@ybotok/loam 0.1.0-beta.1 → 0.1.0-beta.2

package/dist/core/path-safety.js

@@ -85,6 +85,65 @@ export function resolvePortableFileInside(root, candidate, label = "path") {
     }
     return resolveInside(root, candidate, label);
 }
+/**
+ * The same portable spelling rules, with containment judged LEXICALLY — for a
+ * path that names a file the docs repo itself mounts.
+ *
+ * Every spelling defence above is kept, and for its reason: a snapshot manifest
+ * is loam's own file, but a corrupted or hostile one could carry `..` segments,
+ * an absolute path or a `C:\` spelling, and what comes out of this join is a
+ * path a caller then goes and reads.
+ *
+ * What is deliberately not applied is the realpath test. Composing a docs repo
+ * out of symlinks — a worktree, a submodule, one service's directory shared
+ * between two checkouts — is a supported layout that every walk of the repo
+ * FOLLOWS rather than refuses (repo.ts's `entryIs` says so in full), and that
+ * `archive` already writes through: its living-document writes are planned from
+ * `servicePaths()` and never see this file. With the realpath test in force on
+ * the manifest's `path` field, a `services/<svc>/` mounted that way made an
+ * interrupted archive permanently unrepairable — the retry was told the
+ * snapshot could not be read when it was perfectly intact, and the half-merge it
+ * was the only record of could never be repaired.
+ *
+ * This is only ever safe on a READ. A symlink that leaves the repo is
+ * lexically indistinguishable from a service directory the operator mounted on
+ * purpose — `escape/owned.txt` and `services/<svc>/spec.md` are both "inside
+ * docsDir" until something resolves them — so the realpath test is the only
+ * check that can refuse the first, at the price of also refusing the second.
+ * A caller that goes on to WRITE through the path must pay that price and use
+ * `resolvePortableFileInside`; `unarchive` does, and says so where it does.
+ * A caller that only reads a file and compares a digest it never discloses
+ * gains nothing from refusing, and loses the operator's ability to repair an
+ * interrupted archive.
+ */
+export function resolvePortableFileInsideLexically(root, candidate, label = "path") {
+    if (candidate.length === 0) {
+        throw new UnsafePathError(candidate, `${label} must not be empty`);
+    }
+    if (candidate.includes("\\")) {
+        throw new UnsafePathError(candidate, `${label} must use forward slashes`);
+    }
+    const parts = candidate.split("/");
+    if (parts.some((part) => part === "" || part === "." || part === "..")) {
+        throw new UnsafePathError(candidate, `${label} must be a canonical relative file path`);
+    }
+    // win32.isAbsolute is intentional even on POSIX, for the reason `resolveInside`
+    // gives: a snapshot travels with its feature directory between operating
+    // systems, and `C:\...` must never turn into an innocuous relative filename
+    // merely because the question was asked on Linux.
+    if (isAbsolute(candidate) || win32.isAbsolute(candidate)) {
+        throw new UnsafePathError(candidate, `${label} must be relative to its owning directory`);
+    }
+    const rootAbs = resolve(root);
+    const target = resolve(rootAbs, ...parts);
+    // Already implied by the segment test above, and asked anyway: this line is
+    // the containment claim itself, so a later loosening of the spelling rules
+    // cannot quietly stop making it.
+    if (!isPathInside(rootAbs, target)) {
+        throw new UnsafePathError(candidate, `${label} resolves outside its owning directory`);
+    }
+    return target;
+}
 /** Find the closest lexically contained path that exists, including symlinks. */
 function nearestExisting(target, root) {
     let current = target;

package/dist/core/path-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/core/path-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE/E,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,SAAS;IADpB,YACW,SAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;yBAHN,SAAS;QAIlB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAK,GAAG,MAAM;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACrE,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,+BAA+B,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,6CAA6C,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,iDAAiD,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAK,GAAG,MAAM;IACvF,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY;IACnD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Resolve caller-controlled paths without letting them leave an owned tree.\n *\n * A lexical `relative()` check is not enough: an existing component may be a\n * symlink whose target lives elsewhere. Conversely, checking only the final\n * path misses destinations that do not exist yet but whose nearest existing\n * parent is a symlink. This helper checks both views before a caller reads,\n * writes, walks, or removes anything.\n */\nimport { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve, sep, win32 } from \"node:path\";\n\nexport class UnsafePathError extends Error {\n  constructor(\n    readonly candidate: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"UnsafePathError\";\n  }\n}\n\n/** True when `target` is `root` or one of its descendants. */\nexport function isPathInside(root: string, target: string): boolean {\n  const rel = relative(resolve(root), resolve(target));\n  return rel === \"\" || (!isAbsolute(rel) && rel !== \"..\" && !rel.startsWith(`..${sep}`));\n}\n\n/**\n * Resolve a relative path beneath `root`, rejecting absolute paths, explicit\n * parent traversal, and symlink escape. The final path may be absent: its\n * nearest existing ancestor is checked in that case.\n */\nexport function resolveInside(root: string, candidate: string, label = \"path\"): string {\n  if (candidate.length === 0) {\n    throw new UnsafePathError(candidate, `${label} must not be empty`);\n  }\n  // win32.isAbsolute is intentional even on POSIX. Persisted/configured paths\n  // may be moved between operating systems, and `C:\\\\...` must never turn into\n  // an innocuous relative filename merely because validation ran on Linux.\n  if (isAbsolute(candidate) || win32.isAbsolute(candidate)) {\n    throw new UnsafePathError(candidate, `${label} must be relative to its owning directory`);\n  }\n  if (candidate.split(/[\\\\/]/).includes(\"..\")) {\n    throw new UnsafePathError(candidate, `${label} must not contain '..' path segments`);\n  }\n\n  const rootAbs = resolve(root);\n  const target = resolve(rootAbs, candidate);\n  if (!isPathInside(rootAbs, target)) {\n    throw new UnsafePathError(candidate, `${label} resolves outside its owning directory`);\n  }\n\n  let rootReal: string;\n  let existing: string;\n  try {\n    rootReal = realpathSync(rootAbs);\n    existing = nearestExisting(target, rootAbs);\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new UnsafePathError(candidate, `${label} cannot be resolved safely: ${detail}`);\n  }\n\n  let existingReal: string;\n  try {\n    existingReal = realpathSync(existing);\n  } catch (err) {\n    // A broken symlink is an existing path according to lstat, but realpath\n    // cannot prove where a later write through it would land. Refuse it.\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new UnsafePathError(candidate, `${label} crosses an unreadable or broken symlink: ${detail}`);\n  }\n  if (!isPathInside(rootReal, existingReal)) {\n    throw new UnsafePathError(candidate, `${label} crosses a symlink outside its owning directory`);\n  }\n  return target;\n}\n\n/**\n * Snapshot manifests are portable data, so their path spelling is stricter\n * than an interactive path: forward slashes, no redundant components, and a\n * file (not directory) name at the end.\n */\nexport function resolvePortableFileInside(root: string, candidate: string, label = \"path\"): string {\n  if (candidate.includes(\"\\\\\")) {\n    throw new UnsafePathError(candidate, `${label} must use forward slashes`);\n  }\n  const parts = candidate.split(\"/\");\n  if (parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) {\n    throw new UnsafePathError(candidate, `${label} must be a canonical relative file path`);\n  }\n  return resolveInside(root, candidate, label);\n}\n\n/** Find the closest lexically contained path that exists, including symlinks. */\nfunction nearestExisting(target: string, root: string): string {\n  let current = target;\n  for (;;) {\n    try {\n      lstatSync(current);\n      return current;\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code !== \"ENOENT\" && code !== \"ENOTDIR\") throw err;\n    }\n    if (current === root) return root;\n    const parent = dirname(current);\n    if (parent === current || !isPathInside(root, parent)) return root;\n    current = parent;\n  }\n}\n"]}
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/core/path-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAE/E,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B,SAAS;IADpB,YACW,SAAiB,EAC1B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;yBAHN,SAAS;QAIlB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAK,GAAG,MAAM;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACrE,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,sCAAsC,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,+BAA+B,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,6CAA6C,MAAM,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,iDAAiD,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAK,GAAG,MAAM;IACvF,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,kCAAkC,CAAC,IAAY,EAAE,SAAiB,EAAE,KAAK,GAAG,MAAM;IAChG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,yCAAyC,CAAC,CAAC;IAC1F,CAAC;IACD,gFAAgF;IAChF,yEAAyE;IACzE,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,2CAA2C,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,2EAA2E;IAC3E,iCAAiC;IACjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY;IACnD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAC;QACzD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Resolve caller-controlled paths without letting them leave an owned tree.\n *\n * A lexical `relative()` check is not enough: an existing component may be a\n * symlink whose target lives elsewhere. Conversely, checking only the final\n * path misses destinations that do not exist yet but whose nearest existing\n * parent is a symlink. This helper checks both views before a caller reads,\n * writes, walks, or removes anything.\n */\nimport { lstatSync, realpathSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve, sep, win32 } from \"node:path\";\n\nexport class UnsafePathError extends Error {\n  constructor(\n    readonly candidate: string,\n    message: string,\n  ) {\n    super(message);\n    this.name = \"UnsafePathError\";\n  }\n}\n\n/** True when `target` is `root` or one of its descendants. */\nexport function isPathInside(root: string, target: string): boolean {\n  const rel = relative(resolve(root), resolve(target));\n  return rel === \"\" || (!isAbsolute(rel) && rel !== \"..\" && !rel.startsWith(`..${sep}`));\n}\n\n/**\n * Resolve a relative path beneath `root`, rejecting absolute paths, explicit\n * parent traversal, and symlink escape. The final path may be absent: its\n * nearest existing ancestor is checked in that case.\n */\nexport function resolveInside(root: string, candidate: string, label = \"path\"): string {\n  if (candidate.length === 0) {\n    throw new UnsafePathError(candidate, `${label} must not be empty`);\n  }\n  // win32.isAbsolute is intentional even on POSIX. Persisted/configured paths\n  // may be moved between operating systems, and `C:\\\\...` must never turn into\n  // an innocuous relative filename merely because validation ran on Linux.\n  if (isAbsolute(candidate) || win32.isAbsolute(candidate)) {\n    throw new UnsafePathError(candidate, `${label} must be relative to its owning directory`);\n  }\n  if (candidate.split(/[\\\\/]/).includes(\"..\")) {\n    throw new UnsafePathError(candidate, `${label} must not contain '..' path segments`);\n  }\n\n  const rootAbs = resolve(root);\n  const target = resolve(rootAbs, candidate);\n  if (!isPathInside(rootAbs, target)) {\n    throw new UnsafePathError(candidate, `${label} resolves outside its owning directory`);\n  }\n\n  let rootReal: string;\n  let existing: string;\n  try {\n    rootReal = realpathSync(rootAbs);\n    existing = nearestExisting(target, rootAbs);\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new UnsafePathError(candidate, `${label} cannot be resolved safely: ${detail}`);\n  }\n\n  let existingReal: string;\n  try {\n    existingReal = realpathSync(existing);\n  } catch (err) {\n    // A broken symlink is an existing path according to lstat, but realpath\n    // cannot prove where a later write through it would land. Refuse it.\n    const detail = err instanceof Error ? err.message : String(err);\n    throw new UnsafePathError(candidate, `${label} crosses an unreadable or broken symlink: ${detail}`);\n  }\n  if (!isPathInside(rootReal, existingReal)) {\n    throw new UnsafePathError(candidate, `${label} crosses a symlink outside its owning directory`);\n  }\n  return target;\n}\n\n/**\n * Snapshot manifests are portable data, so their path spelling is stricter\n * than an interactive path: forward slashes, no redundant components, and a\n * file (not directory) name at the end.\n */\nexport function resolvePortableFileInside(root: string, candidate: string, label = \"path\"): string {\n  if (candidate.includes(\"\\\\\")) {\n    throw new UnsafePathError(candidate, `${label} must use forward slashes`);\n  }\n  const parts = candidate.split(\"/\");\n  if (parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) {\n    throw new UnsafePathError(candidate, `${label} must be a canonical relative file path`);\n  }\n  return resolveInside(root, candidate, label);\n}\n\n/**\n * The same portable spelling rules, with containment judged LEXICALLY — for a\n * path that names a file the docs repo itself mounts.\n *\n * Every spelling defence above is kept, and for its reason: a snapshot manifest\n * is loam's own file, but a corrupted or hostile one could carry `..` segments,\n * an absolute path or a `C:\\` spelling, and what comes out of this join is a\n * path a caller then goes and reads.