@ploaness/cli 1.0.0

package/dist/checks/dependencies.js

@@ -0,0 +1,389 @@
+// Dependency gates. A license is a fixed fact of a package version, so it changes state only when you add
+// or upgrade something: a true signal about your change. Freshness is bounded rather than banned, because
+// "a newer version exists" is not a property of your change, but "the version I declared is two majors
+// behind" is, and that is a real liability.
+import { realpathSync } from 'node:fs';
+import path from 'node:path';
+import { asRecord, asText, collectCoordinates, findFreshnessViolations, findLicenseViolations, HARNESS_EXCEPTIONS, HARNESS_PACKAGE, hoursPublished, inheritedManifestPaths, isArray, isHeldByReleaseAge, isRecord, judgeVulnerabilities, mapWithConcurrency, NETWORKED_TOOL_TIMEOUT_MS, REGISTRY_CONCURRENCY, RELEASE_AGE_FLOOR_HOURS, REQUEST_TIMEOUT_MS, } from '@ploaness/governance';
+import { manifestPathFrom, readJson, trackedFiles } from '../context.js';
+import { failed, passed, run, TIMED_OUT_CODE, withOutput, } from '../exec.js';
+import { imageFreshness } from './images.js';
+/** Every dependency license must sit inside the allowlist. */
+// Report enough of a tool's raw output to diagnose it, without pasting a whole log into a finding.
+const MAX_REPORTED_CHARS = 2000;
+const MAX_REPORTED_LINES = 5;
+const MAX_LISTED_NAMES = 10;
+// The registry answers with this status for a package it has never published.
+const NOT_FOUND = 404;
+export const licenses = (context) => {
+    const result = run('pnpm', ['licenses', 'list', '--json'], { cwd: context.root });
+    if (result.code !== 0) {
+        return failed('the license inventory could not be produced', [result.output]);
+    }
+    // `stdout`, not `output`. pnpm writes ` WARN ` lines to stderr as a matter of course, and `output`
+    // concatenates the two streams with no separator - so a warning about an unsupported engine made the
+    // inventory unparseable and this gate blamed the parse rather than the warning.
+    const grouped = parseLicenseInventory(result.stdout);
+    if (grouped === undefined) {
+        return failed('the license inventory was not valid JSON', [
+            result.output.slice(0, MAX_REPORTED_CHARS),
+        ]);
+    }
+    const packages = Object.values(grouped)
+        .flat()
+        .map((entry) => ({
+        name: entry.name,
+        license: entry.license,
+    }));
+    const violations = findLicenseViolations(packages);
+    return withOutput(violations.length > 0
+        ? failed(`${String(violations.length)} dependency license(s) outside policy`, violations.map((entry) => `${entry.name}: ${entry.license}`))
+        : passed(`all ${String(packages.length)} dependency licenses are within policy`), result.stdout);
+};
+const MANIFEST_NAME = 'package.json';
+// Every manifest the repository tracks, not only the root one. A workspace declares its toolchain across
+// several of them, and reading the root alone left every analyzer ploaness itself runs on unmeasured.
+const trackedManifests = (context) => trackedFiles(context.root)
+    .filter((file) => file === MANIFEST_NAME || file.endsWith(`/${MANIFEST_NAME}`))
+    .map((file) => ({
+    path: file,
+    packageJson: readJson(path.join(context.root, file)),
+    isInherited: false,
+}));
+// A path as the filesystem finally names it, so the same manifest reached two ways compares equal.
+// Under pnpm every installed package is a symlink into the store, and in a workspace it is a symlink
+// back into the tree - which is how an inherited manifest can turn out to be a tracked one.
+const realPathOrSelf = (file) => {
+    try {
+        return realpathSync(file);
+    }
+    catch {
+        return file;
+    }
+};
+// The one place the walk touches the filesystem. Everything it decides - which dependencies to follow,
+// how a diamond and a cycle are handled - is in @ploaness/governance, where a spec states it without
+// building an install.
+const HARNESS_RESOLVER = { locate: manifestPathFrom, read: readJson };
+// A manifest names itself, which is what a finding should say. The path under node_modules is a store
+// address that differs between two installs of the same version, so it identifies nothing a reader can
+// act on.
+const declaredName = (packageJson, fallback) => asText(asRecord(packageJson)['name']) || fallback;
+// The manifests a project INHERITS: `ploaness` as the project itself resolves it, and every ploaness
+// package that one pulls in. The standard counts these as declared coordinates, and they are the
+// manifests that decide which analyzer versions the project's gates actually run - none of which the
+// project tracks, so a reader of tracked files alone could never see them. That is why a consumer's
+// update report was silent about a harness pin going stale while ploaness's own report was not.
+const inheritedManifests = (context, tracked) => {
+    const alreadyRead = new Set(tracked.map((manifest) => realPathOrSelf(path.join(context.root, manifest.path))));
+    const entry = manifestPathFrom(HARNESS_PACKAGE, path.join(context.root, MANIFEST_NAME));
+    return inheritedManifestPaths(entry, HARNESS_RESOLVER)
+        .filter((file) => !alreadyRead.has(realPathOrSelf(file)))
+        .map((file) => {
+        const packageJson = readJson(file);
+        return {
+            path: `${declaredName(packageJson, file)}/${MANIFEST_NAME}`,
+            packageJson,
+            isInherited: true,
+        };
+    });
+};
+const manifestSources = (context) => {
+    const tracked = trackedManifests(context);
+    return [...tracked, ...inheritedManifests(context, tracked)];
+};
+// The registry exposes two documents per package: the packument root and, per version, a version
+// document. `/{name}/latest` is the version document for the `latest` dist-tag and costs a few kilobytes,
+// while the packument root costs tens of megabytes for a package as long-lived as `next`. Freshness needs
+// one string, so the version document is the right request. It must NOT carry the abbreviated-packument
+// accept type: that media type is defined only for the packument root, and the registry answers 406 for
+// it here - inconsistently, because the CDN serves whichever representation it already holds.
+const REGISTRY_ATTEMPTS = 3;
+const versionDocumentUrl = (name) => `https://registry.npmjs.org/${encodeURIComponent(name).replace('%40', '@')}/latest`;
+const parseLicenseInventory = (output) => {
+    try {
+        return JSON.parse(output);
+    }
+    catch {
+        return undefined;
+    }
+};
+// A deadline on every attempt, not on the lookup as a whole. A registry that accepts the connection and
+// then says nothing is the failure this catches, and it is the one an unbounded `fetch` waits out
+// forever: `REGISTRY_ATTEMPTS` retries an inconclusive attempt, but an attempt that never concludes is
+// never retried either. Three bounded attempts fail in a knowable time; one unbounded attempt does not
+// fail at all.
+/** One registry attempt: an answer, or undefined when the attempt was inconclusive and may be retried. */
+const fetchOrUndefined = async (name) => {
+    try {
+        return await fetch(versionDocumentUrl(name), {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return undefined;
+    }
+};
+const attemptLookup = async (name) => {
+    const response = await fetchOrUndefined(name);
