@keithadler/frostjs 0.1.0

package/dist/policy/parse.js

@@ -0,0 +1,352 @@
+/**
+ * Parser for frostjs's policy files, written in frost's policy dialect:
+ * line-oriented, one rule per line, `--` or `#` comments, case-insensitive
+ * keywords, double-quoted strings. A trailing comment on a rule is its hint
+ * and is printed when the rule refuses something.
+ *
+ *   policy "checkout-widget"
+ *   ignore "public/*.min.js"
+ *   vendored "vendor/**"
+ *   may reach "api.example.com", "cdn.example.com"
+ *   may use session storage
+ *   may use local storage in "src/legacy/*" until 2026-12-01  -- migrating
+ *   forbid cookies                                             -- consent banner owns these
+ *   forbid reaching "*.telemetry.example"
+ *   forbid everything else
+ */
+import { resolveCapability, FAMILIES, CAPABILITY_PHRASES } from "./vocabulary.js";
+import { SAME_ORIGIN } from "../extract/target.js";
+/**
+ * A policy that cannot be read. The message carries file, line, the source
+ * line with a caret under the column, and what to try instead.
+ */
+export class PolicyError extends Error {
+    file;
+    line;
+    column;
+    detail;
+    source;
+    tryInstead;
+    constructor(file, line, 
+    /** 1-based. */
+    column, detail, source, tryInstead) {
+        super(`${file} line ${line}: ${detail}\n  ${source}\n  ${" ".repeat(Math.max(0, column - 1))}^` +
+            (tryInstead ? `\n  try: ${tryInstead}` : ""));
+        this.file = file;
+        this.line = line;
+        this.column = column;
+        this.detail = detail;
+        this.source = source;
+        this.tryInstead = tryInstead;
+        this.name = "PolicyError";
+    }
+}
+/** A position in one line's tokens. */
+class Cursor {
+    tokens;
+    end;
+    fail;
+    pos = 0;
+    constructor(tokens, 
+    /** Offset of the end of the code on this line, for errors about something missing. */
+    end, fail) {
+        this.tokens = tokens;
+        this.end = end;
+        this.fail = fail;
+    }
+    tok() {
+        return this.tokens[this.pos];
+    }
+    word(offset = 0) {
+        const t = this.tokens[this.pos + offset];
+        return t?.kind === "word" ? t.value : null;
+    }
+    at() {
+        return this.tokens[this.pos]?.at ?? this.end;
+    }
+    done() {
+        return this.pos >= this.tokens.length;
+    }
+}
+/**
+ * Parse a policy file's text. Throws PolicyError at the first line that
+ * cannot be read; `file` is used only in messages.
+ */
+export function parsePolicy(text, file) {
+    const rules = [];
+    const vendored = [];
+    const ignore = [];
+    let name = null;
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const n = i + 1;
+        const [code, hint] = splitComment(lines[i]);
+        const trimmed = code.trim();
+        if (trimmed === "")
+            continue;
+        const fail = (at, detail, tryInstead) => {
+            throw new PolicyError(file, n, at + 1, detail, code.trimEnd(), tryInstead);
+        };
+        const c = new Cursor(tokenize(code, fail), code.trimEnd().length, fail);
+        const first = c.tok();
+        if (c.word() === "policy") {
+            if (name !== null)
+                fail(first.at, "only one policy line is allowed");
+            const nameTok = c.tokens[1];
+            if (nameTok?.kind !== "string" || c.tokens.length !== 2) {
+                fail(nameTok?.at ?? c.end, "'policy' needs a quoted name", `policy "${nameTok?.raw ?? "name"}"`);
+            }
+            name = nameTok.value;
+            continue;
+        }
