@ploaness/governance 1.12.0 → 1.14.0

package/dist/change-scope.js

@@ -0,0 +1,340 @@
+// Which pages a change can affect, so `delta` verification sweeps those and nothing else.
+//
+// The change is everything that differs from the merge-base of HEAD with the default branch of the first
+// remote: commits not on that branch, staged and unstaged edits, and untracked files alike. A changed
+// file reaches pages through the import graph. A route is in scope when one of its entry modules - its
+// page, and the layout, template, loading, error and not-found modules above it - imports the file,
+// directly or not; a story is in scope when its story file does. Whatever the graph cannot follow is
+// global, and a global change sweeps everything. Nothing is remembered between runs: the scope is
+// derived from Git each time, and it is safe only because `full` sweeps the default branch completely.
+import path from 'node:path';
+import { BROWSER_ENDPOINT_ENVIRONMENT_VARIABLE } from './browser-run.js';
+import { isWithinSourceRoots, STYLESHEET_EXTENSIONS } from './file-roles.js';
+import { isArray, isRecord } from './json-shapes.js';
+import { appRootOf, declaredRoutesOf, isRootLayout, resolvedRouteOf } from './route-map.js';
+/** Names the file that holds the change scope a `delta` run hands its browser sweep. */
+export const SWEEP_SCOPE_ENVIRONMENT_VARIABLE = 'PLOANESS_SWEEP_SCOPE';
+/**
+ * Whether the browser sweep runs its engine pass in Firefox and WebKit as well as in Chromium. Only an
+ * unscoped run with the pinned browsers does: a `delta` run sweeps the change in Chromium alone.
+ * @param environment the runner's environment.
+ * @returns true when the other engines run.
+ */
+export const coversEveryEngine = (environment) => environment[BROWSER_ENDPOINT_ENVIRONMENT_VARIABLE] !== undefined &&
+    environment[SWEEP_SCOPE_ENVIRONMENT_VARIABLE] === undefined;
+/** The default branch a remote names when its own `HEAD` is not recorded. */
+const DEFAULT_BRANCH = 'main';
+/** The remote a clone names first, and the one the baseline is read from when it exists. */
+const PREFERRED_REMOTE = 'origin';
+/**
+ * The remote whose default branch is the baseline: `origin` when there is one, otherwise the first.
+ * @param remotes the repository's remotes, as `git remote` lists them.
+ * @returns the remote, or undefined when the repository has none.
+ */
+export const baselineRemote = (remotes) => remotes.includes(PREFERRED_REMOTE) ? PREFERRED_REMOTE : remotes[0];
+const REMOTES_PREFIX = 'refs/remotes/';
+/**
+ * The remote-tracking branch that stands for the remote's default branch.
+ * @param remote the remote.
+ * @param symbolicHead what `refs/remotes/<remote>/HEAD` points at, or undefined when it is not recorded.
+ * @returns a ref such as `origin/main`.
+ */
+export const trackingBranch = (remote, symbolicHead) => symbolicHead?.startsWith(`${REMOTES_PREFIX}${remote}/`) === true
+    ? symbolicHead.slice(REMOTES_PREFIX.length)
+    : `${remote}/${DEFAULT_BRANCH}`;
+/**
+ * Decide the commit a change is measured from. Local `main` is never it: a commit made on it would be
+ * its own baseline and never be checked. A shallow clone may lack the true merge-base, so it has none.
+ * @param facts what Git said.
+ * @returns the merge-base, or why the sweep has to be complete.
+ */
+export const changeBaseline = (facts) => {
+    if (facts.branch === undefined) {
+        return {
+            commit: undefined,
+            problem: `the repository has no remote-tracking default branch, such as ${PREFERRED_REMOTE}/${DEFAULT_BRANCH}`,
+        };
+    }
+    if (facts.isShallow) {
+        return { commit: undefined, problem: `the clone is shallow, so its merge-base with ${facts.branch} is unknown` };
+    }
+    return facts.mergeBase === undefined
+        ? { commit: undefined, problem: `HEAD and ${facts.branch} share no merge-base` }
+        : { commit: facts.mergeBase, branch: facts.branch };
+};
+// Repository files that decide what is installed and how it runs, for every member alike.
+const REPOSITORY_INPUTS = new Set([
+    'package.json',
+    'pnpm-lock.yaml',
+    'pnpm-workspace.yaml',
+    '.npmrc',
+    '.nvmrc',
+]);
+// Relative to the member root. A theme or token file needs no entry: a Tailwind theme is a global
+// stylesheet, a token module is followed through the graph, and anything else under a source root is
+// unknown and therefore global.
+const MEMBER_INPUTS = [
+    { pattern: /^package\.json$/u, what: 'the manifest' },
+    { pattern: /^tsconfig\.json$/u, what: 'the TypeScript configuration, which decides how imports resolve' },
+    { pattern: /^next\.config\.[cm]?[jt]s$/u, what: 'the Next.js configuration' },
+    { pattern: /^(?:tailwind|postcss)\.config\.[cm]?[jt]s$/u, what: 'the style tool configuration' },
+    {
+        pattern: /^(?:src\/)?(?:middleware|proxy|instrumentation(?:-client)?)\.[cm]?[jt]sx?$/u,
+        what: 'request handling every route passes through',
+    },
+    { pattern: /^(?:\.env[^/]*|[^/]+\.env)$/u, what: 'an environment file' },
+    { pattern: /^public\//u, what: 'a public file pages may load' },
+    { pattern: /(?:^|\/)\.storybook\//u, what: 'the Storybook configuration' },
+];
+const CSS_MODULE = /\.module\.[a-z]+$/u;
+const isGlobalStylesheet = (file) => STYLESHEET_EXTENSIONS.some((extension) => file.endsWith(extension)) && !CSS_MODULE.test(file);
+const ROOT_MEMBER = '.';
+const isInside = (file, member) => member === ROOT_MEMBER || file === member || file.startsWith(`${member}/`);
+// The deepest member holding the file: a nested member's files are its own, not its parent's.
+const ownerOf = (file, members) => members
+    .filter((member) => isInside(file, member))
+    .reduce((deepest, member) => deepest === undefined || deepest === ROOT_MEMBER || member.length > deepest.length ? member : deepest, undefined);
