pm-ops 2026.10.6 → 2026.10.13

package/dist/release-completeness.d.ts

@@ -0,0 +1,209 @@
+import type { VerifierResult } from "./shell-scan.ts";
+/** A release tag matches a calendar version, optionally with a `-N` suffix. */
+export declare const RELEASE_TAG_PATTERN: RegExp;
+/**
+ * Decide whether a tag is a release tag rather than an arbitrary ref.
+ *
+ * Only release tags are anchored: a non-release tag is not part of the release
+ * triple contract and is ignored, so an unrelated tag cannot fail this gate.
+ *
+ * @param tag - A git tag name.
+ * @returns True when the tag spells a calendar release version.
+ */
+export declare function isReleaseTag(tag: string): boolean;
+/**
+ * Convert a release tag to the npm version string it corresponds to.
+ *
+ * A tag zero-pads the month and day (`v2026.08.31`) while npm stores them
+ * without padding (`2026.8.31`), and both may carry a `-N` suffix
+ * (`v2026.07.14-1` -> `2026.7.14-1`). The components are parsed as numbers so
+ * the leading zeros drop, which is also what makes the two spellings compare
+ * equal.
+ *
+ * @param tag - A release tag name, with or without a leading `v`.
+ * @returns The npm version string for that tag.
+ */
+export declare function tagToNpmVersion(tag: string): string;
+/**
+ * Convert a published npm version to the release tag it corresponds to.
+ *
+ * This is the inverse of {@link tagToNpmVersion}: it re-pads the month and day
+ * to two digits and restores the leading `v`, so `2026.7.14-1` becomes
+ * `v2026.07.14-1`. The year is already four digits, so padding to two leaves it
+ * unchanged.
+ *
+ * @param version - A published npm version string.
+ * @returns The release tag name for that version.
+ */
+export declare function npmVersionToTag(version: string): string;
+/**
+ * Extract the repository URL from a `package.json` `repository` field.
+ *
+ * The field may be a shorthand string or an object with a `url` key, and both
+ * forms occur in this fleet, so the two are reconciled here rather than at
+ * every caller.
+ *
+ * @param repo - The raw `repository` value from a manifest.
+ * @returns The URL string, or an empty string when none is declared.
+ */
+export declare function repositoryUrl(repo: string | {
+    url?: string;
+} | undefined): string;
+/**
+ * Derive the `owner/name` slug from a repository URL.
+ *
+ * Accepts every spelling npm and git record: `git+https://github.com/o/n.git`,
+ * `https://github.com/o/n`, `git@github.com:o/n.git`, and the `github:o/n`
+ * shorthand. A URL that names no GitHub host yields an empty string so the
+ * caller can fail closed rather than querying the wrong registry.
+ *
+ * The host check requires `hostname === "github.com"` exactly rather than a
+ * substring test. A regex that merely looks for `github` anywhere in the URL
+ * accepts `https://notgithub.com/owner/name` and
+ * `https://evil.example/github:owner/name`, directing the verifier at the
+ * wrong repository. The HTTPS form is parsed with `new URL` so the hostname is
+ * compared precisely; the SSH (`git@github.com:owner/name`) and shorthand
+ * (`github:owner/name`) forms are not valid URLs and are matched with anchored
+ * patterns that require the `github.com` host literally.
+ *
+ * @param url - The repository URL to parse.
+ * @returns The `owner/name` slug, or an empty string when no GitHub host is named.
+ */
+export declare function repoSlugFromUrl(url: string): string;
+/**
+ * Read the package name declared in a manifest.
+ *
+ * @param root - Repository root containing `package.json`.
+ * @returns The `name` field, or an empty string when the manifest lacks one.
+ */
+export declare function packageNameFromManifest(root: string): string;
+/**
+ * Split command output into non-empty, trimmed lines.
+ *
+ * Used for `git tag` and `gh api ... releases` output, both of which are one entry
+ * per line. A trailing newline produces no empty entry.
+ *
+ * @param output - Raw command output.
+ * @returns The non-empty trimmed lines.
+ */
+export declare function parseLines(output: string): string[];
+/**
+ * Parse the complete JSON array emitted by `npm view <pkg> versions --json`.
+ *
+ * Reject malformed JSON and unreadable entries instead of dropping them. The
+ * caller must report an unavailable inventory separately from an empty one;
+ * otherwise a registry failure falsely describes existing releases as absent.
