human-to-code 0.0.1 → 0.1.2

package/dist/patch.js

@@ -0,0 +1,394 @@
+/**
+ * Constrained patch validation and atomic application.
+ *
+ * Model output is never applied as a shell patch. Every operation is checked
+ * against the repository root, its exact base hash, and an explicit scope.
+ */
+import { chmod, copyFile, lstat, mkdir, mkdtemp, readFile, rename, rm, unlink, writeFile, } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep, win32, } from "node:path";
+import { randomUUID } from "node:crypto";
+import { hashCanonical, sha256Text, validatePatchSetV1 } from "./contracts.js";
+const DEFAULT_MAX_OPERATIONS = 200;
+const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
+const HARD_PROTECTED_NAMES = new Set([
+    ".git",
+    ".hg",
+    ".svn",
+    "node_modules",
+    "secrets.human",
+    "human-to-code.config.json",
+    ".npmrc",
+    ".yarnrc",
+    ".yarnrc.yml",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials",
+    "credentials",
+    "credentials.json",
+    "service-account.json",
+    "kubeconfig",
+]);
+const HARD_PROTECTED_PREFIXES = [".human-to-code/"];
+export class PatchSafetyError extends Error {
+    code;
+    details;
+    constructor(code, message, details = []) {
+        super(message);
+        this.name = "PatchSafetyError";
+        this.code = code;
+        this.details = details;
+    }
+}
+function toPosix(value) {
+    return value.split(/[\\/]/).join("/");
+}
+export function normalizePatchPath(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new PatchSafetyError("INVALID_PATH", "Patch paths must be non-empty strings.");
+    }
+    if (value.includes("\0") || isAbsolute(value) || win32.isAbsolute(value)) {
+        throw new PatchSafetyError("PATH_ESCAPE", `Unsafe patch path: ${JSON.stringify(value)}.`);
+    }
+    const normalized = posix.normalize(toPosix(value));
+    if (normalized === "." ||
+        normalized === ".." ||
+        normalized.startsWith("../") ||
+        normalized.includes("/../") ||
+        normalized.startsWith("/")) {
+        throw new PatchSafetyError("PATH_ESCAPE", `Patch path escapes the root: ${value}.`);
+    }
+    const segments = normalized.split("/");
+    if (segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+        throw new PatchSafetyError("INVALID_PATH", `Patch path is not canonical: ${value}.`);
+    }
+    return normalized;
+}
+function isPrefixMatch(path, rule) {
+    const normalizedRule = normalizePatchPath(rule.endsWith("/") ? rule.slice(0, -1) : rule);
+    if (normalizedRule.includes("*")) {
+        const escaped = normalizedRule.replace(/[.+^${}()|[\]\\]/gu, "\\$&");
+        const expression = escaped.replaceAll("**", "\0").replaceAll("*", "[^/]*").replaceAll("\0", ".*");
+        return new RegExp(`^${expression}(?:/.*)?$`, "u").test(path);
+    }
+    return path === normalizedRule || path.startsWith(`${normalizedRule}/`);
+}
+function assertAllowedPath(path, policy) {
+    const parts = path.split("/");
+    const sensitiveName = (part) => {
+        const lower = part.toLowerCase();
+        return HARD_PROTECTED_NAMES.has(lower)
+            || /^\.env(?:\..*)?$/iu.test(part)
+            || /^(?:id_rsa|id_dsa|id_ecdsa|id_ed25519)(?:\..*)?$/iu.test(part)
+            || /\.(?:pem|key|p12|pfx|jks|keystore)$/iu.test(part)
+            || /^(?:credentials?|secrets?)(?:\..*)?$/iu.test(part);
+    };
+    const cargoCredential = parts.some((part, index) => part.toLowerCase() === ".cargo" && /^credentials(?:\.toml)?$/iu.test(parts[index + 1] ?? ""));
+    const dockerCredential = parts.some((part, index) => part.toLowerCase() === ".docker" && (parts[index + 1] ?? "").toLowerCase() === "config.json");
+    if (parts.some(sensitiveName) || cargoCredential || dockerCredential) {
+        throw new PatchSafetyError("PROTECTED_PATH", `Patch targets protected path: ${path}.`);
+    }
+    if (HARD_PROTECTED_PREFIXES.some((prefix) => path.startsWith(prefix))) {
+        throw new PatchSafetyError("PROTECTED_PATH", `Patch targets protected path: ${path}.`);
+    }
+    if ((policy.protectedPaths ?? []).some((rule) => isPrefixMatch(path, rule))) {
+        throw new PatchSafetyError("PROTECTED_PATH", `Patch targets configured protected path: ${path}.`);
+    }
+    const allowed = policy.allowedPaths;
+    if (allowed && allowed.length > 0 && !allowed.some((rule) => isPrefixMatch(path, rule))) {