+        const pathList = c.word() === "vendored" ? vendored : c.word() === "ignore" ? ignore : null;
+        if (pathList !== null) {
+            const keyword = c.word();
+            const example = keyword === "vendored" ? 'vendored "vendor/**"' : 'ignore "public/*.min.js"';
+            c.pos = 1;
+            if (c.tok()?.kind !== "string")
+                fail(c.at(), `'${keyword}' needs one or more quoted paths`, example);
+            pathList.push(...quotedList(c, "path", example, checkPath(example)));
+            if (!c.done())
+                fail(c.at(), `unexpected '${c.tok().raw}' after the paths`);
+            continue;
+        }
+        rules.push(parseRule(c, trimmed, hint, n));
+    }
+    return { file, name: name ?? file, rules, vendored, ignore };
+}
+/** The verb forms a rule may start with, longest first so `forbid using` beats `forbid`. */
+const FORMS = [
+    { words: ["may", "use"], verb: "may", reach: false, text: "may use" },
+    { words: ["may", "reach"], verb: "may", reach: true, text: "may reach" },
+    { words: ["forbid", "reaching"], verb: "forbid", reach: true, text: "forbid reaching" },
+    { words: ["forbid", "using"], verb: "forbid", reach: false, text: "forbid" },
+    { words: ["forbid"], verb: "forbid", reach: false, text: "forbid" },
+];
+function parseRule(c, text, hint, line) {
+    const form = FORMS.find((f) => f.words.every((w, i) => c.word(i) === w));
+    if (!form) {
+        const rest = c.tokens
+            .slice(1)
+            .map((t) => t.raw)
+            .join(" ");
+        c.fail(c.tokens[0].at, `cannot read '${text}'`, resolveCapability(rest) ? `may use ${rest}` : "may use storage");
+    }
+    c.pos = form.words.length;
+    const { verb, text: verbText } = form;
+    const { capability, phrase, hosts } = form.reach ? parseHosts(c, verbText) : parseCapability(c, verb, verbText);
+    const paths = [];
+    let until = null;
+    while (!c.done()) {
+        const w = c.word();
+        if (w === "in") {
+            if (paths.length > 0) {
+                c.fail(c.at(), "'in' given twice; list every path after one 'in', separated by commas", `${verbText} ${phrase} in "a/*", "b/*"`);
+            }
+            c.pos++;
+            const example = `${verbText} ${phrase} in "src/*"`;
+            if (c.tok()?.kind !== "string")
+                c.fail(c.at(), "'in' needs one or more quoted paths", example);
+            paths.push(...quotedList(c, "path", example, checkPath(example)));
+        }
+        else if (w === "until") {
+            if (verb === "forbid") {
+                c.fail(c.at(), "'until' only applies to 'may' rules; a forbid does not expire", `forbid ${phrase}`);
+            }
+            if (until !== null)
+                c.fail(c.at(), "'until' given twice", `${verbText} ${phrase} until 2026-12-01`);
+            c.pos++;
+            const t = c.tok();
+            if (t?.kind !== "word" || !/^\d{4}-\d{2}-\d{2}$/.test(t.value)) {
+                c.fail(c.at(), "'until' needs a date like 2026-12-01", `${verbText} ${phrase} until 2026-12-01`);
+            }
+            if (!isRealDate(t.value))
+                c.fail(t.at, `${t.value} is not a real date`);
+            until = t.value;
+            c.pos++;
+        }
+        else {
+            c.fail(c.at(), `unexpected '${c.tok()?.raw}' after the rule`);
+        }
+    }
+    return { verb, capability, hosts, paths, until, hint, line, text };
+}
+/** `may reach "host", ...` and `forbid reaching "host", ...`. */
+function parseHosts(c, verbText) {
