@pipobscure/bundle 0.0.1

package/dist/cli.js

@@ -0,0 +1,555 @@
+import * as FS from 'node:fs';
+import * as PATH from 'node:path';
+import { parseArgs } from 'node:util';
+import { createBundle, signBundle, verifyBundle, runBundle, fileSigner } from './api.js';
+import { members } from './archive.js';
+import { launcherPath } from './files.js';
+import * as AUDIT from './audit.js';
+import { message, STATES } from './manifest.js';
+// Re-exported because this is where a CLI consumer looks for it; it is defined
+// in the format layer so the `bundle` launcher can report an exit code without
+// loading the whole CLI.
+export { STATES };
+import * as SKILLS from './skill.js';
+// Argument parsing and reporting, and nothing else. Every command below is a
+// `parseArgs` call, a message or two, and one call into `api.ts` — which is
+// deliberate: what the CLI can do is exactly what an embedder can do, because
+// they are the same functions.
+export const USAGE = `usage: bundle <command> [options]
+
+commands:
+  create    build an archive from a list of files
+  sign      sign an archive into a new file, optionally behind a prefix
+  audit     report what is about to be reviewed, and gate signing on the verdict
+  verify    verify an archive and report its trust state
+  run       mount a signed archive and run it
+  sea       build a node runtime that verifies an archive before running it
+  trust     refresh the sigstore trust root used to check sigstore signatures
+  skill     install this package's bundle-auditing skill into a project
+
+create options:
+  -b, --base <dir>      base directory the file list is relative to (default: .)
+  -p, --prefix <file>   prefix prepended before the archive (launcher or binary);
+                        omit it for a plain archive meant to be run from a mount
+  -f, --files <file>    read the newline-separated file list from here (default: stdin)
+  -o, --output <file>   write the archive here (default: stdout)
+  -k, --key <file>      leaf private key (PEM); signs at build time with --chain
+  -c, --chain <file>    full certificate chain (PEM, leaf first)
+      --hash <alg>      digest for the whole-file hash and member digests (default: sha256)
+      --sign <alg>      digest the signature over that hash uses (default: sha256)
+
+sign options:                       usage: sign [options] <archive>
+  -o, --output <file>   write the signed archive here (default: stdout)
+  -l, --launcher        prepend this package's shell launcher, so the result runs
+                        by name — the usual way to make a self-executing archive
+  -p, --prefix <file>   prepend some other prefix: a launcher of your own, or a
+                        node binary; omit both for a plain mountable archive
+  -x, --executable      make the output executable (implied by --launcher/--prefix)
+      --hash <alg>      digest for the whole-file hash and member digests (default: sha256)
+      --sign <alg>      digest the signature over that hash uses (default: sha256)
+
+  by default this signs through sigstore, taking the identity from CI when
+  there is one and otherwise opening a GitHub sign-in:
+      --flow <how>          auto | ci | browser | device (default: auto)
+      --token <jwt>         use this OIDC token instead of signing in
+      --oidc-issuer <url>   OIDC issuer (default: sigstore's dex)
+      --connector <name>    identity provider to jump to (default: github)
+      --fulcio <url>        certificate authority (default: fulcio.sigstore.dev)
+      --rekor <url>         transparency log; empty string to skip it
+      --tsa <url>           timestamp authority; empty string to skip it
+
+  or, to sign against a certificate authority of your own:
+  -k, --key <file>      leaf private key (PEM)
+  -c, --chain <file>    full certificate chain (PEM, leaf first)
+
+audit options:                      usage: audit [options] <archive>
+  -b, --baseline <file> a previously approved archive to review against, so the
+                        review is of what changed rather than of everything
+  -v, --verdict <file>  where the verdict is (default: <archive>.audit.json)
+      --check           exit non-zero unless a clean verdict pins these bytes
+      --approve         record a clean verdict you reached by reading it yourself
+  -n, --note <text>     what you checked, recorded with --approve
+
+  with none of those it reports what is about to be reviewed and how. The review
+  itself needs judgement, so no command performs it: install the skill with
+  'bundle skill' and run /audit-bundle, or read the archive yourself and
+  --approve. Signing is not gated unless you run --check before it.
