@kernlang/review 3.3.9 → 3.4.0

package/dist/project-context.js

@@ -0,0 +1,563 @@
+/**
+ * Project-Context — repo-level signals for the review pipeline.
+ *
+ * Reads project configs (tsconfig.json, package.json) and .gitignore so rules
+ * can gate on what the user already enforces elsewhere. Designed to be SAFE on
+ * adversarial inputs:
+ *
+ *  - **JSON-only.** No executable config readers (no eslint.config.js eval).
+ *    Phase 2 may add YAML/TOML but only via safeLoad; never `require()` of a
+ *    user-controlled file.
+ *  - **Realpath containment.** Any path resolved from a config (extends, etc.)
+ *    must live under the project root after `realpathSync` — otherwise it is
+ *    ignored. Defends against `extends: '../../../etc/passwd'` and symlink
+ *    traversal attacks surfaced by the Phase 1 red-team.
+ *  - **Content-hash cache.** Cache key is hashed file content + extends chain
+ *    (reuses the cache.ts pattern). mtime is unsound on second-resolution
+ *    filesystems and on TOCTOU windows where bytes change but mtime does not.
+ *  - **LRU eviction.** Max 128 cached project roots — defense against the
+ *    long-running Guard bot accumulating per-PR worktree paths until OOM.
+ *  - **Pattern-length cap on .gitignore.** Discards any individual pattern
+ *    longer than 256 chars. Defense against ReDoS via crafted negation +
+ *    quantifier patterns from the red-team.
+ */
+import { execFileSync } from 'child_process';
+import { createHash } from 'crypto';
+import { existsSync, readFileSync, realpathSync } from 'fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'path';
+import { withoutLocalGitEnv } from './git-env.js';
+/** Maximum pattern length for a single .gitignore entry (red-team P1 ReDoS guard). */
+const MAX_GITIGNORE_PATTERN_LENGTH = 256;
+/** LRU cap for cached project contexts (red-team P1 OOM guard for Guard bot). */
+const CONTEXT_CACHE_CAP = 128;
+/** Map iteration order is insertion order; deletes + re-inserts give LRU. */
+const contextCache = new Map();
+/**
+ * Walk up from a starting directory looking for the nearest `package.json`.
+ * Returns undefined if none is found before the filesystem root. Used by
+ * per-file review entry points that need a project context but only have a
+ * file path.
+ */
+export function findProjectRoot(startDir) {
+    let cur = resolve(startDir);
+    while (true) {
+        if (existsSync(resolve(cur, 'package.json')))
+            return cur;
+        const parent = dirname(cur);
+        if (parent === cur)
+            return undefined;
+        cur = parent;
+    }
+}
+/**
+ * Get the project context for a project root. Cached by content hash —
+ * a config file edit invalidates the entry on next call.
+ */
+export function getProjectContext(projectRoot) {
+    const root = safeRealpath(projectRoot);
+    if (!root) {
+        return emptyContext(projectRoot);
+    }
+    const probe = computeContentHash(root);
+    const cached = contextCache.get(root);
+    if (cached && cached.hash === probe) {
+        // LRU touch: delete + re-insert moves it to most-recently-used.
+        contextCache.delete(root);
+        contextCache.set(root, cached);
+        return cached.context;
+    }
+    const context = buildContext(root, probe);
+    contextCache.set(root, { hash: probe, context });
+    // LRU eviction.
+    while (contextCache.size > CONTEXT_CACHE_CAP) {
+        const oldestKey = contextCache.keys().next().value;
+        if (oldestKey === undefined)
+            break;
+        contextCache.delete(oldestKey);
+    }
+    return context;
+}
+/** Test-only: clear cache between tests. */
+export function _resetProjectContextCache() {
+    contextCache.clear();
+}
+/** Test-only: report current cache size. */
+export function _projectContextCacheSize() {
+    return contextCache.size;
+}
+/**
+ * Returns true iff the file is matched by the project's .gitignore. Use
+ * `isReviewable` for the full skip-list semantics — this is the gitignore
+ * predicate alone.
