@mmnto/cli 1.107.0 → 1.108.0

package/dist/commands/verify-lockfile-sync.js

@@ -27,6 +27,408 @@ const AUX_LOOKUP_TIMEOUT_MS = 10_000;
 //                   which generally don't require a lockfile diff anyway) and
 //                   rejects `workspace:^` references (no leading digit).
 const DEP_BUMP_RE = /^\+\s*"(?!version")[^"]+"\s*:\s*"[\^~]?\d+\.\d+/m;
+// Match a QUOTED pnpm-lockfile key line (sign already stripped when the line
+// comes from a diff). Anchors, left to right:
+//   `^\s+`   — required indent. Every key that names a package is nested (an
+//              importer's dependency block, `packages:`, `snapshots:`), so the
+//              document-level keys (`lockfileVersion:`, `importers:`) never match.
+//   `'([^']+)'`
+//            — the quoted key. pnpm quotes any key containing `@` or another
+//              YAML-special char, which is every scoped name and every
+//              `name@version` packages/snapshots key.
+//   `:`      — the key terminator. A quoted key is accepted with or without a
+//              scalar value: pnpm only quotes package names, so there is no
+//              metadata-key collision to exclude here.
+const LOCKFILE_QUOTED_KEY_RE = /^\s+'([^']+)':/;
+// Match a BARE pnpm-lockfile key line (sign already stripped). Same indent
+// anchor as above, plus:
+//   `([^'\s:]+)`
+//            — the unquoted key (`ajv@8.18.0`, `commander`, `packages/cli`).
+//   `:(?:\s*\{\})?\s*$`
+//            — the key must carry NO scalar value (`foo@1.0.0:`) or the empty
+//              mapping (`foo@1.0.0: {}`). That is what pnpm emits for package
+//              keys, and it structurally excludes the scalar metadata keys
+//              (`resolution:`, `specifier:`, `version:`, `engines:`, `optional:`)
+//              without maintaining a blocklist. A package that disappears from
+//              the lockfile always loses its valueless `packages:`/`snapshots:`
+//              key line, so the restriction costs no detection.
+const LOCKFILE_BARE_KEY_RE = /^\s+([^'\s:]+):(?:\s*\{\})?\s*$/;
+// Parse ONE lockfile line into its indent and key. Anchors, left to right:
+//   `^( *)`  — the indent, CAPTURED: YAML nesting is the only structure signal
+//              the lockfile gives, and the section walker needs the depth, not
+//              just the key.
+//   `(?:'([^']+)'|([^'\s:]+))`
+//            — the key, quoted (pnpm quotes scoped names and any key holding a
+//              YAML-special char) or bare (`ajv@8.18.0`, `packages/cli`, `.`).
+//   `:(?:\s.*)?$`
+//            — the key terminator plus an optional value. A value is NOT
+//              disqualifying here, unlike the candidate-side regexes: the walker
+//              decides membership by section and depth, so it needs no
+//              value-shape proxy for structure.
+const LOCKFILE_KEY_LINE_RE = /^( *)(?:'([^']+)'|([^'\s:]+)):(?:\s.*)?$/;
+// pnpm-lockfile GRAMMAR keys that are valueless like a package key but never
+// name a package. Candidate parsing works line-by-line off a DIFF, which carries
+// no section context, so the guard is still needed there (the HEAD-side harvest
+// is section-aware and needs no blocklist). Without it, removing a repo's last
+// devDependency would make `devDependencies` a candidate — absent from the HEAD
+// lockfile, and "declared" because package.json still carries a
+// `"devDependencies": {}` key — a false block on a legitimate push. The cost is
+// that a dependency named EXACTLY one of these strings is invisible to the gate;
+// a false block on a real push is the worse failure (mmnto-ai/totem#2473 class).
+const LOCKFILE_STRUCTURAL_KEYS = new Set([
+    'catalogs',
+    'dependencies',
+    'devDependencies',
+    'importers',
+    'optionalDependencies',
+    'overrides',
+    'packages',
+    'patchedDependencies',
+    'peerDependencies',
+    'peerDependenciesMeta',
+    'settings',
+    'snapshots',
+    'transitivePeerDependencies',
+]);
+// The manifest blocks whose keys are install-resolvable dependency
+// declarations — the only blocks that answer "is this pin still declared?".
+// `overrides` / `resolutions` are excluded by design (see
+// collectImporterDeclarations). Doubles as the importer-side dependency-block
+// set for the lockfile walker: the lockfile mirrors these manifest blocks.
