pm-ops 2026.10.6 → 2026.10.13

package/dist/release-repair.d.ts

@@ -0,0 +1,77 @@
+import { defaultExec, type CompletenessFetcher } from "./release-completeness.ts";
+import type { VerifierResult } from "./shell-scan.ts";
+/** Process boundary shared by the real adapter and recorded command fixtures. */
+export type RepairExecutor = typeof defaultExec;
+/** Verified registry identity and provenance commit for one immutable version. */
+export interface NpmEvidence {
+    /** Registry package name. */
+    name: string;
+    /** Registry version coordinate. */
+    version: string;
+    /** Registry gitHead, required to match the signed commit. */
+    gitHead: string;
+    /** Signed source repository slug. */
+    repository: string;
+    /** Signed source commit, extracted only after npm verifies the bundle. */
+    commit: string;
+}
+/** I/O contract for evidence and conditional writes; deliberately no publish API. */
+export interface RepairClient {
+    /** Verify npm provenance and read the coordinate's metadata. */
+    npmEvidence(name: string, version: string): NpmEvidence;
+    /** Read the actual remote tag's peeled commit, or null on proven absence. */
+    remoteTag(root: string, tag: string): string | null;
+    /** Read an immutable local commit's object or committed file. */
+    git(root: string, args: string[]): string;
+    /** Create only an absent remote tag at the attested commit. */
+    createTag(slug: string, tag: string, commit: string): void;
+    /** Create only a missing release with committed changelog notes. */
+    createRelease(slug: string, tag: string, notes: string): void;
+}
+/** The subset of a verified SLSA v1 statement used to bind the source commit. */
+export interface ProvenanceStatement {
+    /** Provenance schema discriminator. */
+    predicateType: string;
+    /** Signed artifacts; repair requires exactly the coordinate's npm tarball. */
+    subject?: {
+        name?: string;
+        digest?: {
+            sha512?: string;
+        };
+    }[];
+    /** Signed build definition with source dependencies. */
+    predicate: {
+        buildDefinition: {
+            /** The signed workflow invocation; only the approved release workflow on main may authorize repair. */
+            externalParameters?: {
+                workflow?: {
+                    path?: string;
+                    ref?: string;
+                    repository?: string;
+                };
+            };
+            resolvedDependencies: {
+                uri: string;
+                digest: {
+                    gitCommit: string;
+                };
+            }[];
+        };
+    };
+}
+/**
+ * Extract a unique source identity from npm's successful signature-audit output.
+ * Raw registry metadata or a merely present attestation is never sufficient.
+ */
+export declare function evidenceFromAudit(name: string, version: string, gitHead: string, output: string, integrity: string): NpmEvidence;
+/** Build the live adapter. All npm operations download/read; scripts are disabled. */
+export declare function makeRepairClient(exec?: RepairExecutor): RepairClient;
+/** Extract exactly one nonempty version section from an immutable changelog. */
+export declare function committedReleaseNotes(changelog: string, version: string): string;
+/**
+ * Preflight all incomplete triples before writing. Never infer absence from a
+ * failed read, move an existing tag, overwrite a release, or publish to npm.
+ * Re-read remote state before each write and after uncertain write outcomes.