+const relativeTo = (file, member) => member === ROOT_MEMBER ? file : file.slice(member.length + 1);
+const NO_EFFECT = { kind: 'none' };
+const globalEffect = (reason) => ({ kind: 'global', reason });
+// What makes a member file global, or undefined when nothing does.
+const memberInputKind = (file, appRoot) => {
+    const input = MEMBER_INPUTS.find((candidate) => candidate.pattern.test(file));
+    if (input !== undefined) {
+        return input.what;
+    }
+    if (isGlobalStylesheet(file)) {
+        return 'a global stylesheet';
+    }
+    return appRoot !== undefined && isRootLayout(file, appRoot) ? 'the root layout' : undefined;
+};
+// A file of this application: global, followed through the graph, or outside what pages are built from.
+// A deleted module is in no graph, and it reaches nothing on its own: a module still importing it no
+// longer builds, and one that stopped importing it is itself changed.
+const ownEffect = (changed, inputs, appRoot) => {
+    const file = relativeTo(changed.path, inputs.member);
+    const kind = memberInputKind(file, appRoot);
+    if (kind !== undefined) {
+        return globalEffect(`${changed.path} is ${kind}`);
+    }
+    if (!isWithinSourceRoots(file, inputs.sourceRoots)) {
+        return NO_EFFECT;
+    }
+    if (inputs.graph[file] !== undefined) {
+        return { kind: 'graph', file };
+    }
+    return changed.isDeleted
+        ? NO_EFFECT
+        : globalEffect(`${changed.path} is not in the import graph, so what it reaches is unknown`);
+};
+const effectOf = (changed, inputs, appRoot) => {
+    if (REPOSITORY_INPUTS.has(changed.path)) {
+        return globalEffect(`${changed.path} decides what is installed for every member`);
+    }
+    const owner = ownerOf(changed.path, inputs.members);
+    if (owner === inputs.member) {
+        return ownEffect(changed, inputs, appRoot);
+    }
+    return owner !== undefined && inputs.related.includes(owner)
+        ? globalEffect(`${changed.path} belongs to ${owner}, which this application runs beside or depends on`)
+        : NO_EFFECT;
+};
+const edgesOf = (graph) => Object.entries(graph).flatMap(([from, imports]) => imports.map((to) => ({ from, to })));
+// Every module that imports one of the frontier's, directly or not, added to what is already reached.
+const reachedFrom = (frontier, reached, edges) => {
+    const next = new Set(edges
+        .filter((edge) => frontier.has(edge.to) && !reached.has(edge.from))
+        .map((edge) => edge.from));
+    return next.size === 0 ? reached : reachedFrom(next, new Set([...reached, ...next]), edges);
+};
+const SEGMENT_MODULE = /^(?:layout|template|loading|error|not-found)\.(?:tsx|ts|jsx|js)$/u;
+// The page, and every segment module in its directory or above it inside the app directory.
+const entryModules = (page, appRoot, files) => {
+    const directory = path.posix.dirname(page);
+    const isAbove = (candidate) => {
+        const own = path.posix.dirname(candidate);
+        return (own === directory || directory.startsWith(`${own}/`)) && isInside(own, appRoot);
+    };
+    return [
+        page,
+        ...files.filter((file) => SEGMENT_MODULE.test(path.posix.basename(file)) && isAbove(file) && file !== page),
+    ];
+};
+const reasonFor = (entries, reaches) => {
+    const hits = entries.flatMap((entry) => reaches.filter((reach) => reach.importers.has(entry)).map((reach) => [entry, reach]));
+    const [first] = hits;
+    if (first === undefined) {
+        return undefined;
+    }
+    const [entry, reach] = first;
+    const others = new Set(hits.map(([, hit]) => hit.changed)).size - 1;
+    const subject = entry === reach.changed ? `${entry} changed` : `${entry} reaches ${reach.changed}`;
+    return others === 0 ? subject : `${subject} and ${String(others)} more changed file(s)`;
+};
+const STORY_FILE = /\.stories\.[cm]?[jt]sx?$/u;
+const routeTargets = (inputs, appRoot, reaches) => appRoot === undefined
+    ? []
+    : declaredRoutesOf(inputs.files, appRoot).flatMap((route) => {
+        const reason = reasonFor(entryModules(route.file, appRoot, inputs.files), reaches);
+        return reason === undefined ? [] : [{ target: route.route, reason }];
+    });
+const storyTargets = (inputs, reaches) => Object.keys(inputs.graph)
+    .filter((module) => STORY_FILE.test(module))
+    .flatMap((story) => {
+    const reason = reasonFor([story], reaches);
+    return reason === undefined ? [] : [{ target: story, reason }];
+});
+/**
+ * Decide what one application's browser sweep covers for a change.
+ *
+ * Everything, when there is no baseline, or when a changed file is a global input: a dependency or
+ * toolchain file, the application's manifest, TypeScript, Next.js, Tailwind or PostCSS configuration,
+ * request handling, an environment file, a public file, the Storybook configuration, a global
+ * stylesheet, the root layout, a file under a source root the import graph does not hold, or any file
+ * of a member the application runs beside or depends on. Otherwise the routes and stories whose entry
+ * modules reach a changed module. A file outside every source root, such as documentation or a
+ * workflow, and a file of an unrelated member, change no page.
+ * @param inputs the baseline, the change, and the application's members, files and graph.
+ * @returns the scope, with a reason for each route and story or for covering everything.
+ */
+export const sweepScopeOf = (inputs) => {
+    const changed = inputs.changed.map((file) => file.path);
+    if (inputs.baseline.commit === undefined) {
+        return { isComplete: true, baseline: undefined, branch: undefined, changed, reasons: [inputs.baseline.problem] };
+    }
+    const appRoot = appRootOf(inputs.files);
+    const effects = inputs.changed.map((file) => effectOf(file, inputs, appRoot));
+    const reasons = effects.flatMap((effect) => effect.kind === 'global' ? [effect.reason] : []);
+    if (reasons.length > 0) {
