@dzhechkov/harness-core 0.8.46 → 0.8.48

package/dist/release-package-audit.js

@@ -0,0 +1,272 @@
+/** Pure evidence admission for a freshly installed release tarball (ADR-001). */
+import { createHash } from 'node:crypto';
+import { dirname, isAbsolute, posix, relative, resolve } from 'node:path';
+const obj = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+const integer = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+const version = (v) => typeof v === 'string' && /^\d+\.\d+\.\d+(?:[-+][\w.+-]+)?$/.test(v);
+const hash = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+function requireEvidence(condition, reason) { if (!condition)
+    throw new Error(reason); }
+const severities = ['info', 'low', 'moderate', 'high', 'critical'];
+function auditReport(input) {
+    requireEvidence(obj(input) && integer(input.exitCode) && input.timedOut !== true, 'audit execution is missing, malformed or timed out');
+    requireEvidence(typeof input.stdout === 'string' && input.stdout.trim() !== '', 'audit JSON is empty');
+    let report;
+    try {
+        report = JSON.parse(input.stdout);
+    }
+    catch {
+        throw new Error('audit JSON cannot be parsed');
+    }
+    requireEvidence(obj(report) && report.auditReportVersion === 2 && !('error' in report), 'unsupported audit schema or error envelope');
+    requireEvidence(obj(report.metadata) && obj(report.metadata.vulnerabilities) && obj(report.vulnerabilities), 'audit vulnerability evidence is missing');
+    const counts = report.metadata.vulnerabilities;
+    requireEvidence([...severities, 'total'].every(k => integer(counts[k])), 'audit counts must be complete nonnegative integers');
+    requireEvidence(severities.reduce((sum, k) => sum + counts[k], 0) === counts.total, 'audit severity total is inconsistent');
+    const findings = Object.entries(report.vulnerabilities).map(([name, item]) => {
+        requireEvidence(obj(item) && severities.includes(item.severity), 'unknown structured advisory severity');
+        if (item.via !== undefined) {
+            requireEvidence(Array.isArray(item.via), 'via advisory evidence must be an array');
+            for (const advisory of item.via) {
+                // npm10 emits strings for metavulnerability dependencies. Those are references,
+                // not advisory objects; retain them without inventing a raw-advisory count.
+                if (typeof advisory === 'string') {
+                    requireEvidence(advisory.trim().length > 0, 'via dependency reference is empty');
+                    continue;
+                }
+                requireEvidence(obj(advisory) && severities.includes(advisory.severity), 'via advisory severity is unknown or malformed');
+                requireEvidence(integer(advisory.source) && ['name', 'dependency', 'title', 'url', 'range'].every(key => typeof advisory[key] === 'string'), 'via advisory object has unsupported field types');
+                // Metadata counts aggregate vulnerability entries, not individual via advisories.
+                // A lower advisory under a higher aggregate is valid; the reverse contradicts it.
+                requireEvidence(severities.indexOf(advisory.severity) <= severities.indexOf(item.severity), 'via advisory severity exceeds the vulnerability entry severity');
+            }
+        }
+        return { name, severity: item.severity };
+    });
+    requireEvidence(severities.every(s => findings.filter(f => f.severity === s).length === counts[s]), 'structured advisory severities contradict counts');
+    const deps = report.metadata.dependencies;
+    requireEvidence(obj(deps) && ['prod', 'dev', 'optional', 'peer', 'peerOptional', 'total'].every(k => integer(deps[k])), 'dependency count evidence is missing');
+    // These categories overlap (npm includes the synthetic consumer in prod); never sum them.
+    const high = counts.high + counts.critical > 0;
+    requireEvidence(high || input.exitCode === 0, 'nonzero audit exit without valid high/critical findings');
+    return { counts, findings, high, totalDependencies: deps.total };
+}
+/** pnpm's retained workspace JSON uses advisory IDs/counts per finding, not npm-v2 nodes. */
+function workspaceReport(input) {
+    requireEvidence(obj(input) && integer(input.exitCode) && input.timedOut !== true && typeof input.stdout === 'string', 'workspace execution unavailable');
+    let data;
+    try {
+        data = JSON.parse(input.stdout);
+    }
+    catch {
+        throw new Error('workspace JSON cannot be parsed');
+    }
+    if (obj(data) && data.auditReportVersion !== undefined)
+        return auditReport(input);
+    requireEvidence(obj(data) && !('error' in data) && Array.isArray(data.actions) && obj(data.advisories) && obj(data.metadata), 'unsupported workspace audit schema or error envelope');
+    const values = data.metadata.vulnerabilities;
+    requireEvidence(obj(values) && severities.every(k => integer(values[k])), 'workspace severity counts unavailable');
+    const counts = Object.fromEntries(severities.map(k => [k, values[k]]));
+    counts.total = severities.reduce((n, k) => n + counts[k], 0);
+    const findings = Object.values(data.advisories).map(item => { requireEvidence(obj(item) && typeof item.module_name === 'string' && severities.includes(item.severity), 'unsupported workspace advisory'); return { name: item.module_name, severity: item.severity }; });
+    // Legacy pnpm counters may count multiple findings for one advisory ID. Any structured
+    // severity still needs a corresponding nonzero metadata count; never synthesize clean.
