@jcode.labs/ragmir 2.17.1 → 2.18.0

package/dist/runtime-info.js

@@ -0,0 +1,81 @@
+import { existsSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { isRecord } from "./guards.js";
+import { VERSION } from "./version.js";
+const packageRequire = createRequire(import.meta.url);
+export function runtimeInfo() {
+    const lanceDbEntry = resolvePackageEntry(packageRequire, "@lancedb/lancedb");
+    const transformersEntry = resolvePackageEntry(packageRequire, "@huggingface/transformers");
+    const lanceDbRequire = lanceDbEntry ? createRequire(lanceDbEntry) : packageRequire;
+    const transformersRequire = transformersEntry ? createRequire(transformersEntry) : packageRequire;
+    return {
+        ragmir: VERSION,
+        node: process.versions.node,
+        v8: process.versions.v8,
+        napi: process.versions.napi ?? null,
+        platform: process.platform,
+        architecture: process.arch,
+        dependencies: {
+            lanceDb: resolvedPackage(packageRequire, "@lancedb/lancedb"),
+            lanceDbNative: resolvedLanceDbNative(lanceDbRequire),
+            apacheArrow: resolvedPackage(lanceDbRequire, "apache-arrow"),
+            transformers: resolvedPackage(packageRequire, "@huggingface/transformers"),
+            onnxRuntime: resolvedPackage(transformersRequire, "onnxruntime-node"),
+            sharp: resolvedPackage(transformersRequire, "sharp"),
+        },
+    };
+}
+function resolvedLanceDbNative(requireFrom) {
+    for (const packageName of lanceDbNativeCandidates()) {
+        const resolved = resolvedPackage(requireFrom, packageName);
+        if (resolved) {
+            return resolved;
+        }
+    }
+    return null;
+}
+function lanceDbNativeCandidates() {
+    const base = `@lancedb/lancedb-${process.platform}-${process.arch}`;
+    if (process.platform === "linux") {
+        return [`${base}-gnu`, `${base}-musl`];
+    }
+    return process.platform === "win32" ? [`${base}-msvc`] : [base];
+}
+function resolvedPackage(requireFrom, packageName) {
+    const entry = resolvePackageEntry(requireFrom, packageName);
+    if (!entry) {
+        return null;
+    }
+    let directory = path.dirname(entry);
+    while (true) {
+        const manifestPath = path.join(directory, "package.json");
+        if (existsSync(manifestPath)) {
+            try {
+                const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+                if (isRecord(manifest) &&
+                    manifest.name === packageName &&
+                    typeof manifest.version === "string") {
+                    return { name: packageName, version: manifest.version };
+                }
+            }
+            catch {
+                return null;
+            }
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory) {
+            return null;
+        }
+        directory = parent;
+    }
+}
+function resolvePackageEntry(requireFrom, packageName) {
+    try {
+        return requireFrom.resolve(packageName);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=runtime-info.js.map

package/dist/runtime-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-info.js","sourceRoot":"","sources":["../src/runtime-info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAErD,MAAM,UAAU,WAAW;IACzB,MAAM,YAAY,GAAG,mBAAmB,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IAC5E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAA;IAC1F,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;IAClF,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,cAAc,CAAA;IACjG,OAAO;QACL,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE;QACvB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI;QACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,IAAI;QAC1B,YAAY,EAAE;YACZ,OAAO,EAAE,eAAe,CAAC,cAAc,EAAE,kBAAkB,CAAC;YAC5D,aAAa,EAAE,qBAAqB,CAAC,cAAc,CAAC;YACpD,WAAW,EAAE,eAAe,CAAC,cAAc,EAAE,cAAc,CAAC;YAC5D,YAAY,EAAE,eAAe,CAAC,cAAc,EAAE,2BAA2B,CAAC;YAC1E,WAAW,EAAE,eAAe,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;YACrE,KAAK,EAAE,eAAe,CAAC,mBAAmB,EAAE,OAAO,CAAC;SACrD;KACF,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAwB;IACrD,KAAK,MAAM,WAAW,IAAI,uBAAuB,EAAE,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;QAC1D,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,IAAI,GAAG,oBAAoB,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACjE,CAAC;AAED,SAAS,eAAe,CACtB,WAAwB,EACxB,WAAmB;IAEnB,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACnC,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACzD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;gBACxE,IACE,QAAQ,CAAC,QAAQ,CAAC;oBAClB,QAAQ,CAAC,IAAI,KAAK,WAAW;oBAC7B,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EACpC,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAA;gBACzD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,SAAS,GAAG,MAAM,CAAA;IACpB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAwB,EAAE,WAAmB;IACxE,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/security.d.ts

@@ -1,3 +1,4 @@
-import type { OperationOptions, SecurityAuditReport } from "./types.js";
-export declare function securityAudit(cwd?: string, options?: OperationOptions): Promise<SecurityAuditReport>;
+import type { Config, SecurityAuditOptions, SecurityAuditReport } from "./types.js";
+export declare function securityAudit(cwd?: string, options?: SecurityAuditOptions): Promise<SecurityAuditReport>;
+export declare function securityAuditWithConfig(config: Config, options?: SecurityAuditOptions): Promise<SecurityAuditReport>;
 //# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEvE,wBAAsB,aAAa,CACjC,GAAG,SAAgB,EACnB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CA2I9B"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEnF,wBAAsB,aAAa,CACjC,GAAG,SAAgB,EACnB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAK9B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA+K9B"}

package/dist/security.js

@@ -1,34 +1,51 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
-import { findProjectConfig, loadConfig } from "./config.js";