+    const example = `${verbText} "api.example.com"`;
+    const t0 = c.tok();
+    if (t0?.kind !== "string") {
+        const guess = t0?.kind === "word" ? t0.raw : "api.example.com";
+        c.fail(c.at(), `'${verbText}' needs one or more quoted hosts`, `${verbText} "${guess}"`);
+    }
+    const hosts = quotedList(c, "host", example, (host, at) => {
+        if (/[/:?#]/.test(host)) {
+            const m = /^(?:[a-z][a-z0-9+.-]*:)?\/\/(?:[^/@]*@)?([^/:?#]+)/i.exec(host);
+            c.fail(at, "name a host, not a URL", `${verbText} "${m?.[1] ?? "api.example.com"}"`);
+        }
+        return host.toLowerCase();
+    });
+    return { capability: "network", phrase: hosts.map((h) => `"${h}"`).join(", "), hosts };
+}
+/** `may use <capability>` and `forbid [using] <capability>`: words up to `in`, `until` or the end. */
+function parseCapability(c, verb, verbText) {
+    const phraseAt = c.at();
+    const words = [];
+    for (let w = c.word(); w !== null && w !== "in" && w !== "until"; w = c.word()) {
+        words.push(w);
+        c.pos++;
+    }
+    if (words.length === 0)
+        c.fail(phraseAt, "name a capability after the verb", `${verbText} storage`);
+    const phrase = words.join(" ");
+    if (verb === "forbid" && phrase === "everything else")
+        return { capability: "*", phrase, hosts: [] };
+    const capability = resolveCapability(phrase);
+    if (capability === null) {
+        const near = nearest(phrase);
+        c.fail(phraseAt, `unknown capability '${phrase}'` + (near ? `; did you mean '${near}'?` : ""), near ? `${verbText} ${near}` : `one of ${FAMILIES.join(", ")}, or a phrase such as "local storage" or "cookies"`);
+    }
+    return { capability, phrase, hosts: [] };
+}
+/** Validator for a path in `in` or `vendored`: relative, never absolute. */
+function checkPath(example) {
+    return (value, at, c) => {
+        if (value.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(value)) {
+            c.fail(at, "paths are relative to the policy file, not absolute", example);
+        }
+        return value;
+    };
+}
+/**
+ * A comma-separated list of quoted strings starting at the cursor. The
+ * caller has already checked that the first token is a string, so the
+ * "needs one or more" message stays the caller's.
+ */
+function quotedList(c, what, example, check) {
+    const out = [];
+    for (;;) {
+        const t = c.tok();
+        if (t?.kind !== "string")
+            c.fail(c.at(), `expected another quoted ${what} after the comma`, example);
+        const value = what === "host" ? t.value.trim() : t.value;
+        if (value === "")
+            c.fail(t.at, what === "host" ? "empty host" : "empty path; name a file or a glob", example);
+        out.push(value === SAME_ORIGIN ? value : check(value, t.at, c));
+        c.pos++;
+        if (c.tok()?.kind === "comma")
+            c.pos++;
+        else
+            break;
+    }
+    return out;
+}
+/** The closest known phrase or code, or null if nothing is within editing distance. */
+function nearest(phrase) {
+    let best = null;
+    let bestDist = Infinity;
+    const candidates = [...CAPABILITY_PHRASES.keys(), ...new Set(CAPABILITY_PHRASES.values())];
+    for (const candidate of candidates) {
+        if (candidate === "*")
+            continue;
+        const d = levenshtein(phrase, candidate);
+        if (d < bestDist) {
+            bestDist = d;
+            best = candidate;
+        }
+    }
+    // Allow roughly a third of the phrase to be wrong, never more than three edits.
