arc-1 0.9.5 → 0.9.7

package/dist/adt/package-hierarchy.js

@@ -0,0 +1,100 @@
+/**
+ * DEVCLASS hierarchy resolver for `allowedPackages` subtree rules (`ZFOO/**`).
+ *
+ * Pattern semantics:
+ *   - `ZFOO/**` means "package `ZFOO` and every transitive sub-package whose
+ *     DEVCLASS chain leads back to `ZFOO`".
+ *   - SAP stores the relationship in `TDEVC.PARENTCL`. ADT exposes direct
+ *     children via `POST /sap/bc/adt/repository/nodestructure`
+ *     (`AdtClient.getSubpackages`).
+ *
+ * Security invariants:
+ *   - Resolution failure (network, permission, missing root) is fail-closed:
+ *     the resolver throws and the caller (checkPackage) MUST treat the throw as
+ *     "package denied". Never silently allow.
+ *   - The cache is keyed by uppercased root; lookups are case-insensitive.
+ *   - A rejected resolution purges its cache entry so a retry can succeed,
+ *     but the current request still fails. This avoids cementing a transient
+ *     failure for the full TTL.
+ *
+ * Cache lifetime:
+ *   - Default 10 minutes (see `DEFAULT_TTL_MS`); overridable per-instance via
+ *     `AdtPackageHierarchyResolverOptions.ttlMs`. The cache can be invalidated
+ *     manually via `invalidate(root?)` after admin actions that change the
+ *     hierarchy (create_package / change_package / delete_package).
+ */
+import { AdtSafetyError } from './errors.js';
+const DEFAULT_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_MAX_PACKAGES = 10_000;
+const DEFAULT_MAX_DEPTH = 50;
+export class AdtPackageHierarchyResolver {
+    fetcher;
+    ttlMs;
+    maxPackages;
+    maxDepth;
+    cache = new Map();
+    constructor(fetcher, opts = {}) {
+        this.fetcher = fetcher;
+        this.ttlMs = opts.ttlMs ?? DEFAULT_TTL_MS;
+        this.maxPackages = opts.maxPackages ?? DEFAULT_MAX_PACKAGES;
+        this.maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
+    }
+    async isDescendantOrSelf(root, pkg) {
+        const upperRoot = root.toUpperCase();
+        const upperPkg = pkg.toUpperCase();
+        if (upperRoot === upperPkg)
+            return true;
+        const subtree = await this.getSubtree(upperRoot);
+        return subtree.has(upperPkg);
+    }
+    invalidate(root) {
+        if (root === undefined) {
+            this.cache.clear();
+            return;
+        }
+        this.cache.delete(root.toUpperCase());
+    }
+    getSubtree(upperRoot) {
+        const now = Date.now();
+        const cached = this.cache.get(upperRoot);
+        if (cached && cached.expires > now)
+            return cached.subtree;
+        const subtree = this.computeSubtree(upperRoot).catch((err) => {
+            // Fail-closed: purge so a retry can succeed; rethrow as AdtSafetyError
+            // so callers see a stable error type at the safety boundary.
+            this.cache.delete(upperRoot);
+            const msg = err instanceof Error ? err.message : String(err);
+            throw new AdtSafetyError(`Failed to resolve DEVCLASS subtree under '${upperRoot}' for allowedPackages rule (denying for safety): ${msg}`);
+        });
+        this.cache.set(upperRoot, { expires: now + this.ttlMs, subtree });
+        return subtree;
+    }
+    async computeSubtree(upperRoot) {
+        const result = new Set([upperRoot]);
+        let frontier = [upperRoot];
+        let depth = 0;
+        while (frontier.length > 0) {
+            if (depth >= this.maxDepth) {
+                throw new Error(`DEVCLASS hierarchy under '${upperRoot}' exceeds maxDepth=${this.maxDepth} (possible cycle in TDEVC.PARENTCL)`);
+            }
+            const nextFrontier = [];
+            for (const cur of frontier) {
+                const children = await this.fetcher(cur);
+                for (const child of children) {
+                    const upper = child.toUpperCase();
+                    if (result.has(upper))
+                        continue;
+                    result.add(upper);
+                    if (result.size > this.maxPackages) {
+                        throw new Error(`DEVCLASS subtree under '${upperRoot}' exceeds maxPackages=${this.maxPackages}; refusing for safety`);
+                    }
+                    nextFrontier.push(upper);
+                }
+            }
+            frontier = nextFrontier;
+            depth++;
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=package-hierarchy.js.map