+ *
+ * @param output - Raw `npm view ... --json` output.
+ * @returns Every version string from a successfully decoded inventory.
+ * @throws When the response is not JSON or not an array of non-empty strings.
+ */
+export declare function parseNpmVersions(output: string): string[];
+/**
+ * Audit three release lists for completeness.
+ *
+ * A release tag is the anchor. For each release tag the check requires both a
+ * matching published npm version and a matching GitHub Release, and it refuses
+ * orphan npm versions and orphan GitHub Releases whose corresponding tag is
+ * missing, so a triple is incomplete in any direction. Non-release tags are
+ * ignored: they are not part of the release contract.
+ *
+ * An empty release-tag set is a failure rather than a pass: a scan that finds
+ * no release tags is either pointed at the wrong repository or has outlived
+ * the releases it guards, and both look identical to a clean result unless
+ * said out loud.
+ *
+ * @param tags - Git tag names.
+ * @param npmVersions - Published npm version strings.
+ * @param githubReleases - GitHub Release tag names.
+ * @returns Failures and per-list notes.
+ */
+export declare function auditReleaseCompleteness(tags: readonly string[], npmVersions: readonly string[], githubReleases: readonly string[]): VerifierResult;
+/** A source of the three release lists, injectable so the suite is hermetic. */
+export interface CompletenessFetcher {
+    /** Git tag names in the repository at `root`. */
+    tags(root: string): string[];
+    /** The `origin` remote URL of the repository at `root`. */
+    remoteUrl(root: string): string;
+    /** Published npm version strings for `pkgName`. */
+    npmVersions(pkgName: string): string[];
+    /** GitHub Release tag names for the `owner/name` slug. */
+    githubReleases(slug: string): string[];
+    /**
+     * Whether the GitHub Release of one tag exists, read by its tag. The list
+     * endpoint can lag a release created seconds earlier; this read confirms a
+     * tag the list lacks before the audit calls it missing.
+     */
+    githubReleaseForTag(slug: string, tag: string): boolean;
+}
+/**
+ * Run a child process and return its stdout as a string.
+ *
+ * The default executor used by {@link makeFetcher}; exported so the suite can
+ * cover the real {@link execFileSync} call with a local command rather than the
+ * networked `npm`/`gh` invocations the fetcher builds.
+ *
+ * @param command - The program to run.
+ * @param args - Arguments to pass.
+ * @param options - Options such as `cwd`.
+ * @returns The process stdout, decoded as UTF-8.
+ */
+export declare function defaultExec(command: string, args: string[], options?: {
+    cwd?: string;
+}): string;
+/**
+ * Fetch all GitHub Release tag names for a slug, paginating through the API.
+ *
+ * `gh release list -L N` caps at N entries, so a repository with more than N
+ * releases silently omits the older ones. This function pages through the
+ * GitHub releases API 100 at a time until a page returns fewer than a full
+ * page, collecting every release so the completeness audit sees the full
+ * history rather than a truncated prefix. Raising a fixed cap reproduces the
+ * same defect later; paginating until the API reports no further pages does
+ * not.
+ *
+ * @param exec - The executor to run `gh` commands through.
+ * @param slug - The `owner/name` slug to query.
+ * @returns All GitHub Release tag names, in API order.
+ */
+export declare function fetchGithubReleasesPaginated(exec: (command: string, args: string[], options: {
+    cwd?: string;
+}) => string, slug: string): string[];
+/**
+ * Build a fetcher from an executor.
+ *
+ * Separating the executor from the parsing lets the suite cover every command
+ * construction and parser with an injected executor, while {@link defaultExec}
+ * is covered separately by a local process. The fetcher the release gate uses
+ * is built from {@link defaultExec}; the suite builds one from a mock.
+ *
+ * @param exec - The executor to run commands through.
+ * @returns A fetcher whose methods gather one release list each.
+ */
+export declare function makeFetcher(exec: (command: string, args: string[], options: {
+    cwd?: string;
+}) => string): CompletenessFetcher;
+/** The fetcher the release gate uses, built from the real executor. */
+export declare const realFetcher: CompletenessFetcher;
+/**
+ * Gather the three release lists and audit them only when all reads succeed.
+ *
+ * A failed read names its source and makes no absence claims from partial data.
+ * Missing package or repository identity is rejected before any registry read.
+ * A release tag missing from the GitHub Release list is confirmed by a read of
+ * that tag's release, because the list lags a release created moments earlier.