+    const limit = Math.min(3, Math.max(1, Math.floor(phrase.length / 3)));
+    return bestDist <= limit ? best : null;
+}
+function levenshtein(a, b) {
+    const prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        let diag = prev[0];
+        prev[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const tmp = prev[j];
+            prev[j] = Math.min(prev[j] + 1, prev[j - 1] + 1, diag + (a[i - 1] === b[j - 1] ? 0 : 1));
+            diag = tmp;
+        }
+    }
+    return prev[b.length];
+}
+/** Year, month (0-based) and day of a validated YYYY-MM-DD string. */
+export function ymd(s) {
+    const [y, m, d] = s.split("-").map(Number);
+    return [y, m - 1, d];
+}
+function isRealDate(s) {
+    const [y, m, d] = ymd(s);
+    const dt = new Date(Date.UTC(y, m, d));
+    return dt.getUTCFullYear() === y && dt.getUTCMonth() === m && dt.getUTCDate() === d;
+}
+/** Split a line into code and trailing comment; a marker inside quotes is not a comment. */
+function splitComment(raw) {
+    let quoted = false;
+    for (let i = 0; i < raw.length; i++) {
+        const ch = raw[i];
+        if (ch === "\\" && quoted) {
+            i++;
+            continue;
+        }
+        if (ch === '"')
+            quoted = !quoted;
+        else if (!quoted && (raw.startsWith("--", i) || ch === "#")) {
+            const len = ch === "#" ? 1 : 2;
+            return [raw.slice(0, i), raw.slice(i + len).trim()];
+        }
+    }
+    return [raw, ""];
+}
+const ESCAPES = { n: "\n", t: "\t", '"': '"', "\\": "\\" };
+function tokenize(line, fail) {
+    const out = [];
+    let i = 0;
+    while (i < line.length) {
+        const ch = line[i];
+        if (/\s/.test(ch)) {
+            i++;
+        }
+        else if (ch === ",") {
+            out.push({ kind: "comma", raw: ",", at: i });
+            i++;
+        }
+        else if (ch === '"') {
+            let j = i + 1;
+            let value = "";
+            let closed = false;
+            while (j < line.length) {
+                const inner = line[j];
+                if (inner === "\\") {
+                    const e = line[j + 1];
+                    if (e !== undefined && ESCAPES[e] !== undefined) {
+                        value += ESCAPES[e];
+                        j += 2;
+                        continue;
+                    }
+                }
+                if (inner === '"') {
+                    closed = true;
+                    break;
+                }
+                value += inner;
+                j++;
+            }
+            if (!closed)
+                fail(i, "unterminated string", `${line.trim()}"`);
+            out.push({ kind: "string", value, raw: line.slice(i, j + 1), at: i });
+            i = j + 1;
+        }
+        else {
+            let j = i;
+            while (j < line.length && !/[\s,"]/.test(line[j]))
+                j++;
+            const raw = line.slice(i, j);
+            out.push({ kind: "word", value: raw.toLowerCase(), raw, at: i });
+            i = j;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=parse.js.map

package/dist/policy/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/policy/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAClF,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAgCnD;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAElB;IACA;IAEA;IACA;IACA;IACA;IAPlB,YACkB,IAAY,EACZ,IAAY;IAC5B,eAAe;IACC,MAAc,EACd,MAAc,EACd,MAAc,EACd,UAAmB;QAEnC,KAAK,CACH,GAAG,IAAI,SAAS,IAAI,KAAK,MAAM,OAAO,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG;YACvF,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/C,CAAC;QAXc,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QAEZ,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAS;QAMnC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AASD,uCAAuC;AACvC,MAAM,MAAM;IAGC;IAEA;IACA;IALX,GAAG,GAAG,CAAC,CAAC;IACR,YACW,MAAe;IACxB,sFAAsF;IAC7E,GAAW,EACX,IAAU;QAHV,WAAM,GAAN,MAAM,CAAS;QAEf,QAAG,GAAH,GAAG,CAAQ;QACX,SAAI,GAAJ,IAAI,CAAM;IAClB,CAAC;IACJ,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,GAAG,CAAC;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,EAAE;QACA,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;IAC/C,CAAC;IACD,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACxC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAS,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;YAC5C,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QAC7E,CAAC,CAAC;QACF,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAC;YACrE,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,8BAA8B,EAAE,WAAW,OAAO,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAG,CAAC;YAC1B,MAAM,OAAO,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAC7F,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YACV,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,KAAK,QAAQ;gBAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,OAAO,kCAAkC,EAAE,OAAO,CAAC,CAAC;YACrG,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC,GAAG,EAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC/D,CAAC;AAED,4FAA4F;AAC5F,MAAM,KAAK,GAAsF;IAC/F,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE;IACrE