@stll/oxlint-config 1.3.1 → 1.5.0

package/README.md

@@ -257,12 +257,15 @@ Peer ranges declare support: they must include the policy compiler release and t
 compatibility release when the selected layout uses it. Ranges do not contribute
 to the installed compiler inventory.
 
-JavaScript update roots come from the repository root, declared workspace membership,
+JavaScript update roots include the repository root, declared workspace membership,
 and directories with their own `bun.lock`, `package-lock.json`, `yarn.lock`, or
-`pnpm-lock.yaml`. Other package manifests do not create update roots; directory names
-have no special meaning. Workspace members share their owner's update entry.
+`pnpm-lock.yaml`. Independent manifests with dependencies, an explicit package manager,
+or dependency-bearing workspace members also create update roots. Metadata-only
+fixtures do not. Package-manager selection follows the nearest declaration or lock;
+workspace members share their owner's update entry. Bundler `Gemfile`/`Gemfile.lock`
+and Composer `composer.json`/`composer.lock` declare roots at their own directories.
 
-`node-engine` and `cloud-setup-drift` are mandatory: opt-outs cannot bypass the
+`node-engine`, `workflow-trust` and `cloud-setup-drift` are mandatory: opt-outs cannot bypass the
 shared Node support range or generated cloud setup requirements.
 
 Opt-outs apply to the entire repository for that rule. Unknown or duplicate
@@ -288,6 +291,62 @@ discovering or building referenced projects. Missing, unreadable, and zero-input
 selected configs fail the check. `--help` prints usage and exits successfully;
 unknown arguments fail.
 
+## Generate dependency update configuration
+
+Run `bunx --no-install stll-dependabot` from the repository root. It reads tracked
+configuration and writes canonical `.github/dependabot.yml`, preserving an existing
+`.github/dependabot.yaml` spelling, including when the indexed output has been
+deleted from the working tree. Conflicting indexed or existing spellings are
+rejected, and unrelated unreadable inputs still stop generation. Repeated runs
+produce identical bytes; linked output files and directories are rejected.
+
+Use `stll-dependabot --check` in CI to compare bytes without writing. Missing or
+stale output exits with status 1; current output exits with status 0. Pass the
+same `--config` argument to write and check commands when using explicit input.
+
+An optional `--config stll-dependabot.json` input declares only coverage:
+
+```json
+{
+  "updates": [
+    { "ecosystem": "bun", "directories": ["/"] },
+    { "ecosystem": "github-actions", "directories": ["/"] },
+    { "ecosystem": "cargo", "directories": ["/native"] }
+  ]
+}
+```
+
+Each ecosystem appears once, and directories must be unique literal absolute
+repository paths. Declarations must cover every detected update root; they may
+also declare ecosystems whose manifests are outside automatic discovery.
+Shared `toolchain.json` owns the schedule, cooldown, groups, and tooling-owned
+package/action/image ignores. The input rejects policy overrides. Without
+`--config`, the tracked manifest inventory supplies ecosystem roots.
+
+For programmatic generation, the `@stll/oxlint-config/dependabot` subpath exports
+`generateDependabotConfig({ files, policy, updates? })`, `parseDependabotInput`,
+and `parseToolchainPolicy`. `parseDependabotInput` validates the JSON shape above
+and returns the `updates` array:
+
+```ts
+import {
+  generateDependabotConfig,
+  parseToolchainPolicy,
+} from "@stll/oxlint-config/dependabot";
+import sharedPolicy from "@stll/oxlint-config/toolchain.json";
+
+const yaml = generateDependabotConfig({
+  files: trackedConfiguration,
+  policy: parseToolchainPolicy(sharedPolicy).dependabot,
+});
+```
+
+The root lint-config entry does not load the tooling parser dependencies
+`yaml`, `picomatch` or `smol-toml`; they belong to the tooling subpath and CLIs.
+`files` maps existing tracked repository-relative configuration paths to their text.
+Deleted tracked manifests are absent from the generator snapshot. Use the
+CLI when a tracked snapshot is not already available; no source imports are needed.
+
 ## Shared cloud setup
 
 Add an explicit declaration to tracked root `stll-toolchain.json`:
@@ -305,6 +364,7 @@ Add an explicit declaration to tracked root `stll-toolchain.json`:
     },
     "tools": {
       "cargo-nextest": "0.9.148",
+      "gitleaks": "8.30.1",
       "wasm-bindgen-cli": "0.2.126",
       "uv": "0.13.1",
       "time": "1.9"
@@ -324,6 +384,18 @@ repository-relative path; its existing parent must be safe at runtime. Track an
 bunx --no-install stll-cloud-setup
 ```
 
+When PostgreSQL is enabled, the selected environment file contains `DATABASE_URL`
+and `POSTGRES_HOST`, `POSTGRES_USER`, `POSTGRES_PASSWORD`, `POSTGRES_DB_NAME`,
+and `POSTGRES_ADDITIONAL_CONNECTION_DATA`. `DATABASE_URL` retains the
+`postgresql://` spelling; the component values assemble the same endpoint with
+`postgres://`. Additional connection data is empty by default.
+Remote Claude sessions receive these generated values as quoted `export`
+assignments after service startup succeeds. SessionStart does not source the
+selected environment file, and it preserves the configured `envFile` path for
+tools that load that file directly. Settings generation migrates only exact
+SessionStart hooks from releases 1.1.0 and 1.3.1 and the prior main-branch form
+at 783bc97; edited or unknown hook forms fail with the canonical repair.
