depvitals 0.1.2 → 0.2.0

package/dist/cli/notifier/updateCache.js

@@ -0,0 +1,352 @@
+/**
+ * Best-effort 24-hour cache for the optional CLI update check (Step 65).
+ *
+ * The update-notifier contract allows **at most one** bounded public registry lookup per user per
+ * day, so the version reported by a previous run is remembered in a tiny private cache file:
+ *
+ * ```json
+ * { "latest": "0.2.1", "checkedAt": 1792170000000 }
+ * ```
+ *
+ * Design rules, all of them derived from the contract and from the repository invariants:
+ *
+ * - **Outside every analyzed project.** The path is always resolved from a user-scoped environment
+ *   variable or from the user's home directory, and a candidate that is not absolute is rejected.
+ *   No part of the path is ever derived from the scanned directory, from `cwd`, or from any project
+ *   file, so scanning a project named `depvitals` - or running from any working directory - cannot
+ *   place the cache inside that project.
+ * - **Minimal, private content.** Only the public `latest` version string and the timestamp of the
+ *   check are stored: no project path, no manifest content, no dependency list, no credential, no
+ *   machine identifier and no telemetry. The directory is created `0o700` and the file `0o600` on
+ *   platforms that honor POSIX mode bits.
+ * - **Untrusted on read.** Cached data is treated exactly like untrusted registry data: missing
+ *   file, unreadable file, oversized file, non-regular file (including a symlink), invalid JSON,
+ *   wrong types, unexpected extra keys, a negative timestamp and a timestamp in the future are all
+ *   cache *misses*, never errors.
+ * - **Invisible on failure.** Every filesystem operation is wrapped so that permission denied,
+ *   read-only media, a missing parent directory or a failing rename resolve normally instead of
+ *   throwing. Nothing here writes to stdout/stderr, and nothing here can change scan output or the
+ *   process exit code.
+ *
+ * The module performs no network access, decides no eligibility, prints nothing and is deliberately
+ * not wired into the CLI yet: the update check is assembled in Step 67, and the registry lookup
+ * itself belongs to Step 66. Because both helpers are asynchronous, callers must await them so a
+ * short-lived process does not exit before the cache write finishes.
+ */
+import { lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+/**
+ * The freshness window. An entry is usable while its age is `>= 0` and strictly below this value;
+ * an older entry is a miss, which is what allows a later step to refresh it.
+ */
+export const UPDATE_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+/** Name of the cache file, exported so callers and documentation can name the exact path. */
+export const UPDATE_CACHE_FILE_NAME = 'update-check.json';
+/** The one environment variable consulted on Linux/macOS/other POSIX systems. */
+const XDG_CACHE_HOME = 'XDG_CACHE_HOME';
+/** The one environment variable consulted on Windows. */
+const LOCAL_APP_DATA = 'LOCALAPPDATA';
+/** Cache subdirectory added to the resolved user cache root. */
+const CACHE_DIRECTORY_NAME = 'depvitals';
+/** Home-directory fallback used when no usable environment variable exists: `~/.cache/depvitals`. */
+const HOME_CACHE_SEGMENTS = ['.cache', CACHE_DIRECTORY_NAME];
+/**
+ * Upper bound of the accepted cache file, in bytes. A real entry is roughly 50 bytes, so a larger
+ * file cannot be our own record and is refused *before* it is read or parsed.
+ */
+const MAX_CACHE_BYTES = 8 * 1024;
+/** Upper bound of the stored version identifier, which keeps a hostile cache file tiny. */
+const MAX_VERSION_LENGTH = 64;
+/**
+ * Characters that can never appear in the stored identifier: whitespace, control characters, a
+ * quote and a backslash. This is *not* a version grammar - exact stable-version syntax is owned by
+ * `versionCompare.isNewerStableVersion`, which stays the single source of truth - it only rejects
+ * values that cannot be used as an identifier and keeps the JSON record well-formed.