+    requireEvidence(severities.every(k => counts[k] >= findings.filter(f => f.severity === k).length), 'workspace advisory severity contradicts metadata');
+    requireEvidence(['dependencies', 'devDependencies', 'optionalDependencies', 'totalDependencies'].every(k => integer(data.metadata[k])), 'workspace dependency counters unavailable');
+    const high = counts.high + counts.critical > 0;
+    requireEvidence(high || input.exitCode === 0, 'workspace nonzero exit without threshold findings');
+    return { counts, findings, high, totalDependencies: data.metadata.totalDependencies };
+}
+export function planReleasePackageAudit(pkg, timeoutMs = 120_000) {
+    return { package: pkg.name, version: pkg.version, dir: pkg.dir, phases: ['pack', 'install', 'validate', 'audit'], timeoutMs };
+}
+function inside(path, parent) { const rel = relative(parent, path); return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel)); }
+function dependencyTables(manifest) {
+    return ['dependencies', 'optionalDependencies', 'peerDependencies'].flatMap(key => {
+        if (manifest[key] === undefined)
+            return [];
+        requireEvidence(obj(manifest[key]), `malformed ${key}`);
+        requireEvidence(Object.values(manifest[key]).every(v => typeof v === 'string'), `malformed ${key} specs`);
+        return [[key, manifest[key]]];
+    });
+}
+function dependencyPath(parent, name, nodes) {
+    requireEvidence(/^(@[a-z0-9._-]+\/)?[a-z0-9._-]+$/i.test(name), 'unsupported dependency name');
+    let cursor = parent;
+    while (cursor !== '.' && cursor !== '') {
+        const candidate = `${cursor}/node_modules/${name}`;
+        if (nodes[candidate] !== undefined)
+            return candidate;
+        cursor = posix.dirname(cursor);
+    }
+    const top = `node_modules/${name}`;
+    return nodes[top] === undefined ? undefined : top;
+}
+function excludesHost(metadata, host) {
+    if (!obj(metadata))
+        return false;
+    const excludes = (values, current) => {
+        if (values === undefined)
+            return false;
+        requireEvidence(Array.isArray(values) && values.every(v => typeof v === 'string'), 'unsupported OS/CPU metadata');
+        const positive = values.filter(v => !v.startsWith('!'));
+        return values.includes(`!${current}`) || (positive.length > 0 && !positive.includes('any') && !positive.includes(current));
+    };
+    return excludes(metadata.os, host.os) || excludes(metadata.cpu, host.cpu);
+}
+function closure(roots, e, strictGraph = false) {
+    requireEvidence(typeof e.consumerDir === 'string' && isAbsolute(e.consumerDir) && roots.every(root => !inside(e.consumerDir, root.dir) && !inside(e.consumerDir, dirname(dirname(dirname(root.dir))))), 'consumer must be outside the workspace');
+    requireEvidence(roots.every(root => typeof root.tarball === 'string' && isAbsolute(root.tarball)), 'candidate tarball identity is missing');
+    requireEvidence(obj(e.platform) && typeof e.platform.os === 'string' && typeof e.platform.cpu === 'string' && (!strictGraph || e.platform.os.length > 0 && e.platform.cpu.length > 0), 'host platform missing');
+    requireEvidence(obj(e.lock) && [2, 3].includes(e.lock.lockfileVersion) && obj(e.lock.packages), 'unsupported consumer lock schema');
+    const nodes = e.lock.packages;
+    requireEvidence(obj(nodes['']) && version(nodes[''].version) && obj(nodes[''].dependencies), 'private versioned consumer root missing');
+    const rootPaths = new Map(roots.map(root => ['node_modules/' + root.package, root]));
+    requireEvidence(rootPaths.size === roots.length && Object.keys(nodes[''].dependencies).length === roots.length && roots.every(root => nodes[''].dependencies[root.package] === `file:${root.tarball}`), 'consumer root must contain only the selected tarball cohort');
+    for (const [path, root] of rootPaths) {
+        requireEvidence(obj(nodes[path]) && nodes[path].version === root.version && typeof nodes[path].resolved === 'string' && nodes[path].resolved.startsWith('file:') && resolve(e.consumerDir, nodes[path].resolved.slice(5)) === root.tarball, 'selected root lock identity missing');
+        if (strictGraph)
+            requireEvidence(typeof root.integrity === 'string' && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(root.integrity) && nodes[path].integrity === root.integrity, 'selected root SRI contradicts supplied artifact');
+    }
+    requireEvidence(Array.isArray(e.installed), 'installed dependency inventory missing');
+    const installed = new Map();
+    for (const entry of e.installed) {
+        requireEvidence(obj(entry) && typeof entry.path === 'string' && obj(entry.manifest) && entry.contained === true, 'installed node escapes consumer or has malformed identity');
+        requireEvidence(!installed.has(entry.path), 'duplicate installed node');
+        installed.set(entry.path, entry.manifest);
+    }
+    requireEvidence(roots.every(root => installed.get('node_modules/' + root.package)?.name === root.package && installed.get('node_modules/' + root.package)?.version === root.version), 'selected root not physically installed');
+    const absences = [];
+    const inventory = [];
+    const graph = [];
+    for (const [path, node] of Object.entries(nodes)) {
+        if (path === '')
+            continue;
+        requireEvidence(obj(node) && path.startsWith('node_modules/') && !path.split('/').some(p => p === '..' || p === '.') && !path.includes('\\') && node.link !== true && version(node.version), 'unsupported linked/versionless lock node');
+        if (!rootPaths.has(path) && node.resolved !== undefined)
+            requireEvidence(typeof node.resolved === 'string' && /^https?:\/\//.test(node.resolved), 'dependency resolves outside registry policy');
+        if (!rootPaths.has(path) && node.resolved === undefined)
+            requireEvidence(node.inBundle === true, 'unresolved non-bundled dependency node');
+        const manifest = installed.get(path);
+        const name = path.split('node_modules/').pop();
+        if (manifest !== undefined)
+            requireEvidence(manifest.name === name && manifest.version === node.version, 'installed identity contradicts resolved lock');
+        else
+            requireEvidence(node.optional === true && excludesHost(node, e.platform), 'resolved dependency absent without supported platform exclusion');
+        inventory.push({ path, name, version: node.version, installed: manifest !== undefined });