+    if (response === undefined) {
+        return undefined;
+    }
+    if (response.ok) {
+        const body = await response.json();
+        const version = asRecord(body)['version'];
+        return typeof version === 'string' ? { kind: 'version', version } : { kind: 'absent' };
+    }
+    // A 404 is a real answer, and retrying cannot change it.
+    return response.status === NOT_FOUND ? { kind: 'absent' } : undefined;
+};
+const latestVersion = async (name, attemptsLeft = REGISTRY_ATTEMPTS) => {
+    if (attemptsLeft <= 0) {
+        return { kind: 'unreachable' };
+    }
+    const lookup = await attemptLookup(name);
+    return lookup ?? (await latestVersion(name, attemptsLeft - 1));
+};
+const sortLookups = (coordinates, lookups) => {
+    const namesWhere = (kind) => [...lookups]
+        .filter(([, lookup]) => lookup.kind === kind)
+        .map(([name]) => name);
+    const statuses = coordinates.flatMap((coordinate) => {
+        const lookup = lookups.get(coordinate.name);
+        if (lookup?.kind !== 'version') {
+            return [];
+        }
+        return [{ ...coordinate, latest: lookup.version }];
+    });
+    return {
+        statuses,
+        unreachable: namesWhere('unreachable'),
+        unpublished: namesWhere('absent'),
+    };
+};
+// The version document carries no publication date, and the packument root that does costs tens of
+// megabytes for a package as long-lived as `next`. The search document is a kilobyte and names the
+// latest version beside its date, which is the only affordable answer to "how old is this release".
+// It is asked ONLY for a coordinate the report already names - a handful, not every dependency - and
+// every miss is silent: search matches by relevance rather than exactly, so a document naming another
+// package or another version answers nothing, and an unknown date reports the update the ordinary way.
+const searchDocumentUrl = (name) => `https://registry.npmjs.org/-/v1/search?text=${encodeURIComponent(name)}&size=1`;
+const publishedAt = async (name, version) => {
+    try {
+        const response = await fetch(searchDocumentUrl(name), {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            return undefined;
+        }
+        const objects = asRecord(await response.json())['objects'];
+        const first = isArray(objects) ? objects[0] : undefined;
+        const found = asRecord(asRecord(first)['package']);
+        if (found['name'] !== name || found['version'] !== version) {
+            return undefined;
+        }
+        const date = found['date'];
+        const parsed = typeof date === 'string' ? Date.parse(date) : Number.NaN;
+        return Number.isNaN(parsed) ? undefined : parsed;
+    }
+    catch {
+        return undefined;
+    }
+};
+// The manifest leads the line because it is what the reader has to open. The standard asks the update
+// report to name it for every coordinate, and a workspace pinning one analyzer in two places is exactly
+// the case where the bare package name says nothing about where to make the change.
+const describeFinding = (finding) => `${finding.owner} ${finding.name}: declared ${finding.current}, latest ${finding.latest}`;
+// A line names its repair, and for an inherited coordinate that is not the repair every other line
+// names. The project cannot edit a version ploaness declares, so "change the declaration" would be
+// advice it has no file to act on; upgrading the harness is the move, and reporting it is the move when
+// no release carries the newer pin yet. The same answer `HARNESS_EXCEPTIONS` gives for an advisory
+// carried by ploaness's own chain.
+const HARNESS_REPAIR = ' - declared by ploaness rather than by the project, so upgrade ploaness, or report it if no ' +
+    'release carries the newer pin';
+// `stale`, not `update`, for a coordinate past the bound that does not stop this build. Printed as an
+// ordinary update it would bury the one line saying the harness itself is overdue among a dozen saying
+// a patch release exists.
+const describeReported = (finding) => finding.verdict === 'fail'
+    ? `stale ${describeFinding(finding)}; past the freshness bound${HARNESS_REPAIR}`
+    : `update ${describeFinding(finding)}`;
+// `held`, not `update`, for a release pnpm will refuse for being too young. Naming it as an ordinary
+// update sends the reader to an install that fails, and the way past that failure is an exclusion from
+// the very guard the wait exists to keep. It says the age so the reader can see how short the wait is.
+const describeHeld = (finding, hours) => {
+    const age = hours === undefined ? 'recently' : `${String(hours)}h ago`;
+    return (`held ${finding.owner} ${finding.name}: latest ${finding.latest}, published ${age}; below the ` +
+        `${String(RELEASE_AGE_FLOOR_HOURS)}h release-age floor pnpm enforces, so it installs once it ages`);
+};
+// A date is asked for only where it can change the line: a coordinate already past the bound is stale
+// whatever its age, and one this project cannot edit is reported to a different address entirely.
+const isHeldCandidate = (finding) => finding.verdict === 'update' && !finding.isInherited;
+const describeUpdates = async (reported, now) => await mapWithConcurrency(reported, REGISTRY_CONCURRENCY, async (finding) => {
+    if (!isHeldCandidate(finding)) {
+        return describeReported(finding);
+    }
+    const age = {
+        publishedAt: await publishedAt(finding.name, finding.latest),
+        now,
+    };
+    return isHeldByReleaseAge(age)
+        ? describeHeld(finding, hoursPublished(age))
+        : describeReported(finding);
+});
+// One lookup per distinct name, fanned back out across the coordinates that share it. A workspace
+// declaring the same analyzer in three manifests must not ask the registry three times.
+//
+// Windowed rather than all at once. `Promise.all` over the distinct names opened a socket per dependency
+// - several hundred on a real workspace - which is what a public registry rate-limits and what a
+// corporate proxy drops. Both arrive here as `unreachable`, so the gate blamed the network for a load
+// the harness itself had generated.
+const lookUpEach = async (names) => new Map(await mapWithConcurrency(names, REGISTRY_CONCURRENCY, async (name) => {
+    try {
+        return [name, await latestVersion(name)];
+    }
+    catch {
+        return [name, { kind: 'unreachable' }];
+    }
+}));
+/**
+ * Fail when a declared dependency is two or more majors behind its latest release; report any lesser
+ * lag as an available update. This gate is fail-closed: it cannot prove freshness
+ * without the registry, so it fails rather than passing silently. A dependency the registry does not
+ * publish at all - a private or workspace-linked package - is reported rather than judged, because a
+ * public "latest" it has no claim to would be a fabricated comparison.
+ */
+// The images the harness pins are versioned inputs like the coordinates are, and they are read first so
+// a registry that cannot answer fails before the longer npm fan-out runs. An image never fails for being
+// behind; it fails only where the guideline says a freshness check does, which is when nothing can
+// establish what is current.
+const imagesUnprovable = (images) => images.failure === undefined
+    ? undefined
+    : failed('image freshness cannot be proven', [