+        return { isComplete: true, baseline: inputs.baseline.commit, branch: inputs.baseline.branch, changed, reasons };
+    }
+    const edges = edgesOf(inputs.graph);
+    const reaches = effects.flatMap((effect) => {
+        if (effect.kind !== 'graph') {
+            return [];
+        }
+        const start = new Set([effect.file]);
+        return [{ changed: effect.file, importers: reachedFrom(start, start, edges) }];
+    });
+    return {
+        isComplete: false,
+        baseline: inputs.baseline.commit,
+        branch: inputs.baseline.branch,
+        changed,
+        routes: routeTargets(inputs, appRoot, reaches),
+        stories: storyTargets(inputs, reaches),
+    };
+};
+const isTargets = (value) => isArray(value) &&
+    value.every((entry) => isRecord(entry) && typeof entry['target'] === 'string' && typeof entry['reason'] === 'string');
+const isStrings = (value) => isArray(value) && value.every((entry) => typeof entry === 'string');
+/**
+ * Whether a parsed value is a scope as `sweepScopeOf` produces it.
+ * @param value the parsed value.
+ * @returns whether it carries every field its kind has.
+ */
+export const isSweepScope = (value) => {
+    if (!(isRecord(value) && isStrings(value['changed']))) {
+        return false;
+    }
+    return value['isComplete'] === true
+        ? isStrings(value['reasons'])
+        : value['isComplete'] === false &&
+            typeof value['baseline'] === 'string' &&
+            typeof value['branch'] === 'string' &&
+            isTargets(value['routes']) &&
+            isTargets(value['stories']);
+};
+const SHORT_COMMIT = 12;
+const sinceText = (baseline, branch) => baseline === undefined || branch === undefined
+    ? ''
+    : ` since ${baseline.slice(0, SHORT_COMMIT)}, the merge-base of HEAD and ${branch}`;
+/**
+ * One line naming the level and what it covers.
+ * @param scope the scope.
+ * @returns the line.
+ */
+export const scopeHeadline = (scope) => scope.isComplete
+    ? `delta${sinceText(scope.baseline, scope.branch)}, complete because ${scope.reasons.join('; ')}`
+    : `delta${sinceText(scope.baseline, scope.branch)}: ${String(scope.changed.length)} changed file(s) reach ` +
+        `${String(scope.routes.length)} route(s) and ${String(scope.stories.length)} story file(s)`;
+const IN_COMPLETE_SCOPE = 'the sweep is complete';
+/**
+ * Why the sweep scans a crawled route, or undefined when the change cannot reach it. A route no
+ * declaration renders is scanned, because what reaches it is unknown.
+ * @param scope the scope.
+ * @param declared every route the application's file tree declares.
+ * @param route the crawled address.
+ * @returns the reason, or undefined.
+ */
+export const routeReason = (scope, declared, route) => {
+    if (scope.isComplete) {
+        return IN_COMPLETE_SCOPE;
+    }
+    const resolved = resolvedRouteOf(declared, route);
+    return resolved === undefined
+        ? 'no route file declares it, so what reaches it is unknown'
+        : scope.routes.find((target) => target.target === resolved.route)?.reason;
+};
+/**
+ * The file a story is declared in, relative to the application's root.
+ * @param importPath the story's `importPath`, relative to the Storybook's own directory.
+ * @param directory that directory, relative to the application's root; `.` when it is the same.
+ * @returns the file.
+ */
+export const storyFileOf = (importPath, directory) => path.posix.normalize(path.posix.join(directory, importPath));
+/**
+ * Why the sweep scans a story, or undefined when the change cannot reach it. A story declared outside
+ * the application, or in no file Storybook names, is scanned, because what reaches it is unknown.
+ * @param scope the scope.
+ * @param storyFile the story's file, from `storyFileOf`, or empty when Storybook names none.
+ * @returns the reason, or undefined.
+ */
+export const storyReason = (scope, storyFile) => {
+    if (scope.isComplete) {
+        return IN_COMPLETE_SCOPE;
+    }
+    if (storyFile === '' || storyFile === '..' || storyFile.startsWith('../')) {
+        return 'its file is outside this application, so what reaches it is unknown';
+    }
+    return scope.stories.find((target) => target.target === storyFile)?.reason;
+};
+const isCruisedModule = (value) => isRecord(value) && typeof value['source'] === 'string' && isArray(value['dependencies']);
+/**
+ * The import graph in dependency-cruiser's JSON report, the analyzer the architecture gate runs.
+ * @param report the parsed report.
+ * @returns each module, relative to where the analyzer ran, and the modules it imports; or undefined
+ *   when the value is not such a report.
+ */
+export const importGraphOf = (report) => {
+    const modules = isRecord(report) ? report['modules'] : undefined;
+    if (!(isArray(modules) && modules.every((module) => isCruisedModule(module)))) {
+        return undefined;
+    }
+    return Object.fromEntries(modules
+        .filter((module) => isCruisedModule(module))
+        .map((module) => [
+        module.source,
+        module.dependencies.flatMap((dependency) => {
+            const resolved = isRecord(dependency) ? dependency['resolved'] : undefined;
+            return typeof resolved === 'string' ? [resolved] : [];
+        }),
+    ]));
+};
+/**
+ * The scope as a reader sees it: the level and baseline, every changed file, and each route and story
+ * with the reason it is swept.
+ * @param scope the scope.
+ * @returns one line each, indented below the headline.
+ */
+export const scopeLines = (scope) => [
+    scopeHeadline(scope),
+    ...scope.changed.map((file) => `  changed ${file}`),
+    ...(scope.isComplete
+        ? []
+        : [
+            ...scope.routes.map((target) => `  route ${target.target}: ${target.reason}`),
+            ...scope.stories.map((target) => `  story ${target.target}: ${target.reason}`),
+        ]),
+];
+//# sourceMappingURL=change-scope.js.map

