@relayflows/sdk 2.0.0

package/dist/output-schema.js

@@ -0,0 +1,28 @@
+import { jsonSchemaError } from './json-schema.js';
+/** Validate authoring sugar before it can be compiled or submitted. */
+export function validateOutputDeclaration(step, at) {
+    if (step.output === undefined)
+        return [];
+    const errors = [];
+    if (!isObject(step.output)) {
+        errors.push(`${at}.output: expected a JSON Schema object`);
+    }
+    else {
+        // `output` lowers to a `json_schema` gate at compile time, so it must clear
+        // exactly the gate a hand-written `verification: {type: json_schema}` does.
+        // Without this the kernel refuses at `run.start` a declaration `flows check`
+        // had just reported as a gate — the divergence this PR exists to close.
+        const invalid = jsonSchemaError(step.output);
+        if (invalid !== undefined) {
+            errors.push(`${at}.output: invalid JSON Schema: ${invalid}`);
+        }
+    }
+    if (step.verification !== undefined) {
+        errors.push(`${at}: output already declares json_schema verification; remove verification`);
+    }
+    return errors;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=output-schema.js.map

package/dist/output-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-schema.js","sourceRoot":"","sources":["../src/output-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAKnD,uEAAuE;AACvE,MAAM,UAAU,yBAAyB,CACvC,IAAkD,EAClD,EAAU;IAEV,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,yEAAyE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/preflight.d.ts

@@ -0,0 +1,80 @@
+import type { FlowSpec, TriggerSpec } from './spec.js';
+import { type StepGateInspection } from './gate-contract.js';
+import type { PreflightFailureKind, PreflightWarningKind } from './failure-kinds.js';
+export type CliResolutionSource = 'step' | 'named' | 'flow' | 'project';
+export interface CliResolution {
+    stepId: string;
+    cli: string;
+    source: CliResolutionSource;
+    /** Model the step or selected named agent declared, probed with the CLI. */
+    model?: string;
+}
+export interface CliProbeResult {
+    exists: boolean;
+    authenticated: boolean;
+    /** False when a custom executable did not identify as a wrapper adapter. */
+    supported?: boolean;
+    /** Exact declared model passed the CLI's model-scoped readiness probe. */
+    modelAvailable?: boolean;
+    authCommand?: string;
+    modelCommand?: string;
+}
+export type CliProbeFailureDetail = 'spawn_failed' | `timeout:${number}ms` | `signal:${string}`;
+export declare class CliProbeError extends Error {
+    readonly detail: CliProbeFailureDetail;
+    constructor(detail: CliProbeFailureDetail);
+}
+/**
+ * Environment facts are injected; this module performs no I/O. A probe may
+ * throw when its fact cannot be collected. Preflight catches that boundary and
+ * emits `probe_failed` (or `command_unprovable` for a deterministic command).
+ */
+export interface PreflightProbes {
+    /**
+     * Resolve relative paths against the file implied by `source`, then probe
+     * `auth status`. When the step declared a `model`, the probe runs with that
+     * model in scope, so readiness answers "can this CLI use THIS model" rather
+     * than the weaker "is this CLI authenticated at all".