+ */
+export declare function repairReleaseCompleteness(root: string, fetcher: CompletenessFetcher, client: RepairClient): VerifierResult;
+//# sourceMappingURL=release-repair.d.ts.map

package/dist/release-repair.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-repair.d.ts","sourceRoot":"","sources":["../release-repair.ts"],"names":[],"mappings":"AAQA,OAAO,EACqB,WAAW,EACY,KAAK,mBAAmB,EAC1E,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,iFAAiF;AACjF,MAAM,MAAM,cAAc,GAAG,OAAO,WAAW,CAAC;AAEhD,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAAC;IACxD,6EAA6E;IAC7E,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpD,iEAAiE;IACjE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1C,+DAA+D;IAC/D,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3D,oEAAoE;IACpE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/D;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;IAC5D,wDAAwD;IACxD,SAAS,EAAE;QACT,eAAe,EAAE;YACf,uGAAuG;YACvG,kBAAkB,CAAC,EAAE;gBAAE,QAAQ,CAAC,EAAE;oBAAE,IAAI,CAAC,EAAE,MAAM,CAAC;oBAAC,GAAG,CAAC,EAAE,MAAM,CAAC;oBAAC,UAAU,CAAC,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,CAAC;YACzF,oBAAoB,EAAE;gBAAE,GAAG,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE;oBAAE,SAAS,EAAE,MAAM,CAAA;iBAAE,CAAA;aAAE,EAAE,CAAC;SACxE,CAAC;KACH,CAAC;CACH;AA8BD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,WAAW,CAkChI;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAA4B,GAAG,YAAY,CA4CjF;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAYhF;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,YAAY,GAAG,cAAc,CAiE1H"}

package/dist/release-repair.js

@@ -0,0 +1,223 @@
+/**
+ * Conservative recovery of missing release tags and GitHub Releases. npm is
+ * read-only: only successfully verified provenance authorizes a repair.
+ * @packageDocumentation
+ */
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { auditReleaseCompleteness, defaultExec, isReleaseTag, npmVersionToTag, repoSlugFromUrl, repositoryUrl, tagToNpmVersion, } from "./release-completeness.js";
+/** The only workflow file whose npm provenance may authorize tag and release repair. */
+const RELEASE_WORKFLOW_PATH = ".github/workflows/release.yml";
+/** The only ref whose release builds may authorize repair. */
+const RELEASE_WORKFLOW_REF = "refs/heads/main";
+/** The package URL npm provenance uses as the subject name; scoped names encode the leading `@`. */
+function npmPurl(name, version) {
+    return `pkg:npm/${name.startsWith("@") ? `%40${name.slice(1)}` : name}@${version}`;
+}
+/** Decode a registry `sha512-<base64>` integrity to the hex digest provenance subjects carry; anything else cannot match. */
+function integrityHex(integrity) {
+    return integrity.startsWith("sha512-") ? Buffer.from(integrity.slice(7), "base64").toString("hex") : null;
+}
+/**
+ * Extract a unique source identity from npm's successful signature-audit output.
+ * Raw registry metadata or a merely present attestation is never sufficient.
+ */
+export function evidenceFromAudit(name, version, gitHead, output, integrity) {
+    const report = JSON.parse(output);
+    if (!Array.isArray(report.invalid) || report.invalid.length !== 0 || !Array.isArray(report.verified)) {
+        throw new Error("npm signature audit is incomplete or contains invalid evidence");
+    }
+    const entries = report.verified.filter((entry) => entry.name === name && entry.version === version && entry.registry === "https://registry.npmjs.org/");
+    if (entries.length !== 1)
+        throw new Error("npm did not verify exactly one matching package coordinate");
+    const sources = [];
+    for (const attestation of entries[0].attestationBundles) {
+        if (attestation.predicateType !== "https://slsa.dev/provenance/v1")
+            continue;
+        const statement = JSON.parse(Buffer.from(attestation.bundle.dsseEnvelope.payload, "base64").toString("utf8"));
+        if (statement.predicateType !== attestation.predicateType)
+            throw new Error("provenance schema mismatch");
+        // The signed subject must be exactly this coordinate's tarball, not merely an attestation npm accepted.