+        images.failure,
+        'this gate is fail-closed by design; retry with network access',
+    ]);
+// The summary may not claim every coordinate is within the bound while the report below it lists one
+// that is not. A harness pin past the bound does not stop this build, and a pass that said nothing about
+// it would leave the only line that matters to be found by reading. The images are counted here too:
+// they are versioned inputs the same rule covers, so a summary naming only coordinates would understate
+// what the gate read.
+const freshnessSummary = (statuses, manifests, report, images) => {
+    const inherited = manifests.filter((manifest) => manifest.isInherited).length;
+    const overdue = report.reported.filter((finding) => finding.verdict === 'fail').length;
+    const counted = `${String(statuses.length)} declared coordinate(s) across ${String(manifests.length)} ` +
+        `manifest(s), ${String(inherited)} inherited, and ${String(images.scanned)} pinned image(s)`;
+    return overdue > 0
+        ? `${counted}; ${String(overdue)} inherited coordinate(s) past the bound, reported not failed`
+        : `${counted}, are within the freshness bound`;
+};
+export const dependencyFreshness = async (context) => {
+    const images = await imageFreshness();
+    const unprovable = imagesUnprovable(images);
+    if (unprovable !== undefined) {
+        return unprovable;
+    }
+    const manifests = manifestSources(context);
+    const coordinates = collectCoordinates(manifests);
+    const names = [
+        ...new Set(coordinates.map((coordinate) => coordinate.name)),
+    ];
+    const { statuses, unreachable, unpublished } = sortLookups(coordinates, await lookUpEach(names));
+    if (unreachable.length > 0) {
+        return failed('the npm registry was unreachable, so freshness cannot be proven', [
+            `no "latest" resolved for: ${unreachable.slice(0, MAX_LISTED_NAMES).join(', ')}`,
+            // Stated so a reader can tell a registry that refused from one that never answered. Both land
+            // here, and only the second is worth investigating as a proxy or firewall rather than as an
+            // outage - which is unreadable from a message that says only "unreachable".
+            `each of ${String(REGISTRY_ATTEMPTS)} attempt(s) was given ${String(REQUEST_TIMEOUT_MS)}ms, so ` +
+                'a name listed above was either refused or never answered within that bound',
+            'this gate is fail-closed by design; retry with network access',
+        ]);
+    }
+    const notes = unpublished.map((name) => `note ${name} is not on the public registry, so freshness is not measurable`);
+    const report = findFreshnessViolations(statuses);
+    if (report.failures.length > 0) {
+        return failed(`${String(report.failures.length)} dependency/dependencies are two or more majors behind`, [
+            ...report.failures.map((finding) => describeFinding(finding)),
+            ...(await describeUpdates(report.reported, Date.now())),
+            ...images.lines,
+            ...notes,
+        ]);
+    }
+    return passed(freshnessSummary(statuses, manifests, report, images), [
+        ...(await describeUpdates(report.reported, Date.now())),
+        ...images.lines,
+        ...notes,
+    ]);
+};
+const asStrings = (raw) => isArray(raw) ? raw.filter((entry) => typeof entry === 'string') : [];
+const textAt = (raw, key, fallback) => {
+    const found = asText(raw[key]);
+    return found.length > 0 ? found : fallback;
+};
+const asAdvisory = (key, raw) => ({
+    id: textAt(raw, 'github_advisory_id', key),
+    packageName: textAt(raw, 'module_name', 'unknown'),
+    // An advisory whose severity the record does not carry is read as the most severe, not the least.
+    // Defaulting to `info` put it below the threshold, so a malformed record was silently a pass inside a
+    // gate that is fail-closed everywhere else.
+    severity: textAt(raw, 'severity', 'unknown'),
+    title: textAt(raw, 'title', 'no title reported'),
+    aliases: asStrings(raw['cves']),
+});
+// `pnpm audit` exits non-zero whenever it finds anything, so the exit code carries no information the
+// JSON does not. The verdict comes from the payload; only an unparseable payload means the database was
+// unreachable, and that is a failure like any other - a check that cannot run is a fail.
+const parseAudit = (output) => {
+    try {
+        const parsed = JSON.parse(output);
+        if (!(isRecord(parsed) && isRecord(parsed['metadata']))) {
+            return undefined;
+        }
+        return Object.entries(asRecord(parsed['advisories'])).map(([key, raw]) => asAdvisory(key, asRecord(raw)));
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Read every package in the resolved set against the public advisory database.
+ * @param context the resolved project environment.
+ * @returns a failure for any finding at or above the declared severity, or for a stale exception.
+ */
+export const vulnerabilities = (context) => {
+    // No `--prod` filter: the standard is explicit that build and test packages count, because a build
+    // tool runs with build privileges and its vulnerability is reachable by anyone who can change the repo.
+    // Deadlined because it asks the advisory database over the network. Without one, a registry that
+    // accepts the connection and stalls holds the whole verification open with nothing printed.
+    const result = run('pnpm', ['audit', '--json'], {
+        cwd: context.root,
+        timeoutMs: NETWORKED_TOOL_TIMEOUT_MS,
+    });
+    // `stdout` for the reason the licence gate reads it: a pnpm warning on stderr used to be concatenated
+    // into the payload and reported as the advisory database being unreachable.
+    const advisories = parseAudit(result.stdout);
+    if (advisories === undefined) {
+        return failed('the advisory database was unreachable, so vulnerabilities cannot be proven', [
+            ...(result.code === TIMED_OUT_CODE
+                ? [`the audit did not answer within ${String(NETWORKED_TOOL_TIMEOUT_MS)}ms and was stopped`]
+                : []),
+            result.output.split('\n').slice(0, MAX_REPORTED_LINES).join('\n'),
+            'this gate is fail-closed by design; retry with network access',
+        ]);
+    }
+    const report = judgeVulnerabilities(advisories, context.settings.vulnerabilityAllowlist, context.settings.vulnerabilitySeverity, HARNESS_EXCEPTIONS);
+    const findings = [
+        ...report.unsuppressed.map((advisory) => `${advisory.severity} ${advisory.id} in ${advisory.packageName}: ${advisory.title}`),
+        ...report.deadEntries,
+    ];
+    // The evidence is the audit pnpm printed, kept whatever the verdict. A gate that reaches its verdict
+    // by PARSING a tool rather than by its exit status is exactly the one a reader wants to audit, and
+    // dropping the transcript here would leave `--verbose` answering "no output" on the gate that most
+    // needs an answer.
+    return withOutput(findings.length > 0
+        ? failed(`${String(findings.length)} vulnerability finding(s) at or above ${report.threshold}`, findings)
+        : passed(`no vulnerability at or above ${report.threshold} across ${String(advisories.length)} advisory record(s)`), result.stdout);
+};
+//# sourceMappingURL=dependencies.js.map