+     */
+    cli(cli: string, source: CliResolutionSource, model?: string): CliProbeResult;
+    executor(trigger: TriggerSpec): boolean;
+    command(binary: string): boolean;
+}
+export interface PreflightOptions {
+    projectCli?: string;
+    projectConfigPath?: string;
+    projectSearchStart?: string;
+    /** Exact, project-owned model allowlist from the nearest flows.json. */
+    models?: readonly string[];
+    modelRegistryPath?: string;
+    probes: PreflightProbes;
+}
+export interface PreflightRefusal {
+    severity: 'refusal';
+    kind: PreflightFailureKind;
+    message: string;
+    stepId?: string;
+    cli?: string;
+    agent?: string;
+    model?: string;
+    triggerId?: string;
+    executor?: string;
+    detail?: CliProbeFailureDetail;
+    /** Author-facing validation errors when kind is `invalid_spec`. */
+    errors?: string[];
+}
+export interface PreflightWarning {
+    severity: 'warning';
+    kind: PreflightWarningKind;
+    message: string;
+    stepId?: string;
+}
+export type PreflightDiagnostic = PreflightRefusal | PreflightWarning;
+export interface PreflightResult {
+    ok: boolean;
+    gates: StepGateInspection[];
+    resolutions: CliResolution[];
+    diagnostics: PreflightDiagnostic[];
+}
+export declare function preflight(flow: FlowSpec, options: PreflightOptions): PreflightResult;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAY,WAAW,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAqC,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEhG,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAExE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,mBAAmB,CAAC;IAC5B,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B,cAAc,GACd,WAAW,MAAM,IAAI,GACrB,UAAU,MAAM,EAAE,CAAC;AAEvB,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,MAAM,EAAE,qBAAqB;gBAA7B,MAAM,EAAE,qBAAqB;CAGnD;AAMD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAC9E,QAAQ,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC;IACxC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,SAAS,CAAC;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,WAAW,EAAE,mBAAmB,EAAE,CAAC;CACpC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAyEpF"}

package/dist/preflight.js

@@ -0,0 +1,361 @@
+import { acceptsAnyOutput, inspectStepGate } from './gate-contract.js';
+import { compileSpec, CompileError } from './compile.js';
+export class CliProbeError extends Error {
+    detail;
+    constructor(detail) {
+        super('CLI probe failed');
+        this.detail = detail;
+    }
+}
+export function preflight(flow, options) {
+    // Compile before touching any environment fact. `compileSpec` snapshots raw
+    // input into inert data, validates it against the closed authoring schema,
+    // and lowers `output` sugar into its json_schema gate — so the gate plan
+    // below describes what the kernel will actually judge, and no probe or gate
+    // inspection ever reads a live accessor. The failure is a named refusal
+    // rather than a thrown error (RFC covenant 2), which is the contract main
+    // settled for this boundary.
+    let compiled;
+    try {
+        compiled = compileSpec(flow);
+    }
+    catch (error) {
+        const errors = error instanceof CompileError
+            ? error.errors
+            : [error instanceof Error ? error.message : 'spec: expected JSON-compatible data'];
+        return {
+            ok: false,
+            gates: [],
+            resolutions: [],
+            diagnostics: [{
+                    severity: 'refusal',
+                    kind: 'invalid_spec',
+                    message: `Relayflow spec is invalid: ${errors.join('; ')}`,
+                    errors,
+                }],
+        };
+    }
+    const diagnostics = [];
+    const resolutions = [];
+    const resolutionByStep = new Map();
+    const cliProbeResults = new Map();
+    diagnostics.push(...unknownModelDiagnostics(compiled, options));
+    // Resolve the complete flow before touching any environment fact. A later
+    // statically unresolved CLI makes the whole submission impossible, so no
+    // earlier command, provider/model, or trigger probe may run first.
+    for (const step of compiled.steps) {
+        if (step.type === 'deterministic')
+            continue;
+        const resolution = resolveCli(step, compiled, options.projectCli);
+        if (resolution === undefined) {
+            diagnostics.push({
+                severity: 'refusal',
+                kind: 'cli_unresolved',
+                stepId: step.id,
+                message: unresolvedCliMessage(step.id, options),
+            });
+        }
+        else {
+            resolutions.push(resolution);
+            resolutionByStep.set(step.id, resolution);
+        }
+    }
+    if (diagnostics.length > 0) {
+        return { ok: false, gates: compiled.steps.map(inspectStepGate), resolutions, diagnostics };
+    }
+    for (const step of compiled.steps) {
+        warnOnVacuousGate(step, diagnostics);
+        warnOnUnprovableEffects(step, options.probes, diagnostics);
+        if (step.type === 'deterministic')
+            continue;
+        const resolution = resolutionByStep.get(step.id);
+        probeResolvedCli(resolution, options.probes, cliProbeResults, diagnostics);
+    }
+    for (const trigger of compiled.triggers ?? []) {
+        probeTrigger(trigger, options.probes, diagnostics);
+    }
+    return {
+        ok: !diagnostics.some((diagnostic) => diagnostic.severity === 'refusal'),
+        gates: compiled.steps.map(inspectStepGate),
+        resolutions,
+        diagnostics,
+    };
+}
+/** Pure authoring validation: no executable, command, trigger, or daemon probe. */
+function unknownModelDiagnostics(flow, options) {
+    const diagnostics = [];
+    // Named declarations remain in the normalized authoring object until this
+    // boundary so even unused or step-shadowed models are checked. toKernelSpec
+    // erases the map and selector only after this pass has had a chance to fail.