+        if (statement.subject?.length !== 1 || statement.subject[0].name !== npmPurl(name, version)
+            || statement.subject[0].digest?.sha512 !== integrityHex(integrity)) {
+            throw new Error("provenance subject does not match the package coordinate and tarball digest");
+        }
+        const workflow = statement.predicate.buildDefinition.externalParameters?.workflow;
+        if (workflow?.path !== RELEASE_WORKFLOW_PATH || workflow.ref !== RELEASE_WORKFLOW_REF || typeof workflow.repository !== "string") {
+            throw new Error("provenance was not built by the approved release workflow and ref");
+        }
+        const workflowRepository = repoSlugFromUrl(workflow.repository);
+        for (const dependency of statement.predicate.buildDefinition.resolvedDependencies) {
+            const repository = repoSlugFromUrl(dependency.uri.replace(/^git\+/, "").split("@")[0]);
+            const commit = dependency.digest.gitCommit;
+            if (!repository || !/^[a-f0-9]{40}$/.test(commit))
+                throw new Error("unrecognized signed source identity");
+            if (repository !== workflowRepository)
+                throw new Error("signed workflow repository differs from the signed source repository");
+            sources.push({ repository, commit });
+        }
+    }
+    if (sources.length !== 1 || !/^[a-f0-9]{40}$/.test(gitHead) || sources[0].commit !== gitHead) {
+        throw new Error("npm gitHead does not match unique verified provenance");
+    }
+    return { name, version, gitHead, ...sources[0] };
+}
+/** Build the live adapter. All npm operations download/read; scripts are disabled. */
+export function makeRepairClient(exec = defaultExec) {
+    return {
+        /** Verify the exact registry coordinate in a disposable script-disabled install. */
+        npmEvidence(name, version) {
+            const metadata = JSON.parse(exec("npm", ["view", `${name}@${version}`, "--json", "--prefer-online", "--registry=https://registry.npmjs.org/"], {}));
+            if (metadata.name !== name || metadata.version !== version)
+                throw new Error("registry coordinate mismatch");
+            const scratch = mkdtempSync(join(tmpdir(), "pm-ops-provenance-"));
+            try {
+                writeFileSync(join(scratch, "package.json"), JSON.stringify({ name: "release-evidence", version: "1.0.0", private: true }));
+                exec("npm", ["install", `${name}@${version}`, "--ignore-scripts", "--no-audit", "--no-fund", "--legacy-peer-deps", "--registry=https://registry.npmjs.org/"], { cwd: scratch });
+                const output = exec("npm", ["audit", "signatures", "--json", "--include-attestations", "--registry=https://registry.npmjs.org/"], { cwd: scratch });
+                return evidenceFromAudit(name, version, metadata.gitHead, output, metadata.dist?.integrity ?? "");
+            }
+            finally {
+                rmSync(scratch, { recursive: true, force: true });
+            }
+        },
+        /** Inspect only the requested remote ref and its annotated-tag peel. */
+        remoteTag(root, tag) {
+            // Validate at the call site: only release tags ever reach git's argv.
+            if (!isReleaseTag(tag))
+                throw new Error(`unsupported release coordinate ${tag}`);
+            const output = exec("git", ["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], { cwd: root }).trim();
+            if (!output)
+                return null;
+            const refs = output.split("\n").map((line) => line.split(/\s+/));
+            if (refs.some(([sha, ref]) => !/^[a-f0-9]{40}$/.test(sha) || (ref !== `refs/tags/${tag}` && ref !== `refs/tags/${tag}^{}`)))
+                throw new Error("unreadable remote tag");
+            return (refs.find(([, ref]) => ref === `refs/tags/${tag}^{}`) ?? refs[0])[0];
+        },
+        /** Read commit objects and committed files through the injected git boundary. */
+        git(root, args) { return exec("git", args, { cwd: root }).trim(); },
+        /** Create an absent remote ref without force-updating existing refs. */
+        createTag(slug, tag, commit) {
+            exec("gh", ["api", `repos/${slug}/git/refs`, "--method", "POST", "-f", `ref=refs/tags/${tag}`, "-f", `sha=${commit}`], {});
+        },
+        /** Create a release from verified notes without changing the latest designation. */
+        createRelease(slug, tag, notes) {
+            const scratch = mkdtempSync(join(tmpdir(), "pm-ops-release-notes-"));
+            try {
+                const notesFile = join(scratch, "notes.md");
+                writeFileSync(notesFile, notes);
+                exec("gh", ["release", "create", tag, "--repo", slug, "--verify-tag", "--latest=false", "--title", `${slug.split("/")[1]} ${tag}`, "--notes-file", notesFile], {});
+            }
+            finally {
+                rmSync(scratch, { recursive: true, force: true });
+            }
+        },
+    };
+}
+/** Extract exactly one nonempty version section from an immutable changelog. */
+export function committedReleaseNotes(changelog, version) {
+    const sections = changelog.split(/^## /m).slice(1);
+    const matches = sections.filter((section) => {
+        // A single-character separator keeps the match linear on long runs of spaces.