\n *\n * What is deliberately not applied is the realpath test. Composing a docs repo\n * out of symlinks — a worktree, a submodule, one service's directory shared\n * between two checkouts — is a supported layout that every walk of the repo\n * FOLLOWS rather than refuses (repo.ts's `entryIs` says so in full), and that\n * `archive` already writes through: its living-document writes are planned from\n * `servicePaths()` and never see this file. With the realpath test in force on\n * the manifest's `path` field, a `services/<svc>/` mounted that way made an\n * interrupted archive permanently unrepairable — the retry was told the\n * snapshot could not be read when it was perfectly intact, and the half-merge it\n * was the only record of could never be repaired.\n *\n * This is only ever safe on a READ. A symlink that leaves the repo is\n * lexically indistinguishable from a service directory the operator mounted on\n * purpose — `escape/owned.txt` and `services/<svc>/spec.md` are both \"inside\n * docsDir\" until something resolves them — so the realpath test is the only\n * check that can refuse the first, at the price of also refusing the second.\n * A caller that goes on to WRITE through the path must pay that price and use\n * `resolvePortableFileInside`; `unarchive` does, and says so where it does.\n * A caller that only reads a file and compares a digest it never discloses\n * gains nothing from refusing, and loses the operator's ability to repair an\n * interrupted archive.\n */\nexport function resolvePortableFileInsideLexically(root: string, candidate: string, label = \"path\"): string {\n  if (candidate.length === 0) {\n    throw new UnsafePathError(candidate, `${label} must not be empty`);\n  }\n  if (candidate.includes(\"\\\\\")) {\n    throw new UnsafePathError(candidate, `${label} must use forward slashes`);\n  }\n  const parts = candidate.split(\"/\");\n  if (parts.some((part) => part === \"\" || part === \".\" || part === \"..\")) {\n    throw new UnsafePathError(candidate, `${label} must be a canonical relative file path`);\n  }\n  // win32.isAbsolute is intentional even on POSIX, for the reason `resolveInside`\n  // gives: a snapshot travels with its feature directory between operating\n  // systems, and `C:\\...` must never turn into an innocuous relative filename\n  // merely because the question was asked on Linux.\n  if (isAbsolute(candidate) || win32.isAbsolute(candidate)) {\n    throw new UnsafePathError(candidate, `${label} must be relative to its owning directory`);\n  }\n  const rootAbs = resolve(root);\n  const target = resolve(rootAbs, ...parts);\n  // Already implied by the segment test above, and asked anyway: this line is\n  // the containment claim itself, so a later loosening of the spelling rules\n  // cannot quietly stop making it.\n  if (!isPathInside(rootAbs, target)) {\n    throw new UnsafePathError(candidate, `${label} resolves outside its owning directory`);\n  }\n  return target;\n}\n\n/** Find the closest lexically contained path that exists, including symlinks. */\nfunction nearestExisting(target: string, root: string): string {\n  let current = target;\n  for (;;) {\n    try {\n      lstatSync(current);\n      return current;\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code !== \"ENOENT\" && code !== \"ENOTDIR\") throw err;\n    }\n    if (current === root) return root;\n    const parent = dirname(current);\n    if (parent === current || !isPathInside(root, parent)) return root;\n    current = parent;\n  }\n}\n"]}

package/dist/core/provenance.js

@@ -18,7 +18,7 @@ import { existsSync } from "node:fs";
 import { readdir, readFile, realpath, stat } from "node:fs/promises";
 import { join, relative, resolve, sep } from "node:path";
 import { listField, parseFrontmatter, rawBody, readFrontmatter, stringField, FEATURE_STATUSES, SERVICE_STATUSES, } from "./frontmatter.js";
-import { featurePaths, servicePaths } from "./repo.js";
+import { featurePaths, servicePaths, SPEC_AXES } from "./repo.js";
 import { isPathInside, resolveInside } from "./path-safety.js";
 /** Fields every artifact is expected to carry, beyond its identity and status. */
 const EXPECTED = ["owner"];
@@ -27,11 +27,10 @@ export async function serviceProvenance(docsDir, service, opts = {}) {
     const findings = [];
     // Both requirement-carrying specs get the same pass: arch.spec.md follows
     // spec.md's frontmatter conventions exactly, so the checks are one loop —
-    // only the label tells a reader which file moved.
-    for (const { path, file } of [
-        { path: paths.spec, file: "spec.md" },
-        { path: paths.archSpec, file: "arch.spec.md" },
-    ]) {
+    // only the label tells a reader which file moved. The pair comes from
+    // SPEC_AXES rather than being respelled, so a third axis is graded here the
+    // day it is declared instead of the day somebody notices.
+    for (const { path, file } of SPEC_AXES.map((axis) => ({ path: paths[axis.key], file: axis.file }))) {
         if (!existsSync(path))
             continue;
         const raw = await readFile(path, "utf8");
@@ -289,11 +288,24 @@ function contentFindings(fm, raw, service, label) {
         },
     ];
 }
+/**
+ * The local calendar day, for the two commands that date a stamp. A vouch or a
+ * verification record is a person saying "today I read this", so it is their
+ * date, not UTC's — `toISOString` files an evening in the Americas under
+ * tomorrow. It sits here because this module already owns the stamp vocabulary
+ * the date is written into.
+ */
+export function today(now) {
+    const pad = (n) => String(n).padStart(2, "0");
+    return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
+}
 /* ------------------------------------------------------------------ */
 /* The content digest                                                  */
 /* ------------------------------------------------------------------ */
 /** How much of the sha256 is written into the document. */
 const DIGEST_LENGTH = 16;
+/** How many source files the digest reads at once — see `sourcesDigest`. */
+const DIGEST_READ_BATCH = 32;
 /**
  * Digest the CONTENT of the files `sources` names. The recipe is spelled out
  * because the value is written into documents, and anything reading them has to
@@ -319,10 +331,23 @@ export async function sourcesDigest(repoDir, sources) {
     const { found, skipped } = await collectSources(repoDir, sources);
     const outer = createHash("sha256");
     const index = [];
-    for (const file of found) {
-        const content = createHash("sha256").update(await readFile(file.abs)).digest("hex");
-        outer.update(`${file.rel}\0${content}\n`);
-        index.push({ path: file.rel, sha: content.slice(0, DIGEST_LENGTH) });
+    // Read in fixed batches, hash in array order. `found` is already sorted and
+    // every file's own sha depends on nothing but its own bytes, so the sequence
+    // fed to `outer` — and therefore the digest — is unchanged by construction;
+    // only the waiting overlaps. A `sources: [src/]` over a real service repo is
+    // thousands of files, and one-await-per-file spent nearly all of its time
+    // idle. The batch is bounded rather than a single `Promise.all` over the
+    // whole list because an unbounded fan-out over a source tree runs the process
+    // out of file descriptors, which would turn a stamp into an EMFILE.
+    for (let start = 0; start < found.length; start += DIGEST_READ_BATCH) {
+        const hashed = await Promise.all(found.slice(start, start + DIGEST_READ_BATCH).map(async (file) => ({
+            rel: file.rel,
+            content: createHash("sha256").update(await readFile(file.abs)).digest("hex"),
+        })));
+        for (const { rel, content } of hashed) {
+            outer.update(`${rel}\0${content}\n`);
+            index.push({ path: rel, sha: content.slice(0, DIGEST_LENGTH) });
+        }
     }
     // `empty` is deliberately not set here: it is a sentence about a named
     // document, and a digest has no name to put in it. Callers that need it say

package/dist/core/provenance.js.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/core/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,OAAO,EACP,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE/D,kFAAkF;AAClF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAU,CAAC;AAWpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,OAAe,EACf,IAAI,GAAsB,EAAE;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,0EAA0E;IAC1E,kDAAkD;IAClD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;QAC3B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE;QACrC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE;KAC/C,EAAE,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CAAC,EAAE,EAAE;YACtB,KAAK;YACL,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,CAAC,GAAG,gBAAgB,CAAC;SAChC,CAAC,CACH,CAAC;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,gBAAgB,CAAC,EAAE,EAAE;QAC1B,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,CAAC,GAAG,gBAAgB,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,gBAAgB,CAAC,EAAe,EAAE,IAAkB;IAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO;YACL;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,6EAA6E;aACpG;SACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,mHAAmH;aAC1I;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,OAAO,KAAK,EAAE,wBAAwB,IAAI,CAAC,OAAO,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,gBAAgB,MAAM,uBAAuB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;KAC5D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,MAAM,uBAAuB;YAC1E,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,EAAe,EACf,OAAe,EACf,KAAa,EACb,OAA2B;IAE3B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,KAAK,mGAAmG;aACrH;SACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAErC,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,kCAAkC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mHAAmH;gBAC7M,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;gBACxL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrF,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAY;QACxB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,oBAAoB;KACzD,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAc,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE3E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,GAAG,KAAK,8IAA8I,OAAO,KAAK;aAC5K;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC;IACnE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,KAAK,6BAA6B,KAAK,KAAK,KAAK,CAAC,MAAM,oBAAoB,MAAM,GAAG;aAClG;SACF,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO;QACL,GAAG,QAAQ;QACX;YACE,yEAAyE;YACzE,2EAA2E;YAC3E,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,KAAK,2BAA2B,KAAK,GAAG,KAAK,CAAC,OAAO,8CAA8C,OAAO,IAAI;YAC1H,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO;YAC/B,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAwB,EAAE,KAAa;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,uGAAuG;YAC3I,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,EAAe,EAAE,GAAW,EAAE,OAAe,EAAE,KAAa;IACnF,IAAI,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClD,6EAA6E;IAC7E,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC;IACnE,OAAO;QACL;YACE,wEAAwE;YACxE,yEAAyE;YACzE,0BAA0B;YAC1B,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,KAAK,kBAAkB,KAAK,qIAAqI,OAAO,KAAK;SAC1L;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,2DAA2D;AAC3D,MAAM,aAAa,GAAG,EAAE,CAAC;AA0CzB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IACpE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpF,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,OAAiB,EACjB,KAAa;IAEb,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,OAAiB;IAClE,OAAO,GAAG,KAAK,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,CAAC;AACrI,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AACpG,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,OAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnF,6EAA6E;IAC7E,2EAA2E;IAC3E,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,4DAA4D;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;iBAC1C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACxD,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,4DAA4D;iBACvD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,sEAAsE;QACtE,0EAA0E;QAC1E,eAAe;QACf,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,mDAAmD,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,6EAA6E;QAC7E,6EAA6E;QAC7E,2DAA2D;aACtD,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,6CAA6C,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;aAC3C,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,yEAAyE;QACzE,6BAA6B;QAC7B,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;aACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;aAC5B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;aAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAAc;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACxC,OAAO,IAAI,OAAO,CAAc,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5D,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,GAAG,IAAI,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,wDAAwD;QACxD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAUD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAUD;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAmB,EAAE,GAAuB;IAChE,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3B,wEAAwE;QACxE,uDAAuD;QACvD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,kBAAkB,GAAG,CAAC,MAAM,OAAO;SAC9F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;aACpD,IAAI,MAAM,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,MAAM,iBAAiB,EAAE,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,OAAiB;IAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAiB;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IAC9D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Provenance checks: is this artifact anchored to anything, and has anyone\n * vouched for it?\n *\n * SCHEMA.md has declared `status` / `owner` / `sources` / `last_verified` since\n * the beginning and nothing read them. They matter more now that the prose is\n * written by an agent: coherence proves the corpus agrees with itself, and only\n * `sources` says it has anything to do with the code.