package/dist/adt/package-hierarchy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-hierarchy.js","sourceRoot":"","sources":["../../src/adt/package-hierarchy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAwC7C,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,OAAO,2BAA2B;IACrB,OAAO,CAA0B;IACjC,KAAK,CAAS;IACd,WAAW,CAAS;IACpB,QAAQ,CAAS;IACjB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,YAAY,OAAgC,EAAE,OAA2C,EAAE;QACzF,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,IAAY,EAAE,GAAW;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,IAAa;QACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,GAAG,GAAG;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAE1D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACpE,uEAAuE;YACvE,6DAA6D;YAC7D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,MAAM,IAAI,cAAc,CACtB,6CAA6C,SAAS,oDAAoD,GAAG,EAAE,CAChH,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,SAAiB;QAC5C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,IAAI,QAAQ,GAAa,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,sBAAsB,IAAI,CAAC,QAAQ,qCAAqC,CAC/G,CAAC;YACJ,CAAC;YACD,MAAM,YAAY,GAAa,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;oBAClC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,SAAS;oBAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAClB,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CACb,2BAA2B,SAAS,yBAAyB,IAAI,CAAC,WAAW,uBAAuB,CACrG,CAAC;oBACJ,CAAC;oBACD,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,YAAY,CAAC;YACxB,KAAK,EAAE,CAAC;QACV,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/adt/release.d.ts

@@ -0,0 +1,35 @@
+/**
+ * SAP_BASIS release parsing helpers.
+ *
+ * Kept dependency-free (no imports) so it can be used from low-level modules
+ * such as `errors.ts` without risking an import cycle through `features.ts`.
+ *
+ * SAP_BASIS release strings reported by `/sap/bc/adt/system/components` are
+ * dotless three-digit codes: "700", "740", "750", "757", "758". Releases below
+ * 751 lack native honoring of the `X-sap-adt-sessiontype: stateful` header over
+ * HTTP (the 7.51+ `CONFIGURE_SESSION_STATE` of `CL_ADT_WB_RES_APP` does not
+ * exist), so ADT writes fail with `423 invalid lock handle` unless the
+ * `abapfs_extensions` enhancement is installed. See issue #293.
+ */
+/** The release at and above which ADT honors stateful HTTP sessions natively. */
+export declare const STATEFUL_SESSION_MIN_RELEASE = 751;
+/**
+ * Parse a SAP_BASIS release string into a comparable integer.
+ *
+ * Strips any non-digit characters first, so both dotless ("750") and dotted
+ * ("7.50") forms map to the same number (750). Returns `undefined` when the
+ * input is empty/undefined or contains no digits.
+ */
+export declare function parseReleaseNumber(release?: string): number | undefined;
+/**
+ * True when the detected release is known to be below the stateful-session
+ * threshold (i.e. ADT HTTP writes need the abapfs_extensions enhancement).
+ * Returns false when the release is unknown — never cry wolf on missing data.
+ */
+export declare function isPreStatefulRelease(abapRelease?: string): boolean;
+/**
+ * Decide whether to emit the startup warning about pre-7.51 write support:
+ * only when writes are enabled AND the detected release is known to be < 7.51.
+ */
+export declare function shouldWarnPreStatefulRelease(allowWrites: boolean, abapRelease?: string): boolean;
+//# sourceMappingURL=release.d.ts.map

package/dist/adt/release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../src/adt/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMvE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAGlE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAEhG"}

package/dist/adt/release.js

@@ -0,0 +1,48 @@
+/**
+ * SAP_BASIS release parsing helpers.
+ *
+ * Kept dependency-free (no imports) so it can be used from low-level modules
+ * such as `errors.ts` without risking an import cycle through `features.ts`.
+ *
+ * SAP_BASIS release strings reported by `/sap/bc/adt/system/components` are
+ * dotless three-digit codes: "700", "740", "750", "757", "758". Releases below
+ * 751 lack native honoring of the `X-sap-adt-sessiontype: stateful` header over
+ * HTTP (the 7.51+ `CONFIGURE_SESSION_STATE` of `CL_ADT_WB_RES_APP` does not
+ * exist), so ADT writes fail with `423 invalid lock handle` unless the
+ * `abapfs_extensions` enhancement is installed. See issue #293.
+ */
+/** The release at and above which ADT honors stateful HTTP sessions natively. */
+export const STATEFUL_SESSION_MIN_RELEASE = 751;
+/**
+ * Parse a SAP_BASIS release string into a comparable integer.
+ *
+ * Strips any non-digit characters first, so both dotless ("750") and dotted
+ * ("7.50") forms map to the same number (750). Returns `undefined` when the
+ * input is empty/undefined or contains no digits.
+ */
+export function parseReleaseNumber(release) {
+    if (!release)
+        return undefined;
+    const digits = release.replace(/\D/g, '');
+    if (digits.length === 0)
+        return undefined;
+    const num = Number.parseInt(digits, 10);
+    return Number.isNaN(num) ? undefined : num;
+}
+/**
+ * True when the detected release is known to be below the stateful-session
+ * threshold (i.e. ADT HTTP writes need the abapfs_extensions enhancement).
+ * Returns false when the release is unknown — never cry wolf on missing data.
+ */
+export function isPreStatefulRelease(abapRelease) {
+    const num = parseReleaseNumber(abapRelease);
+    return num !== undefined && num < STATEFUL_SESSION_MIN_RELEASE;
+}
+/**
+ * Decide whether to emit the startup warning about pre-7.51 write support:
+ * only when writes are enabled AND the detected release is known to be < 7.51.
+ */
+export function shouldWarnPreStatefulRelease(allowWrites, abapRelease) {
+    return allowWrites === true && isPreStatefulRelease(abapRelease);
+}
+//# sourceMappingURL=release.js.map

