comber 0.1.0

package/dist/api/har-driver.js

@@ -0,0 +1,167 @@
+import { guardedFetch } from "../core/net.js";
+import { harOperationLabel, parseHar, shapeSignature } from "./har.js";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+function makeFetchTransport(guard) {
+    return async (req) => {
+        const res = await guardedFetch(req.url, { method: req.method, headers: req.headers, body: req.body }, guard);
+        const headers = {};
+        res.headers.forEach((v, k) => {
+            headers[k.toLowerCase()] = v;
+        });
+        return { status: res.status, headers, bodyText: await res.text() };
+    };
+}
+const NOOP_COVERAGE = { skip() { }, bumpExtra() { } };
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+function errMessage(e) {
+    return (e instanceof Error ? e.message : String(e)).slice(0, 160);
+}
+export class HarDriver {
+    opts;
+    name = "har";
+    capabilities = { screenshot: false, probes: [] };
+    operations;
+    identity;
+    transport;
+    cov = NOOP_COVERAGE;
+    exercised = 0;
+    drifts = 0;
+    constructor(opts) {
+        this.opts = opts;
+        this.operations = parseHar(opts.har);
+        this.transport =
+            opts.transport ?? makeFetchTransport({ allowPrivate: opts.allowPrivateTarget, timeoutMs: opts.timeoutMs });
+        // A stable address identity for the single catalog state (the capture's origin if any).
+        let origin = "har-capture";
+        const first = this.operations[0];
+        if (first) {
+            try {
+                origin = new URL(first.url).origin;
+            }
+            catch {
+                /* keep default */
+            }
+        }
+        this.identity = origin;
+    }
+    attachCoverage(sink) {
+        this.cov = sink;
+    }
+    async start() {
+        /* stateless */
+    }
+    async close() {
+        /* stateless */
+    }
+    get entry() {
+        return { id: this.identity, scope: this.identity, label: this.identity };
+    }
+    entryAddress() {
+        return this.entry;
+    }
+    currentAddress() {
+        return this.entry;
+    }
+    inScope(addr) {
+        return addr.id === this.identity;
+    }
+    async goto(_addr) {
+        /* single state */
+    }
+    /** One Surface; one node per deduped recorded operation. Write entries are surfaced disabled
+     *  in read-only mode (a counted coverage skip). */
+    async snapshot() {
+        const nodes = this.operations.map((op) => ({
+            id: harOperationLabel(op),
+            kind: "har-request",
+            label: harOperationLabel(op),
+            handle: op,
+            disabled: !SAFE_METHODS.has(op.method) && !this.opts.allowWrites,
+        }));
+        return { address: this.entry, title: "HAR capture", nodes, blindSpots: 0 };
+    }
+    /** EXERCISE — re-send the recorded request, compare the live response to the recording. */
+    async exercise(node) {
+        const op = node.handle;
+        if (!SAFE_METHODS.has(op.method) && !this.opts.allowWrites)
+            return {};
+        const signals = [];
+        let live;
+        try {
+            live = await this.send(op);
+        }
+        catch (e) {
+            this.exercised++;
+            signals.push(this.signal(op, "request-failed", "warn", `${harOperationLabel(op)} → transport error: ${errMessage(e)}`));
+            return { signals };
+        }
+        this.exercised++;
+        // STATUS drift — the live status no longer matches what was recorded.
+        if (live.status !== op.recorded.status) {
+            this.drifts++;
+            signals.push(this.signal(op, "contract-drift", "fail", `${harOperationLabel(op)} → status drift: recorded HTTP ${op.recorded.status}, live HTTP ${live.status}`));
+        }
+        else {
+            // SHAPE drift — same status, but the JSON body structure changed (field added/removed/retyped).
