmd: '',
+                    cwd: f.dir,
+                    timeoutMs: 0,
+                    reason: `bin "${bin.name}" points at ${bin.path} which does not exist — build before release`,
+                    kind: 'synthetic-fail',
+                    failClass: 'MISSING_BIN',
+                });
+            }
+            else {
+                steps.push({
+                    id: `smoke:${f.name}:${bin.name}`,
+                    gate: 'smoke',
+                    pkg: f.name,
+                    cmd: `node "${bin.path}" --help`,
+                    cwd: f.dir,
+                    timeoutMs: t.smoke,
+                    reason: `bin "${bin.name}" must boot (--help, exit 0)`,
+                    kind: 'exec',
+                    tempCwd: true,
+                });
+            }
+        }
+    }
+    return { steps, skips, packages: facts.map((f) => f.name) };
+}
+/* ------------------------------------------------------------------ */
+/*  VERIFY — pure classification                                       */
+/* ------------------------------------------------------------------ */
+/**
+ * AM-1: split an audit non-zero exit into VULNS_HIGH (advisories found) vs AUDIT_ERROR
+ * (audit could not run). BOTH block (fail-closed either way); only the message differs, so a
+ * misclassification is cosmetic, never a false pass. Unrecognized output ⇒ AUDIT_ERROR — we
+ * never claim "vulnerabilities found" from output we cannot read.
+ */
+function classifyAuditFailure(output) {
+    const text = String(output ?? '');
+    const looksLikeError = /(ERR_PNPM|npm ERR!|ENOTFOUND|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|audit endpoint|registry .*(unreachable|error)|no .*lockfile|missing .*lockfile|cannot audit)/i.test(text);
+    const looksLikeVulns = /\d+\s+vulnerabilit(y|ies)|severity\s*[:>]|\bhigh\b.*\bvulnerabilit|advisor(y|ies)\b/i.test(text);
+    if (looksLikeVulns && !looksLikeError) {
+        return { cls: 'VULNS_HIGH', reason: 'audit found >=high advisories — fix or consciously fall back to plain dz publish' };
+    }
+    return {
+        cls: 'AUDIT_ERROR',
+        reason: 'audit could not complete (network/registry/lockfile) — a gate that cannot run is NOT a passed gate',
+    };
+}
+/**
+ * One-line detail for an AUDIT failure: prefer the line that actually SUMMARIZES the
+ * advisories (pnpm/npm print it to stdout) over execSync's generic stderr "Command failed…".
+ */
+function auditDetailLine(stdout, stderr) {
+    const all = `${stdout == null ? '' : String(stdout)}\n${stderr == null ? '' : String(stderr)}`;
+    const summary = all
+        .split('\n')
+        .map((l) => l.trim())
+        .find((l) => /\d+\s+vulnerabilit|severity|advisor/i.test(l));
+    return (summary ?? firstLine(stdout, stderr)).slice(0, 200);
+}
+/**
+ * First non-empty output line, for one-line failure reasons; hostile input coerced safely.
+ * Exported so the CLI reuses it for gh/tag periphery messages (G9 reuse-never-copy).
+ */
+export function firstOutputLine(...chunks) {
+    return firstLine(...chunks);
+}
+function firstLine(...chunks) {
+    for (const c of chunks) {
+        const s = c == null ? '' : String(c);
+        const line = s.split('\n').find((l) => l.trim().length > 0);
+        if (line !== undefined)
+            return line.trim().slice(0, 200);
+    }
+    return '';
+}
+/**
+ * Merge plan + executions into the {@link ReleaseVerdict} — the single fail-closed decision
+ * point (ADR load-bearing property):
+ *
+ * - any `fail` ⇒ `publishAction: 'blocked'`, `ok: false`;
+ * - a planned exec step with NO execution record ⇒ `UNEXECUTED_STEP` failure;
+ * - all-skip (nothing executed anywhere) ⇒ NOT `proceed` — nothing verified is not verified;
+ * - never throws on hostile input (`formatPublishError` discipline).