package/dist/adt/release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../../src/adt/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAoB;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC5C,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,4BAA4B,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAoB,EAAE,WAAoB;IACrF,OAAO,WAAW,KAAK,IAAI,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC"}

package/dist/adt/safety.d.ts

@@ -19,6 +19,9 @@
  * `SAP_DISALLOWED_OPS` were removed in v0.7. Admins configure via the `allow*`
  * flags and `SAP_DENY_ACTIONS`.
  */
+import type { PackageHierarchyResolver } from './package-hierarchy.js';
+/** Suffix that marks an `allowedPackages` entry as "this package + DEVCLASS subtree". */
+export declare const SUBTREE_SUFFIX = "/**";
 /**
  * Operation type codes (internal classification).
  * NOT admin-facing — the code just uses these as a compact categorical label.
@@ -62,10 +65,43 @@ export declare function unrestrictedSafetyConfig(): SafetyConfig;
 export declare function isOperationAllowed(config: SafetyConfig, op: OperationTypeCode): boolean;
 /** Check operation and throw AdtSafetyError if blocked. */
 export declare function checkOperation(config: SafetyConfig, op: OperationTypeCode, opName: string): void;
-/** Check if operations on a given package are allowed (write-only check). */
+/**
+ * Static (synchronous) outcome of evaluating `allowedPackages` against `pkg`.
+ *   - 'allowed': the package matches an exact / prefix-wildcard / subtree-root rule.
+ *   - 'denied': no rule matches and no subtree rule could possibly match.
+ *   - 'needs-hierarchy': at least one `X/**` rule exists where `pkg !== X`; the
+ *     decision requires DEVCLASS hierarchy resolution. The caller MUST resolve
+ *     via `checkPackage(..., resolver)` (async) — falling back to
+ *     `isPackageAllowed`'s boolean form will treat it as DENIED (fail-closed).
+ */
+export type PackageAllowDecision = 'allowed' | 'denied' | 'needs-hierarchy';
+/**
+ * Evaluate the static portion of `allowedPackages`.
+ *
+ * Subtree (`X/**`) rules can only be statically resolved when the package
+ * equals the subtree root. Any other case requires hierarchy resolution and
+ * is reported as 'needs-hierarchy'.
+ */
+export declare function decidePackageAllowed(config: SafetyConfig, pkg: string): PackageAllowDecision;
+/**
+ * Synchronous, fail-closed view of `allowedPackages`. Subtree rules that need
+ * hierarchy resolution return `false` here — callers wanting the precise answer
+ * must use `checkPackage(..., resolver)` (async).
+ *
+ * Kept exported because non-write code paths (effective-policy logging,
+ * CLI display) rely on a quick synchronous check.
+ */
 export declare function isPackageAllowed(config: SafetyConfig, pkg: string): boolean;
-/** Check package and throw AdtSafetyError if blocked. */
-export declare function checkPackage(config: SafetyConfig, pkg: string): void;
+/**
+ * Check package and throw AdtSafetyError if blocked.
+ *
+ * If `allowedPackages` contains subtree (`X/**`) rules, a `resolver` is
+ * required to evaluate them. Any resolver failure is treated as DENY
+ * (fail-closed); the original failure is included in the thrown message.
+ *
+ * Reads are never package-gated; this function is only called on write paths.
+ */
+export declare function checkPackage(config: SafetyConfig, pkg: string, resolver?: PackageHierarchyResolver | null): Promise<void>;
 /**
  * Check transport operation. Writes require `allowWrites && allowTransportWrites`.
  * Reads are always allowed at this layer (scope check enforces user gating upstream).

