@maverickcer/env-cap 0.2.0

package/dist/.dts/build/source-position.d.ts

@@ -0,0 +1,69 @@
+import type ts from "typescript";
+/**
+ * A precise pointer into a source file -- the shared shape every exact-position fact in the
+ * build pipeline (declaration sites, usage sites, dynamic-access sites) uses, so a consumer never
+ * has to reconcile three ad hoc `{ file; line; column }` shapes that happen to mean the same
+ * thing. See ADR 0036.
+ */
+export interface SourcePosition {
+    /** Root-relative, POSIX-separated. */
+    readonly file: string;
+    /** 1-indexed line number. */
+    readonly line: number;
+    /** 1-indexed column number. */
+    readonly column: number;
+}
+/**
+ * `node`'s starting line/column within `sourceFile`, both 1-indexed -- TypeScript's own
+ * `getLineAndCharacterOfPosition()` returns 0-indexed values for both. Callers combine this with
+ * the file path they already have in scope to build a full {@link SourcePosition}; this returns
+ * only the two numbers so it's usable identically whether the caller's `file` is already
+ * root-relative or still absolute.
+ */
+export declare function positionOf(sourceFile: ts.SourceFile, node: ts.Node): {
+    line: number;
+    column: number;
+};
+/**
+ * Parses a developer-supplied `"<relative-path>:<line>:<column>"` citation
+ * (a {@link runtime.VariableDocs.dynamicAccess} entry) into a
+ * {@link SourcePosition}. Splits on the *last* two colons so a path
+ * containing colons of its own (rare, but not impossible) still parses --
+ * only the trailing `:<line>:<column>` is treated as position syntax.
+ * Returns `undefined` for anything that isn't exactly that shape (missing
+ * segments, a non-positive-integer line/column, an empty path) -- callers
+ * treat that as a malformed citation, never a thrown error. See ADR 0037.
+ */
+export declare function parsePositionCitation(citation: string): SourcePosition | undefined;
+/**
+ * One developer-declared {@link runtime.VariableDocs.dynamicAccess} citation's
+ * current acknowledgment state -- a claim, never an observation. Kept fully
+ * separate from `VariableAccessStatus` (which stays exactly 3-valued and
+ * purely AST-derived) so a developer's assertion can never make env-cap
+ * claim it observed something it didn't. See
+ * `evidence-snapshot.ts`'s `computeDynamicAccessAcknowledgments()` (where
+ * this is computed) and ADR 0037.
+ */
+export interface DynamicAccessAssertion extends SourcePosition {
+    /**
+     * `"fresh"` -- the cited file currently exists and either matches the
+     * committed baseline hash or has no baseline yet (a brand-new citation,
+     * nothing to contradict it yet). `"stale"` -- the cited file exists but its
+     * content has changed since the committed baseline. `"missing"` -- the
+     * cited file no longer exists at all. Re-derived from scratch every run;
+     * never cached across runs.
+     */
+    readonly acknowledgment: "fresh" | "stale" | "missing";
+    /**
+     * SHA-256 hex digest of the cited file's content *as observed this run* --
+     * `undefined` iff `acknowledgment === "missing"` (nothing to hash). This is
+     * the one field that makes freshness checking possible without a
+     * snapshot-only shadow type: the live `EvidenceModel.dependency` a caller
+     * gets back and the persisted evidence snapshot a later run reads back as
+     * its baseline are the exact same shape -- this run's `contentHash` becomes
+     * next run's comparison target directly. See `evidence-snapshot.ts` and
+     * ADR 0037.
+     */
+    readonly contentHash: string | undefined;
+}
+//# sourceMappingURL=source-position.d.ts.map

package/dist/.dts/build/source-position.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-position.d.ts","sourceRoot":"","sources":["../../../src/build/source-position.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,YAAY,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,IAAI,EAAE,EAAE,CAAC,IAAI,GACZ;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAQlF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAuB,SAAQ,cAAc;IAC5D;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAAA;IACtD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;CACzC"}

package/dist/.dts/build/tool-version.d.ts

@@ -0,0 +1,8 @@
+/**
+ * env-cap's own installed version -- stamped onto
+ * `EvidenceModel.provenance.toolVersion` and mixed into
+ * `computeSourceFingerprint()`. `./build` never reads its own manifest from
+ * disk (ADR 0040).
+ */
+export declare function readToolVersion(): string;
+//# sourceMappingURL=tool-version.d.ts.map

package/dist/.dts/build/tool-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-version.d.ts","sourceRoot":"","sources":["../../../src/build/tool-version.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC"}