\n *\n * Absence and contradiction are graded differently on purpose. A missing field\n * is incompleteness — a warning, something to work through. A field that says\n * the wrong thing (a spec claiming to be another service, a status nobody\n * defined) is a bug, and gates.\n */\nimport { spawn } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { existsSync } from \"node:fs\";\nimport { readdir, readFile, realpath, stat } from \"node:fs/promises\";\nimport { join, relative, resolve, sep } from \"node:path\";\nimport {\n  listField,\n  parseFrontmatter,\n  rawBody,\n  readFrontmatter,\n  stringField,\n  FEATURE_STATUSES,\n  SERVICE_STATUSES,\n  type Frontmatter,\n} from \"./frontmatter.js\";\nimport type { Finding } from \"./report.js\";\nimport { featurePaths, servicePaths } from \"./repo.js\";\nimport { isPathInside, resolveInside } from \"./path-safety.js\";\n\n/** Fields every artifact is expected to carry, beyond its identity and status. */\nconst EXPECTED = [\"owner\"] as const;\n\nexport interface ProvenanceOptions {\n  /**\n   * The repo `sources` resolve against — the service repo loam is running in.\n   * Undefined when the docs being validated describe some other repository, in\n   * which case the paths are not ours to resolve and are left alone.\n   */\n  repoDir?: string;\n}\n\nexport async function serviceProvenance(\n  docsDir: string,\n  service: string,\n  opts: ProvenanceOptions = {},\n): Promise<Finding[]> {\n  const paths = servicePaths(docsDir, service);\n  const findings: Finding[] = [];\n  // Both requirement-carrying specs get the same pass: arch.spec.md follows\n  // spec.md's frontmatter conventions exactly, so the checks are one loop —\n  // only the label tells a reader which file moved.\n  for (const { path, file } of [\n    { path: paths.spec, file: \"spec.md\" },\n    { path: paths.archSpec, file: \"arch.spec.md\" },\n  ]) {\n    if (!existsSync(path)) continue;\n    const raw = await readFile(path, \"utf8\");\n    const fm = parseFrontmatter(raw);\n    const label = `${service}: ${file}`;\n    findings.push(\n      ...identityFindings(fm, {\n        label,\n        idField: \"service\",\n        idValue: service,\n        statuses: [...SERVICE_STATUSES],\n      }),\n    );\n    // With no frontmatter at all, \"it names no sources\" says nothing the missing\n    // header did not already say — and a malformed one proves nothing either:\n    // `sources.absent` against a header nobody can read is the same false\n    // advice as the field cascade, so frontmatter.malformed stands alone.\n    if (fm.present && !fm.malformed) {\n      findings.push(...(await sourceFindings(fm, service, label, opts.repoDir)));\n      findings.push(...contentFindings(fm, raw, service, label));\n    }\n  }\n  return findings;\n}\n\nexport async function featureProvenance(\n  featureDir: string,\n  featureId: string,\n): Promise<Finding[]> {\n  const path = featurePaths(featureDir).intent;\n  if (!existsSync(path)) return [];\n  const fm = await readFrontmatter(path);\n  return identityFindings(fm, {\n    label: \"intent.md\",\n    idField: \"feature\",\n    idValue: featureId,\n    statuses: [...FEATURE_STATUSES],\n  });\n}\n\ninterface IdentitySpec {\n  label: string;\n  idField: \"service\" | \"feature\";\n  idValue: string;\n  statuses: string[];\n}\n\nfunction identityFindings(fm: Frontmatter, spec: IdentitySpec): Finding[] {\n  const findings: Finding[] = [];\n  if (!fm.present) {\n    return [\n      {\n        severity: \"warn\",\n        code: \"frontmatter.missing\",\n        subject: spec.idValue,\n        message: `${spec.label} has no frontmatter — no owner, no status, no link to the code it describes`,\n      },\n    ];\n  }\n\n  // One honest error instead of the cascade: with an unreadable header the\n  // field checks below would grade owner/status/service \"missing\" and send the\n  // author adding fields to a block YAML refuses to parse. Nothing can be\n  // concluded from a header nobody can read — including that it lacks fields.\n  if (fm.malformed) {\n    return [\n      {\n        severity: \"error\",\n        code: \"frontmatter.malformed\",\n        subject: spec.idValue,\n        message: `${spec.label} has frontmatter that does not parse as YAML — owner, status and sources are unreadable until the header is fixed`,\n      },\n    ];\n  }\n\n  const id = stringField(fm, spec.idField);\n  if (id !== undefined && id !== spec.idValue) {\n    findings.push({\n      severity: \"error\",\n      code: \"frontmatter.field-mismatch\",\n      subject: spec.idValue,\n      message: `${spec.label} declares ${spec.idField}: ${id}, but it lives under ${spec.idValue}`,\n    });\n  }\n\n  const status = stringField(fm, \"status\");\n  if (status !== undefined && !spec.statuses.includes(status)) {\n    findings.push({\n      severity: \"error\",\n      code: \"frontmatter.status-unknown\",\n      subject: spec.idValue,\n      message: `${spec.label} has status '${status}' — expected one of ${spec.statuses.join(\", \")}`,\n    });\n  }\n\n  const missing = [\n    ...(id === undefined ? [spec.idField] : []),\n    ...(status === undefined ? [\"status\"] : []),\n    ...EXPECTED.filter((f) => stringField(fm, f) === undefined),\n  ];\n  if (missing.length > 0) {\n    findings.push({\n      severity: \"warn\",\n      code: \"frontmatter.field-missing\",\n      subject: spec.idValue,\n      message: `${spec.label} is missing ${missing.length} frontmatter field(s)`,\n      details: missing,\n      text: { detailPrefix: \"- \" },\n    });\n  }\n  return findings;\n}\n\nasync function sourceFindings(\n  fm: Frontmatter,\n  service: string,\n  label: string,\n  repoDir: string | undefined,\n): Promise<Finding[]> {\n  const sources = listField(fm, \"sources\");\n  if (sources.length === 0) {\n    return [\n      {\n        severity: \"warn\",\n        code: \"sources.absent\",\n        message: `${label} names no sources — nothing ties it to the code, so nothing can tell you when it goes out of date`,\n      },\n    ];\n  }\n  // Someone else's repository: the paths describe a tree loam is not standing in.\n  if (repoDir === undefined) return [];\n\n  // Before existence: a pattern entry would \"not exist\" as a literal path, and\n  // grading it missing would send the author fixing the wrong thing.\n  const patterns = patternSources(sources);\n  if (patterns.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${patterns.length} source(s) are glob patterns — ${patterns.join(\", \")}. Patterns are no longer supported: name files or directories (a directory already covers everything beneath it).`,\n        details: patterns,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const unsafe = unsafeSources(repoDir, sources);\n  if (unsafe.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-outside\",\n        message: `${label}: ${unsafe.length} source(s) escape the service repo — ${unsafe.join(\", \")}. Sources must be relative paths contained by this repository, including through symlinks.`,\n        details: unsafe,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const missing = missingSources(repoDir, sources);\n  if (missing.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${missing.length} source(s) do not exist — ${missing.join(\", \")}`,\n        details: missing,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n  const resolved: Finding = {\n    severity: \"ok\",\n    code: \"sources.resolved\",\n    message: `${label}: ${sources.length} source(s) resolve`,\n  };\n\n  // The walk happens here rather than inside the staleness branch below, even\n  // though only staleness needs the hashes: what the walk REFUSED to follow is\n  // a hole in the tie to the code whether or not anybody has vouched yet, and\n  // an unvouched service is exactly where a reader is about to decide the\n  // sources list is honest.\n  const { digest, files, index, skipped } = await sourcesDigest(repoDir, sources);\n  const findings: Finding[] = [resolved, ...skippedFindings(skipped, label)];\n\n  // The paths are there; the question staleness answers is whether what is AT\n  // them is still what somebody read.\n  const stamped = stringField(fm, \"sources_digest\");\n  if (stamped === undefined) {\n    return [\n      ...findings,\n      {\n        severity: \"warn\",\n        code: \"sources.unvouched\",\n        message: `${label}: no sources_digest — nobody has vouched for this against the code, so nothing can tell you when it goes stale. Run \\`loam vouch --service ${service}\\`.`,\n      },\n    ];\n  }\n\n  const since = stringField(fm, \"last_verified\") ?? \"it was stamped\";\n  if (digest === stamped) {\n    return [\n      ...findings,\n      {\n        severity: \"ok\",\n        code: \"sources.current\",\n        message: `${label}: sources unchanged since ${since} (${files.length} file(s), digest ${digest})`,\n      },\n    ];\n  }\n\n  // What MOVED, when the stamp recorded enough to say. Repeating the frontmatter's\n  // own `sources` entries back at a reader — which is all this finding could do\n  // before `sources_files` existed — answers a question nobody asked: they wrote\n  // that list, and \"one of these five directories changed somehow\" is where the\n  // search starts, not where it ends.\n  const moved = movedSources(decodeSourceIndex(stringField(fm, \"sources_files\")), index);\n  return [\n    ...findings,\n    {\n      // A warning, not an error: the doc may still be right, and only a person\n      // can say. What loam knows is that nobody has looked since the code moved.\n      severity: \"warn\",\n      code: \"sources.stale\",\n      message: `${label}: sources changed since ${since}${moved.summary} — re-read them and \\`loam vouch --service ${service}\\``,\n      details: moved.paths ?? sources,\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/**\n * The paths the digest walk would not follow. Never silent: a symlink dropped\n * on the floor is a file whose content nobody is watching, while the document\n * beside it says `verified` — the digest cannot go stale over bytes it never\n * hashed, so the one thing the stamp promises is quietly untrue for them.\n *\n * A warning, not an error, and for the same reason staleness is: the doc may be\n * perfectly right about the code behind that link. What loam can say is that it\n * is not watching it.\n */\nfunction skippedFindings(skipped: SkippedSource[], label: string): Finding[] {\n  if (skipped.length === 0) return [];\n  return [\n    {\n      severity: \"warn\",\n      code: \"sources.skipped\",\n      message: `${label}: ${skipped.length} path(s) under the listed sources were not hashed — the digest says nothing about what is behind them`,\n      details: skipped.map((s) => `${s.path} — ${s.reason}`),\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/**\n * The doc-side half of the freshness check. `sources_digest` says whether the\n * CODE moved since a person looked, and only that service's repo can recompute\n * it; `content_digest` says whether the DOCUMENT did, and needs nothing but\n * the document — so this runs wherever the spec is readable, `--service` and\n * `--all` alike. Without it, editing a spec after it was vouched left\n * `status: verified` standing over words nobody read — forged freshness, in\n * the exact agent-written-prose threat model this layer exists for.\n */\nfunction contentFindings(fm: Frontmatter, raw: string, service: string, label: string): Finding[] {\n  if (stringField(fm, \"status\") !== \"verified\") return [];\n  const stamped = stringField(fm, \"content_digest\");\n  // A verified doc with no stamp predates the field. Quiet on purpose: the fix\n  // is re-vouching, and grading years of pre-feature vouches as suspect would\n  // drown the fleet in warnings nobody chose.\n  if (stamped === undefined) return [];\n  if (contentDigest(raw) === stamped) return [];\n  const since = stringField(fm, \"last_verified\") ?? \"it was vouched\";\n  return [\n    {\n      // A warning, not an error — the sources.stale doctrine: the doc changed\n      // since it was vouched, and only a person can say whether verified still\n      // holds of the new words.\n      severity: \"warn\",\n      code: \"content.stale\",\n      message: `${label} changed since ${since} — the doc moved under its vouch, and only a person can say whether 'verified' still holds. Re-read it and \\`loam vouch --service ${service}\\`.`,\n    },\n  ];\n}\n\n/* ------------------------------------------------------------------ */\n/* The content digest                                                  */\n/* ------------------------------------------------------------------ */\n\n/** How much of the sha256 is written into the document. */\nconst DIGEST_LENGTH = 16;\n\nexport interface SourcesDigest extends SourcesExpansion {\n  /** The stamp that goes in `sources_digest`. */\n  digest: string;\n  /**\n   * Per file, its own short sha — the record `sources_files` carries so a later\n   * `sources.stale` can name what moved instead of guessing. Same order as `files`.\n   */\n  index: SourceIndexEntry[];\n}\n\n/** One file's share of the stamp: what it is called, and what it said. */\nexport interface SourceIndexEntry {\n  /** Repo-relative, `/`-separated. */\n  path: string;\n  /** sha256 of its bytes, truncated the way `sources_digest` is. */\n  sha: string;\n}\n\n/** A path the walk found but would not hash, and the reason a reader needs. */\nexport interface SkippedSource {\n  /** Repo-relative, `/`-separated. */\n  path: string;\n  /** Why it was left out — the half of the sentence after the path. */\n  reason: string;\n}\n\n/** What a `sources` list covers, and what it does not. */\nexport interface SourcesExpansion {\n  /** Repo-relative paths, sorted — exactly what a digest would hash. */\n  files: string[];\n  /** Everything the walk refused to follow. Empty in the ordinary case. */\n  skipped: SkippedSource[];\n  /**\n   * Set only when `files` is empty: the one sentence that says the list covers\n   * nothing. `loam vouch` refuses with it, `loam validate` grades it — see\n   * emptySourcesMessage for why they must be the same words.