@vyuhlabs/dxkit 2.5.1 → 2.6.0

package/dist/allowlist/file.js

@@ -0,0 +1,497 @@
+"use strict";
+/**
+ * On-disk allowlist file — `.dxkit/allowlist.json` + optional sidecar
+ * `.dxkit/allowlist-reasons.local.json`.
+ *
+ * The allowlist file is the durable contract for per-finding
+ * suppressions: customer has reviewed this fingerprint, categorized
+ * the reason, and accepts that the guardrail should let the finding
+ * pass on future runs.
+ *
+ * Identity is the 16-char hex fingerprint from
+ * `src/analyzers/tools/fingerprint.ts` (CLAUDE.md Rule 9). An entry
+ * matches a finding when their fingerprint strings are byte-equal.
+ *
+ * # Two modes, one schema
+ *
+ * The mode is recorded in `.dxkit/policy.json` (out of scope for this
+ * module — consumers pass it in via `AllowlistMode`). Both modes use
+ * the same `AllowlistFile` shape on disk; sanitized mode just drops
+ * the human-readable fields and pushes them to a sidecar:
+ *
+ *   `'full'` — every field present on the entry. Default for
+ *   private repos. The committed file carries the full audit trail.
+ *
+ *   `'sanitized'` — entries carry `fingerprint + kind + category +
+ *   addedAt + expiresAt + acknowledgedSeverity` only. The
+ *   `reason` + `addedBy` fields live in the gitignored sidecar
+ *   `.dxkit/allowlist-reasons.local.json`, keyed by fingerprint.
+ *   Default for public repos. Loaders merge the sidecar back when
+ *   present; readers tolerate its absence (no reason field, but
+ *   the suppression still applies because matching is by
+ *   fingerprint).
+ *
+ * # Validation surface
+ *
+ * `validateAllowlistFile` enforces every Sprint-0-locked rule:
+ *   - `reason` is required (full mode) / required in sidecar
+ *     (sanitized mode)
+ *   - `category` is one of the five canonical values
+ *   - `category` is valid for the entry's `kind`
+ *   - `requiresExpiry(category)` ⇒ `expiresAt` is present + parseable
+ *   - `acknowledgedSeverity` is required when `category` is
+ *     `accepted-risk` AND `severity` is `high`/`critical`
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_MODES = exports.ALLOWLIST_REASONS_FILENAME = exports.ALLOWLIST_FILENAME = exports.ALLOWLIST_DIR = exports.ALLOWLIST_REASONS_SCHEMA_VERSION = exports.ALLOWLIST_SCHEMA_VERSION = void 0;
+exports.pathForAllowlist = pathForAllowlist;
+exports.pathForAllowlistReasons = pathForAllowlistReasons;
+exports.emptyAllowlistFile = emptyAllowlistFile;
+exports.loadAllowlist = loadAllowlist;
+exports.loadAllowlistReasons = loadAllowlistReasons;
+exports.saveAllowlist = saveAllowlist;
+exports.findEntry = findEntry;
+exports.addEntry = addEntry;
+exports.removeEntry = removeEntry;
+exports.matchesFinding = matchesFinding;
+exports.isEntryActive = isEntryActive;
+exports.daysUntilExpiry = daysUntilExpiry;
+exports.auditAllowlist = auditAllowlist;
+exports.pruneExpired = pruneExpired;
+exports.validateAllowlistFile = validateAllowlistFile;
+exports.validateAllowlistEntry = validateAllowlistEntry;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const categories_1 = require("./categories");
+exports.ALLOWLIST_SCHEMA_VERSION = 'dxkit-allowlist/v1';
+exports.ALLOWLIST_REASONS_SCHEMA_VERSION = 'dxkit-allowlist-reasons/v1';
+exports.ALLOWLIST_DIR = '.dxkit';
+exports.ALLOWLIST_FILENAME = 'allowlist.json';
+exports.ALLOWLIST_REASONS_FILENAME = 'allowlist-reasons.local.json';
+/**
+ * Single source of truth for mode values. The `AllowlistMode` union
+ * is derived from this array via `(typeof ...)[number]`, so adding
+ * a new mode means appending one string here — the runtime checks
+ * below pick it up via `ALL_MODES.includes(...)` without any
+ * literal-value drift between type and runtime.
