@vyuhlabs/dxkit 2.5.2 → 2.7.0

package/dist/allowlist/cli.js

@@ -0,0 +1,454 @@
+"use strict";
+/**
+ * `vyuh-dxkit allowlist <subcommand>` — orchestrates the user-facing
+ * write/read paths over the allowlist module.
+ *
+ * Subcommands (Sprint 1 chunk):
+ *
+ *   - `add <file>:<line>` — inline annotation insertion. Kind-agnostic;
+ *     the annotation grammar carries category + reason only. Refuses
+ *     non-inline-compatible categories (accepted-risk / deferred).
+ *
+ *   - `add --fingerprint=<id> --kind=<kind>` — file-level allowlist
+ *     entry. Persists to `.dxkit/allowlist.json` (or its sanitized
+ *     mode + gitignored reasons sidecar). Required for any
+ *     accepted-risk / deferred suppression OR any kind that lacks a
+ *     stable single-line attachment point.
+ *
+ *   - `list` — print every entry across the file-level allowlist.
+ *     Reads only; no mutation. Honors `--json` for structured output.
+ *
+ *   - `show <fingerprint>` — print one entry's full detail. Falls
+ *     back to a "no entry found" message when the fingerprint isn't
+ *     present.
+ *
+ * Subcommands `audit` and `prune` land in a follow-up commit.
+ *
+ * # Architectural posture
+ *
+ * Every IO goes through `loadAllowlist` / `saveAllowlist` in
+ * `src/allowlist/file.ts` (arch-rule 1 enforces this). Inline
+ * annotation insertion goes through `insertAnnotation` in
+ * `src/allowlist/inline.ts`. Per-kind / per-category validation
+ * goes through `categories.ts` helpers. NO duplicated taxonomy or
+ * IO logic here — this file is pure orchestration.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOWLIST_FILENAME = exports.DEFAULT_EXPIRY_DAYS = exports.ALLOWLIST_SUBCOMMANDS = void 0;
+exports.runAllowlist = runAllowlist;
+exports.runAllowlistAdd = runAllowlistAdd;
+exports.runAllowlistList = runAllowlistList;
+exports.runAllowlistShow = runAllowlistShow;
+exports.runAllowlistAudit = runAllowlistAudit;
+exports.runAllowlistPrune = runAllowlistPrune;
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const logger = __importStar(require("../logger"));
+const languages_1 = require("../languages");
+const categories_1 = require("./categories");
+Object.defineProperty(exports, "DEFAULT_EXPIRY_DAYS", { enumerable: true, get: function () { return categories_1.DEFAULT_EXPIRY_DAYS; } });
+const file_1 = require("./file");
+Object.defineProperty(exports, "ALLOWLIST_FILENAME", { enumerable: true, get: function () { return file_1.ALLOWLIST_FILENAME; } });
+const inline_1 = require("./inline");
+/** Subcommands recognized under `vyuh-dxkit allowlist`. */
+exports.ALLOWLIST_SUBCOMMANDS = ['add', 'list', 'show', 'audit', 'prune'];
+/**
+ * Dispatch entry point called from `src/cli.ts`. Validates the
+ * subcommand name + routes to the per-subcommand handler. Unknown
+ * subcommands exit with a clear error and the list of recognized
+ * names.