+        const heading = section.split("\n")[0];
+        const separator = heading.search(/\s-\s/);
+        return (separator === -1 ? heading : heading.slice(0, separator)).trim() === version;
+    });
+    if (matches.length !== 1)
+        throw new Error(`committed changelog must have exactly one section for ${version}`);
+    const body = matches[0].split("\n").slice(1).join("\n").trim();
+    if (!body)
+        throw new Error(`committed changelog section for ${version} is empty`);
+    return body + "\n";
+}
+/**
+ * Preflight all incomplete triples before writing. Never infer absence from a
+ * failed read, move an existing tag, overwrite a release, or publish to npm.
+ * Re-read remote state before each write and after uncertain write outcomes.
+ */
+export function repairReleaseCompleteness(root, fetcher, client) {
+    const notes = [];
+    try {
+        const manifest = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        const name = manifest.name;
+        const slug = repoSlugFromUrl(fetcher.remoteUrl(root));
+        if (!name || !slug || repoSlugFromUrl(repositoryUrl(manifest.repository)) !== slug)
+            throw new Error("package and origin repository identity mismatch");
+        const tags = fetcher.tags(root).filter(isReleaseTag);
+        const versions = fetcher.npmVersions(name);
+        const releases = fetcher.githubReleases(slug);
+        const candidates = [...new Set([...tags, ...versions.map(npmVersionToTag), ...releases])];
+        const plans = [];
+        for (const tag of candidates) {
+            if (!isReleaseTag(tag))
+                throw new Error(`unsupported release coordinate ${tag}`);
+            const version = tagToNpmVersion(tag);
+            if (!versions.includes(version))
+                throw new Error(`${tag} has no published npm version; publishing is never a repair`);
+            const remote = client.remoteTag(root, tag);
+            const exists = fetcher.githubReleaseForTag(slug, tag);
+            if (remote !== null && tags.includes(tag)) {
+                const local = client.git(root, ["rev-parse", `refs/tags/${tag}^{commit}`]);
+                if (local !== remote)
+                    throw new Error(`local and remote tag mismatch for ${tag}`);
+            }
+            if (remote !== null && exists)
+                continue;
+            const evidence = client.npmEvidence(name, version);
+            if (evidence.name !== name || evidence.version !== version || evidence.repository !== slug || !/^[a-f0-9]{40}$/.test(evidence.commit) || evidence.gitHead !== evidence.commit)
+                throw new Error(`npm evidence mismatch for ${tag}`);
+            if (remote !== null && remote !== evidence.commit)
+                throw new Error(`tag and attested gitHead mismatch for ${tag}`);
+            if (tags.includes(tag) && client.git(root, ["rev-parse", `refs/tags/${tag}^{commit}`]) !== evidence.commit)
+                throw new Error(`local tag and attested gitHead mismatch for ${tag}`);
+            const commit = client.git(root, ["rev-parse", `${evidence.commit}^{commit}`]);
+            if (commit !== evidence.commit)
+                throw new Error(`attested commit unavailable for ${tag}`);
+            const committed = JSON.parse(client.git(root, ["show", `${commit}:package.json`]));
+            if (committed.name !== name || committed.version !== version || repoSlugFromUrl(repositoryUrl(committed.repository)) !== slug)
+                throw new Error(`committed package identity mismatch for ${tag}`);
+            const body = committedReleaseNotes(client.git(root, ["show", `${commit}:CHANGELOG.md`]), version);
+            plans.push({ tag, commit, notes: body });
+        }
+        for (const plan of plans) {
+            let remote = client.remoteTag(root, plan.tag);
+            if (remote === null) {
+                // Report a repair only for a create call that succeeded; an accepted pre-existing or lost-response result is named as such.