+ */
+exports.ALL_MODES = ['full', 'sanitized'];
+function pathForAllowlist(cwd) {
+    return path.join(cwd, exports.ALLOWLIST_DIR, exports.ALLOWLIST_FILENAME);
+}
+function pathForAllowlistReasons(cwd) {
+    return path.join(cwd, exports.ALLOWLIST_DIR, exports.ALLOWLIST_REASONS_FILENAME);
+}
+/**
+ * Create an empty allowlist file in the requested mode. Useful for
+ * the `vyuh-dxkit allowlist add` CLI path when no file exists yet.
+ */
+function emptyAllowlistFile(mode = 'full') {
+    return { schemaVersion: exports.ALLOWLIST_SCHEMA_VERSION, mode, entries: [] };
+}
+/**
+ * Read the on-disk allowlist + (when present) merge the sidecar
+ * reasons. Returns `null` when the main file doesn't exist —
+ * callers treat that as "no allowlist configured."
+ *
+ * Throws on:
+ *   - Malformed JSON in either file
+ *   - Unrecognized `schemaVersion`
+ *   - Root is not an object
+ *
+ * The sidecar's absence is NOT an error: customers in sanitized
+ * mode may have a committed allowlist on disk without the sidecar
+ * cloned (CI checkout, fresh teammate clone). The fingerprint-only
+ * file is still functional as a suppression list.
+ */
+function loadAllowlist(cwd) {
+    const filePath = pathForAllowlist(cwd);
+    if (!fs.existsSync(filePath))
+        return null;
+    const raw = fs.readFileSync(filePath, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`allowlist file is not valid JSON: ${filePath} (${err.message})`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`allowlist file root is not an object: ${filePath}`);
+    }
+    const obj = parsed;
+    if (obj.schemaVersion !== exports.ALLOWLIST_SCHEMA_VERSION) {
+        throw new Error(`allowlist file schemaVersion is ${JSON.stringify(obj.schemaVersion)}; ` +
+            `this dxkit understands ${JSON.stringify(exports.ALLOWLIST_SCHEMA_VERSION)} only ` +
+            `(${filePath})`);
+    }
+    if (!isAllowlistMode(obj.mode)) {
+        throw new Error(`allowlist file mode is ${JSON.stringify(obj.mode)}; ` +
+            `expected one of ${JSON.stringify(exports.ALL_MODES)} (${filePath})`);
+    }
+    if (!Array.isArray(obj.entries)) {
+        throw new Error(`allowlist file entries is not an array (${filePath})`);
+    }
+    const base = parsed;
+    if (base.mode === 'full')
+        return base;
+    // sanitized mode → merge sidecar if present
+    const sidecar = loadAllowlistReasons(cwd);
+    if (!sidecar)
+        return base;
+    return mergeReasons(base, sidecar);
+}
+/**
+ * Load the gitignored reasons sidecar. Returns `null` when missing.
+ * Throws on malformed JSON or wrong schemaVersion.
+ */
+function loadAllowlistReasons(cwd) {
+    const filePath = pathForAllowlistReasons(cwd);
+    if (!fs.existsSync(filePath))
+        return null;
+    const raw = fs.readFileSync(filePath, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`allowlist reasons sidecar is not valid JSON: ${filePath} (${err.message})`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`allowlist reasons sidecar root is not an object: ${filePath}`);
+    }
+    const obj = parsed;
+    if (obj.schemaVersion !== exports.ALLOWLIST_REASONS_SCHEMA_VERSION) {
+        throw new Error(`allowlist reasons sidecar schemaVersion is ${JSON.stringify(obj.schemaVersion)}; ` +
+            `expected ${JSON.stringify(exports.ALLOWLIST_REASONS_SCHEMA_VERSION)} (${filePath})`);
+    }
+    if (!obj.reasons || typeof obj.reasons !== 'object' || Array.isArray(obj.reasons)) {
+        throw new Error(`allowlist reasons sidecar 'reasons' is not an object (${filePath})`);
+    }
+    return parsed;
+}
+/**
+ * Persist the allowlist to disk. Writes the sidecar separately in
+ * sanitized mode: the committed file gets the structural fields;
+ * the sidecar gets `reason` + `addedBy`.