package/dist/change-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-scope.js","sourceRoot":"","sources":["../src/change-scope.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,yGAAyG;AACzG,sGAAsG;AACtG,uGAAuG;AACvG,oGAAoG;AACpG,qGAAqG;AACrG,kGAAkG;AAClG,uGAAuG;AACvG,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,qCAAqC,EAAE,MAAM,kBAAkB,CAAA;AACxE,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAsB,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE/G,wFAAwF;AACxF,MAAM,CAAC,MAAM,gCAAgC,GAAW,sBAAsB,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAyD,EAAW,EAAE,CACtG,WAAW,CAAC,qCAAqC,CAAC,KAAK,SAAS;IAChE,WAAW,CAAC,gCAAgC,CAAC,KAAK,SAAS,CAAA;AAE7D,6EAA6E;AAC7E,MAAM,cAAc,GAAW,MAAM,CAAA;AAErC,4FAA4F;AAC5F,MAAM,gBAAgB,GAAW,QAAQ,CAAA;AAEzC;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAA0B,EAAsB,EAAE,CAC/E,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAEpE,MAAM,cAAc,GAAW,eAAe,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,YAAgC,EAAU,EAAE,CACzF,YAAY,EAAE,UAAU,CAAC,GAAG,cAAc,GAAG,MAAM,GAAG,CAAC,KAAK,IAAI;IAC9D,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC;IAC3C,CAAC,CAAC,GAAG,MAAM,IAAI,cAAc,EAAE,CAAA;AAgBnC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAoB,EAAY,EAAE;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,iEAAiE,gBAAgB,IAAI,cAAc,EAAE;SAC/G,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,gDAAgD,KAAK,CAAC,MAAM,aAAa,EAAE,CAAA;IAClH,CAAC;IACD,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QAClC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,KAAK,CAAC,MAAM,sBAAsB,EAAE;QAChF,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;AACvD,CAAC,CAAA;AAuDD,0FAA0F;AAC1F,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAS;IAC7D,cAAc;IACd,gBAAgB;IAChB,qBAAqB;IACrB,QAAQ;IACR,QAAQ;CACT,CAAC,CAAA;AAQF,kGAAkG;AAClG,qGAAqG;AACrG,gCAAgC;AAChC,MAAM,aAAa,GAA2B;IAC5C,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE;IACrD,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,iEAAiE,EAAE;IACzG,EAAE,OAAO,EAAE,6BAA6B,EAAE,IAAI,EAAE,2BAA2B,EAAE;IAC7E,EAAE,OAAO,EAAE,6CAA6C,EAAE,IAAI,EAAE,8BAA8B,EAAE;IAChG;QACE,OAAO,EAAE,6EAA6E;QACtF,IAAI,EAAE,6CAA6C;KACpD;IACD,EAAE,OAAO,EAAE,8BAA8B,EAAE,IAAI,EAAE,qBAAqB,EAAE;IACxE,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,8BAA8B,EAAE;IAC/D,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAA6B,EAAE;CAC3E,CAAA;AAED,MAAM,UAAU,GAAW,oBAAoB,CAAA;AAE/C,MAAM,kBAAkB,GAAG,CAAC,IAAY,EAAW,EAAE,CACnD,qBAAqB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEhH,MAAM,WAAW,GAAW,GAAG,CAAA;AAE/B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE,CACzD,MAAM,KAAK,WAAW,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAA;AAE5E,8FAA8F;AAC9F,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,OAA0B,EAAsB,EAAE,CAC/E,OAAO;KACJ,MAAM,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;KAC3D,MAAM,CACL,CAAC,OAA2B,EAAE,MAAc,EAAU,EAAE,CACtD,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EACvG,SAAS,CACV,CAAA;AAEL,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,MAAc,EAAU,EAAE,CAC1D,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAQ/D,MAAM,SAAS,GAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AAE1C,MAAM,YAAY,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;AAE7E,mEAAmE;AACnE,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,OAA2B,EAAsB,EAAE;IACxF,MAAM,KAAK,GAA4B,aAAa,CAAC,IAAI,CAAC,CAAC,SAAsB,EAAW,EAAE,CAC5F,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC,IAAI,CAAA;IACnB,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7F,CAAC,CAAA;AAED,wGAAwG;AACxG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,SAAS,GAAG,CAAC,OAAoB,EAAE,MAAmB,EAAE,OAA2B,EAAU,EAAE;IACnG,MAAM,IAAI,GAAW,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAuB,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,OAAO,IAAI,EAAE,CAAC,CAAA;IACnD,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAChC,CAAC;IACD,OAAO,OAAO,CAAC,SAAS;QACtB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,4DAA4D,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,OAAoB,EAAE,MAAmB,EAAE,OAA2B,EAAU,EAAE;IAClG,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,OAAO,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,6CAA6C,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,KAAK,GAAuB,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACvE,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1D,CAAC,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,eAAe,KAAK,oDAAoD,CAAC;QACvG,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAQD,MAAM,OAAO,GAAG,CAAC,KAAkD,EAAmB,EAAE,CACtF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAuC,EAAmB,EAAE,CACvG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAU,EAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAClD,CAAA;AAEH,sGAAsG;AACtG,MAAM,WAAW,GAAG,CAClB,QAA6B,EAC7B,OAA4B,EAC5B,KAAsB,EACD,EAAE;IACvB,MAAM,IAAI,GAAwB,IAAI,GAAG,CACvC,KAAK;SACF,MAAM,CAAC,CAAC,IAAU,EAAW,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACjF,GAAG,CAAC,CAAC,IAAU,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1C,CAAA;IACD,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,CAAS,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AACrG,CAAC,CAAA;AAQD,MAAM,cAAc,GAAW,mEAAmE,CAAA;AAElG,4FAA4F;AAC5F,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,KAAwB,EAAqB,EAAE;IAClG,MAAM,SAAS,GAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC7C,MAAM,GAAG,GAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACjD,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACzF,CAAC,CAAA;IACD,OAAO;QACL,IAAI;QACJ,GAAG,KAAK,CAAC,MAAM,CACb,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,CAC5G;KACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAE,OAAyB,EAAsB,EAAE;IAC9F,MAAM,IAAI,GAA0C,OAAO,CAAC,OAAO,CACjE,CAAC,KAAa,EAAyC,EAAE,CACvD,OAAO,CAAC,MAAM,CAAC,CAAC,KAAY,EAAW,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAC9G,CAAA;IACD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IACpB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;IAC5B,MAAM,MAAM,GAAW,IAAI,GAAG,CAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAA2B,EAAU,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAA;IACrH,MAAM,OAAO,GAAW,KAAK,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,OAAO,EAAE,CAAA;IAC1G,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,QAAQ,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAA;AACzF,CAAC,CAAA;AAED,MAAM,UAAU,GAAW,2BAA2B,CAAA;AAEtD,MAAM,YAAY,GAAG,CACnB,MAAmB,EACnB,OAA2B,EAC3B,OAAyB,EACA,EAAE,CAC3B,OAAO,KAAK,SAAS;IACnB,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAoB,EAA2B,EAAE;QAChG,MAAM,MAAM,GAAuB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;QACtG,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;AAER,MAAM,YAAY,GAAG,CAAC,MAAmB,EAAE,OAAyB,EAA2B,EAAE,CAC/F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACtB,MAAM,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KAC5D,OAAO,CAAC,CAAC,KAAa,EAA2B,EAAE;IAClD,MAAM,MAAM,GAAuB,SAAS,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9D,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAChE,CAAC,CAAC,CAAA;AAEN;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAmB,EAAc,EAAE;IAC9D,MAAM,OAAO,GAAsB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/F,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAA;IAClH,CAAC;IACD,MAAM,OAAO,GAAuB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,MAAM,OAAO,GAAsB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAU,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACrH,MAAM,OAAO,GAAsB,OAAO,CAAC,OAAO,CAAC,CAAC,MAAc,EAAqB,EAAE,CACvF,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAChD,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IACjH,CAAC;IACD,MAAM,KAAK,GAAoB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,OAAO,GAAqB,OAAO,CAAC,OAAO,CAAC,CAAC,MAAc,EAAoB,EAAE;QACrF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;QACjE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;IAChF,CAAC,CAAC,CAAA;IACF,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAChC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO;QACP,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,OAAO,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;KACvC,CAAA;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE,CAC5C,OAAO,CAAC,KAAK,CAAC;IACd,KAAK,CAAC,KAAK,CACT,CAAC,KAAc,EAAW,EAAE,CAC1B,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAChG,CAAA;AAEH,MAAM,SAAS,GAAG,CAAC,KAAc,EAAW,EAAE,CAC5C,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAA;AAEvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAuB,EAAE;IAClE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI;QACjC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,KAAK;YAC3B,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ;YACrC,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;YACnC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1B,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,MAAM,YAAY,GAAW,EAAE,CAAA;AAE/B,MAAM,SAAS,GAAG,CAAC,QAA4B,EAAE,MAA0B,EAAU,EAAE,CACrF,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;IAC5C,CAAC,CAAC,EAAE;IACJ,CAAC,CAAC,UAAU,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,gCAAgC,MAAM,EAAE,CAAA;AAEvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAU,EAAE,CACzD,KAAK,CAAC,UAAU;IACd,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,sBAAsB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IACjG,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,yBAAyB;QACzG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAA;AAEjG,MAAM,iBAAiB,GAAW,uBAAuB,CAAA;AAEzD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAAiB,EACjB,QAAkC,EAClC,KAAa,EACO,EAAE;IACtB,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IACD,MAAM,QAAQ,GAA8B,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC5E,OAAO,QAAQ,KAAK,SAAS;QAC3B,CAAC,CAAC,0DAA0D;QAC5D,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAoB,EAAW,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;AACpG,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAE,SAAiB,EAAU,EAAE,CAC3E,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAE,SAAiB,EAAsB,EAAE;IACtF,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,iBAAiB,CAAA;IAC1B,CAAC;IACD,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1E,OAAO,qEAAqE,CAAA;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAoB,EAAW,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,MAAM,CAAA;AACnG,CAAC,CAAA;AAQD,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACjE,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;AAE1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAe,EAA2D,EAAE;IACxG,MAAM,OAAO,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACzE,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAe,EAAW,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO;SACJ,MAAM,CAAC,CAAC,MAAe,EAA2B,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,MAAqB,EAAwC,EAAE,CAAC;QACpE,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,UAAmB,EAAqB,EAAE;YACrE,MAAM,QAAQ,GAAY,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACnF,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QACvD,CAAC,CAAC;KACH,CAAC,CACL,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAqB,EAAE,CAAC;IAClE,aAAa,CAAC,KAAK,CAAC;IACpB,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,aAAa,IAAI,EAAE,CAAC;IACnE,GAAG,CAAC,KAAK,CAAC,UAAU;QAClB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAoB,EAAU,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACnG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAoB,EAAU,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;SACrG,CAAC;CACP,CAAA"}

package/dist/cloudfront-functions.d.ts

@@ -0,0 +1,34 @@
+import { type RuntimeRole } from './javascript-runtimes.js';
+import type { TerraformViolation } from './terraform-policy.js';
+/** One CloudFront Function a source deploys, as far as a line reader can follow it. */
+export interface CloudFrontFunction {
+    readonly line: number;
+    /** The literal runtime, or undefined when the argument is absent or an expression. */
+    readonly runtime: string | undefined;
+    /** The repo-relative file it deploys, or undefined when `code` is anything this reader cannot follow. */
+    readonly code: string | undefined;
+}
+/**
+ * The repo-relative path `file("${path.module}/<relative>")` names, read from a source at `source`.
+ * @param source the repo-relative path of the source that declares the function.
+ * @param relative the path written after `${path.module}/`.
+ * @returns the resolved path, or undefined when it climbs out of the repository.
+ */
+export declare const resolveModulePath: (source: string, relative: string) => string | undefined;
+/**
+ * Every CloudFront Function a source declares.
+ * @param source the repo-relative path of the source, which `${path.module}` resolves against.
+ * @param text the source's text, as tracked.
+ * @returns one function per resource block, in source order.
+ */
+export declare const cloudFrontFunctionsIn: (source: string, text: string) => readonly CloudFrontFunction[];
+/**
+ * Report every CloudFront Function whose deployed file is not linted for the runtime that runs it.
+ * @param source the repo-relative path of the source.
+ * @param text the source's text, as tracked.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @param roles every allowlist role with the runtime it declares.
+ * @returns one violation per defect, ordered by the line it sits on.
+ */
+export declare const findCloudFrontRuntimeViolations: (source: string, text: string, tracked: ReadonlySet<string>, roles: readonly RuntimeRole[]) => readonly TerraformViolation[];
+//# sourceMappingURL=cloudfront-functions.d.ts.map

package/dist/cloudfront-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudfront-functions.d.ts","sourceRoot":"","sources":["../src/cloudfront-functions.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,WAAW,EAAc,MAAM,0BAA0B,CAAA;AAG3F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAiB/D,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IACpC,yGAAyG;IACzG,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAkBD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,UAAU,MAAM,KAAG,MAAM,GAAG,SAO7E,CAAA;AAaD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,SAAS,kBAAkB,EAO7F,CAAA;AA0EH;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC1C,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,SAAS,WAAW,CAAC,MAAM,CAAC,EAC5B,OAAO,SAAS,WAAW,EAAE,KAC5B,SAAS,kBAAkB,EAI1B,CAAA"}