package/dist/.dts/build/types.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The filesystem capability `env-cap/build` requires from its caller.
+ *
+ * `./build` is a **library surface**: it must not acquire filesystem access
+ * implicitly (no `node:fs` import anywhere under `src/` outside `src/cli/`).
+ * Every public options object in `build/index.ts` carries a required `fs`
+ * field of this type, and the caller supplies a concrete adapter -- the
+ * `env-cap` CLI builds one over `node:fs/promises` (`src/cli/filesystem.ts`);
+ * a test builds either that same real adapter or an in-memory fake. See ADR
+ * 0040.
+ *
+ * "Ambient-fs-free" means specifically: `./build` never reaches for
+ * `node:fs` itself. It still performs real filesystem operations -- the
+ * capability is always handed in.
+ *
+ * The shape is modeled on `node:fs/promises`'s own signatures so a thin
+ * adapter is a drop-in value, but uses minimal structural types
+ * ({@link BuildDirent}/{@link BuildStats}) rather than Node's `Dirent`/
+ * `Stats` -- the capability boundary shouldn't leak Node's type surface just
+ * because the concrete adapter happens to be Node-backed. Only the
+ * operations `src/build/**` actually calls are here.
+ */
+export interface BuildFileSystem {
+    /** Read a UTF-8 text file. Rejects if the path doesn't exist or isn't readable. */
+    readonly readFile: (path: string, encoding: "utf8") => Promise<string>;
+    /** Write a UTF-8 text file, creating or truncating it. The parent directory must already exist. */
+    readonly writeFile: (path: string, data: string, encoding: "utf8") => Promise<void>;
+    /** Create a directory and every missing parent. A no-op if it already exists. */
+    readonly mkdir: (path: string, options: {
+        readonly recursive: true;
+    }) => Promise<void>;
+    /** List a directory's entries with their file-type info. */
+    readonly readdir: (path: string, options: {
+        readonly withFileTypes: true;
+    }) => Promise<readonly BuildDirent[]>;
+    /** Stat a path (following symlinks). Rejects if the path doesn't exist. */
+    readonly stat: (path: string) => Promise<BuildStats>;
+    /** Resolve a path to its canonical, symlink-free absolute form. */
+    readonly realpath: (path: string) => Promise<string>;
+}
+/** One directory entry from {@link BuildFileSystem.readdir} -- the subset of Node's `Dirent` `src/build/**` reads. */
+export interface BuildDirent {
+    readonly name: string;
+    readonly isDirectory: () => boolean;
+    readonly isFile: () => boolean;
+}
+/** A path's stat info from {@link BuildFileSystem.stat} -- the subset of Node's `Stats` `src/build/**` reads. */
+export interface BuildStats {
+    readonly isFile: () => boolean;
+    /** Size in bytes -- read by the package-schema resolver to enforce a size ceiling. */
+    readonly size: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/.dts/build/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/build/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,eAAe;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACtE,mGAAmG;IACnG,QAAQ,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnF,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACtF,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;QAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAA;KAAE,KACtC,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;IACpD,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CACrD;AAED,sHAAsH;AACtH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAA;CAC/B;AAED,iHAAiH;AACjH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAA;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB"}