+        const data = manifest ?? node;
+        if (strictGraph) {
+            requireEvidence(node.dev !== true && node.extraneous !== true, 'unselected development or extraneous node is outside production cohort');
+            requireEvidence(/^(?:node_modules\/(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)(?:\/node_modules\/(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+)*$/i.test(path), 'unsupported noncanonical lock path');
+            requireEvidence(data.peerDependenciesMeta === undefined || obj(data.peerDependenciesMeta) && Object.values(data.peerDependenciesMeta).every(value => obj(value) && (value.optional === undefined || typeof value.optional === 'boolean')), 'malformed optional peer metadata');
+            requireEvidence(!path.split('/').some(segment => segment === '') && (nodes[path].inBundle === true || rootPaths.has(path) || typeof node.integrity === 'string' && /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(node.integrity)), 'registry node SRI or canonical path missing');
+            const equal = (a, b) => JSON.stringify(Object.entries((a ?? {})).sort()) === JSON.stringify(Object.entries((b ?? {})).sort());
+            for (const table of ['dependencies', 'peerDependencies', 'optionalDependencies', 'peerDependenciesMeta'])
+                requireEvidence(manifest === undefined || equal(manifest[table], node[table]), 'installed declarations contradict resolved lock');
+            for (const field of ['os', 'cpu'])
+                requireEvidence(manifest === undefined || JSON.stringify(manifest[field]) === JSON.stringify(node[field]), 'installed platform declaration contradicts lock');
+        }
+        const edges = [];
+        for (const [table, declarations] of dependencyTables(data)) {
+            for (const [dep, spec] of Object.entries(declarations)) {
+                requireEvidence(!/^(?:workspace:|file:|link:|npm:)/.test(spec), 'unsupported local or alias dependency spec');
+                const child = dependencyPath(path, dep, nodes);
+                edges.push({ table, name: dep, spec: spec, target: child ?? null });
+                if (child !== undefined) {
+                    if (!installed.has(child) && table === 'optionalDependencies')
+                        absences.push({ name: dep, kind: 'locked-not-installed', parent: path });
+                    continue;
+                }
+                if (table === 'dependencies' && data.optionalDependencies?.[dep] !== undefined)
+                    continue;
+                if (table === 'peerDependencies' && data.peerDependenciesMeta?.[dep]?.optional === true) {
+                    absences.push({ name: dep, kind: 'optional-peer', parent: path });
+                    continue;
+                }
+                if (table === 'optionalDependencies' && excludesHost(e.optionalMetadata?.[`${path}:${dep}`], e.platform)) {
+                    absences.push({ name: dep, kind: 'platform-excluded', parent: path });
+                    continue;
+                }
+                throw new Error(`required dependency coverage missing: ${dep}`);
+            }
+        }
+        graph.push({ path, name, version: node.version, selectedRoot: rootPaths.has(path), installed: manifest !== undefined, resolved: node.resolved ?? null, integrity: node.integrity ?? null, bundled: node.inBundle === true, optional: node.optional === true, ...(strictGraph ? { optionalWitnesses: Object.fromEntries(Object.keys(data.optionalDependencies ?? {}).filter(name => dependencyPath(path, name, nodes) === undefined).map(name => [name, e.optionalMetadata?.[path + ':' + name] ?? null])) } : {}), declarations: Object.fromEntries(dependencyTables(data)), peerDependenciesMeta: data.peerDependenciesMeta ?? {}, os: data.os ?? null, cpu: data.cpu ?? null, edges: edges.sort((a, b) => (a.table + ':' + a.name).localeCompare(b.table + ':' + b.name)) });
+        const bundles = data.bundleDependencies ?? data.bundledDependencies;
+        if (bundles !== undefined && bundles !== false) {
+            requireEvidence(bundles === true || (Array.isArray(bundles) && bundles.every(n => typeof n === 'string')), 'unsupported bundle declaration');
+            const names = bundles === true ? Object.keys(data.dependencies ?? {}) : bundles;
+            for (const name of names) {
+                const child = dependencyPath(path, name, nodes);
+                requireEvidence(child !== undefined && nodes[child].inBundle === true && installed.has(child), 'bundled bytes absent from installed audited inventory');
+            }
+        }
+    }
+    requireEvidence([...installed.keys()].every(path => nodes[path] !== undefined), 'installed node absent from lock coverage');
+    return { inventory, absences, graph: graph.sort((a, b) => a.path.localeCompare(b.path)) };
+}
+export function judgeReleasePackageAudit(plan, evidence, includeDev = false) {
+    if (plan === undefined) {
+        const base = { scope: 'workspace', nonBlocking: true, includeDev: includeDev || (obj(evidence) && evidence.includeDev === true) };
+        if (evidence === undefined)
+            return { ...base, status: 'not-run', reason: 'workspace audit was not executed' };
+        try {
+            const r = workspaceReport(evidence);
+            return { ...base, status: r.counts.total > 0 ? 'findings' : 'clean', counts: r.counts, findings: r.findings };
+        }
+        catch (error) {
+            return { ...base, status: 'error', reason: error instanceof Error ? error.message : 'workspace audit unavailable' };
+        }
+    }
+    const base = { scope: 'package-consumer', package: plan.package, version: plan.version };
+    let phases = [];
+    try {
+        requireEvidence(obj(evidence), 'package audit evidence missing');
+        const e = evidence;
+        requireEvidence(e.package === plan.package && e.version === plan.version, 'package audit identity mismatch');
+        requireEvidence(Array.isArray(e.phases), 'package phase records missing');
+        phases = e.phases.map((p) => { requireEvidence(obj(p) && typeof p.phase === 'string' && integer(p.exitCode), 'malformed phase record'); return { phase: p.phase, exitCode: p.exitCode, ...(p.timedOut === true ? { timedOut: true } : {}) }; });
+        requireEvidence(plan.phases.join(',') === 'pack,install,validate,audit' && phases.map(p => p.phase).join(',') === plan.phases.join(','), 'required package phase missing, duplicated or reordered');