+    for (const [agent, declaration] of Object.entries(flow.agents ?? {})) {
+        if (isKnownModel(declaration.model, options.models))
+            continue;
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'model_unknown',
+            agent,
+            cli: declaration.cli,
+            model: declaration.model,
+            message: unknownNamedAgentModelMessage(agent, declaration.cli, declaration.model, options.modelRegistryPath),
+        });
+    }
+    for (const step of flow.steps) {
+        if (step.type === 'deterministic' || step.model === undefined)
+            continue;
+        if (isKnownModel(step.model, options.models))
+            continue;
+        const resolution = resolveCli(step, flow, options.projectCli);
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'model_unknown',
+            stepId: step.id,
+            ...(resolution === undefined ? {} : { cli: resolution.cli }),
+            model: step.model,
+            message: unknownModelMessage(step.id, step.model, resolution?.cli, options.modelRegistryPath),
+        });
+    }
+    return diagnostics;
+}
+function unknownNamedAgentModelMessage(agent, cli, model, registryPath) {
+    const source = registryPath === undefined
+        ? 'the nearest project config (no model registry was found)'
+        : `project model registry "${registryPath}"`;
+    return `Named agent "${agent}" declares model "${model}" for CLI "${cli}", but it is not listed in ${source}; add the exact model only after verifying that project is allowed to use it.`;
+}
+function isKnownModel(model, models) {
+    return models?.includes(model) === true;
+}
+function unknownModelMessage(stepId, model, cli, registryPath) {
+    const source = registryPath === undefined
+        ? 'the nearest project config (no model registry was found)'
+        : `project model registry "${registryPath}"`;
+    const cliContext = cli === undefined ? '' : ` for CLI "${cli}"`;
+    return `Step "${stepId}" declares model "${model}"${cliContext}, but it is not listed in ${source}; add the exact model only after verifying that project is allowed to use it.`;
+}
+function unresolvedCliMessage(stepId, options) {
+    const context = options.projectConfigPath !== undefined
+        ? ` Nearest project config "${options.projectConfigPath}" declares no cli; outer configs are shadowed.`
+        : options.projectSearchStart !== undefined
+            ? ` No flows.json was found from "${options.projectSearchStart}" to the filesystem root.`
+            : '';
+    return `Step "${stepId}" has no CLI at step, flow, or project level.${context}`;
+}
+function resolveCli(step, flow, projectCli) {
+    const named = step.type === 'agent' && step.agent !== undefined
+        ? flow.agents?.[step.agent]
+        : undefined;
+    // Model comes only from the step or its explicitly selected declaration.
+    // There is deliberately no flow/project or host default.
+    const effectiveModel = step.model ?? named?.model;
+    const model = effectiveModel !== undefined ? { model: effectiveModel } : {};
+    if (step.cli !== undefined)
+        return { stepId: step.id, cli: step.cli, source: 'step', ...model };
+    if (named !== undefined)
+        return { stepId: step.id, cli: named.cli, source: 'named', ...model };
+    if (flow.cli !== undefined)
+        return { stepId: step.id, cli: flow.cli, source: 'flow', ...model };
+    if (projectCli !== undefined)
+        return { stepId: step.id, cli: projectCli, source: 'project', ...model };
+    return undefined;
+}
+function probeResolvedCli(resolution, probes, cache, diagnostics) {
+    // Source is load-bearing: the same relative CLI string resolves from the
+    // flow directory for step/named/flow declarations and the config directory for
+    // project declarations.
+    // Model is part of the key: the same CLI probed with two different models
+    // is two different questions, and caching on the CLI alone would let a
+    // model that the CLI cannot resolve inherit an earlier model's pass.
