@nanocollective/sentinel 0.1.0-alpha.0

package/dist/prompt/build.js

@@ -0,0 +1,123 @@
+/**
+ * Assemble the templated audit prompt for one rule pack against one repository.
+ * The pack's Markdown body is the audit instructions; the source files (scoped
+ * by the pack's applies_to globs) are the material; and a fixed reporting
+ * contract tells the model to emit findings in the snake_case shape the
+ * {@link ../findings/validate.js validator} accepts.
+ */
+import { CONFIDENCES, SEVERITIES } from '../findings/types.js';
+import { matchesAppliesTo } from '../rule-packs/glob.js';
+/** Prefix each line with a right-aligned 1-indexed number for line_range use. */
+function numberLines(content) {
+    const lines = content.split('\n');
+    const width = String(lines.length).length;
+    return lines
+        .map((line, i) => `${String(i + 1).padStart(width)}| ${line}`)
+        .join('\n');
+}
+function formatFile(file) {
+    return [
+        `===== FILE: ${file.path} =====`,
+        numberLines(file.content),
+        `===== END FILE: ${file.path} =====`,
+    ].join('\n');
+}
+function quotedList(values) {
+    return values.map(value => `"${value}"`).join(', ');
+}
+function reportingContract(packName, category) {
+    return [
+        '## Reporting findings',
+        '',
+        'Report the findings as a JSON array. Return [] if you find nothing.',
+        'Each finding is an object with exactly these keys:',
+        '',
+        `- "rule": string — the pack rule that fired, prefixed with the pack name (e.g. "${packName}/<pattern>")`,
+        '- "file": string — the repository-relative path of the affected file',
+        '- "line_range": object — {"start": <number>, "end": <number>}, 1-indexed and inclusive',
+        `- "category": string — the finding category (e.g. "${category || packName}")`,
+        `- "severity": string — one of ${quotedList(SEVERITIES)}`,
+        `- "confidence": string — one of ${quotedList(CONFIDENCES)}`,
+        '- "offending_snippet": string — the exact code the finding refers to',
+        '',
+        'Also include these fields where you can; they become the issue a human reads:',
+        '- "summary": string — a one-line description of the finding',
+        '- "rationale": string — why the finding has the severity you assigned',
+        '- "suggested_next_steps": string — what a reviewer should do next (not a patch)',
+        '',
+        'Output format (follow exactly):',
+        '- Put the JSON array inside a ```json fenced code block.',
+        '- On the line after the closing fence, output exactly: <<<SENTINEL_END>>>',
+        '- Write nothing after that line.',
+        '',
+        'Files below are shown with `N| ` line-number prefixes; use them for line_range.',
+        'Do not include the prefix in offending_snippet.',
+    ].join('\n');
+}
+/**
+ * Build an audit prompt. Files not matching the pack's applies_to scope are
+ * excluded and reported back in {@link PromptResult.skippedFiles}.
+ */
+export function buildAuditPrompt(input) {
+    const { pack, files, repoName, context, repoNotes } = input;
+    const { manifest, body } = pack;
+    const included = [];
+    const skippedFiles = [];
+    for (const file of files) {
+        if (matchesAppliesTo(manifest, file.path)) {
+            included.push(file);
+        }
+        else {
+            skippedFiles.push(file.path);
+        }
+    }
+    const sections = [];
+    const repoLabel = repoName ? `\`${repoName}\`` : 'this repository';
+    const languages = manifest.appliesTo.languages;
+    const framing = [
+        '# Security audit',
+        '',
+        `You are a meticulous security reviewer auditing ${repoLabel} with the rule pack "${manifest.name}" (version ${manifest.version}, category ${manifest.category || 'unspecified'}).`,
+        languages.length > 0 ? `The pack targets: ${languages.join(', ')}.` : '',
+        '',
+        'Follow the audit instructions exactly. Report only issues the instructions call for. When a pattern has known exceptions you cannot rule out from the code alone, lower your confidence rather than guessing.',
+    ]
+        .filter(line => line !== '')
+        .join('\n');
+    sections.push(framing);
+    sections.push(['## Audit instructions', '', body.trim()].join('\n'));
+    const weighting = Object.entries(manifest.severityWeighting);
+    if (weighting.length > 0) {
+        sections.push([
+            '## Severity weighting',
+            '',
+            'The rule pack assigns these baseline severities to specific finding types:',
+            '',
+            ...weighting.map(([key, severity]) => `- ${key}: ${severity}`),
+        ].join('\n'));
+    }
+    sections.push(reportingContract(manifest.name, manifest.category));
+    const contextParts = [];
+    if (repoNotes && repoNotes.trim().length > 0) {
+        contextParts.push(repoNotes.trim());
+    }
+    for (const file of context ?? []) {
+        contextParts.push(formatFile(file));
+    }
+    if (contextParts.length > 0) {
+        sections.push(['## Additional context', '', contextParts.join('\n\n')].join('\n'));
+    }
+    sections.push([
+        '## Files under audit',
+        '',
+        included.length > 0
+            ? included.map(formatFile).join('\n\n')
+            : "No files matched this pack's applies_to scope; report no findings.",
+    ].join('\n'));
+    return {
+        prompt: sections.join('\n\n'),
+        includedFiles: included.map(file => file.path),
+        skippedFiles,
+    };
+}
+//# sourceMappingURL=build.js.map