package/dist/adt/safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/adt/safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;CAchB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAcnF,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,YAAY,CAWlD;AAED,0CAA0C;AAC1C,wBAAgB,wBAAwB,IAAI,YAAY,CAWvD;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAgBvF;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMhG;AAYD,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB3E;AAED,yDAAyD;AACzD,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAMpE;AAqBD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAsB9G;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,UAAO,GAAG,IAAI,CAYtF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CA6B3F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,GACnC,YAAY,CAuCd;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAY3D"}
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../src/adt/safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEvE,yFAAyF;AACzF,eAAO,MAAM,cAAc,QAAQ,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;CAchB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAcnF,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,YAAY,CAWlD;AAED,0CAA0C;AAC1C,wBAAgB,wBAAwB,IAAI,YAAY,CAWvD;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAgBvF;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMhG;AAYD;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,CAAC;AAE5E;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,CA6B5F;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE3E;AAeD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,wBAAwB,GAAG,IAAI,GACzC,OAAO,CAAC,IAAI,CAAC,CA2Cf;AAqBD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAsB9G;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,UAAO,GAAG,IAAI,CAYtF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CA6B3F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,YAAY,EAC1B,aAAa,EAAE,OAAO,CAAC,YAAY,CAAC,GACnC,YAAY,CA2Ed;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAY3D"}

