@promptci/core 0.0.1

package/dist/scanner.js

@@ -0,0 +1,216 @@
+import fg from 'fast-glob';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+const DEFAULT_PATTERNS = [
+    // Core AI instruction files
+    'CLAUDE.md',
+    'AGENTS.md',
+    '.cursorrules',
+    '.windsurfrules',
+    // Cursor IDE rules
+    '.cursor/rules/**',
+    // GitHub Copilot instructions (legacy + new per-file format)
+    '.github/copilot-instructions.md',
+    '.github/instructions/**/*.md',
+    // Claude memory / settings directory
+    '.claude/**/*.md',
+    // README is often the only context file in small repos
+    'README.md',
+    // BUG-I1: Additional root-level instruction files that agents commonly read.
+    // Explicit names only — keeps the set narrow enough to avoid scanning docs/
+    // but broad enough to catch QA.md, CONTRIBUTING.md, and similar convention files.
+    'QA.md',
+    'CONTRIBUTING.md',
+    'ARCHITECTURE.md',
+    'DEVELOPMENT.md',
+    'CODING_STANDARDS.md',
+    'CONVENTIONS.md',
+    'GUIDELINES.md',
+    // Explicit AI/prompt directories only — not generic docs/
+    'ai/**/*.md',
+    'ai-instructions/**/*.md',
+    'prompts/**/*.md',
+    'system-prompts/**/*.md',
+];
+// NOTE: docs/**/*.md is intentionally excluded — docs directories typically
+// contain project documentation (QA reports, plans, guides) that are not AI
+// instruction files and cause false positive context-bloat and conflict findings.
+// 'worktrees'/'.worktrees' covers git worktree checkouts nested anywhere in the
+// tree (e.g. Claude Code's .claude/worktrees/<name>/, or a top-level worktrees/
+// dir used by other agent tooling) — these are full copies of the repo and
+// would otherwise be scanned as duplicate instruction-file trees.
+const IGNORE_DIRS = ['.git', 'node_modules', 'Library', 'Temp', 'bin', 'obj', 'dist', 'build', 'worktrees', '.worktrees'];
+const MAX_FILE_SIZE = 500 * 1024;
+const BINARY_CHECK_BYTES = 512;
+function deriveFileType(absPath) {
+    const base = path.basename(absPath);
+    const norm = absPath.replace(/\\/g, '/');
+    if (base === 'AGENTS.md')
+        return 'agents';
+    if (base === '.cursorrules' || norm.includes('/.cursor/rules/'))
+        return 'cursor';
+    if (base === 'copilot-instructions.md' || norm.includes('/.github/instructions/'))
+        return 'copilot';
+    if (base === 'CLAUDE.md' || norm.includes('/.claude/'))
+        return 'claude';
+    if (base === 'README.md')
+        return 'readme';
+    if (norm.includes('/docs/') && base.endsWith('.md'))
+        return 'docs';
+    if ((norm.includes('/ai/') || norm.includes('/prompts/')) && base.endsWith('.md'))
+        return 'prompt';
+    return 'unknown';
+}
+function slugify(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^\w\s-]/g, '')
+        .replace(/[\s_]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+// `content.split('\n')` produces a phantom trailing empty element whenever the
+// file ends with a newline (the common case). Drop it so line counts/endLine
+// values refer to real lines, not one past EOF.
+function splitLines(content) {
+    const rawLines = content.split('\n');
+    if (content.length > 0 && content.endsWith('\n')) {
+        rawLines.pop();
+    }
+    return rawLines;
+}
+function parseSections(content, filePath) {
+    const lines = splitLines(content);
+    const sections = [];
+    let currentHeading = undefined;
+    let currentStartLine = 1;
+    let currentLines = [];
+    const flush = (endLine) => {
+        const text = currentLines.join('\n');
+        const id = currentHeading !== undefined ? slugify(currentHeading) : `${filePath}:0`;
+        sections.push({
+            id,
+            filePath,
+            heading: currentHeading,
+            startLine: currentStartLine,
+            endLine,
+            text,
+            normalizedText: text.toLowerCase().trim(),
+        });
+    };
+    let inCodeBlock = false;
+    let fenceChar = null;
+    let fenceLen = 0;
+    for (let i = 0; i < lines.length; i++) {
+        const lineNum = i + 1;
+        const line = lines[i] ?? '';
+        // Track fenced code blocks so bash comments (`# text`) are not treated as
+        // headings. A closing fence must use the same fence character (``` vs ~~~
+        // are not interchangeable) and be at least as long as the opening fence,
+        // per CommonMark. Up to 3 leading spaces are allowed on either fence.