+
 Rust is optional. A tracked root `rust-toolchain.toml` enables it automatically;
 otherwise declare `cloud.rust` to enable it. `cloud.rust.toolchain`, when given,
 must be an exact stable Rust patch. The root toolchain file supplies the pin when
@@ -336,10 +408,17 @@ the minimal profile and a pinned, checksum-verified rustup installer. Rust-enabl
 setup also provisions Ubuntu's `build-essential` package for native compilation
 and linking.
 
+`cloud.rust.additionalToolchains` explicitly selects extra exact compiler releases.
+Each must match the shared pin or a valid `rustExceptions` entry and differ from the
+primary compiler. Extras are installed once with the minimal profile and verified
+offline at session start. An exception alone authorizes a version; it does not
+provision it. This setting installs neither Hawk nor extra compiler components.
+Generated scripts contain no trailing whitespace and end with one newline.
+
 `cloud.tools` is a closed object: the supported keys are `cargo-nextest`,
-`wasm-bindgen-cli`, `uv`, and `time`. Each value must be an exact release supported by
+`wasm-bindgen-cli`, `gitleaks`, `uv`, and `time`. Each value must be an exact release supported by
 the installed tooling package. Unknown tools and unsupported versions fail
-generation. `cargo-nextest`, `wasm-bindgen-cli`, and `uv` use versioned upstream Linux binaries with committed
+generation. `cargo-nextest`, `wasm-bindgen-cli`, `gitleaks`, and `uv` use versioned upstream Linux binaries with committed
 SHA256 pins for amd64 and arm64; setup does not build them with `cargo install`.
 `time` installs GNU time (`/usr/bin/time`, needed for `/usr/bin/time -v`) from
 Ubuntu's `time` package with bounded apt; its value is the upstream release
@@ -367,20 +446,29 @@ binary DEBs for the declared release and architecture, verifies the policy's
 SHA256 pins, and installs those local files with apt. It does not resolve Valkey
 from a mutable package index.
 The command writes `.agents/cloud-setup.sh` with executable permissions and
-merges a `SessionStart` hook into `.claude/settings.json`. The hook runs
-`bash "$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh" start` only when
-`CLAUDE_CODE_REMOTE=true`, including sessions that reuse cached filesystems and
-sessions started from a repository subdirectory. Generation replaces the
-relative-path hook written by 1.1.0 in place. After successful startup, it appends the
-managed shell profile's literal exports to `CLAUDE_ENV_FILE` when available, so
-subsequent Claude commands select pinned runtimes and tools before preinstalled
-versions while retaining their inherited `PATH`. The settings also set
+merges a `SessionStart` hook into `.claude/settings.json`. Only when
+`CLAUDE_CODE_REMOTE=true`, the hook runs
+`bash "$CLAUDE_PROJECT_DIR/.agents/cloud-setup.sh" session` if `CLAUDE_ENV_FILE`
+is nonempty, and `start` otherwise. This includes sessions that reuse cached
+filesystems and sessions started from a repository subdirectory. Generation
+replaces the exact hooks written by 1.1.0 and 1.3.1 and the prior main-branch
+form in place.
+After successful startup, the hook copies existing `CLAUDE_ENV_FILE` content
+into a temporary file in the same directory, adds the generated service exports
+and managed shell profile's literal exports, then renames it over the destination.
+The resulting file has mode `0600`; an existing destination must be a regular,
+non-symlink file. Subsequent Claude commands select pinned runtimes and tools
+before preinstalled versions while retaining their inherited `PATH`. The settings also set
 `"attribution": {"commit": "", "pr": ""}`, so cloud sessions add no tool
 attribution to commits or pull requests. Existing environment-file
 content, unrelated settings, and hooks are preserved. Invalid JSON, disabled
 hooks, conflicting cloud startup entries, or a different `attribution` value stop
-generation with a repair instruction. Commit both generated files.
+generation with a repair instruction. Startup or environment persistence failures
+produce actionable session context and a stderr reason; SessionStart cannot block
+a session. Successful hook execution is silent on stdout. Commit both generated files.
 Generation refuses symlink parents or destinations and hard-linked destinations.
+Generation recreates its deleted tracked output files and requires unrelated
+tracked inputs to remain readable.
 `stll-toolchain-check` rejects missing, drifted, or undeclared tracked scripts,
 missing or conflicting startup hooks, and missing or different attribution
 settings with mandatory `cloud-setup-drift`.
@@ -389,16 +477,26 @@ prints usage without reading repository configuration.
 
 | Environment phase       | Command                               |
 | ----------------------- | ------------------------------------- |
-| Networked install       | `bash .agents/cloud-setup.sh install` |
-| Offline session startup | `bash .agents/cloud-setup.sh start`   |
-
-Both commands can be rerun. Missing or unknown subcommands print usage and
+| Networked install       | `bash .agents/cloud-setup.sh install`   |
+| Offline session startup | `bash .agents/cloud-setup.sh start`     |
+| Startup with exports    | `bash .agents/cloud-setup.sh session`   |
+
+Runtime installation repairs and verifies a missing or empty system CA bundle
+offline before any apt refresh or download, including when the certificate package
+is already current. If the certificate updater is unavailable or cannot restore
+trust, restore the base image offline before rerunning installation.
+
+All three commands can be rerun. Passwordless sudo rules limited to specific
+script arguments must authorize `install`, `start`, and `session`.
+Missing or unknown subcommands print usage and
 exit 2; there is no implicit lifecycle mode. The script supports Ubuntu 24.04
 with root access or passwordless sudo and fails when required capabilities
 or pinned installations are unavailable. `install` provisions runtimes,
 dependencies, and declared services; `start` refreshes the managed shell environment
 and restores local services after
-cached environments lose running processes. Services bind only to localhost.
+cached environments lose running processes. `session` performs the same offline
+startup, sends startup output to stderr, and emits the declared service environment
+exports on stdout for the hook to capture. Services bind only to localhost.