+        throw new PatchSafetyError("OUT_OF_SCOPE", `Patch path is outside the contract scope: ${path}.`);
+    }
+}
+function resolveInside(root, path) {
+    const abs = resolve(root, ...path.split("/"));
+    const rel = relative(root, abs);
+    if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new PatchSafetyError("PATH_ESCAPE", `Resolved path escapes the root: ${path}.`);
+    }
+    return abs;
+}
+async function assertSafeParents(root, absPath) {
+    let cursor = dirname(absPath);
+    const rootResolved = resolve(root);
+    while (cursor !== rootResolved) {
+        const rel = relative(rootResolved, cursor);
+        if (rel === ".." || rel.startsWith(`..${sep}`)) {
+            throw new PatchSafetyError("PATH_ESCAPE", `Parent directory escapes root: ${absPath}.`);
+        }
+        try {
+            const info = await lstat(cursor);
+            if (info.isSymbolicLink()) {
+                throw new PatchSafetyError("SYMLINK_ESCAPE", `Patch parent is a symlink: ${toPosix(rel)}.`);
+            }
+            if (!info.isDirectory()) {
+                throw new PatchSafetyError("INVALID_PATH", `Patch parent is not a directory: ${toPosix(rel)}.`);
+            }
+        }
+        catch (error) {
+            if (error instanceof PatchSafetyError)
+                throw error;
+            const code = error.code;
+            if (code !== "ENOENT")
+                throw error;
+        }
+        cursor = dirname(cursor);
+    }
+}
+async function readSafeRegularFile(absPath, path) {
+    let info;
+    try {
+        info = await lstat(absPath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new PatchSafetyError("MISSING_BASE", `Patch base file does not exist: ${path}.`);
+        }
+        throw error;
+    }
+    if (info.isSymbolicLink()) {
+        throw new PatchSafetyError("SYMLINK_ESCAPE", `Patch target is a symlink: ${path}.`);
+    }
+    if (!info.isFile()) {
+        throw new PatchSafetyError("INVALID_TARGET", `Patch target is not a regular file: ${path}.`);
+    }
+    if (info.nlink > 1) {
+        throw new PatchSafetyError("HARDLINK_ESCAPE", `Patch target has multiple hard links: ${path}.`);
+    }
+    const bytes = await readFile(absPath);
+    if (bytes.includes(0)) {
+        throw new PatchSafetyError("BINARY_TARGET", `Patch target appears binary: ${path}.`);
+    }
+    return { text: bytes.toString("utf8"), mode: info.mode & 0o777 };
+}
+function assertBaseHash(path, text, expected) {
+    const actual = sha256Text(text);
+    if (actual !== expected) {
+        throw new PatchSafetyError("STALE_BASE", `Patch base hash does not match ${path}.`, [`expected=${expected}`, `actual=${actual}`]);
+    }
+}
+function uniqueOccurrence(haystack, needle) {
+    if (needle.length === 0)
+        return -1;
+    const first = haystack.indexOf(needle);
+    if (first < 0)
+        return -1;
+    return haystack.indexOf(needle, first + 1) < 0 ? first : -2;
+}
+export function computePatchSnapshotHash(operations) {
+    const bases = operations
+        .map((operation) => {
+        if (operation.kind === "create")
+            return { path: normalizePatchPath(operation.path), hash: null };
+        if (operation.kind === "rename") {
+            return {
+                path: normalizePatchPath(operation.from),
+                destination: normalizePatchPath(operation.path),
+                hash: operation.baseHash,
+            };
+        }
+        return { path: normalizePatchPath(operation.path), hash: operation.baseHash };
+    })
+        .sort((a, b) => a.path.localeCompare(b.path));
+    return hashCanonical(bases);
+}
+export async function preparePatch(rootInput, patch, policy = {}) {
+    const root = resolve(rootInput);
+    const rootInfo = await lstat(root).catch((error) => {
+        throw new PatchSafetyError("INVALID_ROOT", `Cannot inspect patch root: ${String(error)}.`);
+    });
+    if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) {
+        throw new PatchSafetyError("INVALID_ROOT", "Patch root must be a real directory.");
+    }
+    if (patch.schemaVersion !== 1 || !Array.isArray(patch.operations)) {
+        throw new PatchSafetyError("INVALID_PATCH", "PatchSetV1 schema is invalid.");
+    }
+    try {
+        validatePatchSetV1(patch);
+    }