package/dist/prompt/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../../source/prompt/build.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,WAAW,EAAE,UAAU,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,gBAAgB,EAAC,MAAM,uBAAuB,CAAC;AAGvD,iFAAiF;AACjF,SAAS,WAAW,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,KAAK;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB;IACnC,OAAO;QACN,eAAe,IAAI,CAAC,IAAI,QAAQ;QAChC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QACzB,mBAAmB,IAAI,CAAC,IAAI,QAAQ;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAAyB;IAC5C,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,QAAgB;IAC5D,OAAO;QACN,uBAAuB;QACvB,EAAE;QACF,qEAAqE;QACrE,oDAAoD;QACpD,EAAE;QACF,mFAAmF,QAAQ,cAAc;QACzG,sEAAsE;QACtE,wFAAwF;QACxF,sDAAsD,QAAQ,IAAI,QAAQ,IAAI;QAC9E,iCAAiC,UAAU,CAAC,UAAU,CAAC,EAAE;QACzD,mCAAmC,UAAU,CAAC,WAAW,CAAC,EAAE;QAC5D,sEAAsE;QACtE,EAAE;QACF,+EAA+E;QAC/E,6DAA6D;QAC7D,uEAAuE;QACvE,iFAAiF;QACjF,EAAE;QACF,iCAAiC;QACjC,0DAA0D;QAC1D,2EAA2E;QAC3E,kCAAkC;QAClC,EAAE;QACF,iFAAiF;QACjF,iDAAiD;KACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IAClD,MAAM,EAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAC,GAAG,KAAK,CAAC;IAC1D,MAAM,EAAC,QAAQ,EAAE,IAAI,EAAC,GAAG,IAAI,CAAC;IAE9B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACnE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC;IAC/C,MAAM,OAAO,GAAG;QACf,kBAAkB;QAClB,EAAE;QACF,mDAAmD,SAAS,wBAAwB,QAAQ,CAAC,IAAI,cAAc,QAAQ,CAAC,OAAO,cAAc,QAAQ,CAAC,QAAQ,IAAI,aAAa,IAAI;QACnL,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,qBAAqB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACxE,EAAE;QACF,+MAA+M;KAC/M;SACC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC3B,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEvB,QAAQ,CAAC,IAAI,CAAC,CAAC,uBAAuB,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAErE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACZ;YACC,uBAAuB;YACvB,EAAE;YACF,4EAA4E;YAC5E,EAAE;YACF,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,QAAQ,EAAE,CAAC;SAC9D,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnE,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QAClC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CACZ,CAAC,uBAAuB,EAAE,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnE,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAI,CACZ;QACC,sBAAsB;QACtB,EAAE;QACF,QAAQ,CAAC,MAAM,GAAG,CAAC;YAClB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACvC,CAAC,CAAC,oEAAoE;KACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CACZ,CAAC;IAEF,OAAO;QACN,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9C,YAAY;KACZ,CAAC;AACH,CAAC"}