package/dist/cloudfront-functions.js

@@ -0,0 +1,124 @@
+// Tie each CloudFront Function an OpenTofu or Terraform source deploys to the allowlist entry that lints it.
+//
+// The lint rules for a CloudFront Function apply only to a file whose allowlist entry declares the
+// CloudFront runtime, and nothing in the file itself says which engine runs it. The resource that
+// deploys it does say so. Reading the two together means a file that CloudFront runs cannot be declared
+// a Node.js program by mistake. A `code` argument this reader cannot follow fails, rather than being
+// skipped, because a skipped function is deployed with nothing having linted it.
+import { CLOUDFRONT_RUNTIME, runtimesOf } from './javascript-runtimes.js';
+import { stripComments } from './source-text.js';
+import { resourceBlocksIn } from './terraform-blocks.js';
+const FUNCTION_TYPE = 'aws_cloudfront_function';
+// HCL's own interpolation, spelled so it is not read as a misplaced template hole.
+const DOLLAR = '$';
+const HOLE = `${DOLLAR}{`;
+const MODULE_DIRECTORY = `${HOLE}path.module}`;
+const RULE = 'cloudfront-runtime';
+// The one spelling followed: the module's own directory plus a literal path. A bare relative path is
+// resolved against the directory OpenTofu runs in, which a source does not state, and every other form
+// is an expression or a built artefact this reader cannot evaluate.
+const MODULE_FILE = /^[ \t]*code[ \t]*=[ \t]*file\([ \t]*"\$\{path\.module\}\/(?<path>[^"$]+)"[ \t]*\)[ \t]*$/;
+const CODE_ARGUMENT = /^[ \t]*code[ \t]*=/;
+const LITERAL_RUNTIME = /^[ \t]*runtime[ \t]*=[ \t]*"(?<runtime>[^"$]*)"[ \t]*$/;
+const directoryOf = (file) => file.slice(0, Math.max(0, file.lastIndexOf('/')));
+const PARENT = '..';
+// Undefined once a `..` climbs above the repository, which no tracked file can sit at.
+const normalisedSegments = (segments) => segments.reduce((resolved, segment) => {
+    if (resolved === undefined || segment === '.' || segment === '') {
+        return resolved;
+    }
+    if (segment !== PARENT) {
+        return [...resolved, segment];
+    }
+    return resolved.length === 0 ? undefined : resolved.slice(0, -1);
+}, []);
+/**
+ * The repo-relative path `file("${path.module}/<relative>")` names, read from a source at `source`.
+ * @param source the repo-relative path of the source that declares the function.
+ * @param relative the path written after `${path.module}/`.
+ * @returns the resolved path, or undefined when it climbs out of the repository.
+ */
+export const resolveModulePath = (source, relative) => {
+    const directory = directoryOf(source);
+    const segments = normalisedSegments([
+        ...(directory.length === 0 ? [] : directory.split('/')),
+        ...relative.split('/'),
+    ]);
+    return segments === undefined || segments.length === 0 ? undefined : segments.join('/');
+};
+const codeOf = (source, body) => {
+    const line = body.find((candidate) => CODE_ARGUMENT.test(candidate));
+    const relative = line === undefined ? undefined : MODULE_FILE.exec(line)?.groups?.['path'];
+    return relative === undefined ? undefined : resolveModulePath(source, relative);
+};
+const runtimeOf = (body) => body
+    .map((line) => LITERAL_RUNTIME.exec(line)?.groups?.['runtime'])
+    .find((runtime) => runtime !== undefined);
+/**
+ * Every CloudFront Function a source declares.
+ * @param source the repo-relative path of the source, which `${path.module}` resolves against.
+ * @param text the source's text, as tracked.
+ * @returns one function per resource block, in source order.
+ */
+export const cloudFrontFunctionsIn = (source, text) => resourceBlocksIn(stripComments(text).split('\n'), FUNCTION_TYPE).map((block) => ({
+    line: block.line,
+    runtime: runtimeOf(block.body),
+    code: codeOf(source, block.body),
+}));
+const violation = (line, reason) => ({ line, rule: RULE, reason });
+const runtimeViolations = (deployed) => {
+    if (deployed.runtime === CLOUDFRONT_RUNTIME) {
+        return [];
+    }
+    const stated = deployed.runtime === undefined
+        ? 'declares no literal runtime, so AWS runs cloudfront-js-1.0'
+        : `runs runtime ${deployed.runtime}`;
+    return [
+        violation(deployed.line, `this CloudFront function ${stated}, which this harness does not lint for - ` +
+            `set runtime = "${CLOUDFRONT_RUNTIME}"`),
+    ];
+};
+const allowlistViolations = (deployed, file, roles) => {
+    const declared = runtimesOf(file, roles);
+    if (declared.length === 0) {
+        return [
+            violation(deployed.line, `this CloudFront function deploys ${file}, which no javascriptAllowlist entry admits - ` +
+                `add one declaring "runtime": "${CLOUDFRONT_RUNTIME}"`),
+        ];
+    }
+    return declared.some((runtime) => runtime !== CLOUDFRONT_RUNTIME)
+        ? [
+            violation(deployed.line, `this CloudFront function deploys ${file}, which javascriptAllowlist declares as runtime ` +
+                `${declared.join(' and ')} - declare "runtime": "${CLOUDFRONT_RUNTIME}" so it is linted for ` +
+                'the engine that runs it'),
+        ]
+        : [];
+};
+const codeViolations = (deployed, tracked, roles) => {
+    if (deployed.code === undefined) {
+        return [
+            violation(deployed.line, 'cannot tell which file this CloudFront function deploys - load a tracked, allowlisted file with ' +
+                `code = file("${MODULE_DIRECTORY}/<path>")`),
+        ];
+    }
+    if (!tracked.has(deployed.code)) {
+        return [
+            violation(deployed.line, `this CloudFront function deploys ${deployed.code}, which the repository does not track - deploy ` +
+                'a tracked file, so the file that runs is the file that is linted'),
+        ];
+    }
+    return allowlistViolations(deployed, deployed.code, roles);
+};
+/**
+ * Report every CloudFront Function whose deployed file is not linted for the runtime that runs it.
+ * @param source the repo-relative path of the source.
+ * @param text the source's text, as tracked.
+ * @param tracked the repo-relative paths of the tracked files.
+ * @param roles every allowlist role with the runtime it declares.
+ * @returns one violation per defect, ordered by the line it sits on.
+ */
+export const findCloudFrontRuntimeViolations = (source, text, tracked, roles) => cloudFrontFunctionsIn(source, text).flatMap((deployed) => [
+    ...runtimeViolations(deployed),
+    ...codeViolations(deployed, tracked, roles),
+]);
+//# sourceMappingURL=cloudfront-functions.js.map