+const MANIFEST_DEPENDENCY_BLOCKS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+    'peerDependencies',
+];
+// `git show` blob-ref prefix for the HEAD revision. Named once so every
+// HEAD-blob read in this file builds the same ref shape.
+const HEAD_REF_PREFIX = 'HEAD:';
+// The workspace definition, read at HEAD. Its `packages:` globs are what admit a
+// manifest this branch ADDS — such a package is not yet an importer of the
+// lockfile at HEAD, so the importer set alone cannot see it.
+const WORKSPACE_FILE_PATH = 'pnpm-workspace.yaml';
+// A `packages:` list entry in pnpm-workspace.yaml: `  - 'packages/*'`. Anchors:
+//   `^\s*-\s*` — the YAML sequence dash at any indent.
+//   `(?:'([^']*)'|"([^"]*)"|(\S+))` — the glob, single-quoted, double-quoted, or
+//                bare (all three occur in the wild).
+//   `\s*$`     — nothing else on the line; a trailing comment or an inline map
+//                is not a plain glob entry and is skipped rather than guessed at.
+const WORKSPACE_PACKAGES_ENTRY_RE = /^\s*-\s*(?:'([^']*)'|"([^"]*)"|(\S+))\s*$/;
+// Any top-level (indent-0) key line — used only to detect that the `packages:`
+// block has ended.
+const WORKSPACE_TOP_LEVEL_KEY_RE = /^\S.*:/;
+// Opening prose of the removed-pin failure message
+// (mmnto-ai/totem-strategy#630). REASON TEXT ONLY — the failure CLASS travels in
+// `VerifyLockfileSyncResult.failureClass`, so editing this sentence can no
+// longer change which remedy a user is handed.
+const REMOVED_PIN_REASON_PREFIX = `${LOCKFILE_PATH} no longer contains any entry for a package whose pin is still declared in a tracked package.json at HEAD`;
+// ─── Removed-pin predicate (mmnto-ai/totem-strategy#630) ─
+/**
+ * The package NAME a lockfile key denotes. Strips a peer parenthetical
+ * (`pkg@1.0.0(react@19.0.0)`) and the trailing `@<version>` suffix: npm forbids
+ * `@` inside a package name except the leading scope marker, so the last `@`
+ * past index 0 always opens the version.
+ */
+function packageNameFromKey(key) {
+    // Leading-slash canonicalization. lockfileVersion 9 — what pnpm emits today —
+    // uses NO leading slash, so this is not a v9 defect; but v5/v6-vintage
+    // lockfiles wrote `/ajv@8.18.0:` and `/@scope/name@1.0.0:`, and this gate
+    // ships to consumer repos through the distributed pre-push hook. Without the
+    // strip, an old-vintage repo's `packages:`/`snapshots:` keys all parse as
+    // `/name`, match nothing in any manifest, and the gate silently degrades to
+    // importer-only coverage.
+    const withoutLeadingSlash = key.startsWith('/') ? key.slice(1) : key;
+    const withoutPeers = withoutLeadingSlash.split('(')[0];
+    const versionAt = withoutPeers.lastIndexOf('@');
+    return versionAt > 0 ? withoutPeers.slice(0, versionAt) : withoutPeers;
+}
+/**
+ * The package NAME a REMOVED diff line denotes, or `null` when the line is not a
+ * key line. Diff-side only: a hunk carries no section context, so this leans on
+ * key shape plus the structural-key blocklist.
+ */
+function lockfileKeyName(line) {
+    const match = LOCKFILE_QUOTED_KEY_RE.exec(line) ?? LOCKFILE_BARE_KEY_RE.exec(line);
+    if (match === null)
+        return null;
+    if (LOCKFILE_STRUCTURAL_KEYS.has(match[1]))
+        return null;
+    return packageNameFromKey(match[1]);
+}
+/**
+ * Index the lockfile at HEAD by SECTION and DEPTH, not by key-line shape.
+ *
+ * A shape-only harvest laundered the very class this gate exists to catch:
+ * `peerDependenciesMeta:` children (`      zod:` / `optional: true`) are
+ * valueless key lines that SURVIVE a package's total removal, so a fully dropped
+ * package still answered "resolves at HEAD" and the gate passed — 21 such blocks
+ * in this repo's own lockfile. Only two things prove resolution: a
+ * `packages:`/`snapshots:` entry, and a workspace importer's dependency-block
+ * key (a workspace link has no `packages:` entry). Peer metadata, catalogs and
+ * settings are commentary ABOUT resolution, not resolution.
+ *
+ * The same pass collects the importer paths — the lockfile's own answer to
+ * "which manifests do I resolve?" — which scopes the declaration probe below.