+import { externalExtractorsRequested, findProjectConfig, loadConfig } from "./config.js";
 import { LEGACY_KB_DIR, LEGACY_KB_GITIGNORE_ENTRY, LEGACY_PRIVATE_DIR, LEGACY_PRIVATE_GITIGNORE_ENTRY, RAGMIR_GITIGNORE_ENTRY, } from "./defaults.js";
 import { operationSignal, throwIfAborted } from "./operation.js";
 export async function securityAudit(cwd = process.cwd(), options = {}) {
     const signal = operationSignal(options);
     throwIfAborted(signal);
     const config = await loadConfig(cwd);
+    return securityAuditWithConfig(config, options);
+}
+export async function securityAuditWithConfig(config, options = {}) {
+    const signal = operationSignal(options);
     throwIfAborted(signal);
     const gitignore = await readGitignore(config.projectRoot, signal);
     throwIfAborted(signal);
     const warnings = [];
-    const usesLegacyKb = [config.storageDir, config.sourcesFile, config.accessLogPath].some((filePath) => usesProjectDirectory(config.projectRoot, filePath, LEGACY_KB_DIR));
-    const usesLegacyPrivate = usesProjectDirectory(config.projectRoot, config.rawDir, LEGACY_PRIVATE_DIR);
-    const [legacyKbIgnored, ragmirIgnored, legacyPrivateIgnored, storageGitIgnored, accessLogGitIgnored,] = await Promise.all([
-        isPathIgnored(config.projectRoot, path.join(config.projectRoot, LEGACY_KB_GITIGNORE_ENTRY), gitignore, signal),
-        isPathIgnored(config.projectRoot, path.join(config.projectRoot, RAGMIR_GITIGNORE_ENTRY), gitignore, signal),
-        isPathIgnored(config.projectRoot, path.join(config.projectRoot, LEGACY_PRIVATE_GITIGNORE_ENTRY), gitignore, signal),
-        isPathIgnored(config.projectRoot, config.storageDir, gitignore, signal),
-        isPathIgnored(config.projectRoot, config.accessLogPath, gitignore, signal),
+    const probeGit = options.deep !== false;
+    const configPath = findProjectConfig(config.projectRoot).configPath;
+    const privatePathDefinitions = privatePathsForConfig(config, configPath);
+    const gitPaths = [
+        path.join(config.projectRoot, LEGACY_KB_GITIGNORE_ENTRY),
+        path.join(config.projectRoot, RAGMIR_GITIGNORE_ENTRY),
+        path.join(config.projectRoot, LEGACY_PRIVATE_GITIGNORE_ENTRY),
+        config.storageDir,
+        ...privatePathDefinitions.map((definition) => definition.filePath),
+    ].map((filePath) => normalizeRelativePath(config.projectRoot, filePath));
+    const [gitPathStates, permissions] = await Promise.all([
+        inspectGitPaths(config.projectRoot, gitPaths, signal, probeGit),
+        inspectPermissions({
+            configPath,
+            rawDir: config.rawDir,
+            storageDir: config.storageDir,
+            sourcesFile: config.sourcesFile,
+            accessLogPath: config.accessLogPath,
+            embeddingModelPath: config.embeddingModelPath,
+        }, signal),
     ]);
     throwIfAborted(signal);
-    const permissions = await inspectPermissions({
-        configPath: findProjectConfig(cwd).configPath,
-        rawDir: config.rawDir,
-        storageDir: config.storageDir,
-        accessLogPath: config.accessLogPath,
-    }, signal);
+    const usesLegacyKb = [config.storageDir, config.sourcesFile, config.accessLogPath].some((filePath) => usesProjectDirectory(config.projectRoot, filePath, LEGACY_KB_DIR));
+    const usesLegacyPrivate = usesProjectDirectory(config.projectRoot, config.rawDir, LEGACY_PRIVATE_DIR);
+    const legacyKbIgnored = isPathIgnored(config.projectRoot, path.join(config.projectRoot, LEGACY_KB_GITIGNORE_ENTRY), gitignore, gitPathStates);
+    const ragmirIgnored = isPathIgnored(config.projectRoot, path.join(config.projectRoot, RAGMIR_GITIGNORE_ENTRY), gitignore, gitPathStates);
+    const legacyPrivateIgnored = isPathIgnored(config.projectRoot, path.join(config.projectRoot, LEGACY_PRIVATE_GITIGNORE_ENTRY), gitignore, gitPathStates);
+    const storageGitIgnored = isPathIgnored(config.projectRoot, config.storageDir, gitignore, gitPathStates);
+    const privatePaths = inspectPrivatePaths(config, privatePathDefinitions, permissions, gitignore, gitPathStates);
     throwIfAborted(signal);
     if (config.privacyProfile !== "trusted" &&
         config.embeddingProvider === "transformers" &&
@@ -47,17 +64,24 @@ export async function securityAudit(cwd = process.cwd(), options = {}) {
     if (usesLegacyPrivate && !legacyPrivateIgnored) {
         warnings.push(`${LEGACY_PRIVATE_GITIGNORE_ENTRY} is not ignored by Git.`);
     }
-    if (!storageGitIgnored) {
-        warnings.push("The configured storageDir is not ignored by Git.");
-    }
-    if (config.accessLog && !accessLogGitIgnored) {
-        warnings.push("The configured accessLogPath is not ignored by Git.");
+    for (const privatePath of privatePaths) {
+        const label = privatePathLabel(privatePath.kind);
+        if (privatePath.insideProject && privatePath.gitIgnored === false) {
+            warnings.push(`The ${label} is not ignored by Git.`);
+        }
+        if (privatePath.gitTracked === true) {
+            warnings.push(`The ${label} is tracked by Git and may expose private Ragmir data.`);
+        }
+        if (privatePath.kind !== "access-log" || config.accessLog) {
+            addPermissionWarning(warnings, privatePath.permissionPrivate, label);
+        }
     }
-    addPermissionWarning(warnings, permissions.configPrivate, "Ragmir config file");
-    addPermissionWarning(warnings, permissions.rawDirPrivate, "raw document directory");
-    addPermissionWarning(warnings, permissions.storageDirPrivate, "index storage directory");
-    if (config.accessLog) {
-        addPermissionWarning(warnings, permissions.accessLogPrivate, "access log");
+    const enabledExternalExtractors = externalExtractorNames(config);
+    const extractorsConfigured = externalExtractorsRequested(config);
+    if (extractorsConfigured) {
+        warnings.push(enabledExternalExtractors.length === 0 && config.privacyProfile === "strict"
+            ? "External extractors were configured but are disabled by the strict privacy profile; they execute with operator authority when enabled."