+ *
+ * Validation runs before writing — invalid input throws and the
+ * file isn't touched. Use `validateAllowlistFile` directly when
+ * you want non-throwing error reporting.
+ */
+function saveAllowlist(cwd, file) {
+    const errors = validateAllowlistFile(file);
+    if (errors.length > 0) {
+        throw new Error(`allowlist file failed validation:\n` +
+            errors.map((e) => `  - ${e.field}: ${e.message}`).join('\n'));
+    }
+    if (file.mode === 'full') {
+        writeJsonPretty(pathForAllowlist(cwd), file);
+        return;
+    }
+    // sanitized mode: split entries → main + sidecar
+    const sanitizedEntries = [];
+    const reasons = {};
+    for (const entry of file.entries) {
+        sanitizedEntries.push(sanitizedEntry(entry));
+        if (entry.reason !== undefined && entry.addedBy !== undefined) {
+            reasons[entry.fingerprint] = { reason: entry.reason, addedBy: entry.addedBy };
+        }
+    }
+    const sanitizedFile = {
+        schemaVersion: file.schemaVersion,
+        mode: 'sanitized',
+        entries: sanitizedEntries,
+    };
+    const sidecar = {
+        schemaVersion: exports.ALLOWLIST_REASONS_SCHEMA_VERSION,
+        reasons,
+    };
+    writeJsonPretty(pathForAllowlist(cwd), sanitizedFile);
+    writeJsonPretty(pathForAllowlistReasons(cwd), sidecar);
+}
+/** Find an entry by fingerprint. */
+function findEntry(file, fingerprint) {
+    return file.entries.find((e) => e.fingerprint === fingerprint);
+}
+/**
+ * Add an entry. Returns a NEW `AllowlistFile` (immutable update).
+ * Throws if `entry.fingerprint` already exists.
+ */
+function addEntry(file, entry) {
+    if (findEntry(file, entry.fingerprint)) {
+        throw new Error(`allowlist already contains entry for fingerprint ${entry.fingerprint}; ` +
+            `use removeEntry first or update in place`);
+    }
+    return { ...file, entries: [...file.entries, entry] };
+}
+/**
+ * Remove an entry by fingerprint. Returns a NEW `AllowlistFile`.
+ * Silently no-ops when the fingerprint isn't present (CLI surfaces
+ * the "not found" case through a separate read step).
+ */
+function removeEntry(file, fingerprint) {
+    return { ...file, entries: file.entries.filter((e) => e.fingerprint !== fingerprint) };
+}
+/**
+ * Whether the allowlist suppresses a given finding. Pure
+ * fingerprint match. Expiry handling is layered on top by
+ * `isEntryActive` (kept separate so the guardrail can distinguish
+ * "matched but expired" from "no match").
+ */
+function matchesFinding(file, fingerprint) {
+    return findEntry(file, fingerprint) !== undefined;
+}
+/**
+ * Whether an entry is currently active (within its expiry window).
+ * Entries without `expiresAt` are always active. Entries past their
+ * expiry are inactive — guardrail treats the underlying finding as
+ * un-allowlisted and the next run flags the suppression as stale.
+ */
+function isEntryActive(entry, now = new Date()) {
+    if (!entry.expiresAt)
+        return true;
+    const today = now.toISOString().slice(0, 10);
+    return entry.expiresAt >= today;
+}
+/**
+ * Days remaining until an entry expires, or `null` when it has no
+ * expiry. Negative values mean already expired by that many days.
