pm-ops 2026.8.31 → 2026.9.2

package/dist/attestation.js

@@ -0,0 +1,593 @@
+/**
+ * Proves this package has no publish path that omits `--provenance`.
+ *
+ * The release step used to fall back to `npm publish` without the flag after
+ * three failed provenance attempts, reporting success and leaving only a
+ * warning annotation. That makes a transient registry failure downgrade the
+ * published artifact's supply-chain attestation permanently for that version,
+ * and consumers cannot tell such a publish apart from one that never had
+ * provenance at all. An unattested publish is not a degraded success; it is a
+ * different artifact.
+ *
+ * A workflow edit is easy to make and easy to lose, so the contract is executed
+ * rather than assumed: every `npm publish` this repository can run is found and
+ * required to carry the flag. The analysis is separated from the I/O so the
+ * rules are driven by the suite against fixtures rather than only against this
+ * repository, which happens to satisfy them.
+ *
+ * @packageDocumentation
+ */
+import { execFileSync } from "node:child_process";
+import { closeSync, openSync, readFileSync, readSync } from "node:fs";
+import { resolve } from "node:path";
+import { bashArrays, blockDepthChange, caseDepthChange, commandArguments, commandCandidates, commandName, dedentRunBlocks, expandArrays, expandScalars, heredocBodyLines, heredocExpansionLines, joinContinuations, literalScalarAssignments, segmentShellLine, startsEnclosingCaseArm, tokenizeCommands, unsetNames, } from "./shell-scan.js";
+/** The flag that attaches a build attestation to the published tarball. */
+export const ATTESTATION_FLAG = "--provenance";
+/** Publishers other than npm, which this repository has no attested path for. */
+export const FOREIGN_PUBLISHERS = new Set(["yarn", "pnpm", "bun"]);
+/** Repository subtrees whose contents are build output rather than a publish path. */
+const GENERATED_PREFIXES = ["dist/", "coverage/", "node_modules/", ".agents/pm/runtime/"];
+/**
+ * The workflow-shaped path patterns whose `run:` blocks GitHub Actions
+ * executes as shell, defined once so the workflow entries in
+ * {@link EXECUTABLE_PATHS} and the {@link isWorkflowYaml} test can never
+ * drift apart. A workflow file and a composite action are the two shapes a
+ * YAML parser hands to bash with the block indentation removed.
+ */
+const WORKFLOW_PATHS = [
+    /^\.github\/workflows\/[^/]+\.ya?ml$/,
+    // A composite action is recognised by its FILE NAME, wherever it sits - a
+    // repository that is itself an action carries `action.yml` at its root, and
+    // matching only `.github/actions/**` excludes it. Its `run:` blocks are shell
+    // GitHub executes, so leaving them unscanned lets an unattested publish hide
+    // there while an attested sibling keeps the audit non-vacuous.
+    /(^|\/)action\.ya?ml$/,
+];
+/**
+ * Whether a repository-relative path is a workflow file whose `run:` blocks
+ * GitHub Actions executes as shell. These are the tracked files whose shell
+ * text a YAML parser hands to bash with the block indentation removed, so they
+ * are the files whose `run:` blocks are dedented before scanning. A plain
+ * shell script is not on this list: its indentation is the shell's own, and a
+ * heredoc terminator indented there is not a terminator in bash either.
+ */
+const isWorkflowYaml = (path) => WORKFLOW_PATHS.some((pattern) => pattern.test(path));
+/** Tracked paths that can execute a command, matched against the repository-relative path. */
+const EXECUTABLE_PATHS = [
+    ...WORKFLOW_PATHS,
+    /(^|\/)package\.json$/,
+    /\.(sh|bash|zsh|ksh)$/,
+    /(^|\/)(Makefile|makefile|GNUmakefile)$/,
+    /\.mk$/,
+    /(^|\/)Dockerfile([.-][^/]*)?$/,
+    /(^|\/)docker-compose([.-][^/]*)?\.ya?ml$/,
+];
+/**
+ * Yield the command text held inside a package manifest.
+ *
+ * A manifest is JSON, so its script bodies are string values rather than lines
+ * of shell. Handing the raw file to a shell tokeniser would read the JSON
+ * punctuation as commands and the script bodies as quoted words. Parsing the
+ * manifest and returning the bodies restores them to the shape the scanner
+ * expects, which matters because a publish moved into an npm script is entirely
+ * real and would otherwise be invisible to this gate.
+ *
+ * A manifest that will not parse yields nothing rather than throwing, so a
+ * malformed sibling file cannot take the gate down; the manifest's own tooling
+ * reports that far better than a publish audit can.