+ *
+ * Child indents are learned from the file rather than hardcoded: the first line
+ * deeper than a section header defines that level's indent.
+ */
+function indexHeadLockfile(content) {
+    const resolved = new Set();
+    const importers = [];
+    let section = null;
+    let sectionChildIndent = null;
+    let dependencyBlockIndent = null;
+    let declarationIndent = null;
+    let inDependencyBlock = false;
+    for (const line of content.split('\n')) {
+        const match = LOCKFILE_KEY_LINE_RE.exec(line);
+        if (match === null)
+            continue;
+        const indent = match[1].length;
+        const key = match[2] ?? match[3];
+        if (indent === 0) {
+            section = key;
+            sectionChildIndent = null;
+            dependencyBlockIndent = null;
+            declarationIndent = null;
+            inDependencyBlock = false;
+            continue;
+        }
+        if (section === null)
+            continue;
+        if (section === 'packages' || section === 'snapshots') {
+            sectionChildIndent ??= indent;
+            if (indent === sectionChildIndent)
+                resolved.add(packageNameFromKey(key));
+            continue;
+        }
+        if (section !== 'importers')
+            continue;
+        sectionChildIndent ??= indent;
+        if (indent === sectionChildIndent) {
+            importers.push(key);
+            dependencyBlockIndent = null;
+            declarationIndent = null;
+            inDependencyBlock = false;
+            continue;
+        }
+        dependencyBlockIndent ??= indent;
+        if (indent === dependencyBlockIndent) {
+            inDependencyBlock = MANIFEST_DEPENDENCY_BLOCKS.includes(key);
+            declarationIndent = null;
+            continue;
+        }
+        if (!inDependencyBlock)
+            continue;
+        declarationIndent ??= indent;
+        if (indent === declarationIndent)
+            resolved.add(packageNameFromKey(key));
+    }
+    return { resolved, importers };
+}
+/** The manifest an importer path owns (`.` is the repo root). */
+function importerManifestPath(importer) {
+    return importer === '.' ? 'package.json' : `${importer}/package.json`;
+}
+/**
+ * Compile one pnpm workspace glob into a whole-string directory matcher.
+ *
+ * Deliberately minimal, and narrower than a full globbing library: every regex
+ * metacharacter is escaped first, then exactly two wildcards are re-expanded —
+ * `**` to `.*` (crosses path separators) and `*` to `[^/]*` (one segment). No
+ * brace expansion, no character classes, no `?`. A glob using those forms simply
+ * fails to match, which costs coverage on an exotic workspace layout; it never
+ * mints a false block, and it keeps a push gate free of a glob dependency.
+ */
+function workspaceGlobToRegExp(glob) {
+    const escaped = glob.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const pattern = escaped.replace(/\\\*\\\*|\\\*/g, (match) => match === '\\*\\*' ? '.*' : '[^/]*');
+    return new RegExp(`^${pattern}$`);
+}
+/**
+ * The `packages:` globs declared in pnpm-workspace.yaml, split into includes and
+ * `!`-negated excludes. A hand parse of one list, not a YAML implementation:
+ * anything that is not a plain sequence entry inside the `packages:` block is
+ * ignored.
+ */
+function parseWorkspaceGlobs(content) {
+    const include = [];
+    const exclude = [];
+    let inPackagesBlock = false;
+    for (const line of content.split('\n')) {
+        if (/^packages:\s*$/.test(line)) {
+            inPackagesBlock = true;
+            continue;
+        }
+        if (!inPackagesBlock)
+            continue;
+        // A new top-level key closes the block; blank lines and comments do not.
+        if (WORKSPACE_TOP_LEVEL_KEY_RE.test(line))
+            break;
+        const match = WORKSPACE_PACKAGES_ENTRY_RE.exec(line);
+        if (match === null)
+            continue;
+        const raw = match[1] ?? match[2] ?? match[3] ?? '';
+        if (raw.length === 0)
+            continue;
+        if (raw.startsWith('!')) {
+            exclude.push(workspaceGlobToRegExp(raw.slice(1)));
+        }
+        else {
+            include.push(workspaceGlobToRegExp(raw));
+        }
+    }
+    return { include, exclude };
+}
+/**
+ * The workspace globs at HEAD, or `null` with a declared skip when they cannot
+ * be read or carry no usable `packages:` entry. `null` degrades admission to the
+ * importer set alone — the pre-existing, narrower behavior.