+            const recordedShape = safeJson(op.recorded.bodyText);
+            const liveShape = safeJson(live.bodyText);
+            if (recordedShape !== undefined && liveShape !== undefined) {
+                const a = shapeSignature(recordedShape);
+                const b = shapeSignature(liveShape);
+                if (a !== b) {
+                    this.drifts++;
+                    signals.push(this.signal(op, "contract-drift", "warn", `${harOperationLabel(op)} → response shape drift from the recorded body`));
+                }
+            }
+        }
+        return { signals };
+    }
+    signal(op, kind, severity, message) {
+        return {
+            kind,
+            severity,
+            message,
+            url: op.url,
+            signature: `${kind}|${harOperationLabel(op)}`.slice(0, 80),
+            action: harOperationLabel(op),
+        };
+    }
+    async send(op) {
+        const headers = { accept: "application/json" };
+        if (op.bodyContentType)
+            headers["content-type"] = op.bodyContentType;
+        if (this.opts.token)
+            headers["authorization"] = `Bearer ${this.opts.token}`;
+        return this.transport({ method: op.method, url: op.url, headers, body: op.body });
+    }
+    drainSignals() {
+        return [];
+    }
+    async screenshot() {
+        return Buffer.alloc(0);
+    }
+    outboundAddresses() {
+        return [];
+    }
+    auditExtra() {
+        const writeOps = this.operations.filter((op) => !SAFE_METHODS.has(op.method)).length;
+        return {
+            harAudit: {
+                operations: this.operations.length,
+                safeOperations: this.operations.length - writeOps,
+                writeOperations: writeOps,
+                exercised: this.exercised,
+                writesSkipped: this.opts.allowWrites ? 0 : writeOps,
+                drifts: this.drifts,
+                allowWrites: this.opts.allowWrites,
+            },
+        };
+    }
+}

package/dist/api/har-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"har-driver.js","sourceRoot":"","sources":["../../src/api/har-driver.ts"],"names":[],"mappings":"AAeA,OAAO,EAAqB,iBAAiB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAazD,MAAM,cAAc,GAAiB,KAAK,EAAE,GAAG,EAAE,EAAE;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/F,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,aAAa,GAAiB,EAAE,IAAI,KAAI,CAAC,EAAE,SAAS,KAAI,CAAC,EAAE,CAAC;AAElE,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,SAAS;IAWS;IAVpB,IAAI,GAAG,KAAK,CAAC;IACb,YAAY,GAAuB,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE7D,UAAU,CAAiB;IAC3B,QAAQ,CAAS;IACjB,SAAS,CAAe;IACjC,GAAG,GAAiB,aAAa,CAAC;IAClC,SAAS,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,CAAC,CAAC;IAEnB,YAA6B,IAAmB;QAAnB,SAAI,GAAJ,IAAI,CAAe;QAC9C,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC;QAClD,wFAAwF;QACxF,IAAI,MAAM,GAAG,aAAa,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,cAAc,CAAC,IAAkB;QAC/B,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,eAAe;IACjB,CAAC;IACD,KAAK,CAAC,KAAK;QACT,eAAe;IACjB,CAAC;IAED,IAAY,KAAK;QACf,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAC3E,CAAC;IACD,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,IAAa;QACnB,OAAO,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAc;QACvB,kBAAkB;IACpB,CAAC;IAED;uDACmD;IACnD,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAkB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACxD,EAAE,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACzB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;SACjE,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,QAAQ,CAAC,IAAiB;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAsB,CAAC;QACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAEtE,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,IAAI,IAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,uBAAuB,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxH,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjB,sEAAsE;QACtE,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,MAAM,CACT,EAAE,EACF,gBAAgB,EAChB,MAAM,EACN,GAAG,iBAAiB,CAAC,EAAE,CAAC,kCAAkC,EAAE,CAAC,QAAQ,CAAC,MAAM,eAAe,IAAI,CAAC,MAAM,EAAE,CACzG,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,gGAAgG;YAChG,MAAM,aAAa,GAAG,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC3D,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;gBACxC,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACZ,IAAI,CAAC,MAAM,EAAE,CAAC;oBACd,OAAO,CAAC,IAAI,CACV,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,EAAE,CAAC,gDAAgD,CAAC,CACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAEO,MAAM,CAAC,EAAgB,EAAE,IAAY,EAAE,QAAyB,EAAE,OAAe;QACvF,OAAO;YACL,IAAI;YACJ,QAAQ;YACR,OAAO;YACP,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,SAAS,EAAE,GAAG,IAAI,IAAI,iBAAiB,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1D,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;SAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,EAAgB;QACjC,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACvE,IAAI,EAAE,CAAC,eAAe;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC;QACrE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,YAAY;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,UAAU;QACd,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,iBAAiB;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,UAAU;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACrF,OAAO;YACL,QAAQ,EAAE;gBACR,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;gBAClC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,QAAQ;gBACjD,eAAe,EAAE,QAAQ;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;gBACnD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;aACnC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/api/har.js

@@ -0,0 +1,100 @@
+// HAR (HTTP Archive) spec source — the API driver's FOURTH discovery mode. Recorded traffic
+// (`log.entries[]`) becomes the operation set: each entry's request (method + URL + body) is an
+// operation, and its recorded response is the CONTRACT we re-check against live. Route-template
+// dedupe collapses `/users/1` and `/users/2` to a single `GET /users/{id}` operation. Leaf
+// module — imports nothing from `core`/`web`.