\n   */\n  empty?: string;\n}\n\n/**\n * Digest the CONTENT of the files `sources` names. The recipe is spelled out\n * because the value is written into documents, and anything reading them has to\n * be able to reproduce it:\n *\n *   1. expand each entry to repo-relative file paths (`/` separators) — a file\n *      is itself, a directory everything beneath it, minus what the repository\n *      does not consider its own (see collectSources) — sorted and de-duplicated;\n *   2. per file, `sha256(bytes)`;\n *   3. feed `<path>\\0<hex>\\n` for each file, in that order, into an outer\n *      sha256;\n *   4. keep the first 16 hex characters.\n *\n * Content, not mtime: git does not preserve modification times, so after a\n * fresh clone every file looks changed and the check would be false positives\n * end to end. Bytes survive the clone. Hashing the path alongside the content\n * means a rename registers, which is what a reader of the doc would want.\n *\n * 64 bits is a change detector, not a seal — it answers \"did this move?\", and\n * an adversary who wants a collision can have one.\n */\nexport async function sourcesDigest(repoDir: string, sources: string[]): Promise<SourcesDigest> {\n  const { found, skipped } = await collectSources(repoDir, sources);\n  const outer = createHash(\"sha256\");\n  const index: SourceIndexEntry[] = [];\n  for (const file of found) {\n    const content = createHash(\"sha256\").update(await readFile(file.abs)).digest(\"hex\");\n    outer.update(`${file.rel}\\0${content}\\n`);\n    index.push({ path: file.rel, sha: content.slice(0, DIGEST_LENGTH) });\n  }\n  // `empty` is deliberately not set here: it is a sentence about a named\n  // document, and a digest has no name to put in it. Callers that need it say\n  // emptySourcesMessage(label, sources) — the same words, from one definition.\n  return { digest: outer.digest(\"hex\").slice(0, DIGEST_LENGTH), files: index.map((e) => e.path), index, skipped };\n}\n\n/**\n * What a `sources` list actually covers — the digest's file set without the\n * hashing.\n *\n * Exported because two commands must give the SAME answer to \"does this list\n * cover anything?\". `loam vouch` refuses to stamp an expansion that covers no\n * files (a digest over nothing never changes, so the stamp would read as\n * current forever), and until `loam validate` could say the same thing in the\n * same words, an author got a green validate followed by a vouch that refused —\n * two commands contradicting each other about one document, with nothing in the\n * green run hinting at it.\n */\nexport async function expandSourceFiles(\n  repoDir: string,\n  sources: string[],\n  label: string,\n): Promise<SourcesExpansion> {\n  const { found, skipped } = await collectSources(repoDir, sources);\n  const files = found.map((f) => f.rel);\n  return { files, skipped, ...(files.length === 0 ? { empty: emptySourcesMessage(label, sources) } : {}) };\n}\n\n/**\n * The one sentence for \"these paths exist and cover no file\". One definition,\n * because `vouch`'s refusal and `validate`'s finding are the same diagnosis\n * about the same document and must not drift into two descriptions of it — the\n * author fixes it once, in the sources list.\n */\nexport function emptySourcesMessage(label: string, sources: string[]): string {\n  return `${label}: the sources listed match no files — ${sources.join(\", \")}. A digest over nothing would read as current forever.`;\n}\n\n/**\n * The stamp `loam vouch` writes into `content_digest`: sha256 of the\n * document's own BODY — every byte after the frontmatter block (below the\n * closing `---` line and its newline; `rawBody` is the one definition of that\n * cut) — first 16 hex characters, the sources recipe's length.\n *\n * Byte-exact, no normalization. Body-only is load-bearing: vouch itself\n * rewrites the frontmatter as it stamps, and a later frontmatter-only edit\n * (another vouch, a corrected owner) must not read as the document moving.\n */\nexport function contentDigest(source: string): string {\n  return createHash(\"sha256\").update(rawBody(source), \"utf8\").digest(\"hex\").slice(0, DIGEST_LENGTH);\n}\n\ninterface SourceFile {\n  /** Repo-relative, `/`-separated — the spelling that goes into the hash. */\n  rel: string;\n  abs: string;\n}\n\n/**\n * The files a `sources` list names: a file is itself, a directory is everything\n * beneath it. Nothing else — glob patterns used to be matched here, by a\n * hand-rolled dialect that silently differed from the gitignore/minimatch\n * conventions authors assume, so a pattern quietly digested a DIFFERENT file\n * set than its author intended. Pattern-looking entries are now refused loudly\n * upstream (see patternSources); this function only ever sees literal paths.\n *\n * Three exclusions, all part of the digest recipe's contract:\n *\n *  - dot-entries are skipped while walking — `.git` is not what the doc was\n *    written from — though a path naming one outright is still honoured;\n *  - `node_modules` is skipped the same way, unconditionally: it is the one\n *    build input every ecosystem agrees is not source, and it is the one that\n *    makes the walk take minutes;\n *  - anything the repository's own `.gitignore` covers is dropped, when the\n *    repo is a git checkout and git is on the PATH (see gitIgnoredPaths).\n *\n * The third is the one worth stating a reason for. `sources_digest` answers\n * \"did the code move since a person read it\", and BUILD OUTPUT moves on every\n * CI run without anybody touching the code — a `sources: [src/]` over a repo\n * that compiles into `src/generated/` went stale on a schedule, so the warning\n * that means \"re-read this\" arrived when nothing had been written. A signal\n * that fires every night is a signal people learn to close. Git's answer is\n * used rather than a list of our own because it is the answer the repository\n * already gives every other tool, and it is the author's to change.\n *\n * The fallback is deliberate: no git, no checkout, a git that errors — hash\n * everything. Missing an exclusion costs noise; inventing one costs a file the\n * stamp silently stops watching, and this walk exists to have nothing in that\n * category.\n */\nasync function collectSources(\n  repoDir: string,\n  sources: string[],\n): Promise<{ found: SourceFile[]; skipped: SkippedSource[] }> {\n  const found = new Map<string, string>();\n  const skipped = new Map<string, string>();\n  const relOf = (abs: string): string => relative(repoDir, abs).split(sep).join(\"/\");\n\n  // realpath once, up front: every containment question below is asked against\n  // the resolved root, so a repo reached through a symlink (a worktree under\n  // /var -> /private/var on macOS, say) does not make its own files look external.\n  const repoReal = await realpath(repoDir).catch(() => resolve(repoDir));\n  // The realpaths of the directories currently being walked — the cycle guard.\n  // A STACK rather than a set of everything ever entered, because the two rules\n  // answer different questions: a directory reachable by two spellings (a\n  // `current -> versions/3` link beside the real tree) is content under both\n  // names and belongs in the digest twice, while a directory reachable from\n  // INSIDE itself is a loop. A global visited-set conflates them, and then which\n  // spelling survives depends on the order readdir happened to return — a\n  // digest that differs between two machines holding identical bytes.\n  const walking: string[] = [];\n\n  const walk = async (dir: string): Promise<void> => {\n    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);\n    // Sorted, so a tree walks the same way on every filesystem.\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n    for (const entry of entries) {\n      if (entry.name.startsWith(\".\") || entry.name === \"node_modules\") continue;\n      const child = join(dir, entry.name);\n      if (entry.isDirectory()) await enterDir(child);\n      else if (entry.isFile()) found.set(relOf(child), child);\n      // readdir reports symlinks by lstat, so isDirectory() and isFile() are\n      // BOTH false for one: before this branch existed a symlinked file, and a\n      // whole subtree behind a symlinked directory, fell between the two arms\n      // and left the digest without a word said. That is the failure this\n      // module is here to prevent, arriving through its own walk.\n      else if (entry.isSymbolicLink()) await follow(child);\n    }\n  };\n\n  const enterDir = async (dir: string): Promise<void> => {\n    const real = await realpath(dir).catch(() => null);\n    if (real === null || walking.includes(real)) return;\n    walking.push(real);\n    try {\n      await walk(dir);\n    } finally {\n      walking.pop();\n    }\n  };\n\n  const follow = async (link: string): Promise<void> => {\n    const real = await realpath(link).catch(() => null);\n    if (real === null) {\n      skipped.set(relOf(link), \"a symlink that does not resolve\");\n      return;\n    }\n    // Outside the repo the file is not this service's to vouch for, and the\n    // same rule already refuses it as a top-level `sources` entry\n    // (sources.path-outside). Reported rather than dropped: an author who\n    // vendored a sibling repo through a symlink needs to know the stamp stops\n    // at the link.\n    if (!isPathInside(repoReal, real)) {\n      skipped.set(relOf(link), \"a symlink whose target is outside this repository\");\n      return;\n    }\n    const info = await stat(link).catch(() => null);\n    if (info === null) {\n      skipped.set(relOf(link), \"a symlink that does not resolve\");\n      return;\n    }\n    // A link's own spelling is what the doc's author wrote, so that is the path\n    // that goes into the digest — the content comes from the target either way.\n    if (info.isFile()) found.set(relOf(link), link);\n    // A link that closes a loop is not reported: everything behind it is already\n    // in the digest under the spelling it was reached by, so nothing has stopped\n    // being watched. Only unhashed CONTENT is worth a warning.\n    else if (info.isDirectory()) await enterDir(link);\n    else skipped.set(relOf(link), \"a symlink to neither a file nor a directory\");\n  };\n\n  for (const source of sources) {\n    const cleaned = source.trim();\n    if (cleaned.length === 0) continue;\n    const root = resolveInside(repoDir, cleaned, `source '${source}'`);\n    const info = await stat(root).catch(() => null);\n    if (info === null) continue;\n    if (info.isFile()) found.set(relOf(root), root);\n    else if (info.isDirectory()) await enterDir(root);\n  }\n\n  // One git invocation for the whole expansion, not one per file: the skipped\n  // list rides along so an ignored symlink does not warn about a path the\n  // repository already says is not its own.\n  const ignored = await gitIgnoredPaths(repoDir, [...found.keys(), ...skipped.keys()]);\n  for (const rel of ignored) {\n    found.delete(rel);\n    skipped.delete(rel);\n  }\n\n  return {\n    // Plain codepoint order, not locale order: the digest has to be the same\n    // everywhere it is computed.\n    found: [...found.entries()]\n      .map(([rel, abs]) => ({ rel, abs }))\n      .sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0)),\n    skipped: [...skipped.entries()]\n      .map(([path, reason]) => ({ path, reason }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  };\n}\n\n/** How long the digest waits on git before deciding it learned nothing. */\nconst GIT_TIMEOUT_MS = 10_000;\n\n/**\n * Which of these repo-relative paths the repository ignores, asked once for the\n * whole list. `git check-ignore` is the authority on purpose — it reads\n * `.gitignore` at every level, `.git/info/exclude` and the user's global\n * excludes, and it already knows that a TRACKED file is not ignored no matter\n * what a pattern says, which is the distinction a re-implementation always gets\n * wrong.\n *\n * Every failure answers \"nothing is ignored\": exit 1 is git saying so, exit 128\n * is \"not a git repository\", a spawn error is git not being installed, and a\n * timeout is a repository too strange to wait for. None of them justify\n * dropping a file from a digest a person is going to sign.\n */\nasync function gitIgnoredPaths(repoDir: string, rels: string[]): Promise<Set<string>> {\n  if (rels.length === 0) return new Set();\n  return new Promise<Set<string>>((done) => {\n    const child = spawn(\"git\", [\"check-ignore\", \"--stdin\", \"-z\"], {\n      cwd: repoDir,\n      stdio: [\"pipe\", \"pipe\", \"ignore\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    let out = \"\";\n    child.stdout.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: string) => {\n      out += chunk;\n    });\n    child.on(\"error\", () => done(new Set()));\n    child.on(\"close\", (code) => {\n      // 0: some paths are ignored and are on stdout. 1: none are — an empty\n      // answer, not a failure. Anything else: we learned nothing.\n      done(code === 0 || code === 1 ? new Set(out.split(\"\\0\").filter((s) => s.length > 0)) : new Set());\n    });\n    // A git that died before reading its input hands us EPIPE; the close\n    // handler above is what decides the outcome either way.\n    child.stdin.on(\"error\", () => undefined);\n    child.stdin.end(rels.join(\"\\0\") + \"\\0\");\n  });\n}\n\n/* ------------------------------------------------------------------ */\n/* The per-file index: what `sources.stale` names                      */\n/* ------------------------------------------------------------------ */\n\n/**\n * How many files `sources_files` will list one by one before it gives up and\n * records only how many there were.\n *\n * A readability budget, not a correctness one: the index lives in the header of\n * a document a person reads, and a `sources: [src/]` over a legacy service can\n * expand to thousands of files. Past the limit `sources.stale` falls back to\n * repeating the `sources` entries — worse advice, but a spec.md whose\n * frontmatter is longer than its requirements is worse still.\n */\nconst SOURCE_INDEX_LIMIT = 100;\n\n/**\n * The `sources_files` value `loam vouch` stamps beside `sources_digest`: one\n * `<sha>  <path>` line per file (sha256sum's layout, and its column order, so\n * the path may contain spaces), or just the file count once the list would run\n * past SOURCE_INDEX_LIMIT.