+ */
+export function classifyGateExecutions(plan, executions, now = new Date()) {
+    const byId = new Map();
+    for (const e of executions ?? []) {
+        if (e != null && typeof e.stepId === 'string')
+            byId.set(e.stepId, e);
+    }
+    const gates = RELEASE_GATE_ORDER.map((gate) => {
+        const gateSteps = (plan?.steps ?? []).filter((s) => s?.gate === gate);
+        const gateSkips = (plan?.skips ?? []).filter((s) => s?.gate === gate);
+        const failures = [];
+        let passed = 0;
+        for (const step of gateSteps) {
+            try {
+                if (step.kind === 'synthetic-fail') {
+                    failures.push({ pkg: step.pkg, reason: step.reason, class: step.failClass ?? 'EXIT_NONZERO' });
+                    continue;
+                }
+                const exec = byId.get(step.id);
+                if (exec === undefined) {
+                    failures.push({
+                        pkg: step.pkg,
+                        reason: `planned step "${step.id}" was never executed — an under-executed plan cannot pass`,
+                        class: 'UNEXECUTED_STEP',
+                    });
+                    continue;
+                }
+                if (exec.timedOut === true) {
+                    failures.push({
+                        pkg: step.pkg,
+                        reason: `timed out after ${step.timeoutMs}ms: ${step.cmd}`,
+                        class: gate === 'smoke' ? 'SMOKE_TIMEOUT' : 'TIMEOUT',
+                    });
+                    continue;
+                }
+                if (typeof exec.exitCode !== 'number' || exec.exitCode !== 0) {
+                    if (gate === 'audit') {
+                        const { cls, reason } = classifyAuditFailure(`${exec.stdout ?? ''}\n${exec.stderr ?? ''}`);
+                        const detail = auditDetailLine(exec.stdout, exec.stderr);
+                        failures.push({ pkg: step.pkg, reason: `${reason}${detail ? ` — ${detail}` : ''}`, class: cls });
+                    }
+                    else {
+                        failures.push({
+                            pkg: step.pkg,
+                            reason: `exit ${String(exec.exitCode)}: ${step.cmd}${firstLine(exec.stderr, exec.stdout) ? ` — ${firstLine(exec.stderr, exec.stdout)}` : ''}`,
+                            class: 'EXIT_NONZERO',
+                        });
+                    }
+                    continue;
+                }
+                passed += 1;
+            }
+            catch {
+                // Hostile/malformed step or execution record: classify as failure, never throw.
+                failures.push({ pkg: step?.pkg, reason: 'unclassifiable step/execution record', class: 'EXIT_NONZERO' });
+            }
+        }
+        const status = failures.length > 0 ? 'fail' : passed > 0 ? 'pass' : 'skip';
+        return { gate, status, passed, failures, skips: gateSkips };
+    });
+    const failedGates = gates.filter((g) => g.status === 'fail');
+    const anyPass = gates.some((g) => g.status === 'pass');
+    const blockedBy = failedGates.map((g) => `${g.gate}: ${g.failures.length} failure(s) [${[...new Set(g.failures.map((f) => f.class))].join(', ')}]`);
+    if (failedGates.length === 0 && !anyPass) {
+        blockedBy.push('nothing-verified: no gate executed a single step — an all-skip run is not a verified release');
+    }
+    const ok = failedGates.length === 0 && anyPass;
+    return {
+        gates,
+        ok,
+        blockedBy,
+        skipped: plan?.skips ?? [],
+        publishAction: ok ? 'proceed' : 'blocked',
+        timestamp: now.toISOString(),
+    };
+}
+/**
+ * gh-2.4-safe `gh issue create` payload (only `--title`/`--body` are assumed downstream).
+ * Pure + deterministic for a fixed verdict — the issue is the verdict's echo, never its judge.
+ */
+export function buildFailureIssue(verdict, ctx = {}) {
+    const failed = verdict.gates.filter((g) => g.status === 'fail').map((g) => g.gate);
+    const title = `dz release: gate failure — ${failed.length > 0 ? failed.join(', ') : 'nothing verified'}`;
+    const lines = [
+        `Verified release blocked at ${verdict.timestamp}.`,
+        '',
+        ...(ctx.invocation ? [`Invocation: \`${ctx.invocation}\``, ''] : []),
+        ...(ctx.repo ? [`Repo: ${ctx.repo}`, ''] : []),
+        '## Gate verdict',
+        '',
+    ];
+    for (const g of verdict.gates) {
+        const icon = g.status === 'pass' ? '✓' : g.status === 'fail' ? '✗' : '○';
+        lines.push(`- ${icon} **${g.gate}** — ${g.status} (${g.passed} passed, ${g.failures.length} failed, ${g.skips.length} skipped)`);
+        for (const f of g.failures)
+            lines.push(`  - [${f.class}] ${f.pkg ? `${f.pkg}: ` : ''}${f.reason}`);
+    }
+    if (verdict.skipped.length > 0) {
+        lines.push('', '## Skipped (honestly reported, never counted as passed)', '');
+        for (const s of verdict.skipped)
+            lines.push(`- [${s.class}] ${s.pkg}: ${s.reason}`);
+    }
+    lines.push('', `Blocked by: ${verdict.blockedBy.join('; ')}`, '', '_Auto-created by `dz release` (best-effort; the release verdict is independent of this issue)._');