+        if (!inCodeBlock) {
+            const openMatch = /^ {0,3}([`~]{3,})/.exec(line);
+            if (openMatch) {
+                inCodeBlock = true;
+                fenceChar = openMatch[1][0] ?? null;
+                fenceLen = openMatch[1].length;
+                currentLines.push(line);
+                continue;
+            }
+        }
+        else {
+            const closeMatch = /^ {0,3}([`~]{3,})\s*$/.exec(line);
+            if (closeMatch && closeMatch[1][0] === fenceChar && closeMatch[1].length >= fenceLen) {
+                inCodeBlock = false;
+                fenceChar = null;
+                fenceLen = 0;
+                currentLines.push(line);
+                continue;
+            }
+            currentLines.push(line);
+            continue;
+        }
+        const headingMatch = /^ {0,3}(#{1,3})\s+(.+)/.exec(line);
+        if (headingMatch) {
+            if (currentLines.length > 0 || currentHeading !== undefined) {
+                flush(lineNum - 1);
+            }
+            currentHeading = headingMatch[2].trim();
+            currentStartLine = lineNum;
+            currentLines = [line];
+        }
+        else {
+            currentLines.push(line);
+        }
+    }
+    if (currentLines.length > 0 || currentHeading !== undefined) {
+        flush(lines.length);
+    }
+    return sections;
+}
+function isBinary(buffer) {
+    const end = Math.min(buffer.length, BINARY_CHECK_BYTES);
+    for (let i = 0; i < end; i++) {
+        if (buffer[i] === 0)
+            return true;
+    }
+    return false;
+}
+export async function scanFiles(input) {
+    const repoRoot = path.resolve(input.repoPath);
+    const patterns = (input.include && input.include.length > 0) ? input.include : DEFAULT_PATTERNS;
+    const ignorePatterns = [
+        ...IGNORE_DIRS.map((d) => `**/${d}/**`),
+        ...(input.exclude ?? []),
+    ];
+    let relativePaths;
+    try {
+        relativePaths = await fg(patterns, {
+            cwd: repoRoot,
+            ignore: ignorePatterns,
+            dot: true,
+            absolute: false,
+            followSymbolicLinks: false,
+        });
+    }
+    catch {
+        return [];
+    }
+    const results = [];
+    for (const relPath of relativePaths) {
+        const absPath = path.resolve(repoRoot, relPath);
+        // Path traversal guard
+        const relative = path.relative(repoRoot, absPath);
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            continue;
+        }
+        try {
+            const stat = await fs.stat(absPath);
+            if (!stat.isFile())
+                continue;
+            if (stat.size > MAX_FILE_SIZE)
+                continue;
+            const buffer = await fs.readFile(absPath);
+            if (isBinary(buffer))
+                continue;
+            const content = buffer.toString('utf-8');
+            const sections = parseSections(content, absPath);
+            const lineCount = splitLines(content).length;
+            const charCount = content.length;
+            results.push({
+                path: absPath,
+                fileType: deriveFileType(absPath),
+                content,
+                sections,
+                lineCount,
+                charCount,
+                estimatedTokens: Math.round(charCount / 4),
+            });
+        }
+        catch {
+            // skip unreadable files
+        }
+    }
+    results.sort((a, b) => a.path.localeCompare(b.path));
+    return results;
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,gBAAgB,GAAG;IACvB,4BAA4B;IAC5B,WAAW;IACX,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,mBAAmB;IACnB,kBAAkB;IAClB,6DAA6D;IAC7D,iCAAiC;IACjC,8BAA8B;IAC9B,qCAAqC;IACrC,iBAAiB;IACjB,uDAAuD;IACvD,WAAW;IACX,6EAA6E;IAC7E,4EAA4E;IAC5E,kFAAkF;IAClF,OAAO;IACP,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,gBAAgB;IAChB,eAAe;IACf,0DAA0D;IAC1D,YAAY;IACZ,yBAAyB;IACzB,iBAAiB;IACjB,wBAAwB;CACzB,CAAC;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,kFAAkF;AAElF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,kEAAkE;AAClE,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;AAE1H,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC;AACjC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEzC,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjF,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,gDAAgD;AAChD,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,QAAgB;IACtD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAyB,EAAE,CAAC;IAE1C,IAAI,cAAc,GAAuB,SAAS,CAAC;IACnD,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,YAAY,GAAa,EAAE,CAAC;IAEhC,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,EAAE,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC;QACpF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE;YACF,QAAQ;YACR,OAAO,EAAE,cAAc;YACvB,SAAS,EAAE,gBAAgB;YAC3B,OAAO;YACP,IAAI;YACJ,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5B,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,SAAS,EAAE,CAAC;gBACd,WAAW,GAAG,IAAI,CAAC;gBACnB,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBACpC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC/B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;gBACrF,WAAW,GAAG,KAAK,CAAC;gBACpB,SAAS,GAAG,IAAI,CAAC;gBACjB,QAAQ,GAAG,CAAC,CAAC;gBACb,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzD,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAC5D,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACrB,CAAC;YACD,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACxC,gBAAgB,GAAG,OAAO,CAAC;YAC3B,YAAY,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAC5D,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAChG,MAAM,cAAc,GAAG;QACrB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;KACzB,CAAC;IAEF,IAAI,aAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,GAAG,EAAE,QAAQ;YACb,MAAM,EAAE,cAAc;YACtB,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,KAAK;YACf,mBAAmB,EAAE,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEhD,uBAAuB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC7B,IAAI,IAAI,CAAC,IAAI,GAAG,aAAa;gBAAE,SAAS;YAExC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;YAEjC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC;gBACjC,OAAO;gBACP,QAAQ;gBACR,SAAS;gBACT,SAAS;gBACT,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/security-pack.d.ts

@@ -0,0 +1,4 @@
+import type { PromptCiIssue } from './types.js';
+import type { RepoContext } from './repo-context.js';
+export declare function detectSecurityPack(context: RepoContext): PromptCiIssue[];
+//# sourceMappingURL=security-pack.d.ts.map

package/dist/security-pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-pack.d.ts","sourceRoot":"","sources":["../src/security-pack.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAyJrD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,EAAE,CA6SxE"}

package/dist/security-pack.js

@@ -0,0 +1,403 @@
+import * as crypto from 'node:crypto';
+import * as path from 'node:path';
+import * as fs from 'node:fs';
+const SECURITY_CHECKS = [
+    {
+        id: 'no-secret-safeguard',
+        title: 'Missing secret safeguard instruction',
+        summary: 'Environment variables are used in this repository, but no instruction found ' +
+            'warning the agent never to print or commit secrets.',
+        patterns: [
+            /never\s+.*(print|commit|log|expose)\s+.*(secret|password|token|key|credential)/i,
+            /do\s+not\s+.*(print|commit|log|expose)\s+.*(secret|password|token|key|credential)/i,
+            /secrets?\s+must\s+never\s+be/i,
+            /keep\s+secrets?\s+secure/i,
+        ],
+        recommendation: 'Add a rule such as: "Never print or commit secrets, API keys, or credentials. ' +
+            'If you need to use an environment variable, use it silently without echoing its value."',
+        severity: 'warning',
+        confidence: 0.8,
+        fixRecipe: 'Never print or commit secrets, API keys, or credentials. If you need to use an environment variable, use it silently without echoing its value.',
+    },
+    {
+        id: 'no-supabase-service-role-rule',
+        title: 'Missing Supabase service role safeguard',
+        summary: 'Supabase is used in this repository, but no instruction found warning that ' +
+            'the service role key must only be used server-side.',
+        patterns: [
+            /service\s+role\s+key\s+must\s+(stay|only\s+be\s+used)\s+server-side/i,
+            /never\s+expose\s+supabase\s+service\s+role/i,
+            /supabase\s+service\s+role\s+key.*server-side/i,
+        ],
+        recommendation: 'Add a rule such as: "The Supabase service role key must stay server-side and never be exposed to the client."',
+        severity: 'warning',
+        confidence: 0.85,
+        fixRecipe: 'Keep SUPABASE_SERVICE_ROLE_KEY server-side only. Never expose it in browser code, logs, or committed files.',
+    },
+    {
+        id: 'no-upload-boundary-docs',
+        title: 'Missing data boundary documentation for uploads',
+        summary: 'Upload features detected, but no instruction found defining data boundaries ' +
+            'or validation requirements for user-provided files.',
+        patterns: [
+            /validate\s+user\s+(provided|uploaded)\s+files/i,
+            /data\s+boundary\s+for\s+uploads/i,
+            /upload\s+validation/i,
+            /limit\s+upload\s+size/i,
+        ],
+        recommendation: 'Add guidance on how to safely handle and validate user uploads to prevent security risks.',
+        severity: 'info',
+        confidence: 0.7,
+        fixRecipe: 'Before handling user uploads, document what file types are allowed, the max file size, and the sanitization steps required.',
+    },
+    {
+        id: 'no-promptci-report-safeguard',
+        title: 'Missing safeguard for .promptci/ reports',
+        summary: '.promptci/ folder exists, but no instruction found warning the agent ' +
+            'not to commit generated reports to the repository.',
+        patterns: [
+            /do\s+not\s+commit\s+\.promptci/i,
+            /never\s+commit\s+\.promptci/i,
+            /\.promptci\/\s+reports\s+should\s+not\s+be\s+committed/i,
+        ],
+        recommendation: 'Add a rule such as: "Do not commit .promptci/ reports to the repository."',
+        severity: 'info',
+        confidence: 0.8,
+        fixRecipe: 'Do not commit .promptci/ reports to the repository.',
+    },
+];
+const DESTRUCTIVE_COMMANDS = [
+    {
+        // SP2: no longer requires TRAILING whitespace — `rm\s+-rf\s+` missed
+        // "...never run rm -rf" (end of sentence) and backticked "`rm -rf`" (end
+        // of span, followed by a backtick, not whitespace). `\b` handles both.