package/dist/.dts/build/usage-report.d.ts

@@ -0,0 +1,124 @@
+import type { ScannedSurface } from "./dependency-graph.js";
+import type { DynamicAccessCitationProblem } from "./citation-verification.js";
+import type { ParseWarning } from "./parse.js";
+import type { DynamicAccessAssertion, SourcePosition } from "./source-position.js";
+/** One contract's dependency-ownership summary: who owns it, and who depends on it. */
+export interface OwnershipDependencyEntry {
+    /** Resolved display name (see {@link DiscoveredContract.contractName}). */
+    readonly contractName: string;
+    /** Root-relative path of the file declaring the contract. */
+    readonly file: string;
+    /** Contract-level default owner, if set. */
+    readonly owner: string | undefined;
+    /** Number of variables declared in this contract's schema. */
+    readonly variableCount: number;
+    /** Files coupled to this contract (imported it, referenced it, or read a
+     *  member from it) -- contract-level "who depends on this," NOT proof any
+     *  specific variable was read. Blast radius if this contract changes is
+     *  `consumers.length`, computed by callers/renderers on demand rather than
+     *  stored redundantly here. */
+    readonly consumers: readonly string[];
+}
+/** A contract never imported anywhere in the scanned repository. */
+export interface AbandonedContractFinding {
+    /** Resolved display name (see {@link DiscoveredContract.contractName}). */
+    readonly contractName: string;
+    /** Root-relative path of the file declaring the contract. */
+    readonly file: string;
+    /** Contract-level default owner, if set. */
+    readonly owner: string | undefined;
+}
+/** A contract reachable only through an unresolved barrel re-export -- can't be proven abandoned or consumed. */
+export interface UnresolvedConsumerFinding {
+    /** Resolved display name (see {@link DiscoveredContract.contractName}). */
+    readonly contractName: string;
+    /** Root-relative path of the file declaring the contract. */
+    readonly file: string;
+    /** Human-readable explanation of why usage couldn't be resolved. */
+    readonly reason: string;
+}
+/** An owned variable with no consumer found in the scanned repository. */
+export interface UnconsumedOwnedVariableFinding {
+    /** Resolved display name (see {@link DiscoveredContract.contractName}). */
+    readonly contractName: string;
+    /** The owning contract's default owner, if set. */
+    readonly owner: string | undefined;
+    /** The unconsumed environment variable name. */
+    readonly key: string;
+    /**
+     * Every `dynamicAccess` citation for this variable that's currently
+     * `"stale"` or `"missing"` (empty when none exist -- see ADR 0037).
+     * Empty is the *strongest* "looks genuinely unused" signal: no developer
+     * has ever claimed otherwise. A non-empty list means someone specifically
+     * claimed dynamic access here once and that claim can no longer be
+     * verified -- worth a human check before deleting, not a stronger reason
+     * to trust "unconsumed." Exposed as the raw citations, not a collapsed
+     * `high`/`low` label, matching this codebase's "show the receipt" pattern
+     * (ADR 0036/0037) -- a reader can judge confidence from the actual
+     * evidence rather than trusting a derived summary. See ADR 0038.
+     */
+    readonly staleOrMissingCitations: readonly DynamicAccessCitationProblem[];
+}
+/** A variable accessed only via dynamic (computed) property access -- usage cannot be determined statically. */
+export interface IndeterminateOwnershipFinding {
+    /** Resolved display name (see {@link DiscoveredContract.contractName}). */
+    readonly contractName: string;
+    /** The environment variable name. */
+    readonly key: string;
+    /** Human-readable explanation of why usage couldn't be determined. */
+    readonly reason: string;
+    /** Every AST-observed dynamic-access site backing `reason`, structured -- see ADR 0036. */
+    readonly dynamicAccessSites: readonly SourcePosition[];
+    /** See {@link UnconsumedOwnedVariableFinding.staleOrMissingCitations}. */
+    readonly staleOrMissingCitations: readonly DynamicAccessCitationProblem[];
+}
+/** A variable that would otherwise be reported `unconsumedOwnedVariables`/`indeterminate`, but has at least one `"fresh"` developer-declared `dynamicAccess` citation -- the raw static status is always shown alongside the assertion, never replaced by it. See ADR 0037. */
+export interface AssertedDynamicAccessFinding {
+    /** Resolved display name (see {@link DiscoveredContract.contractName}). */
+    readonly contractName: string;
+    /** The environment variable name. */
+    readonly key: string;
+    /** What this variable's status would be without the fresh assertion. */
+    readonly wouldBeStatus: "unconsumed" | "indeterminate";
+    /** Every citation covering this variable, each with its own current freshness. */
+    readonly dynamicAccessAssertions: readonly DynamicAccessAssertion[];
+}
+/** Everything {@link renderUsageReport} needs to render the Dependency &
+ *  Ownership Report -- deliberately independent of (not derived from)
+ *  `GenerateUsageReportResult` in `generate-usage.js`, the same way
+ *  `RenderDocsOptions` in `docs.ts` doesn't derive from
+ *  `GenerateDocumentationResult`. `generate-usage.ts` composes its own
+ *  public result type from these building blocks instead, keeping this
+ *  renderer module importable without its orchestrator. */
+export interface RenderUsageReportOptions {
+    /** Every contract's ownership/dependency summary. */
+    readonly dependencyOwnership: readonly OwnershipDependencyEntry[];
+    /** Contracts never imported anywhere in the scanned repository. */
+    readonly abandonedContracts: readonly AbandonedContractFinding[];
+    /** Advisory only, never gates `onOwnershipIssue` -- a contract only
+     *  reaches here when an ambiguous barrel re-export makes "abandoned" or
+     *  "consumed" both unprovable. */
+    readonly unresolvedConsumers: readonly UnresolvedConsumerFinding[];
+    /** Owned variables with no consumer found in the scanned repository. */
+    readonly unconsumedOwnedVariables: readonly UnconsumedOwnedVariableFinding[];
+    /** Variables accessed only via dynamic (computed) property access. */
+    readonly indeterminate: readonly IndeterminateOwnershipFinding[];
+    /** Variables a developer has re-acknowledged via `dynamicAccess`, freshly -- see ADR 0037. */
+    readonly asserted: readonly AssertedDynamicAccessFinding[];
+    /** Schema-discovery parse warnings plus, since ADR 0014, any `packages`
+     *  resolution failures -- surfaced here too (not just from
+     *  `generateEnvManifest`/`generateDocumentation`) so a team relying only
+     *  on `--ownership` output still learns when a cross-package contract
+     *  failed to resolve. */
+    readonly parseWarnings: readonly ParseWarning[];
+    /** Every surface actually scanned for usage -- see ADR 0036. Named explicitly next to `unconsumedOwnedVariables` so "no consumer found" is never read as a stronger claim than what was actually searched. */
+    readonly scannedSurfaces: readonly ScannedSurface[];
+}
+/**
+ * Renders the Dependency & Ownership Report: who owns each variable, which
+ * features consume each contract, and what the blast radius is if it
+ * changes -- structured around exactly those three questions, never generic
+ * "dead code"/"unused symbol" language.
+ */
+export declare function renderUsageReport(computed: RenderUsageReportOptions): string;
+//# sourceMappingURL=usage-report.d.ts.map