package/dist/prompt/types.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Inputs and output for audit prompt templating. The builder is pure: the
+ * orchestrator reads files from disk and passes them in, so the same code path
+ * serves both the Actions run and a local `sentinel run` (see
+ * docs/workflow/index.md#execution-model).
+ */
+import type { RulePack } from '../rule-packs/types.js';
+/** A repository file, with its POSIX-style repo-relative path. */
+export interface SourceFile {
+    path: string;
+    content: string;
+}
+/** Everything needed to build one audit prompt for one pack against one repo. */
+export interface PromptInput {
+    /** The rule pack whose body is the audit instructions. */
+    pack: RulePack;
+    /** Candidate source files; scoped down by the pack's applies_to. */
+    files: SourceFile[];
+    /** The audited repository, e.g. "my-org/my-program". */
+    repoName?: string;
+    /** Additional reference files the pack should read (Anchor.toml, etc.). */
+    context?: SourceFile[];
+    /** Free-text per-repo context. */
+    repoNotes?: string;
+}
+/** The assembled prompt plus which files it did and did not include. */
+export interface PromptResult {
+    prompt: string;
+    /** Paths included after applies_to scoping. */
+    includedFiles: string[];
+    /** Paths excluded by applies_to scoping. */
+    skippedFiles: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/prompt/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../source/prompt/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,wBAAwB,CAAC;AAErD,kEAAkE;AAClE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC3B,0DAA0D;IAC1D,IAAI,EAAE,QAAQ,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,EAAE,CAAC;CACvB"}

package/dist/prompt/types.js

@@ -0,0 +1,8 @@
+/**
+ * Inputs and output for audit prompt templating. The builder is pure: the
+ * orchestrator reads files from disk and passes them in, so the same code path
+ * serves both the Actions run and a local `sentinel run` (see
+ * docs/workflow/index.md#execution-model).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/prompt/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../source/prompt/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/rule-packs/dependencies.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Resolve a rule pack's `depends_on` graph into a run order. A pack can pull in
+ * a language-general or organisation-conventions pack that must run alongside
+ * it; this produces the transitive closure in dependency-first order, with
+ * missing dependencies and cycles reported as structured errors.
+ */
+import type { RulePack, RulePackError } from './types.js';
+/** The outcome of resolving a dependency graph. */
+export interface DependencyResult {
+    /** Pack names in run order: every dependency precedes its dependents. */
+    order: string[];
+    /** Missing-dependency and cycle errors. Empty when resolution succeeded. */
+    errors: RulePackError[];
+}
+/**
+ * Resolve the dependency closure of `rootName` over `packs`. The root itself is
+ * included, last, after everything it (transitively) depends on.
+ */
+export declare function resolveDependencies(packs: RulePack[], rootName: string): DependencyResult;
+//# sourceMappingURL=dependencies.d.ts.map

package/dist/rule-packs/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../source/rule-packs/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAC,QAAQ,EAAE,aAAa,EAAC,MAAM,YAAY,CAAC;AAExD,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAChC,yEAAyE;IACzE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,MAAM,EAAE,aAAa,EAAE,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,QAAQ,EAAE,EACjB,QAAQ,EAAE,MAAM,GACd,gBAAgB,CAsDlB"}

package/dist/rule-packs/dependencies.js

@@ -0,0 +1,58 @@
+/**
+ * Resolve a rule pack's `depends_on` graph into a run order. A pack can pull in
+ * a language-general or organisation-conventions pack that must run alongside
+ * it; this produces the transitive closure in dependency-first order, with
+ * missing dependencies and cycles reported as structured errors.
+ */
+/**
+ * Resolve the dependency closure of `rootName` over `packs`. The root itself is
+ * included, last, after everything it (transitively) depends on.
+ */
+export function resolveDependencies(packs, rootName) {
+    const byName = new Map(packs.map(pack => [pack.manifest.name, pack]));
+    const errors = [];
+    const order = [];
+    const resolved = new Set();
+    const onStack = new Set();
+    if (!byName.has(rootName)) {
+        return {
+            order: [],
+            errors: [
+                { field: 'depends_on', message: `unknown rule pack: ${rootName}` },
+            ],
+        };
+    }
+    function visit(name) {
+        if (resolved.has(name)) {
+            return;
+        }
+        if (onStack.has(name)) {
+            errors.push({
+                field: 'depends_on',
+                message: `dependency cycle detected at rule pack: ${name}`,
+            });
+            return;
+        }
+        const pack = byName.get(name);
+        if (!pack) {
+            errors.push({
+                field: 'depends_on',
+                message: `unknown rule pack: ${name}`,
+            });
+            return;
+        }
+        onStack.add(name);
+        for (const dependency of pack.manifest.dependsOn) {
+            visit(dependency);
+        }
+        onStack.delete(name);
+        resolved.add(name);
+        order.push(name);
+    }
+    visit(rootName);
+    if (errors.length > 0) {
+        return { order: [], errors };
+    }
+    return { order, errors: [] };
+}
+//# sourceMappingURL=dependencies.js.map