+
+verify options:                     usage: verify [options] <archive>
+  -a, --archive <file>  archive to verify (or pass it as a positional argument)
+  -r, --root <file>     extra trusted root certificate (PEM); repeatable
+      --identity <san>  require this sigstore signing identity
+      --issuer <url>    require this sigstore OIDC issuer
+      --sigstore-root <file>  sigstore trust root (default: the cache 'trust' fills)
+      --json            print the result as JSON
+
+run options:                        usage: run [options] <archive> [-- <app args>]
+  -r, --root <file>     extra trusted root certificate (PEM); repeatable
+      --identity <san>  require this sigstore signing identity
+      --issuer <url>    require this sigstore OIDC issuer
+      --untrusted       run an archive whose signature is good but untrusted
+
+sea options:                        usage: sea [options] [archive]
+  -o, --output <file>   write the executable here (required)
+      --node <file>     node binary to embed (default: the running one)
+      --base <file>     reuse a SEA base built earlier instead of building one
+      --no-sigstore     leave the sigstore libraries out of the embedded verifier
+      --untrusted       let the finished executable run an archive whose
+                        signature is good but unanchored
+  -r, --root <file>     trusted root the executable checks against; repeatable
+      --identity <san>  identity the executable requires of a signature
+      --issuer <url>    issuer the executable requires of a signature
+
+  with an archive, the result is that application: one file that verifies
+  itself and runs what is inside it. without one, the result is a verifying
+  node — a runtime that takes an archive on its own command line:
+
+      bundle sea -o node-verifying
+      ./node-verifying ./my-app.zip --args --for --the --app
+
+  a runtime built with a policy (-r, --identity, --issuer) is sealed: it
+  accepts no policy from its command line, because a binary that demands a
+  signing identity is not one whose user can ask it to stop.
+
+  the signing options are the same as 'sign': sigstore by default, or --key
+  with --chain against a certificate authority of your own
+
+trust options:
+      --mirror <url>    TUF repository to refresh from (default: sigstore's)
+
+skill options:                      usage: skill [options] [name]
+  -d, --dir <dir>       where to install (default: .claude/skills)
+  -f, --force           overwrite files that are already there
+  -l, --list            list the skills this package carries and stop
+
+  -h, --help            show this help`;
+const CONSOLE = {
+    out: (line) => { process.stdout.write(`${line}\n`); },
+    err: (line) => { process.stderr.write(`${line}\n`); },
+};
+/**
+ * The commands, in the order the usage text lists them. Keeping the dispatch
+ * table and the help in one place is what stops the two drifting apart.
+ */
+export const COMMANDS = {
+    create, sign, audit, verify: check, run, sea, trust, skill,
+};
+/**
+ * Run one CLI invocation. `argv` is the user's arguments — everything after the
+ * runtime and the entry point — and the return value is the process exit code,
+ * so a caller decides what to do with it rather than being exited out from
+ * under.
+ */
+export async function main(argv, io = CONSOLE) {
+    const [cmd, ...rest] = argv;
+    try {
+        if (cmd === undefined) {
+            io.out(USAGE);
+            return 64;
+        }
+        if (cmd === '-h' || cmd === '--help' || cmd === 'help') {
+            io.out(USAGE);
+            return 0;
+        }
+        const command = Object.hasOwn(COMMANDS, cmd) ? COMMANDS[cmd] : undefined;
+        if (!command)
+            throw new Error(`unknown command: ${cmd}`);
+        return await command(rest, io);
+    }
+    catch (err) {
+        io.err(`error: ${message(err)}`);
+        return 70;
+    }
+}
+async function create(args, io) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            base: { type: 'string', short: 'b', default: '.' },
+            prefix: { type: 'string', short: 'p' },
+            files: { type: 'string', short: 'f' },
+            output: { type: 'string', short: 'o' },
+            key: { type: 'string', short: 'k' },
+            chain: { type: 'string', short: 'c' },
+            hash: { type: 'string', default: 'sha256' },
+            sign: { type: 'string', default: 'sha256' },
+        },
+    });
+    if (Boolean(values.key) !== Boolean(values.chain))
+        throw new Error('create: --key and --chain must be given together');