+ */
+const UNUSABLE_IDENTIFIER = /[\s"\\/]/;
+/**
+ * Whether `value` contains a C0/C1-in-ASCII-range control character. Written as a code-point scan
+ * instead of a regex range so the lint rule against control-character patterns stays meaningful.
+ */
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < 0x20 || code === 0x7f) {
+            return true;
+        }
+    }
+    return false;
+}
+/** The only mode bits requested for the cache directory and the cache file. */
+const CACHE_DIRECTORY_MODE = 0o700;
+const CACHE_FILE_MODE = 0o600;
+/**
+ * Whether the Windows path dialect applies. Only the exact `'win32'` platform string (the value
+ * `process.platform` reports on Windows) selects it; every other platform uses POSIX rules.
+ */
+function isWindowsPlatform(platform) {
+    return (platform ?? process.platform) === 'win32';
+}
+/** The path helpers matching the platform of one call. */
+function pathsFor(platform) {
+    return isWindowsPlatform(platform) ? win32 : posix;
+}
+/**
+ * Accept a directory candidate only when it is a non-empty absolute path. Relative values - which
+ * would silently be resolved against the current working directory, and therefore possibly inside
+ * the project being scanned - are rejected here, and a rejected location turns into a cache miss.
+ */
+function absoluteOnly(candidate, paths) {
+    if (candidate === undefined || candidate === '') {
+        return undefined;
+    }
+    return paths.isAbsolute(candidate) ? candidate : undefined;
+}
+/**
+ * Read the home directory from the injected provider, or from `node:os`. A provider that throws or
+ * returns an empty/relative value yields no usable location.
+ */
+function homeOnly(options, paths) {
+    let reported;
+    try {
+        reported = options.homedir?.() ?? homedir();
+    }
+    catch {
+        // An unavailable home directory is a normal situation (locked-down or daemon accounts).
+        return undefined;
+    }
+    return absoluteOnly(reported, paths);
+}
+/**
+ * Resolve the user-scoped cache *directory* for the platform:
+ *
+ * - Windows: absolute `LOCALAPPDATA` + `depvitals`;
+ * - otherwise: absolute `XDG_CACHE_HOME` + `depvitals`;
+ * - fallback on every platform: `<home>/.cache/depvitals`.
+ *
+ * Environment variables are consulted by exact name, are only accepted when absolute, and never
+ * fall back to the analyzed project.
+ */
+function cacheDirectory(options, paths) {
+    const override = absoluteOnly(options.cacheDir, paths);
+    if (override !== undefined) {
+        return override;
+    }
+    const env = options.env ?? {};
+    if (isWindowsPlatform(options.platform)) {
+        const localAppData = absoluteOnly(env[LOCAL_APP_DATA], paths);
+        if (localAppData !== undefined) {
+            return paths.join(localAppData, CACHE_DIRECTORY_NAME);
+        }
+    }
+    else {
+        const xdgCacheHome = absoluteOnly(env[XDG_CACHE_HOME], paths);
+        if (xdgCacheHome !== undefined) {
+            return paths.join(xdgCacheHome, CACHE_DIRECTORY_NAME);
+        }
+    }
+    const home = homeOnly(options, paths);
+    if (home === undefined) {
+        return undefined;
+    }
+    return paths.join(home, ...HOME_CACHE_SEGMENTS);
+}
+/**
+ * Resolve the usable cache directory and the cache file inside it, or `undefined` when no safe
+ * location exists (no usable environment variable and no absolute home directory, or a relative
+ * `cacheDir`). Neither result ever depends on the scanned directory or on `cwd`.
+ */
+function resolveLocation(options) {
+    const paths = pathsFor(options.platform);
+    const directory = cacheDirectory(options, paths);
+    if (directory === undefined) {
+        return undefined;
+    }
+    return { directory, file: paths.join(directory, UPDATE_CACHE_FILE_NAME) };
+}
+/**
+ * Resolve the absolute path of the cache file, or `undefined` when no safe location exists, i.e.