+    catch (error) {
+        throw new PatchSafetyError("INVALID_PATCH", error instanceof Error ? error.message : String(error));
+    }
+    const maxOperations = policy.maxOperations ?? DEFAULT_MAX_OPERATIONS;
+    if (patch.operations.length === 0 || patch.operations.length > maxOperations) {
+        throw new PatchSafetyError("PATCH_SIZE", `Patch must contain between 1 and ${maxOperations} operations.`);
+    }
+    if (!/^[a-f0-9]{64}$/u.test(patch.snapshotHash)) {
+        throw new PatchSafetyError("INVALID_SNAPSHOT", "Patch snapshot hash is not a SHA-256 digest.");
+    }
+    if (policy.expectedSnapshotHash !== undefined && patch.snapshotHash !== policy.expectedSnapshotHash) {
+        throw new PatchSafetyError("INVALID_SNAPSHOT", "Patch is bound to a different workspace snapshot.");
+    }
+    const normalizedKeys = new Set();
+    const claimedPaths = new Set();
+    for (const operation of patch.operations) {
+        const paths = operation.kind === "rename" ? [operation.from, operation.path] : [operation.path];
+        for (const rawPath of paths) {
+            const path = normalizePatchPath(rawPath);
+            assertAllowedPath(path, policy);
+            const key = path.toLocaleLowerCase("en-US");
+            if (normalizedKeys.has(key) || claimedPaths.has(path)) {
+                throw new PatchSafetyError("PATH_COLLISION", `Patch contains a duplicate or case-colliding path: ${path}.`);
+            }
+            normalizedKeys.add(key);
+            claimedPaths.add(path);
+        }
+    }
+    const prepared = [];
+    let changedBytes = 0;
+    for (const operation of patch.operations) {
+        const path = normalizePatchPath(operation.path);
+        const absPath = resolveInside(root, path);
+        await assertSafeParents(root, absPath);
+        if (operation.kind === "create") {
+            try {
+                await lstat(absPath);
+                throw new PatchSafetyError("TARGET_EXISTS", `Create target already exists: ${path}.`);
+            }
+            catch (error) {
+                if (error instanceof PatchSafetyError)
+                    throw error;
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+            const mode = 0o644;
+            changedBytes += Buffer.byteLength(operation.content);
+            prepared.push({ kind: "create", path, absPath, content: operation.content, mode });
+            continue;
+        }
+        if (operation.kind === "edit") {
+            const current = await readSafeRegularFile(absPath, path);
+            assertBaseHash(path, current.text, operation.baseHash);
+            const index = uniqueOccurrence(current.text, operation.oldText);
+            if (index === -1) {
+                throw new PatchSafetyError("EDIT_MISMATCH", `Edit source text was not found in ${path}.`);
+            }
+            if (index === -2) {
+                throw new PatchSafetyError("EDIT_AMBIGUOUS", `Edit source text is not unique in ${path}.`);
+            }
+            const after = current.text.slice(0, index) +
+                operation.newText +
+                current.text.slice(index + operation.oldText.length);
+            changedBytes += Buffer.byteLength(operation.newText) + Buffer.byteLength(operation.oldText);
+            prepared.push({ kind: "edit", path, absPath, before: current.text, after, mode: current.mode });
+            continue;
+        }
+        if (operation.kind === "delete") {
+            if (!policy.allowDeletes) {
+                throw new PatchSafetyError("DELETE_NOT_ALLOWED", `Delete was not authorized: ${path}.`);
+            }
+            const current = await readSafeRegularFile(absPath, path);
+            assertBaseHash(path, current.text, operation.baseHash);
+            changedBytes += Buffer.byteLength(current.text);
+            prepared.push({ kind: "delete", path, absPath, before: current.text, mode: current.mode });
+            continue;
+        }
+        if (!policy.allowRenames) {
+            throw new PatchSafetyError("RENAME_NOT_ALLOWED", `Rename was not authorized: ${operation.from}.`);
+        }
+        const from = normalizePatchPath(operation.from);
+        const absFrom = resolveInside(root, from);
+        await assertSafeParents(root, absFrom);
+        const current = await readSafeRegularFile(absFrom, from);