+                let created = true;
+                try {
+                    client.createTag(slug, plan.tag, plan.commit);
+                }
+                catch (error) {
+                    created = false;
+                    if (client.remoteTag(root, plan.tag) !== plan.commit)
+                        throw error;
+                }
+                remote = client.remoteTag(root, plan.tag);
+                notes.push(created ? `repaired tag ${plan.tag}` : `tag ${plan.tag} confirmed at the planned commit after a failed create call`);
+            }
+            if (remote !== plan.commit)
+                throw new Error(`remote tag changed for ${plan.tag}`);
+            if (!fetcher.githubReleaseForTag(slug, plan.tag)) {
+                let created = true;
+                try {
+                    client.createRelease(slug, plan.tag, plan.notes);
+                }
+                catch (error) {
+                    created = false;
+                    if (!fetcher.githubReleaseForTag(slug, plan.tag))
+                        throw error;
+                }
+                notes.push(created ? `repaired GitHub Release ${plan.tag}` : `GitHub Release ${plan.tag} confirmed present after a failed create call`);
+            }
+        }
+        const finalTags = [...new Set([...tags, ...candidates.filter((tag) => client.remoteTag(root, tag) !== null)])];
+        const finalReleases = candidates.filter((tag) => fetcher.githubReleaseForTag(slug, tag));
+        const result = auditReleaseCompleteness(finalTags, fetcher.npmVersions(name), finalReleases);
+        return { failures: result.failures, notes: [...notes, ...result.notes] };
+    }
+    catch (error) {
+        return { failures: [`release repair refused: ${error instanceof Error ? error.message : String(error)}`], notes };
+    }
+}
+//# sourceMappingURL=release-repair.js.map

package/dist/release-repair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-repair.js","sourceRoot":"","sources":["../release-repair.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,wBAAwB,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EACpE,eAAe,EAAE,aAAa,EAAE,eAAe,GAChD,MAAM,2BAA2B,CAAC;AA+DnC,wFAAwF;AACxF,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,8DAA8D;AAC9D,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAE/C,oGAAoG;AACpG,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,OAAO,WAAW,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AACrF,CAAC;AAED,6HAA6H;AAC7H,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe,EAAE,OAAe,EAAE,MAAc,EAAE,SAAiB;IACjH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAoB,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,KAAK,6BAA6B,CAAC,CAAC;IACxJ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACxG,MAAM,OAAO,GAA6C,EAAE,CAAC;IAC7D,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,kBAAkB,EAAE,CAAC;QACzD,IAAI,WAAW,CAAC,aAAa,KAAK,gCAAgC;YAAE,SAAS;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;QACrI,IAAI,SAAS,CAAC,aAAa,KAAK,WAAW,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzG,wGAAwG;QACxG,IAAI,SAAS,CAAC,OAAO,EAAE,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;eACvF,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,kBAAkB,EAAE,QAAQ,CAAC;QAClF,IAAI,QAAQ,EAAE,IAAI,KAAK,qBAAqB,IAAI,QAAQ,CAAC,GAAG,KAAK,oBAAoB,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjI,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,kBAAkB,GAAG,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAChE,KAAK,MAAM,UAAU,IAAI,SAAS,CAAC,SAAS,CAAC,eAAe,CAAC,oBAAoB,EAAE,CAAC;YAClF,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YACxF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC1G,IAAI,UAAU,KAAK,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC/H,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC;AACpD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,IAAI,GAAmB,WAAW;IACjE,OAAO;QACL,oFAAoF;QACpF,WAAW,CAAC,IAAI,EAAE,OAAO;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,QAAQ,EAAE,iBAAiB,EAAE,wCAAwC,CAAC,EAAE,EAAE,CAAC,CAAsF,CAAC;YACzO,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAC5G,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5H,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,oBAAoB,EAAE,wCAAwC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChL,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,wBAAwB,EAAE,wCAAwC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBACpJ,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;YACpG,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QACD,wEAAwE;QACxE,SAAS,CAAC,IAAI,EAAE,GAAG;YACjB,sEAAsE;YACtE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,GAAG,EAAE,EAAE,aAAa,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/H,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAI,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,GAAG,EAAE,IAAI,GAAG,KAAK,aAAa,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACvK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnE,wEAAwE;QACxE,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM;YACzB,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,oFAAoF;QACpF,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK;YAC5B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAC5C,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACrK,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,OAAe;IACtE,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,8EAA8E;QAC9E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;QACxC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC;IACvF,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,EAAE,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,OAAO,WAAW,CAAC,CAAC;IAClF,OAAO,IAAI,GAAG,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,OAA4B,EAAE,MAAoB;IACxG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAA6D,CAAC;QAC1I,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvJ,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1F,MAAM,KAAK,GAAqD,EAAE,CAAC;QACnE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,6DAA6D,CAAC,CAAC;YACtH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC;gBAC3E,IAAI,KAAK,KAAK,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM;gBAAE,SAAS;YACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;YACnO,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;YACnH,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,GAAG,WAAW,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;YAClL,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAC;YAC1F,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,CAA8E,CAAC;YAChK,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,IAAI,SAAS,CAAC,OAAO,KAAK,OAAO,IAAI,eAAe,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;YACjM,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClG,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,4HAA4H;gBAC5H,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC;oBAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAC,CAAC;gBACtD,OAAO,KAAK,EAAE,CAAC;oBACb,OAAO,GAAG,KAAK,CAAC;oBAChB,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM;wBAAE,MAAM,KAAK,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,6DAA6D,CAAC,CAAC;YAClI,CAAC;YACD,IAAI,MAAM,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC;oBAAC,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;gBACzD,OAAO,KAAK,EAAE,CAAC;oBACb,OAAO,GAAG,KAAK,CAAC;oBAChB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;wBAAE,MAAM,KAAK,CAAC;gBAChE,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,GAAG,+CAA+C,CAAC,CAAC;YAC1I,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;QAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,CAAC,2BAA2B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACpH,CAAC;AACH,CAAC"}

package/dist/shell-scan.d.ts

@@ -45,6 +45,8 @@ export interface ShellToken {
      * different security meaning in command position.
      */
     unresolved?: boolean;
+    /** True when unresolved expansion can produce multiple arguments despite some quoting. */
+    multipleWords?: true;
     /**
      * True when the word's FIRST character came from inside quotes.
      *
@@ -58,6 +60,19 @@ export interface ShellToken {
 }
 /** One simple command: the words it would run, in order. */
 export type ShellCommand = ShellToken[];
+/** A lexical child region, before any parent binding is expanded. */
+interface ShellChildRegion {
+    /** First character of the opening delimiter. */
+    start: number;
+    /** First character after the closing delimiter, or end of truncated input. */
+    end: number;
+    /** Child source after the backtick escape layer is removed. */
+    text: string;
+    /** Arithmetic operands contain substitutions but are not shell commands. */
+    arithmetic: boolean;
+    /** Standalone subshells have no unresolved output word in their parent. */
+    subshell?: true;
+}
 /**
  * Split shell text into the simple commands it contains.
  *
@@ -77,6 +92,17 @@ export type ShellCommand = ShellToken[];
  * @returns Every simple command found, outermost first.
  */
 export declare function tokenizeCommands(text: string, depth?: number): ShellCommand[];
+/**
+ * Protect lexical child state from parent structural scans and expansion.
+ *
+ * The shared scanner supplies the exact substitution boundaries. Neutral
+ * placeholders preserve outer unresolved words and line indexing. Callers
+ * audit each returned child independently; inherited bindings are unproven.
+ */
+export declare function isolateShellChildren(text: string, depth?: number, arithmetic?: boolean): {
+    parent: string;
+    children: ShellChildRegion[];
+};
 /**
  * Whether a command's program is reached through a spawning wrapper.