+    const cacheKey = JSON.stringify([resolution.cli, resolution.source, resolution.model ?? null]);
+    let outcome = cache.get(cacheKey);
+    if (outcome === undefined) {
+        try {
+            outcome = { result: probes.cli(resolution.cli, resolution.source, resolution.model) };
+        }
+        catch (error) {
+            const detail = error instanceof CliProbeError ? error.detail : undefined;
+            outcome = { failure: detail ?? null };
+        }
+        cache.set(cacheKey, outcome);
+    }
+    if ('failure' in outcome) {
+        const detail = outcome.failure ?? undefined;
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'probe_failed',
+            stepId: resolution.stepId,
+            cli: resolution.cli,
+            ...(detail !== undefined ? { detail } : {}),
+            message: probeFailedMessage(resolution, detail),
+        });
+        return;
+    }
+    const { result } = outcome;
+    if (!result.exists) {
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'cli_missing',
+            stepId: resolution.stepId,
+            cli: resolution.cli,
+            message: `Step "${resolution.stepId}" declares CLI "${resolution.cli}", but it does not resolve as an executable.`,
+        });
+    }
+    else if (result.supported === false) {
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'cli_unsupported',
+            stepId: resolution.stepId,
+            cli: resolution.cli,
+            message: `Step "${resolution.stepId}" declares CLI "${resolution.cli}", but it is neither a supported raw Claude/Codex executable nor a conforming Relayflows wrapper; custom wrappers must identify with the relayflows-agent-cli-v1 contract.`,
+        });
+    }
+    else if (!result.authenticated) {
+        const command = result.authCommand ?? `${resolution.cli} auth status`;
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'cli_unauthenticated',
+            stepId: resolution.stepId,
+            cli: resolution.cli,
+            message: `Step "${resolution.stepId}" declares CLI "${resolution.cli}", but "${command}" exited non-zero; authenticate it or repair that adapter's authentication probe.`,
+        });
+    }
+    else if (resolution.model !== undefined && result.modelAvailable !== true) {
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'model_unavailable',
+            stepId: resolution.stepId,
+            cli: resolution.cli,
+            model: resolution.model,
+            message: `Step "${resolution.stepId}" declares model "${resolution.model}" for CLI "${resolution.cli}", but its model-scoped "${result.modelCommand ?? `${resolution.cli} auth status`}" probe exited non-zero; verify the model name and this credential's access.`,
+        });
+    }
+}
+function probeFailedMessage(resolution, detail) {
+    const prefix = `Could not verify CLI "${resolution.cli}" for step "${resolution.stepId}"`;
+    if (detail === undefined)
+        return `${prefix}.`;
+    if (detail === 'spawn_failed')
+        return `${prefix}: the probe process could not be started.`;
+    if (detail.startsWith('signal:')) {
+        return `${prefix}: the probe was terminated by signal "${detail.slice('signal:'.length)}".`;
+    }
+    return `${prefix}: the probe timed out after ${detail.slice('timeout:'.length)}.`;
+}
+function probeTrigger(trigger, probes, diagnostics) {
+    let registered;
+    try {
+        registered = probes.executor(trigger);
+    }
+    catch {
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'probe_failed',
+            triggerId: trigger.id,
+            executor: trigger.executor,
+            message: `Could not verify executor "${trigger.executor}" for trigger "${trigger.id}".`,
+        });
+        return;
+    }
+    if (!registered) {
+        diagnostics.push({
+            severity: 'refusal',
+            kind: 'no_executor',
+            triggerId: trigger.id,
+            executor: trigger.executor,
+            message: `Trigger "${trigger.id}" has no registered executor "${trigger.executor}".`,
+        });
+    }
+}
+/**
+ * A deterministic step is never silently accepted. An unresolved bare command
+ * may still be a shell builtin, function, or assignment, so it warns. A command
+ * containing `/` names a path rather than relying on shell resolution, so a
+ * failed existence probe refuses the flow.
+ */
+/**
+ * A declared `json_schema` gate that accepts every output is legal and stays
+ * legal — but it is indistinguishable in the gate plan from one that judges
+ * something, which is exactly the confusion AGENTS.md's "never edit a gate that
+ * judges your own work" rail exists to prevent.