+        assertBaseHash(from, current.text, operation.baseHash);
+        try {
+            await lstat(absPath);
+            throw new PatchSafetyError("TARGET_EXISTS", `Rename destination already exists: ${path}.`);
+        }
+        catch (error) {
+            if (error instanceof PatchSafetyError)
+                throw error;
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        changedBytes += Buffer.byteLength(current.text);
+        prepared.push({ kind: "rename", from, absFrom, path, absPath, before: current.text, mode: current.mode });
+    }
+    const maxChangedBytes = policy.maxChangedBytes ?? DEFAULT_MAX_BYTES;
+    if (changedBytes > maxChangedBytes) {
+        throw new PatchSafetyError("PATCH_SIZE", `Patch changes ${changedBytes} bytes, exceeding the ${maxChangedBytes}-byte limit.`);
+    }
+    return { root, patch, operations: prepared, changedBytes };
+}
+async function writeAtomic(absPath, content, mode) {
+    await mkdir(dirname(absPath), { recursive: true });
+    const temporary = join(dirname(absPath), `.${basename(absPath)}.h2c-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, content, { encoding: "utf8", flag: "wx", mode });
+        await chmod(temporary, mode);
+        await rename(temporary, absPath);
+    }
+    finally {
+        await rm(temporary, { force: true }).catch(() => undefined);
+    }
+}
+/**
+ * Apply an already constrained PatchSet. On any failure, touched paths are
+ * restored to their original content and modes before the error is rethrown.
+ */
+export async function applyPatchAtomic(root, patch, policy = {}) {
+    const prepared = await preparePatch(root, patch, policy);
+    const backupRoot = await mkdtemp(join(tmpdir(), "human-to-code-rollback-"));
+    const applied = [];
+    const appliedIndexes = [];
+    try {
+        for (let index = 0; index < prepared.operations.length; index++) {
+            const operation = prepared.operations[index];
+            const backup = join(backupRoot, String(index));
+            if (operation.kind === "create") {
+                await writeAtomic(operation.absPath, operation.content, operation.mode);
+                applied.push(operation.path);
+                appliedIndexes.push(index);
+            }
+            else if (operation.kind === "edit") {
+                await copyFile(operation.absPath, backup, fsConstants.COPYFILE_EXCL);
+                await writeAtomic(operation.absPath, operation.after, operation.mode);
+                applied.push(operation.path);
+                appliedIndexes.push(index);
+            }
+            else if (operation.kind === "delete") {
+                await copyFile(operation.absPath, backup, fsConstants.COPYFILE_EXCL);
+                await unlink(operation.absPath);
+                applied.push(operation.path);
+                appliedIndexes.push(index);
+            }
+            else {
+                await copyFile(operation.absFrom, backup, fsConstants.COPYFILE_EXCL);
+                await mkdir(dirname(operation.absPath), { recursive: true });
+                await rename(operation.absFrom, operation.absPath);
+                applied.push(`${operation.from} -> ${operation.path}`);
+                appliedIndexes.push(index);
+            }
+        }
+    }
+    catch (error) {
+        for (const index of appliedIndexes.reverse()) {
+            const operation = prepared.operations[index];
+            const backup = join(backupRoot, String(index));
+            try {
+                if (operation.kind === "create") {
+                    await rm(operation.absPath, { force: true });
+                }
+                else if (operation.kind === "edit" || operation.kind === "delete") {
+                    await copyFile(backup, operation.absPath);
+                    await chmod(operation.absPath, operation.mode);
+                }
+                else {
+                    await rm(operation.absPath, { force: true });
+                    await copyFile(backup, operation.absFrom);
+                    await chmod(operation.absFrom, operation.mode);
+                }
+            }
+            catch {
+                // Preserve the original failure. Rollback failures are surfaced in the
+                // error message instead of risking a second exception hiding it.