 System provisioning runs as root; frozen dependencies run as the invoking user
 with that user's home and a private, user-owned Bun cache. Package installation
 does not permit automatic downgrades.
@@ -432,14 +530,14 @@ or the configured package hosts; a redirected download names its original host.
 
 Allow these direct download hosts for the generated installer:
 
-| Host                   | Downloads                                                                |
-| ---------------------- | ------------------------------------------------------------------------ |
-| `nodejs.org`           | Node archives and SHA256 manifests                                       |
-| `github.com`           | Bun archives and checksums; pinned nextest, wasm-bindgen and uv releases |
-| `static.rust-lang.org` | Pinned rustup-init, Rust manifests, toolchains, components and targets   |
-| `www.postgresql.org`   | PostgreSQL repository signing key                                        |
-| `apt.postgresql.org`   | PostgreSQL packages and repository metadata                              |
-| `download.valkey.io`   | Pinned Valkey binary packages                                            |
+| Host                   | Downloads                                                                          |
+| ---------------------- | ---------------------------------------------------------------------------------- |
+| `nodejs.org`           | Node archives and SHA256 manifests                                                 |
+| `github.com`           | Bun archives and checksums; pinned nextest, wasm-bindgen, gitleaks and uv releases |
+| `static.rust-lang.org` | Pinned rustup-init, Rust manifests, toolchains, components and targets             |
+| `www.postgresql.org`   | PostgreSQL repository signing key                                                  |
+| `apt.postgresql.org`   | PostgreSQL packages and repository metadata                                        |
+| `download.valkey.io`   | Pinned Valkey binary packages                                                      |
 
 GitHub release downloads redirect to `release-assets.githubusercontent.com`;
 allow that host as well. This includes Bun and the optional prebuilt tools.
@@ -463,6 +561,66 @@ resolved JavaScript targets, and entry points. `stll-publish-contract --write`
 records an explicit contract decision as a reviewable diff; it also validates
 consumer support and cannot accept development-only requirements.
 
+Use `stll-publish-contract --artifact path/to/package.tgz` to check an existing
+release archive after the workspace metadata checks. It validates the static
+literal import closure within the packed package and compares the archive's
+manifest with its declared public workspace package's committed contract and
+resolved build target. The command never packs
+or executes the archive, accepts exactly one archive, and cannot combine
+`--artifact` with `--write`. Unknown or private package artifacts fail. Bare external
+package dependencies are outside this local archive check. Dynamic imports require
+literal specifiers; computed values cannot exclude the module loader namespace.
+The reader follows literal ESM imports/re-exports, CommonJS
+require/resolve calls and named, destructured or namespace `createRequire` bindings based on
+`import.meta.url` or `__filename`. Asset references must be regular packed files;
+non-JavaScript ESM assets are not parsed as scripts. Recursive import mappings
+are rejected, including expanding wildcard aliases.
+Node resolves collected specifiers against a temporary archive filesystem:
+`createRequire(importer).resolve` for CommonJS and `import.meta.resolve` with the
+importer's URL for ESM, using their respective default conditions. The worker
+reads manifests and file existence without loading package code. Only manifests
+need contents; other members use inert placeholders, and selected targets must
+still be regular packed members. External import-map dependencies use inert
+metadata outside the packed package boundary. Unknown external mapping forms
+fail explicitly. Temporary files and the worker are removed after validation.
+Regular-file validation and script traversal are tracked separately: an asset
+later reached through CommonJS is parsed regardless of archive member order.
+Exported declarations use the same scope collection as ordinary declarations.
+Loader references are allowed only within recognized static declarations and
+calls; inline module factories and unsupported namespace references fail closed.
+Known loader calls require one literal specifier. Unresolved loader aliases,
+computed bases, unsupported propagation and conflicting bindings report an
+`Unresolvable dynamic loader` diagnostic instead of omitting dependencies.
+In CommonJS scopes, declarations, parameters and assignments that shadow wrapper
+loader names or inherited loader aliases must resolve to a recognized static
+binding. Unknown bindings fail closed; uninitialized wrapper `var` declarations
+retain the existing loader binding.
+Imports from `node:module` or `module` must declare recognized factory or namespace
+bindings, including string-named `createRequire` imports. Unsupported named imports,
+side-effect imports, re-exports and dynamic namespace imports fail closed. Derived
+aliases retain this policy in ESM scopes. A `__filename` factory base must resolve
+to the unshadowed CommonJS wrapper binding; ESM factories use `import.meta.url`.
+Loader bindings, factory results, module namespaces and their aliases cannot be
+exported through ESM declarations/defaults/re-exports or CommonJS exports. They
+produce an `unsupported loader propagation` diagnostic; analysis does not infer
+loader behavior across module boundaries. Ordinary exported functions may still
+make recognized static local loader calls.
+
+This check proves the import closure of ordinary authored code in our own
+packages within the supported static forms. It is not a security boundary against
+deliberately obfuscated code. Unrecognized loader forms are rejected rather than
+inferred; the check does not interpret dynamic code or prove arbitrary JavaScript
+data flow. Known escape hatches are rejected: CommonJS wrapper `arguments`,
+`eval`, `Function` construction/calls, `module.constructor`, `module.require`,
+`process.mainModule`, global `require` properties, and `require.cache`,
+`require.extensions` or `require.main` access. The strict metadata-read policy
+also rejects aliases such as `const a = require.main`, which would otherwise
+propagate an unclassified loader-capable object.
+
+Wildcard exports exclude directory entries and treat only JavaScript-like
+matches as scripts. Licenses and other extensionless wildcard matches remain
+opaque; an import that reaches extensionless code still traverses its closure.