+ *
+ * @param root - Repository root to verify.
+ * @param fetcher - The source of the three lists.
+ * @returns Failures and notes for the repository.
+ */
+export declare function verify(root: string, fetcher: CompletenessFetcher): VerifierResult;
+/**
+ * Print a result and set a failing exit code when it failed.
+ *
+ * @param result - The audit outcome.
+ * @param write - Sink for the report lines.
+ * @param exit - Called with the process exit code when there were failures.
+ */
+export declare function report(result: VerifierResult, write: (line: string) => void, exit: (code: number) => void): void;
+//# sourceMappingURL=release-completeness.d.ts.map

package/dist/release-completeness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-completeness.d.ts","sourceRoot":"","sources":["../release-completeness.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,QAAkC,CAAC;AAEnE;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,MAAM,CAGjF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA4BnD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAEnD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,cAAc,EAAE,SAAS,MAAM,EAAE,GAChC,cAAc,CAuChB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,2DAA2D;IAC3D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,mDAAmD;IACnD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvC,0DAA0D;IAC1D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvC;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,MAAM,CAER;AAKD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,EAC5E,IAAI,EAAE,MAAM,GACX,MAAM,EAAE,CAiBV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,MAAM,GAAG,mBAAmB,CA4B7H;AAED,uEAAuE;AACvE,eAAO,MAAM,WAAW,EAAE,mBAA8C,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,cAAc,CA0BjF;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CACpB,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC7B,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B,IAAI,CAaN"}

package/dist/release-completeness.js

@@ -0,0 +1,402 @@
+/**
+ * Proves every release tag of this package is a complete release triple: a git
+ * tag, a published npm version, and a GitHub Release, all corresponding to one
+ * another.
+ *
+ * The release workflow tags a commit and publishes to npm in the same job, but
+ * the GitHub Release is a separate later step. When an earlier step failed -
+ * as the bun-install verification did for 14 days from 2026-08-17 onward - the
+ * job aborted before `Create GitHub release` ran, so tags and npm versions
+ * accumulated with no GitHub Release and nothing reported the gap. The
+ * publish-attestation and changelog-date gates both passed: the artifact was
+ * attested and the heading was dated correctly, yet the release was only
+ * two-thirds complete. This check closes that hole by requiring the third
+ * member of every release triple to exist.
+ *
+ * The analysis is separated from the I/O so the rules are driven by the suite
+ * against injected lists rather than only against this repository, which
+ * happens to satisfy them. A release tag is the anchor: for each one the
+ * check requires both a matching published npm version and a matching GitHub
+ * Release, and it also refuses orphan npm versions and orphan GitHub Releases
+ * whose corresponding tag is missing, so a triple is incomplete in any
+ * direction.
+ *
+ * @packageDocumentation
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+/** A release tag matches a calendar version, optionally with a `-N` suffix. */
+export const RELEASE_TAG_PATTERN = /^v\d{4}\.\d{2}\.\d{2}(-\d+)?$/;
+/**
+ * Decide whether a tag is a release tag rather than an arbitrary ref.
+ *
+ * Only release tags are anchored: a non-release tag is not part of the release
+ * triple contract and is ignored, so an unrelated tag cannot fail this gate.
+ *
+ * @param tag - A git tag name.
+ * @returns True when the tag spells a calendar release version.
+ */
+export function isReleaseTag(tag) {
+    return RELEASE_TAG_PATTERN.test(tag);
+}
+/**
+ * Convert a release tag to the npm version string it corresponds to.
+ *
+ * A tag zero-pads the month and day (`v2026.08.31`) while npm stores them
+ * without padding (`2026.8.31`), and both may carry a `-N` suffix
+ * (`v2026.07.14-1` -> `2026.7.14-1`). The components are parsed as numbers so
+ * the leading zeros drop, which is also what makes the two spellings compare
+ * equal.
+ *
+ * @param tag - A release tag name, with or without a leading `v`.
+ * @returns The npm version string for that tag.
+ */
+export function tagToNpmVersion(tag) {
+    const core = tag.startsWith("v") ? tag.slice(1) : tag;
+    const dash = core.indexOf("-");
+    const base = dash >= 0 ? core.slice(0, dash) : core;
+    const suffix = dash >= 0 ? core.slice(dash) : "";
+    const parts = base.split(".").map((part) => String(Number(part)));
+    return parts.join(".") + suffix;
+}
+/**
+ * Convert a published npm version to the release tag it corresponds to.