+ */
+function readWorkspaceGlobs(safeExec, log, repoRoot) {
+    let globs;
+    try {
+        globs = parseWorkspaceGlobs(safeExec('git', ['show', `${HEAD_REF_PREFIX}${WORKSPACE_FILE_PATH}`], {
+            cwd: repoRoot,
+            timeout: AUX_LOOKUP_TIMEOUT_MS,
+        }));
+        // totem-context: declared-skip probe — a repo with no workspace file (or an unreadable one) simply has no glob admission, so the gate falls back to the importer set rather than guessing at workspace membership (mmnto/totem#1440 Tenet 4 init-class)
+    }
+    catch {
+        log.info(TAG, `Could not read ${WORKSPACE_FILE_PATH} at HEAD — admitting workspace importers only; a package.json this branch ADDS will not be checked for a lockfile companion.`);
+        return null;
+    }
+    if (globs.include.length === 0) {
+        log.info(TAG, `No usable \`packages:\` globs in ${WORKSPACE_FILE_PATH} at HEAD — admitting workspace importers only.`);
+        return null;
+    }
+    return globs;
+}
+/**
+ * The lockfile at HEAD, indexed — or `null` with a declared skip when it cannot
+ * be read. Both the resolves-at-HEAD test and the importer scope derive from it,
+ * so a failed read means neither question can be answered honestly.
+ */
+function readHeadLockfileIndex(safeExec, log, repoRoot) {
+    try {
+        return indexHeadLockfile(safeExec('git', ['show', `${HEAD_REF_PREFIX}${LOCKFILE_PATH}`], {
+            cwd: repoRoot,
+            timeout: AUX_LOOKUP_TIMEOUT_MS,
+        }));
+        // totem-context: declared-skip probe — without the HEAD lockfile the gate cannot tell a dedupe from a full removal, nor a workspace manifest from a stray one, so it announces the skip and passes (mmnto/totem#1440 Tenet 4 init-class)
+    }
+    catch {
+        log.info(TAG, `Could not read ${LOCKFILE_PATH} at HEAD — skipping the workspace-scoped checks.`);
+        return null;
+    }
+}
+/**
+ * Every package name declared in an install-resolvable dependency block of a
+ * WORKSPACE IMPORTER manifest at HEAD.
+ *
+ * Scoped to importers deliberately. A tracked manifest that is NOT an importer —
+ * a separately-deployed service, a test fixture — declares pins this lockfile
+ * never resolves, so counting it converts a legitimate transitive-dependency
+ * drop into a hard block with an unusable remedy. Reproduced against the built
+ * CLI: a `@modelcontextprotocol/sdk` bump dropped transitive `hono`, which
+ * `services/compile-worker/package.json` declares, and the gate blocked the
+ * push. The importer set is the lockfile's own definition of the manifests it
+ * resolves, so it is the only sound scope for the question.
+ *
+ * `overrides` / `resolutions` are not counted: a name appearing only there
+ * constrains how some OTHER package's dependency resolves and is not itself a
+ * declaration that must resolve.
+ */
+function collectImporterDeclarations(safeExec, log, repoRoot, importers) {
+    const declared = new Set();
+    const unreadable = [];
+    for (const importer of importers) {
+        const file = importerManifestPath(importer);
+        let manifest;
+        try {
+            manifest = JSON.parse(safeExec('git', ['show', `${HEAD_REF_PREFIX}${file}`], {
+                cwd: repoRoot,
+                timeout: AUX_LOOKUP_TIMEOUT_MS,
+            }));
+            // totem-context: per-manifest skip, DECLARED once below — an unreadable or unparseable importer manifest at HEAD cannot answer the membership question; the paths are collected and reported in a single log line rather than silently dropped or spammed per file (mmnto/totem#1440 Tenet 4 init-class)
+        }
+        catch {
+            unreadable.push(file);
+            continue;
+        }
+        if (typeof manifest !== 'object' || manifest === null) {
+            unreadable.push(file);
+            continue;
+        }
+        for (const block of MANIFEST_DEPENDENCY_BLOCKS) {
+            const deps = manifest[block];
+            if (typeof deps !== 'object' || deps === null)
+                continue;
+            for (const name of Object.keys(deps))
+                declared.add(name);
+        }
+    }
+    if (unreadable.length > 0) {
+        log.info(TAG, `Could not read ${unreadable.length} importer manifest(s) at HEAD (${unreadable.join(', ')}) — their declarations are not counted.`);
+    }
+    return declared;
+}
+/**
+ * Packages the diff range removes from the lockfile entirely while their pin
+ * stays declared by a workspace importer — the mmnto-ai/totem-strategy#630
+ * live-fire class, where a failed optional-dependency fetch drops every
+ * importer/packages/snapshots entry for a working dep and `pnpm install` still
+ * exits 0.