+        // Also covers the equivalent flag order `rm -fr`.
+        pattern: /\brm\s+-(?:rf|fr)\b/i,
+        name: 'rm -rf',
+    },
+    {
+        pattern: /drop\s+table/i,
+        name: 'drop table',
+    },
+    {
+        pattern: /git\s+push\s+--force/i,
+        name: 'git push --force',
+    },
+];
+function issueId(checkId) {
+    const hash = crypto.createHash('sha1').update(checkId).digest('hex').slice(0, 12);
+    return `security-pack-${hash}`;
+}
+function destructiveCommandIssueId(filePath, command) {
+    const hash = crypto.createHash('sha1').update(`destructive-command:${filePath}:${command}`).digest('hex').slice(0, 12);
+    return `destructive-command-${hash}`;
+}
+/** SP1 / B3: per-FILE id — see call site for why this replaced a constant id. */
+function inspectReportsFirstIssueId(filePath) {
+    const hash = crypto.createHash('sha1').update(`inspect-reports-first:${filePath}`).digest('hex').slice(0, 12);
+    return `security-pack-inspect-reports-first-${hash}`;
+}
+function matchesAny(text, patterns) {
+    return patterns.some((p) => p.test(text));
+}
+/**
+ * SP3: does this .gitignore LINE actually ignore `target` (a bare directory
+ * or dotfile name, no slashes)?
+ *
+ * Old behavior used `clean.includes(target)` as a catch-all fallback, which
+ * was wrong two ways:
+ *   1. A NEGATION line ("!.promptci/") re-includes a path (un-ignores it) in
+ *      gitignore syntax, but `"!.promptci".includes(".promptci")` is true, so
+ *      the negation was misread as "yes, this is ignored".
+ *   2. Substring matching let an unrelated entry satisfy the check —
+ *      "distribution.md".includes("dist") and "builds-notes/".includes("build")
+ *      are both true, so those unrelated lines were misread as ignoring
+ *      "dist"/"build", masking a real unignored-directory finding (FN).
+ *
+ * Fixed by rejecting negation lines outright, then requiring an EXACT path
+ * SEGMENT match (splitting on '/' so a leading globstar segment doesn't
+ * block the match, but a differently-named file/dir never accidentally
+ * satisfies it).
+ */
+function gitignoreLineMatchesTarget(line, target) {
+    if (line.startsWith('!'))