+        requireEvidence(phases.every(p => p.timedOut !== true && (p.phase === 'audit' || p.exitCode === 0)), 'package phase failed or timed out');
+        requireEvidence(e.sourceRestored === true && e.cleanup === true, 'source restoration or owned scratch cleanup not established');
+        requireEvidence(hash(e.candidateSha256) && hash(e.lockSha256), 'candidate/lock digest missing');
+        requireEvidence(typeof e.npmVersion === 'string' && /^10\.\d+\.\d+$/.test(e.npmVersion), 'unsupported or missing npm version');
+        const c = closure([{ ...plan, tarball: e.tarball }], e);
+        const r = auditReport(e.audit);
+        requireEvidence(r.totalDependencies === c.inventory.length, 'audit dependency total does not cover the validated lock inventory');
+        requireEvidence(phases[3].exitCode === e.audit.exitCode, 'audit phase and execution exits disagree');
+        return { ...base, status: r.high ? 'findings' : 'clean', ...(r.high ? { failureClass: 'VULNS_HIGH', reason: `${r.counts.total} vulnerabilities found (high ${r.counts.high}, critical ${r.counts.critical})` } : {}), phases,
+            candidateSha256: e.candidateSha256, lockSha256: e.lockSha256, npmVersion: e.npmVersion, platform: e.platform,
+            resolvedCount: c.inventory.length, installedCount: e.installed.length, closure: c.inventory, optionalAbsences: c.absences, counts: r.counts, findings: r.findings };
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : 'package audit unavailable';
+        const e = obj(evidence) ? evidence : {};
+        return { ...base, status: 'error', failureClass: reason.includes('phase missing') || reason.includes('evidence missing') ? 'UNEXECUTED_STEP' : 'AUDIT_ERROR', reason, phases,
+            ...(hash(e.candidateSha256) ? { candidateSha256: e.candidateSha256 } : {}), ...(hash(e.lockSha256) ? { lockSha256: e.lockSha256 } : {}),
+            ...(version(e.npmVersion) ? { npmVersion: e.npmVersion } : {}),
+            ...(obj(e.platform) && typeof e.platform.os === 'string' && typeof e.platform.cpu === 'string' ? { platform: { os: e.platform.os, cpu: e.platform.cpu } } : {}) };
+    }
+}
+/** Additional five-root admission; the singleton judge uses the same closure/edge/audit validators. */
+export function judgeReleaseCohortAudit(roots, evidence) {
+    const base = { scope: 'package-cohort' };
+    try {
+        const expected = ['harness-core', 'harness-cli', 'skills-meta', 'keysarium', 'skills-feature-adr'].map(name => '@dzhechkov/' + name).sort();
+        requireEvidence(Array.isArray(roots) && roots.length === 5 && JSON.stringify(roots.map(root => root.package).sort()) === JSON.stringify(expected), 'cohort must be the exact authorized five');
+        requireEvidence(roots.every(root => version(root.version) && hash(root.sha256) && typeof root.dir === 'string' && isAbsolute(root.dir) && typeof root.tarball === 'string' && isAbsolute(root.tarball) && root.tarball === resolve(root.tarball)) && new Set(roots.map(root => root.tarball)).size === roots.length, 'cohort root artifact identity incomplete');
+        requireEvidence(obj(evidence) && evidence.cleanup === true && evidence.sourceRestored === true && hash(evidence.lockSha256) && /^10\.\d+\.\d+$/.test(evidence.npmVersion), 'cohort execution, restoration or cleanup evidence incomplete');
+        const e = evidence;
+        requireEvidence(typeof e.lockBytes === 'string' && Buffer.byteLength(e.lockBytes) <= 16 * 1024 * 1024 && createHash('sha256').update(e.lockBytes).digest('hex') === e.lockSha256 && JSON.stringify(JSON.parse(e.lockBytes)) === JSON.stringify(e.lock), 'cohort raw lock/digest/object evidence disagree');
+        requireEvidence(Array.isArray(e.phases) && e.phases.map((p) => p.phase).join(',') === 'pack,install,validate,audit' && e.phases.every((p) => integer(p.exitCode) && p.timedOut !== true && (p.phase === 'audit' || p.exitCode === 0)), 'cohort execution phases missing or failed');
+        const c = closure(roots, e, true);
+        const audit = auditReport(e.audit);
+        requireEvidence(c.inventory.length <= 10000 && audit.totalDependencies === c.inventory.length && e.phases[3].exitCode === e.audit.exitCode, 'cohort audit does not cover the complete lock');
+        if (audit.high)
+            return { ...base, status: 'findings', reason: 'cohort has high/critical findings', counts: audit.counts };
+        return { ...base, status: 'clean', graph: c.graph, optionalAbsences: c.absences, resolvedCount: c.inventory.length, counts: audit.counts };
+    }
+    catch (error) {
+        return { ...base, status: 'error', reason: error instanceof Error ? error.message : 'cohort admission unavailable' };
+    }
+}
+//# sourceMappingURL=release-package-audit.js.map

package/dist/release-package-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-package-audit.js","sourceRoot":"","sources":["../src/release-package-audit.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsC1E,MAAM,GAAG,GAAG,CAAC,KAAc,EAAgB,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnH,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxG,MAAM,OAAO,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjH,MAAM,IAAI,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,SAAS,eAAe,CAAC,SAAkB,EAAE,MAAc,IAAuB,IAAI,CAAC,SAAS;IAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5H,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAU,CAAC;AAC5E,SAAS,WAAW,CAAC,KAAc;IACjC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,oDAAoD,CAAC,CAAC;IACxI,eAAe,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACvG,IAAI,MAAe,CAAC;IAAC,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAAC,CAAC;IACzH,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,4CAA4C,CAAC,CAAC;IACtI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,yCAAyC,CAAC,CAAC;IACxJ,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC/C,eAAe,CAAC,CAAC,GAAG,UAAU,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,oDAAoD,CAAC,CAAC;IAC/H,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;IAC5H,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3E,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,sCAAsC,CAAC,CAAC;QACzG,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACnF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,gFAAgF;gBAChF,4EAA4E;gBAC5E,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