+            }
+        }
+        throw new PatchSafetyError("APPLY_FAILED", `Patch application failed and was rolled back: ${String(error)}.`);
+    }
+    finally {
+        await rm(backupRoot, { recursive: true, force: true });
+    }
+    return { applied, patchHash: hashCanonical(patch) };
+}
+//# sourceMappingURL=patch.js.map

package/dist/patch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patch.js","sourceRoot":"","sources":["../src/patch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,EACL,QAAQ,EACR,KAAK,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,MAAM,EACN,EAAE,EACF,MAAM,EACN,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EACL,QAAQ,EACR,OAAO,EACP,UAAU,EACV,IAAI,EACJ,KAAK,EACL,QAAQ,EACR,OAAO,EACP,GAAG,EACH,KAAK,GACN,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE/E,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,iBAAiB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,MAAM;IACN,KAAK;IACL,MAAM;IACN,cAAc;IACd,eAAe;IACf,2BAA2B;IAC3B,QAAQ;IACR,SAAS;IACT,aAAa;IACb,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,aAAa;IACb,kBAAkB;IAClB,sBAAsB;IACtB,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,iBAAiB,CAAC,CAAC;AA2CpD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACb,OAAO,CAAW;IAE3B,YAAY,IAAY,EAAE,OAAe,EAAE,UAAoB,EAAE;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAOD,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,wCAAwC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,IACE,UAAU,KAAK,GAAG;QAClB,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,gCAAgC,KAAK,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,gCAAgC,KAAK,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClG,OAAO,IAAI,MAAM,CAAC,IAAI,UAAU,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAmB;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC;eACjC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;eAC/B,oDAAoD,CAAC,IAAI,CAAC,IAAI,CAAC;eAC/D,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;eAClD,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClJ,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,CAAC;IACnJ,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,eAAe,IAAI,gBAAgB,EAAE,CAAC;QACrE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iCAAiC,IAAI,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,iCAAiC,IAAI,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,4CAA4C,IAAI,GAAG,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC;IACpC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,6CAA6C,IAAI,GAAG,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,mCAAmC,IAAI,GAAG,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IAC5D,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,kCAAkC,OAAO,GAAG,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,8BAA8B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,oCAAoC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACrC,CAAC;QACD,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAe,EAAE,IAAY;IAC9D,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,mCAAmC,IAAI,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,8BAA8B,IAAI,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,uCAAuC,IAAI,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,yCAAyC,IAAI,GAAG,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gCAAgC,IAAI,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,QAAgB;IAClE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CACxB,YAAY,EACZ,kCAAkC,IAAI,GAAG,EACzC,CAAC,YAAY,QAAQ,EAAE,EAAE,UAAU,MAAM,EAAE,CAAC,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAqC;IAC5E,MAAM,KAAK,GAAG,UAAU;SACrB,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QACjB,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjG,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO;gBACL,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC;gBACxC,WAAW,EAAE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC/C,IAAI,EAAE,SAAS,CAAC,QAAQ;aACzB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC;IAChF,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,KAAiB,EACjB,SAAsB,EAAE;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC1D,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+BAA+B,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,sBAAsB,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAC7E,MAAM,IAAI,gBAAgB,CACxB,YAAY,EACZ,oCAAoC,aAAa,cAAc,CAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACpG,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,mDAAmD,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChG,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,sDAAsD,IAAI,GAAG,CAAC,CAAC;YAC9G,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEvC,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,iCAAiC,IAAI,GAAG,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,gBAAgB;oBAAE,MAAM,KAAK,CAAC;gBACnD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YACtE,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC;YACnB,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzD,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;YAChE,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,qCAAqC,IAAI,GAAG,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,qCAAqC,IAAI,GAAG,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,KAAK,GACT,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;gBAC5B,SAAS,CAAC,OAAO;gBACjB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvD,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAC5F,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,8BAA8B,IAAI,GAAG,