+ */
+function daysUntilExpiry(entry, now = new Date()) {
+    if (!entry.expiresAt)
+        return null;
+    const expiry = new Date(entry.expiresAt + 'T00:00:00Z');
+    const today = new Date(now.toISOString().slice(0, 10) + 'T00:00:00Z');
+    const msPerDay = 24 * 60 * 60 * 1000;
+    return Math.round((expiry.getTime() - today.getTime()) / msPerDay);
+}
+function auditAllowlist(file, options = {}) {
+    const now = options.now ?? new Date();
+    const horizon = options.soonToExpireDays ?? 14;
+    const expired = [];
+    const soonToExpire = [];
+    const missingRationale = [];
+    for (const entry of file.entries) {
+        const days = daysUntilExpiry(entry, now);
+        if (days !== null && days < 0) {
+            expired.push(entry);
+        }
+        else if (days !== null && days <= horizon) {
+            soonToExpire.push({ entry, daysRemaining: days });
+        }
+        if (!entry.reason || entry.reason.trim().length === 0) {
+            // In sanitized mode the reason may legitimately live in the
+            // gitignored sidecar; flag here so the caller can decide
+            // whether to treat it as a real audit item or just an
+            // "unavailable locally" notice.
+            missingRationale.push(entry);
+        }
+    }
+    return { expired, soonToExpire, missingRationale };
+}
+/**
+ * Remove expired entries from the file. Returns a new file (immutable)
+ * plus the list of removed entries so the CLI can render what changed.
+ * Pure function — no I/O.
+ */
+function pruneExpired(file, now = new Date()) {
+    const removed = [];
+    const keptEntries = [];
+    for (const entry of file.entries) {
+        if (isEntryActive(entry, now)) {
+            keptEntries.push(entry);
+        }
+        else {
+            removed.push(entry);
+        }
+    }
+    return { kept: { ...file, entries: keptEntries }, removed };
+}
+/**
+ * Validate every entry in the file against the canonical taxonomy
+ * + Sprint-0-locked rules. Pure function; returns an array of
+ * `ValidationError` rather than throwing so callers can render
+ * structured error messages.
+ */
+function validateAllowlistFile(file) {
+    const errors = [];
+    if (file.schemaVersion !== exports.ALLOWLIST_SCHEMA_VERSION) {
+        errors.push({
+            field: 'schemaVersion',
+            message: `expected ${JSON.stringify(exports.ALLOWLIST_SCHEMA_VERSION)}, got ${JSON.stringify(file.schemaVersion)}`,
+        });
+    }
+    if (!isAllowlistMode(file.mode)) {
+        errors.push({
+            field: 'mode',
+            message: `expected one of ${JSON.stringify(exports.ALL_MODES)}, got ${JSON.stringify(file.mode)}`,
+        });
+    }
+    const seen = new Set();
+    for (const entry of file.entries) {
+        if (seen.has(entry.fingerprint)) {
+            errors.push({
+                fingerprint: entry.fingerprint,
+                field: 'fingerprint',
+                message: `duplicate fingerprint`,
+            });
+        }
+        seen.add(entry.fingerprint);
+        for (const err of validateAllowlistEntry(entry, file.mode))
+            errors.push(err);
+    }
+    return errors;
+}
+/**
+ * Validate a single entry. Exposed independently so the CLI's
+ * `allowlist add` can pre-flight before mutating the file.
+ */
+function validateAllowlistEntry(entry, mode) {
+    const errors = [];
+    const fp = entry.fingerprint;
+    if (!fp || typeof fp !== 'string' || !/^[0-9a-f]{16}$/.test(fp)) {
+        errors.push({
+            fingerprint: fp,
+            field: 'fingerprint',
+            message: 'must be a 16-char lowercase hex string',
+        });
+    }
+    if (!categories_1.ALL_CATEGORIES.includes(entry.category)) {
+        errors.push({
+            fingerprint: fp,
+            field: 'category',
+            message: `must be one of ${JSON.stringify(categories_1.ALL_CATEGORIES)}; got ${JSON.stringify(entry.category)}`,
+        });
+    }
+    if (!(0, categories_1.isCategoryValidForKind)(entry.kind, entry.category)) {
+        errors.push({
+            fingerprint: fp,
+            field: 'category',
+            message: `category ${JSON.stringify(entry.category)} does not apply to kind ${JSON.stringify(entry.kind)}`,
+        });
+    }
+    // reason: required in full mode; sidecar-owned in sanitized mode (so
+    // the entry on disk legitimately omits it). The CLI write path emits
+    // a separate validation pass for the sidecar.