+            : "External extractors are configured and execute with the operator's filesystem and process authority.");
     }
     throwIfAborted(signal);
     return {
@@ -69,6 +93,7 @@ export async function securityAudit(cwd = process.cwd(), options = {}) {
             embedding: config.embeddingProvider,
             embeddingModel: config.embeddingModel,
             embeddingModelRevision: config.embeddingModelRevision,
+            embeddingModelDigest: config.embeddingModelDigest,
             embeddingModelPath: config.embeddingModelPath,
             transformersAllowRemoteModels: config.transformersAllowRemoteModels,
             llmGeneration: false,
@@ -88,6 +113,15 @@ export async function securityAudit(cwd = process.cwd(), options = {}) {
             gitIgnored: storageGitIgnored,
             encryptedAtRest: "external-required",
         },
+        privatePaths,
+        externalExtractors: {
+            configured: extractorsConfigured,
+            enabled: enabledExternalExtractors,
+            disabledByStrictProfile: extractorsConfigured &&
+                config.privacyProfile === "strict" &&
+                enabledExternalExtractors.length === 0,
+            executeWithOperatorAuthority: true,
+        },
         permissions,
         mcp: {
             maxTopK: config.mcpMaxTopK,
@@ -116,14 +150,18 @@ async function inspectPermissions(paths, signal) {
             configPrivate: null,
             rawDirPrivate: null,
             storageDirPrivate: null,
+            sourcesFilePrivate: null,
             accessLogPrivate: null,
+            embeddingModelPathPrivate: null,
         };
     }
-    const [configPrivate, rawDirPrivate, storageDirPrivate, accessLogPrivate] = await Promise.all([
+    const [configPrivate, rawDirPrivate, storageDirPrivate, sourcesFilePrivate, accessLogPrivate, embeddingModelPathPrivate,] = await Promise.all([
         isPrivatePath(paths.configPath, signal),
         isPrivatePath(paths.rawDir, signal),
         isPrivatePath(paths.storageDir, signal),
+        isPrivatePath(paths.sourcesFile, signal),
         isPrivatePath(paths.accessLogPath, signal),
+        isPrivatePath(paths.embeddingModelPath, signal),
     ]);
     throwIfAborted(signal);
     return {
@@ -131,9 +169,89 @@ async function inspectPermissions(paths, signal) {
         configPrivate,
         rawDirPrivate,
         storageDirPrivate,
+        sourcesFilePrivate,
         accessLogPrivate,
+        embeddingModelPathPrivate,
     };
 }
+function privatePathsForConfig(config, configPath) {
+    return [
+        {
+            kind: "config",
+            filePath: configPath,
+        },
+        { kind: "raw", filePath: config.rawDir },
+        { kind: "storage", filePath: config.storageDir },
+        { kind: "sources", filePath: config.sourcesFile },
+        { kind: "access-log", filePath: config.accessLogPath },
+        {
+            kind: "embedding-models",
+            filePath: config.embeddingModelPath,
+        },
+    ];
+}
+function inspectPrivatePaths(config, definitions, permissions, gitignore, gitPathStates) {
+    return definitions.map((definition) => {
+        const relativePath = normalizeRelativePath(config.projectRoot, definition.filePath);
+        const insideProject = !isOutsideProject(relativePath);
+        const gitState = gitPathStates.get(relativePath);
+        return {
+            kind: definition.kind,
+            path: definition.filePath,
+            insideProject,
+            gitIgnored: insideProject
+                ? isPathIgnored(config.projectRoot, definition.filePath, gitignore, gitPathStates)
+                : null,
+            gitTracked: insideProject ? (gitState?.tracked ?? null) : null,
+            permissionPrivate: privatePathPermission(definition.kind, permissions),
+        };
+    });
+}
+function privatePathPermission(kind, permissions) {
+    switch (kind) {
+        case "config":
+            return permissions.configPrivate;
+        case "raw":
+            return permissions.rawDirPrivate;
+        case "storage":
+            return permissions.storageDirPrivate;
+        case "sources":
+            return permissions.sourcesFilePrivate;
+        case "access-log":
+            return permissions.accessLogPrivate;
+        case "embedding-models":
+            return permissions.embeddingModelPathPrivate;
+    }
+}
+function privatePathLabel(kind) {
+    switch (kind) {
+        case "config":
+            return "Ragmir config file";
+        case "raw":
+            return "configured rawDir";
+        case "storage":
+            return "configured storageDir";
+        case "sources":
+            return "configured sourcesFile";
+        case "access-log":
+            return "configured accessLogPath";
+        case "embedding-models":
+            return "configured embeddingModelPath";
+    }
+}
+function externalExtractorNames(config) {
+    const enabled = [];
+    if (config.pdfOcrCommand.length > 0) {
+        enabled.push("pdf-ocr");
+    }
+    if (config.imageOcrCommand.length > 0) {
+        enabled.push("image-ocr");
+    }
+    if (config.legacyWordCommand.length > 0) {
+        enabled.push("legacy-word");
+    }
+    return enabled;
+}
 async function isPrivatePath(filePath, signal) {
     throwIfAborted(signal);
     try {
@@ -181,45 +299,124 @@ function usesProjectDirectory(projectRoot, filePath, directory) {
     const relativePath = normalizeRelativePath(projectRoot, filePath);
     return relativePath === directory || relativePath.startsWith(`${directory}/`);
 }
-async function isPathIgnored(projectRoot, filePath, lines, signal) {
+async function inspectGitPaths(projectRoot, relativePaths, signal, probeGit) {
+    const paths = [
+        ...new Set(relativePaths.filter((relativePath) => !isOutsideProject(relativePath))),
+    ];
+    if (!probeGit || paths.length === 0) {