package/dist/checks/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../src/checks/dependencies.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,0GAA0G;AAC1G,uGAAuG;AACvG,4CAA4C;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAEL,QAAQ,EACR,MAAM,EACN,kBAAkB,EAKlB,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,OAAO,EACP,kBAAkB,EAClB,QAAQ,EACR,oBAAoB,EAIpB,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,GAGnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACtF,OAAO,EACL,MAAM,EAEN,MAAM,EAEN,GAAG,EACH,cAAc,EACd,UAAU,GACX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAoB,cAAc,EAAE,MAAM,aAAa,CAAA;AAO9D,8DAA8D;AAC9D,mGAAmG;AACnG,MAAM,kBAAkB,GAAW,IAAI,CAAA;AACvC,MAAM,kBAAkB,GAAW,CAAC,CAAA;AACpC,MAAM,gBAAgB,GAAW,EAAE,CAAA;AACnC,8EAA8E;AAC9E,MAAM,SAAS,GAAW,GAAG,CAAA;AAE7B,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAgB,EAAc,EAAE;IACvD,MAAM,MAAM,GAAc,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IAC5F,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,6CAA6C,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/E,CAAC;IACD,mGAAmG;IACnG,qGAAqG;IACrG,gFAAgF;IAChF,MAAM,OAAO,GAA4D,qBAAqB,CAC5F,MAAM,CAAC,MAAM,CACd,CAAA;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,0CAA0C,EAAE;YACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC;SAC3C,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,QAAQ,GAA+B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAChE,IAAI,EAAE;SACN,GAAG,CACF,CAAC,KAAuB,EAAmB,EAAE,CAAC,CAAC;QAC7C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CACH,CAAA;IACH,MAAM,UAAU,GAA+B,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC9E,OAAO,UAAU,CACf,UAAU,CAAC,MAAM,GAAG,CAAC;QACnB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,uCAAuC,EACnE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CACtF;QACH,CAAC,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wCAAwC,CAAC,EAClF,MAAM,CAAC,MAAM,CACd,CAAA;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAW,cAAc,CAAA;AAE5C,yGAAyG;AACzG,sGAAsG;AACtG,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAA6B,EAAE,CACvE,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;KACvB,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,CAAC;KAC/F,GAAG,CACF,CAAC,IAAY,EAAkB,EAAE,CAAC,CAAC;IACjC,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,WAAW,EAAE,KAAK;CACnB,CAAC,CACH,CAAA;AAEL,mGAAmG;AACnG,qGAAqG;AACrG,4FAA4F;AAC5F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE;IAC9C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,qGAAqG;AACrG,uBAAuB;AACvB,MAAM,gBAAgB,GAAqB,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;AAEvF,sGAAsG;AACtG,uGAAuG;AACvG,UAAU;AACV,MAAM,YAAY,GAAG,CAAC,WAAoB,EAAE,QAAgB,EAAU,EAAE,CACtE,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAA;AAEnD,qGAAqG;AACrG,iGAAiG;AACjG,qGAAqG;AACrG,oGAAoG;AACpG,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,CACzB,OAAgB,EAChB,OAAkC,EACP,EAAE;IAC7B,MAAM,WAAW,GAAwB,IAAI,GAAG,CAC9C,OAAO,CAAC,GAAG,CAAC,CAAC,QAAwB,EAAU,EAAE,CAC/C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CACvD,CACF,CAAA;IACD,MAAM,KAAK,GAAuB,gBAAgB,CAChD,eAAe,EACf,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CACvC,CAAA;IACD,OAAO,sBAAsB,CAAC,KAAK,EAAE,gBAAgB,CAAC;SACnD,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;SACzE,GAAG,CAAC,CAAC,IAAY,EAAkB,EAAE;QACpC,MAAM,WAAW,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3C,OAAO;YACL,IAAI,EAAE,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,aAAa,EAAE;YAC3D,WAAW;YACX,WAAW,EAAE,IAAI;SAClB,CAAA;IACH,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,OAAgB,EAA6B,EAAE;IACtE,MAAM,OAAO,GAA8B,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACpE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED,iGAAiG;AACjG,0GAA0G;AAC1G,0GAA0G;AAC1G,wGAAwG;AACxG,wGAAwG;AACxG,8FAA8F;AAC9F,MAAM,iBAAiB,GAAW,CAAC,CAAA;AAEnC,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAU,EAAE,CAClD,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAA;AAYrF,MAAM,qBAAqB,GAAG,CAC5B,MAAc,EAC2C,EAAE;IAC3D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAgD,CAAA;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,wGAAwG;AACxG,kGAAkG;AAClG,uGAAuG;AACvG,uGAAuG;AACvG,eAAe;AACf,0GAA0G;AAC1G,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAY,EAAiC,EAAE;IAC7E,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE;YAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAA+B,EAAE;IACxE,MAAM,QAAQ,GAAyB,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC3C,MAAM,OAAO,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAA;QAClD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IACxF,CAAC;IACD,yDAAyD;IACzD,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,KAAK,EACzB,IAAY,EACZ,eAAuB,iBAAiB,EACvB,EAAE;IACnB,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;IAChC,CAAC;IACD,MAAM,MAAM,GAAuB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5D,OAAO,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,CAAC,CAAA;AAChE,CAAC,CAAA;AASD,MAAM,WAAW,GAAG,CAClB,WAA0C,EAC1C,OAAoC,EAC5B,EAAE;IACV,MAAM,UAAU,GAAG,CAAC,IAAoB,EAAqB,EAAE,CAC7D,CAAC,GAAG,OAAO,CAAC;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAA4B,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;SAChF,GAAG,CAAC,CAAC,CAAC,IAAI,CAA4B,EAAU,EAAE,CAAC,IAAI,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAgC,WAAW,CAAC,OAAO,CAC/D,CAAC,UAA8B,EAA+B,EAAE;QAC9D,MAAM,MAAM,GAAuB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QAC/D,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAA;QACX,CAAC;QACD,OAAO,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC,CACF,CAAA;IACD,OAAO;QACL,QAAQ;QACR,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC;QACtC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;KAClC,CAAA;AACH,CAAC,CAAA;AAED,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAU,EAAE,CACjD,+CAA+C,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAA;AAElF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAE,OAAe,EAA+B,EAAE;IACvF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAa,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE;YAC9D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,OAAO,GAAY,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;QACnE,MAAM,KAAK,GAAY,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,MAAM,KAAK,GAA4B,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;QAC3E,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,OAAO,EAAE,CAAC;YAC3D,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,IAAI,GAAY,KAAK,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,MAAM,GAAW,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,sGAAsG;AACtG,wGAAwG;AACxG,oFAAoF;AACpF,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC5D,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,cAAc,OAAO,CAAC,OAAO,YAAY,OAAO,CAAC,MAAM,EAAE,CAAA;AAE3F,mGAAmG;AACnG,mGAAmG;AACnG,wGAAwG;AACxG,mGAAmG;AACnG,mCAAmC;AACnC,MAAM,cAAc,GAClB,8FAA8F;IAC9F,+BAA+B,CAAA;AAEjC,sGAAsG;AACtG,uGAAuG;AACvG,0BAA0B;AAC1B,MAAM,gBAAgB,GAAG,CAAC,OAAyB,EAAU,EAAE,CAC7D,OAAO,CAAC,OAAO,KAAK,MAAM;IACxB,CAAC,CAAC,SAAS,eAAe,CAAC,OAAO,CAAC,6BAA6B,cAAc,EAAE;IAChF,CAAC,CAAC,UAAU,eAAe,CAAC,OAAO,CAAC,EAAE,CAAA;AAE1C,qGAAqG;AACrG,uGAAuG;AACvG,uGAAuG;AACvG,MAAM,YAAY,GAAG,CAAC,OAAyB,EAAE,KAAyB,EAAU,EAAE;IACpF,MAAM,GAAG,GAAW,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAA;IAC9E,OAAO,CACL,QAAQ,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,MAAM,eAAe,GAAG,cAAc;QAC/F,GAAG,MAAM,CAAC,uBAAuB,CAAC,gEAAgE,CACnG,CAAA;AACH,CAAC,CAAA;AAED,sGAAsG;AACtG,kGAAkG;AAClG,MAAM,eAAe,GAAG,CAAC,OAAyB,EAAW,EAAE,CAC7D,OAAO,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,WAAW,CAAA;AAEtD,MAAM,eAAe,GAAG,KAAK,EAC3B,QAAqC,EACrC,GAAW,EACiB,EAAE,CAC9B,MAAM,kBAAkB,CACtB,QAAQ,EACR,oBAAoB,EACpB,KAAK,EAAE,OAAyB,EAAmB,EAAE;IACnD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,GAAG,GAAe;QACtB,WAAW,EAAE,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;QAC5D,GAAG;KACJ,CAAA;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC;QAC5B,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC,CACF,CAAA;AAEH,kGAAkG;AAClG,wFAAwF;AACxF,EAAE;AACF,yGAAyG;AACzG,iGAAiG;AACjG,sGAAsG;AACtG,oCAAoC;AACpC,MAAM,UAAU,GAAG,KAAK,EAAE,KAAwB,EAAwC,EAAE,CAC1F,IAAI,GAAG,CACL,MAAM,kBAAkB,CACtB,KAAK,EACL,oBAAoB,EACpB,KAAK,EAAE,IAAY,EAAsC,EAAE;IACzD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAA;IACxC,CAAC;AACH,CAAC,CACF,CACF,CAAA;AAEH;;;;;;GAMG;AACH,wGAAwG;AACxG,yGAAyG;AACzG,mGAAmG;AACnG,6BAA6B;AAC7B,MAAM,gBAAgB,GAAG,CAAC,MAAmB,EAA0B,EAAE,CACvE,MAAM,CAAC,OAAO,KAAK,SAAS;IAC1B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,MAAM,CAAC,kCAAkC,EAAE;QACzC,MAAM,CAAC,OAAO;QACd,+DAA+D;KAChE,CAAC,CAAA;AAER,qGAAqG;AACrG,yGAAyG;AACzG,qGAAqG;AACrG,wGAAwG;AACxG,sBAAsB;AACtB,MAAM,gBAAgB,GAAG,CACvB,QAAqC,EACrC,SAAoC,EACpC,MAAuB,EACvB,MAAmB,EACX,EAAE;