+        return false;
+    const clean = line.replace(/^\/+|\/+$/g, '');
+    const segments = clean.split('/');
+    return segments.includes(target);
+}
+export function detectSecurityPack(context) {
+    const { files, repoRoot } = context;
+    if (files.length === 0)
+        return [];
+    const issues = [];
+    const combinedContent = files.map((f) => f.content).join('\n');
+    const allFilePaths = files.map((f) => f.path);
+    // 1. Secret Safeguard Signal
+    const envFiles = ['.env', '.env.example', '.env.local', '.env.development', '.env.production'];
+    const hasEnvVars = envFiles.some(f => fs.existsSync(path.join(/*turbopackIgnore: true*/ repoRoot, f))) ||
+        context.files.some(f => /env\s+vars|environment\s+variables/i.test(f.content));
+    if (hasEnvVars) {
+        const check = SECURITY_CHECKS.find(c => c.id === 'no-secret-safeguard');
+        if (!matchesAny(combinedContent, check.patterns)) {
+            issues.push({
+                id: issueId(check.id),
+                severity: check.severity,
+                category: 'security',
+                title: check.title,
+                summary: check.summary,
+                filePaths: allFilePaths,
+                locations: [],
+                evidence: ['Environment variables detected but no safeguard instruction found.'],
+                recommendation: check.recommendation,
+                fixRecipe: check.fixRecipe,
+                confidence: check.confidence,
+            });
+        }
+    }
+    // 2. Supabase Signal
+    const supabaseDeps = {
+        ...context.packageJson.dependencies,
+        ...context.packageJson.devDependencies,
+        ...context.packageJson.peerDependencies,
+    };
+    const hasSupabase = fs.existsSync(path.join(/*turbopackIgnore: true*/ repoRoot, 'supabase/migrations')) ||
+        Object.keys(supabaseDeps).some((dep) => dep === '@supabase/supabase-js' || dep.startsWith('@supabase/'));
+    if (hasSupabase) {
+        const check = SECURITY_CHECKS.find(c => c.id === 'no-supabase-service-role-rule');
+        if (!matchesAny(combinedContent, check.patterns)) {
+            issues.push({
+                id: issueId(check.id),
+                severity: check.severity,
+                category: 'security',
+                title: check.title,
+                summary: check.summary,
+                filePaths: allFilePaths,
+                locations: [],
+                evidence: ['Supabase detected but no service role safeguard instruction found.'],
+                recommendation: check.recommendation,
+                fixRecipe: check.fixRecipe,
+                confidence: check.confidence,
+            });
+        }
+    }
+    // 3. Upload Signal
+    // Basic heuristic: look for common upload-related paths or keywords in file paths
+    // SP4: normalize backslashes first — on win32, f.path uses `\`, so a bare
+    // `/api/upload` substring check never matched an absolute Windows path.
+    const hasUploadFeatures = context.files.some(f => {
+        const normalizedPath = f.path.replace(/\\/g, '/');
+        return (normalizedPath.includes('/api/upload') ||
+            normalizedPath.includes('/uploads/') ||
+            /multer|busboy|formidable/i.test(f.content));
+    });
+    if (hasUploadFeatures) {
+        const check = SECURITY_CHECKS.find(c => c.id === 'no-upload-boundary-docs');
+        if (!matchesAny(combinedContent, check.patterns)) {
+            issues.push({
+                id: issueId(check.id),
+                severity: check.severity,
+                category: 'security',
+                title: check.title,
+                summary: check.summary,
+                filePaths: allFilePaths,
+                locations: [],
+                evidence: ['Upload features detected but no data boundary documentation found.'],
+                recommendation: check.recommendation,
+                fixRecipe: check.fixRecipe,
+                confidence: check.confidence,
+            });
+        }
+    }
+    // 4. .promptci/ Signal
+    const hasPromptCiFolder = fs.existsSync(path.join(/*turbopackIgnore: true*/ repoRoot, '.promptci'));
+    if (hasPromptCiFolder) {
+        const check = SECURITY_CHECKS.find(c => c.id === 'no-promptci-report-safeguard');
+        if (!matchesAny(combinedContent, check.patterns)) {
+            issues.push({
+                id: issueId(check.id),
+                severity: check.severity,
+                category: 'security',
+                title: check.title,
+                summary: check.summary,
+                filePaths: allFilePaths,
+                locations: [],
+                evidence: ['.promptci/ folder detected but no report safeguard instruction found.'],
+                recommendation: check.recommendation,
+                fixRecipe: check.fixRecipe,
+                confidence: check.confidence,
+            });
+        }
+    }
+    // 5. Destructive Commands in instructions
+    for (const file of files) {
+        for (const cmd of DESTRUCTIVE_COMMANDS) {
+            if (cmd.pattern.test(file.content)) {