+ *
+ * This is the inverse of {@link tagToNpmVersion}: it re-pads the month and day
+ * to two digits and restores the leading `v`, so `2026.7.14-1` becomes
+ * `v2026.07.14-1`. The year is already four digits, so padding to two leaves it
+ * unchanged.
+ *
+ * @param version - A published npm version string.
+ * @returns The release tag name for that version.
+ */
+export function npmVersionToTag(version) {
+    const dash = version.indexOf("-");
+    const base = dash >= 0 ? version.slice(0, dash) : version;
+    const suffix = dash >= 0 ? version.slice(dash) : "";
+    const parts = base.split(".").map((part) => part.padStart(2, "0"));
+    return `v${parts.join(".")}${suffix}`;
+}
+/**
+ * Extract the repository URL from a `package.json` `repository` field.
+ *
+ * The field may be a shorthand string or an object with a `url` key, and both
+ * forms occur in this fleet, so the two are reconciled here rather than at
+ * every caller.
+ *
+ * @param repo - The raw `repository` value from a manifest.
+ * @returns The URL string, or an empty string when none is declared.
+ */
+export function repositoryUrl(repo) {
+    if (typeof repo === "string")
+        return repo;
+    return repo?.url ?? "";
+}
+/**
+ * Derive the `owner/name` slug from a repository URL.
+ *
+ * Accepts every spelling npm and git record: `git+https://github.com/o/n.git`,
+ * `https://github.com/o/n`, `git@github.com:o/n.git`, and the `github:o/n`
+ * shorthand. A URL that names no GitHub host yields an empty string so the
+ * caller can fail closed rather than querying the wrong registry.
+ *
+ * The host check requires `hostname === "github.com"` exactly rather than a
+ * substring test. A regex that merely looks for `github` anywhere in the URL
+ * accepts `https://notgithub.com/owner/name` and
+ * `https://evil.example/github:owner/name`, directing the verifier at the
+ * wrong repository. The HTTPS form is parsed with `new URL` so the hostname is
+ * compared precisely; the SSH (`git@github.com:owner/name`) and shorthand
+ * (`github:owner/name`) forms are not valid URLs and are matched with anchored
+ * patterns that require the `github.com` host literally.
+ *
+ * @param url - The repository URL to parse.
+ * @returns The `owner/name` slug, or an empty string when no GitHub host is named.
+ */
+export function repoSlugFromUrl(url) {
+    // Shorthand form: `github:owner/name`. Checked before URL parsing because
+    // `new URL("github:owner/name")` parses `github` as the protocol and an
+    // empty hostname, which would fall through to the URL branch and return ""
+    // for a valid shorthand.
+    const shorthand = /^github:([^/]+\/[^/]+?)(?:\.git)?\/?$/i.exec(url);
+    if (shorthand)
+        return shorthand[1];
+    // SSH form: `git@github.com:owner/name.git`. Not a URL, so it is matched
+    // with an anchored pattern that requires `github.com` literally.
+    const ssh = /^git@github\.com:([^/]+\/[^/]+?)(?:\.git)?\/?$/i.exec(url);
+    if (ssh)
+        return ssh[1];
+    // HTTPS form: `git+https://github.com/owner/name.git` etc. The `git+`
+    // prefix is stripped so `new URL` can parse the remaining `https://` URL.
+    // The hostname is compared exactly — a substring test accepts hostile hosts
+    // such as `notgithub.com`.
+    try {
+        const parsed = new URL(url.replace(/^git\+/i, ""));
+        if (parsed.hostname === "github.com") {
+            const path = /^\/([^/]+\/[^/]+?)(?:\.git)?\/?$/.exec(parsed.pathname);
+            if (path)
+                return path[1];
+        }
+    }
+    catch {
+        // Not a valid URL — neither the SSH nor shorthand branches matched, so
+        // there is no GitHub slug to extract.
+    }
+    return "";
+}
+/**
+ * Read the package name declared in a manifest.
+ *
+ * @param root - Repository root containing `package.json`.
+ * @returns The `name` field, or an empty string when the manifest lacks one.
+ */
+export function packageNameFromManifest(root) {
+    const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8"));
+    return pkg.name ?? "";
+}
+/**
+ * Split command output into non-empty, trimmed lines.
+ *
+ * Used for `git tag` and `gh api ... releases` output, both of which are one entry
+ * per line. A trailing newline produces no empty entry.