package/dist/rule-packs/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../source/rule-packs/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAiB,EACjB,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO;YACN,KAAK,EAAE,EAAE;YACT,MAAM,EAAE;gBACP,EAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB,QAAQ,EAAE,EAAC;aAChE;SACD,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,IAAY;QAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO;QACR,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,2CAA2C,IAAI,EAAE;aAC1D,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,YAAY;gBACnB,OAAO,EAAE,sBAAsB,IAAI,EAAE;aACrC,CAAC,CAAC;YACH,OAAO;QACR,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YAClD,KAAK,CAAC,UAAU,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAErB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEhB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAC,KAAK,EAAE,EAAE,EAAE,MAAM,EAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;AAC5B,CAAC"}

package/dist/rule-packs/glob.d.ts

@@ -0,0 +1,23 @@
+/**
+ * A small glob matcher for `applies_to.paths`. Supports the subset of glob
+ * syntax rule packs actually use:
+ *
+ *   **  matches any number of path segments, including none
+ *   *   matches any run of characters within a single segment (not `/`)
+ *   ?   matches a single character within a segment (not `/`)
+ *
+ * Anything else is treated literally. This is deliberately not a full glob
+ * implementation; the orchestrator can reach for a heavier library if a pack
+ * ever needs brace expansion or character classes.
+ */
+import type { RulePackManifest } from './types.js';
+/** Compile a single glob pattern to an anchored regular expression. */
+export declare function globToRegExp(pattern: string): RegExp;
+/** Returns true if a POSIX-style path matches the glob pattern. */
+export declare function matchesGlob(pattern: string, path: string): boolean;
+/**
+ * Returns true if a file should be read under a pack's `applies_to.paths`. An
+ * empty path list means the pack applies to the whole repository.
+ */
+export declare function matchesAppliesTo(manifest: RulePackManifest, path: string): boolean;
+//# sourceMappingURL=glob.d.ts.map

package/dist/rule-packs/glob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.d.ts","sourceRoot":"","sources":["../../source/rule-packs/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAMjD,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6BpD;AAED,mEAAmE;AACnE,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,MAAM,GACV,OAAO,CAMT"}

package/dist/rule-packs/glob.js

@@ -0,0 +1,66 @@
+/**
+ * A small glob matcher for `applies_to.paths`. Supports the subset of glob
+ * syntax rule packs actually use:
+ *
+ *   **  matches any number of path segments, including none
+ *   *   matches any run of characters within a single segment (not `/`)
+ *   ?   matches a single character within a segment (not `/`)
+ *
+ * Anything else is treated literally. This is deliberately not a full glob
+ * implementation; the orchestrator can reach for a heavier library if a pack
+ * ever needs brace expansion or character classes.
+ */
+function escapeRegExp(literal) {
+    return literal.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+}
+/** Compile a single glob pattern to an anchored regular expression. */
+export function globToRegExp(pattern) {
+    let out = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (char === '*') {
+            if (pattern[i + 1] === '*') {
+                // `**` — cross segment boundaries. Consume a trailing slash so that
+                // `a/**/b` still matches `a/b` with no intervening segment.
+                i++;
+                if (pattern[i + 1] === '/') {
+                    i++;
+                    out += '(?:.*/)?';
+                }
+                else {
+                    out += '.*';
+                }
+            }
+            else {
+                out += '[^/]*';
+            }
+        }
+        else if (char === '?') {
+            out += '[^/]';
+        }
+        else {
+            out += escapeRegExp(char);
+        }
+    }
+    // The pattern is built from a rule pack's applies_to globs (the installing
+    // org's own files), with all regex specials escaped and only bounded `*`,
+    // `**`, and `?` expansions — no attacker-controlled quantifiers.
+    // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp
+    return new RegExp(`^${out}$`);
+}
+/** Returns true if a POSIX-style path matches the glob pattern. */
+export function matchesGlob(pattern, path) {
+    return globToRegExp(pattern).test(path);
+}
+/**
+ * Returns true if a file should be read under a pack's `applies_to.paths`. An
+ * empty path list means the pack applies to the whole repository.
+ */
+export function matchesAppliesTo(manifest, path) {
+    const { paths } = manifest.appliesTo;
+    if (paths.length === 0) {
+        return true;
+    }
+    return paths.some(pattern => matchesGlob(pattern, path));
+}
+//# sourceMappingURL=glob.js.map