package/dist/adt/safety.js

@@ -20,6 +20,8 @@
  * flags and `SAP_DENY_ACTIONS`.
  */
 import { AdtSafetyError } from './errors.js';
+/** Suffix that marks an `allowedPackages` entry as "this package + DEVCLASS subtree". */
+export const SUBTREE_SUFFIX = '/**';
 /**
  * Operation type codes (internal classification).
  * NOT admin-facing — the code just uses these as a compact categorical label.
@@ -114,32 +116,114 @@ function explainOperationBlock(config, op) {
         return 'reason: allowFreeSQL=false';
     return 'reason: unknown';
 }
-/** Check if operations on a given package are allowed (write-only check). */
-export function isPackageAllowed(config, pkg) {
+/**
+ * Evaluate the static portion of `allowedPackages`.
+ *
+ * Subtree (`X/**`) rules can only be statically resolved when the package
+ * equals the subtree root. Any other case requires hierarchy resolution and
+ * is reported as 'needs-hierarchy'.
+ */
+export function decidePackageAllowed(config, pkg) {
     if (listDeniesAll(config.allowedPackages))
-        return false;
+        return 'denied';
     if (config.allowedPackages.length === 0)
-        return true;
+        return 'allowed';
     const upperPkg = pkg.toUpperCase();
+    let hasSubtreeRule = false;
     for (const allowed of config.allowedPackages) {
         const upperAllowed = allowed.toUpperCase();
-        // Exact match
         if (upperAllowed === upperPkg)
-            return true;
-        // Wildcard match: "Z*" matches "ZTEST", "ZRAY", etc.
+            return 'allowed';
+        if (upperAllowed.endsWith(SUBTREE_SUFFIX)) {
+            const root = upperAllowed.slice(0, -SUBTREE_SUFFIX.length);
+            // Empty root (`/**` alone, or `**` missed the leading slash) is a misconfig — ignore.
+            if (root.length === 0)
+                continue;
+            if (root === upperPkg)
+                return 'allowed';
+            hasSubtreeRule = true;
+            continue;
+        }
+        // Prefix wildcard: "Z*" matches "ZTEST", "ZRAY", etc.
         if (upperAllowed.endsWith('*')) {
             const prefix = upperAllowed.slice(0, -1);
             if (upperPkg.startsWith(prefix))
-                return true;
+                return 'allowed';
         }
     }
-    return false;
+    return hasSubtreeRule ? 'needs-hierarchy' : 'denied';
+}
+/**
+ * Synchronous, fail-closed view of `allowedPackages`. Subtree rules that need
+ * hierarchy resolution return `false` here — callers wanting the precise answer
+ * must use `checkPackage(..., resolver)` (async).
+ *
+ * Kept exported because non-write code paths (effective-policy logging,
+ * CLI display) rely on a quick synchronous check.
+ */
+export function isPackageAllowed(config, pkg) {
+    return decidePackageAllowed(config, pkg) === 'allowed';
+}
+/** Extract the subtree roots from `allowedPackages` (uppercased, empty roots dropped). */
+function extractSubtreeRoots(config) {
+    const roots = [];
+    for (const allowed of config.allowedPackages) {
+        const upper = allowed.toUpperCase();
+        if (!upper.endsWith(SUBTREE_SUFFIX))
+            continue;
+        const root = upper.slice(0, -SUBTREE_SUFFIX.length);
+        if (root.length === 0)
+            continue;
+        roots.push(root);
+    }
+    return roots;
 }
-/** Check package and throw AdtSafetyError if blocked. */
-export function checkPackage(config, pkg) {
-    if (!isPackageAllowed(config, pkg)) {
+/**
+ * Check package and throw AdtSafetyError if blocked.
+ *
+ * If `allowedPackages` contains subtree (`X/**`) rules, a `resolver` is
+ * required to evaluate them. Any resolver failure is treated as DENY
+ * (fail-closed); the original failure is included in the thrown message.
+ *
+ * Reads are never package-gated; this function is only called on write paths.
+ */
+export async function checkPackage(config, pkg, resolver) {
+    const decision = decidePackageAllowed(config, pkg);
+    if (decision === 'allowed')
+        return;
+    if (decision === 'denied') {
         throw new AdtSafetyError(`Operations on package '${pkg}' are blocked by safety configuration (allowed: ${displayAllowList(config.allowedPackages)})`);
     }
+    // 'needs-hierarchy' — every subtree rule must be tried.
+    if (!resolver) {
+        throw new AdtSafetyError(`Operations on package '${pkg}' need DEVCLASS hierarchy resolution for a subtree allowedPackages rule, ` +
+            `but no resolver was passed to checkPackage (allowed: ${displayAllowList(config.allowedPackages)}). ` +
+            `This is an internal wiring bug — please file an issue.`);
+    }
+    const roots = extractSubtreeRoots(config);
+    const errors = [];
+    let matched = false;
+    // Evaluate every subtree root before deciding. Fail-closed invariant:
+    // ANY resolver error denies, even if a later root returns true. The docstring
+    // promises this; collecting then deciding (rather than short-circuiting on
+    // first match) ensures errors from earlier roots are not masked by a later
+    // success.
+    for (const root of roots) {
+        try {
+            if (await resolver.isDescendantOrSelf(root, pkg)) {
+                matched = true;
+            }
+        }
+        catch (err) {
+            errors.push(`${root}${SUBTREE_SUFFIX}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (errors.length > 0) {
+        throw new AdtSafetyError(`Operations on package '${pkg}' blocked: DEVCLASS hierarchy resolution failed (${errors.join('; ')})`);
+    }
+    if (matched)
+        return;
+    throw new AdtSafetyError(`Operations on package '${pkg}' are blocked by safety configuration (allowed: ${displayAllowList(config.allowedPackages)})`);
 }
 /** Check if a transport is in the whitelist. */
 function isTransportInWhitelist(config, transport) {
@@ -264,15 +348,52 @@ export function deriveUserSafetyFromProfile(serverConfig, profileSafety) {
         // Profile narrows server: keep profile entries that are covered by server.
         // "Covered by" means: there exists a server entry equal to the profile entry, or a
         // server wildcard that matches it.
+        //
+        // Subtree patterns ("ZFOO/**") need special handling — we cannot resolve the
+        // DEVCLASS hierarchy at config-load time without a live SAP session, so the
+        // static "covers" decision is intentionally conservative:
+        //   - server "ZFOO/**" covers profile "ZFOO"          (root is statically known)
+        //   - server "ZFOO/**" covers profile "ZFOO/**"       (identical — handled by s===p)
+        //   - server "ZFOO/**" covers profile "ZSUB"          → NO (descendant cannot be
+        //                                                      statically proven)
+        //   - server "Z*"      covers profile "ZFOO/**"       → NO (server prefix may not
+        //                                                      reach non-Z descendants of ZFOO;
+        //                                                      profile's intended scope would
+        //                                                      leak past the server ceiling)
+        //   - server "*"       covers anything (already true via s.endsWith('*') logic below)
+        //
+        // The runtime check (checkPackage) re-validates against the resolved hierarchy
+        // for any entry that survives intersection, so this layer is purely structural.
         const covers = (serverPat, profilePat) => {
             const s = serverPat.toUpperCase();
             const p = profilePat.toUpperCase();
             if (s === p)
                 return true;
+            // Server unrestricted wildcard '*' covers everything.
+            if (s === '*')
+                return true;
+            // Profile subtree narrows to an unknown-at-config-time set. Only covered by
+            // identical server subtree (handled above) or '*' (handled above) — never by a
+            // server prefix wildcard, because the subtree may contain names that don't
+            // share the prefix.
+            if (p.endsWith(SUBTREE_SUFFIX))
+                return false;
+            // Server subtree: only the literal root is statically proven covered.
+            if (s.endsWith(SUBTREE_SUFFIX)) {
+                const serverRoot = s.slice(0, -SUBTREE_SUFFIX.length);
+                return p === serverRoot;
+            }
+            // Server prefix wildcard.
             if (s.endsWith('*')) {
-                const prefix = s.slice(0, -1);
-                if (p.startsWith(prefix))
-                    return true;
+                const serverPrefix = s.slice(0, -1);
+                if (p.endsWith('*')) {
+                    // Profile prefix is narrower than server prefix iff profile's literal prefix
+                    // starts with the server's. E.g. server "Z*" covers profile "ZF*".
+                    const profilePrefix = p.slice(0, -1);
+                    return profilePrefix.startsWith(serverPrefix);
+                }
+                // Profile is exact: "ZF" is covered by "Z*".
+                return p.startsWith(serverPrefix);
             }
             return false;
         };