,mCAAmC,CAAC,CAAC;oBACjF,SAAS;gBACX,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,+CAA+C,CAAC,CAAC;gBAC1H,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,EAAE,iDAAiD,CAAC,CAAC;gBAChM,kFAAkF;gBAClF,kFAAkF;gBAClF,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,gEAAgE,CAAC,CAAC;YAChK,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAkB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,kDAAkD,CAAC,CAAC;IACxJ,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC1C,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,sCAAsC,CAAC,CAAC;IAChK,0FAA0F;IAC1F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC/C,eAAe,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,yDAAyD,CAAC,CAAC;IACzG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACnE,CAAC;AACD,6FAA6F;AAC7F,SAAS,eAAe,CAAC,KAAc;IACrC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,iCAAiC,CAAC,CAAC;IACzJ,IAAI,IAAa,CAAC;IAAC,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAAC,CAAC;IACzH,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAClF,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,sDAAsD,CAAC,CAAC;IACtL,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC7C,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;IACnH,MAAM,MAAM,GAA2B,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,gCAAgC,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7R,uFAAuF;IACvF,uFAAuF;IACvF,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,kDAAkD,CAAC,CAAC;IACxJ,eAAe,CAAC,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;IACrL,MAAM,IAAI,GAAG,MAAM,CAAC,IAAK,GAAG,MAAM,CAAC,QAAS,GAAG,CAAC,CAAC;IACjD,eAAe,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,mDAAmD,CAAC,CAAC;IACnG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,iBAA2B,EAAE,CAAC;AAClG,CAAC;AACD,MAAM,UAAU,uBAAuB,CAAC,GAA8E,EAAE,SAAS,GAAG,OAAO;IACzI,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;AAChI,CAAC;AACD,SAAS,MAAM,CAAC,IAAY,EAAE,MAAc,IAAa,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChK,SAAS,gBAAgB,CAAC,QAAa;IACrC,OAAO,CAAC,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QAChF,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC3C,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,EAAE,CAAC,CAAC;QACxD,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,aAAa,GAAG,QAAQ,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,MAAc,EAAE,IAAY,EAAE,KAAU;IAC9D,eAAe,CAAC,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC/F,IAAI,MAAM,GAAG,MAAM,CAAC;IACpB,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,GAAG,MAAM,iBAAiB,IAAI,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,IAAI,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AACD,SAAS,YAAY,CAAC,QAAiB,EAAE,IAAS;IAChD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAE,OAAe,EAAW,EAAE;QAC7D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,6BAA6B,CAAC,CAAC;QAClH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7H,CAAC,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AACD,SAAS,OAAO,CAAC,KAAwG,EAAE,CAAM,EAAE,WAAW,GAAG,KAAK;IACpJ,eAAe,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAClP,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;IAC5I,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAChN,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,kCAAkC,CAAC,CAAC;IACpI,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC9B,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,yCAAyC,CAAC,CAAC;IACxI,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrF,eAAe,CAAC,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,6DAA6D,CAAC,CAAC;IACvQ,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;QACnR,IAAI,WAAW;YAAE,eAAe,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,iDAAiD,CAAC,CAAC;IAC9N,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,wCAAwC,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAe,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,2DAA2D,CAAC,CAAC;QAC9K,eAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACxE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAChO,MAAM,QAAQ,GAAkH,EAAE,CAAC;IACnI,MAAM,SAAS,GAA+E,EAAE,CAAC;IACjG,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,0CAA0C,CAAC,CAAC;QACzO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,eAAe,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,6CAA6C,CAAC,CAAC;QACjM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,wCAAwC,CAAC,CAAC;QAC3I,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,EAAG,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS;YAAE,eAAe,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;;YACpJ,eAAe,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,iEAAiE,CAAC,CAAC;QAClJ,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,QAAQ,IAAI,IAAI,CAAC;QAC9B,IAAI,WAAW,EAAE,CAAC;YAChB,eAAe,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,wEAAwE,CAAC,CAAC;YACzI,eAAe,CAAC,4GAA4G,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,oCAAoC,CAAC,CAAC;YAC/K,eAAe,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;YAC/Q,eAAe,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,6CAA6C,CAAC,CAAC;YACzQ,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,CAAU,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvK,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,sBAAsB,CAAC;gBAAE,eAAe,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iDAAiD,CAAC,CAAC;YAC5O,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;gBAAE,eAAe,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iDAAiD,CAAC,CAAC;QACnM,CAAC;QACD,MAAM,KAAK,GAAgF,EAAE,CAAC;QAC9F,KAAK,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvD,eAAe,CAAC,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAc,CAAC,EAAE,4CAA4C,CAAC,CAAC;gBACxH,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAc,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;gBAC9E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,sBAAsB;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBACxI,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,KAAK,cAAc,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS;oBAAE,SAAS;gBACzF,IAAI,KAAK,KAAK,kBAAkB,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzK,IAAI,KAAK,KAAK,sBAAsB,IAAI,YAAY,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC9L,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,KAAK,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/uB,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,mBAAmB,CAAC;QACpE