+ */
+function warnOnVacuousGate(step, diagnostics) {
+    if (step.verification?.type !== 'json_schema')
+        return;
+    if (!acceptsAnyOutput(step.verification.schema))
+        return;
+    diagnostics.push({
+        severity: 'warning',
+        kind: 'vacuous_gate',
+        stepId: step.id,
+        message: `Step "${step.id}" declares a json_schema gate that accepts every possible output, so it judges nothing.`,
+    });
+}
+function warnOnUnprovableEffects(step, probes, diagnostics) {
+    if (step.type !== 'deterministic')
+        return;
+    const binary = firstCommandWord(step.command);
+    if (binary === undefined) {
+        diagnostics.push({
+            severity: 'warning',
+            kind: 'command_unprovable',
+            stepId: step.id,
+            message: `Step "${step.id}" has no command word to check, so nothing about it can be proven before execution.`,
+        });
+        return;
+    }
+    let exists;
+    try {
+        exists = probes.command(binary);
+    }
+    catch {
+        diagnostics.push({
+            severity: 'warning',
+            kind: 'command_unprovable',
+            stepId: step.id,
+            message: `Step "${step.id}" command "${binary}" could not be probed, so its presence is unproven before execution.`,
+        });
+        return;
+    }
+    diagnostics.push(exists
+        ? {
+            severity: 'warning',
+            kind: 'unprovable_effects',
+            stepId: step.id,
+            message: `Step "${step.id}" command "${binary}" resolves, but its effects cannot be proven before execution.`,
+        }
+        : binary.includes('/')
+            ? {
+                severity: 'refusal',
+                kind: 'command_missing',
+                stepId: step.id,
+                message: `Step "${step.id}" command path "${binary}" does not exist.`,
+            }
+            : {
+                severity: 'warning',
+                kind: 'command_unresolved',
+                stepId: step.id,
+                message: `Step "${step.id}" command "${binary}" does not resolve as an executable; it runs only if the shell supplies it.`,
+            });
+}
+function firstCommandWord(command) {
+    // Skip the shell prefixes that can legally precede the command word.
+    //
+    // Review caught this on PR #47: the new path-like refusal keys on the first
+    // word containing a slash, and `TMPDIR=/tmp printf ok`, `>/tmp/out echo hi`
+    // and `PATH=/usr/bin:$PATH mkdir x` all have one — but none of them names a
+    // path to execute. All three are valid and were being refused outright,
+    // which is exactly the "refusing would reject valid flows" failure the warn
+    // behaviour exists to avoid.
+    //
+    // An assignment is NAME=value with a shell-legal name; a redirection starts
+    // with < or > (optionally with a leading fd number). Neither is the command.
+    let rest = command.trim();
+    for (;;) {
+        const prefix = rest.match(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|[^\s]*)|[0-9]*[<>]{1,2}\s*[^\s]+)\s+/);
+        if (prefix === null)
+            break;
+        rest = rest.slice(prefix[0].length);
+    }
+    const match = rest.match(/^(?:"([^"]+)"|'([^']+)'|([^\s]+))/);
+    return match?.[1] ?? match?.[2] ?? match?.[3];
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAA2B,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAgCzD,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAArB,YAAqB,MAA6B;QAChD,KAAK,CAAC,kBAAkB,CAAC,CAAC;QADP,WAAM,GAAN,MAAM,CAAuB;IAElD,CAAC;CACF;AAgED,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,OAAyB;IACjE,4EAA4E;IAC5E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,6BAA6B;IAC7B,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,YAAY;YAC1C,CAAC,CAAC,KAAK,CAAC,MAAM;YACd,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;QACrF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,CAAC;oBACZ,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAC1D,MAAM;iBACP,CAAC;SACH,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAA0B,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE3D,WAAW,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,0EAA0E;IAC1E,yEAAyE;IACzE,mEAAmE;IACnE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;YAAE,SAAS;QAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,WAAW,CAAC,IAAI,CAAC;gBACf,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7B,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IAC7F,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,iBAAiB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACrC,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;YAAE,SAAS;QAC5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC;QAClD,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC9C,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC;QACxE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;QAC1C,WAAW;QACX,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,uBAAuB,CAC9B,IAAc,EACd,OAAyB;IAEzB,MAAM,WAAW,GAAuB,EAAE,CAAC;IAE3C,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,KAAK,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrE,IAAI,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QAC9D