+ *
+ * Candidates are every name on a REMOVED key line, with no added-side
+ * subtraction: that subtraction was an optimization the corrected
+ * resolves-at-HEAD test already subsumes, and it was itself a laundering vector
+ * (an ADDED `peerDependenciesMeta` child naming the dropped package excluded it
+ * from the candidate set entirely). Over-generation stays safe because the
+ * decisive predicate is sound: a candidate fails only when it resolves NOWHERE
+ * at HEAD AND a workspace importer still declares it. Every git read is
+ * best-effort with a DECLARED skip — this feature has no silent skips.
+ *
+ * Candidate volume is deliberately UNBOUNDED. An earlier cap was costed against
+ * a per-candidate `git grep`; the decisive predicate is now an O(1) lookup
+ * against one lockfile index plus at most one manifest read per importer, so a
+ * cap would only buy false negatives — a real drop riding in behind an ordinary
+ * large update is exactly the shape this gate exists to catch.
+ */
+function findRemovedPins(safeExec, log, repoRoot, resolvedRef) {
+    let lockfileDiff;
+    try {
+        lockfileDiff = safeExec('git', ['diff', `${resolvedRef}...HEAD`, '--', LOCKFILE_PATH], {
+            cwd: repoRoot,
+            timeout: AUX_LOOKUP_TIMEOUT_MS,
+        });
+        // totem-context: declared-skip probe — failure means the removed-pin check cannot evaluate, so it announces the skip and passes rather than blocking (mmnto/totem#1440 Tenet 4 init-class)
+    }
+    catch {
+        log.info(TAG, `Could not read the ${LOCKFILE_PATH} diff — skipping the removed-pin check.`);
+        return [];
+    }
+    const candidates = new Set();
+    for (const line of lockfileDiff.split('\n')) {
+        if (line[0] !== '-')
+            continue;
+        const name = lockfileKeyName(line.slice(1));
+        if (name !== null)
+            candidates.add(name);
+    }
+    if (candidates.size === 0)
+        return [];
+    const index = readHeadLockfileIndex(safeExec, log, repoRoot);
+    if (index === null)
+        return [];
+    const unresolved = [...candidates].filter((name) => !index.resolved.has(name));
+    if (unresolved.length === 0)
+        return [];
+    const declared = collectImporterDeclarations(safeExec, log, repoRoot, index.importers);
+    return unresolved.filter((name) => declared.has(name));
+}
 // ─── Main command ───────────────────────────────────────
 /**
  * Programmatic surface — returns the verification result without exiting or
@@ -111,6 +513,18 @@ export async function verifyLockfileSyncCommand() {
     // alongside it. Most cohort-sync PRs and all Version Packages PRs land
     // here.
     if (files.includes(LOCKFILE_PATH)) {
+        // A present lockfile is not a synced lockfile: the diff can also REMOVE a
+        // package outright while package.json keeps its pin
+        // (mmnto-ai/totem-strategy#630). Checked before the pass so the fast-pass
+        // cannot launder that shape.
+        const removedPins = findRemovedPins(safeExec, log, repoRoot, resolvedRef);
+        if (removedPins.length > 0) {
+            return {
+                valid: false,
+                failureClass: 'removed-pin',
+                reason: `${REMOVED_PIN_REASON_PREFIX}: ${removedPins.join(', ')}. The diff range removes every lockfile entry for the package(s), so the declared dependency cannot resolve.`,
+            };
+        }
         const label = successColor(bold('PASS'));
         log.success(TAG, `${label} — ${LOCKFILE_PATH} present in diff range.`);
         return { valid: true };
@@ -120,12 +534,45 @@ export async function verifyLockfileSyncCommand() {
     if (pkgJsonPaths.length === 0) {
         return { valid: true };
     }
+    // Narrow to WORKSPACE IMPORTER manifests. A tracked manifest this lockfile
+    // does not resolve — a test fixture, a separately-deployed service — needs no
+    // lockfile companion when it gains a pin, so counting it hard-fails a correct
+    // push (reproduced against the built CLI). The importer set is the lockfile's
+    // own answer, so it is derived from the lockfile at HEAD here too.
+    const headIndex = readHeadLockfileIndex(safeExec, log, repoRoot);
+    if (headIndex === null) {
+        return { valid: true };
+    }
+    const importerManifests = new Set(headIndex.importers.map(importerManifestPath));
+    // A manifest this branch ADDS is not an importer at HEAD, so the importer set
+    // alone would let a new package ship pins with no lockfile companion. The
+    // workspace globs at HEAD close that hole; the root manifest is always in
+    // scope. (The removed-pin branch needs none of this: the lockfile is in the
+    // diff there, so its own importer list already includes any new package.)