+ *
+ * @param output - Raw command output.
+ * @returns The non-empty trimmed lines.
+ */
+export function parseLines(output) {
+    return output.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+}
+/**
+ * Parse the complete JSON array emitted by `npm view <pkg> versions --json`.
+ *
+ * Reject malformed JSON and unreadable entries instead of dropping them. The
+ * caller must report an unavailable inventory separately from an empty one;
+ * otherwise a registry failure falsely describes existing releases as absent.
+ *
+ * @param output - Raw `npm view ... --json` output.
+ * @returns Every version string from a successfully decoded inventory.
+ * @throws When the response is not JSON or not an array of non-empty strings.
+ */
+export function parseNpmVersions(output) {
+    const parsed = JSON.parse(output);
+    if (!Array.isArray(parsed) || parsed.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+        throw new Error("expected an array of non-empty version strings");
+    }
+    return parsed;
+}
+/**
+ * Audit three release lists for completeness.
+ *
+ * A release tag is the anchor. For each release tag the check requires both a
+ * matching published npm version and a matching GitHub Release, and it refuses
+ * orphan npm versions and orphan GitHub Releases whose corresponding tag is
+ * missing, so a triple is incomplete in any direction. Non-release tags are
+ * ignored: they are not part of the release contract.
+ *
+ * An empty release-tag set is a failure rather than a pass: a scan that finds
+ * no release tags is either pointed at the wrong repository or has outlived
+ * the releases it guards, and both look identical to a clean result unless
+ * said out loud.
+ *
+ * @param tags - Git tag names.
+ * @param npmVersions - Published npm version strings.
+ * @param githubReleases - GitHub Release tag names.
+ * @returns Failures and per-list notes.
+ */
+export function auditReleaseCompleteness(tags, npmVersions, githubReleases) {
+    const releaseTags = tags.filter(isReleaseTag);
+    const tagSet = new Set(releaseTags);
+    const npmSet = new Set(npmVersions);
+    const ghSet = new Set(githubReleases);
+    const failures = [];
+    if (releaseTags.length === 0) {
+        failures.push("no release tags found - the scan is looking in the wrong place");
+    }
+    for (const tag of releaseTags) {
+        const version = tagToNpmVersion(tag);
+        if (!npmSet.has(version)) {
+            failures.push(`release tag ${tag} has no corresponding published npm version (expected ${version})`);
+        }
+        if (!ghSet.has(tag)) {
+            failures.push(`release tag ${tag} has no corresponding GitHub Release`);
+        }
+    }
+    for (const version of npmVersions) {
+        const tag = npmVersionToTag(version);
+        if (!tagSet.has(tag)) {
+            failures.push(`published npm version ${version} has no corresponding release tag (expected ${tag})`);
+        }
+    }
+    for (const release of githubReleases) {
+        if (!tagSet.has(release)) {
+            failures.push(`GitHub Release ${release} has no corresponding release tag`);
+        }
+    }
+    const notes = [];
+    if (failures.length === 0) {
+        notes.push(`ok - ${releaseTags.length} release tag(s), each with a published npm version and a GitHub Release`);
+    }
+    return { failures, notes };
+}
+/**
+ * Run a child process and return its stdout as a string.
+ *
+ * The default executor used by {@link makeFetcher}; exported so the suite can
+ * cover the real {@link execFileSync} call with a local command rather than the
+ * networked `npm`/`gh` invocations the fetcher builds.
+ *
+ * @param command - The program to run.
+ * @param args - Arguments to pass.
+ * @param options - Options such as `cwd`.
+ * @returns The process stdout, decoded as UTF-8.
+ */
+export function defaultExec(command, args, options = {}) {
+    return execFileSync(command, args, { encoding: "utf-8", ...options });
+}
+/** Page size for GitHub Release API pagination. The API caps at 100. */
+const GITHUB_RELEASES_PER_PAGE = 100;
+/**
+ * Fetch all GitHub Release tag names for a slug, paginating through the API.
+ *
+ * `gh release list -L N` caps at N entries, so a repository with more than N
+ * releases silently omits the older ones. This function pages through the
+ * GitHub releases API 100 at a time until a page returns fewer than a full
+ * page, collecting every release so the completeness audit sees the full
+ * history rather than a truncated prefix. Raising a fixed cap reproduces the
+ * same defect later; paginating until the API reports no further pages does
+ * not.