+function asObject(v) {
+    return v && typeof v === "object" && !Array.isArray(v) ? v : {};
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A path segment that is an identifier (numeric / uuid / long hex) → templated as `{id}`. */
+function isIdLike(seg) {
+    return /^\d+$/.test(seg) || UUID_RE.test(seg) || /^[0-9a-f]{16,}$/i.test(seg);
+}
+/** Derive a route template from a URL path: id-like segments become `{id}`. */
+export function templateOfPath(pathname) {
+    return pathname
+        .split("/")
+        .map((seg) => (isIdLike(seg) ? "{id}" : seg))
+        .join("/");
+}
+function headerValue(headers, name) {
+    if (!Array.isArray(headers))
+        return undefined;
+    const lower = name.toLowerCase();
+    for (const h of headers) {
+        const o = asObject(h);
+        if (typeof o.name === "string" && o.name.toLowerCase() === lower && typeof o.value === "string")
+            return o.value;
+    }
+    return undefined;
+}
+/**
+ * Parse a HAR document into deduped operations. The first entry per `METHOD template` wins
+ * (route-template dedupe); later entries that template-collapse to it are dropped.
+ */
+export function parseHar(doc) {
+    const log = asObject(asObject(doc).log);
+    const entries = Array.isArray(log.entries) ? log.entries : [];
+    const seen = new Set();
+    const out = [];
+    for (const raw of entries) {
+        const entry = asObject(raw);
+        const request = asObject(entry.request);
+        const response = asObject(entry.response);
+        const method = typeof request.method === "string" ? request.method.toUpperCase() : undefined;
+        const url = typeof request.url === "string" ? request.url : undefined;
+        if (!method || !url)
+            continue;
+        let template;
+        try {
+            template = templateOfPath(new URL(url).pathname);
+        }
+        catch {
+            continue; // not a usable absolute URL
+        }
+        const key = `${method} ${template}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const postData = asObject(request.postData);
+        const body = typeof postData.text === "string" ? postData.text : undefined;
+        const bodyContentType = typeof postData.mimeType === "string" ? postData.mimeType : headerValue(request.headers, "content-type");
+        const content = asObject(response.content);
+        out.push({
+            method,
+            url,
+            template,
+            body,
+            bodyContentType,
+            recorded: {
+                status: typeof response.status === "number" ? response.status : 0,
+                bodyText: typeof content.text === "string" ? content.text : "",
+                mimeType: typeof content.mimeType === "string" ? content.mimeType : undefined,
+            },
+        });
+    }
+    return out;
+}
+/** "METHOD /template" — stable operation identity (node id/label, dedupe namespace). */
+export function harOperationLabel(op) {
+    return `${op.method} ${op.template}`;
+}
+/**
+ * A stable, value-free STRUCTURAL signature of a JSON value — object key sets (sorted) + the
+ * scalar TYPES at each leaf, never the values themselves. Comparing the recorded vs. live
+ * signatures detects added/removed/retyped fields (contract drift) without leaking body data.
+ */
+export function shapeSignature(value, depth = 0) {
+    if (depth > 6)
+        return "…";
+    if (Array.isArray(value))
+        return `[${value.length ? shapeSignature(value[0], depth + 1) : ""}]`;
+    if (value === null)
+        return "null";
+    if (typeof value === "object") {
+        const keys = Object.keys(value).sort();
+        return `{${keys.map((k) => `${k}:${shapeSignature(value[k], depth + 1)}`).join(",")}}`;
+    }
+    return typeof value;
+}

package/dist/api/har.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"har.js","sourceRoot":"","sources":["../../src/api/har.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gGAAgG;AAChG,gGAAgG;AAChG,2FAA2F;AAC3F,8CAA8C;AAgB9C,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,QAAQ;SACZ,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,IAAY;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC;IAClH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAmB,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;YAAE,SAAS;QAE9B,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,4BAA4B;QACxC,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,MAAM,eAAe,GAAG,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAEjI,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,GAAG;YACH,QAAQ;YACR,IAAI;YACJ,eAAe;YACf,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACjE,QAAQ,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC9D,QAAQ,EAAE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aAC9E;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,EAAgB;IAChD,OAAO,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACtD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IAChG,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,cAAc,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACtH,CAAC;IACD,OAAO,OAAO,KAAK,CAAC;AACtB,CAAC"}

package/dist/api/load.js

@@ -0,0 +1,83 @@
+// I/O loaders for the API driver — read an OpenAPI document (JSON or YAML), a HAR capture, a
+// GraphQL introspection result, and optional seed/role-seed data from a file path or URL. Kept
+// SEPARATE from the drivers (which take already-parsed objects) so the drivers stay hermetically
+// testable; only the CLI composition root touches these.