package/dist/.dts/build/usage-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-report.d.ts","sourceRoot":"","sources":["../../../src/build/usage-report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AAE9E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,KAAK,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAElF,uFAAuF;AACvF,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B;;;;mCAI+B;IAC/B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,oEAAoE;AACpE,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,4CAA4C;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AACD,iHAAiH;AACjH,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AACD,0EAA0E;AAC1E,MAAM,WAAW,8BAA8B;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;IAClC,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,uBAAuB,EAAE,SAAS,4BAA4B,EAAE,CAAA;CAC1E;AACD,gHAAgH;AAChH,MAAM,WAAW,6BAA6B;IAC5C,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,kBAAkB,EAAE,SAAS,cAAc,EAAE,CAAA;IACtD,0EAA0E;IAC1E,QAAQ,CAAC,uBAAuB,EAAE,SAAS,4BAA4B,EAAE,CAAA;CAC1E;AACD,+QAA+Q;AAC/Q,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,qCAAqC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wEAAwE;IACxE,QAAQ,CAAC,aAAa,EAAE,YAAY,GAAG,eAAe,CAAA;IACtD,kFAAkF;IAClF,QAAQ,CAAC,uBAAuB,EAAE,SAAS,sBAAsB,EAAE,CAAA;CACpE;AAED;;;;;;2DAM2D;AAC3D,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,wBAAwB,EAAE,CAAA;IACjE,mEAAmE;IACnE,QAAQ,CAAC,kBAAkB,EAAE,SAAS,wBAAwB,EAAE,CAAA;IAChE;;sCAEkC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAClE,wEAAwE;IACxE,QAAQ,CAAC,wBAAwB,EAAE,SAAS,8BAA8B,EAAE,CAAA;IAC5E,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,SAAS,6BAA6B,EAAE,CAAA;IAChE,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,SAAS,4BAA4B,EAAE,CAAA;IAC1D;;;;6BAIyB;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAA;IAC/C,8MAA8M;IAC9M,QAAQ,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,CAAA;CACpD;AAsJD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,MAAM,CAkC5E"}

package/dist/.dts/cli/filesystem.d.ts

@@ -0,0 +1,3 @@
+import type { BuildFileSystem } from "../build/types.js";
+export declare const nodeBuildFileSystem: BuildFileSystem;
+//# sourceMappingURL=filesystem.d.ts.map

package/dist/.dts/cli/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../../src/cli/filesystem.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAe,eAAe,EAAc,MAAM,mBAAmB,CAAA;AAwDjF,eAAO,MAAM,mBAAmB,EAAE,eAOjC,CAAA"}

package/dist/.dts/eslint-plugin/glob.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Converts one glob pattern to a RegExp. Handles `**` as "any number of path
+ * segments, including zero" (so `**\/node_modules/**` matches a root-level
+ * `node_modules`, and `**\/env.schema.ts` matches a root-level file, not just
+ * nested ones) -- a plain `**` -> `.*` substitution gets both of those wrong.
+ *
+ * Used by no-raw-process-env.ts's `allow` option.
+ *
+ * Deliberately duplicated (not shared) with
+ * src/build/glob.ts, which needs the exact same matching behavior for its
+ * own schema-discovery walk -- keeps this eslint-plugin-only module free of
+ * any import reaching outside src/eslint-plugin, so `src/eslint-plugin`
+ * stays independently splittable into its own package with zero
+ * source-level cross-folder dependency. Not re-exported from `./index.js` --
+ * Private tier per VERSIONING.md.
+ */
+export declare function globToRegExp(pattern: string): RegExp;
+//# sourceMappingURL=glob.d.ts.map

package/dist/.dts/eslint-plugin/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../../src/eslint-plugin/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAyBpD"}