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE;IACxE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE;IACvF,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5E,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;CACpE,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM;aAClB,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;aACjB,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,EAAE,EAAE,gBAAgB,IAAI,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACpH,CAAC;IACD,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC1B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEtC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEhH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,CAAC,CAAC,IAAI,CACJ,CAAC,CAAC,EAAE,EAAE,EACN,uEAAuE,EACvE,GAAG,QAAQ,IAAI,MAAM,kBAAkB,CACxC,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,GAAG,EAAE,CAAC;YACR,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,MAAM,aAAa,CAAC;YACnD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,KAAK,QAAQ;gBAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,qCAAqC,EAAE,OAAO,CAAC,CAAC;YAC/F,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,+DAA+D,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;YACtG,CAAC;YACD,IAAI,KAAK,KAAK,IAAI;gBAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,GAAG,QAAQ,IAAI,MAAM,mBAAmB,CAAC,CAAC;YACpG,CAAC,CAAC,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/D,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE,GAAG,QAAQ,IAAI,MAAM,mBAAmB,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,KAAK,qBAAqB,CAAC,CAAC;YACxE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,GAAG,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,CAAC,GAAG,EAAE,EAAE,GAAG,kBAAkB,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC;AASD,iEAAiE;AACjE,SAAS,UAAU,CAAC,CAAS,EAAE,QAAgB;IAC7C,MAAM,OAAO,GAAG,GAAG,QAAQ,oBAAoB,CAAC;IAChD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACnB,IAAI,EAAE,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,EAAE,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAC/D,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,QAAQ,kCAAkC,EAAE,GAAG,QAAQ,KAAK,KAAK,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,GAAG,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;AACzF,CAAC;AAED,sGAAsG;AACtG,SAAS,eAAe,CAAC,CAAS,EAAE,IAAU,EAAE,QAAgB;IAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;IACxB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,GAAG,EAAE,CAAC;IACV,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,kCAAkC,EAAE,GAAG,QAAQ,UAAU,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAErG,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,IAAI,CACJ,QAAQ,EACR,uBAAuB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAC5E,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,qDAAqD,EAAE,OAAO,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CACjB,CAAS,EACT,IAAqB,EACrB,OAAe,EACf,KAAuD;IAEvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,SAAS,CAAC;QACR,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,KAAK,QAAQ;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,2BAA2B,IAAI,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,KAAK,KAAK,EAAE;YAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,mCAAmC,EAAE,OAAO,CAAC,CAAC;QAC9G,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,GAAG,EAAE,CAAC;QACR,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,IAAI,KAAK,OAAO;YAAE,CAAC,CAAC,GAAG,EAAE,CAAC;;YAClC,MAAM;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,MAAM,UAAU,GAAG,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,KAAK,GAAG;YAAE,SAAS;QAChC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjB,QAAQ,GAAG,CAAC,CAAC;YACb,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,GAAG,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,GAAG,CAAC,CAAS;IAC3B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAA6B,CAAC;IACvE,OAAO,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,4FAA4F;AAC5F,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;aAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAqC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAE7F,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAU;IACxC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClB,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7C,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;gBACvB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACtB,IAAI,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;wBAChD,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;wBACpB,CAAC,IAAI,CAAC,CAAC;wBACP,SAAS;oBACX,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;oBAClB,MAAM,GAAG,IAAI,CAAC;oBACd,MAAM;gBACR,CAAC;gBACD,KAAK,IAAI,KAAK,CAAC;gBACf,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,CAAC;YACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;gBAAE,CAAC,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/policy/vocabulary.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The words a policy author may use for a capability, mapped to the stable
+ * code the extractor emits. Phrases are matched after lowercasing and
+ * whitespace collapsing. A capability code is always accepted as-is.