+                // Check if there is safety language nearby or in the same file
+                const safetyPatterns = [
+                    /ask\s+(before|for\s+approval)/i,
+                    /confirm\s+before/i,
+                    /be\s+careful\s+with/i,
+                    /destructive\s+operation/i,
+                    /\bdanger(?:ous)?\b/i,
+                ];
+                if (!matchesAny(file.content, safetyPatterns)) {
+                    issues.push({
+                        id: destructiveCommandIssueId(file.path, cmd.name),
+                        severity: 'warning',
+                        category: 'security',
+                        title: `Destructive command "${cmd.name}" without safety language`,
+                        summary: `Instruction file contains a destructive command "${cmd.name}" but lacks ` +
+                            `safety language (e.g., "Ask before running").`,
+                        filePaths: [file.path],
+                        locations: [], // Could be improved with line numbers
+                        evidence: [`Destructive command "${cmd.name}" found in ${path.basename(file.path)} without safety language.`],
+                        recommendation: `Add safety language such as "Ask for confirmation before running ${cmd.name}" ` +
+                            `to ensure destructive operations are not performed accidentally.`,
+                        confidence: 0.7,
+                    });
+                }
+            }
+        }
+    }
+    // 6. .gitignore Checks (Cost 9)
+    const gitignorePath = path.join(/*turbopackIgnore: true*/ repoRoot, '.gitignore');
+    let gitignoreContent = '';
+    try {
+        if (fs.existsSync(gitignorePath)) {
+            gitignoreContent = fs.readFileSync(gitignorePath, 'utf8');
+        }
+    }
+    catch {
+        // ignore
+    }
+    const gitignoreLines = gitignoreContent
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l && !l.startsWith('#'));
+    const hasPromptCiGitignore = gitignoreLines.some((line) => gitignoreLineMatchesTarget(line, '.promptci'));
+    if (!hasPromptCiGitignore) {
+        issues.push({
+            id: 'security-pack-no-promptci-gitignore',
+            severity: 'info',
+            category: 'security',
+            title: 'Missing .promptci/ ignore in .gitignore',
+            summary: 'The .promptci/ directory is not ignored in .gitignore, which may lead to ' +
+                'committing large generated scan reports to the repository.',
+            filePaths: ['.gitignore'],
+            locations: [],
+            evidence: ['.promptci/ entry not found in .gitignore'],
+            recommendation: 'Add `.promptci/` to your `.gitignore` file to prevent committing generated reports.',
+            fixRecipe: 'echo ".promptci/" >> .gitignore',
+            confidence: 0.9,
+        });
+    }
+    // 7. Unignored build, output, or coverage directories (Cost 9)
+    const commonDirs = ['coverage', 'dist', 'build', '.next', 'bin', 'obj', 'temp', 'tmp', 'logs'];
+    const unignoredDirs = commonDirs.filter((d) => {
+        const fullPath = path.join(/*turbopackIgnore: true*/ repoRoot, d);
+        try {
+            if (fs.existsSync(fullPath)) {
+                const stat = fs.statSync(fullPath);
+                if (stat.isDirectory()) {
+                    const isIgnored = gitignoreLines.some((line) => gitignoreLineMatchesTarget(line, d));
+                    return !isIgnored;
+                }
+            }
+        }
+        catch {
+            // ignore
+        }
+        return false;
+    });
+    if (unignoredDirs.length > 0) {
+        issues.push({
+            id: 'security-pack-unignored-dirs',
+            severity: 'warning',
+            category: 'context_bloat',
+            title: 'Unignored build, output, or coverage directories',
+            summary: `The repository contains directory/directories (${unignoredDirs.join(', ')}) that are ` +
+                `commonly generated but not ignored in .gitignore. AI tools may ingest these, ` +
+                `inflating token costs.`,
+            filePaths: ['.gitignore'],
+            locations: [],
+            evidence: unignoredDirs.map((d) => `Directory "${d}" exists but is not ignored in .gitignore.`),
+            recommendation: `Add generated directories to .gitignore. For example: "${unignoredDirs.map((d) => `${d}/`).join(', ')}"`,
+            fixRecipe: unignoredDirs.map((d) => `echo "${d}/" >> .gitignore`).join('\n'),
+            confidence: 0.8,
+        });
+    }
+    // 8. Broad include patterns scanning generated directories (Cost 9)
+    let hasBroadInclude = false;
+    try {
+        const configPath = path.join(/*turbopackIgnore: true*/ repoRoot, '.promptci', 'config.json');
+        if (fs.existsSync(configPath)) {
+            const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+            if (Array.isArray(config.include)) {
+                const broadPatterns = ['**/*', '**/*.md', '*', '*.*', '**'];
+                hasBroadInclude = config.include.some((p) => broadPatterns.includes(p.trim()));