+//
+// `src/api` may import the new libs (`yaml`) + core; never `web`. This module is the one place
+// `.yaml`/`.yml` specs are accepted: a content-sniff (a spec that starts with `{`/`[` is JSON,
+// otherwise YAML — which is a JSON superset, so it parses both) makes it format-agnostic.
+import { readFile } from "node:fs/promises";
+import { parse as parseYaml } from "yaml";
+import { guardedFetch } from "../core/net.js";
+/** A spec body looks like JSON when it begins with an object/array delimiter. */
+function looksLikeJson(text) {
+    const t = text.trimStart();
+    return t.startsWith("{") || t.startsWith("[");
+}
+/**
+ * Parse an OpenAPI spec body that may be JSON OR YAML. JSON-looking bodies go through
+ * `JSON.parse` first (fast, precise errors); anything else (or a JSON body that fails) is
+ * parsed as YAML. A spec that is neither raises a single clear error.
+ */
+export function parseSpec(text, source) {
+    if (looksLikeJson(text)) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            /* fall through — maybe it is YAML that happens to start with a brace */
+        }
+    }
+    try {
+        return parseYaml(text);
+    }
+    catch (e) {
+        throw new Error(`OpenAPI spec ${source} is not valid JSON or YAML: ${e.message}`);
+    }
+}
+/** Load + parse an OpenAPI 3.x document (JSON or YAML) from an http(s) URL or a local file path.
+ *  A URL source is fetched through the SSRF egress guard (fail-closed unless `allowPrivate`), so
+ *  a `--openapi http://169.254.169.254/…` can't turn the spec load into a metadata read. */
+export async function loadOpenApiDocument(source, guard = {}) {
+    if (/^https?:\/\//i.test(source)) {
+        const res = await guardedFetch(source, {}, guard);
+        if (!res.ok)
+            throw new Error(`failed to fetch OpenAPI spec ${source}: HTTP ${res.status}`);
+        return parseSpec(await res.text(), source);
+    }
+    return parseSpec(await readFile(source, "utf8"), source);
+}
+/** Load operator seed data (per-operation request overrides) from a JSON file, if configured. */
+export async function loadSeedData(path) {
+    if (!path)
+        return undefined;
+    const text = await readFile(path, "utf8");
+    try {
+        return JSON.parse(text);
+    }
+    catch (e) {
+        throw new Error(`seed data ${path} is not valid JSON: ${e.message}`);
+    }
+}
+/** Load a HAR capture (always JSON per the HAR spec) from a local file path. */
+export async function loadHar(path) {
+    const text = await readFile(path, "utf8");
+    try {
+        return JSON.parse(text);
+    }
+    catch (e) {
+        throw new Error(`HAR file ${path} is not valid JSON: ${e.message}`);
+    }
+}
+/** Load per-role seed data (role → per-operation overrides) for the multi-role IDOR harness. */
+export async function loadRoleSeedData(path) {
+    if (!path)
+        return undefined;
+    const text = await readFile(path, "utf8");
+    try {
+        return JSON.parse(text);
+    }
+    catch (e) {
+        throw new Error(`role-seed data ${path} is not valid JSON: ${e.message}`);
+    }
+}

package/dist/api/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/api/load.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,+FAA+F;AAC/F,iGAAiG;AACjG,yDAAyD;AACzD,EAAE;AACF,+FAA+F;AAC/F,+FAA+F;AAC/F,0FAA0F;AAC1F,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAG1C,iFAAiF;AACjF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3B,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAc;IACpD,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAc;IACtD,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAa;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAa;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;IACtD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/api/openapi.js

@@ -0,0 +1,159 @@
+// Minimal OpenAPI 3.x ingest — the API driver's "discover the surface" half. We parse
+// only what the checker needs to exercise an API and judge breakage: operations
+// (method + path template + parameters + requestBody + documented responses) plus
+// whether the operation requires auth. `$ref`s are resolved against `components`.