package/dist/rule-packs/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../source/rule-packs/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,SAAS,YAAY,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,OAAe;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAClB,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC5B,oEAAoE;gBACpE,4DAA4D;gBAC5D,CAAC,EAAE,CAAC;gBACJ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC5B,CAAC,EAAE,CAAC;oBACJ,GAAG,IAAI,UAAU,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACP,GAAG,IAAI,IAAI,CAAC;gBACb,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,GAAG,IAAI,OAAO,CAAC;YAChB,CAAC;QACF,CAAC;aAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACzB,GAAG,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,CAAC;YACP,GAAG,IAAI,YAAY,CAAC,IAAc,CAAC,CAAC;QACrC,CAAC;IACF,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,gGAAgG;IAChG,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,IAAY;IACxD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,QAA0B,EAC1B,IAAY;IAEZ,MAAM,EAAC,KAAK,EAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/rule-packs/parse.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Parse and validate a single rule pack file: split the YAML manifest header
+ * from the Markdown body, validate the manifest against the v1 contract, and
+ * normalise it to a {@link RulePack}. Failures come back as a structured
+ * {@link ParseResult}, mirroring the findings validator.
+ */
+import type { ParseResult } from './types.js';
+/**
+ * Split a pack file into its raw YAML manifest and Markdown body. Returns null
+ * when the file does not open with a `---` fenced frontmatter block.
+ */
+export declare function splitFrontmatter(raw: string): {
+    yaml: string;
+    body: string;
+} | null;
+/**
+ * Parse a rule pack file. On success, returns the normalised pack; on failure,
+ * returns every reason it was rejected.
+ */
+export declare function parseRulePack(raw: string): ParseResult;
+//# sourceMappingURL=parse.d.ts.map

package/dist/rule-packs/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../source/rule-packs/parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAEX,WAAW,EAGX,MAAM,YAAY,CAAC;AAoBpB;;;GAGG;AACH,wBAAgB,gBAAgB,CAC/B,GAAG,EAAE,MAAM,GACT;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAC,GAAG,IAAI,CAkBrC;AAoGD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CA6HtD"}