+ */
+export function isPathIgnored(filePath, ctx) {
+    const rel = toRelative(ctx.root, filePath);
+    if (rel === undefined)
+        return false;
+    let ignored = false;
+    for (const pattern of ctx.gitignore.rootPatterns) {
+        if (pattern.regex.test(rel)) {
+            ignored = !pattern.negate;
+        }
+    }
+    return ignored;
+}
+/**
+ * Per-flag tsconfig strictness — phase 2.3 from the red-team. The composite
+ * `strict: true` is shorthand for several flags; users frequently enable
+ * `strictNullChecks` alone without the umbrella. Rules should query the
+ * specific flag they depend on, not `strict`, so that `strict:false` does
+ * not over-debuff a finding whose underlying guarantee is in fact present.
+ */
+export function isStrictFlagEffective(flag, ctx) {
+    const ts = ctx.tsconfig;
+    if (!ts)
+        return false;
+    if (ts[flag] === true)
+        return true;
+    // The umbrella `strict: true` enables strictNullChecks, noImplicitAny, and
+    // a handful of others. Treat it as setting them when not explicitly false.
+    if (ts.strict === true && (flag === 'strictNullChecks' || flag === 'noImplicitAny') && ts[flag] !== false) {
+        return true;
+    }
+    return false;
+}
+/**
+ * The full skip-list predicate. A file is reviewable iff it is NOT
+ * (gitignored AND not git-tracked).
+ *
+ * This is the Phase 1 red-team's finding #4 fix: a tracked artifact that lives
+ * inside a gitignored directory (the classic `packages/sdk/dist/client.gen.ts`
+ * case) must remain reviewable. Suppression-by-skip-list is reserved for
+ * truly-untracked outputs.
+ */
+export function isReviewable(filePath, ctx) {
+    const rel = toRelative(ctx.root, filePath);
+    if (rel === undefined)
+        return true; // Outside project root — caller decides.
+    if (ctx.gitTrackedFiles.has(rel))
+        return true;
+    return !isPathIgnored(filePath, ctx);
+}
+// ── Implementation ─────────────────────────────────────────────────────────
+function buildContext(root, contentHash) {
+    const packageJson = readJson(root, 'package.json');
+    return {
+        root,
+        packageJson,
+        tsconfig: readTsconfig(root),
+        gitignore: readGitignore(root),
+        gitTrackedFiles: readGitTrackedFiles(root),
+        external: readExternalLinterConfig(root, packageJson),
+        contentHash,
+    };
+}
+function emptyContext(projectRoot) {
+    return {
+        root: resolve(projectRoot),
+        gitignore: { rootPatterns: [] },
+        gitTrackedFiles: new Set(),
+        external: { eslintEnabledRules: new Set(), biomeEnabledRules: new Set() },
+        contentHash: '',
+    };
+}
+/**
+ * Read project-level external linter configs. JSON-only and bounded:
+ *
+ *  - **No eslint.config.js eval.** Phase 1 red-team flagged require() of an
+ *    attacker-controlled config file as straight RCE. We read `.eslintrc.json`,
+ *    `.eslintrc` (assumed JSON), and `package.json` `eslintConfig` only. If the
+ *    project uses flat config (eslint.config.js), this reader returns empty;
+ *    overlap calibration just doesn't fire — fail-safe.
+ *  - **Relative-only extends.** Same containment rule as tsconfig: a string
+ *    starting with `.` is followed if it resolves under the project root.
+ *    Package refs (`eslint:recommended`, `@scope/eslint-config`) are NOT
+ *    resolved — we don't reach into node_modules.
+ *  - **Single tier of overrides ignored.** Only the top-level `rules` block is
+ *    consumed. Per-file `overrides` requires the async ESLint API; reading them
+ *    out of context here would be incorrect (different files would see the
+ *    same merged set), so we skip entirely.
+ */
+function readExternalLinterConfig(root, packageJson) {
+    const eslintEnabledRules = new Set();
+    const biomeEnabledRules = new Set();
+    // ── ESLint ──
+    // Priority: .eslintrc.json → .eslintrc → package.json#eslintConfig.