+ *
+ * @param text - The manifest's contents.
+ * @returns Each script body in manifest order.
+ */
+function manifestCommandBodies(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return [];
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return [];
+    const scripts = parsed.scripts;
+    if (typeof scripts !== "object" || scripts === null)
+        return [];
+    return Object.values(scripts)
+        .filter((value) => typeof value === "string");
+}
+/**
+ * Join manifest script bodies for legacy text consumers without continuations.
+ *
+ * The auditor itself analyzes each returned body in a fresh scope; this text
+ * form remains for callers that need the earlier newline-joined contract.
+ *
+ * @param text - The manifest's contents.
+ * @returns One sanitized line per script body, newline joined.
+ */
+export function manifestCommandLines(text) {
+    // Preserve the text-returning compatibility contract while ensuring a body
+    // cannot continue into the next one when callers tokenize the joined result.
+    return manifestCommandBodies(text)
+        .map((value) => value.replace(/\\+$/, ""))
+        .join("\n");
+}
+/** Subcommands that run something else, so a later `publish` word is its argument. */
+// npm's runner subcommands, which take a script or package name rather than
+// publishing. `workspace` is deliberately absent: it is not a subcommand at all
+// -- npm selects a workspace with the `-w`/`--workspace` FLAG -- and listing it
+// here only meant that a `publish` written after the word was never audited.
+const RUNNER_SUBCOMMANDS = new Set(["run", "run-script", "exec", "explore", "x"]);
+/**
+ * npm flags that consume the word after them.
+ *
+ * Their values sit where a subcommand would, so a value that happens to spell a
+ * runner word (`npm --tag run publish`) otherwise reads as `npm run` and the
+ * publish beside it is discarded. Joined forms (`--tag=run`) need no entry,
+ * because they are one word.
+ */
+const VALUE_TAKING_FLAGS = new Set([
+    "--tag", "--access", "--registry", "--otp", "--workspace", "-w",
+    "--userconfig", "--globalconfig", "--cache", "--prefix", "--loglevel",
+    "--provenance-file", "--auth-type", "--before", "--omit", "--include",
+]);
+/**
+ * Decide whether one command is a direct `npm publish`.
+ *
+ * `publish` does not have to follow `npm` immediately: npm accepts its
+ * configuration flags anywhere on the line, so `npm --access public publish` is
+ * a real publish that an adjacency test discards silently, leaving an attested
+ * sibling elsewhere in the file to carry the audit to a pass.
+ *
+ * Reading the first non-flag word as the subcommand does not work either,
+ * because npm has flags that take a separate value (`--access public`) and
+ * flags that do not (`--ignore-scripts`), and telling them apart needs npm's
+ * own option table. So the word is looked for anywhere in the arguments, and
+ * only a preceding runner subcommand rules it out -- `npm run publish` runs a
+ * package script whose body is scanned from the manifest, and requiring the
+ * flag on the runner would report a defect that is not there.
+ *
+ * The residual imprecision is `npm --tag publish ...`, a dist-tag named after
+ * the subcommand, which this reads as a publish. That direction is deliberate:
+ * a false positive is a report line to argue with, a false negative is an
+ * unattested artifact on the registry.
+ *
+ * The program is checked in command position by the caller, so `echo npm
+ * publish` and `notnpm publish` never reach here.
+ *
+ * @param command - One simple command's tokens.
+ * @returns True when the command publishes.
+ */
+export function isPublishCommand(command) {
+    const args = commandArguments(command);
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index];
+        // A flag's separate value is not the subcommand. `npm --tag run publish`
+        // configures the tag as "run" and publishes; reading `run` as a runner
+        // subcommand discarded a real publish and let an attested sibling carry the
+        // audit. Only npm's own value-taking flags are skipped, so an unknown flag
+        // still leaves its value in subcommand position rather than being ignored.
+        if (VALUE_TAKING_FLAGS.has(token.value)) {
+            index += 1;
+            continue;
+        }
+        if (token.value.startsWith("-"))
+            continue;
+        if (RUNNER_SUBCOMMANDS.has(token.value))
+            return false;
+        if (token.value === "publish")
+            return true;
+    }
+    return false;
+}
+/**
+ * Decide whether one publish command actually enables the attestation.
+ *
+ * A substring test is not enough. `--provenance=false`, `--provenance false` and
+ * `--no-provenance` all contain the flag's spelling and all turn the
+ * attestation off, so a containment check accepts precisely the regression this
+ * gate exists to catch -- while reporting the file as attested. `--provenance-file`
+ * is a different flag entirely and must not be read as this one.