,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,eAAe;YACrB,KAAK;YACL,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,OAAO,EAAE,6BAA6B,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC;SAC7G,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,SAAS;QACxE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACvD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9D,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;YAC5D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,6BAA6B,CACpC,KAAa,EACb,GAAW,EACX,KAAa,EACb,YAAgC;IAEhC,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,0DAA0D;QAC5D,CAAC,CAAC,2BAA2B,YAAY,GAAG,CAAC;IAC/C,OAAO,gBAAgB,KAAK,qBAAqB,KAAK,cAAc,GAAG,8BAA8B,MAAM,+EAA+E,CAAC;AAC7L,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,MAAqC;IACxE,OAAO,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAc,EACd,KAAa,EACb,GAAuB,EACvB,YAAgC;IAEhC,MAAM,MAAM,GAAG,YAAY,KAAK,SAAS;QACvC,CAAC,CAAC,0DAA0D;QAC5D,CAAC,CAAC,2BAA2B,YAAY,GAAG,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IAChE,OAAO,SAAS,MAAM,qBAAqB,KAAK,IAAI,UAAU,6BAA6B,MAAM,+EAA+E,CAAC;AACnL,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAyB;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACrD,CAAC,CAAC,4BAA4B,OAAO,CAAC,iBAAiB,gDAAgD;QACvG,CAAC,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;YACxC,CAAC,CAAC,kCAAkC,OAAO,CAAC,kBAAkB,2BAA2B;YACzF,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,SAAS,MAAM,gDAAgD,OAAO,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,UAAU,CACjB,IAAkD,EAClD,IAAc,EACd,UAA8B;IAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAC7D,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,SAAS,CAAC;IACd,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC;IAClD,MAAM,KAAK,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IAChG,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IAC/F,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IAChG,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;IACvG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAyB,EACzB,MAAuB,EACvB,KAAmC,EACnC,WAAkC;IAElC,yEAAyE;IACzE,+EAA+E;IAC/E,wBAAwB;IACxB,0EAA0E;IAC1E,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC;QAC5C,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC;SAChD,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,OAAO,EAAE,SAAS,UAAU,CAAC,MAAM,mBAAmB,UAAU,CAAC,GAAG,8CAA8C;SACnH,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,OAAO,EAAE,SAAS,UAAU,CAAC,MAAM,mBAAmB,UAAU,CAAC,GAAG,4KAA4K;SACjP,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,GAAG,UAAU,CAAC,GAAG,cAAc,CAAC;QACtE,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,OAAO,EAAE,SAAS,UAAU,CAAC,MAAM,mBAAmB,UAAU,CAAC,GAAG,WAAW,OAAO,mFAAmF;SAC1K,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5E,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,OAAO,EAAE,SAAS,UAAU,CAAC,MAAM,qBAAqB,UAAU,CAAC,KAAK,cAAc,UAAU,CAAC,GAAG,4BAA4B,MAAM,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,GAAG,cAAc,8EAA8E;SACrQ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,UAAyB,EACzB,MAA8B;IAE9B,MAAM,MAAM,GAAG,yBAAyB,UAAU,CAAC,GAAG,eAAe,UAAU,CAAC,MAAM,GAAG,CAAC;IAC1F,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,MAAM,GAAG,CAAC;IAC9C,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,GAAG,MAAM,2CAA2C,CAAC;IAC3F,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,MAAM,yCAAyC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9F,CAAC;IACD,OAAO,GAAG,MAAM,+BAA+B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CACnB,OAAoB,EACpB,MAAuB,EACvB,WAAkC;IAElC,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,8BAA8B,OAAO,CAAC,QAAQ,kBAAkB,OAAO,CAAC,EAAE,IAAI;SACxF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,aAAa;YACnB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,YAAY,OAAO,CAAC,EAAE,iCAAiC,OAAO,CAAC,QAAQ,IAAI;SACrF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAc,EAAE,WAAkC;IAC3E,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,KAAK,aAAa;QAAE,OAAO;IACtD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO;IACxD,WAAW,CAAC,IAAI,CAAC;QACf,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,yFAAyF;KACnH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAc,EACd,MAAuB,EACvB,WAAkC;IAElC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,qFAAqF;SAC/G,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,IAAI,CAAC;YACf,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,cAAc,MAAM,sEAAsE;SACpH,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,MAAM;QACrB,CAAC,CAAC;YACA,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,cAAc,MAAM,gEAAgE;SAC9G;QACD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;YACpB,CAAC,CAAC;gBACA,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,mBAAmB,MAAM,mBAAmB;aACtE;YACH,CAAC,CAAC;gBACA,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,cAAc,MAAM,6EAA6E;aAC3H,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,qEAAqE;IACrE,EAAE;IACF,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,4EAA4E;IAC5E,6BAA6B;IAC7B,EAAE;IACF,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1B,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAChH,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM;QAC3B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}