+    const eslintRoots = [];
+    for (const name of ['.eslintrc.json', '.eslintrc']) {
+        const data = readJson(root, name);
+        if (data) {
+            eslintRoots.push(data);
+            break;
+        }
+    }
+    if (packageJson?.eslintConfig)
+        eslintRoots.push(packageJson.eslintConfig);
+    for (const r of eslintRoots) {
+        collectEslintRules(root, r, eslintEnabledRules, new Set(), 0);
+    }
+    // ── Biome ──
+    const biome = readJson(root, 'biome.json');
+    if (biome)
+        collectBiomeRules(root, biome, biomeEnabledRules, new Set(), 0);
+    return { eslintEnabledRules, biomeEnabledRules };
+}
+function collectEslintRules(root, config, out, seen, depth) {
+    if (depth > 10)
+        return;
+    if (!config || typeof config !== 'object')
+        return;
+    const cfg = config;
+    // Walk relative `extends`. Package refs are skipped (see header doc).
+    const extendsList = Array.isArray(cfg.extends) ? cfg.extends : typeof cfg.extends === 'string' ? [cfg.extends] : [];
+    for (const ext of extendsList) {
+        if (typeof ext !== 'string' || !ext.startsWith('.'))
+            continue;
+        const candidate = resolve(root, ext);
+        const real = safeRealpath(candidate);
+        if (!real || !isWithin(root, real) || seen.has(real))
+            continue;
+        seen.add(real);
+        if (!existsSync(real))
+            continue;
+        let extData;
+        try {
+            extData = JSON.parse(readFileSync(real, 'utf-8').replace(/\/\*[\s\S]*?\*\/|\/\/.*$/gm, ''));
+        }
+        catch {
+            continue;
+        }
+        collectEslintRules(root, extData, out, seen, depth + 1);
+    }
+    // Pull rule levels from this config.
+    const rules = cfg.rules;
+    if (rules && typeof rules === 'object') {
+        for (const [ruleId, raw] of Object.entries(rules)) {
+            if (isEnabledLevel(raw))
+                out.add(ruleId);
+        }
+    }
+}
+function collectBiomeRules(root, config, out, seen, depth) {
+    if (depth > 10)
+        return;
+    if (!config || typeof config !== 'object')
+        return;
+    const cfg = config;
+    const extendsList = Array.isArray(cfg.extends) ? cfg.extends : typeof cfg.extends === 'string' ? [cfg.extends] : [];
+    for (const ext of extendsList) {
+        if (typeof ext !== 'string' || !ext.startsWith('.'))
+            continue;
+        const candidate = resolve(root, ext);
+        const real = safeRealpath(candidate);
+        if (!real || !isWithin(root, real) || seen.has(real))
+            continue;
+        seen.add(real);
+        if (!existsSync(real))
+            continue;
+        let extData;
+        try {
+            extData = JSON.parse(readFileSync(real, 'utf-8').replace(/\/\*[\s\S]*?\*\/|\/\/.*$/gm, ''));
+        }
+        catch {
+            continue;
+        }
+        collectBiomeRules(root, extData, out, seen, depth + 1);
+    }
+    // biome.json shape: linter.rules.<group>.<ruleName>: 'error' | 'warn' | 'off' | { level, options }
+    const linter = cfg.linter;
+    const groups = linter?.rules;
+    if (!groups || typeof groups !== 'object')
+        return;
+    for (const [groupName, group] of Object.entries(groups)) {
+        if (!group || typeof group !== 'object')
+            continue;
+        if (groupName === 'recommended' || groupName === 'all')
+            continue;
+        for (const [ruleName, raw] of Object.entries(group)) {
+            if (isEnabledLevel(raw))
+                out.add(ruleName);
+        }
+    }
+}
+function isEnabledLevel(raw) {
+    if (raw === 'error' || raw === 'warn' || raw === 1 || raw === 2)
+        return true;
+    if (Array.isArray(raw) && raw.length > 0)
+        return isEnabledLevel(raw[0]);
+    if (raw && typeof raw === 'object') {
+        const lvl = raw.level;
+        return isEnabledLevel(lvl);
+    }
+    return false;
+}
+/**
+ * Shells out to `git ls-files -c -z` to get the set of tracked paths. Returns
+ * an empty set if not a git repo or if git is unavailable. Bounded execution
+ * (10s timeout, 100 MB buffer) so a misbehaving git can't wedge the review.