+ * when no usable cache environment variable and no absolute home directory is available. A
+ * relative `cacheDir` is ignored in favor of those user-scoped defaults. The result never depends
+ * on the scanned directory or on `cwd`.
+ *
+ * @param options - Location inputs (override directory, environment map, home provider, platform).
+ * @returns The absolute cache file path, or `undefined` when caching is impossible.
+ */
+export function resolveUpdateCacheFile(options = {}) {
+    return resolveLocation(options)?.file;
+}
+/**
+ * Whether the injected clock is usable. A fractional, `NaN`, infinite, negative or absurdly large
+ * value cannot establish freshness, so it disables the operation instead of guessing.
+ */
+function isUsableClock(now) {
+    return Number.isSafeInteger(now) && now >= 0;
+}
+/** Whether a string can serve as the stored version identifier. See `UNUSABLE_IDENTIFIER`. */
+function isUsableIdentifier(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= MAX_VERSION_LENGTH &&
+        !hasControlCharacter(value) &&
+        !UNUSABLE_IDENTIFIER.test(value));
+}
+/**
+ * Read at most a bounded amount of text from the cache file.
+ *
+ * `lstat` (not `stat`) is used deliberately: the entry must be a regular file, so a symlink planted
+ * at the cache path - a path this module does not control on shared systems - is a miss, and its
+ * target is never read. A directory, an oversized file and any I/O error also end up as `undefined`.
+ */
+async function readCacheText(file) {
+    const info = await lstat(file);
+    if (!info.isFile() || info.size > MAX_CACHE_BYTES) {
+        return undefined;
+    }
+    const contents = await readFile(file, 'utf8');
+    // Decoded length is not byte length, so re-check the bound before parsing anything.
+    return contents.length > MAX_CACHE_BYTES ? undefined : contents;
+}
+/**
+ * Validate one cached document. The document must be a JSON object carrying exactly `latest` (a
+ * usable identifier) and `checkedAt` (a non-negative safe integer); arrays, scalars, invalid JSON,
+ * wrong types and unexpected extra keys are all rejected.
+ */
+function parseCacheEntry(contents) {
+    let parsed;
+    try {
+        parsed = JSON.parse(contents);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const record = parsed;
+    if (Object.keys(record).length !== 2) {
+        return undefined;
+    }
+    const latest = record['latest'];
+    const checkedAt = record['checkedAt'];
+    if (!isUsableIdentifier(latest)) {
+        return undefined;
+    }
+    if (typeof checkedAt !== 'number' || !Number.isSafeInteger(checkedAt) || checkedAt < 0) {
+        return undefined;
+    }
+    return { latest, checkedAt };
+}
+/**
+ * Look up a fresh cached `latest` version.
+ *
+ * Returns the cached string only when the record exists, is valid, and its age is `>= 0` and below
+ * {@link UPDATE_CACHE_TTL_MS}. Every other case - no file, invalid or oversized content, wrong
+ * types, an extra key, a negative or future timestamp, a permission error, a symlink, a locked-down
+ * home folder - returns `undefined`, i.e. a miss. This function never throws and never logs, so a
+ * broken cache can never change a scan.
+ *
+ * @param options - The injected clock plus the cache location inputs.
+ * @returns The cached `latest` version, or `undefined` when the cache must be treated as empty.
+ */
+export async function readCachedLatest(options) {
+    try {
+        if (!isUsableClock(options.now)) {
+            return undefined;
+        }
+        const file = resolveUpdateCacheFile(options);
+        if (file === undefined) {
+            return undefined;
+        }
+        const text = await readCacheText(file);
+        if (text === undefined) {
+            return undefined;
+        }
+        const entry = parseCacheEntry(text);
+        if (entry === undefined) {
+            return undefined;
+        }
+        // A future timestamp means the clock or the file cannot be trusted: refresh, do not guess.
+        const age = options.now - entry.checkedAt;
+        if (age < 0 || age >= UPDATE_CACHE_TTL_MS) {
+            return undefined;
+        }
+        return entry.latest;
+    }
+    catch {
+        // A missing file (ENOENT) and every other filesystem failure are ordinary cache misses.