+
 The consumer policy pins Node 22.23.3, npm 12.2.0, pnpm 12.9.1, and TypeScript
 6.0.3 independently of the development toolchain. Published engines and TypeScript
 peers must support the consumer versions; ranges may include newer versions.
@@ -542,6 +700,9 @@ static contract; no older Node-to-ECMAScript mapping is inferred. Browser target
 are unsupported here: declare an explicit ECMAScript year. Types-only contracts reject any packed JavaScript. Nested
 package manifests and explicit module extensions determine parsing mode.
 Linked syntax inputs and unsafe archive paths fail before staging.
+Invalid JavaScript encountered during import-closure analysis throws a `SyntaxError`
+that names the packed member and retains the original parser error as its cause.
+This can precede the declared-target and native Node checks.
 
 The reusable consumer job declares its exact scope in `stll-toolchain.json`:
 
@@ -623,6 +784,118 @@ exits successfully even when history is unreadable, reporting `changed: true`
 and `status: "unreadable"`. Use `changed` to force the full CI depth on both
 pull requests and merge-queue runs. An unreadable snapshot never skips checks.
 
+Run repository-installed tools only after the workflow's existing trust decision.
+The mandatory `workflow-trust` rule applies to PR workflows declaring a
+`trust-check` job. Repository execution requires a direct dependency and a
+condition requiring its `trusted == 'true'` output for every PR trigger.
+Before that boundary, only literal output, bounded comparisons, `true`, `false`,
+`exit`, bounded Git `rev-parse`/`merge-base` object queries, and GET-only `gh api`
+reads are accepted. The trust job's structural `if`/`elif` comparisons use the
+same checks; output may go only to `GITHUB_OUTPUT` or `/dev/null`. Variables must
+be quoted, and command names and `printf` formats must be literal.
+
+The following catalog is the production allowlist. Command kinds select the
+corresponding bounded argument validator; a listed command does not authorize
+arbitrary arguments. Git requires the stated number of explicit object refs.
+Bootstrap action inputs are restricted to the listed keys; Bun requires a literal
+version rather than a repository version file.
+
+<!-- workflow-trust-bootstrap-catalog:start -->
+
+```json
+{
+  "commands": {
+    "test": "comparison",
+    "[": "comparison",
+    "[[": "comparison",
+    "true": "status",
+    "false": "status",
+    "exit": "exit",
+    "echo": "output",
+    "printf": "format",
+    "git": "git",
+    "gh": "github"
+  },
+  "git": {
+    "rev-parse": {
+      "flags": ["--short", "--verify"],
+      "references": 1
+    },
+    "merge-base": {
+      "flags": ["--all", "--is-ancestor"],
+      "references": 2
+    }
+  },
+  "github": ["api"],
+  "actions": {
+    "actions/checkout": [
+      "fetch-depth",
+      "persist-credentials",
+      "ref",
+      "repository",
+      "submodules"
+    ],
+    "oven-sh/setup-bun": ["bun-version", "no-cache"]
+  }
+}
+```
+
+<!-- workflow-trust-bootstrap-catalog:end -->
+
+Job containers and nonempty services require the job-level trust gate because
+they start before steps and supply executable code. A step condition cannot
+authorize their startup. Digest pinning alone does not approve an image for
+pre-trust execution; the guard has no implicit image approval catalog.
+Before trust, step actions must use a full SHA and match the explicit bootstrap
+catalog: `actions/checkout` or `oven-sh/setup-bun`, with
+bounded selector inputs. Other actions and unsupported inputs require the
+job-level gate; a step condition cannot authorize them. Every job-level reusable workflow
+call requires the job-level trust condition, including pinned calls without inputs.
+
+Interpreters, sourced files, executable paths, package managers (including
+metadata and script-disabled install modes), launchers, custom shells, and
+unknown commands or syntax require trust. File readers, file-presence tests,
+`jq`/`yq`, Git working-tree/history commands, and `actions/setup-node` require the
+job-level gate. Unsupported options and query programs also require the gate. For example, gate the entire
+detector job, including dependency installation:
+
+```yaml
+check-changes:
+  needs: [trust-check]
+  if: >-
+    always() && !cancelled()
+    && ((github.event_name != 'pull_request'
+         && github.event_name != 'pull_request_target')
+        || needs.trust-check.outputs.trusted == 'true')
+  runs-on: ubuntu-latest
+  steps:
+    # Check out, set up Bun, install dependencies, then run the shared detector.
+    - run: bunx --no-install stll-toolchain-changed --since "$BASE_REF"
+```
+
+Actions interpolation is checked before shell quoting or comments. Only the
+bounded identity expressions `github.sha`, `github.run_id`, `github.run_attempt`
+and `github.repository` may appear directly in pre-trust scripts. Other contexts,
+functions and matrix values require environment indirection or the trust gate;
+the guard does not infer that an expression is safe from its shell quotes.
+Pass contributor-controlled metadata through a supported data environment key
+(`PR_TITLE`, `HEAD_REF`, `ISSUE_BODY` or `COMMENT_BODY`) and quote its expansion:
+
+```yaml
+- env:
+    PR_TITLE: ${{ github.event.pull_request.title }}
+  run: echo "$PR_TITLE"
+```
+
+The trust job must classify each PR trigger used by the workflow. Main/manual
+jobs remain runnable when the PR-only trust job is skipped. Job or step
+conditions may prove that execution is limited to non-PR events; event string
+comparisons follow Actions case-insensitive equality. The guard
+proves only supported static metadata commands and boolean conditions; unknown
+commands and conditions cannot authorize execution. It does not validate the
+trust job's authorization policy.
+Workflows with no declared trust job retain their existing fork-CI policy.