package/dist/cloudfront-functions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudfront-functions.js","sourceRoot":"","sources":["../src/cloudfront-functions.ts"],"names":[],"mappings":"AAAA,6GAA6G;AAC7G,EAAE;AACF,mGAAmG;AACnG,kGAAkG;AAClG,wGAAwG;AACxG,qGAAqG;AACrG,iFAAiF;AACjF,OAAO,EAAE,kBAAkB,EAAoB,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAsB,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG5E,MAAM,aAAa,GAAW,yBAAyB,CAAA;AAEvD,mFAAmF;AACnF,MAAM,MAAM,GAAW,GAAG,CAAA;AAC1B,MAAM,IAAI,GAAW,GAAG,MAAM,GAAG,CAAA;AACjC,MAAM,gBAAgB,GAAW,GAAG,IAAI,cAAc,CAAA;AACtD,MAAM,IAAI,GAAW,oBAAoB,CAAA;AAEzC,qGAAqG;AACrG,uGAAuG;AACvG,oEAAoE;AACpE,MAAM,WAAW,GAAW,0FAA0F,CAAA;AACtH,MAAM,aAAa,GAAW,oBAAoB,CAAA;AAClD,MAAM,eAAe,GAAW,wDAAwD,CAAA;AAWxF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAE/F,MAAM,MAAM,GAAW,IAAI,CAAA;AAE3B,uFAAuF;AACvF,MAAM,kBAAkB,GAAG,CAAC,QAA2B,EAAiC,EAAE,CACxF,QAAQ,CAAC,MAAM,CAAgC,CAAC,QAAuC,EAAE,OAAe,EAAE,EAAE;IAC1G,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC,EAAE,EAAE,CAAC,CAAA;AAER;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,QAAgB,EAAsB,EAAE;IACxF,MAAM,SAAS,GAAW,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAkC,kBAAkB,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvD,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;KACvB,CAAC,CAAA;IACF,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzF,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,IAAuB,EAAsB,EAAE;IAC7E,MAAM,IAAI,GAAuB,IAAI,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IACzG,MAAM,QAAQ,GAAuB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAA;IAC9G,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AACjF,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAuB,EAAsB,EAAE,CAChE,IAAI;KACD,GAAG,CAAC,CAAC,IAAY,EAAsB,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;KAC1F,IAAI,CAAC,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAA;AAE1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAiC,EAAE,CACnG,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC,GAAG,CAClE,CAAC,KAAoB,EAAsB,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;CACjC,CAAC,CACH,CAAA;AAEH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,MAAc,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;AAEtG,MAAM,iBAAiB,GAAG,CAAC,QAA4B,EAAiC,EAAE;IACxF,IAAI,QAAQ,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QAC5C,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GACV,QAAQ,CAAC,OAAO,KAAK,SAAS;QAC5B,CAAC,CAAC,4DAA4D;QAC9D,CAAC,CAAC,gBAAgB,QAAQ,CAAC,OAAO,EAAE,CAAA;IACxC,OAAO;QACL,SAAS,CACP,QAAQ,CAAC,IAAI,EACb,4BAA4B,MAAM,2CAA2C;YAC3E,kBAAkB,kBAAkB,GAAG,CAC1C;KACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAC1B,QAA4B,EAC5B,IAAY,EACZ,KAA6B,EACE,EAAE;IACjC,MAAM,QAAQ,GAAsB,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,SAAS,CACP,QAAQ,CAAC,IAAI,EACb,oCAAoC,IAAI,gDAAgD;gBACtF,iCAAiC,kBAAkB,GAAG,CACzD;SACF,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,kBAAkB,CAAC;QAChF,CAAC,CAAC;YACE,SAAS,CACP,QAAQ,CAAC,IAAI,EACb,oCAAoC,IAAI,kDAAkD;gBACxF,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B,kBAAkB,wBAAwB;gBAC7F,yBAAyB,CAC5B;SACF;QACH,CAAC,CAAC,EAAE,CAAA;AACR,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CACrB,QAA4B,EAC5B,OAA4B,EAC5B,KAA6B,EACE,EAAE;IACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO;YACL,SAAS,CACP,QAAQ,CAAC,IAAI,EACb,kGAAkG;gBAChG,gBAAgB,gBAAgB,WAAW,CAC9C;SACF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,SAAS,CACP,QAAQ,CAAC,IAAI,EACb,oCAAoC,QAAQ,CAAC,IAAI,iDAAiD;gBAChG,kEAAkE,CACrE;SACF,CAAA;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,MAAc,EACd,IAAY,EACZ,OAA4B,EAC5B,KAA6B,EACE,EAAE,CACjC,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAA4B,EAAiC,EAAE,CAAC;IAC3G,GAAG,iBAAiB,CAAC,QAAQ,CAAC;IAC9B,GAAG,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;CAC5C,CAAC,CAAA"}

package/dist/generated-denial.d.ts

@@ -10,8 +10,11 @@ export declare const GENERATED_ARTEFACTS: readonly string[];
  * ploaness repository denies its own regenerated asset bodies through the same shaped list, written by
  * hand in `.claude/settings.json` because nothing here runs `ploaness sync`. Closing over the constant
  * would have made the rule untestable against any set but that one.
+ *
+ * The runtime matches a file path only through `Edit(...)`, which binds every tool that writes a file;
+ * it reports a `Write(...)` path rule as one that never matches.
  * @param artefacts the repo-relative paths a generator owns.
- * @returns the Edit and Write denials the runtime settings must carry.
+ * @returns the denials the runtime settings must carry.
  */
 export declare const requiredDenyRules: (artefacts: readonly string[]) => readonly string[];
 /**

package/dist/generated-denial.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-denial.d.ts","sourceRoot":"","sources":["../src/generated-denial.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,EAAE,MAAkC,CAAA;AAExE,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EACyB,CAAA;AAOzG;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,OAAO,EAAE,WAAW,SAAS,MAAM,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAStG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,OAAO,EACjB,eAAe,OAAO,EACtB,WAAW,SAAS,MAAM,EAAE,KAC3B,SAAS,MAAM,EAgBjB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,SAAS,MAAM,EAAE,EAAE,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAG1G,CAAA"}
+{"version":3,"file":"generated-denial.d.ts","sourceRoot":"","sources":["../src/generated-denial.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,EAAE,MAAkC,CAAA;AAExE,sGAAsG;AACtG,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAIhD,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EACd,CAAA;AAalE;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,OAAO,EAAE,WAAW,SAAS,MAAM,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAWtG,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,OAAO,EACjB,eAAe,OAAO,EACtB,WAAW,SAAS,MAAM,EAAE,KAC3B,SAAS,MAAM,EAgBjB,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,GAAI,aAAa,SAAS,MAAM,EAAE,EAAE,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,MAAM,EAG1G,CAAA"}