+    const workspaceGlobs = readWorkspaceGlobs(safeExec, log, repoRoot);
+    const isWorkspaceManifest = (file) => {
+        if (file === 'package.json')
+            return true;
+        if (importerManifests.has(file))
+            return true;
+        if (workspaceGlobs === null)
+            return false;
+        const dir = file.slice(0, -'/package.json'.length);
+        if (!workspaceGlobs.include.some((re) => re.test(dir)))
+            return false;
+        return !workspaceGlobs.exclude.some((re) => re.test(dir));
+    };
+    const workspacePkgJsonPaths = pkgJsonPaths.filter(isWorkspaceManifest);
+    if (workspacePkgJsonPaths.length === 0) {
+        log.info(TAG, `Changed package.json file(s) are not workspace importers of ${LOCKFILE_PATH} — no lockfile companion is required.`);
+        return { valid: true };
+    }
     // Pull the unified diff for the package.json files and scan for
     // dependency-pin additions. `safeExec`'s arg-array form handles quoting,
     // so multiple paths pass safely with no shell metacharacter risk.
     let unifiedDiff = '';
     try {
-        unifiedDiff = safeExec('git', ['diff', `${resolvedRef}...HEAD`, '--', ...pkgJsonPaths], {
+        unifiedDiff = safeExec('git', ['diff', `${resolvedRef}...HEAD`, '--', ...workspacePkgJsonPaths], {
             cwd: repoRoot,
             timeout: AUX_LOOKUP_TIMEOUT_MS,
         });
@@ -137,6 +584,7 @@ export async function verifyLockfileSyncCommand() {
     if (DEP_BUMP_RE.test(unifiedDiff)) {
         return {
             valid: false,
+            failureClass: 'missing-lockfile',
             reason: `Tracked lockfile detected, but ${LOCKFILE_PATH} is missing from the diff range while a package.json adds a dependency pin.`,
         };
     }
@@ -153,7 +601,14 @@ export async function verifyLockfileSyncCliCommand() {
     const { TotemError } = await import('@mmnto/totem');
     const result = await verifyLockfileSyncCommand();
     if (!result.valid) {
-        throw new TotemError('CHECK_FAILED', result.reason, `Run \`pnpm install\` from the repo root to regenerate ${LOCKFILE_PATH}, then stage and commit it before re-pushing. CI runs with \`--frozen-lockfile\` and rejects pushes where a tracked package.json declares dependency pins that the lockfile does not reflect.`);
+        // Two failure classes, two remedies. The removed-pin class is NOT fixed by a
+        // plain `pnpm install` — that is precisely the command that produced it.
+        // Selected from the structured discriminant, never from the reason prose: a
+        // wording edit must not be able to downgrade a user's remedy.
+        const recoveryHint = result.failureClass === 'removed-pin'
+            ? `A failed optional-dependency fetch (an expired or missing registry token) silently removes every ${LOCKFILE_PATH} entry for a package while its pin stays declared in package.json — exit 0, no warning (mmnto-ai/totem-strategy#630 class). Verify registry auth with \`npm whoami\`, regenerate with \`pnpm update <pkg>\` (NOT \`pnpm install --lockfile-only\`, which false-reports "Already up to date" on an optional-dependency drop), then commit the regenerated ${LOCKFILE_PATH}.`
+            : `Run \`pnpm install\` from the repo root to regenerate ${LOCKFILE_PATH}, then stage and commit it before re-pushing. CI runs with \`--frozen-lockfile\` and rejects pushes where a tracked package.json declares dependency pins that the lockfile does not reflect.`;
+        throw new TotemError('CHECK_FAILED', result.reason, recoveryHint);
     }
 }
 //# sourceMappingURL=verify-lockfile-sync.js.map

package/dist/commands/verify-lockfile-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-lockfile-sync.js","sourceRoot":"","sources":["../../src/commands/verify-lockfile-sync.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,MAAM,GAAG,GAAG,oBAAoB,CAAC;AAEjC,+EAA+E;AAC/E,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,qCAAqC;AACrC,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,qDAAqD;AACrD,qBAAqB;AACrB,oEAAoE;AACpE,qBAAqB;AACrB,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,WAAW,GAAG,kDAAkD,CAAC;AAUvE,2DAA2D;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,8DAA8D,CAAC,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,kEAAkE;IAClE,uEAAuE;IACvE,aAAa;IACb,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,eAAe,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;YACnE,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QACH,kLAAkL;IACpL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,6BAA6B,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxC,yLAAyL;IAC3L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,qBAAqB;IACrB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,UAAU,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE;gBACvE,