+//
+// Leaf module: imports NOTHING from `core` or `web`. It emits plain descriptors the
+// driver maps onto the target-agnostic contract (so the dependency arrow stays
+// api → core, never the reverse, and never api ↔ web).
+const HTTP_METHODS = ["get", "put", "post", "delete", "options", "head", "patch", "trace"];
+/**
+ * Resolves `#/...` JSON pointers against the root document. Follows chained `$ref`s with a
+ * guard so a cyclic schema can't spin forever. Anything without a `$ref` is returned as-is.
+ */
+export class SpecResolver {
+    doc;
+    constructor(doc) {
+        this.doc = doc;
+    }
+    /** Follow `$ref`s until a concrete node (or a missing pointer) is reached. */
+    deref(node) {
+        let cur = node;
+        let guard = 0;
+        while (cur && typeof cur === "object" && typeof cur.$ref === "string" && guard++ < 64) {
+            cur = this.lookup(cur.$ref);
+        }
+        return cur;
+    }
+    lookup(ref) {
+        if (!ref.startsWith("#/"))
+            return undefined;
+        const parts = ref
+            .slice(2)
+            .split("/")
+            .map((p) => p.replace(/~1/g, "/").replace(/~0/g, "~"));
+        let cur = this.doc;
+        for (const p of parts) {
+            if (cur == null || typeof cur !== "object")
+                return undefined;
+            cur = cur[p];
+        }
+        return cur;
+    }
+}
+function asObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function normalizeParam(raw) {
+    const name = typeof raw.name === "string" ? raw.name : undefined;
+    const location = raw.in;
+    if (!name || (location !== "path" && location !== "query" && location !== "header" && location !== "cookie")) {
+        return undefined;
+    }
+    return {
+        name,
+        in: location,
+        // A path parameter is always required per the spec; otherwise honor `required`.
+        required: location === "path" ? true : raw.required === true,
+        schema: raw.schema,
+        example: raw.example,
+        examples: raw.examples,
+    };
+}
+function mergeParams(pathLevel, opLevel) {
+    const byKey = new Map();
+    for (const p of pathLevel)
+        byKey.set(`${p.in}:${p.name}`, p);
+    for (const p of opLevel)
+        byKey.set(`${p.in}:${p.name}`, p); // op-level overrides path-level
+    return [...byKey.values()];
+}
+function parseRequestBody(raw, resolver) {
+    const rb = asObject(resolver.deref(raw));
+    const content = asObject(rb.content);
+    if (Object.keys(content).length === 0)
+        return undefined;
+    const out = {};
+    for (const [mt, body] of Object.entries(content))
+        out[mt] = asObject(resolver.deref(body));
+    return { required: rb.required === true, content: out };
+}
+function parseResponses(raw, resolver) {
+    const responses = asObject(raw);
+    const out = [];
+    for (const [statusKey, respRaw] of Object.entries(responses)) {
+        const resp = asObject(resolver.deref(respRaw));
+        const contentRaw = asObject(resp.content);
+        const content = {};
+        for (const [mt, body] of Object.entries(contentRaw))
+            content[mt] = asObject(resolver.deref(body));
+        out.push({ statusKey, content });
+    }
+    return out;
+}
+/** A security requirement list "requires auth" when at least one requirement object is
+ *  non-empty. `security: []` explicitly opts OUT (public), so it does NOT require auth. */
+function computesRequiresAuth(opSecurity, globalSecurity) {
+    const sec = opSecurity !== undefined ? opSecurity : globalSecurity;
+    if (!Array.isArray(sec))
+        return false;
+    return sec.some((req) => req && typeof req === "object" && Object.keys(req).length > 0);
+}
+/**
+ * Parse an OpenAPI 3.x document object into the operation descriptors the driver
+ * exercises. Returns the operations plus the resolver (shared so request building and
+ * response classification deref schemas against the same `components`).