\n *\n * Its whole purpose is the next `sources.stale`. `sources_digest` can say THAT\n * the code moved and never which part of it; with the index a reader gets the\n * added, removed and changed paths, which is the difference between re-reading\n * one file and re-reading a directory. It is also a readable git diff in the\n * docs repo: the vouch commit shows exactly which source files the stamp now\n * stands over.\n */\nexport function encodeSourceIndex(index: SourceIndexEntry[]): string {\n  if (index.length > SOURCE_INDEX_LIMIT) return String(index.length);\n  return index.map((e) => `${e.sha}  ${e.path}`).join(\"\\n\");\n}\n\n/** What a stamped `sources_files` says: the per-file shas, the count, or nothing. */\ninterface StampedIndex {\n  /** path -> sha, or null when the stamp did not record them. */\n  entries: Map<string, string> | null;\n  /** How many files the stamp covered, when that is knowable. */\n  count?: number;\n}\n\n/**\n * Read back what `encodeSourceIndex` wrote. Anything unrecognised reads as \"the\n * stamp said nothing\" rather than as an empty index: a header nobody can parse\n * must not turn into a `sources.stale` claiming every file was deleted.\n */\nfunction decodeSourceIndex(stamped: string | undefined): StampedIndex {\n  if (stamped === undefined) return { entries: null };\n  const text = stamped.trim();\n  if (text.length === 0) return { entries: null };\n  if (/^\\d+$/.test(text)) return { entries: null, count: Number(text) };\n\n  const entries = new Map<string, string>();\n  for (const line of text.split(\"\\n\")) {\n    const match = /^([0-9a-f]{16})\\s+(.+)$/.exec(line.trim());\n    if (match === null) return { entries: null };\n    entries.set(match[2]!, match[1]!);\n  }\n  return { entries, count: entries.size };\n}\n\n/** The paths that moved between a stamp and now, with a phrase for the message. */\ninterface MovedSources {\n  /** Annotated paths, or undefined when the stamp did not record enough to say. */\n  paths?: string[];\n  /** Appended to the `sources.stale` message; empty when there is nothing to add. */\n  summary: string;\n}\n\n/**\n * added / removed / changed, from the stamped index against the current one.\n * The annotation travels IN the detail line rather than in three separate\n * lists: a reader scanning a stale report wants the paths in one column, and\n * \"which of the three\" is one word wide.\n */\nfunction movedSources(stamp: StampedIndex, now: SourceIndexEntry[]): MovedSources {\n  if (stamp.entries === null) {\n    // No index, but the count alone still beats silence: \"12 files then, 14\n    // now\" tells a reader to go looking for two new files.\n    return {\n      summary: stamp.count === undefined ? \"\" : ` (${stamp.count} file(s) then, ${now.length} now)`,\n    };\n  }\n  const paths: string[] = [];\n  const current = new Map(now.map((e) => [e.path, e.sha]));\n  for (const [path, sha] of current) {\n    const before = stamp.entries.get(path);\n    if (before === undefined) paths.push(`added    ${path}`);\n    else if (before !== sha) paths.push(`changed  ${path}`);\n  }\n  for (const path of stamp.entries.keys()) if (!current.has(path)) paths.push(`removed  ${path}`);\n  paths.sort();\n  // An index that agrees with the current tree while the digest does not is a\n  // contradiction (a truncation collision, or a hand-edited header). Say\n  // nothing rather than print an empty list under a staleness warning.\n  if (paths.length === 0) return { summary: \"\" };\n  return { paths, summary: ` (${paths.length} path(s) moved)` };\n}\n\n/** The characters that made an entry a pattern under the glob dialect loam no longer ships. */\nconst PATTERN_CHARS = /[*?[]/;\n\n/**\n * The `sources` entries that look like glob patterns — anything containing\n * `*`, `?` or `[`. Patterns are refused loudly everywhere sources are consumed\n * (`loam vouch` refuses the run, `loam validate` grades an error), never\n * resolved: the glob dialect loam used to ship silently differed from the\n * gitignore/minimatch conventions authors assume — bracket classes literal,\n * its own `**` handling — so a pattern quietly digested a different file set\n * than intended, corrupting the staleness signal in both directions. A\n * directory already means \"everything beneath it\", so the fix is to name one.\n *\n * The cost accepted with the rule: a real file with `[` in its name (a Next.js\n * route, say) cannot be listed on its own — its parent directory covers it.\n */\nexport function patternSources(sources: string[]): string[] {\n  return sources.filter((s) => PATTERN_CHARS.test(s.trim()));\n}\n\n/** The `sources` entries that resolve to nothing in this repo. */\nexport function missingSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((s) => !sourceExists(repoDir, s));\n}\n\n/** Entries that are absolute, traverse upward, or escape through a symlink. */\nexport function unsafeSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((source) => {\n    const cleaned = source.trim();\n    if (cleaned.length === 0) return false;\n    try {\n      resolveInside(repoDir, cleaned, `source '${source}'`);\n      return false;\n    } catch {\n      return true;\n    }\n  });\n}\n\n/** Does a `sources` entry point at something real? Literal paths only, checked exactly. */\nfunction sourceExists(repoDir: string, source: string): boolean {\n  const cleaned = source.trim();\n  if (cleaned.length === 0) return false;\n  try {\n    return existsSync(resolveInside(repoDir, cleaned, `source '${source}'`));\n  } catch {\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/core/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,OAAO,EACP,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE/D,kFAAkF;AAClF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAU,CAAC;AAWpC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,OAAe,EACf,IAAI,GAAsB,EAAE;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,0DAA0D;IAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACnG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CACX,GAAG,gBAAgB,CAAC,EAAE,EAAE;YACtB,KAAK;YACL,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,OAAO;YAChB,QAAQ,EAAE,CAAC,GAAG,gBAAgB,CAAC;SAChC,CAAC,CACH,CAAC;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAkB,EAClB,SAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,gBAAgB,CAAC,EAAE,EAAE;QAC1B,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,CAAC,GAAG,gBAAgB,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,gBAAgB,CAAC,EAAe,EAAE,IAAkB;IAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO;YACL;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,6EAA6E;aACpG;SACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,mHAAmH;aAC1I;SACF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,OAAO,KAAK,EAAE,wBAAwB,IAAI,CAAC,OAAO,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,gBAAgB,MAAM,uBAAuB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;KAC5D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,MAAM,uBAAuB;YAC1E,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,EAAe,EACf,OAAe,EACf,KAAa,EACb,OAA2B;IAE3B,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,GAAG,KAAK,mGAAmG;aACrH;SACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAErC,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,kCAAkC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mHAAmH;gBAC7M,OAAO,EAAE,QAAQ;gBACjB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,MAAM,CAAC,MAAM,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4FAA4F;gBACxL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL;gBACE,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrF,OAAO,EAAE,OAAO;gBAChB,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAY;QACxB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,oBAAoB;KACzD,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,0BAA0B;IAC1B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAc,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAE3E,4EAA4E;IAC5E,oCAAoC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,GAAG,KAAK,8IAA8I,OAAO,KAAK;aAC5K;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC;IACnE,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,QAAQ;YACX;gBACE,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,GAAG,KAAK,6BAA6B,KAAK,KAAK,KAAK,CAAC,MAAM,oBAAoB,MAAM,GAAG;aAClG;SACF,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,oCAAoC;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,OAAO;QACL,GAAG,QAAQ;QACX;YACE,yEAAyE;YACzE,2EAA2E;YAC3E,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,KAAK,2BAA2B,KAAK,GAAG,KAAK,CAAC,OAAO,8CAA8C,OAAO,IAAI;YAC1H,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO;YAC/B,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,OAAwB,EAAE,KAAa;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO,CAAC,MAAM,uGAAuG;YAC3I,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YACtD,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAC7B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,EAAe,EAAE,GAAW,EAAE,OAAe,EAAE,KAAa;IACnF,IAAI,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAClD,6EAA6E;IAC7E,4EAA4E;IAC5E,4CAA4C;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,gBAAgB,CAAC;IACnE,OAAO;QACL;YACE,wEAAwE;YACxE,yEAAyE;YACzE,0BAA0B;YAC1B,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,KAAK,kBAAkB,KAAK,qIAAqI,OAAO,KAAK;SAC1L;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,GAAS;IAC7B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,2DAA2D;AAC3D,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA0C7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IACpE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,yEAAyE;IACzE,8EAA8E;IAC9E,oEAAoE;IACpE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACjE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC7E,CAAC,CAAC,CACJ,CAAC;QACF,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YACtC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,OAAiB,EACjB,KAAa;IAEb,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,OAAiB;IAClE,OAAO,GAAG,KAAK,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wDAAwD,CAAC;AACrI,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;AACpG,CAAC;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAe,EACf,OAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEnF,6EAA6E;IAC7E,2EAA2E;IAC3E,iFAAiF;IACjF,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,+EAA+E;IAC/E,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,4DAA4D;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;iBAC1C,IAAI,KAAK,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACxD,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,4DAA4D;iBACvD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,sEAAsE;QACtE,0EAA0E;QAC1E,eAAe;QACf,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,mDAAmD,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,6EAA6E;QAC7E,6EAA6E;QAC7E,2DAA2D;aACtD,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,6CAA6C,CAAC,CAAC;IAC/E,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,IAAI;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;aAC3C,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAED,OAAO;QACL,yEAAyE;QACzE,6BAA6B;QAC7B,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;aACxB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;aACnC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;aAC5B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;aAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,IAAc;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACxC,OAAO,IAAI,OAAO,CAAc,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE;YAC5D,GAAG,EAAE,OAAO;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;YACjC,OAAO,EAAE,cAAc;SACxB,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,GAAG,IAAI,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,sEAAsE;YACtE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,wDAAwD;QACxD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAyB;IACzD,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5D,CAAC;AAUD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA2B;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IAEtE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAUD;;;;;GAKG;AACH,SAAS,YAAY,CAAC,KAAmB,EAAE,GAAuB;IAChE,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3B,wEAAwE;QACxE,uDAAuD;QACvD,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,kBAAkB,GAAG,CAAC,MAAM,OAAO;SAC9F,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;aACpD,IAAI,MAAM,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,EAAE,CAAC;IACb,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,MAAM,iBAAiB,EAAE,CAAC;AAChE,CAAC;AAED,+FAA+F;AAC/F,MAAM,aAAa,GAAG,OAAO,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,OAAiB;IAC9C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,OAAiB;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAiB;IAC9D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Provenance checks: is this artifact anchored to anything, and has anyone\n * vouched for it?\n *\n * SCHEMA.md has declared `status` / `owner` / `sources` / `last_verified` since\n * the beginning and nothing read them. They matter more now that the prose is\n * written by an agent: coherence proves the corpus agrees with itself, and only\n * `sources` says it has anything to do with the code.\n *\n * Absence and contradiction are graded differently on purpose. A missing field\n * is incompleteness — a warning, something to work through. A field that says\n * the wrong thing (a spec claiming to be another service, a status nobody\n * defined) is a bug, and gates.\n */\nimport { spawn } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { existsSync } from \"node:fs\";\nimport { readdir, readFile, realpath, stat } from \"node:fs/promises\";\nimport { join, relative, resolve, sep } from \"node:path\";\nimport {\n  listField,\n  parseFrontmatter,\n  rawBody,\n  readFrontmatter,\n  stringField,\n  FEATURE_STATUSES,\n  SERVICE_STATUSES,\n  type Frontmatter,\n} from \"./frontmatter.js\";\nimport type { Finding } from \"./report.js\";\nimport { featurePaths, servicePaths, SPEC_AXES } from \"./repo.js\";\nimport { isPathInside, resolveInside } from \"./path-safety.js\";\n\n/** Fields every artifact is expected to carry, beyond its identity and status. */\nconst EXPECTED = [\"owner\"] as const;\n\nexport interface ProvenanceOptions {\n  /**\n   * The repo `sources` resolve against — the service repo loam is running in.