+ */
+async function runAllowlist(cwd, subcommand, args) {
+    if (!subcommand || !isAllowlistSubcommand(subcommand)) {
+        logger.fail(`Unknown allowlist subcommand: ${JSON.stringify(subcommand ?? '(none)')}. ` +
+            `Expected one of: ${exports.ALLOWLIST_SUBCOMMANDS.join(', ')}.`);
+        process.exit(1);
+    }
+    switch (subcommand) {
+        case 'add':
+            return runAllowlistAdd(cwd, {
+                target: args.positionalAfter,
+                category: args.values.category,
+                reason: args.values.reason,
+                kind: args.values.kind,
+                fingerprint: args.values.fingerprint,
+                expires: args.values.expires,
+                acknowledgedSeverity: args.values['acknowledged-severity'],
+                addedBy: args.values['added-by'],
+                mode: args.values.mode,
+            });
+        case 'list':
+            return runAllowlistList(cwd, { json: !!args.values.json });
+        case 'show':
+            return runAllowlistShow(cwd, {
+                fingerprint: args.positionalAfter,
+                json: !!args.values.json,
+            });
+        case 'audit': {
+            const horizonRaw = args.values['soon-days'];
+            const horizon = horizonRaw ? parseInt(horizonRaw, 10) : undefined;
+            return runAllowlistAudit(cwd, {
+                json: !!args.values.json,
+                soonToExpireDays: Number.isFinite(horizon) ? horizon : undefined,
+            });
+        }
+        case 'prune':
+            return runAllowlistPrune(cwd, {
+                json: !!args.values.json,
+                dryRun: !!args.values['dry-run'],
+                yes: !!args.values.yes,
+            });
+    }
+}
+// ─── add ──────────────────────────────────────────────────────────────────
+async function runAllowlistAdd(cwd, opts) {
+    // Validate category up-front so the rest of the flow can assume
+    // it's a canonical value.
+    const category = parseCategory(opts.category);
+    const reason = (opts.reason ?? '').trim();
+    if (!reason) {
+        logger.fail('--reason is required (non-empty rationale string)');
+        process.exit(1);
+    }
+    // Two routing paths: inline annotation insertion vs file-level entry.
+    // The target shape decides:
+    //   - `<file>:<line>` → inline (category must be inline-compatible)
+    //   - `--fingerprint=<id> --kind=<kind>` → file-level
+    const inlineTarget = parseInlineTarget(opts.target);
+    if (inlineTarget) {
+        return runAddInline({ cwd, target: inlineTarget, category, reason });
+    }
+    // File-level form
+    return runAddFileLevel({ cwd, opts, category, reason });
+}
+function parseInlineTarget(target) {
+    if (!target)
+        return null;
+    const m = target.match(/^(.+):(\d+)$/);
+    if (!m)
+        return null;
+    return { file: m[1], line: parseInt(m[2], 10) };
+}
+async function runAddInline(args) {
+    const { cwd, target, category, reason } = args;
+    if (!categories_1.INLINE_COMPATIBLE_CATEGORIES.has(category)) {
+        logger.fail(`category ${JSON.stringify(category)} is file-only — ` +
+            `use --fingerprint=<id> --kind=<kind> form instead. ` +
+            `Inline-compatible categories: ${[...categories_1.INLINE_COMPATIBLE_CATEGORIES].join(', ')}.`);
+        process.exit(1);
+    }
+    const absPath = path.resolve(cwd, target.file);
+    const lang = inferLanguage(target.file);
+    if (!lang || !lang.commentSyntax) {
+        logger.fail(`cannot infer language from file extension for ${JSON.stringify(target.file)}; ` +
+            `inline annotation requires a known language pack with commentSyntax`);
+        process.exit(1);
+    }
+    const result = (0, inline_1.insertAnnotation)(absPath, target.line, { category, reason }, lang);
+    logger.info(`Inserted ${result.position} allowlist annotation at ${target.file}:${result.annotationLine} ` +
+        `(category=${category})`);
+}
+async function runAddFileLevel(args) {
+    const { cwd, opts, category, reason } = args;
+    const fingerprint = opts.fingerprint?.trim();
+    const kindRaw = opts.kind?.trim();
+    if (!fingerprint || !kindRaw) {
+        logger.fail(`file-level allowlist entry requires --fingerprint=<16-hex> and --kind=<kind> ` +
+            `(or pass <file>:<line> for inline annotation when kind+category are inline-compatible)`);
+        process.exit(1);
+    }
+    const kind = kindRaw;
+    if (!(0, categories_1.isCategoryValidForKind)(kind, category)) {
+        logger.fail(`category ${JSON.stringify(category)} does not apply to kind ${JSON.stringify(kind)}`);
+        process.exit(1);
+    }
+    const expiresAt = resolveExpiresAt(opts.expires, category);
+    const addedBy = opts.addedBy?.trim() || resolveGitUserEmail(cwd);
+    if (!addedBy) {
+        logger.fail(`--added-by is required (or set git config user.email so it can be inferred)`);
+        process.exit(1);
+    }
+    const addedAt = todayISO();
+    const acknowledgedSeverity = parseSeverityOpt(opts.acknowledgedSeverity);
+    const entry = {
+        fingerprint,
+        kind,
+        category,
+        reason,
+        addedBy,
+        addedAt,
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+        ...(acknowledgedSeverity !== undefined ? { acknowledgedSeverity } : {}),
+    };
+    // Resolve effective mode (CLI override → existing file mode → default 'full').