+
 The comparison includes Bun declarations, Node selectors and support ranges,
 resolved TypeScript compiler versions (including workspace and compatibility
 aliases), oxlint, oxlint-tsgolint, oxfmt, and shared tooling pins. Lockfile
@@ -701,3 +974,43 @@ another exact stable release. Each record contains exactly `pin`, `reason`,
 `tracking` (a GitHub issue URL) and `expires` (a future `YYYY-MM-DD` date).
 Channels, expired records and `rust-version` rule opt-outs fail validation.
 See the [root policy guide](../../README.md) for a complete declaration.
+
+`stll-toolchain-check` requires tracked JavaScript and TypeScript files selected by type-aware lint to belong to declared TypeScript projects. See the [Node scripts project recipe](https://github.com/stella/tooling/blob/main/README.md) for scripts outside the library project. The check inventories Oxlint-selected files and expands compiler configurations; it does not run lint or type checking.
+
+The project-ownership guard models declared package-manager scripts, including
+literal filtered Bun build bodies and their script aliases with the selected
+workspace as the working directory. It inventories supported linter invocations;
+it never executes build bodies. Unrecognized linter launchers and script forms
+fail closed. This is an ownership check for ordinary authored package scripts,
+not a security boundary against deliberately obfuscated code or lint invocations
+hidden inside arbitrary program bodies. Unsupported forms require an explicit
+supported script invocation or a separately tested extension to the model.
+
+## Quarantine preset and expiry checks
+
+Run `bunx --no-install stll-quarantine --sync` before installation to create the
+five-day Bun preset and synchronize permanent exact-name `@stll/` exemptions.
+The command derives registry identities from dependency declarations and the
+root Bun lockfile, including transitive platform packages. Existing first-party
+creation timestamps remain stable across runs; they are not expiries.
+
+Third-party entries require `# quarantine-expires: YYYY-MM-DDTHH:mm:ss.sssZ`.
+`stll-toolchain-check` warns 48 hours before expiry; warnings continue through
+the existing 24-hour removal grace, after which expired entries fail. The
+quarantine rule cannot be opted out. `stll-quarantine --check` is read-only;
+`--prune` removes expired third-party entries without removing first-party ones.
+`--help` lists modes. Linked output files are rejected.
+
+`@stll/oxlint-config/quarantine` exports the Node-compatible repository helpers
+`checkRepositoryQuarantine`, `synchronizeRepositoryQuarantine`, and
+`pruneRepositoryQuarantine`, accepting a tracked `files` snapshot and optional
+`now`. The toolchain API reports advisory expiry messages through `onWarning`;
+its returned diagnostics remain failures. Snapshot readers keep lockfiles
+opaque by default; `{ bunLock: "content" }` explicitly requests the root graph
+when quarantine identity checks need it.
+
+The shared scheduled workflow imports the same dependency-free policy core
+from an exact tooling commit; it does not install consumer dependencies to
+perform enforcement or pruning. Its stable removal branch updates one PR per
+repository. See the [root guide](../../README.md#package-quarantine) for the
+inline annotation format and adoption boundary.

package/dist/cloud-setup-cli.cjs

@@ -1,46 +1,17 @@
 #!/usr/bin/env node
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_file = require("./generated-file.cjs");
 const require_toolchain_inputs = require("./toolchain-inputs.cjs");
 const require_toolchain_guard = require("./toolchain-guard.cjs");
 const require_toolchain_schema = require("./toolchain-schema.cjs");
-let node_fs = require("node:fs");
-let node_path = require("node:path");
 let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
+let node_fs = require("node:fs");
 //#region src/cloud-setup-cli.ts
 const usage = "Usage: stll-cloud-setup (run from repository root)\n       stll-cloud-setup --help";
-const optionalStat = async (path) => {
-	try {
-		return await (0, node_fs_promises.lstat)(path);
-	} catch (error) {
-		if (error instanceof Error && "code" in error && error.code === "ENOENT") return void 0;
-		throw error;
-	}
-};
-const checkOutput = async (destination) => {
-	const parent = (0, node_path.dirname)(destination);
-	const parentStat = await optionalStat(parent);
-	if (parentStat !== void 0 && (parentStat.isSymbolicLink() || !parentStat.isDirectory())) throw new Error("cloud setup parent must be a real repository directory");
-	const destinationStat = await optionalStat(destination);
-	if (destinationStat !== void 0 && (destinationStat.isSymbolicLink() || !destinationStat.isFile() || destinationStat.nlink !== 1)) throw new Error("cloud setup destination must be a single-link regular repository file");
-	return destinationStat;
-};
-const writeOutput = async ({ destination, text, mode }) => {
-	await checkOutput(destination);
-	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(destination), { recursive: true });