+ */
+export declare const CAPABILITY_PHRASES: ReadonlyMap<string, string>;
+/** Every capability family code, for validating a bare code and for hints. */
+export declare const FAMILIES: readonly string[];
+/** Every member code the extractor can emit. Keep in step with src/extract/recognizers. */
+export declare const MEMBER_CODES: readonly string[];
+/** Every code a policy may name directly: the families and each member the extractor can emit. */
+export declare const KNOWN_CODES: ReadonlySet<string>;
+/** Resolve a phrase or code to a capability code, or null. */
+export declare function resolveCapability(words: string): string | null;
+//# sourceMappingURL=vocabulary.d.ts.map

package/dist/policy/vocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.d.ts","sourceRoot":"","sources":["../../src/policy/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CA+BzD,CAAC;AAEH,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EASrC,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAoCzC,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAA2C,CAAC;AAExF,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9D"}

package/dist/policy/vocabulary.js

@@ -0,0 +1,99 @@
+/**
+ * The words a policy author may use for a capability, mapped to the stable
+ * code the extractor emits. Phrases are matched after lowercasing and
+ * whitespace collapsing. A capability code is always accepted as-is.
+ */
+export const CAPABILITY_PHRASES = new Map([
+    ["everything", "*"],
+    // storage
+    ["storage", "storage"],
+    ["local storage", "storage.local"],
+    ["session storage", "storage.session"],
+    ["cookies", "storage.cookie"],
+    ["the cookie", "storage.cookie"],
+    ["indexeddb", "storage.indexeddb"],
+    ["the cache", "storage.cache"],
+    ["caches", "storage.cache"],
+    ["cache storage", "storage.cache"],
+    ["navigator storage", "storage.navigator"],
+    // network
+    ["the network", "network"],
+    ["network", "network"],
+    // codegen
+    ["code generation", "codegen"],
+    ["eval", "codegen"],
+    // dom-escape
+    ["html injection", "dom-escape"],
+    // identity
+    ["identity", "identity"],
+    ["fingerprinting", "identity"],
+    // navigation
+    ["navigation", "navigation"],
+    // globals
+    ["globals", "globals"],
+    // worker
+    ["workers", "worker"],
+    ["service workers", "worker"],
+]);
+/** Every capability family code, for validating a bare code and for hints. */
+export const FAMILIES = [
+    "storage",
+    "network",
+    "codegen",
+    "dom-escape",
+    "identity",
+    "navigation",
+    "globals",
+    "worker",
+];
+/** Every member code the extractor can emit. Keep in step with src/extract/recognizers. */
+export const MEMBER_CODES = [
+    "storage.local",
+    "storage.session",
+    "storage.indexeddb",
+    "storage.cache",
+    "storage.cookie",
+    "storage.navigator",
+    "network.fetch",
+    "network.xhr",
+    "network.websocket",
+    "network.eventsource",
+    "network.beacon",
+    "network.import",
+    "codegen.eval",
+    "codegen.function",
+    "codegen.timer",
+    "codegen.write",
+    "dom-escape.html",
+    "dom-escape.script",
+    "dom-escape.iframe",
+    "identity.device",
+    "identity.geolocation",
+    "identity.media",
+    "identity.clipboard",
+    "identity.credentials",
+    "identity.permissions",
+    "navigation.location",
+    "navigation.open",
+    "navigation.history",
+    "navigation.postmessage",
+    "globals.window",
+    "globals.prototype",
+    "worker.dedicated",
+    "worker.shared",
+    "worker.service",
+    "worker.worklet",
+];
+/** Every code a policy may name directly: the families and each member the extractor can emit. */
+export const KNOWN_CODES = new Set([...FAMILIES, ...MEMBER_CODES]);
+/** Resolve a phrase or code to a capability code, or null. */
+export function resolveCapability(words) {
+    const key = words.trim().toLowerCase().replace(/\s+/g, " ");
+    const phrase = CAPABILITY_PHRASES.get(key);
+    if (phrase !== undefined)
+        return phrase;
+    if (KNOWN_CODES.has(key))
+        return key;
+    return null;
+}
+//# sourceMappingURL=vocabulary.js.map