+    const mode = resolveMode(cwd, opts.mode);
+    const validationErrors = (0, file_1.validateAllowlistEntry)(entry, mode);
+    if (validationErrors.length > 0) {
+        logger.fail(`allowlist entry failed validation:`);
+        for (const e of validationErrors) {
+            logger.fail(`  - ${e.field}: ${e.message}`);
+        }
+        process.exit(1);
+    }
+    const existing = (0, file_1.loadAllowlist)(cwd) ?? (0, file_1.emptyAllowlistFile)(mode);
+    if ((0, file_1.findEntry)(existing, fingerprint)) {
+        logger.fail(`allowlist already contains entry for fingerprint ${fingerprint}. ` +
+            `Run \`vyuh-dxkit allowlist show ${fingerprint}\` to inspect, or remove first.`);
+        process.exit(1);
+    }
+    const updated = { ...(0, file_1.addEntry)(existing, entry), mode };
+    (0, file_1.saveAllowlist)(cwd, updated);
+    logger.info(`Added allowlist entry for fingerprint ${fingerprint} (kind=${kind}, category=${category})` +
+        (expiresAt ? `, expires ${expiresAt}` : ''));
+}
+// ─── list ─────────────────────────────────────────────────────────────────
+async function runAllowlistList(cwd, opts) {
+    const file = (0, file_1.loadAllowlist)(cwd);
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(file ?? (0, file_1.emptyAllowlistFile)('full'), null, 2) + '\n');
+        return;
+    }
+    if (!file || file.entries.length === 0) {
+        logger.info(`No allowlist entries. Run \`vyuh-dxkit allowlist add\` to create one.`);
+        return;
+    }
+    logger.info(`${file.entries.length} allowlist entr${file.entries.length === 1 ? 'y' : 'ies'} ` +
+        `(mode=${file.mode}, schema=${file.schemaVersion}):`);
+    for (const entry of file.entries) {
+        const expires = entry.expiresAt ? ` · expires ${entry.expiresAt}` : '';
+        const reasonPreview = entry.reason ? ` — ${truncate(entry.reason, 60)}` : '';
+        logger.info(`  ${entry.fingerprint}  ${entry.kind}/${entry.category}` +
+            `  (added ${entry.addedAt}${expires})${reasonPreview}`);
+    }
+}
+// ─── show ─────────────────────────────────────────────────────────────────
+async function runAllowlistShow(cwd, opts) {
+    const fp = opts.fingerprint?.trim();
+    if (!fp) {
+        logger.fail(`Usage: vyuh-dxkit allowlist show <fingerprint>`);
+        process.exit(1);
+    }
+    const file = (0, file_1.loadAllowlist)(cwd);
+    if (!file) {
+        logger.fail(`No allowlist file at ${(0, file_1.pathForAllowlist)(cwd)}`);
+        process.exit(1);
+    }
+    const entry = (0, file_1.findEntry)(file, fp);
+    if (!entry) {
+        logger.fail(`No allowlist entry for fingerprint ${fp}`);
+        process.exit(1);
+    }
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(entry, null, 2) + '\n');
+        return;
+    }
+    logger.info(`Fingerprint:        ${entry.fingerprint}`);
+    logger.info(`Kind:               ${entry.kind}`);
+    logger.info(`Category:           ${entry.category}`);
+    logger.info(`Added at:           ${entry.addedAt}`);
+    if (entry.addedBy)
+        logger.info(`Added by:           ${entry.addedBy}`);
+    if (entry.expiresAt)
+        logger.info(`Expires at:         ${entry.expiresAt}`);
+    if (entry.acknowledgedSeverity) {
+        logger.info(`Acknowledged sev.:  ${entry.acknowledgedSeverity}`);
+    }
+    if (entry.reason)
+        logger.info(`Reason:             ${entry.reason}`);
+}
+// ─── audit ────────────────────────────────────────────────────────────────
+async function runAllowlistAudit(cwd, opts) {
+    const file = (0, file_1.loadAllowlist)(cwd);
+    if (!file) {
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ expired: [], soonToExpire: [], missingRationale: [] }, null, 2) + '\n');
+            return;
+        }
+        logger.info(`No allowlist file at ${(0, file_1.pathForAllowlist)(cwd)} — nothing to audit.`);
+        return;
+    }
+    const report = (0, file_1.auditAllowlist)(file, { soonToExpireDays: opts.soonToExpireDays });
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+        return;
+    }
+    const total = file.entries.length;
+    const horizon = opts.soonToExpireDays ?? 14;
+    logger.info(`Allowlist audit: ${total} entr${total === 1 ? 'y' : 'ies'} ` +
+        `(mode=${file.mode}); soon-to-expire window=${horizon} days`);
+    if (report.expired.length === 0 &&
+        report.soonToExpire.length === 0 &&
+        report.missingRationale.length === 0) {
+        logger.success(`No issues found.`);
+        return;
+    }
+    if (report.expired.length > 0) {