-	const output = await (0, node_fs_promises.open)(destination, node_fs.constants.O_WRONLY | node_fs.constants.O_CREAT | node_fs.constants.O_NOFOLLOW, mode);
-	try {
-		const opened = await output.stat();
-		if (!opened.isFile() || opened.nlink !== 1) throw new Error("cloud setup destination must be a single-link regular repository file");
-		await output.truncate(0);
-		await output.writeFile(text, "utf8");
-		await output.chmod(mode);
-	} finally {
-		await output.close();
-	}
-};
 const readClaudeSettings = async (destination) => {
 	try {
-		if (await checkOutput(destination) === void 0) return void 0;
+		if (await require_generated_file.checkGeneratedOutput(destination) === void 0) return void 0;
 		const input = await (0, node_fs_promises.open)(destination, node_fs.constants.O_RDONLY | node_fs.constants.O_NOFOLLOW);
 		try {
 			const opened = await input.stat();
@@ -65,7 +36,20 @@ const main = async () => {
 	if (args.length !== 0) throw new Error(usage);
 	const root = await (0, node_fs_promises.realpath)(process.cwd());
 	const { files, diagnostics } = require_toolchain_guard.readToolchainInputs(root);
-	if (diagnostics.length > 0) throw new Error(diagnostics.map(({ path, message }) => `${path}: ${message}${path === ".claude/settings.json" ? `; ${require_toolchain_inputs.cloudSessionStartFix}` : ""}`).join("\n"));
+	const destination = (0, node_path.join)(root, require_toolchain_inputs.cloudSetupPath);
+	const settingsDestination = (0, node_path.join)(root, require_toolchain_inputs.cloudClaudeSettingsPath);
+	const settings = await readClaudeSettings(settingsDestination);
+	const remainingDiagnostics = await require_generated_file.generationDiagnostics({
+		diagnostics,
+		outputs: [{
+			relative: require_toolchain_inputs.cloudSetupPath,
+			destination
+		}, {
+			relative: require_toolchain_inputs.cloudClaudeSettingsPath,
+			destination: settingsDestination
+		}]
+	});
+	if (remainingDiagnostics.length > 0) throw new Error(remainingDiagnostics.map(({ path, message }) => `${path}: ${message}${path === ".claude/settings.json" ? `; ${require_toolchain_inputs.cloudSessionStartFix}` : ""}`).join("\n"));
 	const text = files["stll-toolchain.json"];
 	if (text === void 0) throw new Error("requires tracked stll-toolchain.json");
 	const { cloud, rustExceptions } = require_toolchain_guard.parseToolchainConfiguration(JSON.parse(text));
@@ -80,17 +64,13 @@ const main = async () => {
 		files,
 		rustExceptions
 	});
-	const destination = (0, node_path.join)(root, require_toolchain_inputs.cloudSetupPath);
-	await checkOutput(destination);
-	const settingsDestination = (0, node_path.join)(root, require_toolchain_inputs.cloudClaudeSettingsPath);
-	const settings = await readClaudeSettings(settingsDestination);
 	const mergedSettings = require_toolchain_inputs.mergeCloudClaudeSettings(settings?.text);
-	await writeOutput({
+	await require_generated_file.writeGeneratedFile({
 		destination,
 		text: script,
 		mode: 493
 	});
-	if (mergedSettings !== settings?.text) await writeOutput({
+	if (mergedSettings !== settings?.text) await require_generated_file.writeGeneratedFile({
 		destination: settingsDestination,
 		text: mergedSettings,
 		mode: settings?.mode ?? 420

package/dist/cloud-setup-cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-setup-cli.cjs","names":["lstat","dirname","mkdir","open","constants","cloudClaudeSettingsPath","cloudSessionStartFix","realpath","readToolchainInputs","parseToolchainConfiguration","parseToolchainPolicy","readFile","generateCloudSetup","join","cloudSetupPath","mergeCloudClaudeSettings"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { lstat, mkdir, open, readFile, realpath } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst optionalStat = async (path: string) => {\n  try {\n    return await lstat(path);\n  } catch (error) {\n    if (error instanceof Error && \"code\" in error && error.code === \"ENOENT\")\n      return undefined;\n    throw error;\n  }\n};\n\nconst checkOutput = async (destination: string) => {\n  const parent = dirname(destination);\n  const parentStat = await optionalStat(parent);\n  if (\n    parentStat !== undefined &&\n    (parentStat.isSymbolicLink() || !parentStat.isDirectory())\n  )\n    throw new Error(\"cloud setup parent must be a real repository directory\");\n  const destinationStat = await optionalStat(destination);\n  if (\n    destinationStat !== undefined &&\n    (destinationStat.isSymbolicLink() ||\n      !destinationStat.isFile() ||\n      destinationStat.nlink !== 1)\n  )\n    throw new Error(\n      \"cloud setup destination must be a single-link regular repository file\",\n    );\n  return destinationStat;\n};\n\ntype WriteOutputOptions = {\n  destination: string;\n  text: string;\n  mode: number;\n};\n\nconst writeOutput = async ({ destination, text, mode }: WriteOutputOptions) => {\n  await checkOutput(destination);\n  await mkdir(dirname(destination), { recursive: true });\n  const output = await open(\n    destination,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW,\n    mode,\n  );\n  try {\n    const opened = await output.stat();\n    if (!opened.isFile() || opened.nlink !