+    const listing = values.files ? FS.readFileSync(values.files, 'utf-8') : await readStdin();
+    const files = [...new Set(listing.split(/\r?\n/).filter(Boolean))].sort();
+    if (!files.length)
+        throw new Error('create: the file list is empty');
+    for (const file of files)
+        io.err(`+ ${file}`);
+    io.err(values.key
+        ? `* signed archive (${files.length} members, ${values.hash} digests, ${values.sign} signature)`
+        : `* unsigned archive (${files.length} members, ${values.hash} digests)`);
+    await createBundle({
+        base: values.base, files, prefix: values.prefix, output: values.output,
+        hashAlg: values.hash, signAlg: values.sign,
+        key: values.key ? FS.readFileSync(values.key) : undefined,
+        chain: values.chain ? FS.readFileSync(values.chain, 'utf-8') : undefined,
+    });
+    return 0;
+}
+async function sign(args, io) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            output: { type: 'string', short: 'o' },
+            launcher: { type: 'boolean', short: 'l' },
+            prefix: { type: 'string', short: 'p' },
+            executable: { type: 'boolean', short: 'x' },
+            key: { type: 'string', short: 'k' },
+            chain: { type: 'string', short: 'c' },
+            hash: { type: 'string', default: 'sha256' },
+            sign: { type: 'string', default: 'sha256' },
+            flow: { type: 'string', default: 'auto' },
+            token: { type: 'string' },
+            'oidc-issuer': { type: 'string' },
+            connector: { type: 'string' },
+            fulcio: { type: 'string' },
+            rekor: { type: 'string' },
+            tsa: { type: 'string' },
+        },
+    });
+    const source = positionals[0];
+    if (!source)
+        throw new Error('sign: an archive path is required');
+    if (Boolean(values.key) !== Boolean(values.chain))
+        throw new Error('sign: --key and --chain must be given together');
+    if (values.launcher && values.prefix)
+        throw new Error('sign: --launcher and --prefix are alternatives');
+    // `--launcher` is `--prefix <this package's shell-base>`, spelled so that
+    // nobody has to know the prefix ships inside node_modules.
+    const prefix = values.launcher ? launcherPath() : values.prefix;
+    for (const name of members(source))
+        io.err(`+ ${name}`);
+    if (prefix)
+        io.err(`* prefix ${prefix} (${FS.statSync(prefix).size} bytes)`);
+    const signer = await chooseSigner(values, io);
+    const res = await signBundle({
+        source, output: values.output, prefix, executable: values.executable,
+        hashAlg: values.hash, signAlg: values.sign, signer,
+    });
+    io.err(`* signed: ${res.hash}`);
+    if (res.output)
+        io.err(`* wrote ${res.output} (${res.size} bytes)`);
+    return 0;
+}
+async function check(args, io) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            archive: { type: 'string', short: 'a' },
+            root: { type: 'string', short: 'r', multiple: true },
+            identity: { type: 'string' },
+            issuer: { type: 'string' },
+            'sigstore-root': { type: 'string' },
+            json: { type: 'boolean' },
+        },
+    });
+    const archive = values.archive ?? positionals[0];
+    if (!archive)
+        throw new Error('verify: an archive path is required');
+    const res = await verifyBundle(archive, {
+        roots: values.root ?? [],
+        identity: values.identity,
+        issuer: values.issuer,
+        trustedRoot: values['sigstore-root'],
+    });
+    report(res, Boolean(values.json), io);
+    return STATES[res.state].code;
+}
+/** Print a verification result, as text or as the JSON `--json` produces. */
+export function report(res, json, io) {
+    const state = STATES[res.state];
+    if (json) {
+        io.out(JSON.stringify({
+            state: res.state, reason: res.reason, subject: res.subject,
+            signed: res.signed, trusted: res.trusted, sigstore: Boolean(res.sigstore),
+            identity: res.identity, issuer: res.issuer,
+            signedAt: res.signedAt ? res.signedAt.toISOString() : undefined,
+            members: res.digests ? [...res.digests.keys()] : undefined,
+            code: state.code,
+        }, null, 2));
+        return;
+    }
+    io.out(`${state.label} — ${res.reason ?? state.note}`);
+    // For a sigstore signature the identity is the answer to "who signed this";
+    // the certificate subject is an ephemeral Fulcio artifact and says nothing
+    // useful.