package/dist/.dts/eslint-plugin/index.d.ts

@@ -0,0 +1,27 @@
+import { noNodeFs } from "./no-node-fs.js";
+import { noRawProcessEnv } from "./no-raw-process-env.js";
+/**
+ * `env-cap/eslint-plugin` -- a flat-config-shaped plugin object
+ * ({ rules: { ... } }), consumed as:
+ *
+ *   import envCapPlugin from "env-cap/eslint-plugin";
+ *   export default [{ plugins: { "env-cap": envCapPlugin }, rules: { "env-cap/no-raw-process-env": "error" } }];
+ *
+ * A 4th public entry point alongside `.`, `./build`, `./helpers` -- see ADR 0017.
+ */
+declare const plugin: {
+    /** Every rule this plugin ships, keyed by its flat-config rule name. */
+    rules: {
+        /** See {@link noRawProcessEnv}. */
+        "no-raw-process-env": import("@typescript-eslint/utils/ts-eslint").RuleModule<"noRawProcessEnv", [import("./no-raw-process-env.js").RuleOptions], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+            name: string;
+        };
+        /** See {@link noNodeFs}. */
+        "no-node-fs": import("@typescript-eslint/utils/ts-eslint").RuleModule<"noNodeFs", [import("./no-node-fs.js").RuleOptions], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+            name: string;
+        };
+    };
+};
+export default plugin;
+export { noNodeFs, noRawProcessEnv };
+//# sourceMappingURL=index.d.ts.map

package/dist/.dts/eslint-plugin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/eslint-plugin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD;;;;;;;;GAQG;AACH,QAAA,MAAM,MAAM;IACV,wEAAwE;;QAEtE,mCAAmC;;;;QAEnC,4BAA4B;;;;;CAG/B,CAAA;AACD,eAAe,MAAM,CAAA;AACrB,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAA"}

package/dist/.dts/eslint-plugin/no-node-fs.d.ts

@@ -0,0 +1,25 @@
+export interface RuleOptions {
+    /** Glob-array of files this rule doesn't apply to -- a project's own
+     *  executable entry points (a CLI, a script) that legitimately construct
+     *  the concrete filesystem adapter. Empty by default -- populate it
+     *  explicitly; the rule never guesses at what counts as an executable
+     *  capability boundary. */
+    allow?: string[];
+}
+/**
+ * Flags any `import`/`require`/dynamic `import()` of `node:fs` in library
+ * code, so a library surface acquires its filesystem capability from the
+ * caller instead of reaching for `node:fs` itself (the same discipline
+ * `repo-contract`'s ADR-0011 established for `child_process`/`process.env`).
+ * See ADR 0040.
+ *
+ * @remarks
+ * Nothing is exempt by default. env-cap's own config allows `src/cli/**`
+ * (the executable capability boundary that builds the `node:fs/promises`
+ * adapter); a consuming project sets its own `allow` for its own entry
+ * points.
+ */
+export declare const noNodeFs: import("@typescript-eslint/utils/ts-eslint").RuleModule<"noNodeFs", [RuleOptions], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};
+//# sourceMappingURL=no-node-fs.d.ts.map

package/dist/.dts/eslint-plugin/no-node-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-node-fs.d.ts","sourceRoot":"","sources":["../../../src/eslint-plugin/no-node-fs.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,WAAW;IAC1B;;;;+BAI2B;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAmBD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,QAAQ;;CAsEnB,CAAA"}

package/dist/.dts/eslint-plugin/no-raw-process-env.d.ts

@@ -0,0 +1,23 @@
+export interface RuleOptions {
+    /** Glob-array of files this rule doesn't apply to, beyond the built-in
+     *  env.schema.ts allowance below -- for a consuming project's own
+     *  Node-only, build-time bootstrap code (see the README section this
+     *  rule ships with for the canonical worked example: a live-expiration
+     *  resolver authenticating to a secrets manager). Empty by default --
+     *  MUST be populated explicitly by the consuming project; env-cap never
+     *  guesses at what counts as "trusted bootstrap code." */
+    allow?: string[];
+}
+/**
+ * Flags any direct `process.env.X`/`process.env["X"]` read in application code, so environment
+ * access always goes through a capability's own `createEnv()` contract instead.
+ *
+ * @remarks
+ * `env.schema.ts`/`env.schema.tsx` files are always exempt (that's where `createEnv()` itself
+ * reads `process.env`); the rule's `allow` option extends that exemption to a consuming
+ * project's own trusted bootstrap code.
+ */
+export declare const noRawProcessEnv: import("@typescript-eslint/utils/ts-eslint").RuleModule<"noRawProcessEnv", [RuleOptions], unknown, import("@typescript-eslint/utils/ts-eslint").RuleListener> & {
+    name: string;
+};
+//# sourceMappingURL=no-raw-process-env.d.ts.map

package/dist/.dts/eslint-plugin/no-raw-process-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-raw-process-env.d.ts","sourceRoot":"","sources":["../../../src/eslint-plugin/no-raw-process-env.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,WAAW;IAC1B;;;;;;8DAM0D;IAC1D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAID;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;CA8D1B,CAAA"}