package/dist/adt/safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/adt/safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,GAAG;CACN,CAAC;AAIX,mEAAmE;AACnE,MAAM,YAAY,GAAG,QAAQ,CAAC;AAC9B,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,oBAAoB,EAAE,KAAK;QAC3B,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE,CAAC,MAAM,CAAC;QACzB,iBAAiB,EAAE,EAAE;QACrB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,oBAAoB,EAAE,IAAI;QAC1B,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,EAAE;QACnB,iBAAiB,EAAE,EAAE;QACrB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,EAAqB;IAC5E,sFAAsF;IACtF,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAEnE,4CAA4C;IAC5C,IAAI,EAAE,KAAK,aAAa,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAEjF,gBAAgB;IAChB,IAAI,EAAE,KAAK,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAEzE,WAAW;IACX,IAAI,EAAE,KAAK,aAAa,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEvE,uFAAuF;IACvF,6EAA6E;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,EAAqB,EAAE,MAAc;IACxF,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,cAAc,CACtB,cAAc,MAAM,WAAW,EAAE,yCAAyC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,qBAAqB,CAAC,MAAoB,EAAE,EAAqB;IACxE,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;QAClD,OAAO,0DAA0D,CAAC;IACpE,IAAI,EAAE,KAAK,aAAa,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,oBAAoB;QAAE,OAAO,oCAAoC,CAAC;IAChH,IAAI,EAAE,KAAK,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,gCAAgC,CAAC;IACpG,IAAI,EAAE,KAAK,aAAa,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,4BAA4B,CAAC;IAC9F,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,GAAW;IAChE,IAAI,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEnC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3C,cAAc;QACd,IAAI,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3C,qDAAqD;QACrD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,GAAW;IAC5D,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,cAAc,CACtB,0BAA0B,GAAG,mDAAmD,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAC5H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gDAAgD;AAChD,SAAS,sBAAsB,CAAC,MAAoB,EAAE,SAAiB;IACrE,IAAI,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAE/C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,YAAY,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,SAAiB,EAAE,MAAc,EAAE,OAAgB;IACtG,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,oBAAoB,MAAM,8EAA8E,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,cAAc,CACtB,oBAAoB,MAAM,8GAA8G,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,cAAc,CACtB,cAAc,MAAM,mBAAmB,SAAS,kDAAkD,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAoB,EAAE,SAAiB,EAAE,OAAO,GAAG,IAAI;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACtB,cAAc,SAAS,8EAA8E,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,cAAc,SAAS,4FAA4F,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAA0B,EAAE,MAAgB;IAC3E,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,SAAS,GAAiB;QAC9B,GAAG,YAAY;QACf,eAAe,EAAE,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC;QAClD,iBAAiB,EAAE,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC;QACtD,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,WAAW,CAAC;KAC3C,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,SAAS,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,cAAc,GAAG,KAAK,CAAC;IAE3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAA0B,EAC1B,aAAoC;IAEpC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,CAAsB,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5F,MAAM,aAAa,GAAG,CAAC,MAAgB,EAAE,OAA6B,EAAY,EAAE;QAClF,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,mFAAmF;QACnF,mCAAmC;QACnC,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,UAAkB,EAAW,EAAE;YAChE,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;YACxC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,gFAAgF;QAChF,4EAA4E;QAC5E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,SAAS,GAAiB;QAC9B,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC;QACrE,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC;QACpF,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,YAAY,CAAC;QACxE,oBAAoB,EAAE,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,CAAC;QAChG,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC,cAAc,CAAC;QAC9E,eAAe,EAAE,aAAa,CAAC,YAAY,CAAC,eAAe,EAAE,aAAa,CAAC,eAAe,CAAC;QAC3F,iBAAiB,EAAE,aAAa,CAAC,YAAY,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;QACjG,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;KAC/F,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,oBAAoB;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC1G,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"safety.js","sourceRoot":"","sources":["../../src/adt/safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC;AAEpC;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,KAAK,EAAE,GAAG;IACV,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,YAAY,EAAE,GAAG;IACjB,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,GAAG;CACN,CAAC;AAIX,mEAAmE;AACnE,MAAM,YAAY,GAAG,QAAQ,CAAC;AAC9B,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEhD,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5D,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,oBAAoB,EAAE,KAAK;QAC3B,cAAc,EAAE,KAAK;QACrB,eAAe,EAAE,CAAC,MAAM,CAAC;QACzB,iBAAiB,EAAE,EAAE;QACrB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,IAAI;QAClB,oBAAoB,EAAE,IAAI;QAC1B,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,EAAE;QACnB,iBAAiB,EAAE,EAAE;QACrB,WAAW,EAAE,EAAE;KAChB,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,EAAqB;IAC5E,sFAAsF;IACtF,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAEnE,4CAA4C;IAC5C,IAAI,EAAE,KAAK,aAAa,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAEjF,gBAAgB;IAChB,IAAI,EAAE,KAAK,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAEzE,WAAW;IACX,IAAI,EAAE,KAAK,aAAa,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEvE,uFAAuF;IACvF,6EAA6E;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,EAAqB,EAAE,MAAc;IACxF,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