package/dist/generated-denial.js

@@ -16,10 +16,17 @@ export const GENERATED_ARTEFACTS = [
  * ploaness repository denies its own regenerated asset bodies through the same shaped list, written by
  * hand in `.claude/settings.json` because nothing here runs `ploaness sync`. Closing over the constant
  * would have made the rule untestable against any set but that one.
+ *
+ * The runtime matches a file path only through `Edit(...)`, which binds every tool that writes a file;
+ * it reports a `Write(...)` path rule as one that never matches.
  * @param artefacts the repo-relative paths a generator owns.
- * @returns the Edit and Write denials the runtime settings must carry.
+ * @returns the denials the runtime settings must carry.
  */
-export const requiredDenyRules = (artefacts) => artefacts.flatMap((artefact) => [`Edit(${artefact})`, `Write(${artefact})`]);
+export const requiredDenyRules = (artefacts) => artefacts.map((artefact) => `Edit(${artefact})`);
+// The `Write(...)` form of a required denial never matches, so it protects nothing and only makes the
+// runtime warn. It is removed for the artefacts given; a `Write(...)` rule for any other path is the
+// project's and stays.
+const isInertDenial = (rule, artefacts) => artefacts.some((artefact) => rule === `Write(${artefact})`);
 const permissionStrings = (settings, key) => {
     const inner = readKey(readKey(settings, 'permissions'), key);
     return isArray(inner) ? inner.filter((entry) => typeof entry === 'string') : [];
@@ -33,7 +40,7 @@ const permissionStrings = (settings, key) => {
 export const applyDenyRules = (existing, artefacts) => {
     const base = { ...asRecord(existing) };
     const permissions = { ...asRecord(base['permissions']) };
-    const deny = permissionStrings(base, 'deny');
+    const deny = permissionStrings(base, 'deny').filter((rule) => !isInertDenial(rule, artefacts));
     const merged = [
         ...deny,
         ...requiredDenyRules(artefacts).filter((rule) => !deny.includes(rule)),

package/dist/generated-denial.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-denial.js","sourceRoot":"","sources":["../src/generated-denial.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAW,yBAAyB,CAAA;AAExE,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sBAAsB;IACtB,GAAG,uBAAuB,eAAe;IACzC,iCAAiC;CAClC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAA4B,EAAqB,EAAE,CACnF,SAAS,CAAC,OAAO,CAAC,CAAC,QAAgB,EAAqB,EAAE,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAA;AAEzG,MAAM,iBAAiB,GAAG,CAAC,QAAiB,EAAE,GAAW,EAAqB,EAAE;IAC9E,MAAM,KAAK,GAAY,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3G,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAiB,EAAE,SAA4B,EAA2B,EAAE;IACzG,MAAM,IAAI,GAA4B,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC/D,MAAM,WAAW,GAA4B,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAA;IACjF,MAAM,IAAI,GAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/D,MAAM,MAAM,GAAsB;QAChC,GAAG,IAAI;QACP,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KACxF,CAAA;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAiB,EACjB,aAAsB,EACtB,SAA4B,EACT,EAAE;IACrB,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAChE,MAAM,IAAI,GAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnE,MAAM,OAAO,GAAsB,QAAQ;SACxC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,uBAAuB,IAAI,mCAAmC,CAAC,CAAA;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,MAAM,OAAO,GAAsB,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC5E,MAAM,WAAW,GAAsB,OAAO;SAC3C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACF,CAAC,IAAY,EAAU,EAAE,CACvB,4BAA4B,IAAI,0DAA0D,CAC7F,CAAA;IACH,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAA;AACrC,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAA8B,EAAE,SAA4B,EAAqB,EAAE,CAChH,WAAW,CAAC,OAAO,CAAC,CAAC,UAAkB,EAAqB,EAAE,CAC5D,SAAS,CAAC,GAAG,CAAC,CAAC,QAAgB,EAAU,EAAE,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,CAC3G,CAAA"}
+{"version":3,"file":"generated-denial.js","sourceRoot":"","sources":["../src/generated-denial.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAW,yBAAyB,CAAA;AAExE,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAsB;IACpD,sBAAsB;IACtB,GAAG,uBAAuB,eAAe;IACzC,iCAAiC;CAClC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAA4B,EAAqB,EAAE,CACnF,SAAS,CAAC,GAAG,CAAC,CAAC,QAAgB,EAAU,EAAE,CAAC,QAAQ,QAAQ,GAAG,CAAC,CAAA;AAElE,sGAAsG;AACtG,qGAAqG;AACrG,uBAAuB;AACvB,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,SAA4B,EAAW,EAAE,CAC5E,SAAS,CAAC,IAAI,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,IAAI,KAAK,SAAS,QAAQ,GAAG,CAAC,CAAA;AAE9E,MAAM,iBAAiB,GAAG,CAAC,QAAiB,EAAE,GAAW,EAAqB,EAAE;IAC9E,MAAM,KAAK,GAAY,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAA;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3G,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAiB,EAAE,SAA4B,EAA2B,EAAE;IACzG,MAAM,IAAI,GAA4B,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC/D,MAAM,WAAW,GAA4B,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAA;IACjF,MAAM,IAAI,GAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CACpE,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAC3D,CAAA;IACD,MAAM,MAAM,GAAsB;QAChC,GAAG,IAAI;QACP,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KACxF,CAAA;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAiB,EACjB,aAAsB,EACtB,SAA4B,EACT,EAAE;IACrB,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAChE,MAAM,IAAI,GAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnE,MAAM,OAAO,GAAsB,QAAQ;SACxC,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,IAAY,EAAU,EAAE,CAAC,uBAAuB,IAAI,mCAAmC,CAAC,CAAA;IAChG,mGAAmG;IACnG,2EAA2E;IAC3E,MAAM,OAAO,GAAsB,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC5E,MAAM,WAAW,GAAsB,OAAO;SAC3C,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACF,CAAC,IAAY,EAAU,EAAE,CACvB,4BAA4B,IAAI,0DAA0D,CAC7F,CAAA;IACH,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CAAC,CAAA;AACrC,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAA8B,EAAE,SAA4B,EAAqB,EAAE,CAChH,WAAW,CAAC,OAAO,CAAC,CAAC,UAAkB,EAAqB,EAAE,CAC5D,SAAS,CAAC,GAAG,CAAC,CAAC,QAAgB,EAAU,EAAE,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,CAC3G,CAAA"}