+    return { title, body: lines.join('\n') };
+}
+/** Short, bounded release notes from injected `git log --oneline`-style lines. */
+export function buildReleaseNotes(gitLogLines, limit = 15) {
+    const bullets = (gitLogLines ?? [])
+        .map((l) => String(l ?? '').trim())
+        .filter((l) => l.length > 0)
+        .slice(0, Math.max(1, limit))
+        .map((l) => `- ${l.slice(0, 200)}`);
+    if (bullets.length === 0)
+        return 'Verified release (no commit subjects available).';
+    return `Verified release — recent changes:\n${bullets.join('\n')}`;
+}
+/** Deterministic tag name from injected data: `release-<yyyymmdd>-<shortsha>`. */
+export function releaseTagName(now, shortSha) {
+    const y = now.getUTCFullYear();
+    const m = String(now.getUTCMonth() + 1).padStart(2, '0');
+    const d = String(now.getUTCDate()).padStart(2, '0');
+    const sha = String(shortSha ?? '').replace(/[^0-9a-zA-Z]/g, '').slice(0, 12);
+    return sha.length > 0 ? `release-${y}${m}${d}-${sha}` : `release-${y}${m}${d}`;
+}
+//# sourceMappingURL=release.js.map

package/dist/release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKrE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAA6B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AA0HlG,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,OAAO;IACf,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,MAAM;CACP,CAAC;AAEX,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,8EAA8E;AAC9E,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,CAAC,6EAA6E;IAC3F,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;aACrD,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC7D,IAAI,CAAC,CAAC,MAAM,EAAE;gBAAE,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAoB,EAAE,MAA0B;IAClF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAE9C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAI5E,CAAC;QACF,MAAM,IAAI,GAAsB,EAAE,CAAC;QACnC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,0FAA0F;YAC1F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChG,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,gBAAqC,CAAC;QAC1C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,gBAAgB,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,aAAa,EAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YACzG,cAAc,EAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC5G,IAAI;YACJ,MAAM;YACN,gBAAgB;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAsC,EACtC,KAAqC;IAErC,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,6BAA6B;QAC9E,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqC,EAAE,IAA6B;IACnG,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG;QACR,KAAK,EAAE,IAAI,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM;QACpD,KAAK,EAAE,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,OAAO;QACtD,MAAM,EAAE,IAAI,CAAC,eAAe,IAAI,gBAAgB,CAAC,QAAQ;QACzD,KAAK,EAAE,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,OAAO;KACvD,CAAC;IAEF,+FAA+F;IAC/F,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE;gBACrB,IAAI,EAAE,OAAO;gBACb,GAAG,EAAE,CAAC,CAAC,IAAI;gBACX,GAAG,EAAE,WAAW;gBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,MAAM,EAAE,mCAAmC;gBAC3C,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO;gBACb,GAAG,EAAE,CAAC,CAAC,IAAI;gBACX,MAAM,EAAE,0EAA0E;gBAClF,KAAK,EAAE,qBAAqB;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC;QACT,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,IAAI,CAAC,eAAe;YACvB,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,qBAAqB;YACxD,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,qBAAqB;QAC7D,GAAG,EAAE,IAAI,CAAC,YAAY;QACtB,SAAS,EAAE,CAAC,CAAC,KAAK;QAClB,MAAM,EAAE,GAAG;YACT,CAAC,CAAC,uFAAuF;YACzF,CAAC,CAAC,qGAAqG;QACzG,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,aAAa;gBACjC,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,CAAC,CAAC,IAAI;gBACX,GAAG,EAAE,EAAE;gBACP,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,sFAAsF;gBAC9F,IAAI,EAAE,gBAAgB;gBACtB,SAAS,EAAE,YAAY;aACxB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,aAAa;oBAChC,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,CAAC,CAAC,IAAI;oBACX,GAAG,EAAE,EAAE;oBACP,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,SAAS,EAAE,CAAC;oBACZ,MAAM,EAAE,oFAAoF;oBAC5F,IAAI,EAAE,gBAAgB;oBACtB,SAAS,EAAE,YAAY;iBACxB,CAAC,CAAC;YACL,CAAC;YACD,SAAS;QACX,CAAC;QAED,wFAAwF;QACxF,uFAAuF;QACvF,4FAA4F;QAC5F,2FAA2F;QAC3F,oDAAoD;QACpD,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,eAAe;oBACnC,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,CAAC,CAAC,IAAI;oBACX,GAAG,EAAE,EAAE;oBACP,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,SAAS,EAAE,CAAC;oBACZ,MAAM,EAAE,kIAAkI;oBAC1I,IAAI,EAAE,gBAAgB;oBACtB,SAAS,EAAE,cAAc;iBAC1B,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,CAAC,CAAC,IAAI;oBACX,MAAM,EAAE,4FAA4F;oBACpG,KAAK,EAAE,mBAAmB;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0FAA0F;QAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE;gBAC7B,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,CAAC,CAAC,IAAI;gBACX,GAAG,EAAE,iBAAiB,GAAG,GAAG;gBAC5B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,SAAS,EAAE,CAAC,CAAC,MAAM;gBACnB,MAAM,EAAE,yBAAyB,GAAG,GAAG;gBACvC,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,UAAU,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,EAAE;oBACtC,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,CAAC,CAAC,IAAI;oBACX,GAAG,EAAE,iBAAiB,GAAG,CAAC,IAAI,GAAG;oBACjC,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,SAAS,EAAE,CAAC,CAAC,MAAM;oBACnB,MAAM,EAAE,wBAAwB,GAAG,CAAC,IAAI,GAAG;oBAC3C,IAAI,EAAE,MAAM;iBACb,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,6FAA6F;QAC7F,4FAA4F;QAC5F,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,UAAU;oBACzC,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,CAAC,CAAC,IAAI;oBACX,GAAG,EAAE,EAAE;oBACP,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,SAAS,EAAE,CAAC;oBACZ,MAAM,EAAE,QAAQ,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,8CAA8C;oBAC7F,IAAI,EAAE,gBAAgB;oBACtB,SAAS,EAAE,aAAa;iBACzB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE;oBACjC,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,CAAC,CAAC,IAAI;oBACX,GAAG,EAAE,SAAS,GAAG,CAAC,IAAI,UAAU;oBAChC,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,SAAS,EAAE,CAAC,CAAC,KAAK;oBAClB,MAAM,EAAE,QAAQ,GAAG,CAAC,IAAI,8BAA8B;oBACtD,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAClC,MAAM,cAAc,GAClB,wKAAwK,CAAC,IAAI,CAC3K,IAAI,CACL,CAAC;IACJ,MAAM,cAAc,GAAG,sFAAsF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzH,IAAI,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,kFAAkF,EAAE,CAAC;IAC3H,CAAC;IACD,OAAO;QACL,GAAG,EAAE,aAAa;QAClB,MAAM,EAAE,oGAAoG;KAC7G,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAe,EAAE,MAAe;IACvD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/F,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,GAAG,MAA0B;IAC3D,OAAO,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,GAAG,MAA0B;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAc,EACd,UAAoC,EACpC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAiB,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAkB,EAAE,CAAC;QACnC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC,CAAC;oBAC/F,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC;wBACZ,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,MAAM,EAAE,iBAAiB,IAAI,CAAC,EAAE,2DAA2D;wBAC3F,KAAK,EAAE,iBAAiB;qBACzB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,MAAM,EAAE,mBAAmB,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,GAAG,EAAE;wBAC1D,KAAK,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;qBACtD,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC7D,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;wBACrB,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC3F,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;wBACzD,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;oBACnG,CAAC;yBAAM,CAAC;wBACN,QAAQ,CAAC,IAAI,CAAC;4BACZ,GAAG,EAAE,IAAI,CAAC,GAAG;4BACb,MAAM,EAAE,QAAQ,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;4BAC7I,KAAK,EAAE,cAAc;yBACtB,CAAC,CAAC;oBACL,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,gFAAgF;gBAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,sCAAsC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAyB,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACjG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACvD,MAAM,SAAS,GAAa,WAAW,CAAC,GAAG,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjH,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,SAAS,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC;IAE/C,OAAO;QACL,KAAK;QACL,EAAE;QACF,SAAS;QACT,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;QAC1B,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACzC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC7B,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB,EAAE,MAA2B,EAAE;IACtF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,8BAA8B,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACzG,MAAM,KAAK,GAAa;QACtB,+BAA+B,OAAO,CAAC,SAAS,GAAG;QACnD,EAAE;QACF,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,iBAAiB;QACjB,EAAE;KACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,CAAC;QACjI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,yDAAyD,EAAE,EAAE,CAAC,CAAC;QAC9E,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,iGAAiG,CAAC,CAAC;IACrK,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,iBAAiB,CAAC,WAA8B,EAAE,KAAK,GAAG,EAAE;IAC1E,MAAM,OAAO,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,kDAAkD,CAAC;IACpF,OAAO,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,GAAS,EAAE,QAAgB;IACxD,MAAM,CAAC,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/dist/sign.d.ts

@@ -51,6 +51,12 @@ export declare function isSafeManifestPath(p: unknown): p is string;
 export declare function checkManifestEntries(files: unknown): string | null;
 /** Every file under `root`, POSIX-relative, excluding the manifest and the SBOM themselves. */
 export declare function listPackFiles(root: string): string[];
+/**
+ * The SIGN-side file list: same exclusions as {@link listPackFiles}, but REGULAR FILES ONLY — `dz sign`
+ * never signs a symlink (hashing one would follow it outside the pack). The verify sweep intentionally
+ * sees MORE than this (symlinks/specials outside node_modules), so a smuggled entry fails verification.