,cAAc,CACtB,cAAc,MAAM,WAAW,EAAE,yCAAyC,qBAAqB,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAC/G,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,qBAAqB,CAAC,MAAoB,EAAE,EAAqB;IACxE,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW;QAClD,OAAO,0DAA0D,CAAC;IACpE,IAAI,EAAE,KAAK,aAAa,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,oBAAoB;QAAE,OAAO,oCAAoC,CAAC;IAChH,IAAI,EAAE,KAAK,aAAa,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,gCAAgC,CAAC;IACpG,IAAI,EAAE,KAAK,aAAa,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,4BAA4B,CAAC;IAC9F,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAE,GAAW;IACpE,IAAI,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3D,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3C,IAAI,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhD,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3D,sFAAsF;YACtF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAChC,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACxC,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QAED,sDAAsD;QACtD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB,EAAE,GAAW;IAChE,OAAO,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,SAAS,CAAC;AACzD,CAAC;AAED,0FAA0F;AAC1F,SAAS,mBAAmB,CAAC,MAAoB;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,SAAS;QAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,GAAW,EACX,QAA0C;IAE1C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,cAAc,CACtB,0BAA0B,GAAG,mDAAmD,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAC5H,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,cAAc,CACtB,0BAA0B,GAAG,2EAA2E;YACtG,wDAAwD,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK;YACrG,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,sEAAsE;IACtE,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,WAAW;IACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,MAAM,QAAQ,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACjD,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,cAAc,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CACtB,0BAA0B,GAAG,oDAAoD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO;QAAE,OAAO;IACpB,MAAM,IAAI,cAAc,CACtB,0BAA0B,GAAG,mDAAmD,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAC5H,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,SAAS,sBAAsB,CAAC,MAAoB,EAAE,SAAiB;IACrE,IAAI,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IAE/C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,YAAY,KAAK,cAAc;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,SAAiB,EAAE,MAAc,EAAE,OAAgB;IACtG,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,oBAAoB,MAAM,8EAA8E,CACzG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,cAAc,CACtB,oBAAoB,MAAM,8GAA8G,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,SAAS,IAAI,SAAS,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,cAAc,CACtB,cAAc,MAAM,mBAAmB,SAAS,kDAAkD,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAChJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAoB,EAAE,SAAiB,EAAE,OAAO,GAAG,IAAI;IAC9E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,cAAc,CACtB,cAAc,SAAS,8EAA8E,CACtG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,cAAc,SAAS,4FAA4F,CACpH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAA0B,EAAE,MAAgB;IAC3E,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE9C,MAAM,SAAS,GAAiB;QAC9B,GAAG,YAAY;QACf,eAAe,EAAE,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC;QAClD,iBAAiB,EAAE,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC;QACtD,WAAW,EAAE,CAAC,GAAG,YAAY,CAAC,WAAW,CAAC;KAC3C,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,SAAS,CAAC,oBAAoB,GAAG,KAAK,CAAC;IACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,SAAS,CAAC,cAAc,GAAG,KAAK,CAAC;IAE3D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,2BAA2B,CACzC,YAA0B,EAC1B,aAAoC;IAEpC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,CAAsB,EAAW,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5F,MAAM,aAAa,GAAG,CAAC,MAAgB,EAAE,OAA6B,EAAY,EAAE;QAClF,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,mFAAmF;QACnF,mCAAmC;QACnC,EAAE;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,0DAA0D;QAC1D,iFAAiF;QACjF,qFAAqF;QACrF,iFAAiF;QACjF,0EAA0E;QAC1E,kFAAkF;QAClF,wFAAwF;QACxF,sFAAsF;QACtF,qFAAqF;QACrF,sFAAsF;QACtF,EAAE;QACF,+EAA+E;QAC/E,gFAAgF;QAChF,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAE,UAAkB,EAAW,EAAE;YAChE,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzB,sDAAsD;YACtD,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC3B,4EAA4E;YAC5E,+EAA+E;YAC/E,2EAA2E;YAC3E,oBAAoB;YACpB,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7C,sEAAsE;YACtE,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/B,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBACtD,OAAO,CAAC,KAAK,UAAU,CAAC;YAC1B,CAAC;YACD,0BAA0B;YAC1B,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACpB,6EAA6E;oBAC7E,mEAAmE;oBACnE,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBACrC,OAAO,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC;gBACD,6CAA6C;gBAC7C,OAAO,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,gFAAgF;QAChF,4EAA4E;QAC5E,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,SAAS,GAAiB;QAC9B,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC;QACrE,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC;QACpF,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,YAAY,CAAC;QACxE,oBAAoB,EAAE,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,aAAa,CAAC,oBAAoB,CAAC;QAChG,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,cAAc,EAAE,aAAa,CAAC,cAAc,CAAC;QAC9E,eAAe,EAAE,aAAa,CAAC,YAAY,CAAC,eAAe,EAAE,aAAa,CAAC,eAAe,CAAC;QAC3F,iBAAiB,EAAE,aAAa,CAAC,YAAY,CAAC,iBAAiB,EAAE,aAAa,CAAC,iBAAiB,CAAC;QACjG,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;KAC/F,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,cAAc,CAAC,MAAoB;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,oBAAoB;QAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,gBAAgB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC1G,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/adt/types.d.ts