IACV,MAAM,SAAS,GAAW,SAAS,CAAC,MAAM,CACxC,CAAC,QAAwB,EAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAC5D,CAAC,MAAM,CAAA;IACR,MAAM,OAAO,GAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,CAC5C,CAAC,OAAyB,EAAW,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,MAAM,CACnE,CAAC,MAAM,CAAA;IACR,MAAM,OAAO,GACX,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kCAAkC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;QACvF,gBAAgB,MAAM,CAAC,SAAS,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAA;IAC9F,OAAO,OAAO,GAAG,CAAC;QAChB,CAAC,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,8DAA8D;QAC9F,CAAC,CAAC,GAAG,OAAO,kCAAkC,CAAA;AAClD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,OAAgB,EAAuB,EAAE;IACjF,MAAM,MAAM,GAAgB,MAAM,cAAc,EAAE,CAAA;IAClD,MAAM,UAAU,GAA2B,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACnE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,MAAM,SAAS,GAA8B,eAAe,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,WAAW,GAAkC,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAChF,MAAM,KAAK,GAAsB;QAC/B,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAA8B,EAAU,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;KACzF,CAAA;IACD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,GAAW,WAAW,CAChE,WAAW,EACX,MAAM,UAAU,CAAC,KAAK,CAAC,CACxB,CAAA;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,iEAAiE,EAAE;YAC/E,6BAA6B,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChF,8FAA8F;YAC9F,4FAA4F;YAC5F,4EAA4E;YAC5E,WAAW,MAAM,CAAC,iBAAiB,CAAC,yBAAyB,MAAM,CAAC,kBAAkB,CAAC,SAAS;gBAC9F,4EAA4E;YAC9E,+DAA+D;SAChE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAAsB,WAAW,CAAC,GAAG,CAC9C,CAAC,IAAY,EAAU,EAAE,CACvB,QAAQ,IAAI,gEAAgE,CAC/E,CAAA;IACD,MAAM,MAAM,GAAoB,uBAAuB,CAAC,QAAQ,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CACX,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,wDAAwD,EACzF;YACE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAyB,EAAU,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACvF,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvD,GAAG,MAAM,CAAC,KAAK;YACf,GAAG,KAAK;SACT,CACF,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE;QACnE,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,GAAG,MAAM,CAAC,KAAK;QACf,GAAG,KAAK;KACT,CAAC,CAAA;AACJ,CAAC,CAAA;AASD,MAAM,SAAS,GAAG,CAAC,GAAY,EAAqB,EAAE,CACpD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAEhG,MAAM,MAAM,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,QAAgB,EAAU,EAAE;IAC3E,MAAM,KAAK,GAAW,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,GAAkB,EAAY,EAAE,CAAC,CAAC;IACjE,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC;IAClD,kGAAkG;IAClG,sGAAsG;IACtG,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,CAAC;IAChD,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC,CAAC,CAAA;AAEF,sGAAsG;AACtG,wGAAwG;AACxG,yFAAyF;AACzF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAmC,EAAE;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CACvD,CAAC,CAAC,GAAG,EAAE,GAAG,CAA6B,EAAY,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC9D,mGAAmG;IACnG,wGAAwG;IACxG,iGAAiG;IACjG,4FAA4F;IAC5F,MAAM,MAAM,GAAc,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QACzD,GAAG,EAAE,OAAO,CAAC,IAAI;QACjB,SAAS,EAAE,yBAAyB;KACrC,CAAC,CAAA;IACF,sGAAsG;IACtG,4EAA4E;IAC5E,MAAM,UAAU,GAAoC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,4EAA4E,EAAE;YAC1F,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,cAAc;gBAChC,CAAC,CAAC,CAAC,mCAAmC,MAAM,CAAC,yBAAyB,CAAC,oBAAoB,CAAC;gBAC5F,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACjE,+DAA+D;SAChE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,oBAAoB,CACtD,UAAU,EACV,OAAO,CAAC,QAAQ,CAAC,sBAAsB,EACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,EACtC,kBAAkB,CACnB,CAAA;IACD,MAAM,QAAQ,GAAsB;QAClC,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CACxB,CAAC,QAAkB,EAAU,EAAE,CAC7B,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,CAAC,KAAK,EAAE,CACtF;QACD,GAAG,MAAM,CAAC,WAAW;KACtB,CAAA;IACD,qGAAqG;IACrG,mGAAmG;IACnG,mGAAmG;IACnG,mBAAmB;IACnB,OAAO,UAAU,CACf,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC,MAAM,CACJ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,yCAAyC,MAAM,CAAC,SAAS,EAAE,EACrF,QAAQ,CACT;QACH,CAAC,CAAC,MAAM,CACJ,gCAAgC,MAAM,CAAC,SAAS,WAAW,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,qBAAqB,CAC1G,EACL,MAAM,CAAC,MAAM,CACd,CAAA;AACH,CAAC,CAAA"}