+ */
+function readGitTrackedFiles(root) {
+    try {
+        const buf = execFileSync('git', ['ls-files', '-c', '-z'], {
+            cwd: root,
+            env: withoutLocalGitEnv(),
+            timeout: 10_000,
+            maxBuffer: 100 * 1024 * 1024,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const set = new Set();
+        for (const path of buf.split('\0')) {
+            if (path)
+                set.add(path);
+        }
+        return set;
+    }
+    catch {
+        return new Set();
+    }
+}
+function safeRealpath(p) {
+    try {
+        return realpathSync(resolve(p));
+    }
+    catch {
+        return undefined;
+    }
+}
+function isWithin(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+function toRelative(root, filePath) {
+    const abs = realpathOrResolve(filePath);
+    if (!isWithin(root, abs))
+        return undefined;
+    const rel = relative(root, abs);
+    // Normalize to POSIX separators for consistent gitignore matching.
+    return rel.split(sep).join('/');
+}
+/**
+ * Realpath the candidate (resolves symlinks). Falls back to plain `resolve` if
+ * the file does not yet exist or realpath fails. Required because the project
+ * root is realpath'd at cache time, so file paths must be compared in the same
+ * symlink-resolved form (e.g. macOS `/var → /private/var`).
+ */
+function realpathOrResolve(p) {
+    const abs = resolve(p);
+    try {
+        return realpathSync(abs);
+    }
+    catch {
+        // File doesn't exist yet — walk up to deepest existing ancestor and
+        // realpath that, then append the missing tail.
+        const parts = [];
+        let cur = abs;
+        while (true) {
+            const parent = dirname(cur);
+            if (parent === cur)
+                return abs;
+            try {
+                const real = realpathSync(parent);
+                return resolve(real, ...parts.reverse(), basenameOf(cur));
+            }
+            catch {
+                parts.push(basenameOf(cur));
+                cur = parent;
+            }
+        }
+    }
+}
+function basenameOf(p) {
+    const idx = p.lastIndexOf(sep);
+    return idx === -1 ? p : p.slice(idx + 1);
+}
+function computeContentHash(root) {
+    const hash = createHash('sha256');
+    for (const file of ['package.json', 'tsconfig.json', '.gitignore', '.eslintrc.json', '.eslintrc', 'biome.json']) {
+        const abs = resolve(root, file);
+        hash.update(file);
+        if (existsSync(abs)) {
+            try {
+                hash.update(readFileSync(abs, 'utf-8'));
+            }
+            catch {
+                // unreadable file — included as length-0 contribution
+            }
+        }
+    }
+    return hash.digest('hex');
+}
+function readJson(root, name) {
+    const abs = resolve(root, name);
+    if (!existsSync(abs))
+        return undefined;
+    if (!isWithin(root, abs))
+        return undefined;
+    try {
+        const raw = readFileSync(abs, 'utf-8');
+        // Strip JSONC comments — common in tsconfig.
+        const stripped = raw.replace(/\/\*[\s\S]*?\*\/|\/\/.*$/gm, '');
+        return JSON.parse(stripped);
+    }
+    catch {
+        return undefined;
+    }
+}
+function readTsconfig(root) {
+    const merged = readTsconfigChain(root, resolve(root, 'tsconfig.json'), new Set(), 0);
+    if (!merged)
+        return undefined;
+    const opts = merged.compilerOptions ?? {};
+    return {
+        strict: opts.strict,
+        strictNullChecks: opts.strictNullChecks,
+        noImplicitAny: opts.noImplicitAny,
+        noUnusedLocals: opts.noUnusedLocals,
+        noUnusedParameters: opts.noUnusedParameters,
+    };
+}
+function readTsconfigChain(root, abs, seen, depth) {
+    if (depth > 10)
+        return undefined;
+    if (!isWithin(root, abs))
+        return undefined;
+    const real = safeRealpath(abs);
+    if (!real || !isWithin(root, real))
+        return undefined;
+    if (seen.has(real))
+        return undefined;
+    seen.add(real);
+    if (!existsSync(real))
+        return undefined;
+    let raw;
+    try {
+        const text = readFileSync(real, 'utf-8').replace(/\/\*[\s\S]*?\*\/|\/\/.*$/gm, '');
+        raw = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    // Merge extends shallowly: extended config provides defaults; current overrides.