\n   * Undefined when the docs being validated describe some other repository, in\n   * which case the paths are not ours to resolve and are left alone.\n   */\n  repoDir?: string;\n}\n\nexport async function serviceProvenance(\n  docsDir: string,\n  service: string,\n  opts: ProvenanceOptions = {},\n): Promise<Finding[]> {\n  const paths = servicePaths(docsDir, service);\n  const findings: Finding[] = [];\n  // Both requirement-carrying specs get the same pass: arch.spec.md follows\n  // spec.md's frontmatter conventions exactly, so the checks are one loop —\n  // only the label tells a reader which file moved. The pair comes from\n  // SPEC_AXES rather than being respelled, so a third axis is graded here the\n  // day it is declared instead of the day somebody notices.\n  for (const { path, file } of SPEC_AXES.map((axis) => ({ path: paths[axis.key], file: axis.file }))) {\n    if (!existsSync(path)) continue;\n    const raw = await readFile(path, \"utf8\");\n    const fm = parseFrontmatter(raw);\n    const label = `${service}: ${file}`;\n    findings.push(\n      ...identityFindings(fm, {\n        label,\n        idField: \"service\",\n        idValue: service,\n        statuses: [...SERVICE_STATUSES],\n      }),\n    );\n    // With no frontmatter at all, \"it names no sources\" says nothing the missing\n    // header did not already say — and a malformed one proves nothing either:\n    // `sources.absent` against a header nobody can read is the same false\n    // advice as the field cascade, so frontmatter.malformed stands alone.\n    if (fm.present && !fm.malformed) {\n      findings.push(...(await sourceFindings(fm, service, label, opts.repoDir)));\n      findings.push(...contentFindings(fm, raw, service, label));\n    }\n  }\n  return findings;\n}\n\nexport async function featureProvenance(\n  featureDir: string,\n  featureId: string,\n): Promise<Finding[]> {\n  const path = featurePaths(featureDir).intent;\n  if (!existsSync(path)) return [];\n  const fm = await readFrontmatter(path);\n  return identityFindings(fm, {\n    label: \"intent.md\",\n    idField: \"feature\",\n    idValue: featureId,\n    statuses: [...FEATURE_STATUSES],\n  });\n}\n\ninterface IdentitySpec {\n  label: string;\n  idField: \"service\" | \"feature\";\n  idValue: string;\n  statuses: string[];\n}\n\nfunction identityFindings(fm: Frontmatter, spec: IdentitySpec): Finding[] {\n  const findings: Finding[] = [];\n  if (!fm.present) {\n    return [\n      {\n        severity: \"warn\",\n        code: \"frontmatter.missing\",\n        subject: spec.idValue,\n        message: `${spec.label} has no frontmatter — no owner, no status, no link to the code it describes`,\n      },\n    ];\n  }\n\n  // One honest error instead of the cascade: with an unreadable header the\n  // field checks below would grade owner/status/service \"missing\" and send the\n  // author adding fields to a block YAML refuses to parse. Nothing can be\n  // concluded from a header nobody can read — including that it lacks fields.\n  if (fm.malformed) {\n    return [\n      {\n        severity: \"error\",\n        code: \"frontmatter.malformed\",\n        subject: spec.idValue,\n        message: `${spec.label} has frontmatter that does not parse as YAML — owner, status and sources are unreadable until the header is fixed`,\n      },\n    ];\n  }\n\n  const id = stringField(fm, spec.idField);\n  if (id !== undefined && id !== spec.idValue) {\n    findings.push({\n      severity: \"error\",\n      code: \"frontmatter.field-mismatch\",\n      subject: spec.idValue,\n      message: `${spec.label} declares ${spec.idField}: ${id}, but it lives under ${spec.idValue}`,\n    });\n  }\n\n  const status = stringField(fm, \"status\");\n  if (status !== undefined && !spec.statuses.includes(status)) {\n    findings.push({\n      severity: \"error\",\n      code: \"frontmatter.status-unknown\",\n      subject: spec.idValue,\n      message: `${spec.label} has status '${status}' — expected one of ${spec.statuses.join(\", \")}`,\n    });\n  }\n\n  const missing = [\n    ...(id === undefined ? [spec.idField] : []),\n    ...(status === undefined ? [\"status\"] : []),\n    ...EXPECTED.filter((f) => stringField(fm, f) === undefined),\n  ];\n  if (missing.length > 0) {\n    findings.push({\n      severity: \"warn\",\n      code: \"frontmatter.field-missing\",\n      subject: spec.idValue,\n      message: `${spec.label} is missing ${missing.length} frontmatter field(s)`,\n      details: missing,\n      text: { detailPrefix: \"- \" },\n    });\n  }\n  return findings;\n}\n\nasync function sourceFindings(\n  fm: Frontmatter,\n  service: string,\n  label: string,\n  repoDir: string | undefined,\n): Promise<Finding[]> {\n  const sources = listField(fm, \"sources\");\n  if (sources.length === 0) {\n    return [\n      {\n        severity: \"warn\",\n        code: \"sources.absent\",\n        message: `${label} names no sources — nothing ties it to the code, so nothing can tell you when it goes out of date`,\n      },\n    ];\n  }\n  // Someone else's repository: the paths describe a tree loam is not standing in.\n  if (repoDir === undefined) return [];\n\n  // Before existence: a pattern entry would \"not exist\" as a literal path, and\n  // grading it missing would send the author fixing the wrong thing.\n  const patterns = patternSources(sources);\n  if (patterns.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${patterns.length} source(s) are glob patterns — ${patterns.join(\", \")}. Patterns are no longer supported: name files or directories (a directory already covers everything beneath it).`,\n        details: patterns,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const unsafe = unsafeSources(repoDir, sources);\n  if (unsafe.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-outside\",\n        message: `${label}: ${unsafe.length} source(s) escape the service repo — ${unsafe.join(\", \")}. Sources must be relative paths contained by this repository, including through symlinks.`,\n        details: unsafe,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n\n  const missing = missingSources(repoDir, sources);\n  if (missing.length > 0) {\n    return [\n      {\n        severity: \"error\",\n        code: \"sources.path-missing\",\n        message: `${label}: ${missing.length} source(s) do not exist — ${missing.join(\", \")}`,\n        details: missing,\n        text: { detailPrefix: \"- \" },\n      },\n    ];\n  }\n  const resolved: Finding = {\n    severity: \"ok\",\n    code: \"sources.resolved\",\n    message: `${label}: ${sources.length} source(s) resolve`,\n  };\n\n  // The walk happens here rather than inside the staleness branch below, even\n  // though only staleness needs the hashes: what the walk REFUSED to follow is\n  // a hole in the tie to the code whether or not anybody has vouched yet, and\n  // an unvouched service is exactly where a reader is about to decide the\n  // sources list is honest.\n  const { digest, files, index, skipped } = await sourcesDigest(repoDir, sources);\n  const findings: Finding[] = [resolved, ...skippedFindings(skipped, label)];\n\n  // The paths are there; the question staleness answers is whether what is AT\n  // them is still what somebody read.\n  const stamped = stringField(fm, \"sources_digest\");\n  if (stamped === undefined) {\n    return [\n      ...findings,\n      {\n        severity: \"warn\",\n        code: \"sources.unvouched\",\n        message: `${label}: no sources_digest — nobody has vouched for this against the code, so nothing can tell you when it goes stale. Run \\`loam vouch --service ${service}\\`.`,\n      },\n    ];\n  }\n\n  const since = stringField(fm, \"last_verified\") ?? \"it was stamped\";\n  if (digest === stamped) {\n    return [\n      ...findings,\n      {\n        severity: \"ok\",\n        code: \"sources.current\",\n        message: `${label}: sources unchanged since ${since} (${files.length} file(s), digest ${digest})`,\n      },\n    ];\n  }\n\n  // What MOVED, when the stamp recorded enough to say. Repeating the frontmatter's\n  // own `sources` entries back at a reader — which is all this finding could do\n  // before `sources_files` existed — answers a question nobody asked: they wrote\n  // that list, and \"one of these five directories changed somehow\" is where the\n  // search starts, not where it ends.\n  const moved = movedSources(decodeSourceIndex(stringField(fm, \"sources_files\")), index);\n  return [\n    ...findings,\n    {\n      // A warning, not an error: the doc may still be right, and only a person\n      // can say. What loam knows is that nobody has looked since the code moved.\n      severity: \"warn\",\n      code: \"sources.stale\",\n      message: `${label}: sources changed since ${since}${moved.summary} — re-read them and \\`loam vouch --service ${service}\\``,\n      details: moved.paths ?? sources,\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/**\n * The paths the digest walk would not follow. Never silent: a symlink dropped\n * on the floor is a file whose content nobody is watching, while the document\n * beside it says `verified` — the digest cannot go stale over bytes it never\n * hashed, so the one thing the stamp promises is quietly untrue for them.\n *\n * A warning, not an error, and for the same reason staleness is: the doc may be\n * perfectly right about the code behind that link. What loam can say is that it\n * is not watching it.\n */\nfunction skippedFindings(skipped: SkippedSource[], label: string): Finding[] {\n  if (skipped.length === 0) return [];\n  return [\n    {\n      severity: \"warn\",\n      code: \"sources.skipped\",\n      message: `${label}: ${skipped.length} path(s) under the listed sources were not hashed — the digest says nothing about what is behind them`,\n      details: skipped.map((s) => `${s.path} — ${s.reason}`),\n      text: { detailPrefix: \"- \" },\n    },\n  ];\n}\n\n/**\n * The doc-side half of the freshness check. `sources_digest` says whether the\n * CODE moved since a person looked, and only that service's repo can recompute\n * it; `content_digest` says whether the DOCUMENT did, and needs nothing but\n * the document — so this runs wherever the spec is readable, `--service` and\n * `--all` alike. Without it, editing a spec after it was vouched left\n * `status: verified` standing over words nobody read — forged freshness, in\n * the exact agent-written-prose threat model this layer exists for.\n */\nfunction contentFindings(fm: Frontmatter, raw: string, service: string, label: string): Finding[] {\n  if (stringField(fm, \"status\") !== \"verified\") return [];\n  const stamped = stringField(fm, \"content_digest\");\n  // A verified doc with no stamp predates the field. Quiet on purpose: the fix\n  // is re-vouching, and grading years of pre-feature vouches as suspect would\n  // drown the fleet in warnings nobody chose.\n  if (stamped === undefined) return [];\n  if (contentDigest(raw) === stamped) return [];\n  const since = stringField(fm, \"last_verified\") ?? \"it was vouched\";\n  return [\n    {\n      // A warning, not an error — the sources.stale doctrine: the doc changed\n      // since it was vouched, and only a person can say whether verified still\n      // holds of the new words.\n      severity: \"warn\",\n      code: \"content.stale\",\n      message: `${label} changed since ${since} — the doc moved under its vouch, and only a person can say whether 'verified' still holds. Re-read it and \\`loam vouch --service ${service}\\`.`,\n    },\n  ];\n}\n\n/**\n * The local calendar day, for the two commands that date a stamp. A vouch or a\n * verification record is a person saying \"today I read this\", so it is their\n * date, not UTC's — `toISOString` files an evening in the Americas under\n * tomorrow. It sits here because this module already owns the stamp vocabulary\n * the date is written into.\n */\nexport function today(now: Date): string {\n  const pad = (n: number): string => String(n).padStart(2, \"0\");\n  return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;\n}\n\n/* ------------------------------------------------------------------ */\n/* The content digest                                                  */\n/* ------------------------------------------------------------------ */\n\n/** How much of the sha256 is written into the document. */\nconst DIGEST_LENGTH = 16;\n\n/** How many source files the digest reads at once — see `sourcesDigest`. */\nconst DIGEST_READ_BATCH = 32;\n\nexport interface SourcesDigest extends SourcesExpansion {\n  /** The stamp that goes in `sources_digest`. */\n  digest: string;\n  /**\n   * Per file, its own short sha — the record `sources_files` carries so a later\n   * `sources.stale` can name what moved instead of guessing. Same order as `files`.\n   */\n  index: SourceIndexEntry[];\n}\n\n/** One file's share of the stamp: what it is called, and what it said. */\nexport interface SourceIndexEntry {\n  /** Repo-relative, `/`-separated. */\n  path: string;\n  /** sha256 of its bytes, truncated the way `sources_digest` is. */\n  sha: string;\n}\n\n/** A path the walk found but would not hash, and the reason a reader needs. */\nexport interface SkippedSource {\n  /** Repo-relative, `/`-separated. */\n  path: string;\n  /** Why it was left out — the half of the sentence after the path. */\n  reason: string;\n}\n\n/** What a `sources` list covers, and what it does not. */\nexport interface SourcesExpansion {\n  /** Repo-relative paths, sorted — exactly what a digest would hash. */\n  files: string[];\n  /** Everything the walk refused to follow. Empty in the ordinary case. */\n  skipped: SkippedSource[];\n  /**\n   * Set only when `files` is empty: the one sentence that says the list covers\n   * nothing. `loam vouch` refuses with it, `loam validate` grades it — see\n   * emptySourcesMessage for why they must be the same words.\n   */\n  empty?: string;\n}\n\n/**\n * Digest the CONTENT of the files `sources` names. The recipe is spelled out\n * because the value is written into documents, and anything reading them has to\n * be able to reproduce it:\n *\n *   1. expand each entry to repo-relative file paths (`/` separators) — a file\n *      is itself, a directory everything beneath it, minus what the repository\n *      does not consider its own (see collectSources) — sorted and de-duplicated;\n *   2. per file, `sha256(bytes)`;\n *   3. feed `<path>\\0<hex>\\n` for each file, in that order, into an outer\n *      sha256;\n *   4. keep the first 16 hex characters.