+        return undefined;
+    }
+}
+/**
+ * Serialize the whole cache document: exactly the two contract-approved fields, nothing else.
+ */
+function serializeEntry(latest, checkedAt) {
+    const entry = { latest, checkedAt };
+    return JSON.stringify(entry);
+}
+/**
+ * Remove a temporary file without ever reporting a failure.
+ */
+async function removeQuietly(target) {
+    try {
+        await rm(target, { force: true });
+    }
+    catch {
+        // Nothing to clean up, or the media refuses it; either way the scan is unaffected.
+    }
+}
+/**
+ * Stage the record in a sibling temporary file and rename it into place, so a concurrent reader -
+ * or a crash in the middle of a write - never observes a half-written JSON document. The temporary
+ * name carries the process id, so simultaneous DepVitals processes do not share a staging file, and
+ * `rename` replaces the previous entry atomically on POSIX and on Windows.
+ *
+ * All failures are swallowed: a read-only, missing or unwritable cache directory simply means the
+ * next run repeats its lookup.
+ */
+async function writeAtomically(file, contents) {
+    const temporary = `${file}.${String(process.pid)}.tmp`;
+    try {
+        await writeFile(temporary, contents, { mode: CACHE_FILE_MODE });
+        await rename(temporary, file);
+    }
+    catch {
+        // Permission denied, read-only media or a vanished parent directory: skip caching silently.
+    }
+    finally {
+        // After a successful rename the temporary name no longer exists, so this is a no-op.
+        await removeQuietly(temporary);
+    }
+}
+/**
+ * Record a `latest` version together with the injected current time.
+ *
+ * The write is best effort and completely silent: it creates the cache directory if needed
+ * (`0o700`), stages the file (`0o600`) and renames it into place, and it resolves normally even when
+ * nothing at all could be written. Only the two contract-approved fields are serialized.
+ *
+ * @param latest - The public `latest` version string to remember; anything whitespace/control-bearing,
+ *   empty or longer than 64 characters is not written.
+ * @param options - The injected clock plus the cache location inputs.
+ */
+export async function writeCachedLatest(latest, options) {
+    try {
+        if (!isUsableClock(options.now) || !isUsableIdentifier(latest)) {
+            return;
+        }
+        const location = resolveLocation(options);
+        if (location === undefined) {
+            return;
+        }
+        // Creating the directory is part of the best-effort path: a home folder that cannot hold a
+        // cache directory simply results in no cache, exactly like a later failing write.
+        await mkdir(location.directory, { recursive: true, mode: CACHE_DIRECTORY_MODE });
+        await writeAtomically(location.file, serializeEntry(latest, options.now));
+    }
+    catch {
+        // `mkdir` is the only call here that can still throw; caching is skipped silently.
+    }
+}
+//# sourceMappingURL=updateCache.js.map

package/dist/cli/notifier/updateCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateCache.js","sourceRoot":"","sources":["../../../src/cli/notifier/updateCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAKzC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAE1D,iFAAiF;AACjF,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,yDAAyD;AACzD,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC,gEAAgE;AAChE,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAEzC,qGAAqG;AACrG,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAU,CAAC;AAEtE;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AAEjC,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAEvC;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAErC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,eAAe,GAAG,KAAK,CAAC;AA+C9B;;;GAGG;AACH,SAAS,iBAAiB,CAAC,QAA4B;IACrD,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC;AACpD,CAAC;AAED,0DAA0D;AAC1D,SAAS,QAAQ,CAAC,QAA4B;IAC5C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAA6B,EAAE,KAAkB;IACrE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,OAAmC,EAAE,KAAkB;IACvE,IAAI,QAA4B,CAAC;IAEjC,IAAI,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CACrB,OAAmC,EACnC,KAAkB;IAElB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEvD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;IAE9B,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAmC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEjD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAsC,EAAE;IAExC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8FAA8F;AAC9F,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,kBAAkB;QAClC,CAAC,mBAAmB,CAAC,KAAK,CAAC;QAC3B,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE9C,oFAAoF;IACpF,OAAO,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAA2C,CAAC;IAE3D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAEtC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA2B;IAChE,IAAI,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAEvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAEpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,2FAA2F;QAC3F,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC;QAE1C,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,mBAAmB,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,SAAiB;IACvD,MAAM,KAAK,GAAe,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEhD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB;IAC3D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAChE,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4FAA4F;IAC9F,CAAC;YAAS,CAAC;QACT,qFAAqF;QACrF,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAA2B;IAE3B,IAAI,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAE1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,2FAA2F;QAC3F,kFAAkF;QAClF,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjF,MAAM,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;AACH,CAAC"}

package/dist/cli/notifier/updateCheck.d.ts

@@ -0,0 +1,88 @@
+/**
+ * The single optional update-check orchestrator (Step 67).