package/dist/.dts/evidence/define-projection.d.ts

@@ -0,0 +1,51 @@
+import type { EvidenceModel } from "../build/evidence-model.js";
+/**
+ * A pure function from the full Evidence Model to one field of a
+ * projection's output shape. Must not mutate `evidence` -- the membrane
+ * `defineEvidenceProjection()` wraps it in enforces that at runtime, see
+ * `createTrackingProxy()` below -- and must not perform I/O; env-cap can
+ * enforce the read-only half of purity but not the "no side effects" half.
+ */
+export type EvidenceProjector<T> = (evidence: EvidenceModel) => T;
+/** One independent, pure projector function per key of the projection's output shape `T`. */
+export type EvidenceProjectionSchema<T extends Record<string, unknown>> = {
+    readonly [K in keyof T]: EvidenceProjector<T[K]>;
+};
+/** `project()`'s return shape: the computed output, plus which `EvidenceModel` field paths fed each output key. */
+export interface EvidenceProjectionResult<T extends Record<string, unknown>> {
+    readonly value: T;
+    readonly sources: Readonly<Record<keyof T, readonly string[]>>;
+}
+/**
+ * The function `defineEvidenceProjection()` returns. Callable directly for
+ * the common case (`projection(evidence)` -> `T`); `.project()` returns the
+ * same value alongside automatic provenance -- see ADR 0032.
+ */
+export interface EvidenceProjection<T extends Record<string, unknown>> {
+    (evidence: EvidenceModel): T;
+    project(evidence: EvidenceModel): EvidenceProjectionResult<T>;
+}
+/**
+ * Declares a projection: a named, pure transform from the immutable
+ * `EvidenceModel` to any consumer-defined output shape, built entirely from
+ * `schema`'s independent per-field projector functions -- see ADR 0031/0032.
+ *
+ * env-cap's own reference projections (`.env.example`, Environment
+ * Configuration Reference, Configuration Ownership, etc.) are built through
+ * this exact function, with no privileged internal path -- a consumer's own
+ * projection is a first-class citizen, not a lesser one.
+ */
+export declare function defineEvidenceProjection<T extends Record<string, unknown>>(schema: EvidenceProjectionSchema<T>): EvidenceProjection<T>;
+/**
+ * The error every membrane write-trap below throws. A function, not a
+ * module-level `const` -- a `const` string's mutants are evaluated once at
+ * module load and can't be attributed to a covering test under Stryker's
+ * `perTest` coverage analysis (a documented false-Survivor, not a real
+ * gap); exported so a test can pin the exact message directly, the same way
+ * every membrane trap's own `.toThrow(...)` can't (a `TypeError` from a
+ * Proxy invariant violation is thrown either way a trap's body is mutated,
+ * so `.toThrow(TypeError)` alone doesn't distinguish "our message" from
+ * "the engine's own invariant-violation message").
+ */
+export declare function readOnlyMembraneError(): TypeError;
+//# sourceMappingURL=define-projection.d.ts.map

package/dist/.dts/evidence/define-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-projection.d.ts","sourceRoot":"","sources":["../../../src/evidence/define-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,KAAK,CAAC,CAAA;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI;IACxE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACjD,CAAA;AAED,mHAAmH;AACnH,MAAM,WAAW,wBAAwB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;IACjB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;CAC/D;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACnE,CAAC,QAAQ,EAAE,aAAa,GAAG,CAAC,CAAA;IAC5B,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAA;CAC9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxE,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC,GAClC,kBAAkB,CAAC,CAAC,CAAC,CAkBvB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,SAAS,CAIjD"}

package/dist/.dts/evidence/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * env-cap Evidence Model entry point (`env-cap/evidence`).
+ *
+ * `defineEvidenceProjection()` is the extensibility mechanism the seven
+ * canonical fact models (ADR 0024) exist to serve. A projection is a named,
+ * pure transform from the immutable `EvidenceModel` -- assembled at build
+ * time by `generateEvidenceModel()`, `env-cap/build` -- to any
+ * consumer-defined output shape, with automatic read-only enforcement and
+ * field-level provenance. See ADR 0031 (why a 5th entry point) and ADR 0032
+ * (the Proxy-based mechanism itself).
+ *
+ * This module is deliberately isomorphic: no `node:fs`, no `typescript`, no
+ * knowledge of how an `EvidenceModel` gets built -- it only imports that
+ * shape as a type (erased at compile time, mirroring `helpers`' one
+ * sanctioned cross-folder edge onto `runtime` -- see
+ * `specs/architecture.md`). A dashboard backend, an edge function, or a CI
+ * step can run a projection over a previously-generated,
+ * JSON-deserialized `EvidenceModel` with zero Node dependency.
+ */
+export type { EvidenceModel, EvidenceProvenance } from "../build/evidence-model.js";
+export { defineEvidenceProjection } from "./define-projection.js";
+export type { EvidenceProjection, EvidenceProjectionResult, EvidenceProjectionSchema, EvidenceProjector, } from "./define-projection.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/.dts/evidence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AACnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACjE,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,wBAAwB,CAAA"}