\n *\n * Content, not mtime: git does not preserve modification times, so after a\n * fresh clone every file looks changed and the check would be false positives\n * end to end. Bytes survive the clone. Hashing the path alongside the content\n * means a rename registers, which is what a reader of the doc would want.\n *\n * 64 bits is a change detector, not a seal — it answers \"did this move?\", and\n * an adversary who wants a collision can have one.\n */\nexport async function sourcesDigest(repoDir: string, sources: string[]): Promise<SourcesDigest> {\n  const { found, skipped } = await collectSources(repoDir, sources);\n  const outer = createHash(\"sha256\");\n  const index: SourceIndexEntry[] = [];\n  // Read in fixed batches, hash in array order. `found` is already sorted and\n  // every file's own sha depends on nothing but its own bytes, so the sequence\n  // fed to `outer` — and therefore the digest — is unchanged by construction;\n  // only the waiting overlaps. A `sources: [src/]` over a real service repo is\n  // thousands of files, and one-await-per-file spent nearly all of its time\n  // idle. The batch is bounded rather than a single `Promise.all` over the\n  // whole list because an unbounded fan-out over a source tree runs the process\n  // out of file descriptors, which would turn a stamp into an EMFILE.\n  for (let start = 0; start < found.length; start += DIGEST_READ_BATCH) {\n    const hashed = await Promise.all(\n      found.slice(start, start + DIGEST_READ_BATCH).map(async (file) => ({\n        rel: file.rel,\n        content: createHash(\"sha256\").update(await readFile(file.abs)).digest(\"hex\"),\n      })),\n    );\n    for (const { rel, content } of hashed) {\n      outer.update(`${rel}\\0${content}\\n`);\n      index.push({ path: rel, sha: content.slice(0, DIGEST_LENGTH) });\n    }\n  }\n  // `empty` is deliberately not set here: it is a sentence about a named\n  // document, and a digest has no name to put in it. Callers that need it say\n  // emptySourcesMessage(label, sources) — the same words, from one definition.\n  return { digest: outer.digest(\"hex\").slice(0, DIGEST_LENGTH), files: index.map((e) => e.path), index, skipped };\n}\n\n/**\n * What a `sources` list actually covers — the digest's file set without the\n * hashing.\n *\n * Exported because two commands must give the SAME answer to \"does this list\n * cover anything?\". `loam vouch` refuses to stamp an expansion that covers no\n * files (a digest over nothing never changes, so the stamp would read as\n * current forever), and until `loam validate` could say the same thing in the\n * same words, an author got a green validate followed by a vouch that refused —\n * two commands contradicting each other about one document, with nothing in the\n * green run hinting at it.\n */\nexport async function expandSourceFiles(\n  repoDir: string,\n  sources: string[],\n  label: string,\n): Promise<SourcesExpansion> {\n  const { found, skipped } = await collectSources(repoDir, sources);\n  const files = found.map((f) => f.rel);\n  return { files, skipped, ...(files.length === 0 ? { empty: emptySourcesMessage(label, sources) } : {}) };\n}\n\n/**\n * The one sentence for \"these paths exist and cover no file\". One definition,\n * because `vouch`'s refusal and `validate`'s finding are the same diagnosis\n * about the same document and must not drift into two descriptions of it — the\n * author fixes it once, in the sources list.\n */\nexport function emptySourcesMessage(label: string, sources: string[]): string {\n  return `${label}: the sources listed match no files — ${sources.join(\", \")}. A digest over nothing would read as current forever.`;\n}\n\n/**\n * The stamp `loam vouch` writes into `content_digest`: sha256 of the\n * document's own BODY — every byte after the frontmatter block (below the\n * closing `---` line and its newline; `rawBody` is the one definition of that\n * cut) — first 16 hex characters, the sources recipe's length.\n *\n * Byte-exact, no normalization. Body-only is load-bearing: vouch itself\n * rewrites the frontmatter as it stamps, and a later frontmatter-only edit\n * (another vouch, a corrected owner) must not read as the document moving.\n */\nexport function contentDigest(source: string): string {\n  return createHash(\"sha256\").update(rawBody(source), \"utf8\").digest(\"hex\").slice(0, DIGEST_LENGTH);\n}\n\ninterface SourceFile {\n  /** Repo-relative, `/`-separated — the spelling that goes into the hash. */\n  rel: string;\n  abs: string;\n}\n\n/**\n * The files a `sources` list names: a file is itself, a directory is everything\n * beneath it. Nothing else — glob patterns used to be matched here, by a\n * hand-rolled dialect that silently differed from the gitignore/minimatch\n * conventions authors assume, so a pattern quietly digested a DIFFERENT file\n * set than its author intended. Pattern-looking entries are now refused loudly\n * upstream (see patternSources); this function only ever sees literal paths.\n *\n * Three exclusions, all part of the digest recipe's contract:\n *\n *  - dot-entries are skipped while walking — `.git` is not what the doc was\n *    written from — though a path naming one outright is still honoured;\n *  - `node_modules` is skipped the same way, unconditionally: it is the one\n *    build input every ecosystem agrees is not source, and it is the one that\n *    makes the walk take minutes;\n *  - anything the repository's own `.gitignore` covers is dropped, when the\n *    repo is a git checkout and git is on the PATH (see gitIgnoredPaths).\n *\n * The third is the one worth stating a reason for. `sources_digest` answers\n * \"did the code move since a person read it\", and BUILD OUTPUT moves on every\n * CI run without anybody touching the code — a `sources: [src/]` over a repo\n * that compiles into `src/generated/` went stale on a schedule, so the warning\n * that means \"re-read this\" arrived when nothing had been written. A signal\n * that fires every night is a signal people learn to close. Git's answer is\n * used rather than a list of our own because it is the answer the repository\n * already gives every other tool, and it is the author's to change.\n *\n * The fallback is deliberate: no git, no checkout, a git that errors — hash\n * everything. Missing an exclusion costs noise; inventing one costs a file the\n * stamp silently stops watching, and this walk exists to have nothing in that\n * category.\n */\nasync function collectSources(\n  repoDir: string,\n  sources: string[],\n): Promise<{ found: SourceFile[]; skipped: SkippedSource[] }> {\n  const found = new Map<string, string>();\n  const skipped = new Map<string, string>();\n  const relOf = (abs: string): string => relative(repoDir, abs).split(sep).join(\"/\");\n\n  // realpath once, up front: every containment question below is asked against\n  // the resolved root, so a repo reached through a symlink (a worktree under\n  // /var -> /private/var on macOS, say) does not make its own files look external.\n  const repoReal = await realpath(repoDir).catch(() => resolve(repoDir));\n  // The realpaths of the directories currently being walked — the cycle guard.\n  // A STACK rather than a set of everything ever entered, because the two rules\n  // answer different questions: a directory reachable by two spellings (a\n  // `current -> versions/3` link beside the real tree) is content under both\n  // names and belongs in the digest twice, while a directory reachable from\n  // INSIDE itself is a loop. A global visited-set conflates them, and then which\n  // spelling survives depends on the order readdir happened to return — a\n  // digest that differs between two machines holding identical bytes.\n  const walking: string[] = [];\n\n  const walk = async (dir: string): Promise<void> => {\n    const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);\n    // Sorted, so a tree walks the same way on every filesystem.\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n    for (const entry of entries) {\n      if (entry.name.startsWith(\".\") || entry.name === \"node_modules\") continue;\n      const child = join(dir, entry.name);\n      if (entry.isDirectory()) await enterDir(child);\n      else if (entry.isFile()) found.set(relOf(child), child);\n      // readdir reports symlinks by lstat, so isDirectory() and isFile() are\n      // BOTH false for one: before this branch existed a symlinked file, and a\n      // whole subtree behind a symlinked directory, fell between the two arms\n      // and left the digest without a word said. That is the failure this\n      // module is here to prevent, arriving through its own walk.\n      else if (entry.isSymbolicLink()) await follow(child);\n    }\n  };\n\n  const enterDir = async (dir: string): Promise<void> => {\n    const real = await realpath(dir).catch(() => null);\n    if (real === null || walking.includes(real)) return;\n    walking.push(real);\n    try {\n      await walk(dir);\n    } finally {\n      walking.pop();\n    }\n  };\n\n  const follow = async (link: string): Promise<void> => {\n    const real = await realpath(link).catch(() => null);\n    if (real === null) {\n      skipped.set(relOf(link), \"a symlink that does not resolve\");\n      return;\n    }\n    // Outside the repo the file is not this service's to vouch for, and the\n    // same rule already refuses it as a top-level `sources` entry\n    // (sources.path-outside). Reported rather than dropped: an author who\n    // vendored a sibling repo through a symlink needs to know the stamp stops\n    // at the link.\n    if (!isPathInside(repoReal, real)) {\n      skipped.set(relOf(link), \"a symlink whose target is outside this repository\");\n      return;\n    }\n    const info = await stat(link).catch(() => null);\n    if (info === null) {\n      skipped.set(relOf(link), \"a symlink that does not resolve\");\n      return;\n    }\n    // A link's own spelling is what the doc's author wrote, so that is the path\n    // that goes into the digest — the content comes from the target either way.\n    if (info.isFile()) found.set(relOf(link), link);\n    // A link that closes a loop is not reported: everything behind it is already\n    // in the digest under the spelling it was reached by, so nothing has stopped\n    // being watched. Only unhashed CONTENT is worth a warning.\n    else if (info.isDirectory()) await enterDir(link);\n    else skipped.set(relOf(link), \"a symlink to neither a file nor a directory\");\n  };\n\n  for (const source of sources) {\n    const cleaned = source.trim();\n    if (cleaned.length === 0) continue;\n    const root = resolveInside(repoDir, cleaned, `source '${source}'`);\n    const info = await stat(root).catch(() => null);\n    if (info === null) continue;\n    if (info.isFile()) found.set(relOf(root), root);\n    else if (info.isDirectory()) await enterDir(root);\n  }\n\n  // One git invocation for the whole expansion, not one per file: the skipped\n  // list rides along so an ignored symlink does not warn about a path the\n  // repository already says is not its own.\n  const ignored = await gitIgnoredPaths(repoDir, [...found.keys(), ...skipped.keys()]);\n  for (const rel of ignored) {\n    found.delete(rel);\n    skipped.delete(rel);\n  }\n\n  return {\n    // Plain codepoint order, not locale order: the digest has to be the same\n    // everywhere it is computed.\n    found: [...found.entries()]\n      .map(([rel, abs]) => ({ rel, abs }))\n      .sort((a, b) => (a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0)),\n    skipped: [...skipped.entries()]\n      .map(([path, reason]) => ({ path, reason }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  };\n}\n\n/** How long the digest waits on git before deciding it learned nothing. */\nconst GIT_TIMEOUT_MS = 10_000;\n\n/**\n * Which of these repo-relative paths the repository ignores, asked once for the\n * whole list. `git check-ignore` is the authority on purpose — it reads\n * `.gitignore` at every level, `.git/info/exclude` and the user's global\n * excludes, and it already knows that a TRACKED file is not ignored no matter\n * what a pattern says, which is the distinction a re-implementation always gets\n * wrong.\n *\n * Every failure answers \"nothing is ignored\": exit 1 is git saying so, exit 128\n * is \"not a git repository\", a spawn error is git not being installed, and a\n * timeout is a repository too strange to wait for. None of them justify\n * dropping a file from a digest a person is going to sign.\n */\nasync function gitIgnoredPaths(repoDir: string, rels: string[]): Promise<Set<string>> {\n  if (rels.length === 0) return new Set();\n  return new Promise<Set<string>>((done) => {\n    const child = spawn(\"git\", [\"check-ignore\", \"--stdin\", \"-z\"], {\n      cwd: repoDir,\n      stdio: [\"pipe\", \"pipe\", \"ignore\"],\n      timeout: GIT_TIMEOUT_MS,\n    });\n    let out = \"\";\n    child.stdout.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: string) => {\n      out += chunk;\n    });\n    child.on(\"error\", () => done(new Set()));\n    child.on(\"close\", (code) => {\n      // 0: some paths are ignored and are on stdout. 1: none are — an empty\n      // answer, not a failure. Anything else: we learned nothing.\n      done(code === 0 || code === 1 ? new Set(out.split(\"\\0\").filter((s) => s.length > 0)) : new Set());\n    });\n    // A git that died before reading its input hands us EPIPE; the close\n    // handler above is what decides the outcome either way.\n    child.stdin.on(\"error\", () => undefined);\n    child.stdin.end(rels.join(\"\\0\") + \"\\0\");\n  });\n}\n\n/* ------------------------------------------------------------------ */\n/* The per-file index: what `sources.stale` names                      */\n/* ------------------------------------------------------------------ */\n\n/**\n * How many files `sources_files` will list one by one before it gives up and\n * records only how many there were.