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    if (hasBroadInclude) {
+        const scannedGenerated = files.filter((f) => {
+            const rel = path.relative(/*turbopackIgnore: true*/ repoRoot, f.path).replace(/\\/g, '/');
+            return (rel.includes('.promptci/') ||
+                rel.includes('coverage/') ||
+                rel.includes('.next/'));
+        });
+        if (scannedGenerated.length > 0) {
+            issues.push({
+                id: 'security-pack-broad-include',
+                severity: 'warning',
+                category: 'context_bloat',
+                title: 'Broad include pattern scanning generated directories',
+                summary: 'PromptCI configuration has a broad include pattern that matches generated directories ' +
+                    'such as .promptci/ or coverage/, causing them to be unnecessarily scanned.',
+                filePaths: ['.promptci/config.json'],
+                locations: [],
+                evidence: scannedGenerated.map((f) => `Scanned generated file: ${path.relative(/*turbopackIgnore: true*/ repoRoot, f.path).replace(/\\/g, '/')}`),
+                recommendation: 'Refine the include patterns in .promptci/config.json or add exclusions to avoid scanning generated/temporary documents.',
+                fixRecipe: 'Modify .promptci/config.json to restrict "include" to specific instruction files, or add exclusions to "exclude".',
+                confidence: 0.95,
+            });
+        }
+    }
+    // 9. Inspect generated reports before source docs (Cost 9)
+    for (const file of files) {
+        const inspectBeforePatterns = [
+            /read\s+.*\.promptci\s+before/i,
+            /inspect\s+.*\.promptci\s+before/i,
+            /check\s+.*\.promptci\s+before/i,
+            /read\s+.*report.*\s+before\s+.*(source|docs|code)/i,
+            /inspect\s+.*report.*\s+before\s+.*(source|docs|code)/i,
+        ];
+        for (const pat of inspectBeforePatterns) {
+            if (pat.test(file.content)) {
+                issues.push({
+                    // SP1 / B3: was a constant id inside this per-file loop — the
+                    // `break` below only exits the pattern loop, not the file loop, so
+                    // two matching files produced two issues sharing ONE id.
+                    id: inspectReportsFirstIssueId(file.path),
+                    severity: 'info',
+                    category: 'context_bloat',
+                    title: 'Instruction prioritizing generated reports over source docs',
+                    summary: `Instruction file "${path.basename(file.path)}" tells the agent to inspect ` +
+                        `generated reports before source files, which can cause circular or outdated guidance ingestion.`,
+                    filePaths: [file.path],
+                    locations: [],
+                    evidence: [`Matched pattern: ${pat.toString()}`],
+                    recommendation: 'Recommend linking to latest reports or directing the agent to read source documents first instead of generated reports.',
+                    fixRecipe: 'Update the instruction to prioritize reading source files and configuration rather than relying on generated reports.',
+                    confidence: 0.7,
+                });
+                break; // one issue per file
+            }
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=security-pack.js.map

package/dist/security-pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-pack.js","sourceRoot":"","sources":["../src/security-pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAgB9B,MAAM,eAAe,GAAoB;IACvC;QACE,EAAE,EAAE,qBAAqB;QACzB,KAAK,EAAE,sCAAsC;QAC7C,OAAO,EACL,8EAA8E;YAC9E,qDAAqD;QACvD,QAAQ,EAAE;YACR,iFAAiF;YACjF,oFAAoF;YACpF,+BAA+B;YAC/B,2BAA2B;SAC5B;QACD,cAAc,EACZ,gFAAgF;YAChF,yFAAyF;QAC3F,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,iJAAiJ;KAC7J;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,KAAK,EAAE,yCAAyC;QAChD,OAAO,EACL,6EAA6E;YAC7E,qDAAqD;QACvD,QAAQ,EAAE;YACR,sEAAsE;YACtE,6CAA6C;YAC7C,+CAA+C;SAChD;QACD,cAAc,EACZ,+GAA+G;QACjH,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,6GAA6G;KACzH;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,KAAK,EAAE,iDAAiD;QACxD,OAAO,EACL,8EAA8E;YAC9E,qDAAqD;QACvD,QAAQ,EAAE;YACR,gDAAgD;YAChD,kCAAkC;YAClC,sBAAsB;YACtB,wBAAwB;SACzB;QACD,cAAc,EACZ,2FAA2F;QAC7F,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,6HAA6H;KACzI;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,KAAK,EAAE,0CAA0C;QACjD,OAAO,EACL,uEAAuE;YACvE,oDAAoD;QACtD,QAAQ,EAAE;YACR,iCAAiC;YACjC,8BAA8B;YAC9B,yDAAyD;SAC1D;QACD,cAAc,EACZ,2EAA2E;QAC7E,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,qDAAqD;KACjE;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAG;IAC3B;QACE,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,sBAAsB;QAC/B,IAAI,EAAE,QAAQ;KACf;IACD;QACE,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,YAAY;KACnB;IACD;QACE,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,kBAAkB;KACzB;CACF,CAAC;AAEF,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,OAAO,iBAAiB,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB,EAAE,OAAe;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,uBAAuB,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvH,OAAO,uBAAuB,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,iFAAiF;AACjF,SAAS,0BAA0B,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9G,OAAO,uCAAuC,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,0BAA0B,CAAC,IAAY,EAAE,MAAc;IAC9D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAoB;IACrD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjF,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,qBAAqB,CAAE,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,MAAM,YAAY,GAAG;QACnB,GAAG,OAAO,CAAC,WAAW,CAAC,YAAY;QACnC,GAAG,OAAO,CAAC,WAAW,CAAC,eAAe;QACtC,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB;KACxC,CAAC;IACF,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACrG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,uBAAuB,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAE3G,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,+BAA+B,CAAE,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,kFAAkF;IAClF,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAClD,OAAO,CACL,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC;YACtC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAC5C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,yBAAyB,CAAE,CAAC;QAC7E,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,oEAAoE,CAAC;gBAChF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,iBAAiB,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACpG,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,8BAA8B,CAAE,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,CAAC,uEAAuE,CAAC;gBACnF,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,MAAM,cAAc,GAAG;oBACrB,gCAAgC;oBAChC,mBAAmB;oBACnB,sBAAsB;oBACtB,0BAA0B;oBAC1B,qBAAqB;iBACtB,CAAC;gBAEF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;oBAC9C,MAAM,CAAC,IAAI,CAAC;wBACV,EAAE,EAAE,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;wBAClD,QAAQ,EAAE,SAAS;wBACnB,QAAQ,EAAE,UAAU;wBACpB,KAAK,EAAE,wBAAwB,GAAG,CAAC,IAAI,2BAA2B;wBAClE,OAAO,EACL,oDAAoD,GAAG,CAAC,IAAI,cAAc;4BAC1E,+CAA+C;wBACjD,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;wBACtB,SAAS,EAAE,EAAE,EAAE,sCAAsC;wBACrD,QAAQ,EAAE,CAAC,wBAAwB,GAAG,CAAC,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC;wBAC7G,cAAc,EACZ,oEAAoE,GAAG,CAAC,IAAI,IAAI;4BAChF,kEAAkE;wBACpE,UAAU,EAAE,GAAG;qBAChB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClF,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,gBAAgB,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB;SACpC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1C,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAE1G,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,qCAAqC;YACzC,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,yCAAyC;YAChD,OAAO,EACL,2EAA2E;gBAC3E,4DAA4D;YAC9D,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,CAAC,0CAA0C,CAAC;YACtD,cAAc,EAAE,qFAAqF;YACrG,SAAS,EAAE,iCAAiC;YAC5C,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACnC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;oBACvB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;oBACrF,OAAO,CAAC,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,8BAA8B;YAClC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,eAAe;YACzB,KAAK,EAAE,kDAAkD;YACzD,OAAO,EACL,kDAAkD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa;gBACvF,+EAA+E;gBAC/E,wBAAwB;YAC1B,SAAS,EAAE,CAAC,YAAY,CAAC;YACzB,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,4CAA4C,CAAC;YAC/F,cAAc,EAAE,0DAA0D,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACzH,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC7F,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC5D,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1F,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACzB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACvB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,6BAA6B;gBACjC,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,eAAe;gBACzB,KAAK,EAAE,sDAAsD;gBAC7D,OAAO,EACL,wFAAwF;oBACxF,4EAA4E;gBAC9E,SAAS,EAAE,CAAC,uBAAuB,CAAC;gBACpC,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACjJ,cAAc,EAAE,yHAAyH;gBACzI,SAAS,EAAE,mHAAmH;gBAC9H,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,qBAAqB,GAAG;YAC5B,+BAA+B;YAC/B,kCAAkC;YAClC,gCAAgC;YAChC,oDAAoD;YACpD,uDAAuD;SACxD,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;YACxC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACV,8DAA8D;oBAC9D,mEAAmE;oBACnE,yDAAyD;oBACzD,EAAE,EAAE,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;oBACzC,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,eAAe;oBACzB,KAAK,EAAE,6DAA6D;oBACpE,OAAO,EACL,qBAAqB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;wBAC5E,iGAAiG;oBACnG,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtB,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,CAAC,oBAAoB,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;oBAChD,cAAc,EAAE,yHAAyH;oBACzI,SAAS,EAAE,uHAAuH;oBAClI,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;gBACH,MAAM,CAAC,qBAAqB;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}