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzD,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;YACvD,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3F,SAAS;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,EAAE,8BAA8B,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,IAAI,GAAG,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QACD,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,iBAAiB,CAAC;IACpE,IAAI,YAAY,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,gBAAgB,CACxB,YAAY,EACZ,iBAAiB,YAAY,yBAAyB,eAAe,cAAc,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,OAAe,EAAE,IAAY;IACvE,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,KAAiB,EACjB,SAAsB,EAAE;IAExB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,IAAI,CAAC;QACH,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/C,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrC,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;gBACrE,MAAM,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;gBACrE,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;gBACrE,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7D,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvD,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,KAAK,IAAI,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,CAAC;qBAAM,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACpE,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC1C,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACjD,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7C,MAAM,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC1C,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACjD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;gBACvE,iEAAiE;YACnE,CAAC;QACH,CAAC;QACD,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,iDAAiD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;AACtD,CAAC"}

package/dist/pinned-http.d.ts

@@ -0,0 +1,15 @@
+/** Dependency-free HTTP(S) transport whose socket is pinned to a vetted IP. */
+export interface PinnedDestination {
+    /** Original hostname used for Host and TLS certificate verification. */
+    hostname: string;
+    /** Exact vetted address used by the socket; no second DNS lookup occurs. */
+    address: string;
+    family: 4 | 6;
+}
+/**
+ * GET or POST using a socket connected to `destination.address`. HTTPS
+ * retains the original hostname for SNI and certificate identity checks.
+ * Environment proxy variables and the OS resolver are intentionally bypassed.
+ */
+export declare function pinnedHttpFetch(rawUrl: string, init: RequestInit, destination: PinnedDestination): Promise<Response>;
+//# sourceMappingURL=pinned-http.d.ts.map

package/dist/pinned-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-http.d.ts","sourceRoot":"","sources":["../src/pinned-http.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAc/E,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;CACf;AAyED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,WAAW,EACjB,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAwFnB"}

package/dist/pinned-http.js

@@ -0,0 +1,170 @@
+/** Dependency-free HTTP(S) transport whose socket is pinned to a vetted IP. */
+import { request as httpRequest, } from "node:http";
+import { request as httpsRequest, } from "node:https";
+import { isIP } from "node:net";
+import { Readable } from "node:stream";
+function abortError() {
+    return new DOMException("The provider request was aborted.", "AbortError");
+}
+function requestBody(init, method) {
+    if (method === "GET") {
+        if (init.body !== undefined && init.body !== null) {
+            throw new TypeError("Pinned GET requests must not contain a request body.");
+        }
+        return Buffer.alloc(0);
+    }
+    if (typeof init.body === "string")
+        return Buffer.from(init.body, "utf8");
+    if (init.body instanceof Uint8Array)
+        return Buffer.from(init.body);
+    if (init.body === undefined || init.body === null)
+        return Buffer.alloc(0);
+    throw new TypeError("Pinned provider transport accepts only bounded string or byte request bodies.");
+}
+function responseHeaders(message) {
+    const headers = new Headers();
+    for (let index = 0; index < message.rawHeaders.length; index += 2) {
+        const name = message.rawHeaders[index];
+        const value = message.rawHeaders[index + 1];
+        if (name !== undefined && value !== undefined)
+            headers.append(name, value);
+    }
+    return headers;
+}
+function webResponse(message) {
+    const status = message.statusCode;
+    if (status === undefined || status < 200 || status > 599) {
+        message.destroy();
+        throw new Error("Provider returned an unsupported HTTP status.");
+    }
+    const hasNoBody = status === 204 || status === 205 || status === 304;
+    const body = hasNoBody
+        ? null
+        : Readable.toWeb(message);
+    return new Response(body, {
+        status,
+        statusText: message.statusMessage ?? "",
+        headers: responseHeaders(message),
+    });
+}
+function normalizedHeaders(url, init, body, method) {
+    const source = new Headers(init.headers);
+    const headers = {};
+    for (const [name, value] of source.entries())
+        headers[name] = value;
+    for (const name of [
+        "proxy-authorization",
+        "proxy-connection",
+        "te",
+        "trailer",
+        "transfer-encoding",
+        "upgrade",
+    ]) {
+        delete headers[name];
+    }
+    // Host is derived from the reviewed URL and cannot be supplied by a caller.