== 1)\n      throw new Error(\n        \"cloud setup destination must be a single-link regular repository file\",\n      );\n    await output.truncate(0);\n    await output.writeFile(text, \"utf8\");\n    await output.chmod(mode);\n  } finally {\n    await output.close();\n  }\n};\n\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkOutput(destination)) === undefined) return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  if (diagnostics.length > 0)\n    throw new Error(\n      diagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const destination = join(root, cloudSetupPath);\n  await checkOutput(destination);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  const settings = await readClaudeSettings(settingsDestination);\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeOutput({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeOutput({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;AAiBA,MAAM,QACJ;AACF,MAAM,eAAe,OAAO,SAAiB;CAC3C,IAAI;EACF,OAAO,OAAA,GAAMA,iBAAAA,MAAAA,CAAM,IAAI;CACzB,SAAS,OAAO;EACd,IAAI,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,UAC9D,OAAO,KAAA;EACT,MAAM;CACR;AACF;AAEA,MAAM,cAAc,OAAO,gBAAwB;CACjD,MAAM,UAAA,GAASC,UAAAA,QAAAA,CAAQ,WAAW;CAClC,MAAM,aAAa,MAAM,aAAa,MAAM;CAC5C,IACE,eAAe,KAAA,MACd,WAAW,eAAe,KAAK,CAAC,WAAW,YAAY,IAExD,MAAM,IAAI,MAAM,wDAAwD;CAC1E,MAAM,kBAAkB,MAAM,aAAa,WAAW;CACtD,IACE,oBAAoB,KAAA,MACnB,gBAAgB,eAAe,KAC9B,CAAC,gBAAgB,OAAO,KACxB,gBAAgB,UAAU,IAE5B,MAAM,IAAI,MACR,uEACF;CACF,OAAO;AACT;AAQA,MAAM,cAAc,OAAO,EAAE,aAAa,MAAM,WAA+B;CAC7E,MAAM,YAAY,WAAW;CAC7B,OAAA,GAAMC,iBAAAA,MAAAA,EAAAA,GAAMD,UAAAA,QAAAA,CAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CACrD,MAAM,SAAS,OAAA,GAAME,iBAAAA,KAAAA,CACnB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,YACnD,IACF;CACA,IAAI;EACF,MAAM,SAAS,MAAM,OAAO,KAAK;EACjC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,uEACF;EACF,MAAM,OAAO,SAAS,CAAC;EACvB,MAAM,OAAO,UAAU,MAAM,MAAM;EACnC,MAAM,OAAO,MAAM,IAAI;CACzB,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;AAEA,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAM,YAAY,WAAW,MAAO,KAAA,GAAW,OAAO,KAAA;EAC3D,MAAM,QAAQ,OAAA,GAAMD,iBAAAA,KAAAA,CAClB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuBC,yBAAAA,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAIC,yBAAAA,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACvD,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,YACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAKF,yBAAAA,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmBG,wBAAAA,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAASC,yBAAAA,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,YAAY,WAAW;CAC7B,MAAM,uBAAA,GAAsBD,UAAAA,KAAAA,CAAK,MAAMR,yBAAAA,uBAAuB;CAC9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,iBAAiBU,yBAAAA,yBAAyB,UAAU,IAAI;CAC9D,MAAM,YAAY;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CAC5D,IAAI,mBAAmB,UAAU,MAC/B,MAAM,YAAY;EAChB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAaD,yBAAAA,eAAe,OAAOT,yBAAAA,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}
+{"version":3,"file":"cloud-setup-cli.cjs","names":["checkGeneratedOutput","open","constants","cloudClaudeSettingsPath","cloudSessionStartFix","realpath","readToolchainInputs","join","cloudSetupPath","generationDiagnostics","parseToolchainConfiguration","parseToolchainPolicy","readFile","generateCloudSetup","mergeCloudClaudeSettings","writeGeneratedFile"],"sources":["../src/cloud-setup-cli.ts"],"sourcesContent":["#!/usr/bin/env node\nimport { constants } from \"node:fs\";\nimport { open, readFile, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { cloudSetupPath, generateCloudSetup } from \"./cloud-setup\";\nimport {\n  cloudClaudeSettingsPath,\n  cloudSessionStartFix,\n  mergeCloudClaudeSettings,\n} from \"./cloud-setup-claude\";\nimport {\n  checkGeneratedOutput,\n  generationDiagnostics,\n  writeGeneratedFile,\n} from \"./generated-file\";\nimport {\n  parseToolchainConfiguration,\n  readToolchainInputs,\n} from \"./toolchain-guard\";\nimport { parseToolchainPolicy } from \"./toolchain-schema\";\n\nconst usage =\n  \"Usage: stll-cloud-setup (run from repository root)\\n       stll-cloud-setup --help\";\nconst readClaudeSettings = async (destination: string) => {\n  try {\n    if ((await checkGeneratedOutput(destination)) === undefined)\n      return undefined;\n    const input = await open(\n      destination,\n      constants.O_RDONLY | constants.O_NOFOLLOW,\n    );\n    try {\n      const opened = await input.stat();\n      if (!opened.isFile() || opened.nlink !== 1)\n        throw new Error(\n          \"settings must be a single-link regular repository file\",\n        );\n      return { text: await input.readFile(\"utf8\"), mode: opened.mode & 0o777 };\n    } finally {\n      await input.close();\n    }\n  } catch (error) {\n    throw new Error(\n      `cannot safely merge ${cloudClaudeSettingsPath}: ${error instanceof Error ? error.message : String(error)}; ${cloudSessionStartFix}`,\n    );\n  }\n};\n\nconst main = async () => {\n  const args = process.argv.slice(2);\n  if (args.length === 1 && args.at(0) === \"--help\") {\n    process.stdout.write(`${usage}\\n`);\n    return;\n  }\n  if (args.length !