+    if (res.identity)
+        io.out(`  identity: ${res.identity}`);
+    if (res.issuer)
+        io.out(`  issuer: ${res.issuer}`);
+    if (res.signedAt)
+        io.out(`  signed: ${res.signedAt.toISOString()}`);
+    if (res.subject && !res.identity)
+        io.out(`  certificate: ${res.subject.replace(/\n/g, ', ')}`);
+}
+// Run an archive the way a mount does. Everything after `--` is the
+// application's own argv.
+function run(args, io) {
+    const split = args.indexOf('--');
+    const mine = split < 0 ? args : args.slice(0, split);
+    const theirs = split < 0 ? [] : args.slice(split + 1);
+    const { values, positionals } = parseArgs({
+        args: mine,
+        allowPositionals: true,
+        options: {
+            root: { type: 'string', short: 'r', multiple: true },
+            identity: { type: 'string' },
+            issuer: { type: 'string' },
+            untrusted: { type: 'boolean' },
+        },
+    });
+    const archive = positionals[0];
+    if (!archive)
+        throw new Error('run: an archive path is required');
+    let res;
+    try {
+        res = runBundle(archive, {
+            roots: values.root ?? [], identity: values.identity, issuer: values.issuer,
+            allowUntrusted: values.untrusted, args: theirs,
+        });
+    }
+    catch (err) {
+        if (err.code !== 'ERR_BUNDLE_UNTRUSTED')
+            throw err;
+        const state = err.state;
+        io.err(`error: ${message(err)}`);
+        return state ? STATES[state].code : 2;
+    }
+    if (res.signal)
+        process.kill(process.pid, res.signal);
+    return res.status ?? 70;
+}
+// The audit gate. The review itself needs judgement, so this command does the
+// two mechanical halves around it: say what is about to be reviewed, and refuse
+// to let signing proceed without a clean verdict over exactly these bytes.
+function audit(args, io) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            baseline: { type: 'string', short: 'b' },
+            verdict: { type: 'string', short: 'v' },
+            note: { type: 'string', short: 'n' },
+            check: { type: 'boolean' },
+            approve: { type: 'boolean' },
+        },
+    });
+    const bundle = positionals[0];
+    if (!bundle)
+        throw new Error('audit: an archive path is required');
+    if (values.check && values.approve)
+        throw new Error('audit: --check and --approve are alternatives');
+    const options = { bundle, verdict: values.verdict, baseline: values.baseline };
+    if (values.check) {
+        const verdict = AUDIT.check(options);
+        const notes = (verdict.findings ?? []).length;
+        io.err(`* audited: ${verdict.summary ?? 'pass'}`);
+        io.err(`  ${verdict.reviewed ?? '?'} of ${verdict.members ?? '?'} members reviewed, ` +
+            `${notes} finding${notes === 1 ? '' : 's'}`);
+        if (verdict.baselineSha256)
+            io.err(`  as a diff against ${verdict.baselineSha256.slice(0, 16)}…`);
+        return 0;
+    }
+    if (values.approve) {
+        const verdict = AUDIT.approve({ ...options, note: values.note });
+        io.err(`* recorded a pass over ${verdict.sha256.slice(0, 16)}… in ${AUDIT.verdictPath(bundle, values.verdict)}`);
+        return 0;
+    }
+    const found = AUDIT.prepare(options);
+    io.out(`${found.bundle}: ${STATES[found.state]?.label ?? found.state}, ${found.members.length} members`);
+    io.out(`  sha256: ${found.sha256}`);
+    if (found.state === 'unsigned') {
+        io.out('  unsigned, as an archive that has not been signed yet should be');
+    }
+    if (found.baseline) {
+        io.out(`  against ${found.baseline.path} (${found.baseline.sha256.slice(0, 16)}…)`);
+        io.out(`  ${found.baseline.added.length} added, ${found.baseline.removed.length} removed, ` +
+            `${found.baseline.carried} carried over`);
+        for (const name of found.baseline.added.slice(0, 10))
+            io.out(`    + ${name}`);
+        for (const name of found.baseline.removed.slice(0, 10))
+            io.out(`    - ${name}`);
+    }
+    else {
+        io.out('  no baseline — the review is of everything, not a diff');
+    }
+    io.err('');
+    io.err('* review it, then record the verdict:');
+    io.err(`    BUNDLE_AUDIT_VERDICT=${found.verdict} \\`);
+    io.err(found.baseline
+        ? `      claude "/audit-bundle ${bundle} against ${found.baseline.path}"`
+        : `      claude "/audit-bundle ${bundle}"`);
+    io.err('  or, having read it yourself:');
+    io.err(`    bundle audit --approve --note '<what you checked>' ${bundle}`);
+    io.err("* then gate signing on it: bundle audit --check ... && bundle sign ...");
+    return 0;
+}
+// Wrap an archive in a node runtime that verifies itself before running it.