+    headers.host = url.host;
+    if (method === "POST")
+        headers["content-length"] = String(body.byteLength);
+    else
+        delete headers["content-length"];
+    headers.connection = "close";
+    return headers;
+}
+/**
+ * GET or POST using a socket connected to `destination.address`. HTTPS
+ * retains the original hostname for SNI and certificate identity checks.
+ * Environment proxy variables and the OS resolver are intentionally bypassed.
+ */
+export function pinnedHttpFetch(rawUrl, init, destination) {
+    const url = new URL(rawUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        return Promise.reject(new TypeError("Pinned provider transport supports only HTTP(S)."));
+    }
+    if (url.username !== "" || url.password !== "" || url.hash !== "") {
+        return Promise.reject(new TypeError("Pinned HTTP URLs must not contain credentials or fragments."));
+    }
+    if (destination.family !== isIP(destination.address)) {
+        return Promise.reject(new TypeError("Pinned provider destination address/family is invalid."));
+    }
+    if (destination.hostname !== url.hostname.replace(/^\[|\]$/gu, "").replace(/\.$/u, "").toLowerCase()) {
+        return Promise.reject(new TypeError("Pinned provider hostname does not match its reviewed URL."));
+    }
+    const method = (init.method ?? "GET").toUpperCase();
+    if (method !== "GET" && method !== "POST") {
+        return Promise.reject(new TypeError("Pinned HTTP transport permits only GET or POST."));
+    }
+    let body;
+    try {
+        body = requestBody(init, method);
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    const signal = init.signal ?? undefined;
+    if (signal?.aborted)
+        return Promise.reject(abortError());
+    const headers = normalizedHeaders(url, init, body, method);
+    const port = url.port === "" ? (url.protocol === "https:" ? 443 : 80) : Number(url.port);
+    const common = {
+        protocol: url.protocol,
+        hostname: destination.address,
+        family: destination.family,
+        port,
+        method,
+        path: `${url.pathname}${url.search}`,
+        headers,
+        agent: false,
+        maxHeaderSize: 64 * 1024,
+        setHost: false,
+    };
+    return new Promise((resolveResponse, reject) => {
+        let message;
+        let settled = false;
+        const finishError = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanupBeforeResponse();
+            reject(error);
+        };
+        const onAbort = () => {
+            const error = abortError();
+            message?.destroy(error);
+            request.destroy(error);
+        };
+        const cleanupBeforeResponse = () => {
+            signal?.removeEventListener("abort", onAbort);
+        };
+        const onResponse = (incoming) => {
+            message = incoming;
+            if (signal?.aborted) {
+                onAbort();
+                return;
+            }
+            // Keep the abort listener until the response body closes so timeout and
+            // caller cancellation also stop a stalled download.
+            incoming.once("close", cleanupBeforeResponse);
+            try {
+                const result = webResponse(incoming);
+                settled = true;
+                resolveResponse(result);
+            }
+            catch (error) {
+                finishError(error instanceof Error ? error : new Error(String(error)));
+            }
+        };
+        const request = url.protocol === "https:"
+            ? httpsRequest({
+                ...common,
+                // For DNS names this controls both SNI and certificate hostname
+                // validation. IP-literal endpoints are verified against their IP SAN.