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YAC/C,eAAe,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;YAC7I,MAAM,KAAK,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAChF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChD,eAAe,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,uDAAuD,CAAC,CAAC;YAC1J,CAAC;QACH,CAAC;IACH,CAAC;IACD,eAAe,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,EAAE,0CAA0C,CAAC,CAAC;IAC5H,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAGD,MAAM,UAAU,wBAAwB,CAAC,IAAyC,EAAE,QAAiB,EAAE,UAAU,GAAG,KAAK;IACvH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,WAAoB,EAAE,WAAW,EAAE,IAAa,EAAE,UAAU,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;QACpJ,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QAC9G,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAAC,CAAC;QAC5J,OAAO,KAAK,EAAE,CAAC;YAAC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC;QAAC,CAAC;IACxI,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,kBAA2B,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAClG,IAAI,MAAM,GAAwC,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,gCAAgC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,QAAQ,CAAC;QACrF,eAAe,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,iCAAiC,CAAC,CAAC;QAC7G,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC1E,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,wBAAwB,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzP,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,yDAAyD,CAAC,CAAC;QACpM,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAC1I,eAAe,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,6DAA6D,CAAC,CAAC;QAChI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAChG,eAAe,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAC/H,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxF,eAAe,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,oEAAoE,CAAC,CAAC;QAClI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;QACtG,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAqB,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,gCAAgC,CAAC,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM;YACnO,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;YAC5G,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxK,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC;QACpF,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM;YAC1K,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtK,CAAC;AACH,CAAC;AAGD,uGAAuG;AACvG,MAAM,UAAU,uBAAuB,CAAC,KAA6K,EAAE,QAAiB;IACtO,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,gBAAyB,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5I,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,0CAA0C,CAAC,CAAC;QAC/L,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;QACjW,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,8DAA8D,CAAC,CAAC;QAC3O,MAAM,CAAC,GAAG,QAAQ,CAAC;QACnB,eAAe,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,iDAAiD,CAAC,CAAC;QAC3S,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,EAAE,2CAA2C,CAAC,CAAC;QAC9R,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;QAC7L,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mCAAmC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1H,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC7I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC;IAAC,CAAC;AAC3I,CAAC"}

package/dist/release.d.ts

@@ -20,6 +20,7 @@
  *
  * @packageDocumentation
  */
+import type { ReleasePackageAuditPlan, ReleasePackageAuditResult, ReleaseWorkspaceAuditReport } from './release-package-audit.js';
 import type { PackedInstallPlan } from './packed-install-smoke.js';
 /** The four HARD verify gates, in execution order. */
 export type ReleaseGateId = 'tests' | 'audit' | 'syntax' | 'smoke';
@@ -67,7 +68,7 @@ export interface GateStep {
      * `exec` (default): the CLI runs `cmd`. `synthetic-fail`: the PLAN already knows this step
      * fails (missing bin, stale dist) — classification sees it without any execution.
      */
-    readonly kind?: 'exec' | 'synthetic-fail' | undefined;
+    readonly kind?: 'exec' | 'synthetic-fail' | 'package-audit' | undefined;
     /** For `synthetic-fail` steps: the failure class the verdict must carry. */
     readonly failClass?: ReleaseFailureClass | undefined;
     /**
@@ -100,6 +101,9 @@ export interface GatePlan {
      * refuses it — the two doors would not be equal, contradicting FR-6's own claim.
      */
     readonly packedInstallPlan?: PackedInstallPlan | undefined;
+    readonly packageAuditPlans?: readonly ReleasePackageAuditPlan[];
+    readonly workspaceAuditStep?: GateStep;
+    readonly workspaceAuditIncludeDev?: boolean;
 }
 /** The CLI's record of running one exec step. */
 export interface GateExecution {
@@ -108,6 +112,7 @@ export interface GateExecution {
     readonly stdout: string;
     readonly stderr: string;
     readonly durationMs: number;
+    readonly packageAuditEvidence?: unknown;
     readonly timedOut?: boolean | undefined;
 }
 /** One classified failure inside a gate. */
@@ -149,6 +154,8 @@ export interface ReleaseVerdict {
     /** Fail-closed decision point: `'proceed'` iff every gate is clean AND something ran. */
     readonly publishAction: 'proceed' | 'blocked';
     readonly timestamp: string;
+    readonly packageAudits: readonly ReleasePackageAuditResult[];
+    readonly workspaceAudit: ReleaseWorkspaceAuditReport;
 }
 /** Default per-step timeouts (NFR-4: a hung child is a classified failure, not a hung release). */
 export declare const RELEASE_TIMEOUTS: {