+ *
+ * This module is the only place where the private notifier helpers of Steps 63-66 are combined, and
+ * the only place that decides whether a *newer DepVitals version* notice exists for one invocation.
+ * The fixed order is the one mandated by the update-notifier contract:
+ *
+ * 1. eligibility (`isEligibleUpdateCheck`): an ineligible invocation stops here, before any cache
+ *    read and before any network attempt, so an opt-out, a CI run or a piped stream costs nothing;
+ * 2. a fresh cache read (`readCachedLatest`);
+ * 3. at most one bounded public lookup on a cache miss (`fetchLatestDepVitalsVersion`);
+ * 4. an optional cache write of the validated result;
+ * 5. a strict stable-version comparison against the installed CLI version;
+ * 6. the notice text, returned to the caller as data.
+ *
+ * Design rules:
+ *
+ * - **No output.** The orchestrator never writes to stdout/stderr and never imports a stream. It
+ *   returns notice text; the CLI entry point owns the channels and the ordering, which is what keeps
+ *   the deterministic report on stdout byte for byte.
+ * - **No project data.** Nothing about the analyzed project (path, manifest, dependency names) is
+ *   accepted or forwarded here. The inputs are the completed command kind, the installed package
+ *   version, the environment map and the two interactivity flags.
+ * - **Silent by construction.** Every failure path - cache error, transport error, malformed
+ *   response, timeout, unusable clock, non-stable version - resolves to `undefined`, and the whole
+ *   pipeline additionally runs inside a `try`/`catch` and inside an explicit wall-clock budget, so a
+ *   misbehaving cache or registry can never change an exit code and can never delay the process
+ *   beyond that budget.
+ * - **Fully injected.** Clock, cache directory and transport are injectable, which is what lets the
+ *   CLI tests stay deterministic and offline. With no seams injected the production defaults are the
+ *   user cache directory and the built-in `fetch`; no test ever reaches the public registry.
+ */
+import { type NotifierCommandKind, type NotifierEnv } from './eligibility.js';
+import { type RegistryFetch } from './registryLookup.js';
+/**
+ * The wall-clock budget for the whole optional check (cache read, at most one lookup, cache write).
+ *
+ * The lookup already carries its own hard bound, so this outer budget only exists to make "the
+ * process never waits on an unbounded promise" explicit and verifiable: when it elapses the check
+ * resolves to "no notice", whatever the transport is still doing.
+ */
+export declare const UPDATE_CHECK_BUDGET_MS = 1000;
+/** What the check needs to decide, all of it passed in by the CLI entry point. */
+export type UpdateNoticeRequest = {
+    /** Which command the CLI completed. Only a completed scan can produce a notice. */
+    readonly commandKind: NotifierCommandKind;
+    /** The installed DepVitals package version, i.e. the version `package.json` declares. */
+    readonly currentVersion: string;
+    /** The environment map used for the eligibility gates. */
+    readonly env: NotifierEnv;
+    /** Whether standard output is an interactive terminal. */
+    readonly stdoutTTY: boolean;
+    /** Whether standard error is an interactive terminal. */
+    readonly stderrTTY: boolean;
+};
+/**
+ * Test-only seams. They exist so the CLI tests can pin a clock, a temporary cache directory and a
+ * stub transport instead of the real cache location and the real network; production passes none.