+    if (mode === 'full') {
+        if (entry.reason === undefined || entry.reason === null) {
+            errors.push({ fingerprint: fp, field: 'reason', message: 'required in full mode' });
+        }
+        else if (typeof entry.reason !== 'string' || entry.reason.trim().length === 0) {
+            errors.push({
+                fingerprint: fp,
+                field: 'reason',
+                message: 'must be a non-empty string',
+            });
+        }
+        if (entry.addedBy === undefined || entry.addedBy === null) {
+            errors.push({ fingerprint: fp, field: 'addedBy', message: 'required in full mode' });
+        }
+        else if (typeof entry.addedBy !== 'string' || entry.addedBy.trim().length === 0) {
+            errors.push({
+                fingerprint: fp,
+                field: 'addedBy',
+                message: 'must be a non-empty string',
+            });
+        }
+    }
+    if (!entry.addedAt || !/^\d{4}-\d{2}-\d{2}$/.test(entry.addedAt)) {
+        errors.push({
+            fingerprint: fp,
+            field: 'addedAt',
+            message: 'must be ISO date YYYY-MM-DD',
+        });
+    }
+    if ((0, categories_1.requiresExpiry)(entry.category)) {
+        if (!entry.expiresAt) {
+            errors.push({
+                fingerprint: fp,
+                field: 'expiresAt',
+                message: `required for category ${JSON.stringify(entry.category)}`,
+            });
+        }
+    }
+    if (entry.expiresAt !== undefined && !/^\d{4}-\d{2}-\d{2}$/.test(entry.expiresAt)) {
+        errors.push({
+            fingerprint: fp,
+            field: 'expiresAt',
+            message: 'must be ISO date YYYY-MM-DD when present',
+        });
+    }
+    // Note on acknowledgedSeverity: the rule "accepted-risk on a
+    // high/critical finding requires acknowledgedSeverity" can't be
+    // enforced from inside this validator — the finding's severity
+    // doesn't live on the on-disk entry. The CLI's `allowlist add`
+    // path enforces it at write time when the finding is in scope.
+    return errors;
+}
+// ─── Internals ───────────────────────────────────────────────────────────
+function isAllowlistMode(value) {
+    return typeof value === 'string' && exports.ALL_MODES.includes(value);
+}
+function writeJsonPretty(filePath, value) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n', 'utf8');
+}
+function sanitizedEntry(entry) {
+    // Strip `reason` + `addedBy`; everything else stays on disk in the
+    // committed file. The fingerprint contract preserves matching.
+    // We intentionally rebuild via property assignment rather than
+    // destructuring so the optional-undefined fields don't survive
+    // serialization as explicit `null`s.