+// The signing half is the same as `sign` — the finished executable is one
+// signed file whose hash covers the runtime, the verifier and the application
+// alike, which is what lets it check itself with something inside itself.
+async function sea(args, io) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            output: { type: 'string', short: 'o' },
+            node: { type: 'string' },
+            base: { type: 'string' },
+            sigstore: { type: 'boolean', default: true },
+            untrusted: { type: 'boolean' },
+            root: { type: 'string', short: 'r', multiple: true },
+            identity: { type: 'string' },
+            issuer: { type: 'string' },
+            key: { type: 'string', short: 'k' },
+            chain: { type: 'string', short: 'c' },
+            hash: { type: 'string', default: 'sha256' },
+            sign: { type: 'string', default: 'sha256' },
+            flow: { type: 'string', default: 'auto' },
+            token: { type: 'string' },
+            'oidc-issuer': { type: 'string' },
+            connector: { type: 'string' },
+            fulcio: { type: 'string' },
+            rekor: { type: 'string' },
+            tsa: { type: 'string' },
+        },
+    });
+    const app = positionals[0];
+    if (!values.output)
+        throw new Error('sea: --output is required');
+    if (Boolean(values.key) !== Boolean(values.chain))
+        throw new Error('sea: --key and --chain must be given together');
+    const SEA = await import('./sea.js');
+    // A policy baked into a runtime is the last word: it would be no policy at
+    // all if the command line could drop it. Nothing baked, nothing to seal —
+    // that runtime takes its policy from flags and the environment, the way
+    // `bundle run` does.
+    const bootstrap = {
+        roots: values.root,
+        identity: values.identity,
+        issuer: values.issuer,
+        allowUntrusted: values.untrusted,
+        sealed: Boolean(values.root?.length || values.identity || values.issuer),
+    };
+    if (!app) {
+        if (values.key || values.chain) {
+            throw new Error('sea: signing options need an archive to sign — a verifying node carries none');
+        }
+        if (values.base)
+            throw new Error('sea: --base reuses a runtime; without an archive there is nothing to add to it');
+        io.err('* building a verifying node (node runtime + verifier, no application)');
+        const built = await SEA.createSeaBase({
+            output: values.output,
+            node: values.node,
+            sigstore: values.sigstore,
+            bootstrap,
+        });
+        io.err(`* wrote ${built.output} (${built.size} bytes, ${built.verifier.length} verifier members)`);
+        io.err(`* run an archive with it: ${values.output} <archive> [args...]`);
+        return 0;
+    }
+    const signer = await chooseSigner(values, io);
+    const res = await SEA.buildSea({
+        app,
+        output: values.output,
+        node: values.node,
+        base: values.base,
+        sigstore: values.sigstore,
+        signer,
+        hashAlg: values.hash,
+        signAlg: values.sign,
+        bootstrap,
+        log: io.err,
+    });
+    if (res.output)
+        io.err(`* wrote ${res.output} (${res.size} bytes)`);
+    return 0;
+}
+// Refresh the sigstore trust root. Verification is deliberately offline — it
+// will not reach for the network to decide whether to mount something — so the
+// trust material has to be fetched by an explicit step like this one. It comes
+// over TUF, which is signed metadata with its own root of trust rather than a
+// plain download.
+async function trust(args, io) {
+    const { values } = parseArgs({ args, options: { mirror: { type: 'string' } } });
+    const SIGSTORE = await import('./sigstore.js');
+    const path = await SIGSTORE.refreshTrustedRoot(values.mirror ? { mirror: values.mirror } : {});
+    io.out(`sigstore trust root refreshed: ${path}`);
+    return 0;
+}
+// Install the auditing skill into a project, so whoever is about to run an
+// archive has the review procedure to hand rather than having to find it here.