+                ...(isIP(destination.hostname) === 0 ? { servername: destination.hostname } : {}),
+            }, onResponse)
+            : httpRequest(common, onResponse);
+        request.once("error", finishError);
+        signal?.addEventListener("abort", onAbort, { once: true });
+        request.end(body);
+    });
+}
+//# sourceMappingURL=pinned-http.js.map

package/dist/pinned-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-http.js","sourceRoot":"","sources":["../src/pinned-http.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EACL,OAAO,IAAI,WAAW,GAGvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,OAAO,IAAI,YAAY,GAExB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAUvC,SAAS,UAAU;IACjB,OAAO,IAAI,YAAY,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,IAAiB,EAAE,MAAsB;IAC5D,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,IAAI,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,SAAS,CAAC,+EAA+E,CAAC,CAAC;AACvG,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,OAAwB;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QACzD,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;IACrE,MAAM,IAAI,GAAG,SAAS;QACpB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAA+B,CAAC;IAC1D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QACvC,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAQ,EACR,IAAiB,EACjB,IAAY,EACZ,MAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACpE,KAAK,MAAM,IAAI,IAAI;QACjB,qBAAqB;QACrB,kBAAkB;QAClB,IAAI;QACJ,SAAS;QACT,mBAAmB;QACnB,SAAS;KACV,EAAE,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,4EAA4E;IAC5E,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACxB,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;;QACtE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtC,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,IAAiB,EACjB,WAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QAClE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,WAAW,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrG,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,2DAA2D,CAAC,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACxC,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,MAAM,GAAuB;QACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,WAAW,CAAC,OAAO;QAC7B,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,IAAI;QACJ,MAAM;QACN,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;QACpC,OAAO;QACP,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,EAAE,GAAG,IAAI;QACxB,OAAO,EAAE,KAAK;KACf,CAAC;IAEF,OAAO,IAAI,OAAO,CAAW,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE;QACvD,IAAI,OAAoC,CAAC;QACzC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,WAAW,GAAG,CAAC,KAAY,EAAQ,EAAE;YACzC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,qBAAqB,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACxB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC;QACF,MAAM,qBAAqB,GAAG,GAAS,EAAE;YACvC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,CAAC,QAAyB,EAAQ,EAAE;YACrD,OAAO,GAAG,QAAQ,CAAC;YACnB,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,wEAAwE;YACxE,oDAAoD;YACpD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;gBACrC,OAAO,GAAG,IAAI,CAAC;gBACf,eAAe,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACvC,CAAC,CAAC,YAAY,CAAC;gBACX,GAAI,MAA8B;gBAClC,gEAAgE;gBAChE,sEAAsE;gBACtE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClF,EAAE,UAAU,CAAC;YAChB,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/planner.d.ts

@@ -0,0 +1,30 @@
+/** Deterministic creation and loading of reviewed ChangeContractV1 artifacts. */
+import type { ProjectProfileV1 } from "./analyzer-types.ts";
+import { type ChangeContractV1 } from "./contracts.ts";
+import type { SourceFile } from "./types.ts";
+export declare class PlanningError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export interface DraftContractResult {
+    contract: ChangeContractV1;
+    contractPath: string;
+    needsReview: true;
+}
+export declare function contractPathForSource(root: string, source: SourceFile): string;
+/**
+ * Create a deliberately unreviewed contract. It is useful as a deterministic
+ * starting point, but the material review question prevents generation until
+ * a human confirms target, scope, acceptance criteria, and elevated risks.
+ */
+export declare function createDraftContract(root: string, source: SourceFile, profile: ProjectProfileV1): Promise<DraftContractResult>;
+export declare function writeDraftContract(result: DraftContractResult): Promise<void>;
+export interface LoadedContract {
+    contract: ChangeContractV1;
+    contractPath: string;
+    hash: string;
+}
+/** Load a reviewed contract and bind it to the current source and analysis. */
+export declare function loadReviewedContract(root: string, contractPathInput: string, profile: ProjectProfileV1): Promise<LoadedContract>;
+export declare function contractRelativeToRoot(root: string, path: string): string;
+//# sourceMappingURL=planner.d.ts.map