package/dist/.dts/helpers/index.d.ts

@@ -0,0 +1,135 @@
+/**
+ * Optional convenience helpers for common processor/validator patterns.
+ * Entirely separate from the core runtime -- `defineEnv`/`validateEnv` have
+ * no knowledge of this module and work identically without it.
+ *
+ * Usage: `processors.toNumber()`, `validators.range(1, 65535)`.
+ *
+ * Deliberately built from explicit named imports assembled into plain object
+ * literals, not `export * as processors from "./processors.js"`. A bundler
+ * (tsup/esbuild) lowers that `export * as` form into a namespace-construction
+ * helper call it can't prove side-effect-free, which defeats tree-shaking in
+ * a *second*, downstream bundling pass (a consumer's own bundler bundling
+ * this already-bundled package): importing only `processors` would still
+ * ship all of `validators`' code. A plain object literal of already-imported
+ * bindings has no such call in the way, so `import { processors } from
+ * "env-cap/helpers"` alone drops `validators` entirely.
+ */
+import { base64, parseJSON, split, toArray, toBigInt, toBoolean, toDate, toInteger, toLowerCase, toNumber, toRegExp, toString, toURL, toUpperCase, trim } from "./processors.js";
+import { after, all, any, before, custom, email, endsWith, finite, future, includes, integer as integerValidator, length, matches, max, maxItems, maxLength, min, minItems, minLength, negative, not, oneOf, optional, past, positive, range, refine, required, safeInteger, unique, url as urlValidator, uuid, uuidVersion } from "./validators.js";
+/**
+ * Convenience {@link runtime.Processor} implementations for common coercion
+ * patterns (e.g. `processors.toNumber()`).
+ *
+ * @remarks
+ * Naming matches `@maverickcer/data-cap`'s `helpers.processors` -- but these
+ * throw with a formatted `Error` message on invalid input, where data-cap's
+ * silently return `undefined`. Do not assume the same failure mode when
+ * moving between packages.
+ */
+export declare const processors: {
+    /** Decodes a base64 string into a `Buffer`. */
+    base64: typeof base64;
+    /** Parses a JSON string; passes non-string values through unchanged. */
+    parseJSON: typeof parseJSON;
+    /** Splits a string on `separator` into a trimmed string array; returns `[]` for non-string input. */
+    split: typeof split;
+    /** Splits a delimited string (or passes through an array) into items, running each through `processors` in order. */
+    toArray: typeof toArray;
+    /** Coerces a value to a `bigint`. */
+    toBigInt: typeof toBigInt;
+    /** Coerces common boolean-like strings (`true`/`1`/`yes`/`on`, and their opposites) into a real boolean. */
+    toBoolean: typeof toBoolean;
+    /** Parses a value into a `Date`. */
+    toDate: typeof toDate;
+    /** Coerces a value to a number and requires it to be an integer. */
+    toInteger: typeof toInteger;
+    /** Lowercases a string (coercing nullish values to `""` first). */
+    toLowerCase: typeof toLowerCase;
+    /** Coerces a value to a number, rejecting empty/whitespace-only strings instead of silently resolving to `0`. */
+    toNumber: typeof toNumber;
+    /** Compiles a value into a `RegExp`. */
+    toRegExp: typeof toRegExp;
+    /** Coerces a value to a string, treating nullish values as `""`. */
+    toString: typeof toString;
+    /** Parses a value into a `URL`, treating nullish values as `""` first. */
+    toURL: typeof toURL;
+    /** Uppercases a string (coercing nullish values to `""` first). */
+    toUpperCase: typeof toUpperCase;
+    /** Trims surrounding whitespace from a string (coercing nullish values to `""` first). */
+    trim: typeof trim;
+};
+/** Convenience {@link runtime.Validator} implementations for common validation patterns (e.g. `validators.range(1, 65535)`). */
+export declare const validators: {
+    /** Passes when the date value is strictly after `date`. */
+    after: typeof after;
+    /** Passes only when every wrapped validator passes; returns the first failing message. */
+    all: typeof all;
+    /** Passes when at least one wrapped validator passes. */
+    any: typeof any;
+    /** Passes when the date value is strictly before `date`. */
+    before: typeof before;
+    /** Identity wrapper for a hand-written `Validator<T>` -- no behavior change, just a fluent entry point alongside the other helpers. */
+    custom: typeof custom;
+    /** Passes for a plausibly-shaped email address (`local@domain`). */
+    email: typeof email;
+    /** Passes when the string ends with `suffix`. */