+    const extendsList = Array.isArray(raw?.extends)
+        ? raw?.extends
+        : typeof raw?.extends === 'string'
+            ? [raw.extends]
+            : [];
+    let merged = {};
+    for (const ext of extendsList ?? []) {
+        if (typeof ext !== 'string')
+            continue;
+        // Only relative extends are walked. Package refs (`@scope/tsconfig`) live in
+        // node_modules; resolving them is overkill for our purposes and would re-open
+        // the eval-arbitrary-code surface.
+        if (!ext.startsWith('.'))
+            continue;
+        const candidate = resolve(dirname(real), ext);
+        const withJson = candidate.endsWith('.json') ? candidate : `${candidate}.json`;
+        const sub = readTsconfigChain(root, withJson, seen, depth + 1);
+        if (sub) {
+            merged = {
+                ...merged,
+                ...sub,
+                compilerOptions: { ...merged.compilerOptions, ...sub.compilerOptions },
+            };
+        }
+    }
+    return {
+        ...merged,
+        ...raw,
+        compilerOptions: { ...merged.compilerOptions, ...raw?.compilerOptions },
+    };
+}
+function readGitignore(root) {
+    const abs = resolve(root, '.gitignore');
+    if (!existsSync(abs))
+        return { rootPatterns: [] };
+    if (!isWithin(root, abs))
+        return { rootPatterns: [] };
+    let text = '';
+    try {
+        text = readFileSync(abs, 'utf-8');
+    }
+    catch {
+        return { rootPatterns: [] };
+    }
+    const patterns = [];
+    for (const rawLine of text.split(/\r?\n/)) {
+        const trimmed = rawLine.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        if (trimmed.length > MAX_GITIGNORE_PATTERN_LENGTH)
+            continue; // ReDoS guard.
+        const negate = trimmed.startsWith('!');
+        const body = negate ? trimmed.slice(1) : trimmed;
+        const matchDirsOnly = body.endsWith('/');
+        const cleaned = matchDirsOnly ? body.slice(0, -1) : body;
+        const regex = compileGitignoreRegex(cleaned, matchDirsOnly);
+        if (!regex)
+            continue;
+        patterns.push({ raw: trimmed, regex, negate, matchDirsOnly });
+    }
+    return { rootPatterns: patterns };
+}
+function compileGitignoreRegex(pattern, matchDirsOnly) {
+    // Hand-rolled minimal gitignore-style glob → regex. Supports:
+    //   *      → [^/]*
+    //   **/    → (anything-or-nothing)
+    //   /xxx   → root-anchored
+    //   xxx    → match anywhere in path (with leading dir boundary)
+    //   xxx/   → directory match (handled via matchDirsOnly param + trailing match)
+    // Other extended globs (?, [], **) intentionally limited — keeps the regex
+    // shapes bounded and ReDoS-safe.