+    const out = {
+        fingerprint: entry.fingerprint,
+        kind: entry.kind,
+        category: entry.category,
+        addedAt: entry.addedAt,
+        ...(entry.expiresAt !== undefined ? { expiresAt: entry.expiresAt } : {}),
+        ...(entry.acknowledgedSeverity !== undefined
+            ? { acknowledgedSeverity: entry.acknowledgedSeverity }
+            : {}),
+    };
+    return out;
+}
+function mergeReasons(file, sidecar) {
+    const merged = file.entries.map((entry) => {
+        const r = sidecar.reasons[entry.fingerprint];
+        if (!r)
+            return entry;
+        return { ...entry, reason: r.reason, addedBy: r.addedBy };
+    });
+    return { ...file, entries: merged };
+}
+//# sourceMappingURL=file.js.map

package/dist/allowlist/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/allowlist/file.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsGH,4CAEC;AAED,0DAEC;AAMD,gDAEC;AAiBD,sCAuCC;AAMD,oDA2BC;AAWD,sCAkCC;AAGD,8BAEC;AAMD,4BAQC;AAOD,kCAEC;AAQD,wCAEC;AAQD,sCAIC;AAMD,0CAMC;AAuCD,wCAuBC;AAOD,oCAcC;AAQD,sDA4BC;AAMD,wDAgFC;AAngBD,uCAAyB;AACzB,2CAA6B;AAG7B,6CAKsB;AAET,QAAA,wBAAwB,GAAG,oBAA6B,CAAC;AAGzD,QAAA,gCAAgC,GAAG,4BAAqC,CAAC;AAGzE,QAAA,aAAa,GAAG,QAAQ,CAAC;AACzB,QAAA,kBAAkB,GAAG,gBAAgB,CAAC;AACtC,QAAA,0BAA0B,GAAG,8BAA8B,CAAC;AAEzE;;;;;;GAMG;AACU,QAAA,SAAS,GAAG,CAAC,MAAM,EAAE,WAAW,CAAU,CAAC;AAwExD,SAAgB,gBAAgB,CAAC,GAAW;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAa,EAAE,0BAAkB,CAAC,CAAC;AAC3D,CAAC;AAED,SAAgB,uBAAuB,CAAC,GAAW;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAa,EAAE,kCAA0B,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,OAAsB,MAAM;IAC7D,OAAO,EAAE,aAAa,EAAE,gCAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,MAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,aAAa,KAAK,gCAAwB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI;YACtE,0BAA0B,IAAI,CAAC,SAAS,CAAC,gCAAwB,CAAC,QAAQ;YAC1E,IAAI,QAAQ,GAAG,CAClB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI;YACpD,mBAAmB,IAAI,CAAC,SAAS,CAAC,iBAAS,CAAC,KAAK,QAAQ,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,GAAG,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,MAAuB,CAAC;IACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAEtC,4CAA4C;IAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,gDAAgD,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,GAAG,MAA0C,CAAC;IACvD,IAAI,GAAG,CAAC,aAAa,KAAK,wCAAgC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI;YACjF,YAAY,IAAI,CAAC,SAAS,CAAC,wCAAgC,CAAC,KAAK,QAAQ,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,yDAAyD,QAAQ,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAAC,GAAW,EAAE,IAAmB;IAC5D,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,qCAAqC;YACnC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,MAAM,gBAAgB,GAAqB,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAwD,EAAE,CAAC;IACxE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAkB;QACnC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IACF,MAAM,OAAO,GAA4B;QACvC,aAAa,EAAE,wCAAgC;QAC/C,OAAO;KACR,CAAC;IACF,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;IACtD,eAAe,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,oCAAoC;AACpC,SAAgB,SAAS,CAAC,IAAmB,EAAE,WAAmB;IAChE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,IAAmB,EAAE,KAAqB;IACjE,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,oDAAoD,KAAK,CAAC,WAAW,IAAI;YACvE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,IAAmB,EAAE,WAAmB;IAClE,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,IAAmB,EAAE,WAAmB;IACrE,OAAO,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,SAAS,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,KAAqB,EAAE,MAAY,IAAI,IAAI,EAAE;IACzE,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,KAAqB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC3E,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;AACrE,CAAC;AAuCD,SAAgB,cAAc,CAAC,IAAmB,EAAE,UAAwB,EAAE;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAmB,EAAE,CAAC;IACxC,MAAM,gBAAgB,GAAqB,EAAE,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YAC5C,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,4DAA4D;YAC5D,yDAAyD;YACzD,sDAAsD;YACtD,gCAAgC;YAChC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAC1B,IAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB,CAAC,IAAmB;IACvD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,aAAa,KAAK,gCAAwB,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,gCAAwB,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;SAC3G,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,iBAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC;gBACV,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,uBAAuB;aACjC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,KAAqB,EACrB,IAAmB;IAEnB,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;IAE7B,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,2BAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,2BAAc,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;SACnG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAA,mCAAsB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,UAAU;YACjB,OAAO,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;SAC3G,CAAC,CAAC;IACL,CAAC;IACD,qEAAqE;IACrE,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC;gBACV,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC;gBACV,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,SAAS;gBAChB,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAA,2BAAc,EAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC;gBACV,WAAW,EAAE,EAAE;gBACf,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,0CAA0C;SACpD,CAAC,CAAC;IACL,CAAC;IACD,6DAA6D;IAC7D,gEAAgE;IAChE,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAE5E,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,iBAA+B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,KAAc;IACvD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CAAC,KAAqB;IAC3C,mEAAmE;IACnE,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,qCAAqC;IACrC,MAAM,GAAG,GAAmB;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;YAC1C,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB,EAAE,OAAgC;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC"}

package/dist/allowlist/gather.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Inline allowlist annotation gather pass.