+        logger.warn(`Expired (${report.expired.length}) — run \`vyuh-dxkit allowlist prune\` to remove:`);
+        for (const e of report.expired) {
+            logger.info(`  ${e.fingerprint}  ${e.kind}/${e.category}  expired ${e.expiresAt}`);
+        }
+    }
+    if (report.soonToExpire.length > 0) {
+        logger.warn(`Soon to expire (${report.soonToExpire.length}; within ${horizon} days) — review or extend:`);
+        for (const { entry, daysRemaining } of report.soonToExpire) {
+            logger.info(`  ${entry.fingerprint}  ${entry.kind}/${entry.category}` +
+                `  expires ${entry.expiresAt} (in ${daysRemaining}d)`);
+        }
+    }
+    if (report.missingRationale.length > 0) {
+        logger.warn(`Missing rationale (${report.missingRationale.length}) — ` +
+            `add a reason or sync the gitignored reasons sidecar:`);
+        for (const e of report.missingRationale) {
+            logger.info(`  ${e.fingerprint}  ${e.kind}/${e.category}`);
+        }
+    }
+}
+// ─── prune ────────────────────────────────────────────────────────────────
+async function runAllowlistPrune(cwd, opts) {
+    const file = (0, file_1.loadAllowlist)(cwd);
+    if (!file) {
+        logger.info(`No allowlist file at ${(0, file_1.pathForAllowlist)(cwd)} — nothing to prune.`);
+        return;
+    }
+    const { kept, removed } = (0, file_1.pruneExpired)(file);
+    if (opts.json) {
+        process.stdout.write(JSON.stringify({ dryRun: !!opts.dryRun, removed, keptCount: kept.entries.length }, null, 2) +
+            '\n');
+        if (!opts.dryRun && removed.length > 0)
+            (0, file_1.saveAllowlist)(cwd, kept);
+        return;
+    }
+    if (removed.length === 0) {
+        logger.info(`No expired entries — allowlist is clean.`);
+        return;
+    }
+    const verb = opts.dryRun ? 'Would remove' : 'Removing';
+    logger.warn(`${verb} ${removed.length} expired entr${removed.length === 1 ? 'y' : 'ies'}:`);
+    for (const e of removed) {
+        logger.info(`  ${e.fingerprint}  ${e.kind}/${e.category}  expired ${e.expiresAt}`);
+    }
+    if (opts.dryRun) {
+        logger.info(`(dry-run — no changes written; rerun without --dry-run to apply)`);
+        return;
+    }
+    (0, file_1.saveAllowlist)(cwd, kept);
+    logger.success(`Pruned ${removed.length} expired entries.`);
+}
+// ─── Internals ────────────────────────────────────────────────────────────
+function isAllowlistSubcommand(value) {
+    return exports.ALLOWLIST_SUBCOMMANDS.includes(value);
+}
+function parseCategory(raw) {
+    if (!raw) {
+        logger.fail(`--category is required. One of: ${categories_1.ALL_CATEGORIES.join(', ')}.`);
+        process.exit(1);
+    }
+    if (!categories_1.ALL_CATEGORIES.includes(raw)) {
+        logger.fail(`--category ${JSON.stringify(raw)} is not a known category. ` +
+            `One of: ${categories_1.ALL_CATEGORIES.join(', ')}.`);
+        process.exit(1);
+    }
+    return raw;
+}
+const VALID_SEVERITIES = ['critical', 'high', 'medium', 'low'];
+function parseSeverityOpt(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!VALID_SEVERITIES.includes(raw)) {
+        logger.fail(`--acknowledged-severity ${JSON.stringify(raw)} is not a known severity. ` +
+            `One of: ${VALID_SEVERITIES.join(', ')}.`);
+        process.exit(1);
+    }
+    return raw;
+}
+function resolveExpiresAt(raw, category) {
+    if (raw !== undefined) {
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(raw)) {
+            logger.fail(`--expires must be ISO date YYYY-MM-DD; got ${JSON.stringify(raw)}`);
+            process.exit(1);
+        }
+        return raw;
+    }
+    if ((0, categories_1.requiresExpiry)(category)) {
+        // Default to DEFAULT_EXPIRY_DAYS from today
+        return (0, categories_1.defaultExpiryDate)(new Date());
+    }
+    return undefined;
+}
+function resolveMode(cwd, override) {
+    if (override !== undefined) {
+        if (!file_1.ALL_MODES.includes(override)) {
+            logger.fail(`--mode ${JSON.stringify(override)} is not a known mode. ` +
+                `One of: ${file_1.ALL_MODES.join(', ')}.`);
+            process.exit(1);
+        }
+        return override;
+    }
+    const existing = (0, file_1.loadAllowlist)(cwd);
+    return existing?.mode ?? 'full';
+}
+function resolveGitUserEmail(cwd) {
+    try {
+        const out = (0, child_process_1.execSync)('git config --get user.email', {
+            cwd,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            encoding: 'utf8',
+        }).trim();
+        return out || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function inferLanguage(file) {