+    let body = pattern;
+    const anchored = body.startsWith('/');
+    if (anchored)
+        body = body.slice(1);
+    let regex = '';
+    for (let i = 0; i < body.length; i++) {
+        const ch = body[i];
+        if (ch === '*') {
+            if (body[i + 1] === '*' && body[i + 2] === '/') {
+                regex += '(?:.*/)?';
+                i += 2;
+            }
+            else if (body[i + 1] === '*') {
+                regex += '.*';
+                i += 1;
+            }
+            else {
+                regex += '[^/]*';
+            }
+        }
+        else if (ch === '?') {
+            regex += '[^/]';
+        }
+        else if (ch === '.' ||
+            ch === '+' ||
+            ch === '(' ||
+            ch === ')' ||
+            ch === '|' ||
+            ch === '^' ||
+            ch === '$' ||
+            ch === '{' ||
+            ch === '}' ||
+            ch === '[' ||
+            ch === ']' ||
+            ch === '\\') {
+            regex += `\\${ch}`;
+        }
+        else {
+            regex += ch;
+        }
+    }
+    const prefix = anchored ? '^' : '^(?:.*/)?';
+    const suffix = matchDirsOnly ? '(?:/.*)?$' : '(?:$|/.*$)';
+    try {
+        return new RegExp(prefix + regex + suffix);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=project-context.js.map

package/dist/project-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-context.js","sourceRoot":"","sources":["../src/project-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAgFlD,sFAAsF;AACtF,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEzC,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,6EAA6E;AAC7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAqD,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,YAAY,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACpC,gEAAgE;QAChE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAEjD,gBAAgB;IAChB,OAAO,YAAY,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM;QACnC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,yBAAyB;IACvC,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,wBAAwB;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAmB;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAqC,EAAE,GAAmB;IAC9F,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC;IACxB,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAmB;IAChE,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IAC7E,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAE9E,SAAS,YAAY,CAAC,IAAY,EAAE,WAAmB;IACrD,MAAM,WAAW,GAAG,QAAQ,CAAkD,IAAI,EAAE,cAAc,CAAC,CAAC;IACpG,OAAO;QACL,IAAI;QACJ,WAAW;QACX,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC;QAC9B,eAAe,EAAE,mBAAmB,CAAC,IAAI,CAAC;QAC1C,QAAQ,EAAE,wBAAwB,CAAC,IAAI,EAAE,WAAW,CAAC;QACrD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1B,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QAC/B,eAAe,EAAE,IAAI,GAAG,EAAE;QAC1B,QAAQ,EAAE,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,iBAAiB,EAAE,IAAI,GAAG,EAAE,EAAE;QACzE,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,wBAAwB,CAC/B,IAAY,EACZ,WAAmD;IAEnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE5C,eAAe;IACf,oEAAoE;IACpE,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,QAAQ,CAAU,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,WAAW,EAAE,YAAY;QAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,cAAc;IACd,MAAM,KAAK,GAAG,QAAQ,CAAU,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAE3E,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,MAAe,EAAE,GAAgB,EAAE,IAAiB,EAAE,KAAa;IAC3G,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO;IACvB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,qCAAqC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAe,EAAE,GAAgB,EAAE,IAAiB,EAAE,KAAa;IAC1G,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO;IACvB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,mGAAmG;IACnG,MAAM,MAAM,GAAG,GAAG,CAAC,MAAyD,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO;IAClD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,KAAK;YAAE,SAAS;QACjE,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC/E,IAAI,cAAc,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,GAAG,GAAI,GAA2B,CAAC,KAAK,CAAC;QAC/C,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACxD,GAAG,EAAE,IAAI;YACT,GAAG,EAAE,kBAAkB,EAAE;YACzB,OAAO,EAAE,MAAM;YACf,SAAS,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;YAC5B,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAgB;IAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,mEAAmE;IACnE,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,+CAA+C;QAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,GAAG,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBAClC,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5B,GAAG,GAAG,MAAM,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QAChH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,sDAAsD;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAI,IAAY,EAAE,IAAY;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvC,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAM,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAaD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAC1C,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAW,EAAE,IAAiB,EAAE,KAAa;IACpF,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACf,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;QACnF,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,iFAAiF;IACjF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,GAAG,EAAE,OAAO;QACd,CAAC,CAAC,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ;YAChC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACf,CAAC,CAAC,EAAE,CAAC;IACT,IAAI,MAAM,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,6EAA6E;QAC7E,8EAA8E;QAC9E,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,OAAO,CAAC;QAC/E,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG;gBACP,GAAG,MAAM;gBACT,GAAG,GAAG;gBACN,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE;aACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT,GAAG,GAAG;QACN,eAAe,EAAE,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,GAAG,GAAG,EAAE,eAAe,EAAE;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACtD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IACD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,IAAI,OAAO,CAAC,MAAM,GAAG,4BAA4B;YAAE,SAAS,CAAC,eAAe;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,aAAsB;IACpE,8DAA8D;IAC9D,mBAAmB;IACnB,mCAAmC;IACnC,2BAA2B;IAC3B,gEAAgE;IAChE,gFAAgF;IAChF,2EAA2E;IAC3E,iCAAiC;IACjC,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/C,KAAK,IAAI,UAAU,CAAC;gBACpB,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/B,KAAK,IAAI,IAAI,CAAC;gBACd,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,OAAO,CAAC;YACnB,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,MAAM,CAAC;QAClB,CAAC;aAAM,IACL,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,GAAG;YACV,EAAE,KAAK,IAAI,EACX,CAAC;YACD,KAAK,IAAI,KAAK,EAAE,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC;IAE1D,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,KAAK,GAAG,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/public-api.d.ts

@@ -42,6 +42,27 @@ interface PackageJsonLike {
     types?: string;
     bin?: string | Record<string, string>;
 }
+/**
+ * Convert a POSIX-style glob pattern to a `RegExp` that matches full paths.