== 0) throw new Error(usage);\n  const root = await realpath(process.cwd());\n  const { files, diagnostics } = readToolchainInputs(root);\n  const destination = join(root, cloudSetupPath);\n  const settingsDestination = join(root, cloudClaudeSettingsPath);\n  // Validate settings separately to retain actionable merge diagnostics.\n  const settings = await readClaudeSettings(settingsDestination);\n  const remainingDiagnostics = await generationDiagnostics({\n    diagnostics,\n    outputs: [\n      { relative: cloudSetupPath, destination },\n      { relative: cloudClaudeSettingsPath, destination: settingsDestination },\n    ],\n  });\n  if (remainingDiagnostics.length > 0)\n    throw new Error(\n      remainingDiagnostics\n        .map(\n          ({ path, message }) =>\n            `${path}: ${message}${path === cloudClaudeSettingsPath ? `; ${cloudSessionStartFix}` : \"\"}`,\n        )\n        .join(\"\\n\"),\n    );\n  const text = files[\"stll-toolchain.json\"];\n  if (text === undefined)\n    throw new Error(\"requires tracked stll-toolchain.json\");\n  const { cloud, rustExceptions } = parseToolchainConfiguration(\n    JSON.parse(text),\n  );\n  if (cloud === undefined)\n    throw new Error(\"requires an explicit cloud declaration\");\n  const nodeVersion = files[\".node-version\"];\n  if (nodeVersion === undefined)\n    throw new Error(\"requires tracked root .node-version\");\n  const policy = parseToolchainPolicy(\n    JSON.parse(\n      await readFile(new URL(\"../toolchain.json\", import.meta.url), \"utf8\"),\n    ),\n  );\n  const script = generateCloudSetup({\n    policy,\n    cloud,\n    nodeVersion: nodeVersion.trim(),\n    files,\n    rustExceptions,\n  });\n  const mergedSettings = mergeCloudClaudeSettings(settings?.text);\n  await writeGeneratedFile({ destination, text: script, mode: 0o755 });\n  if (mergedSettings !== settings?.text)\n    await writeGeneratedFile({\n      destination: settingsDestination,\n      text: mergedSettings,\n      mode: settings?.mode ?? 0o644,\n    });\n  process.stdout.write(\n    `Generated ${cloudSetupPath} and ${cloudClaudeSettingsPath}\\n`,\n  );\n};\n\nmain().catch((error: unknown) => {\n  process.stderr.write(\n    `cloud-setup: ${error instanceof Error ? error.message : String(error)}\\n`,\n  );\n  process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;AAsBA,MAAM,QACJ;AACF,MAAM,qBAAqB,OAAO,gBAAwB;CACxD,IAAI;EACF,IAAK,MAAMA,uBAAAA,qBAAqB,WAAW,MAAO,KAAA,GAChD,OAAO,KAAA;EACT,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,KAAAA,CAClB,aACAC,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UACjC;EACA,IAAI;GACF,MAAM,SAAS,MAAM,MAAM,KAAK;GAChC,IAAI,CAAC,OAAO,OAAO,KAAK,OAAO,UAAU,GACvC,MAAM,IAAI,MACR,wDACF;GACF,OAAO;IAAE,MAAM,MAAM,MAAM,SAAS,MAAM;IAAG,MAAM,OAAO,OAAO;GAAM;EACzE,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MACR,uBAAuBC,yBAAAA,wBAAwB,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,IAAIC,yBAAAA,sBAChH;CACF;AACF;AAEA,MAAM,OAAO,YAAY;CACvB,MAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;CACjC,IAAI,KAAK,WAAW,KAAK,KAAK,GAAG,CAAC,MAAM,UAAU;EAChD,QAAQ,OAAO,MAAM,GAAG,MAAM,GAAG;EACjC;CACF;CACA,IAAI,KAAK,WAAW,GAAG,MAAM,IAAI,MAAM,KAAK;CAC5C,MAAM,OAAO,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,QAAQ,IAAI,CAAC;CACzC,MAAM,EAAE,OAAO,gBAAgBC,wBAAAA,oBAAoB,IAAI;CACvD,MAAM,eAAA,GAAcC,UAAAA,KAAAA,CAAK,MAAMC,yBAAAA,cAAc;CAC7C,MAAM,uBAAA,GAAsBD,UAAAA,KAAAA,CAAK,MAAMJ,yBAAAA,uBAAuB;CAE9D,MAAM,WAAW,MAAM,mBAAmB,mBAAmB;CAC7D,MAAM,uBAAuB,MAAMM,uBAAAA,sBAAsB;EACvD;EACA,SAAS,CACP;GAAE,UAAUD,yBAAAA;GAAgB;EAAY,GACxC;GAAE,UAAUL,yBAAAA;GAAyB,aAAa;EAAoB,CACxE;CACF,CAAC;CACD,IAAI,qBAAqB,SAAS,GAChC,MAAM,IAAI,MACR,qBACG,KACE,EAAE,MAAM,cACP,GAAG,KAAK,IAAI,UAAU,SAAA,0BAAmC,KAAKC,yBAAAA,yBAAyB,IAC3F,CAAC,CACA,KAAK,IAAI,CACd;CACF,MAAM,OAAO,MAAM;CACnB,IAAI,SAAS,KAAA,GACX,MAAM,IAAI,MAAM,sCAAsC;CACxD,MAAM,EAAE,OAAO,mBAAmBM,wBAAAA,4BAChC,KAAK,MAAM,IAAI,CACjB;CACA,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,wCAAwC;CAC1D,MAAM,cAAc,MAAM;CAC1B,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,qCAAqC;CACvD,MAAM,SAASC,yBAAAA,qBACb,KAAK,MACH,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,IAAI,IAAI,qBAAA,QAAA,KAAA,CAAA,CAAA,cAAA,UAAA,CAAA,CAAA,IAAoC,GAAG,MAAM,CACtE,CACF;CACA,MAAM,SAASC,yBAAAA,mBAAmB;EAChC;EACA;EACA,aAAa,YAAY,KAAK;EAC9B;EACA;CACF,CAAC;CACD,MAAM,iBAAiBC,yBAAAA,yBAAyB,UAAU,IAAI;CAC9D,MAAMC,uBAAAA,mBAAmB;EAAE;EAAa,MAAM;EAAQ,MAAM;CAAM,CAAC;CACnE,IAAI,mBAAmB,UAAU,MAC/B,MAAMA,uBAAAA,mBAAmB;EACvB,aAAa;EACb,MAAM;EACN,MAAM,UAAU,QAAQ;CAC1B,CAAC;CACH,QAAQ,OAAO,MACb,aAAaP,yBAAAA,eAAe,OAAOL,yBAAAA,wBAAwB,GAC7D;AACF;AAEA,KAAK,CAAC,CAAC,OAAO,UAAmB;CAC/B,QAAQ,OAAO,MACb,gBAAgB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACzE;CACA,QAAQ,WAAW;AACrB,CAAC"}