+ *
+ * @param exec - The executor to run `gh` commands through.
+ * @param slug - The `owner/name` slug to query.
+ * @returns All GitHub Release tag names, in API order.
+ */
+export function fetchGithubReleasesPaginated(exec, slug) {
+    const releases = [];
+    let page = 1;
+    while (true) {
+        // `--method GET` is load-bearing, not decoration: `gh api` switches to POST
+        // as soon as any `-f` parameter is present, so without it this "read" posts
+        // to the create-a-release endpoint. Verified against the live API — it
+        // returns `422 "tag_name" wasn't supplied`, i.e. the request was understood
+        // as an attempt to CREATE a release, and the audit fails outright.
+        const output = exec("gh", ["api", `repos/${slug}/releases`, "--method", "GET", "-f", `per_page=${GITHUB_RELEASES_PER_PAGE}`, "-f", `page=${page}`, "--jq", ".[].tag_name"], {});
+        const pageReleases = parseLines(output);
+        if (pageReleases.length === 0)
+            break;
+        releases.push(...pageReleases);
+        if (pageReleases.length < GITHUB_RELEASES_PER_PAGE)
+            break;
+        page++;
+    }
+    return releases;
+}
+/**
+ * Build a fetcher from an executor.
+ *
+ * Separating the executor from the parsing lets the suite cover every command
+ * construction and parser with an injected executor, while {@link defaultExec}
+ * is covered separately by a local process. The fetcher the release gate uses
+ * is built from {@link defaultExec}; the suite builds one from a mock.
+ *
+ * @param exec - The executor to run commands through.
+ * @returns A fetcher whose methods gather one release list each.
+ */
+export function makeFetcher(exec) {
+    return {
+        tags(root) {
+            return parseLines(exec("git", ["tag"], { cwd: root }));
+        },
+        remoteUrl(root) {
+            return exec("git", ["remote", "get-url", "origin"], { cwd: root }).trim();
+        },
+        npmVersions(pkgName) {
+            return parseNpmVersions(exec("npm", ["view", pkgName, "versions", "--json"], {}));
+        },
+        githubReleases(slug) {
+            return fetchGithubReleasesPaginated(exec, slug);
+        },
+        githubReleaseForTag(slug, tag) {
+            let answered;
+            try {
+                answered = exec("gh", ["api", `repos/${slug}/releases/tags/${tag}`, "--method", "GET", "--jq", ".tag_name"], {}).trim();
+            }
+            catch (error) {
+                // Only a 404 answers "no such release"; any other failure is an unreadable source.
+                if (error instanceof Error && error.message.includes("HTTP 404"))
+                    return false;
+                throw error;
+            }
+            // A successful read that names another tag (or none) is unreadable, not absent.
+            if (answered !== tag)
+                throw new Error(`the release read for ${tag} answered tag "${answered}"`);
+            return true;
+        },
+    };
+}
+/** The fetcher the release gate uses, built from the real executor. */
+export const realFetcher = makeFetcher(defaultExec);
+/**
+ * Gather the three release lists and audit them only when all reads succeed.
+ *
+ * A failed read names its source and makes no absence claims from partial data.
+ * Missing package or repository identity is rejected before any registry read.
+ * A release tag missing from the GitHub Release list is confirmed by a read of
+ * that tag's release, because the list lags a release created moments earlier.
+ *
+ * @param root - Repository root to verify.
+ * @param fetcher - The source of the three lists.
+ * @returns Failures and notes for the repository.
+ */
+export function verify(root, fetcher) {
+    let source = "package manifest";
+    try {
+        const pkgName = packageNameFromManifest(root);
+        if (!pkgName)
+            throw new Error("package name is missing");
+        source = "origin repository";
+        const slug = repoSlugFromUrl(fetcher.remoteUrl(root));
+        if (!slug)
+            throw new Error("origin does not identify a GitHub repository");
+        source = "git tags";
+        const tags = fetcher.tags(root);
+        source = "npm versions";
+        const npmVersions = fetcher.npmVersions(pkgName);
+        source = "GitHub Releases";
+        const listed = fetcher.githubReleases(slug);
+        // The list endpoint lags a release created moments before: it missed
+        // pm-ops v2026.09.28, created in the same second this audit ran after it.
+        // A release tag the list lacks is read by its tag before it counts as missing.