package/dist/policy/vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.js","sourceRoot":"","sources":["../../src/policy/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAgC,IAAI,GAAG,CAAC;IACrE,CAAC,YAAY,EAAE,GAAG,CAAC;IACnB,UAAU;IACV,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IACtC,CAAC,SAAS,EAAE,gBAAgB,CAAC;IAC7B,CAAC,YAAY,EAAE,gBAAgB,CAAC;IAChC,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAClC,CAAC,WAAW,EAAE,eAAe,CAAC;IAC9B,CAAC,QAAQ,EAAE,eAAe,CAAC;IAC3B,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC1C,UAAU;IACV,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,UAAU;IACV,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,aAAa;IACb,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAChC,WAAW;IACX,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,gBAAgB,EAAE,UAAU,CAAC;IAC9B,aAAa;IACb,CAAC,YAAY,EAAE,YAAY,CAAC;IAC5B,UAAU;IACV,CAAC,SAAS,EAAE,SAAS,CAAC;IACtB,SAAS;IACT,CAAC,SAAS,EAAE,QAAQ,CAAC;IACrB,CAAC,iBAAiB,EAAE,QAAQ,CAAC;CAC9B,CAAC,CAAC;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAsB;IACzC,SAAS;IACT,SAAS;IACT,SAAS;IACT,YAAY;IACZ,UAAU;IACV,YAAY;IACZ,SAAS;IACT,QAAQ;CACT,CAAC;AAEF,2FAA2F;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAsB;IAC7C,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,eAAe;IACf,aAAa;IACb,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;IAChB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,qBAAqB;IACrB,iBAAiB;IACjB,oBAAoB;IACpB,wBAAwB;IACxB,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,kGAAkG;AAClG,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC;AAExF,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,45 @@
+export interface RegistryUse {
+    capability: string;
+    target: string | null;
+}
+export interface RegistryEntry {
+    /** "sha384-<base64>", the same form as an SRI integrity value. */
+    integrity: string;
+    package: string;
+    version: string;
+    /** Path relative to the policy directory when the entry was added. */
+    file: string;
+    /** Distinct (capability, target) pairs with at least probable confidence. */
+    uses: RegistryUse[];
+    added: string;
+}
+export interface Registry {
+    version: 1;
+    /** Lockfile this registry was last synced against, if any. */
+    lockfile?: {
+        path: string;
+        integrity: string;
+    };
+    entries: RegistryEntry[];
+}
+/** The SRI-form SHA-384 of a file's contents. */
+export declare function integrityOfFile(file: string): string;
+/** Where the registry lives for a policy: .frostjs/registry.json beside it. */
+export declare function registryPath(policyDir: string): string;
+/** Read a registry. A missing file is an empty registry; malformed JSON or an unknown version throws. */
+export declare function readRegistry(file: string): Registry;
+/** Write the registry with entries sorted by package, version and file, creating .frostjs/ if needed. */
+export declare function writeRegistry(file: string, registry: Registry): void;
+/** Replace any entry with the same integrity, then add. */
+export declare function upsert(registry: Registry, entry: RegistryEntry): Registry;
+/** The entry for a hash, or null. */
+export declare function lookup(registry: Registry, integrity: string): RegistryEntry | null;
+/**
+ * Guess the package and version a vendored file belongs to: the nearest
+ * package.json between the file and `stopAt`, else the file's base name.
+ */
+export declare function guessPackage(file: string, stopAt: string): {
+    package: string;
+    version: string;
+};
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,CAAC,CAAC;IACX,8DAA8D;IAC9D,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAOD,iDAAiD;AACjD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAWnD;AAED,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAUpE;AAED,2DAA2D;AAC3D,wBAAgB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,GAAG,QAAQ,CAEzE;AAED,qCAAqC;AACrC,wBAAgB,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAElF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoB/F"}

package/dist/registry.js

@@ -0,0 +1,85 @@
+/**
+ * The fingerprint registry for vendored code (REQUIREMENTS section 8).