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,qBAAqB;aAC/B,CAAC,CAAC;YACH,WAAW,GAAG,GAAG,CAAC;YAClB,MAAM;YACN,0JAA0J;QAC5J,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvD,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,QAAQ;IACR,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,aAAa,yBAAyB,CAAC,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,gEAAgE;IAChE,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,EAAE;YACtF,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QACH,4LAA4L;IAC9L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,kCAAkC,aAAa,6EAA6E;SACrI,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,gEAAgE,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,yBAAyB,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAClB,cAAc,EACd,MAAM,CAAC,MAAO,EACd,yDAAyD,aAAa,+LAA+L,CACtQ,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify-lockfile-sync.js","sourceRoot":"","sources":["../../src/commands/verify-lockfile-sync.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,MAAM,GAAG,GAAG,oBAAoB,CAAC;AAEjC,+EAA+E;AAC/E,4EAA4E;AAC5E,8CAA8C;AAC9C,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAEvC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,qCAAqC;AACrC,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,qDAAqD;AACrD,qBAAqB;AACrB,oEAAoE;AACpE,qBAAqB;AACrB,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,WAAW,GAAG,kDAAkD,CAAC;AAEvE,6EAA6E;AAC7E,8CAA8C;AAC9C,6EAA6E;AAC7E,+EAA+E;AAC/E,mFAAmF;AACnF,gBAAgB;AAChB,6EAA6E;AAC7E,uEAAuE;AACvE,sDAAsD;AACtD,8EAA8E;AAC9E,4EAA4E;AAC5E,uDAAuD;AACvD,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEhD,2EAA2E;AAC3E,yBAAyB;AACzB,iBAAiB;AACjB,6EAA6E;AAC7E,wBAAwB;AACxB,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,kFAAkF;AAClF,+EAA+E;AAC/E,gFAAgF;AAChF,gEAAgE;AAChE,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAE/D,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,6BAA6B;AAC7B,+BAA+B;AAC/B,+EAA+E;AAC/E,+EAA+E;AAC/E,kBAAkB;AAClB,yEAAyE;AACzE,iFAAiF;AACjF,uEAAuE;AACvE,gDAAgD;AAChD,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAExE,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,gEAAgE;AAChE,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,UAAU;IACV,cAAc;IACd,iBAAiB;IACjB,WAAW;IACX,sBAAsB;IACtB,WAAW;IACX,UAAU;IACV,qBAAqB;IACrB,kBAAkB;IAClB,sBAAsB;IACtB,UAAU;IACV,WAAW;IACX,4BAA4B;CAC7B,CAAC,CAAC;AAEH,mEAAmE;AACnE,4EAA4E;AAC5E,0DAA0D;AAC1D,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG;IACjC,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;CACV,CAAC;AAEX,wEAAwE;AACxE,yDAAyD;AACzD,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,iFAAiF;AACjF,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,gFAAgF;AAChF,uDAAuD;AACvD,iFAAiF;AACjF,qDAAqD;AACrD,+EAA+E;AAC/E,kFAAkF;AAClF,MAAM,2BAA2B,GAAG,2CAA2C,CAAC;AAEhF,+EAA+E;AAC/E,mBAAmB;AACnB,MAAM,0BAA0B,GAAG,QAAQ,CAAC;AAE5C,mDAAmD;AACnD,iFAAiF;AACjF,2EAA2E;AAC3E,+CAA+C;AAC/C,MAAM,yBAAyB,GAAG,GAAG,aAAa,2GAA2G,CAAC;AAuC9J,4DAA4D;AAE5D;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,8EAA8E;IAC9E,uEAAuE;IACvE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,mBAAmB,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxD,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,qBAAqB,GAAkB,IAAI,CAAC;IAChD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC;QAElC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,GAAG,GAAG,CAAC;YACd,kBAAkB,GAAG,IAAI,CAAC;YAC1B,qBAAqB,GAAG,IAAI,CAAC;YAC7B,iBAAiB,GAAG,IAAI,CAAC;YACzB,iBAAiB,GAAG,KAAK,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,IAAI,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YACtD,kBAAkB,KAAK,MAAM,CAAC;YAC9B,IAAI,MAAM,KAAK,kBAAkB;gBAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,WAAW;YAAE,SAAS;QAEtC,kBAAkB,KAAK,MAAM,CAAC;QAC9B,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,qBAAqB,GAAG,IAAI,CAAC;YAC7B,iBAAiB,GAAG,IAAI,CAAC;YACzB,iBAAiB,GAAG,KAAK,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,qBAAqB,KAAK,MAAM,CAAC;QACjC,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACrC,iBAAiB,GAAI,0BAAgD,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpF,iBAAiB,GAAG,IAAI,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,iBAAiB;YAAE,SAAS;QACjC,iBAAiB,KAAK,MAAM,CAAC;QAC7B,IAAI,MAAM,KAAK,iBAAiB;YAAE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,iEAAiE;AACjE,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,QAAQ,eAAe,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1D,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CACpC,CAAC;IACF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,eAAe,GAAG,IAAI,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,SAAS;QAC/B,yEAAyE;QACzE,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QAEjD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC/B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,QAAoB,EACpB,GAAe,EACf,QAAgB;IAEhB,IAAI,KAA+C,CAAC;IACpD,IAAI,CAAC;QACH,KAAK,GAAG,mBAAmB,CACzB,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,GAAG,mBAAmB,EAAE,CAAC,EAAE;YACpE,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CACH,CAAC;QACF,wPAAwP;IAC1P,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CACN,GAAG,EACH,kBAAkB,mBAAmB,8HAA8H,CACpK,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CACN,GAAG,EACH,oCAAoC,mBAAmB,gDAAgD,CACxG,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,QAAoB,EACpB,GAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,iBAAiB,CACtB,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC,EAAE;YAC9D,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CACH,CAAC;QACF,yOAAyO;IAC3O,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CACN,GAAG,EACH,kBAAkB,aAAa,kDAAkD,CAClF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,2BAA2B,CAClC,QAAoB,EACpB,GAAe,EACf,QAAgB,EAChB,SAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CACnB,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,GAAG,IAAI,EAAE,CAAC,EAAE;gBACrD,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,qBAAqB;aAC/B,CAAC,CACH,CAAC;YACF,ySAAyS;QAC3S,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,0BAA0B,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAI,QAAoC,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;gBAAE,SAAS;YACxD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,GAAG,EACH,kBAAkB,UAAU,CAAC,MAAM,kCAAkC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,CACpI,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,eAAe,CACtB,QAAoB,EACpB,GAAe,EACf,QAAgB,EAChB,WAAmB;IAEnB,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;YACrF,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QACH,2LAA2L;IAC7L,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,aAAa,yCAAyC,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAC9B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,2DAA2D;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACpF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,8DAA8D,CAAC,CAAC;QAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,kEAAkE;IAClE,uEAAuE;IACvE,aAAa;IACb,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,eAAe,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,EAAE;YACnE,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QACH,kLAAkL;IACpL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,6BAA6B,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yDAAyD;IACzD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxC,yLAAyL;IAC3L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,qBAAqB;IACrB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,UAAU,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,YAAY,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,GAAG,SAAS,CAAC,EAAE;gBACvE,GAAG,EAAE,QAAQ;gBACb,OAAO,EAAE,qBAAqB;aAC/B,CAAC,CAAC;YACH,WAAW,GAAG,GAAG,CAAC;YAClB,MAAM;YACN,0JAA0J;QAC5J,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvD,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,QAAQ;IACR,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,0EAA0E;QAC1E,oDAAoD;QACpD,0EAA0E;QAC1E,6BAA6B;QAC7B,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC1E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,YAAY,EAAE,aAAa;gBAC3B,MAAM,EAAE,GAAG,yBAAyB,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,8GAA8G;aAC9K,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,aAAa,yBAAyB,CAAC,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC9F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACjF,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE;QACpD,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,cAAc,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC;IACF,MAAM,qBAAqB,GAAG,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACvE,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CACN,GAAG,EACH,+DAA+D,aAAa,uCAAuC,CACpH,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,gEAAgE;IAChE,yEAAyE;IACzE,kEAAkE;IAClE,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,QAAQ,CACpB,KAAK,EACL,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,EACjE;YACE,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,qBAAqB;SAC/B,CACF,CAAC;QACF,4LAA4L;IAC9L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,kBAAkB;YAChC,MAAM,EAAE,kCAAkC,aAAa,6EAA6E;SACrI,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,gEAAgE,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,MAAM,yBAAyB,EAAE,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,6EAA6E;QAC7E,yEAAyE;QACzE,4EAA4E;QAC5E,8DAA8D;QAC9D,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY,KAAK,aAAa;YACnC,CAAC,CAAC,oGAAoG,aAAa,4VAA4V,aAAa,GAAG;YAC/d,CAAC,CAAC,yDAAyD,aAAa,+LAA+L,CAAC;QAC5Q,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,MAAO,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}