+        return new Map();
+    }
+    const [ignoredPaths, trackedPaths] = await Promise.all([
+        checkGitIgnoredPaths(projectRoot, paths, signal),
+        checkGitTrackedPaths(projectRoot, paths, signal),
+    ]);
     throwIfAborted(signal);
+    return new Map(paths.map((relativePath) => [
+        relativePath,
+        {
+            ignored: ignoredPaths?.get(relativePath) ?? null,
+            tracked: trackedPaths?.get(relativePath) ?? null,
+        },
+    ]));
+}
+function isPathIgnored(projectRoot, filePath, lines, gitPathStates) {
     const relativePath = normalizeRelativePath(projectRoot, filePath);
     if (isOutsideProject(relativePath)) {
         return false;
     }
-    let gitResult;
-    try {
-        gitResult = await checkGitIgnored(projectRoot, relativePath, signal);
-    }
-    catch (error) {
-        throwIfAborted(signal);
-        throw error;
-    }
-    throwIfAborted(signal);
-    if (gitResult !== null) {
+    const gitResult = gitPathStates.get(relativePath)?.ignored;
+    if (gitResult !== undefined && gitResult !== null) {
         return gitResult;
     }
     return isPathIgnoredByEntries(relativePath, lines);
 }
-function checkGitIgnored(projectRoot, relativePath, signal) {
+async function checkGitIgnoredPaths(projectRoot, relativePaths, signal) {
+    const result = await spawnGitWithInput(projectRoot, ["check-ignore", "--verbose", "--non-matching", "-z", "--stdin"], Buffer.from(`${relativePaths.join("\0")}\0`, "utf8"), signal);
+    throwIfAborted(signal);
+    if (!result || (result.code !== 0 && result.code !== 1)) {
+        return null;
+    }
+    const fields = nullDelimitedFields(result.stdout);
+    if (fields.length % 4 !== 0) {
+        return null;
+    }
+    const ignoredPaths = new Map();
+    for (let index = 0; index < fields.length; index += 4) {
+        const pattern = fields[index + 2];
+        const relativePath = fields[index + 3];
+        if (pattern === undefined || relativePath === undefined) {
+            return null;
+        }
+        ignoredPaths.set(relativePath, pattern.length > 0 && !pattern.startsWith("!"));
+    }
+    return relativePaths.every((relativePath) => ignoredPaths.has(relativePath)) ? ignoredPaths : null;
+}
+function checkGitTrackedPaths(projectRoot, relativePaths, signal) {
     return new Promise((resolve, reject) => {
-        execFile("git", ["check-ignore", "--quiet", "--", relativePath], { cwd: projectRoot, windowsHide: true, signal }, (error) => {
+        execFile("git", [
+            "ls-files",
+            "--cached",
+            "-z",
+            "--",
+            ...relativePaths.map((relativePath) => `:(literal)${relativePath}`),
+        ], { cwd: projectRoot, encoding: "buffer", windowsHide: true, signal }, (error, stdout) => {
+            if (signal?.aborted) {
+                reject(error);
+                return;
+            }
             if (!error) {
-                resolve(true);
+                const trackedFiles = nullDelimitedFields(stdout);
+                resolve(new Map(relativePaths.map((relativePath) => [
+                    relativePath,
+                    trackedFiles.some((trackedFile) => trackedFile === relativePath || trackedFile.startsWith(`${relativePath}/`)),
+                ])));
                 return;
             }
+            resolve(null);
+        });
+    });
+}
+function spawnGitWithInput(projectRoot, args, input, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("git", args, {
+            cwd: projectRoot,
+            signal,
+            stdio: ["pipe", "pipe", "ignore"],
+            windowsHide: true,
+        });
+        const stdout = [];
+        let settled = false;
+        child.stdin.on("error", () => undefined);
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.once("error", (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
             if (signal?.aborted) {
                 reject(error);
-                return;
             }
-            if (error.code === 1) {
-                resolve(false);
+            else {
+                resolve(null);
+            }
+        });
+        child.once("close", (code) => {
+            if (settled) {
                 return;
             }
-            resolve(null);
+            settled = true;
+            resolve({ code, stdout: Buffer.concat(stdout) });
         });
+        child.stdin.end(input);
     });
 }
+function nullDelimitedFields(output) {
+    const fields = output.toString("utf8").split("\0");
+    if (fields.at(-1) === "") {
+        fields.pop();
+    }
+    return fields;
+}
 function isPathIgnoredByEntries(relativePath, lines) {
     const segments = relativePath.split("/");
     for (let index = 1; index <= segments.length; index += 1) {

package/dist/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC3D,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAGhE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACjE,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAa,EAAE,CAAA;IAE7B,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CACrF,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAChF,CAAA;IACD,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,MAAM,EACb,kBAAkB,CACnB,CAAA;IACD,MAAM,CACJ,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACpB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,aAAa,CACX,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EACxD,SAAS,EACT,MAAM,CACP;QACD,aAAa,CACX,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,EACrD,SAAS,EACT,MAAM,CACP;QACD,aAAa,CACX,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC,EAC7D,SAAS,EACT,MAAM,CACP;QACD,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC;QACvE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC;KAC3E,CAAC,CAAA;IACF,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC1C;QACE,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAU;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,EACD,MAAM,CACP,CAAA;IACD,cAAc,CAAC,MAAM,CAAC,CAAA;IAEtB,IACE,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,iBAAiB,KAAK,cAAc;QAC3C,MAAM,CAAC,6BAA6B,EACpC,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,gGAAgG,CACjG,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,yBAAyB,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,yBAAyB,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,iBAAiB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,8BAA8B,yBAAyB,CAAC,CAAA;IAC3E,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACtE,CAAC;IACD,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IAC/E,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,aAAa,EAAE,wBAAwB,CAAC,CAAA;IACnF,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAA;IACxF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAA;IAC5E,CAAC;IAED,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,iBAAiB;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,6BAA6B,EAAE,MAAM,CAAC,6BAA6B;YACnE,aAAa,EAAE,KAAK;SACrB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;YACjC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;YACjC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzE;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,gBAAgB,EAAE,KAAK;SACxB;QACD,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,UAAU,EAAE,iBAAiB;YAC7B,eAAe,EAAE,mBAAmB;SACrC;QACD,WAAW;QACX,GAAG,EAAE;YACH,OAAO,EAAE,MAAM,CAAC,UAAU;YAC1B,cAAc,EAAE,MAAM,CAAC,iBAAiB;YACxC,uBAAuB,EAAE,KAAK;SAC/B;QACD,SAAS,EAAE;YACT,eAAe;YACf,aAAa;YACb,oBAAoB;SACrB;QACD,eAAe,EAAE;YACf,sFAAsF;YACtF,yFAAyF;YACzF,4FAA4F;YAC5F,8EAA8E;SAC/E;QACD,QAAQ;KACT,CAAA;AACH,CAAC;AASD,KAAK,UAAU,kBAAkB,CAC/B,KAAsB,EACtB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,IAAI;YACvB,gBAAgB,EAAE,IAAI;SACvB,CAAA;IACH,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5F,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QACvC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QACvC,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;KAC3C,CAAC,CAAA;IACF,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,aAAa;QACb,aAAa;QACb,iBAAiB;QACjB,gBAAgB;KACjB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAA;QAChD,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,WAA2B,EAC3B,KAAa;IAEb,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,OAAO,KAAK,kJAAkJ,CAC/J,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IAED,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,MAAM,KAAK,CAAA;IACb,CAAC;IACD,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO,IAAI,GAAG,CACZ,OAAO;SACJ,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB,EAAE,QAAgB,EAAE,SAAiB;IACpF,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACjE,OAAO,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,QAAgB,EAChB,KAAkB,EAClB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACjE,IAAI,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,SAAyB,CAAA;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,MAAM,KAAK,CAAA;IACb,CAAC;IACD,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,WAAmB,EACnB,YAAoB,EACpB,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,KAAK,EACL,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,EAC/C,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAC/C,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,CAAA;gBACb,OAAM;YACR,CAAC;YACD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAA;gBACb,OAAM;YACR,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,CAAA;gBACd,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB,EAAE,KAAkB;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AACjG,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACvE,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxF,OAAO,EACL,aAAa,EACb,yBAAyB,EACzB,kBAAkB,EAClB,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAGhE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,UAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,OAAO,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,UAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACvC,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACjE,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,KAAK,CAAA;IACvC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,UAAU,CAAA;IACnE,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACxE,MAAM,QAAQ,GAAG;QACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;QAC7D,MAAM,CAAC,UAAU;QACjB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;KACnE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;IACxE,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;QAC/D,kBAAkB,CAChB;YACE,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;SAC9C,EACD,MAAM,CACP;KACF,CAAC,CAAA;IACF,cAAc,CAAC,MAAM,CAAC,CAAA;IAEtB,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CACrF,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAChF,CAAA;IACD,MAAM,iBAAiB,GAAG,oBAAoB,CAC5C,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,MAAM,EACb,kBAAkB,CACnB,CAAA;IACD,MAAM,eAAe,GAAG,aAAa,CACnC,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EACxD,SAAS,EACT,aAAa,CACd,CAAA;IACD,MAAM,aAAa,GAAG,aAAa,CACjC,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,EACrD,SAAS,EACT,aAAa,CACd,CAAA;IACD,MAAM,oBAAoB,GAAG,aAAa,CACxC,MAAM,CAAC,WAAW,EAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC,EAC7D,SAAS,EACT,aAAa,CACd,CAAA;IACD,MAAM,iBAAiB,GAAG,aAAa,CACrC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,UAAU,EACjB,SAAS,EACT,aAAa,CACd,CAAA;IACD,MAAM,YAAY,GAAG,mBAAmB,CACtC,MAAM,EACN,sBAAsB,EACtB,WAAW,EACX,SAAS,EACT,aAAa,CACd,CAAA;IACD,cAAc,CAAC,MAAM,CAAC,CAAA;IAEtB,IACE,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,MAAM,CAAC,iBAAiB,KAAK,cAAc;QAC3C,MAAM,CAAC,6BAA6B,EACpC,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,gGAAgG,CACjG,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,yBAAyB,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,YAAY,IAAI,CAAC,eAAe,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,yBAAyB,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,iBAAiB,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,8BAA8B,yBAAyB,CAAC,CAAA;IAC3E,CAAC;IACD,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;QAChD,IAAI,WAAW,CAAC,aAAa,IAAI,WAAW,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,yBAAyB,CAAC,CAAA;QACtD,CAAC;QACD,IAAI,WAAW,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,wDAAwD,CAAC,CAAA;QACrF,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IACD,MAAM,yBAAyB,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAChE,MAAM,oBAAoB,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;IAChE,IAAI,oBAAoB,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,yBAAyB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,QAAQ;YAC1E,CAAC,CAAC,wIAAwI;YAC1I,CAAC,CAAC,sGAAsG,CAC3G,CAAA;IACH,CAAC;IAED,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE;YACT,SAAS,EAAE,MAAM,CAAC,iBAAiB;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,6BAA6B,EAAE,MAAM,CAAC,6BAA6B;YACnE,aAAa,EAAE,KAAK;SACrB;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;YACjC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,OAAO;YACjC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzE;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,IAAI,EAAE,MAAM,CAAC,aAAa;YAC1B,gBAAgB,EAAE,KAAK;SACxB;QACD,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,UAAU,EAAE,iBAAiB;YAC7B,eAAe,EAAE,mBAAmB;SACrC;QACD,YAAY;QACZ,kBAAkB,EAAE;YAClB,UAAU,EAAE,oBAAoB;YAChC,OAAO,EAAE,yBAAyB;YAClC,uBAAuB,EACrB,oBAAoB;gBACpB,MAAM,CAAC,cAAc,KAAK,QAAQ;gBAClC,yBAAyB,CAAC,MAAM,KAAK,CAAC;YACxC,4BAA4B,EAAE,IAAI;SACnC;QACD,WAAW;QACX,GAAG,EAAE;YACH,OAAO,EAAE,MAAM,CAAC,UAAU;YAC1B,cAAc,EAAE,MAAM,CAAC,iBAAiB;YACxC,uBAAuB,EAAE,KAAK;SAC/B;QACD,SAAS,EAAE;YACT,eAAe;YACf,aAAa;YACb,oBAAoB;SACrB;QACD,eAAe,EAAE;YACf,sFAAsF;YACtF,yFAAyF;YACzF,4FAA4F;YAC5F,8EAA8E;SAC/E;QACD,QAAQ;KACT,CAAA;AACH,CAAC;AAWD,KAAK,UAAU,kBAAkB,CAC/B,KAAsB,EACtB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,KAAK;YACd,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,IAAI;YACvB,kBAAkB,EAAE,IAAI;YACxB,gBAAgB,EAAE,IAAI;YACtB,yBAAyB,EAAE,IAAI;SAChC,CAAA;IACH,CAAC;IACD,MAAM,CACJ,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EAC1B,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QACvC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;QACnC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QACvC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC;QACxC,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC;QAC1C,aAAa,CAAC,KAAK,CAAC,kBAAkB,EAAE,MAAM,CAAC;KAChD,CAAC,CAAA;IACF,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,aAAa;QACb,aAAa;QACb,iBAAiB;QACjB,kBAAkB;QAClB,gBAAgB;QAChB,yBAAyB;KAC1B,CAAA;AACH,CAAC;AAOD,SAAS,qBAAqB,CAAC,MAAc,EAAE,UAAkB;IAC/D,OAAO;QACL;YACE,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,UAAU;SACrB;QACD,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE;QACxC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;QAChD,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE;QACjD,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE;QACtD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,MAAM,CAAC,kBAAkB;SACpC;KACF,CAAA;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAc,EACd,WAAoC,EACpC,WAA+C,EAC/C,SAAsB,EACtB,aAA4B;IAE5B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACpC,MAAM,YAAY,GAAG,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;QACnF,MAAM,aAAa,GAAG,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAA;QACrD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAChD,OAAO;YACL,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,QAAQ;YACzB,aAAa;YACb,UAAU,EAAE,aAAa;gBACvB,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;gBAClF,CAAC,CAAC,IAAI;YACR,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YAC9D,iBAAiB,EAAE,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;SACvE,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAmC,EACnC,WAA+C;IAE/C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,WAAW,CAAC,aAAa,CAAA;QAClC,KAAK,KAAK;YACR,OAAO,WAAW,CAAC,aAAa,CAAA;QAClC,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,iBAAiB,CAAA;QACtC,KAAK,SAAS;YACZ,OAAO,WAAW,CAAC,kBAAkB,CAAA;QACvC,KAAK,YAAY;YACf,OAAO,WAAW,CAAC,gBAAgB,CAAA;QACrC,KAAK,kBAAkB;YACrB,OAAO,WAAW,CAAC,yBAAyB,CAAA;IAChD,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAyD;IACjF,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ;YACX,OAAO,oBAAoB,CAAA;QAC7B,KAAK,KAAK;YACR,OAAO,mBAAmB,CAAA;QAC5B,KAAK,SAAS;YACZ,OAAO,uBAAuB,CAAA;QAChC,KAAK,SAAS;YACZ,OAAO,wBAAwB,CAAA;QACjC,KAAK,YAAY;YACf,OAAO,0BAA0B,CAAA;QACnC,KAAK,kBAAkB;YACrB,OAAO,+BAA+B,CAAA;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,OAAO,GAAmD,EAAE,CAAA;IAClE,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAA;QAChD,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAkB,EAClB,WAA2B,EAC3B,KAAa;IAEb,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,OAAO,KAAK,kJAAkJ,CAC/J,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,MAA+B;IAE/B,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IAED,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,MAAM,CAAC,CAAA;QACtB,MAAM,KAAK,CAAA;IACb,CAAC;IACD,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO,IAAI,GAAG,CACZ,OAAO;SACJ,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB,EAAE,QAAgB,EAAE,SAAiB;IACpF,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACjE,OAAO,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAA;AAC/E,CAAC;AAcD,KAAK,UAAU,eAAe,CAC5B,WAAmB,EACnB,aAAuB,EACvB,MAA+B,EAC/B,QAAiB;IAEjB,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC;KACpF,CAAA;IACD,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;QAChD,oBAAoB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC;KACjD,CAAC,CAAA;IACF,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,OAAO,IAAI,GAAG,CACZ,KAAK,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