+ */
+export function parseOpenApi(doc) {
+    const resolver = new SpecResolver(doc);
+    const root = asObject(doc);
+    const paths = asObject(root.paths);
+    const globalSecurity = root.security;
+    const operations = [];
+    for (const [pathTemplate, pathItemRaw] of Object.entries(paths)) {
+        const pathItem = asObject(resolver.deref(pathItemRaw));
+        const pathParams = Array.isArray(pathItem.parameters)
+            ? pathItem.parameters.map((p) => normalizeParam(asObject(resolver.deref(p)))).filter((p) => !!p)
+            : [];
+        for (const method of HTTP_METHODS) {
+            const opRaw = pathItem[method];
+            if (!opRaw || typeof opRaw !== "object")
+                continue;
+            const op = asObject(resolver.deref(opRaw));
+            const opParams = Array.isArray(op.parameters)
+                ? op.parameters.map((p) => normalizeParam(asObject(resolver.deref(p)))).filter((p) => !!p)
+                : [];
+            operations.push({
+                method: method.toUpperCase(),
+                path: pathTemplate,
+                operationId: typeof op.operationId === "string" ? op.operationId : undefined,
+                summary: typeof op.summary === "string" ? op.summary : undefined,
+                parameters: mergeParams(pathParams, opParams),
+                requestBody: op.requestBody !== undefined ? parseRequestBody(op.requestBody, resolver) : undefined,
+                responses: parseResponses(op.responses, resolver),
+                requiresAuth: computesRequiresAuth(op.security, globalSecurity),
+            });
+        }
+    }
+    const info = asObject(root.info);
+    return { operations, resolver, title: typeof info.title === "string" ? info.title : undefined };
+}
+/** "METHOD /template" — stable operation identity (SurfaceNode id/label, dedupe namespace). */
+export function operationLabel(op) {
+    return `${op.method} ${op.path}`;
+}
+/** The documented response whose key best matches `status`: exact → "NXX" range → default. */
+export function responseFor(op, status) {
+    const cls = Math.floor(status / 100);
+    return (op.responses.find((r) => /^\d+$/.test(r.statusKey) && Number(r.statusKey) === status) ??
+        op.responses.find((r) => /^[1-5]xx$/i.test(r.statusKey) && Number(r.statusKey[0]) === cls) ??
+        op.responses.find((r) => r.statusKey === "default"));
+}
+/** Is `status` covered by ANY documented response (exact, range, or default)? */
+export function isDocumented(op, status) {
+    return op.responses.length > 0 && responseFor(op, status) !== undefined;
+}
+/** Human-readable list of documented status keys (for the undocumented-status message). */
+export function documentedStatusList(op) {
+    return op.responses.map((r) => r.statusKey).join(", ") || "(none)";
+}

package/dist/api/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/api/openapi.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,gFAAgF;AAChF,kFAAkF;AAClF,kFAAkF;AAClF,EAAE;AACF,oFAAoF;AACpF,+EAA+E;AAC/E,uDAAuD;AA+DvD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAEpG;;;GAGG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,GAAY;QAAZ,QAAG,GAAH,GAAG,CAAS;IAAG,CAAC;IAE7C,8EAA8E;IAC9E,KAAK,CAAc,IAAa;QAC9B,IAAI,GAAG,GAAY,IAAI,CAAC;QACxB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAQ,GAA0B,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9G,GAAG,GAAG,IAAI,CAAC,MAAM,CAAE,GAAwB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,KAAK,GAAG,GAAG;aACd,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,IAAI,GAAG,GAAY,IAAI,CAAC,GAAG,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC7D,GAAG,GAAI,GAA+B,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B;IAClD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI;QACJ,EAAE,EAAE,QAAQ;QACZ,gFAAgF;QAChF,QAAQ,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI;QAC5D,MAAM,EAAE,GAAG,CAAC,MAAgC;QAC5C,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAsD;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,SAA6B,EAAE,OAA2B;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gCAAgC;IAC5F,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY,EAAE,QAAsB;IAC5D,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,GAAG,GAAqC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAqB,CAAC;IAC/G,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,QAAsB;IAC1D,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAqB,CAAC;QACtH,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;2FAC2F;AAC3F,SAAS,oBAAoB,CAAC,UAAmB,EAAE,cAAuB;IACxE,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;IACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrC,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,KAAK,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YACnD,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvH,CAAC,CAAC,EAAE,CAAC;QAEP,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YAClD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC;gBAC3C,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjH,CAAC,CAAC,EAAE,CAAC;YAEP,UAAU,CAAC,IAAI,CAAC;gBACd,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,OAAO,EAAE,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBAC5E,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAChE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC;gBAC7C,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClG,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;gBACjD,YAAY,EAAE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAClG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,cAAc,CAAC,EAAgB;IAC7C,OAAO,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,WAAW,CAAC,EAAgB,EAAE,MAAc;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;IACrC,OAAO,CACL,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC;QACrF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;QAC1F,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,EAAgB,EAAE,MAAc;IAC3D,OAAO,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC;AAC1E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,EAAgB;IACnD,OAAO,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;AACrE,CAAC"}