package/dist/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,OAAO,KAAK,EAAE,iBAAiB,EAA0B,MAAM,2BAA2B,CAAC;AAE3F,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnE,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,EAAE,SAAS,aAAa,EAA0C,CAAC;AAElG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,SAAS,GACT,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,cAAc,GACd,eAAe,GACf,aAAa,GACb,iBAAiB,CAAC;AAEtB,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAE3E,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjD;AAED,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAC5D;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AA4CX;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAmD3G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EACtC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,mBAAmB,EAAE,CAYvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAChG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,QAAQ,CAuN/G;AAyCD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAErE;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAiB3E;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,SAAK,EAAE,QAAQ,SAAO,GAAG,MAAM,CA6BnG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,GAAG,GAAE,IAAiB,GACrB,cAAc,CA+HhB;AAMD,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,GAAG,OAAO,CAIV;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,GAAE,mBAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAyFzH;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAQpF;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMlE"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../src/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,OAAO,KAAK,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAIlI,OAAO,KAAK,EAAE,iBAAiB,EAA0B,MAAM,2BAA2B,CAAC;AAE3F,sDAAsD;AACtD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEnE,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,EAAE,SAAS,aAAa,EAA0C,CAAC;AAElG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAC3B,cAAc,GACd,SAAS,GACT,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,cAAc,GACd,eAAe,GACf,aAAa,GACb,iBAAiB,CAAC;AAEtB,oFAAoF;AACpF,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AAE3E,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,eAAe,EAAE,CAAC;IAC1C,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACjD;AAED,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,eAAe,GAAG,SAAS,CAAC;IACxE,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACxC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,mFAAmF;AACnF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,uBAAuB,EAAE,CAAC;IAChE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,QAAQ,CAAC;IACvC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CAC7C;AAED,iDAAiD;AACjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACzC;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;CACrC;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,2BAA2B,CAAC;CACtD;AAED,mGAAmG;AACnG,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AA4CX;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAoD3G;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EACtC,KAAK,EAAE,SAAS,mBAAmB,EAAE,GACpC,mBAAmB,EAAE,CAYvB;AAMD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAChG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,EAAE,IAAI,EAAE,uBAAuB,GAAG,QAAQ,CAwN/G;AAyCD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAErE;AAyBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,CAiB3E;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,SAAK,EAAE,QAAQ,SAAO,GAAG,MAAM,CA6BnG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBlD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,QAAQ,EACd,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,GAAG,GAAE,IAAiB,GACrB,cAAc,CAqJhB;AAMD,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC;AAiCD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,GAAG,OAAO,CAIV;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,GAAE,mBAAwB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAyFzH;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,SAAK,GAAG,MAAM,CAQpF;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMlE"}

package/dist/release.js

@@ -22,7 +22,8 @@
  */
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
-import { discoverPackages, matchesPublishFilter, orderByDependencies } from './publish.js';
+import { planReleasePackageAudit, judgeReleasePackageAudit } from './release-package-audit.js';
+import { discoverPackages, matchesPublishFilter, validatePublishFilters, orderByDependencies } from './publish.js';
 import { planPackedInstallSmoke, judgePackedInstallSmoke } from './packed-install-smoke.js';
 /** Order the CLI executes and the verdict reports gates in. */
 export const RELEASE_GATE_ORDER = ['tests', 'audit', 'syntax', 'smoke'];
@@ -101,6 +102,7 @@ export function collectPackageFacts(monorepoRoot, filter) {
         throw new Error('release: --filter requires non-empty package-name substrings (empty would match ALL packages)');
     }
     const discovered = discoverPackages(monorepoRoot);
+    validatePublishFilters(filter, discovered);
     const selected = filter === undefined ? discovered : discovered.filter((p) => filter.some((f) => matchesPublishFilter(p, f, monorepoRoot)));
     const ordered = orderByDependencies(selected);
     return ordered.map((p) => {
@@ -195,21 +197,23 @@ export function planReleaseGates(facts, opts) {
             });
         }
     }
-    // Gate 2 — audit: ONE workspace-level step (AM-1: pnpm primary; npm only without pnpm-lock).
+    // HARD audit: every selected root, including binless/dependency-free packages.
+    const packageAuditPlans = facts.map(f => planReleasePackageAudit(f, t.audit));
+    for (const audit of packageAuditPlans)
+        steps.push({
+            id: `audit:package:${audit.package}`, gate: 'audit', pkg: audit.package,
+            cmd: 'pack → install (--ignore-scripts, prod/optional/peer) → validate closure → npm audit --json --audit-level=high',
+            cwd: audit.dir, timeoutMs: t.audit, reason: 'isolated selected tarball consumer must have no high/critical advisories', kind: 'package-audit',
+        });
     const dev = opts.includeDevDeps === true;
-    steps.push({
-        id: 'audit:workspace',
-        gate: 'audit',
+    const workspaceAuditStep = {
+        id: 'audit:workspace', gate: 'audit',
         cmd: opts.pnpmLockPresent
-            ? `pnpm audit${dev ? '' : ' --prod'} --audit-level high`
-            : `npm audit${dev ? '' : ' --omit=dev'} --audit-level=high`,
-        cwd: opts.monorepoRoot,
-        timeoutMs: t.audit,
-        reason: dev
-            ? 'no >=high advisories across ALL workspace dependencies (dev included via --audit-dev)'
-            : 'no >=high advisories in production dependencies (dev-only chains excluded — widen with --audit-dev)',
-        kind: 'exec',
-    });
+            ? `pnpm audit${dev ? '' : ' --prod'} --audit-level high --json`
+            : `npm audit${dev ? '' : ' --omit=dev'} --audit-level=high --json --offline=false`,
+        cwd: opts.monorepoRoot, timeoutMs: t.audit,
+        reason: 'separate nonblocking workspace advisory observation', kind: 'exec',
+    };
     // Gates 3+4 — per package. AM-3: a stale dist is NEVER checked/booted as-is.