package/dist/rule-packs/parse.js

@@ -0,0 +1,230 @@
+/**
+ * Parse and validate a single rule pack file: split the YAML manifest header
+ * from the Markdown body, validate the manifest against the v1 contract, and
+ * normalise it to a {@link RulePack}. Failures come back as a structured
+ * {@link ParseResult}, mirroring the findings validator.
+ */
+import { parse as parseYaml } from 'yaml';
+import { isSeverity } from '../findings/types.js';
+/** Kebab-case: lowercase alphanumerics separated by single hyphens. */
+const NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+/** Semver core with an optional prerelease/build suffix. */
+const VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+].+)?$/;
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every(item => typeof item === 'string');
+}
+/**
+ * Split a pack file into its raw YAML manifest and Markdown body. Returns null
+ * when the file does not open with a `---` fenced frontmatter block.
+ */
+export function splitFrontmatter(raw) {
+    const normalised = raw.replace(/\r\n/g, '\n');
+    if (!normalised.startsWith('---\n')) {
+        return null;
+    }
+    const rest = normalised.slice(4);
+    const end = rest.indexOf('\n---');
+    if (end === -1) {
+        return null;
+    }
+    const yaml = rest.slice(0, end);
+    // Drop the closing fence line (its trailing chars + newline), then any blank
+    // lines separating the fence from the body.
+    const afterFence = rest.slice(end + 4);
+    const body = afterFence.replace(/^[^\n]*\n/, '').replace(/^\n+/, '');
+    return { yaml, body };
+}
+function validateAppliesTo(value, errors) {
+    const appliesTo = { paths: [], languages: [] };
+    if (value === undefined) {
+        return appliesTo;
+    }
+    if (!isObject(value)) {
+        errors.push({
+            field: 'applies_to',
+            message: 'applies_to must be a mapping with optional paths and languages',
+        });
+        return appliesTo;
+    }
+    if (value.paths !== undefined) {
+        if (isStringArray(value.paths)) {
+            appliesTo.paths = value.paths;
+        }
+        else {
+            errors.push({
+                field: 'applies_to.paths',
+                message: 'applies_to.paths must be a list of glob strings',
+            });
+        }
+    }
+    if (value.languages !== undefined) {
+        if (isStringArray(value.languages)) {
+            appliesTo.languages = value.languages;
+        }
+        else {
+            errors.push({
+                field: 'applies_to.languages',
+                message: 'applies_to.languages must be a list of language identifiers',
+            });
+        }
+    }
+    return appliesTo;
+}
+function validateSeverityWeighting(value, errors) {
+    const weighting = {};
+    if (value === undefined) {
+        return weighting;
+    }
+    if (!isObject(value)) {
+        errors.push({
+            field: 'severity_weighting',
+            message: 'severity_weighting must be a mapping of finding type to severity',
+        });
+        return weighting;
+    }
+    for (const [key, severity] of Object.entries(value)) {
+        if (isSeverity(severity)) {
+            weighting[key] = severity;
+        }
+        else {
+            errors.push({
+                field: `severity_weighting.${key}`,
+                message: 'severity must be one of: low, medium, high, critical',
+            });
+        }
+    }
+    return weighting;
+}
+function validateDependsOn(value, name, errors) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!isStringArray(value)) {
+        errors.push({
+            field: 'depends_on',
+            message: 'depends_on must be a list of pack names',
+        });
+        return [];
+    }
+    if (typeof name === 'string' && value.includes(name)) {
+        errors.push({
+            field: 'depends_on',
+            message: 'a pack cannot depend on itself',
+        });
+    }
+    return value;
+}
+/**
+ * Parse a rule pack file. On success, returns the normalised pack; on failure,
+ * returns every reason it was rejected.
+ */
+export function parseRulePack(raw) {
+    const errors = [];
+    const split = splitFrontmatter(raw);
+    if (!split) {
+        return {
+            valid: false,
+            pack: null,
+            errors: [
+                {
+                    field: 'document',
+                    message: 'a rule pack must open with a --- fenced YAML manifest followed by a Markdown body',
+                },
+            ],
+        };
+    }
+    let manifestData;
+    try {
+        manifestData = parseYaml(split.yaml);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            valid: false,
+            pack: null,
+            errors: [
+                { field: 'document', message: `invalid YAML manifest: ${message}` },
+            ],
+        };
+    }
+    if (!isObject(manifestData)) {
+        return {
+            valid: false,
+            pack: null,
+            errors: [{ field: 'document', message: 'manifest must be a mapping' }],
+        };
+    }
+    // name (required, kebab-case)
+    if (!isNonEmptyString(manifestData.name)) {
+        errors.push({
+            field: 'name',
+            message: 'name is required and must be a string',
+        });
+    }
+    else if (!NAME_PATTERN.test(manifestData.name)) {
+        errors.push({ field: 'name', message: 'name must be kebab-case' });
+    }
+    // version (required, semver)
+    if (!isNonEmptyString(manifestData.version)) {
+        errors.push({
+            field: 'version',
+            message: 'version is required and must be a string',
+        });
+    }
+    else if (!VERSION_PATTERN.test(manifestData.version)) {
+        errors.push({
+            field: 'version',
+            message: 'version must be semver (e.g. 1.2.0)',
+        });
+    }
+    // description (optional)
+    if (manifestData.description !== undefined &&
+        typeof manifestData.description !== 'string') {
+        errors.push({
+            field: 'description',
+            message: 'description must be a string',
+        });
+    }
+    // category (optional)
+    if (manifestData.category !== undefined &&
+        !isNonEmptyString(manifestData.category)) {
+        errors.push({
+            field: 'category',
+            message: 'category must be a non-empty string when present',
+        });
+    }
+    const appliesTo = validateAppliesTo(manifestData.applies_to, errors);
+    const severityWeighting = validateSeverityWeighting(manifestData.severity_weighting, errors);
+    const dependsOn = validateDependsOn(manifestData.depends_on, manifestData.name, errors);
+    // body (required — a pack with no prompt does nothing)
+    if (split.body.trim().length === 0) {
+        errors.push({
+            field: 'body',
+            message: 'the Markdown body is empty; a pack must contain an audit prompt',
+        });
+    }
+    if (errors.length > 0) {
+        return { valid: false, pack: null, errors };
+    }
+    const manifest = {
+        name: manifestData.name,
+        version: manifestData.version,
+        description: typeof manifestData.description === 'string'
+            ? manifestData.description
+            : '',
+        appliesTo,
+        severityWeighting,
+        dependsOn,
+        category: isNonEmptyString(manifestData.category)
+            ? manifestData.category
+            : '',
+    };
+    return { valid: true, pack: { manifest, body: split.body }, errors: [] };
+}
+//# sourceMappingURL=parse.js.map