\n *\n * A readability budget, not a correctness one: the index lives in the header of\n * a document a person reads, and a `sources: [src/]` over a legacy service can\n * expand to thousands of files. Past the limit `sources.stale` falls back to\n * repeating the `sources` entries — worse advice, but a spec.md whose\n * frontmatter is longer than its requirements is worse still.\n */\nconst SOURCE_INDEX_LIMIT = 100;\n\n/**\n * The `sources_files` value `loam vouch` stamps beside `sources_digest`: one\n * `<sha>  <path>` line per file (sha256sum's layout, and its column order, so\n * the path may contain spaces), or just the file count once the list would run\n * past SOURCE_INDEX_LIMIT.\n *\n * Its whole purpose is the next `sources.stale`. `sources_digest` can say THAT\n * the code moved and never which part of it; with the index a reader gets the\n * added, removed and changed paths, which is the difference between re-reading\n * one file and re-reading a directory. It is also a readable git diff in the\n * docs repo: the vouch commit shows exactly which source files the stamp now\n * stands over.\n */\nexport function encodeSourceIndex(index: SourceIndexEntry[]): string {\n  if (index.length > SOURCE_INDEX_LIMIT) return String(index.length);\n  return index.map((e) => `${e.sha}  ${e.path}`).join(\"\\n\");\n}\n\n/** What a stamped `sources_files` says: the per-file shas, the count, or nothing. */\ninterface StampedIndex {\n  /** path -> sha, or null when the stamp did not record them. */\n  entries: Map<string, string> | null;\n  /** How many files the stamp covered, when that is knowable. */\n  count?: number;\n}\n\n/**\n * Read back what `encodeSourceIndex` wrote. Anything unrecognised reads as \"the\n * stamp said nothing\" rather than as an empty index: a header nobody can parse\n * must not turn into a `sources.stale` claiming every file was deleted.\n */\nfunction decodeSourceIndex(stamped: string | undefined): StampedIndex {\n  if (stamped === undefined) return { entries: null };\n  const text = stamped.trim();\n  if (text.length === 0) return { entries: null };\n  if (/^\\d+$/.test(text)) return { entries: null, count: Number(text) };\n\n  const entries = new Map<string, string>();\n  for (const line of text.split(\"\\n\")) {\n    const match = /^([0-9a-f]{16})\\s+(.+)$/.exec(line.trim());\n    if (match === null) return { entries: null };\n    entries.set(match[2]!, match[1]!);\n  }\n  return { entries, count: entries.size };\n}\n\n/** The paths that moved between a stamp and now, with a phrase for the message. */\ninterface MovedSources {\n  /** Annotated paths, or undefined when the stamp did not record enough to say. */\n  paths?: string[];\n  /** Appended to the `sources.stale` message; empty when there is nothing to add. */\n  summary: string;\n}\n\n/**\n * added / removed / changed, from the stamped index against the current one.\n * The annotation travels IN the detail line rather than in three separate\n * lists: a reader scanning a stale report wants the paths in one column, and\n * \"which of the three\" is one word wide.\n */\nfunction movedSources(stamp: StampedIndex, now: SourceIndexEntry[]): MovedSources {\n  if (stamp.entries === null) {\n    // No index, but the count alone still beats silence: \"12 files then, 14\n    // now\" tells a reader to go looking for two new files.\n    return {\n      summary: stamp.count === undefined ? \"\" : ` (${stamp.count} file(s) then, ${now.length} now)`,\n    };\n  }\n  const paths: string[] = [];\n  const current = new Map(now.map((e) => [e.path, e.sha]));\n  for (const [path, sha] of current) {\n    const before = stamp.entries.get(path);\n    if (before === undefined) paths.push(`added    ${path}`);\n    else if (before !== sha) paths.push(`changed  ${path}`);\n  }\n  for (const path of stamp.entries.keys()) if (!current.has(path)) paths.push(`removed  ${path}`);\n  paths.sort();\n  // An index that agrees with the current tree while the digest does not is a\n  // contradiction (a truncation collision, or a hand-edited header). Say\n  // nothing rather than print an empty list under a staleness warning.\n  if (paths.length === 0) return { summary: \"\" };\n  return { paths, summary: ` (${paths.length} path(s) moved)` };\n}\n\n/** The characters that made an entry a pattern under the glob dialect loam no longer ships. */\nconst PATTERN_CHARS = /[*?[]/;\n\n/**\n * The `sources` entries that look like glob patterns — anything containing\n * `*`, `?` or `[`. Patterns are refused loudly everywhere sources are consumed\n * (`loam vouch` refuses the run, `loam validate` grades an error), never\n * resolved: the glob dialect loam used to ship silently differed from the\n * gitignore/minimatch conventions authors assume — bracket classes literal,\n * its own `**` handling — so a pattern quietly digested a different file set\n * than intended, corrupting the staleness signal in both directions. A\n * directory already means \"everything beneath it\", so the fix is to name one.\n *\n * The cost accepted with the rule: a real file with `[` in its name (a Next.js\n * route, say) cannot be listed on its own — its parent directory covers it.\n */\nexport function patternSources(sources: string[]): string[] {\n  return sources.filter((s) => PATTERN_CHARS.test(s.trim()));\n}\n\n/** The `sources` entries that resolve to nothing in this repo. */\nexport function missingSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((s) => !sourceExists(repoDir, s));\n}\n\n/** Entries that are absolute, traverse upward, or escape through a symlink. */\nexport function unsafeSources(repoDir: string, sources: string[]): string[] {\n  return sources.filter((source) => {\n    const cleaned = source.trim();\n    if (cleaned.length === 0) return false;\n    try {\n      resolveInside(repoDir, cleaned, `source '${source}'`);\n      return false;\n    } catch {\n      return true;\n    }\n  });\n}\n\n/** Does a `sources` entry point at something real? Literal paths only, checked exactly. */\nfunction sourceExists(repoDir: string, source: string): boolean {\n  const cleaned = source.trim();\n  if (cleaned.length === 0) return false;\n  try {\n    return existsSync(resolveInside(repoDir, cleaned, `source '${source}'`));\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/core/records.js

@@ -0,0 +1,33 @@
+/**
+ * The shapes an unknown parsed document is asked about, in one place.
+ *
+ * Every YAML and JSON file loam reads arrives as `unknown`, and every reader
+ * has to answer the same first question before it can look at a key: is this an
+ * object at all? Six modules each carried their own copy of the answer, two of
+ * them spelled with a cast — and a cast is exactly what this test exists to
+ * make unnecessary, since the predicate form hands the caller a narrowed type
+ * that tsc keeps checking. A leaf with no imports, so any layer can ask.
+ */
+/** An object with string keys — not null, and not an array. */
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The same question where the answer is used rather than branched on. */
+export function asRecord(value) {
+    return isRecord(value) ? value : null;
+}
+/**
+ * A map whose keys come from a document somebody else wrote.
+ *
+ * `Object.create(null)` rather than `{}` because a key read out of untrusted
+ * YAML can be `__proto__` or `constructor`, and on a normal object those either
+ * mutate the prototype or read back a function that was never in the file.
+ */
+export function dictionary() {
+    return Object.create(null);
+}
+/** The value a record actually holds for `key`, never one it inherited. */
+export function ownValue(record, key) {
+    return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;
+}
+//# sourceMappingURL=records.js.map

package/dist/core/records.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"records.js","sourceRoot":"","sources":["../../src/core/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,+DAA+D;AAC/D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAsB,CAAC;AAClD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAI,MAAyB,EAAE,GAAW;IAChE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC","sourcesContent":["/**\n * The shapes an unknown parsed document is asked about, in one place.\n *\n * Every YAML and JSON file loam reads arrives as `unknown`, and every reader\n * has to answer the same first question before it can look at a key: is this an\n * object at all? Six modules each carried their own copy of the answer, two of\n * them spelled with a cast — and a cast is exactly what this test exists to\n * make unnecessary, since the predicate form hands the caller a narrowed type\n * that tsc keeps checking. A leaf with no imports, so any layer can ask.\n */\n\n/** An object with string keys — not null, and not an array. */\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** The same question where the answer is used rather than branched on. */\nexport function asRecord(value: unknown): Record<string, unknown> | null {\n  return isRecord(value) ? value : null;\n}\n\n/**\n * A map whose keys come from a document somebody else wrote.\n *\n * `Object.create(null)` rather than `{}` because a key read out of untrusted\n * YAML can be `__proto__` or `constructor`, and on a normal object those either\n * mutate the prototype or read back a function that was never in the file.\n */\nexport function dictionary<T>(): Record<string, T> {\n  return Object.create(null) as Record<string, T>;\n}\n\n/** The value a record actually holds for `key`, never one it inherited. */\nexport function ownValue<T>(record: Record<string, T>, key: string): T | undefined {\n  return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : undefined;\n}\n"]}

package/dist/core/repo.js

@@ -42,6 +42,43 @@ export function compareIds(a, b) {
 function tokenize(s) {
     return (s.match(/\d+|\D+/g) ?? []).map((t) => (/^\d/.test(t) ? Number(t) : t));
 }
+/**
+ * Known ids within a small edit distance of `id`, closest first, at most three.
+ *
+ * The did-you-mean hint for a name somebody typed: `loam new --touches` and
+ * `loam delta <svc>` answer the same mistake, and each carried its own copy of
+ * these twenty-four lines. It belongs here because the ids being scored are
+ * this module's ids — service directory names, feature ids — and because
+ * `compareIds` right above is the tiebreak that keeps the list deterministic
+ * when two candidates score equally. Not in `core/ids.ts`: `compareIds` lives
+ * here and repo.ts imports ids.js, so putting it there would close a cycle.
+ *
+ * `arch.ts`'s `closeIds` looks similar and is not: substring and prefix, capped
+ * at five, answering "which element could this be" rather than "did you
+ * misspell a directory". Two rules, two homes.
+ */
+export function nearestIds(id, known) {
+    const budget = Math.max(1, Math.floor(id.length / 4));
+    return known
+        .map((candidate) => ({ candidate, distance: editDistance(id.toLowerCase(), candidate.toLowerCase()) }))
+        .filter((scored) => scored.distance <= budget)
+        .sort((a, b) => a.distance - b.distance || compareIds(a.candidate, b.candidate))
+        .slice(0, 3)
+        .map((scored) => scored.candidate);
+}
+/** Plain Levenshtein — ids are short, and the row-at-a-time form keeps it obvious. */
+function editDistance(a, b) {
+    let previous = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i += 1) {
+        const current = [i];
+        for (let j = 1; j <= b.length; j += 1) {
+            const substitution = previous[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1);
+            current.push(Math.min(previous[j] + 1, current[j - 1] + 1, substitution));
+        }
+        previous = current;
+    }
+    return previous[b.length];
+}
 /**
  * Feature id from a directory name: everything up to and including the first
  * number run (`FEAT-101-payment-splitting` -> `FEAT-101`). A name with no
@@ -100,6 +137,35 @@ export function landscapePath(docsDir) {
 export function featuresDir(docsDir) {
     return join(docsDir, "features");
 }
+/**
+ * The agent contract's filename, and where it sits in a docs repo.
+ *
+ * Both spellings are exported because the two questions are different: `init`,
+ * `doctor` and `validate` want a path under a docsDir they already hold, while
+ * `docs.ts` builds the scaffold as `[relative path, bytes]` pairs and needs the
+ * bare name. Four modules spelled the literal out for themselves, and one of
+ * them — `init` — uses it to decide whether a directory IS a docs repo at all,
+ * so a rename that reached three of the four would leave `init` recognising a
+ * file nothing else writes any more.
+ *
+ * `openspec-inventory.ts`'s "AGENTS.md" is deliberately NOT this constant: it
+ * names a file in a foreign OpenSpec tree that happens to share the name.
+ */
+export const AGENTS_FILENAME = "AGENTS.md";
+export function agentsPath(docsDir) {
+    return join(docsDir, AGENTS_FILENAME);
+}
+/**
+ * Where shipped features live. `features/archive/` is spelled here and nowhere
+ * else for the same reason every other artifact path is: `archive` and
+ * `unarchive` move directories in and out of it, and a layout string that two
+ * commands re-derive is a layout two commands can disagree about. The
+ * `features/archive/…` strings in refusal PROSE are not this path — they are
+ * what a reader types into `ls`, and they stay spelled out.
+ */
+export function archiveDir(docsDir) {
+    return join(featuresDir(docsDir), ARCHIVE_DIR);
+}
 export function docsRepoState(docsDir) {
     const path = docsDir;
     let isDir = false;
@@ -193,7 +259,15 @@ async function subdirs(dir) {
         .map((e) => e.name)
         .sort(compareIds);
 }
-async function countMarkdown(dir) {
+/**
+ * Markdown files sitting directly in `dir` — the ADR count, and the only place
+ * that rule is spelled. Exported because `show` kept a second copy that tested
+ * `Dirent.isFile()` itself: always false for a symlink, whatever it points at,
+ * so a docs repo composed of symlinks (the layout `entryIs` above exists to
+ * support) had `loam list` and `loam show` reporting different ADR counts for
+ * the same service. One rule, one answer.
+ */
+export async function countMarkdown(dir) {
     if (!existsSync(dir))
         return 0;
     const entries = await readdir(dir, { withFileTypes: true });