+        const listedSet = new Set(listed);
+        const confirmed = tags.filter((tag) => isReleaseTag(tag) && !listedSet.has(tag) && fetcher.githubReleaseForTag(slug, tag));
+        return auditReleaseCompleteness(tags, npmVersions, [...listed, ...confirmed]);
+    }
+    catch (error) {
+        return {
+            failures: [`unable to determine release completeness while reading ${source}: ${error instanceof Error ? error.message : String(error)}`],
+            notes: [],
+        };
+    }
+}
+/**
+ * Print a result and set a failing exit code when it failed.
+ *
+ * @param result - The audit outcome.
+ * @param write - Sink for the report lines.
+ * @param exit - Called with the process exit code when there were failures.
+ */
+export function report(result, write, exit) {
+    const lines = [
+        ...result.notes,
+        ...result.failures.map((failure) => `FAIL - ${failure}`),
+    ];
+    for (const line of lines)
+        write(line);
+    const failureCount = result.failures.length;
+    if (failureCount === 0) {
+        write("verify-release-completeness: every release tag has a published npm version and a GitHub Release.");
+        return;
+    }
+    write(`verify-release-completeness: ${failureCount} failure(s).`);
+    exit(1);
+}
+//# sourceMappingURL=release-completeness.js.map

package/dist/release-completeness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-completeness.js","sourceRoot":"","sources":["../release-completeness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAA2C;IACvE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,SAAS,GAAG,wCAAwC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,CAAE,CAAC;IAEpC,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,GAAG,GAAG,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;IAExB,sEAAsE;IACtE,0EAA0E;IAC1E,4EAA4E;IAC5E,2BAA2B;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtE,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,sCAAsC;IACxC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAsB,CAAC;IAClG,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/G,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAkB,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAuB,EACvB,WAA8B,EAC9B,cAAiC;IAEjC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,eAAe,GAAG,yDAAyD,OAAO,GAAG,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,eAAe,GAAG,sCAAsC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,yBAAyB,OAAO,+CAA+C,GAAG,GAAG,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,OAAO,mCAAmC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,WAAW,CAAC,MAAM,yEAAyE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAoBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,IAAc,EACd,OAAO,GAAqB,EAAE;IAE9B,OAAO,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,wEAAwE;AACxE,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAA4E,EAC5E,IAAY;IAEZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,EAAE,CAAC;QACZ,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,wBAAwB,EAAE,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;QAChL,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QACrC,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;QAC/B,IAAI,YAAY,CAAC,MAAM,GAAG,wBAAwB;YAAE,MAAM;QAC1D,IAAI,EAAE,CAAC;IACT,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,IAA4E;IACtG,OAAO;QACL,IAAI,CAAC,IAAI;YACP,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,SAAS,CAAC,IAAI;YACZ,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5E,CAAC;QACD,WAAW,CAAC,OAAO;YACjB,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,cAAc,CAAC,IAAI;YACjB,OAAO,4BAA4B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QACD,mBAAmB,CAAC,IAAI,EAAE,GAAG;YAC3B,IAAI,QAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,IAAI,kBAAkB,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mFAAmF;gBACnF,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC/E,MAAM,KAAK,CAAC;YACd,CAAC;YACD,gFAAgF;YAChF,IAAI,QAAQ,KAAK,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,kBAAkB,QAAQ,GAAG,CAAC,CAAC;YAChG,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAwB,WAAW,CAAC,WAAW,CAAC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAA4B;IAC/D,IAAI,MAAM,GAAG,kBAAkB,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzD,MAAM,GAAG,mBAAmB,CAAC;QAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC3E,MAAM,GAAG,UAAU,CAAC;QACpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,GAAG,cAAc,CAAC;QACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,GAAG,iBAAiB,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,qEAAqE;QACrE,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3H,OAAO,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ,EAAE,CAAC,0DAA0D,MAAM,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzI,KAAK,EAAE,EAAE;SACV,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,MAAsB,EACtB,KAA6B,EAC7B,IAA4B;IAE5B,MAAM,KAAK,GAAG;QACZ,GAAG,MAAM,CAAC,KAAK;QACf,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,OAAO,EAAE,CAAC;KACzD,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC5C,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,kGAAkG,CAAC,CAAC;QAC1G,OAAO;IACT,CAAC;IACD,KAAK,CAAC,gCAAgC,YAAY,cAAc,CAAC,CAAC;IAClE,IAAI,CAAC,CAAC,CAAC,CAAC;AACV,CAAC"}