;QAC1B,YAAY;QACZ;YACE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI;YAChD,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI;SACjD;KACF,CAAC,CACH,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,WAAmB,EACnB,QAAgB,EAChB,KAAkB,EAClB,aAA4B;IAE5B,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IACjE,IAAI,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC1D,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,sBAAsB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACpD,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAAmB,EACnB,aAAuB,EACvB,MAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,WAAW,EACX,CAAC,cAAc,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,EAChE,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EACpD,MAAM,CACP,CAAA;IACD,cAAc,CAAC,MAAM,CAAC,CAAA;IACtB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmB,CAAA;IAC/C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACjC,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;AACpG,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAAmB,EACnB,aAAuB,EACvB,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,KAAK,EACL;YACE,UAAU;YACV,UAAU;YACV,IAAI;YACJ,IAAI;YACJ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,aAAa,YAAY,EAAE,CAAC;SACpE,EACD,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EACnE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAA;gBACb,OAAM;YACR,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,YAAY,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;gBAChD,OAAO,CACL,IAAI,GAAG,CACL,aAAa,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;oBAClC,YAAY;oBACZ,YAAY,CAAC,IAAI,CACf,CAAC,WAAW,EAAE,EAAE,CACd,WAAW,KAAK,YAAY,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,YAAY,GAAG,CAAC,CAC7E;iBACF,CAAC,CACH,CACF,CAAA;gBACD,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,WAAmB,EACnB,IAAc,EACd,KAAa,EACb,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,WAAW;YAChB,MAAM;YACN,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjC,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QAC9D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,KAAK,CAAC,CAAA;YACf,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,CAAA;YACf,CAAC;QACH,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAM;YACR,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,EAAE,CAAA;IACd,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,YAAoB,EAAE,KAAkB;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAA;AACjG,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACvE,CAAC"}

package/dist/semantic-config.d.ts

@@ -2,8 +2,14 @@ export interface EnableSemanticEmbeddingsResult {
     configPath: string;
     embeddingProvider: "transformers";
     embeddingModel: string;
+    embeddingModelRevision: string;
+    embeddingModelDigest: string | null;
     embeddingModelPath: string;
     transformersAllowRemoteModels: false;
 }
-export declare function enableSemanticEmbeddings(cwd?: string): Promise<EnableSemanticEmbeddingsResult>;
+export interface SemanticEmbeddingArtifact {
+    embeddingModelRevision: string;
+    embeddingModelDigest: string;
+}
+export declare function enableSemanticEmbeddings(cwd?: string, artifact?: SemanticEmbeddingArtifact): Promise<EnableSemanticEmbeddingsResult>;
 //# sourceMappingURL=semantic-config.d.ts.map

package/dist/semantic-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semantic-config.d.ts","sourceRoot":"","sources":["../src/semantic-config.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,EAAE,cAAc,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,6BAA6B,EAAE,KAAK,CAAA;CACrC;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,SAAgB,GAClB,OAAO,CAAC,8BAA8B,CAAC,CAgCzC"}
+{"version":3,"file":"semantic-config.d.ts","sourceRoot":"","sources":["../src/semantic-config.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,EAAE,cAAc,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,sBAAsB,EAAE,MAAM,CAAA;IAC9B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,6BAA6B,EAAE,KAAK,CAAA;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,oBAAoB,EAAE,MAAM,CAAA;CAC7B;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,SAAgB,EACnB,QAAQ,CAAC,EAAE,yBAAyB,GACnC,OAAO,CAAC,8BAA8B,CAAC,CA4DzC"}

package/dist/semantic-config.js

@@ -1,29 +1,55 @@
 import { findProjectConfig } from "./config.js";
-import { DEFAULT_CONFIG } from "./defaults.js";
+import { DEFAULT_CONFIG, defaultEmbeddingModelRevision } from "./defaults.js";
 import { initProject } from "./init.js";
 import { mutateProjectConfig } from "./project-config-file.js";
-export async function enableSemanticEmbeddings(cwd = process.cwd()) {
+export async function enableSemanticEmbeddings(cwd = process.cwd(), artifact) {
+    if (artifact && !/^[0-9a-f]{40}$/u.test(artifact.embeddingModelRevision)) {
+        throw new Error("The resolved embedding model revision must be an immutable 40-character commit hash before enabling semantic embeddings.");
+    }
+    if (artifact && !/^sha256:[0-9a-f]{64}$/u.test(artifact.embeddingModelDigest)) {
+        throw new Error("The resolved embedding model digest must be a lowercase SHA-256 identity.");
+    }
     await initProject(cwd);
     const projectConfig = findProjectConfig(cwd);
-    const { embeddingModel, embeddingModelPath } = await mutateProjectConfig(projectConfig, (rawConfig) => {
+    const { embeddingModel, embeddingModelRevision, embeddingModelDigest, embeddingModelPath } = await mutateProjectConfig(projectConfig, (rawConfig) => {
         const embeddingModel = typeof rawConfig.embeddingModel === "string"
             ? rawConfig.embeddingModel
             : DEFAULT_CONFIG.embeddingModel;
         const embeddingModelPath = typeof rawConfig.embeddingModelPath === "string"
             ? rawConfig.embeddingModelPath
             : DEFAULT_CONFIG.embeddingModelPath;
+        const embeddingModelRevision = artifact?.embeddingModelRevision ??