+ *
+ * Walks the source tree looking for `<lineComment> dxkit-allow:<category>`
+ * comments and records each occurrence as a `(file, line, category)`
+ * tuple. The `stale-allow` producer uses this list together with the
+ * current scan's secret/code/config findings to detect orphaned
+ * annotations — annotations whose underlying finding is no longer
+ * present, which the developer should remove.
+ *
+ * Architectural posture:
+ *
+ *   - File walk goes through the canonical `walkSourceFiles` helper
+ *     so `.gitignore` + `.dxkit-ignore` + bundled defaults are
+ *     honored uniformly. No custom recursion / exclusion logic
+ *     (per CLAUDE.md G_v4_7).
+ *   - Per-language comment marker comes from each pack's
+ *     `LanguageSupport.commentSyntax` via the inline annotation
+ *     parser. No hardcoded `'//'` / `'#'` literals in this module
+ *     (arch-check rule 2 enforces).
+ *   - Annotation parsing reuses `parseAnnotation` from `inline.ts`
+ *     — single source of grammar truth.
+ *
+ * Test files ARE walked (intentional — annotations often live in
+ * test fixtures suppressing scanner findings against deliberate
+ * placeholder credentials). Auto-generated files are NOT walked
+ * (the developer doesn't author annotations in generated code, and
+ * `walkSourceFiles` already excludes them by default).
+ */
+import { type AnnotationPosition } from './inline';
+export interface InlineAllowlistOccurrence {
+    /** Project-relative POSIX path. */
+    readonly file: string;
+    /** 1-based line number where the annotation comment LIVES. For
+     *  above-line annotations the value is the line just before the
+     *  finding's target; for same-line it's the finding's own line. */
+    readonly line: number;
+    /** Category named in the annotation (`test-fixture` / `false-positive` /
+     *  etc.). Free-form at gather level; the producer cross-checks
+     *  against the canonical `AllowlistCategory` union. */
+    readonly category: string;
+    /** Where the annotation sits relative to the suppressed line. */
+    readonly position: AnnotationPosition;
+}
+export interface GatherInlineOpts {
+    /** Walk test files too. Default: true (test fixtures legitimately
+     *  carry intentional placeholders + suppressions). */
+    readonly includeTests?: boolean;
+}
+/**
+ * Walk source files under `cwd` and collect every inline allowlist
+ * annotation occurrence. Cheap on small repos; on large ones the
+ * `walkSourceFiles` cache amortizes the cost across multiple gather
+ * passes within a single baseline-create run.
+ *
+ * Returns occurrences in stable order (file path lexicographic, then
+ * line ascending) so downstream deterministic-output requirements
+ * are satisfied automatically.
+ */
+export declare function gatherInlineAllowlistAnnotations(cwd: string, opts?: GatherInlineOpts): InlineAllowlistOccurrence[];
+//# sourceMappingURL=gather.d.ts.map

package/dist/allowlist/gather.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather.d.ts","sourceRoot":"","sources":["../../src/allowlist/gather.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEhG,MAAM,WAAW,yBAAyB;IACxC,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;uEAEmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;2DAEuD;IACvD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B;0DACsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,gBAAqB,GAC1B,yBAAyB,EAAE,CA+C7B"}