+ */
+export type UpdateNoticeSeams = {
+    /** Cache directory override; only an absolute path is honored (see `updateCache`). */
+    readonly cacheDir?: string;
+    /** Transport override; defaults to the built-in `fetch`. */
+    readonly fetchImpl?: RegistryFetch;
+    /** Clock override, in epoch milliseconds; defaults to `Date.now`. */
+    readonly now?: () => number;
+    /** Budget override, in milliseconds; defaults to {@link UPDATE_CHECK_BUDGET_MS}. */
+    readonly budgetMs?: number;
+};
+/** The notifier collaborator the entry point uses; `collectUpdateNotice` is the production default. */
+export type UpdateNoticeCollector = (request: UpdateNoticeRequest) => Promise<string | undefined>;
+/**
+ * The notice text: two lines, no colour, no emoji, no ANSI, and no claim about how DepVitals was
+ * installed. `npx depvitals@latest` is offered as a way to run the published release, not as an
+ * instruction to install anything.
+ */
+export declare function formatUpdateNotice(currentVersion: string, latestVersion: string): string;
+/**
+ * Decide whether this invocation has a newer-version notice, and produce its text.
+ *
+ * @param request - The completed command kind, the installed version, the environment and the two
+ *   interactivity flags. Nothing project-derived is accepted.
+ * @param seams - Test-only clock/cache/transport overrides.
+ * @returns The notice text, or `undefined` for every silent case: ineligible invocation, no usable
+ *   version information, a failed or timed-out lookup, and a `latest` that is not strictly newer.
+ */
+export declare function collectUpdateNotice(request: UpdateNoticeRequest, seams?: UpdateNoticeSeams): Promise<string | undefined>;
+//# sourceMappingURL=updateCheck.d.ts.map

package/dist/cli/notifier/updateCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateCheck.d.ts","sourceRoot":"","sources":["../../../src/cli/notifier/updateCheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,qBAAqB,CAAC;AAI7B;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C,kFAAkF;AAClF,MAAM,MAAM,mBAAmB,GAAG;IAChC,mFAAmF;IACnF,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,uGAAuG;AACvG,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAiBlG;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAKxF;AAsFD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,GAAE,iBAAsB,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiC7B"}

package/dist/cli/notifier/updateCheck.js

@@ -0,0 +1,166 @@
+/**
+ * The single optional update-check orchestrator (Step 67).
+ *
+ * This module is the only place where the private notifier helpers of Steps 63-66 are combined, and
+ * the only place that decides whether a *newer DepVitals version* notice exists for one invocation.
+ * The fixed order is the one mandated by the update-notifier contract:
+ *
+ * 1. eligibility (`isEligibleUpdateCheck`): an ineligible invocation stops here, before any cache
+ *    read and before any network attempt, so an opt-out, a CI run or a piped stream costs nothing;
+ * 2. a fresh cache read (`readCachedLatest`);
+ * 3. at most one bounded public lookup on a cache miss (`fetchLatestDepVitalsVersion`);
+ * 4. an optional cache write of the validated result;
+ * 5. a strict stable-version comparison against the installed CLI version;
+ * 6. the notice text, returned to the caller as data.
+ *
+ * Design rules:
+ *
+ * - **No output.** The orchestrator never writes to stdout/stderr and never imports a stream. It
+ *   returns notice text; the CLI entry point owns the channels and the ordering, which is what keeps
+ *   the deterministic report on stdout byte for byte.
+ * - **No project data.** Nothing about the analyzed project (path, manifest, dependency names) is
+ *   accepted or forwarded here. The inputs are the completed command kind, the installed package
+ *   version, the environment map and the two interactivity flags.