package/dist/rule-packs/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../source/rule-packs/parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAC,KAAK,IAAI,SAAS,EAAC,MAAM,MAAM,CAAC;AACxC,OAAO,EAAC,UAAU,EAAgB,MAAM,sBAAsB,CAAC;AAQ/D,uEAAuE;AACvE,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD,4DAA4D;AAC5D,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC/B,GAAW;IAEX,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrE,OAAO,EAAC,IAAI,EAAE,IAAI,EAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,MAAuB;IACjE,MAAM,SAAS,GAAc,EAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAC,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,gEAAgE;SACzE,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,kBAAkB;gBACzB,OAAO,EAAE,iDAAiD;aAC1D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,SAAS,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACvC,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,sBAAsB;gBAC7B,OAAO,EAAE,6DAA6D;aACtE,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CACjC,KAAc,EACd,MAAuB;IAEvB,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,oBAAoB;YAC3B,OAAO,EACN,kEAAkE;SACnE,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QAC3B,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,sBAAsB,GAAG,EAAE;gBAClC,OAAO,EAAE,sDAAsD;aAC/D,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CACzB,KAAc,EACd,IAAa,EACb,MAAuB;IAEvB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACX,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,yCAAyC;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACX,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,gCAAgC;SACzC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACxC,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE;gBACP;oBACC,KAAK,EAAE,UAAU;oBACjB,OAAO,EACN,mFAAmF;iBACpF;aACD;SACD,CAAC;IACH,CAAC;IAED,IAAI,YAAqB,CAAC;IAC1B,IAAI,CAAC;QACJ,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE;gBACP,EAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,OAAO,EAAE,EAAC;aACjE;SACD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,CAAC,EAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,4BAA4B,EAAC,CAAC;SACpE,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,uCAAuC;SAChD,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,EAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAC,CAAC,CAAC;IAClE,CAAC;IAED,6BAA6B;IAC7B,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,0CAA0C;SACnD,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,qCAAqC;SAC9C,CAAC,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IACC,YAAY,CAAC,WAAW,KAAK,SAAS;QACtC,OAAO,YAAY,CAAC,WAAW,KAAK,QAAQ,EAC3C,CAAC;QACF,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,8BAA8B;SACvC,CAAC,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,IACC,YAAY,CAAC,QAAQ,KAAK,SAAS;QACnC,CAAC,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC,EACvC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,kDAAkD;SAC3D,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,yBAAyB,CAClD,YAAY,CAAC,kBAAkB,EAC/B,MAAM,CACN,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,CAClC,YAAY,CAAC,UAAU,EACvB,YAAY,CAAC,IAAI,EACjB,MAAM,CACN,CAAC;IAEF,uDAAuD;IACvD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,MAAM;YACb,OAAO,EACN,iEAAiE;SAClE,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAqB;QAClC,IAAI,EAAE,YAAY,CAAC,IAAc;QACjC,OAAO,EAAE,YAAY,CAAC,OAAiB;QACvC,WAAW,EACV,OAAO,YAAY,CAAC,WAAW,KAAK,QAAQ;YAC3C,CAAC,CAAC,YAAY,CAAC,WAAW;YAC1B,CAAC,CAAC,EAAE;QACN,SAAS;QACT,iBAAiB;QACjB,SAAS;QACT,QAAQ,EAAE,gBAAgB,CAAC,YAAY,CAAC,QAAQ,CAAC;YAChD,CAAC,CAAC,YAAY,CAAC,QAAQ;YACvB,CAAC,CAAC,EAAE;KACL,CAAC;IAEF,OAAO,EAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAC,EAAE,MAAM,EAAE,EAAE,EAAC,CAAC;AACtE,CAAC"}