+ *
+ * Supported syntax:
+ *   - `*`  — any run of non-separator chars
+ *   - `**` — any path fragment, including separators (zero or more segments)
+ *   - `?`  — a single non-separator char
+ *   - `[abc]` / `[a-z]` — character class
+ *   - `[!abc]` — negated character class (POSIX-style; translated to regex `[^abc]`)
+ *
+ * All other regex metacharacters are escaped. Brace expansion (`{a,b}`) is
+ * NOT supported — keep config patterns simple; split into multiple entries.
+ *
+ * The pattern is expected to be POSIX-separated (forward slashes). The caller
+ * normalizes Windows backslashes to `/` before calling this. Consecutive `*`
+ * runs are collapsed first to prevent catastrophic backtracking on patterns
+ * like `**\/**\/**`.
+ */
+export declare function globToRegex(pattern: string): RegExp;
+/** Normalize path separators so glob matching works on Windows. */
+export declare function toPosix(p: string): string;
 /**
  * Resolve a package.json specifier (e.g. `./dist/index.js`) to the source file
  * the review operates on (e.g. `./src/index.ts`). Returns undefined if nothing

package/dist/public-api.js

@@ -18,6 +18,7 @@
 import { existsSync, readFileSync } from 'fs';
 import { dirname, isAbsolute, join, resolve } from 'path';
 import { SyntaxKind } from 'ts-morph';
+import { getFrameworkSeed } from './framework-seeds.js';
 const SRC_EXTS = ['.ts', '.tsx'];
 /** Characters that, when present in a pattern, trigger glob expansion. */
 const GLOB_CHARS = /[*?[]/;
@@ -42,7 +43,7 @@ function hasGlobChars(pattern) {
  * runs are collapsed first to prevent catastrophic backtracking on patterns
  * like `**\/**\/**`.
  */
-function globToRegex(pattern) {
+export function globToRegex(pattern) {
     const squashed = pattern.replace(/\*{2,}/g, '**').replace(/(?:\*\*\/)+/g, '**/');
     let out = '';
     let i = 0;
@@ -94,7 +95,7 @@ function globToRegex(pattern) {
     return new RegExp(`^${out}$`);
 }
 /** Normalize path separators so glob matching works on Windows. */
-function toPosix(p) {
+export function toPosix(p) {
     return p.replace(/\\/g, '/');
 }
 function collectSpecifiers(value) {
@@ -268,6 +269,20 @@ export function buildPublicApiMap(filePaths, overrides) {
             explicitSymbols.add(`${abs}#${name}`);
         }
     }
+    // Per-symbol framework seeds — Next.js conventions, etc. Each match
+    // contributes (filePath, exportName) tuples to explicitSymbols, NEVER
+    // a whole-file flag in entryFiles. That's the fix for red-team CRITICAL
+    // #2: a stale helper sitting next to a Next.js page must not inherit
+    // public-API status from the page convention. Step 7a covers stable
+    // Next.js patterns; 7b adds metadata files / parallel routes / proxy.
+    for (const fp of filePaths) {
+        const seed = getFrameworkSeed(fp);
+        if (!seed)
+            continue;
+        for (const symbol of seed.symbols) {
+            explicitSymbols.add(`${fp}#${symbol}`);
+        }
+    }
     return { entryFiles, explicitSymbols };
 }
 export const EMPTY_PUBLIC_API = {