+    endsWith: typeof endsWith;
+    /** Alias for `oneOf` -- passes when the value is one of the `allowed` values. */
+    enum: typeof oneOf;
+    /** Passes when the number is finite (rejects `Infinity`/`-Infinity`/`NaN`). */
+    finite: typeof finite;
+    /** Passes when the date is strictly after the current time. */
+    future: typeof future;
+    /** Passes when the string contains `text` as a substring. */
+    includes: typeof includes;
+    /** Passes when the number is an integer. */
+    integer: typeof integerValidator;
+    /** Passes when the string's length is exactly `expected`. */
+    length: typeof length;
+    /** Passes when the string matches `pattern`; `message` overrides the default failure text. */
+    matches: typeof matches;
+    /** Passes when the number is less than or equal to `maximum`. */
+    max: typeof max;
+    /** Passes when the array has at most `maximum` items. */
+    maxItems: typeof maxItems;
+    /** Passes when the string's length is at most `length`. */
+    maxLength: typeof maxLength;
+    /** Passes when the number is greater than or equal to `minimum`. */
+    min: typeof min;
+    /** Passes when the array has at least `minimum` items. */
+    minItems: typeof minItems;
+    /** Passes when the string's length is at least `length`. */
+    minLength: typeof minLength;
+    /** Passes when the number is strictly negative. */
+    negative: typeof negative;
+    /** Inverts a validator: passes when the wrapped validator fails, and vice versa. */
+    not: typeof not;
+    /** Passes when the value is one of the `allowed` values. */
+    oneOf: typeof oneOf;
+    /** Passes when the value is undefined, otherwise delegates to the provided validator. */
+    optional: typeof optional;
+    /** Passes when the date is strictly before the current time. */
+    past: typeof past;
+    /** Passes when the number is strictly positive. */
+    positive: typeof positive;
+    /** Passes when the number is within `[minimum, maximum]` inclusive. */
+    range: typeof range;
+    /** Runs the wrapped validator but replaces its failure message with `message`. */
+    refine: typeof refine;
+    /** Alias for `matches` -- passes when the string matches `pattern`. */
+    regex: typeof matches;
+    /** Passes when the value is defined and, unless `allowEmptyString` is set, non-empty. */
+    required: typeof required;
+    /** Passes when the number is a safe integer (`Number.isSafeInteger`). */
+    safeInteger: typeof safeInteger;
+    /** Passes when every item in the array is unique. */
+    unique: typeof unique;
+    /** Passes when the string is a valid absolute URL. */
+    url: typeof urlValidator;
+    /** Passes when the string is a valid UUID of one of the given `versions` (default: any of 1-8). */
+    uuid: typeof uuid;
+    /** Shorthand for `uuid([version])` -- passes only for that exact UUID version. */
+    uuidVersion: typeof uuidVersion;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/.dts/helpers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,MAAM,EACN,SAAS,EACT,KAAK,EACL,OAAO,EACP,QAAQ,EACR,SAAS,EACT,MAAM,EACN,SAAS,EACT,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,WAAW,EACX,IAAI,EACL,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,KAAK,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,MAAM,EACN,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,QAAQ,EACR,OAAO,IAAI,gBAAgB,EAC3B,MAAM,EACN,OAAO,EACP,GAAG,EACH,QAAQ,EACR,SAAS,EACT,GAAG,EACH,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,GAAG,EACH,KAAK,EACL,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,KAAK,EACL,MAAM,EACN,QAAQ,EACR,WAAW,EACX,MAAM,EACN,GAAG,IAAI,YAAY,EACnB,IAAI,EACJ,WAAW,EACZ,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU;IACrB,+CAA+C;;IAE/C,wEAAwE;;IAExE,qGAAqG;;IAErG,qHAAqH;;IAErH,qCAAqC;;IAErC,4GAA4G;;IAE5G,oCAAoC;;IAEpC,oEAAoE;;IAEpE,mEAAmE;;IAEnE,iHAAiH;;IAEjH,wCAAwC;;IAExC,oEAAoE;;IAEpE,0EAA0E;;IAE1E,mEAAmE;;IAEnE,0FAA0F;;CAE3F,CAAA;AACD,gIAAgI;AAChI,eAAO,MAAM,UAAU;IACrB,2DAA2D;;IAE3D,0FAA0F;;IAE1F,yDAAyD;;IAEzD,4DAA4D;;IAE5D,uIAAuI;;IAEvI,oEAAoE;;IAEpE,iDAAiD;;IAEjD,iFAAiF;;IAEjF,+EAA+E;;IAE/E,+DAA+D;;IAE/D,6DAA6D;;IAE7D,4CAA4C;;IAE5C,6DAA6D;;IAE7D,8FAA8F;;IAE9F,iEAAiE;;IAEjE,yDAAyD;;IAEzD,2DAA2D;;IAE3D,oEAAoE;;IAEpE,0DAA0D;;IAE1D,4DAA4D;;IAE5D,mDAAmD;;IAEnD,oFAAoF;;IAEpF,4DAA4D;;IAE5D,yFAAyF;;IAEzF,gEAAgE;;IAEhE,mDAAmD;;IAEnD,uEAAuE;;IAEvE,kFAAkF;;IAElF,uEAAuE;;IAEvE,yFAAyF;;IAEzF,yEAAyE;;IAEzE,qDAAqD;;IAErD,sDAAsD;;IAEtD,mGAAmG;;IAEnG,kFAAkF;;CAEnF,CAAA"}