     for (const f of facts) {
         if (f.srcNewerThanDist === true) {
@@ -368,7 +372,7 @@ export function planReleaseGates(facts, opts) {
             }
         }
     }
-    return { steps, skips, packages: facts.map((f) => f.name), ...(packedInstallPlan !== undefined ? { packedInstallPlan } : {}) };
+    return { packageAuditPlans, workspaceAuditStep, workspaceAuditIncludeDev: dev, steps, skips, packages: facts.map((f) => f.name), ...(packedInstallPlan !== undefined ? { packedInstallPlan } : {}) };
 }
 /* ------------------------------------------------------------------ */
 /*  VERIFY — pure classification                                       */
@@ -595,6 +599,23 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
         }));
         packedInstallVerdict = judgePackedInstallSmoke(packedInstallPlan, translated);
     }
+    const packageAudits = [];
+    for (const name of plan?.packages ?? []) {
+        const auditPlans = (plan.packageAuditPlans ?? []).filter(p => p.package === name);
+        const steps = (plan.steps ?? []).filter(s => s.gate === 'audit' && s.pkg === name && s.kind === 'package-audit');
+        const records = (executions ?? []).filter(e => e?.stepId === `audit:package:${name}`);
+        if (auditPlans.length !== 1 || steps.length !== 1 || records.length !== 1) {
+            packageAudits.push({ scope: 'package-consumer', package: name, version: auditPlans[0]?.version ?? '', status: 'error', failureClass: 'UNEXECUTED_STEP', reason: 'selected package audit plan/step/execution missing or duplicated', phases: [] });
+        }
+        else {
+            const result = judgeReleasePackageAudit(auditPlans[0], records[0].packageAuditEvidence);
+            packageAudits.push(records[0].timedOut === true || (result.status === 'clean' && records[0].exitCode !== 0)
+                ? { ...result, status: 'error', failureClass: 'AUDIT_ERROR', reason: 'package audit wrapper timeout or exit/evidence inconsistency' }
+                : result);
+        }
+    }
+    const workspaceRecords = (executions ?? []).filter(e => e?.stepId === 'audit:workspace');
+    const workspaceAudit = judgeReleasePackageAudit(undefined, workspaceRecords.length === 1 ? { ...workspaceRecords[0], includeDev: plan.workspaceAuditIncludeDev === true } : undefined, plan.workspaceAuditIncludeDev === true);
     const gates = RELEASE_GATE_ORDER.map((gate) => {
         const gateSteps = (plan?.steps ?? []).filter((s) => s?.gate === gate);
         const gateSkips = (plan?.skips ?? []).filter((s) => s?.gate === gate);
@@ -602,6 +623,8 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
         let passed = 0;
         for (const step of gateSteps) {
             try {
+                if (gate === 'audit')
+                    continue; // typed per-root judge below owns this gate
                 if (packedInstallBinStepIds.has(step.id))
                     continue; // judged separately below (AM-7)
                 if (step.kind === 'synthetic-fail') {
@@ -629,23 +652,16 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
                     continue;
                 }
                 if (typeof exec.exitCode !== 'number' || exec.exitCode !== 0) {
-                    if (gate === 'audit') {
-                        const { cls, reason } = classifyAuditFailure(`${exec.stdout ?? ''}\n${exec.stderr ?? ''}`);
-                        const detail = auditDetailLine(exec.stdout, exec.stderr);
-                        failures.push({ pkg: step.pkg, reason: `${reason}${detail ? ` — ${detail}` : ''}`, class: cls });
-                    }
-                    else {
-                        // FR-1: for tests/syntax/smoke, name the ACTUAL failure (summary + failing tests),
-                        // not just the first output line — see testsFailureDetail's doc comment for why.
-                        const detail = testsFailureDetail(exec.stderr, exec.stdout);
-                        failures.push({
-                            pkg: step.pkg,
-                            reason: `exit ${String(exec.exitCode)}: ${step.cmd}${detail ? ` — ${detail}` : ''}`,
-                            class: 'EXIT_NONZERO',
-                            // AM-4: per-stream tails, never merged — see GateFailure.tails doc comment.
-                            tails: { stdout: outputTail(exec.stdout, undefined), stderr: outputTail(undefined, exec.stderr) },
-                        });
-                    }
+                    // FR-1: for tests/syntax/smoke, name the ACTUAL failure (summary + failing tests),
+                    // not just the first output line — see testsFailureDetail's doc comment for why.
+                    const detail = testsFailureDetail(exec.stderr, exec.stdout);
+                    failures.push({
+                        pkg: step.pkg,
+                        reason: `exit ${String(exec.exitCode)}: ${step.cmd}${detail ? ` — ${detail}` : ''}`,
+                        class: 'EXIT_NONZERO',
+                        // AM-4: per-stream tails, never merged — see GateFailure.tails doc comment.
+                        tails: { stdout: outputTail(exec.stdout, undefined), stderr: outputTail(undefined, exec.stderr) },
+                    });
                     continue;
                 }
                 passed += 1;
@@ -655,6 +671,14 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
                 failures.push({ pkg: step?.pkg, reason: 'unclassifiable step/execution record', class: 'EXIT_NONZERO' });
             }
         }
+        if (gate === 'audit') {
+            for (const result of packageAudits) {
+                if (result.status === 'clean')
+                    passed += 1;
+                else
+                    failures.push({ pkg: result.package, class: result.failureClass ?? 'AUDIT_ERROR', reason: result.reason ?? 'package consumer audit unavailable' });
+            }
+        }
         // AM-7: fold the packed-install bin verdicts (judged via judgePackedInstallSmoke, above) into
         // the 'smoke' gate — the ONLY gate that ever plans packed-install steps.
         if (gate === 'smoke' && packedInstallVerdict !== undefined) {
@@ -683,6 +707,8 @@ export function classifyGateExecutions(plan, executions, now = new Date()) {
     const ok = failedGates.length === 0 && anyPass;
     return {
         gates,
+        packageAudits,
+        workspaceAudit,
         ok,
         blockedBy,
         skipped: plan?.skips ?? [],