+function skill(args, io) {
+    const { values, positionals } = parseArgs({
+        args,
+        allowPositionals: true,
+        options: {
+            dir: { type: 'string', short: 'd' },
+            force: { type: 'boolean', short: 'f' },
+            list: { type: 'boolean', short: 'l' },
+        },
+    });
+    const available = SKILLS.skills();
+    if (values.list) {
+        if (!available.length)
+            io.out('this package carries no skills');
+        for (const entry of available)
+            io.out(`${entry.name}\n  ${entry.description}`);
+        return 0;
+    }
+    const names = positionals.length ? positionals : available.map((entry) => entry.name);
+    if (!names.length)
+        throw new Error('skill: this package carries no skills to install');
+    for (const name of names) {
+        const res = SKILLS.install(name, { dir: values.dir, force: values.force });
+        for (const file of res.written)
+            io.err(`+ ${PATH.relative(process.cwd(), file)}`);
+        for (const file of res.skipped)
+            io.err(`= ${PATH.relative(process.cwd(), file)} (already there; --force to overwrite)`);
+        io.out(`installed skill '${res.name}' into ${PATH.relative(process.cwd(), res.path) || res.path}`);
+    }
+    return 0;
+}
+// Two signers, one interface. Either way the certificate has to be in hand
+// before the archive is built, because AUTHORITY.PEM carries it and
+// AUTHORITY.PEM is inside the region the hash covers — so this runs first and
+// the signature itself is made later, over the finished bytes.
+async function chooseSigner(values, io) {
+    if (values.key && values.chain) {
+        io.err('* signing against the supplied certificate chain');
+        return fileSigner({ key: values.key, chain: values.chain, signAlg: values.sign });
+    }
+    const SIGSTORE = await import('./sigstore.js');
+    io.err('* signing through sigstore');
+    return await SIGSTORE.signer({
+        signAlg: values.sign,
+        flow: values.flow,
+        token: values.token,
+        issuer: values['oidc-issuer'],
+        connector: values.connector,
+        fulcioURL: values.fulcio,
+        rekorURL: values.rekor,
+        tsaURL: values.tsa,
+        log: io.err,
+    });
+}
+function readStdin() {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        process.stdin.setEncoding('utf-8');
+        process.stdin.on('data', (chunk) => { data += chunk; })
+            .on('end', () => resolve(data))
+            .on('error', reject);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAmD,MAAM,eAAe,CAAC;AAEjG,+EAA+E;AAC/E,+EAA+E;AAC/E,yBAAyB;AACzB,OAAO,EAAE,MAAM,EAAE,CAAC;AAClB,OAAO,KAAK,MAAM,MAAM,YAAY,CAAC;AAErC,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,+BAA+B;AAE/B,MAAM,CAAC,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA2GkB,CAAC;AAQxC,MAAM,OAAO,GAAY;IACrB,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;CACxD,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAA8E;IAC/F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK;CAC7D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,EAAE,GAAY,OAAO;IAC5D,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACrD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACd,OAAO,CAAC,CAAC;QACb,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,EAAW;IAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QACzB,IAAI;QACJ,OAAO,EAAE;YACL,IAAI,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE;YACpD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,KAAK,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,GAAG,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,KAAK,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,IAAI,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;YAC7C,IAAI,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE;SAChD;KACJ,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAEvH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;IAC1F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAErE,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QACb,CAAC,CAAC,qBAAqB,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,IAAI,aAAa;QAChG,CAAC,CAAC,uBAAuB,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,IAAI,WAAW,CAAC,CAAC;IAE9E,MAAM,YAAY,CAAC;QACf,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;QACtE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI;QAC1C,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QACzD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC,CAAC;IACH,OAAO,CAAC,CAAC;AACb,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,EAAW;IAC3C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACL,MAAM,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC3C,QAAQ,EAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YAC3C,MAAM,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC3C,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YAC3C,GAAG,EAAS,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC3C,KAAK,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC3C,IAAI,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,QAAQ,EAAE;YAClD,IAAI,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,QAAQ,EAAE;YAClD,IAAI,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,MAAM,EAAE;YAChD,KAAK,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,SAAS,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,MAAM,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,KAAK,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,GAAG,EAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;SACjC;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACrH,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAExG,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAEhE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,YAAY,MAAM,KAAK,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;QACpE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM;KACrD,CAAC,CAAC;IACH,EAAE,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACb,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,EAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACL,OAAO,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE;YACxC,IAAI,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,MAAM,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACnC,IAAI,EAAM,EAAE,IAAI,EAAE,SAAS,EAAE;SAChC;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,eAAe,CAAC;KACvC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,MAAM,CAAC,GAAuB,EAAE,IAAa,EAAE,EAAW;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACP,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO;YAC1D,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YACzE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;YAC1C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;YAC/D,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,IAAI,EAAE,KAAK,CAAC,IAAI;SACnB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACb,OAAO;IACX,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,MAAM,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,4EAA4E;IAC5E,2EAA2E;IAC3E,UAAU;IACV,IAAI,GAAG,CAAC,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,IAAI,GAAG,CAAC,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,oEAAoE;AACpE,0BAA0B;AAC1B,SAAS,GAAG,CAAC,IAAc,EAAE,EAAW;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACL,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzD,QAAQ,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SACjC;KACJ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAElE,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACD,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM;YAC1E,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM;SACjD,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAK,GAAyB,CAAC,IAAI,KAAK,sBAAsB;YAAE,MAAM,GAAG,CAAC;QAC1E,MAAM,KAAK,GAAI,GAAqC,CAAC,KAAK,CAAC;QAC3D,EAAE,CAAC,GAAG,CAAC,UAAU,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,SAAS,KAAK,CAAC,IAAc,EAAE,EAAW;IACtC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACL,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YACzC,OAAO,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YACzC,IAAI,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YACzC,KAAK,EAAK,EAAE,IAAI,EAAE,SAAS,EAAE;YAC7B,OAAO,EAAG,EAAE,IAAI,EAAE,SAAS,EAAE;SAChC;KACJ,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAE/E,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9C,EAAE,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,OAAO,IAAI,MAAM,EAAE,CAAC,CAAC;QAClD,EAAE,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,QAAQ,IAAI,GAAG,OAAO,OAAO,CAAC,OAAO,IAAI,GAAG,qBAAqB;YACjF,GAAG,KAAK,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,cAAc;YAAE,EAAE,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACb,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClH,OAAO,CAAC,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,KAA0B,CAAC,EAAE,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IAC9H,EAAE,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC7B,EAAE,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjB,EAAE,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QACpF,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,WAAW,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,YAAY;YACvF,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,eAAe,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAAE,EAAE,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACJ,EAAE,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACtE,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IAChD,EAAE,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;IACvD,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ;QACjB,CAAC,CAAC,+BAA+B,MAAM,YAAY,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG;QACzE,CAAC,CAAC,+BAA+B,MAAM,GAAG,CAAC,CAAC;IAChD,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACzC,EAAE,CAAC,GAAG,CAAC,0DAA0D,MAAM,EAAE,CAAC,CAAC;IAC3E,EAAE,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,0EAA0E;AAC1E,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,EAAW;IAC1C,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACL,MAAM,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC1C,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,QAAQ,EAAG,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE;YAC7C,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC9B,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1D,QAAQ,EAAG,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,GAAG,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC1C,KAAK,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YAC1C,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,QAAQ,EAAE;YACjD,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,QAAQ,EAAE;YACjD,IAAI,EAAO,EAAE,IAAI,EAAE,QAAQ,EAAG,OAAO,EAAE,MAAM,EAAE;YAC/C,KAAK,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,MAAM,EAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,KAAK,EAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,GAAG,EAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;SAChC;KACJ,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAEpH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,qBAAqB;IACrB,MAAM,SAAS,GAAG;QACd,KAAK,EAAE,MAAM,CAAC,IAAI;QAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,cAAc,EAAE,MAAM,CAAC,SAAS;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC;KAC3E,CAAC;IAEF,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACnH,EAAE,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS;SACZ,CAAC,CAAC;QACH,EAAE,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAAC;QACnG,EAAE,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,MAAM,sBAAsB,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACb,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;QAC3B,GAAG;QACH,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;QACN,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,SAAS;QACT,GAAG,EAAE,EAAE,CAAC,GAAG;KACd,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM;QAAE,EAAE,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACb,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,kBAAkB;AAClB,KAAK,UAAU,KAAK,CAAC,IAAc,EAAE,EAAW;IAC5C,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,EAAE,CAAC,GAAG,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,2EAA2E;AAC3E,+EAA+E;AAC/E,SAAS,KAAK,CAAC,IAAc,EAAE,EAAW;IACtC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACL,GAAG,EAAI,EAAE,IAAI,EAAE,QAAQ,EAAG,KAAK,EAAE,GAAG,EAAE;YACtC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;YACtC,IAAI,EAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACzC;KACJ,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAChE,KAAK,MAAM,KAAK,IAAI,SAAS;YAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAEvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACxH,EAAE,CAAC,GAAG,CAAC,oBAAoB,GAAG,CAAC,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAgBD,2EAA2E;AAC3E,oEAAoE;AACpE,8EAA8E;AAC9E,+DAA+D;AAC/D,KAAK,UAAU,YAAY,CAAC,MAAoB,EAAE,EAAW;IACzD,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC7B,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAC3D,OAAO,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACrC,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,IAAI,EAAE,MAAM,CAAC,IAAwD;QACrE,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM;QACxB,QAAQ,EAAE,MAAM,CAAC,KAAK;QACtB,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,GAAG,EAAE,EAAE,CAAC,GAAG;KACd,CAAC,CAAC;AACP,CAAC;AAED,SAAS,SAAS;IACd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;aAC1D,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;aAC9B,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/files.d.ts

@@ -0,0 +1,53 @@
+export interface WalkOptions {
+    /** Directory names skipped wherever they appear (default: ['node_modules']). */
+    exclude?: string[] | undefined;
+}
+/**
+ * Every file under `dir`, as `/`-separated paths relative to it, sorted.
+ *
+ * A nested `node_modules` is skipped by default: its contents belong to the
+ * packages inside it, which `dependencyFiles` reaches through the dependency
+ * graph instead — so a hoisted tree and a nested one produce the same set.
+ */
+export declare function walk(dir: string, { exclude }?: WalkOptions, prefix?: string): string[];
+/**
+ * Every file of `names` and of everything they depend on, as paths relative to
+ * `base`, sorted. Packages are located the way node locates them, so the answer
+ * describes the tree that is actually installed rather than what a lock file
+ * says should be.
+ *
+ * A dependency that is not installed under `base` — missing, or hoisted above
+ * it, where no member path can name it — is an error rather than a silent
+ * omission, because a bundle whose closure is incomplete is a bundle that
+ * fails at runtime on a machine other than the one that built it. Only an
+ * optional dependency may be absent.
+ */
+export declare function dependencyFiles(names: string[], base: string): string[];
+export interface ModuleFilesOptions {
+    /** Directory the result is relative to. */
+    base: string;
+    /** Individual files to include, relative to `base`. */
+    files?: string[] | undefined;
+    /** Directories to include whole, relative to `base`. */
+    dirs?: string[] | undefined;
+    /** Package names whose dependency closure to include. */
+    dependencies?: string[] | undefined;
+    /** Keep only files matching one of these; a bare extension counts. */
+    filter?: ((name: string) => boolean) | undefined;
+}
+/** The three sources above, combined and de-duplicated. */
+export declare function moduleFiles({ base, files, dirs, dependencies, filter }: ModuleFilesOptions): string[];
+/**
+ * The shell launcher this package ships: the prefix that turns an archive into
+ * a file you can run by name. `bundle sign --launcher` uses it, so nobody has
+ * to know it lives inside `node_modules`.
+ */
+export declare function launcherPath(): string;
+/** This package's own root — the directory its `package.json` sits in. */
+export declare function packageRoot(): string;
+/**
+ * The directory this package's runnable modules are in: `dist` once compiled,
+ * `src` when the source is being run directly under node's type stripping.
+ */
+export declare function moduleDir(): string;
+//# sourceMappingURL=files.d.ts.map

package/dist/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../src/files.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IACxB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAA0B,EAAE,GAAE,WAAgB,EAAE,MAAM,SAAK,GAAG,MAAM,EAAE,CASzG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkCvE;AAkBD,MAAM,WAAW,kBAAkB;IAC/B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5B,yDAAyD;IACzD,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,SAAS,CAAC;CACpD;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,EAAE,IAAI,EAAE,KAAU,EAAE,IAAS,EAAE,YAAiB,EAAE,MAAM,EAAE,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAQpH;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,0EAA0E;AAC1E,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;;GAGG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAElC"}