+    const ext = path.extname(file).toLowerCase();
+    if (!ext)
+        return undefined;
+    for (const lang of languages_1.LANGUAGES) {
+        if (lang.sourceExtensions.includes(ext))
+            return lang;
+    }
+    return undefined;
+}
+function todayISO(now = new Date()) {
+    return now.toISOString().slice(0, 10);
+}
+function truncate(s, max) {
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max - 1) + '…';
+}
+//# sourceMappingURL=cli.js.map

package/dist/allowlist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/allowlist/cli.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FH,oCAmDC;AAID,0CAqBC;AAyHD,4CAuBC;AAID,4CA8BC;AAID,8CAsEC;AAID,8CAmCC;AAvcD,2CAA6B;AAC7B,iDAAyC;AACzC,kDAAoC;AACpC,4CAAyC;AAIzC,6CAQsB;AA+hBb,oGAriBP,gCAAmB,OAqiBO;AA9hB5B,iCAgBgB;AAihBP,mGAhiBP,yBAAkB,OAgiBO;AAhhB3B,qCAA4C;AAE5C,2DAA2D;AAC9C,QAAA,qBAAqB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AA8CxF;;;;;GAKG;AACI,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,UAA8B,EAC9B,IAGC;IAED,IAAI,CAAC,UAAU,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CACT,iCAAiC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI;YACzE,oBAAoB,6BAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,KAAK;YACR,OAAO,eAAe,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,IAAI,CAAC,eAAe;gBAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAA8B;gBACpD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAA4B;gBAChD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAA0B;gBAC5C,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAiC;gBAC1D,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAA6B;gBAClD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAuB;gBAChF,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAuB;gBACtD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAiC;aACpD,CAAC,CAAC;QACL,KAAK,MAAM;YACT,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM;YACT,OAAO,gBAAgB,CAAC,GAAG,EAAE;gBAC3B,WAAW,EAAE,IAAI,CAAC,eAAe;gBACjC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;aACzB,CAAC,CAAC;QACL,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAuB,CAAC;YAClE,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,OAAO,iBAAiB,CAAC,GAAG,EAAE;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;gBACxB,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aACjE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,GAAG,EAAE;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;gBACxB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;gBAChC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG;aACvB,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAAsB;IACvE,gEAAgE;IAChE,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,4BAA4B;IAC5B,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,kBAAkB;IAClB,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AAOD,SAAS,iBAAiB,CAAC,MAA0B;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAK3B;IACC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,CAAC,yCAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CACT,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,kBAAkB;YACpD,qDAAqD;YACrD,iCAAiC,CAAC,GAAG,yCAA4B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,iDAAiD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;YAC9E,qEAAqE,CACxE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,yBAAgB,EAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,IAAI,CACT,YAAY,MAAM,CAAC,QAAQ,4BAA4B,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,cAAc,GAAG;QAC5F,aAAa,QAAQ,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAK9B;IACC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CACT,+EAA+E;YAC7E,wFAAwF,CAC3F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,OAAuB,CAAC;IACrC,IAAI,CAAC,IAAA,mCAAsB,EAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CACT,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;IAC3B,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAEzE,MAAM,KAAK,GAAmB;QAC5B,WAAW;QACX,IAAI;QACJ,QAAQ;QACR,MAAM;QACN,OAAO;QACP,OAAO;QACP,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IAEF,+EAA+E;IAC/E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,gBAAgB,GAAG,IAAA,6BAAsB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,IAAI,IAAA,yBAAkB,EAAC,IAAI,CAAC,CAAC;IAChE,IAAI,IAAA,gBAAS,EAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,oDAAoD,WAAW,IAAI;YACjE,mCAAmC,WAAW,iCAAiC,CAClF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAkB,EAAE,GAAG,IAAA,eAAQ,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACtE,IAAA,oBAAa,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