+ */
+export declare function listSignablePackFiles(root: string): string[];
 /**
  * The bytes that get signed (FR-7). Sorted by path, LF endings, no trailing whitespace, and no
  * dependence on JSON key order — a signature must not depend on how a serialiser felt that day.

package/dist/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE;AAeD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAK1D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAapD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAI5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAG7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAM5F;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAMvD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CAWtF;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM,GAChB,YAAY,CA8Dd;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAYlD;AAaD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,mBAAmB,CAiB9E;AAOD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAKzE;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,GAAG,cAAc,CAehG"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,eAAO,MAAM,aAAa,sBAAsB,CAAC;AACjD,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C;AAED,uGAAuG;AACvG,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWtE;AAeD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAK1D;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAED,+FAA+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAqBpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAc5D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,MAAM,CAI5E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAG7D;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAM5F;AAED,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CAMvD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAG,cAAc,CAWtF;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACzC,SAAS,EAAE,MAAM,GAChB,YAAY,CA8Dd;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAWvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ5E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACnF;AAED,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,SAAS,aAAa,EAAE,CAAC;CAC/C;AAED,mGAAmG;AACnG,wBAAgB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAYlD;AAaD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,mBAAmB,CAiB9E;AAOD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,mDAAmD;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAKzE;AAED,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEpD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,GAAG,cAAc,CAehG"}

package/dist/sign.js

@@ -96,12 +96,21 @@ export function listPackFiles(root) {
     const out = [];
     const walk = (dir, rel) => {
         for (const e of readdirSync(dir, { withFileTypes: true })) {
+            // node_modules/.git are unsigned territory BY DESIGN (installed deps / VCS metadata — not pack
+            // content; npm tarballs ship neither). The SIGN and VERIFY walks MUST share these exclusions:
+            // an asymmetry here false-TAMPERs every pnpm workspace pack whose node_modules holds symlinks
+            // (found live arming task #36 — 10 of 23 skill packs flagged right after signing).
+            if (e.name === 'node_modules' || e.name === '.git')
+                continue;
             if (e.name === MANIFEST_NAME || e.name === SBOM_NAME)
                 continue;
             const abs = join(dir, e.name);
             const r = rel ? rel + '/' + e.name : e.name;
             if (e.isDirectory())
                 walk(abs, r);
+            // NOT else-isFile: a symlink (or other non-file) OUTSIDE the excluded dirs must stay VISIBLE to the
+            // verify sweep — it fails as "present but not signed" / "is a symlink" (R3-4: a smuggled symlink is a
+            // finding, not something to silently ignore). Only node_modules/.git are exempt territory.
             else
                 out.push(r);
         }
@@ -109,6 +118,30 @@ export function listPackFiles(root) {
     walk(root, '');
     return out.sort();
 }
+/**
+ * The SIGN-side file list: same exclusions as {@link listPackFiles}, but REGULAR FILES ONLY — `dz sign`
+ * never signs a symlink (hashing one would follow it outside the pack). The verify sweep intentionally
+ * sees MORE than this (symlinks/specials outside node_modules), so a smuggled entry fails verification.
+ */
+export function listSignablePackFiles(root) {
+    const out = [];
+    const walk = (dir, rel) => {
+        for (const e of readdirSync(dir, { withFileTypes: true })) {
+            if (e.name === 'node_modules' || e.name === '.git')
+                continue;
+            if (e.name === MANIFEST_NAME || e.name === SBOM_NAME)
+                continue;
+            const abs = join(dir, e.name);
+            const r = rel ? rel + '/' + e.name : e.name;
+            if (e.isDirectory())
+                walk(abs, r);
+            else if (e.isFile())
+                out.push(r);
+        }
+    };
+    walk(root, '');
+    return out.sort();
+}
 /**
  * The bytes that get signed (FR-7). Sorted by path, LF endings, no trailing whitespace, and no
  * dependence on JSON key order — a signature must not depend on how a serialiser felt that day.