+ *
+ * Tokens are judged in order and the last one wins, which is how npm resolves a
+ * flag given more than once: `--provenance --no-provenance` publishes without an
+ * attestation, so this must answer false for it.
+ *
+ * Quoting is irrelevant to the shell and so is irrelevant here: `npm publish
+ * "--provenance"` is attested, and the scan this replaces read it as bare.
+ *
+ * @param command - One simple command's tokens.
+ * @returns True when the command publishes with an attestation.
+ */
+export function attestationEnabled(command) {
+    const args = commandArguments(command);
+    let enabled = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const token = args[index].value;
+        if (token === `--no-${ATTESTATION_FLAG.slice(2)}`) {
+            enabled = false;
+            continue;
+        }
+        if (token === ATTESTATION_FLAG) {
+            const next = args[index + 1]?.value;
+            if (next === "true" || next === "false") {
+                enabled = next === "true";
+                index += 1;
+                continue;
+            }
+            enabled = true;
+            continue;
+        }
+        if (token.startsWith(`${ATTESTATION_FLAG}=`)) {
+            enabled = token.slice(ATTESTATION_FLAG.length + 1) === "true";
+        }
+    }
+    return enabled;
+}
+/** Decide whether a segment enters an `else` or `elif` sibling arm. */
+function startsIfSiblingArm(segment) {
+    const first = tokenizeCommands(segment)[0]?.[0]?.value;
+    return first === "else" || first === "elif";
+}
+/**
+ * Find every publish invocation in one file's contents.
+ *
+ * Continuations are joined and shared arrays expanded before tokenising, for
+ * the same reason the changelog-date scan does it: a multi-line invocation
+ * otherwise looks like fragments, none of which carries the flag.
+ *
+ * @param source - The file's path and contents.
+ * @returns The publish invocations found, in file order.
+ */
+function publishInvocationsInShell(source, raw) {
+    const text = joinContinuations(raw);
+    const arrays = bashArrays(text);
+    const lines = text.split("\n");
+    const bodies = heredocBodyLines(lines);
+    const bodyExpansion = heredocExpansionLines(lines);
+    const scopes = [new Map()];
+    let caseDepth = 0;
+    const visibleScalars = () => {
+        const visible = new Map();
+        for (const scope of scopes) {
+            for (const [name, binding] of scope) {
+                if (binding === undefined)
+                    visible.delete(name);
+                else
+                    visible.set(name, binding);
+            }
+        }
+        return visible;
+    };
+    const expanded = lines.map((line, lineIndex) => {
+        // Heredoc bodies cannot mutate the parent binding state. Unquoted bodies
+        // expand variables before being written; quoted bodies retain references,
+        // which fail closed if a generated script later executes them.
+        if (bodies[lineIndex]) {
+            return bodyExpansion[lineIndex]
+                ? expandScalars(expandArrays(line, arrays), visibleScalars())
+                : line;
+        }
+        const segments = segmentShellLine(line);
+        let assignmentEligible = true;
+        let pendingAssignments = new Map();
+        let pendingAssignmentEligible = false;
+        const rendered = segments.map((segment) => {
+            if (/^(?:;|&&?|\|\|?)$/.test(segment)) {
+                const currentScope = scopes[scopes.length - 1];
+                for (const [name, binding] of pendingAssignments) {
+                    // Only a sequential separator persists the assignment in the current
+                    // scope. Ambiguous execution shadows prior evidence fail-closed.
+                    currentScope.set(name, pendingAssignmentEligible && segment === ";" ? binding : undefined);
+                }
+                pendingAssignments = new Map();
+                assignmentEligible = segment === ";";
+                return segment;
+            }
+            // Scope transitions are applied per segment, not per physical line. A
+            // one-line compound command can open, assign, publish, and close without
+            // any net line-level depth change, yet each command still needs the
+            // binding state at the point where it runs.
+            const caseChange = caseDepthChange(segment);
+            // The `case` nesting depth *before* this segment. A segment that opens a
+            // `case` is the first arm of the block it opens and has no earlier
+            // sibling; a segment that starts an arm while already inside a `case` is
+            // a sibling of a previous arm even when it also opens a nested one.
+            // `insideCase` folds this segment's own opener in and so cannot tell the
+            // two apart — see the sibling reset below.