,MAAM,CAAC,IAAI,CACT,yCAAyC,WAAW,UAAU,IAAI,cAAc,QAAQ,GAAG;QACzF,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAuB;IACzE,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAA,yBAAkB,EAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,kBAAkB,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;QAChF,SAAS,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,aAAa,IAAI,CACvD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CACT,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE;YACvD,YAAY,KAAK,CAAC,OAAO,GAAG,OAAO,IAAI,aAAa,EAAE,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAuB;IACzE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAA,uBAAgB,EAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAwB;IAC3E,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CACZ,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAwB,EAC7E,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,CACT,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAA,uBAAgB,EAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,qBAAc,EAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEjF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAC5C,MAAM,CAAC,IAAI,CACT,oBAAoB,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;QAC3D,SAAS,IAAI,CAAC,IAAI,4BAA4B,OAAO,OAAO,CAC/D,CAAC;IAEF,IACE,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC3B,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAChC,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CACT,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,mDAAmD,CACrF,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CACT,mBAAmB,MAAM,CAAC,YAAY,CAAC,MAAM,YAAY,OAAO,4BAA4B,CAC7F,CAAC;QACF,KAAK,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3D,MAAM,CAAC,IAAI,CACT,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE;gBACvD,aAAa,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CACT,sBAAsB,MAAM,CAAC,gBAAgB,CAAC,MAAM,MAAM;YACxD,sDAAsD,CACzD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAEtE,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAwB;IAC3E,MAAM,IAAI,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,wBAAwB,IAAA,uBAAgB,EAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACjF,OAAO;IACT,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAA,mBAAY,EAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACzF,IAAI,CACP,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,IAAA,oBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IACvD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IAC5F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,aAAa,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,IAAA,oBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzB,MAAM,CAAC,OAAO,CAAC,UAAU,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAQ,6BAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,mCAAmC,2BAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAE,2BAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CACT,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4BAA4B;YAC3D,WAAW,2BAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1C,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAwB,CAAC;AAClC,CAAC;AAED,MAAM,gBAAgB,GAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAE3F,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CACT,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,4BAA4B;YACxE,WAAW,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5C,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAsB,CAAC;AAChC,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAuB,EACvB,QAA2B;IAE3B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,IAAA,2BAAc,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,4CAA4C;QAC5C,OAAO,IAAA,8BAAiB,EAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,QAAmC;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAE,gBAA+B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CACT,UAAU,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,wBAAwB;gBACxD,WAAW,gBAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IACpC,OAAO,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC;AAClC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAQ,EAAC,6BAA6B,EAAE;YAClD,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,qBAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAY,IAAI,IAAI,EAAE;IACtC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,GAAW;IACtC,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;AACnC,CAAC"}

package/dist/allowlist/diff.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Allowlist delta — what changed between two repo states.