+ * - **Silent by construction.** Every failure path - cache error, transport error, malformed
+ *   response, timeout, unusable clock, non-stable version - resolves to `undefined`, and the whole
+ *   pipeline additionally runs inside a `try`/`catch` and inside an explicit wall-clock budget, so a
+ *   misbehaving cache or registry can never change an exit code and can never delay the process
+ *   beyond that budget.
+ * - **Fully injected.** Clock, cache directory and transport are injectable, which is what lets the
+ *   CLI tests stay deterministic and offline. With no seams injected the production defaults are the
+ *   user cache directory and the built-in `fetch`; no test ever reaches the public registry.
+ */
+import { isEligibleUpdateCheck, } from './eligibility.js';
+import { fetchLatestDepVitalsVersion, } from './registryLookup.js';
+import { readCachedLatest, writeCachedLatest } from './updateCache.js';
+import { isNewerStableVersion } from './versionCompare.js';
+/**
+ * The wall-clock budget for the whole optional check (cache read, at most one lookup, cache write).
+ *
+ * The lookup already carries its own hard bound, so this outer budget only exists to make "the
+ * process never waits on an unbounded promise" explicit and verifiable: when it elapses the check
+ * resolves to "no notice", whatever the transport is still doing.
+ */
+export const UPDATE_CHECK_BUDGET_MS = 1000;
+/**
+ * The production transport: the built-in `fetch`, narrowed to the shape the registry lookup accepts.
+ *
+ * Only the endpoint and the abort signal are forwarded - never a header, a body, a credential or any
+ * project-derived value - because `RegistryRequestInit` has exactly one field.
+ */
+async function builtInFetch(endpoint, init) {
+    const response = await fetch(endpoint, { signal: init.signal });
+    return { status: response.status, body: response.body };
+}
+/**
+ * The notice text: two lines, no colour, no emoji, no ANSI, and no claim about how DepVitals was
+ * installed. `npx depvitals@latest` is offered as a way to run the published release, not as an
+ * instruction to install anything.
+ */
+export function formatUpdateNotice(currentVersion, latestVersion) {
+    return (`\nNew DepVitals version available: ${currentVersion} -> ${latestVersion}\n` +
+        'Run: npx depvitals@latest\n');
+}
+/**
+ * Resolve the `latest` version to compare against, using the cache first.
+ *
+ * Returns `undefined` when nothing usable is known: a fresh cache hit yields the cached string and
+ * no request at all; otherwise exactly one bounded lookup happens, and its validated result is
+ * remembered for the next run. A failed lookup yields `undefined` and caches nothing.
+ */
+async function resolveLatestVersion(request, seams) {
+    const cacheOptions = {
+        env: request.env,
+        now: seams.now?.() ?? Date.now(),
+        ...(seams.cacheDir === undefined ? {} : { cacheDir: seams.cacheDir }),
+    };
+    const cached = await readCachedLatest(cacheOptions);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const fetched = await fetchLatestDepVitalsVersion({
+        fetchImpl: seams.fetchImpl ?? builtInFetch,
+    });
+    if (fetched === null) {
+        return undefined;
+    }
+    // Best effort and silent: a cache that cannot be written costs the next run one extra lookup.
+    await writeCachedLatest(fetched, cacheOptions);
+    return fetched;
+}
+/**
+ * Run the whole optional check inside a fixed wall-clock budget.
+ *
+ * The deadline resolves with the "no notice" value instead of throwing, and it stays **referenced**
+ * for exactly as long as the `await` below is pending. That ownership is the point of this helper:
+ * the CLI entry point derives its exit status from an awaited call, so if nothing held the event
+ * loop open while the notifier was in flight, Node could reach an idle loop with that await still
+ * pending and terminate on the unsettled top-level await path - replacing the scan's own `0`/`1`
+ * status with exit `13` and a warning. Neither the transport (which may never answer) nor the
+ * lookup's `AbortSignal.timeout` (whose timer does not hold the loop open) can make that guarantee,
+ * so this timer does.