+            (typeof rawConfig.embeddingModelRevision === "string"
+                ? rawConfig.embeddingModelRevision
+                : defaultEmbeddingModelRevision(embeddingModel));
+        const embeddingModelDigest = artifact?.embeddingModelDigest ??
+            (typeof rawConfig.embeddingModelDigest === "string"
+                ? rawConfig.embeddingModelDigest
+                : DEFAULT_CONFIG.embeddingModelDigest);
         Object.assign(rawConfig, {
             embeddingProvider: "transformers",
             embeddingModel,
+            embeddingModelRevision,
+            embeddingModelDigest,
             embeddingModelPath,
             transformersAllowRemoteModels: false,
         });
-        return { changed: true, value: { embeddingModel, embeddingModelPath } };
+        return {
+            changed: true,
+            value: {
+                embeddingModel,
+                embeddingModelRevision,
+                embeddingModelDigest,
+                embeddingModelPath,
+            },
+        };
     });
     return {
         configPath: projectConfig.configPath,
         embeddingProvider: "transformers",
         embeddingModel,
+        embeddingModelRevision,
+        embeddingModelDigest,
         embeddingModelPath,
         transformersAllowRemoteModels: false,
     };

package/dist/semantic-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"semantic-config.js","sourceRoot":"","sources":["../src/semantic-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAU9D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;IACtB,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAE5C,MAAM,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,MAAM,mBAAmB,CACtE,aAAa,EACb,CAAC,SAAS,EAAE,EAAE;QACZ,MAAM,cAAc,GAClB,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;YAC1C,CAAC,CAAC,SAAS,CAAC,cAAc;YAC1B,CAAC,CAAC,cAAc,CAAC,cAAc,CAAA;QACnC,MAAM,kBAAkB,GACtB,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,CAAC,CAAC,SAAS,CAAC,kBAAkB;YAC9B,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,iBAAiB,EAAE,cAAc;YACjC,cAAc;YACd,kBAAkB;YAClB,6BAA6B,EAAE,KAAK;SACrC,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAA;IACzE,CAAC,CACF,CAAA;IAED,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,iBAAiB,EAAE,cAAc;QACjC,cAAc;QACd,kBAAkB;QAClB,6BAA6B,EAAE,KAAK;KACrC,CAAA;AACH,CAAC"}
+{"version":3,"file":"semantic-config.js","sourceRoot":"","sources":["../src/semantic-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAA;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAiB9D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,QAAoC;IAEpC,IAAI,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,0HAA0H,CAC3H,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;IAC9F,CAAC;IACD,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;IACtB,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAE5C,MAAM,EAAE,cAAc,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,GACxF,MAAM,mBAAmB,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE;QACrD,MAAM,cAAc,GAClB,OAAO,SAAS,CAAC,cAAc,KAAK,QAAQ;YAC1C,CAAC,CAAC,SAAS,CAAC,cAAc;YAC1B,CAAC,CAAC,cAAc,CAAC,cAAc,CAAA;QACnC,MAAM,kBAAkB,GACtB,OAAO,SAAS,CAAC,kBAAkB,KAAK,QAAQ;YAC9C,CAAC,CAAC,SAAS,CAAC,kBAAkB;YAC9B,CAAC,CAAC,cAAc,CAAC,kBAAkB,CAAA;QACvC,MAAM,sBAAsB,GAC1B,QAAQ,EAAE,sBAAsB;YAChC,CAAC,OAAO,SAAS,CAAC,sBAAsB,KAAK,QAAQ;gBACnD,CAAC,CAAC,SAAS,CAAC,sBAAsB;gBAClC,CAAC,CAAC,6BAA6B,CAAC,cAAc,CAAC,CAAC,CAAA;QACpD,MAAM,oBAAoB,GACxB,QAAQ,EAAE,oBAAoB;YAC9B,CAAC,OAAO,SAAS,CAAC,oBAAoB,KAAK,QAAQ;gBACjD,CAAC,CAAC,SAAS,CAAC,oBAAoB;gBAChC,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;YACvB,iBAAiB,EAAE,cAAc;YACjC,cAAc;YACd,sBAAsB;YACtB,oBAAoB;YACpB,kBAAkB;YAClB,6BAA6B,EAAE,KAAK;SACrC,CAAC,CAAA;QACF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE;gBACL,cAAc;gBACd,sBAAsB;gBACtB,oBAAoB;gBACpB,kBAAkB;aACnB;SACF,CAAA;IACH,CAAC,CAAC,CAAA;IAEJ,OAAO;QACL,UAAU,EAAE,aAAa,CAAC,UAAU;QACpC,iBAAiB,EAAE,cAAc;QACjC,cAAc;QACd,sBAAsB;QACtB,oBAAoB;QACpB,kBAAkB;QAClB,6BAA6B,EAAE,KAAK;KACrC,CAAA;AACH,CAAC"}