+ * Lives at .frostjs/registry.json beside the policy. Maps a SHA-384 of a
+ * file's bytes to the package it came from and the capability set it was
+ * found to use when somebody reviewed it with `frostjs vendor add`.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+const REGISTRY_RELATIVE = path.join(".frostjs", "registry.json");
+/** The SRI-form SHA-384 of some bytes. */
+function integrityOf(bytes) {
+    return "sha384-" + createHash("sha384").update(bytes).digest("base64");
+}
+/** The SRI-form SHA-384 of a file's contents. */
+export function integrityOfFile(file) {
+    return integrityOf(fs.readFileSync(file));
+}
+/** Where the registry lives for a policy: .frostjs/registry.json beside it. */
+export function registryPath(policyDir) {
+    return path.join(policyDir, REGISTRY_RELATIVE);
+}
+/** Read a registry. A missing file is an empty registry; malformed JSON or an unknown version throws. */
+export function readRegistry(file) {
+    if (!fs.existsSync(file))
+        return { version: 1, entries: [] };
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch (e) {
+        throw new Error(`registry ${file} is not valid JSON: ${e.message}`);
+    }
+    const r = raw;
+    if (r.version !== 1 || !Array.isArray(r.entries))
+        throw new Error(`registry ${file} has an unknown format`);
+    return { version: 1, ...(r.lockfile ? { lockfile: r.lockfile } : {}), entries: r.entries };
+}
+/** Write the registry with entries sorted by package, version and file, creating .frostjs/ if needed. */
+export function writeRegistry(file, registry) {
+    const sorted = [...registry.entries].sort((a, b) => a.package === b.package
+        ? a.version === b.version
+            ? a.file.localeCompare(b.file)
+            : a.version.localeCompare(b.version)
+        : a.package.localeCompare(b.package));
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ ...registry, entries: sorted }, null, 2) + "\n");
+}
+/** Replace any entry with the same integrity, then add. */
+export function upsert(registry, entry) {
+    return { ...registry, entries: [...registry.entries.filter((e) => e.integrity !== entry.integrity), entry] };
+}
+/** The entry for a hash, or null. */
+export function lookup(registry, integrity) {
+    return registry.entries.find((e) => e.integrity === integrity) ?? null;
+}
+/**
+ * Guess the package and version a vendored file belongs to: the nearest
+ * package.json between the file and `stopAt`, else the file's base name.
+ */
+export function guessPackage(file, stopAt) {
+    let dir = path.dirname(path.resolve(file));
+    const stop = path.resolve(stopAt);
+    for (;;) {
+        const pj = path.join(dir, "package.json");
+        if (fs.existsSync(pj)) {
+            try {
+                const p = JSON.parse(fs.readFileSync(pj, "utf8"));
+                if (typeof p.name === "string")
+                    return { package: p.name, version: typeof p.version === "string" ? p.version : "unknown" };
+            }
+            catch {
+                // fall through to the next directory
+            }
+        }
+        if (dir === stop)
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return { package: path.basename(file), version: "unknown" };
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;AA0BjE,0CAA0C;AAC1C,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;AACjD,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,CAAC,GAAG,GAAwB,CAAC;IACnC,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,wBAAwB,CAAC,CAAC;IAC5G,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;IAC5D,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjD,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACrB,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;YACvB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CACvC,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,MAAM,CAAC,QAAkB,EAAE,KAAoB;IAC7D,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,MAAM,CAAC,QAAkB,EAAE,SAAiB;IAC1D,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,SAAS,CAAC;QACR,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1C,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAwC,CAAC;gBACzF,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;YAC/F,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC9D,CAAC"}

package/dist/report/github.d.ts

@@ -0,0 +1,10 @@
+/**
+ * GitHub Actions workflow commands. Each denial becomes an inline
+ * annotation on the pull request; unknown uses become warnings. The text
+ * summary follows so the job log still reads on its own.
+ */
+import type { Decision } from "../policy/index.js";
+import { type Totals, type TextOptions } from "./text.js";
+/** `--format github`: one workflow command per denial or unknown use, then the text report. */
+export declare function github(decisions: readonly Decision[], totals: Totals, opts?: TextOptions): string;
+//# sourceMappingURL=github.d.ts.map