@@ -813,4 +813,78 @@ export interface RevisionListResult {
     };
     revisions: RevisionInfo[];
 }
+/**
+ * Line range from the ADT `objectstructure` atom-link `#start=L,C;end=L,C` fragment.
+ *
+ * `sr`/`er` are 1-indexed rows. `sc`/`ec` are 0-indexed columns. The `er` row is
+ * INCLUSIVE (the end token lives on that line). The `ec` column is the column
+ * AFTER the end token (i.e. half-open: [sc, ec) — `ec` matches a typical
+ * editor's "go to end of selection" position).
+ *
+ * Wire example: `<atom:link href="…#start=12,0;end=22,8">` →
+ * `{ sr: 12, sc: 0, er: 22, ec: 8 }` — the block spans lines 12-22 inclusive,
+ * with the final ENDCLASS token ending at column 8 of line 22.
+ */
+export interface LineRange {
+    sr: number;
+    sc: number;
+    er: number;
+    ec: number;
+}
+/**
+ * One method's structural metadata, parsed from `<abapsource:objectStructureElement>`
+ * elements in the `objectstructure` response.
+ *
+ * Cross-release: on S/4HANA 2023 (kernel 7.58+) one `CLAS/OM` element carries both
+ * `definition` and `implementation` ranges. On NW 7.50, the entry is SPLIT — one
+ * `CLAS/OO` element carries `definition` (+ identifiers), one `CLAS/OM` element
+ * carries `implementation` (+ identifiers). `parseClassStructure` merges by name
+ * so callers see a single `MethodStructure` per method on either release.
+ *
+ * `implementation` is `undefined` for ABSTRACT methods (no METHOD body exists).
+ */
+export interface MethodStructure {
+    name: string;
+    visibility: 'public' | 'protected' | 'private';
+    level: 'instance' | 'static';
+    abstract: boolean;
+    constructor: boolean;
+    /** Full METHODS clause range in `/source/main` (the declaration line(s) in DEFINITION). */
+    definition: LineRange;
+    /** Full METHOD…ENDMETHOD range in `/source/main` (body in IMPLEMENTATION). Absent for ABSTRACT. */
+    implementation?: LineRange;
+    /** Position of the method name token within the DEFINITION (useful for code-intel features). */
+    definitionIdentifier?: LineRange;
+    /** Position of the method name token within the IMPLEMENTATION header (`METHOD <name>.`). */
+    implementationIdentifier?: LineRange;
+}
+/** Attribute / constant / type declaration in the class DEFINITION. Carries only a definition range. */
+export interface AttributeStructure {
+    name: string;
+    visibility: 'public' | 'protected' | 'private';
+    level: 'instance' | 'static';
+    constant: boolean;
+    readOnly: boolean;
+    definition: LineRange;
+}
+/**
+ * Parsed `/sap/bc/adt/oo/classes/{name}/objectstructure` response — the line-range map
+ * arc-1 uses for surgical edits to a global class without re-sending the full source.
+ *
+ * `classDefinitionBlock` covers `CLASS … DEFINITION … ENDCLASS.` in `/source/main`.
+ * `classImplementationBlock` covers `CLASS … IMPLEMENTATION … ENDCLASS.` — absent
+ * only for purely-abstract classes with no IMPLEMENTATION half (unusual).
+ *
+ * `methods` and `attributes` are extracted from the nested elements; ignored types
+ * (`CLAS/OE` events, `CLAS/OT` types, `CLAS/OF` friends, `CLAS/OK` constants/literals,
+ * `CLAS/OCX` text-elements) are dropped — class-section surgery in this release only
+ * targets methods and attributes. Attribute-level surgery is a follow-up.
+ */
+export interface ClassStructure {
+    className: string;
+    classDefinitionBlock: LineRange;
+    classImplementationBlock?: LineRange;
+    methods: MethodStructure[];
+    attributes: AttributeStructure[];
+}
 //# sourceMappingURL=types.d.ts.map