+ *
+ * The guardrail check posts a PR comment whenever new allowlist
+ * entries appear on the PR branch. Reviewers see the suppressions
+ * being introduced and can sanity-check the typed category / reason
+ * / expiry without manually grepping for `dxkit-allow:` lines.
+ *
+ * # Two-state comparison
+ *
+ * `computeAllowlistDelta` compares the current on-disk allowlist
+ * (loaded via the canonical `loadAllowlist`) against the allowlist
+ * at the baseline's commit SHA (read via `git show <sha>:.dxkit/...`).
+ * Each entry's identity is its `fingerprint`; the delta is the
+ * symmetric difference of the two fingerprint sets, hydrated back
+ * to the full entries on each side.
+ *
+ *   added   — entries present in current but not at the baseline SHA
+ *   removed — entries present at the baseline SHA but not in current
+ *
+ * # Graceful degradation
+ *
+ * When the baseline SHA isn't reachable (shallow clone, force-push
+ * orphaned base), the delta reports `baselineAccessible: false` and
+ * an empty `added` / `removed`. Callers (the renderer) treat that
+ * as "delta unavailable" rather than "no changes" — surfacing the
+ * incident so the customer can either deepen the clone or accept
+ * the missing review signal.
+ *
+ * Architectural posture:
+ *   - All IO goes through `loadAllowlist` (CLAUDE.md arch rule 1).
+ *   - `git show` is the only direct git interaction; failure modes
+ *     return null without throwing.
+ *   - Pure function over both inputs (current allowlist + git-resolved
+ *     baseline allowlist) — testable independently of git state.
+ */
+import { type AllowlistEntry } from './file';
+export interface AllowlistDelta {
+    /** Entries present in current but not at the baseline SHA. */
+    readonly added: ReadonlyArray<AllowlistEntry>;
+    /** Entries present at the baseline SHA but not in current. */
+    readonly removed: ReadonlyArray<AllowlistEntry>;
+    /** False when the baseline SHA wasn't reachable (shallow clone,
+     *  force-push that orphaned the base). When false, added/removed
+     *  are always empty — callers surface "delta unavailable" rather
+     *  than "no changes." */
+    readonly baselineAccessible: boolean;
+}
+/**
+ * Compute the delta between the current on-disk allowlist and the
+ * allowlist at the baseline's commit SHA. Returns a structurally
+ * empty delta with `baselineAccessible: false` when the baseline
+ * SHA can't be read.
+ *
+ * `baselineCommitSha` must be a non-empty hex SHA; an empty string
+ * (the canonical "no commit" value baseline-create uses outside a
+ * git repo) yields `baselineAccessible: false` immediately.
+ */
+export declare function computeAllowlistDelta(cwd: string, baselineCommitSha: string): AllowlistDelta;
+/**
+ * Pure delta over two entry arrays. Exposed for testability —
+ * callers without git state can synthesize before/after fixtures
+ * directly. Uses fingerprint equality (the canonical identity
+ * predicate) for set diff.
+ */
+export declare function diffEntries(prior: ReadonlyArray<AllowlistEntry>, current: ReadonlyArray<AllowlistEntry>): AllowlistDelta;
+//# sourceMappingURL=diff.d.ts.map

package/dist/allowlist/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/allowlist/diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,EAKL,KAAK,cAAc,EAEpB,MAAM,QAAQ,CAAC;AAEhB,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAChD;;;6BAGyB;IACzB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,cAAc,CAyB5F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,EACpC,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,GACrC,cAAc,CAehB"}