package/dist/checks/editorconfig.d.ts

@@ -0,0 +1,5 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+/** Check every tracked text file against the committed `.editorconfig`. */
+export declare const editorconfig: (context: Context) => GateResult;
+//# sourceMappingURL=editorconfig.d.ts.map

package/dist/checks/editorconfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorconfig.d.ts","sourceRoot":"","sources":["../../src/checks/editorconfig.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAS5D,2EAA2E;AAC3E,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,UAoC/C,CAAA"}

package/dist/checks/editorconfig.js

@@ -0,0 +1,38 @@
+// Conformance to the committed `.editorconfig`. The decision lives in governance; this reads the tree.
+//
+// Every tracked file is checked except those excluded by role: a binary asset, recognised from its own
+// bytes, and a path the project declares generated. The standard's line cap applies to code roles only,
+// because a line cap is a Code Rule and prose wraps by meaning rather than by column.
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { CODE_EXTENSIONS, findEditorconfigViolations, hasExtension, isBinary, matchesRole, parseEditorconfig, } from '@ploaness/governance';
+import { trackedFiles } from '../context.js';
+import { failed, passed } from '../exec.js';
+const CONFIG_FILE = '.editorconfig';
+/** Check every tracked text file against the committed `.editorconfig`. */
+export const editorconfig = (context) => {
+    const configPath = path.join(context.root, CONFIG_FILE);
+    if (!existsSync(configPath)) {
+        return failed(`${CONFIG_FILE} is missing, so formatting cannot be proven`, [
+            `${CONFIG_FILE} is a managed file; restore it with \`ploaness sync\``,
+        ]);
+    }
+    const rules = parseEditorconfig(readFileSync(configPath, 'utf8'));
+    // A tracked path is not always a regular file: a symlink and a submodule gitlink both appear here,
+    // and reading either throws rather than yielding text.
+    const tracked = trackedFiles(context.root).filter((file) => {
+        const full = path.join(context.root, file);
+        return existsSync(full) && statSync(full).isFile();
+    });
+    // Select first, then judge: the two steps read separately and neither accumulates into a mutable box.
+    const readable = tracked
+        .filter((file) => !matchesRole(file, context.settings.typographyExclusions))
+        .map((file) => ({ file, bytes: readFileSync(path.join(context.root, file)) }))
+        .filter((entry) => !isBinary(entry.bytes));
+    const findings = readable.flatMap((entry) => findEditorconfigViolations(entry.bytes.toString('utf8'), rules, hasExtension(entry.file, CODE_EXTENSIONS)).map((violation) => `${entry.file}:${String(violation.line)} ${violation.reason}`));
+    const checked = readable.length;
+    return findings.length > 0
+        ? failed(`${String(findings.length)} formatting violation(s)`, findings)
+        : passed(`${String(checked)} tracked file(s) match ${CONFIG_FILE}`);
+};
+//# sourceMappingURL=editorconfig.js.map

package/dist/checks/editorconfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"editorconfig.js","sourceRoot":"","sources":["../../src/checks/editorconfig.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,sFAAsF;AACtF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,eAAe,EAGf,0BAA0B,EAC1B,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,iBAAiB,GAClB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAgB,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,WAAW,GAAW,eAAe,CAAA;AAO3C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAc,EAAE;IAC3D,MAAM,UAAU,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAC/D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,GAAG,WAAW,6CAA6C,EAAE;YACzE,GAAG,WAAW,uDAAuD;SACtE,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,KAAK,GAAsB,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;IACpF,mGAAmG;IACnG,uDAAuD;IACvD,MAAM,OAAO,GAAsB,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE;QAC7F,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAClD,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,sGAAsG;IACtG,MAAM,QAAQ,GAAwB,OAAO;SAC1C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;SAC5F,GAAG,CAAC,CAAC,IAAY,EAAY,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;SAC/F,MAAM,CAAC,CAAC,KAAe,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IAE/D,MAAM,QAAQ,GAAsB,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAe,EAAqB,EAAE,CAC1F,0BAA0B,CACxB,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC5B,KAAK,EACL,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAC1C,CAAC,GAAG,CACH,CAAC,SAAgC,EAAU,EAAE,CAC3C,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAChE,CACF,CAAA;IACD,MAAM,OAAO,GAAW,QAAQ,CAAC,MAAM,CAAA;IAEvC,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE,QAAQ,CAAC;QACxE,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAA;AACvE,CAAC,CAAA"}

package/dist/checks/generated.d.ts

@@ -0,0 +1,10 @@
+import type { Repository } from '../context.js';
+import { type GateResult } from '../exec.js';
+export declare const generatedDenial: (context: Repository) => GateResult;
+/**
+ * Merge the required deny rules into the project's runtime settings.
+ * @param context the resolved project environment.
+ * @returns true when the file was created or changed.
+ */
+export declare const hasWrittenDenyRules: (context: Repository) => boolean;
+//# sourceMappingURL=generated.d.ts.map

package/dist/checks/generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.d.ts","sourceRoot":"","sources":["../../src/checks/generated.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAyC5D,eAAO,MAAM,eAAe,GAAI,SAAS,UAAU,KAAG,UAerD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,UAAU,KAAG,OAiBzD,CAAA"}