+ *
+ * It is bounded and short-lived, never a keepalive: the `finally` clears it on every path, so a
+ * cache hit or a fast lookup leaves nothing pending and the process exits immediately. A stalled
+ * transport costs at most this budget, and in practice only the lookup's own shorter timeout,
+ * because a live event loop is what lets that timeout fire at all.
+ *
+ * A rejection of the work (which the notifier helpers themselves never produce) propagates to the
+ * caller's `catch`, which is also silent.
+ */
+async function withinBudget(work, budgetMs) {
+    let timer;
+    const deadline = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            resolve(undefined);
+        }, budgetMs);
+    });
+    const task = work();
+    // If the deadline wins, a later failure of the work must not become an unhandled rejection in a
+    // short-lived CLI process; the answer is already "no notice".
+    task.catch(() => undefined);
+    try {
+        return await Promise.race([task, deadline]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+/**
+ * Decide whether this invocation has a newer-version notice, and produce its text.
+ *
+ * @param request - The completed command kind, the installed version, the environment and the two
+ *   interactivity flags. Nothing project-derived is accepted.
+ * @param seams - Test-only clock/cache/transport overrides.
+ * @returns The notice text, or `undefined` for every silent case: ineligible invocation, no usable
+ *   version information, a failed or timed-out lookup, and a `latest` that is not strictly newer.
+ */
+export async function collectUpdateNotice(request, seams = {}) {
+    try {
+        // Gate first: an ineligible run must not read the cache, must not touch the network and must not
+        // print anything, so every `await` below sits behind this single predicate.
+        if (!isEligibleUpdateCheck({
+            env: request.env,
+            stdoutTTY: request.stdoutTTY,
+            stderrTTY: request.stderrTTY,
+            commandKind: request.commandKind,
+        })) {
+            return undefined;
+        }
+        const latest = await withinBudget(() => resolveLatestVersion(request, seams), seams.budgetMs ?? UPDATE_CHECK_BUDGET_MS);
+        if (latest === undefined) {
+            return undefined;
+        }
+        if (!isNewerStableVersion(request.currentVersion, latest)) {
+            return undefined;
+        }
+        return formatUpdateNotice(request.currentVersion, latest);
+    }
+    catch {
+        // The optional notification is never an error source: no message, no exit-code change, no retry.
+        return undefined;
+    }
+}
+//# sourceMappingURL=updateCheck.js.map

package/dist/cli/notifier/updateCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateCheck.js","sourceRoot":"","sources":["../../../src/cli/notifier/updateCheck.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EACL,qBAAqB,GAGtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,GAG5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAA2B,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAkC3C;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CACzB,QAAgB,EAChB,IAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAEhE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAsB,EAAE,aAAqB;IAC9E,OAAO,CACL,sCAAsC,cAAc,OAAO,aAAa,IAAI;QAC5E,6BAA6B,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,OAA4B,EAC5B,KAAwB;IAExB,MAAM,YAAY,GAAuB;QACvC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QAChC,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;KACtE,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAEpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,2BAA2B,CAAC;QAChD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,YAAY;KAC3C,CAAC,CAAC;IAEH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,8FAA8F;IAC9F,MAAM,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,KAAK,UAAU,YAAY,CACzB,IAAuC,EACvC,QAAgB;IAEhB,IAAI,KAAgD,CAAC;IAErD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;QAClD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,CAAC,SAAS,CAAC,CAAC;QACrB,CAAC,EAAE,QAAQ,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,EAAE,CAAC;IAEpB,gGAAgG;IAChG,8DAA8D;IAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAE5B,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA4B,EAC5B,QAA2B,EAAE;IAE7B,IAAI,CAAC;QACH,iGAAiG;QACjG,4EAA4E;QAC5E,IACE,CAAC,qBAAqB,CAAC;YACrB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,EACF,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,EAC1C,KAAK,CAAC,QAAQ,IAAI,sBAAsB,CACzC,CAAC;QAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,iGAAiG;QACjG,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}