  *
@@ -177,7 +203,7 @@ export declare function joinContinuations(text: string): string;
  * other rule in the scanner already tolerates leading whitespace
  * (`STANDALONE_ASSIGNMENT` opens with `^[ \t]*`, control closers and function
  * openers are matched against trimmed syntax, a comment starts after any
- * separator or whitespace, and `bashArrays` anchors on a word boundary), so
+ * separator or whitespace, and `bashArrays` uses a whitespace boundary), so
  * this function changes nothing else about what the scanner sees.
  *
  * Only `run:` blocks are dedented, because `run` is the key GitHub Actions
@@ -194,6 +220,36 @@ export declare function joinContinuations(text: string): string;
  * @returns The same text with each `run:` block's content dedented.
  */
 export declare function dedentRunBlocks(text: string): string;
+/** One supported array declaration with its lexical source extent. */
+interface BashArrayDeclaration {
+    /** Assigned array name. */
+    name: string;
+    /** Literal source operands with whitespace collapsed. */
+    value: string;
+    /** First character of the assigned name, excluding preceding whitespace. */
+    start: number;
+    /** First character following the closing parenthesis. */
+    end: number;
+}
+/**
+ * Enumerate literal declarations with original UTF-16 extents in source order.
+ *
+ * Candidates start at input start or after ECMAScript whitespace, with an ASCII
+ * identifier immediately followed by `=(`. Bare inner parentheses are rejected;
+ * quotes and backslash pairs preserve literal source, including substitutions
+ * inside quotes. This helper does not filter enclosing comments or shell scopes.
+ *
+ * Backward tables record the exclusive closing offset (zero means failure) for
+ * each suffix entered bare, single-quoted or double-quoted. Every transition
+ * uses an already computed later suffix, so malformed candidates never rescan
+ * quotes or remaining input. The forward name scan advances monotonically;
+ * successful extents do not overlap, so their total projection cost is linear.
+ * Time and auxiliary storage are O(text.length), including malformed recovery.
+ *
+ * @param text - Exact source text; continuations are not joined here.
+ * @returns Literal operands with whitespace collapsed and non-overlapping extents.
+ */
+export declare function bashArrayDeclarations(text: string): BashArrayDeclaration[];
 /**
  * Index bash array assignments so a shared options array can be expanded.
  *
@@ -478,4 +534,5 @@ export interface VerifierResult {
     /** Lines describing what was checked, for the operator. */
     notes: string[];
 }
+export {};
 //# sourceMappingURL=shell-scan.d.ts.map

package/dist/shell-scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-scan.d.ts","sourceRoot":"","sources":["../shell-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;OAQG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;AAiNxC;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,YAAY,EAAE,CAoMxE;AAmKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAInE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,EAAE,CAYrE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,EAAE,CAGlE;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAqHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsEpD;AAYD;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D;AAkMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAkCvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7E;AAmKD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAEhE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiCvD;AA0BD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA+C5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,MAAM,CAiBzE;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0B3E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAK9D;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAYhF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAK9E;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB"}
+{"version":3,"file":"shell-scan.d.ts","sourceRoot":"","sources":["../shell-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0FAA0F;IAC1F,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;;;OAQG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,4DAA4D;AAC5D,MAAM,MAAM,YAAY,GAAG,UAAU,EAAE,CAAC;AAgOxC,qEAAqE;AACrE,UAAU,gBAAgB;IACxB,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAI,GAAG,YAAY,EAAE,CAExE;AAoQD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAI,EAAE,UAAU,UAAQ,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAgBlI;AAmKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAInE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,YAAY,EAAE,CAYrE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,UAAU,EAAE,CAGlE;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAqHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAsEpD;AAED,sEAAsE;AACtE,UAAU,oBAAoB;IAC5B,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAqC1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D;AAkMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAqCvF;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7E;AAmKD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAEhE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiCvD;AA0BD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA+C5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CASnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,MAAM,CAiBzE;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0B3E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAK9D;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAYhF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAK9E;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB"}