package/dist/checks/generated.js

@@ -0,0 +1,65 @@
+// Write denial for the generated Payload artefacts. The decision lives in governance; this reads the
+// runtime settings file and, on the sync path, writes it back.
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { applyDenyRules, deniedPathsFor, findDenialViolations, parseJsonc, } from '@ploaness/governance';
+import { failed, passed } from '../exec.js';
+// Matches the indent the shipped formatter settings declare.
+const JSON_INDENT = 2;
+const SETTINGS_PATH = '.claude/settings.json';
+const LOCAL_SETTINGS_PATH = '.claude/settings.local.json';
+// Absent and unparseable used to collapse into the same `undefined`, and `hasWrittenDenyRules` then
+// merged its rules into that nothing and wrote the result. One stray comma in a project's settings and
+// `ploaness sync` replaced every permission, hook, and environment entry the file held with the deny
+// list alone. A tool may refuse to write; it may not quietly discard what it could not read.
+const readSettings = (root, relative) => {
+    const full = path.join(root, relative);
+    if (!existsSync(full)) {
+        return { value: undefined, isMalformed: false };
+    }
+    const read = parseJsonc(readFileSync(full, 'utf8'));
+    return { value: read.value, isMalformed: read.problem !== undefined };
+};
+const readJson = (root, relative) => readSettings(root, relative).value;
+/** Check that the agent runtime is denied write access to every generated artefact. */
+// The deny list is the union over Payload members of `<member>/<artefact>`. The runtime reads one
+// settings file, at the repository root, while the artefacts are member-relative - so a rule written
+// for one member would bind nothing in a workspace, and a gate per member would have several of them
+// fighting over one file. For a single member at the root the union is the list that always shipped.
+const deniedArtefacts = (repository) => repository.members
+    .filter((member) => member.isPayload)
+    .flatMap((member) => deniedPathsFor([member.path], member.settings.generatedArtefacts));
+export const generatedDenial = (context) => {
+    const findings = findDenialViolations(readJson(context.root, SETTINGS_PATH), readJson(context.root, LOCAL_SETTINGS_PATH), deniedArtefacts(context));
+    return findings.length > 0
+        ? failed(`${String(findings.length)} generated file(s) are writable by an agent`, [
+            ...findings,
+            // Said plainly rather than implied: the rule binds the runtime that reads this file. The
+            // standard scopes it the same way, so this is the whole of what the rule claims.
+            `a denial in ${SETTINGS_PATH} binds the runtime that reads it; the regeneration gate ` +
+                'remains the check that catches an edit made another way',
+        ])
+        : passed('every generated artefact is denied to an agent');
+};
+/**
+ * Merge the required deny rules into the project's runtime settings.
+ * @param context the resolved project environment.
+ * @returns true when the file was created or changed.
+ */
+export const hasWrittenDenyRules = (context) => {
+    const full = path.join(context.root, SETTINGS_PATH);
+    const existing = readSettings(context.root, SETTINGS_PATH);
+    if (existing.isMalformed) {
+        throw new Error(`${SETTINGS_PATH} exists but is not valid JSON; repair it before running \`ploaness sync\`, ` +
+            'because merging into a file that could not be read would discard everything it holds');
+    }
+    const merged = applyDenyRules(existing.value, deniedArtefacts(context));
+    const text = `${JSON.stringify(merged, null, JSON_INDENT)}\n`;
+    if (existsSync(full) && readFileSync(full, 'utf8') === text) {
+        return false;
+    }
+    mkdirSync(path.dirname(full), { recursive: true });
+    writeFileSync(full, text);
+    return true;
+};
+//# sourceMappingURL=generated.js.map

package/dist/checks/generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.js","sourceRoot":"","sources":["../../src/checks/generated.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EAEpB,UAAU,GACX,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,MAAM,EAAmB,MAAM,EAAE,MAAM,YAAY,CAAA;AAE5D,6DAA6D;AAC7D,MAAM,WAAW,GAAW,CAAC,CAAA;AAC7B,MAAM,aAAa,GAAW,uBAAuB,CAAA;AACrD,MAAM,mBAAmB,GAAW,6BAA6B,CAAA;AASjE,oGAAoG;AACpG,uGAAuG;AACvG,qGAAqG;AACrG,6FAA6F;AAC7F,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAgB,EAAE;IACpE,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;IACjD,CAAC;IACD,MAAM,IAAI,GAAe,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAA;AAEhG,uFAAuF;AACvF,kGAAkG;AAClG,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,UAAsB,EAAqB,EAAE,CACpE,UAAU,CAAC,OAAO;KACf,MAAM,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;KACrD,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CAC7C,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAClE,CAAA;AAEL,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAmB,EAAc,EAAE;IACjE,MAAM,QAAQ,GAAsB,oBAAoB,CACtD,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,EACrC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAC3C,eAAe,CAAC,OAAO,CAAC,CACzB,CAAA;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,6CAA6C,EAAE;YAC9E,GAAG,QAAQ;YACX,yFAAyF;YACzF,iFAAiF;YACjF,eAAe,aAAa,0DAA0D;gBACpF,yDAAyD;SAC5D,CAAC;QACJ,CAAC,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAA;AAC9D,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAmB,EAAW,EAAE;IAClE,MAAM,IAAI,GAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAiB,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAA;IACxE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,6EAA6E;YAC3F,sFAAsF,CACzF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAA4B,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IAChG,MAAM,IAAI,GAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAA;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACzB,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}

package/dist/checks/history.d.ts

@@ -0,0 +1,19 @@
+import { type Context } from '../context.js';
+import { type GateResult } from '../exec.js';
+export declare const requireFullHistory: (context: Context) => GateResult;
+/**
+ * Validate commit messages. Every commit is held to every rule, including the ones git writes for you: a
+ * merge, a revert, or an autosquash subject must be given a conforming form by hand.
+ *
+ * It walks the same refs `linearHistory` does, and the default is the shared constant rather than a
+ * literal so the two cannot drift apart. Walking only HEAD was the earlier spelling and it left a hole
+ * this repository's own rules describe: a branch off HEAD's ancestry is history the repository owns and
+ * can rewrite, so a banned message there is a violation nothing reported. A real project carried an
+ * agent-attribution trailer on such a branch past a passing gate.
+ */
+export declare const commitHistory: (context: Context, revisionArguments?: readonly string[]) => GateResult;
+/** Validate one pending message, from a message file the author points at. */
+export declare const commitMessageProblems: (context: Context, raw: string) => readonly string[];
+/** The history is linear: a merge commit is prohibited wherever this repository owns it. */
+export declare const linearHistory: (context: Context) => GateResult;
+//# sourceMappingURL=history.d.ts.map

package/dist/checks/history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.d.ts","sourceRoot":"","sources":["../../src/checks/history.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAAO,MAAM,eAAe,CAAA;AACjD,OAAO,EAAU,KAAK,UAAU,EAAU,MAAM,YAAY,CAAA;AAY5D,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,UAUrD,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,OAAO,EAChB,oBAAmB,SAAS,MAAM,EAA4B,KAC7D,UAmBF,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,qBAAqB,GAAI,SAAS,OAAO,EAAE,KAAK,MAAM,KAAG,SAAS,MAAM,EAKpF,CAAA;AAOD,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GAAI,SAAS,OAAO,KAAG,UA6BhD,CAAA"}