+            const caseDepthBefore = caseDepth;
+            const insideCase = caseDepth > 0 || caseChange > 0;
+            const change = blockDepthChange(segment, insideCase);
+            if (change < 0) {
+                for (let count = 0; count > change && scopes.length > 1; count -= 1) {
+                    const closed = scopes.pop();
+                    const parent = scopes[scopes.length - 1];
+                    // Assignments inside a conditional remain arm-local and are dropped,
+                    // but an unset is destructive evidence. Forgetting it could restore
+                    // an attesting outer value that the real shell discarded.
+                    for (const [name, binding] of closed) {
+                        if (binding === undefined)
+                            parent.set(name, undefined);
+                    }
+                }
+            }
+            caseDepth = Math.max(0, caseDepth + caseChange);
+            // A sibling arm receives a fresh map at the same numeric depth. Clearing
+            // it is the branch identity: evidence from a mutually exclusive arm can
+            // never be visible to this path. Outer scopes remain visible.
+            //
+            // Keyed on the depth BEFORE this segment, never on whether the segment
+            // opens a `case`. A segment that opens one is the first arm of the block
+            // it opens: the push below has not happened yet, so clearing would erase
+            // the OUTER scope and refuse a publish whose flag was bound before the
+            // block, and there is no earlier sibling to hide anyway.
+            //
+            // But "opens a `case`" is NOT the same question. A later arm may itself
+            // open a nested `case` (`b) case "$Y" in`), and it is still a sibling of
+            // the previous arm. Skipping the reset for it leaves that arm's binding
+            // visible and attests a publish the shell would run unattested from a
+            // mutually exclusive arm. `else`/`elif` are siblings unconditionally, for
+            // the same reason, including when they open a nested block.
+            if (startsIfSiblingArm(segment) || (caseDepthBefore > 0 && startsEnclosingCaseArm(segment))) {
+                const currentScope = scopes[scopes.length - 1];
+                const discarded = [...currentScope].filter((entry) => entry[1] === undefined);
+                currentScope.clear();
+                // A destructive operation in either possible arm makes the later value
+                // unprovable. Retain only unsets when moving to a sibling arm; retaining
+                // assignments here would re-open the sibling-evidence defect.
+                for (const [name] of discarded)
+                    currentScope.set(name, undefined);
+            }
+            if (change > 0) {
+                for (let count = 0; count < change; count += 1)
+                    scopes.push(new Map());
+            }
+            const resolved = expandScalars(expandArrays(segment, arrays), visibleScalars());
+            pendingAssignments = literalScalarAssignments(segment);
+            pendingAssignmentEligible = assignmentEligible;
+            const currentScope = scopes[scopes.length - 1];
+            for (const command of tokenizeCommands(segment)) {
+                for (const name of unsetNames(command))
+                    currentScope.set(name, undefined);
+            }
+            assignmentEligible = false;
+            return resolved;
+        });
+        const currentScope = scopes[scopes.length - 1];
+        for (const [name, binding] of pendingAssignments) {
+            currentScope.set(name, pendingAssignmentEligible ? binding : undefined);
+        }
+        return rendered.join("");
+    }).join("\n");
+    const found = [];
+    for (const command of tokenizeCommands(expanded)) {
+        // Every reading, not just the command's own: a wrapper option that takes a
+        // value (`sudo -u root npm publish`) moves the program past where naming it
+        // once would look. Missing a publish is a failed audit; offering one that no
+        // shell would run is noise an operator dismisses.
+        for (const candidate of commandCandidates(command)) {
+            const program = commandName(candidate);
+            if (program === undefined)
+                continue;
+            const unresolvedProgram = program.startsWith("$");
+            if (program !== "npm" && !FOREIGN_PUBLISHERS.has(program) && !unresolvedProgram)
+                continue;
+            if (!isPublishCommand(candidate))
+                continue;
+            // Not de-duplicated: two identical publish lines are two invocations, and
+            // collapsing them would report one of them as if the other did not exist.
+            found.push({ file: source.file, program, command: candidate });
+        }
+    }
+    return found;
+}
+/** A path whose final segment is exactly `package.json`.
+ *
+ * Anchored at a segment boundary rather than matched as a suffix: a tracked
+ * executable named `fake-package.json` ends with the same characters, and
+ * routing it to the manifest reader parses it as JSON, fails, and yields no
+ * bodies — hiding every publish it contains from the audit. Because the
+ * non-vacuity guard is repository-wide, one attested publish elsewhere then
+ * satisfies it and the whole run passes clean. */
+const MANIFEST_PATH = /(?:^|\/)package\.json$/;
+/**
+ * Find every publish invocation in one source, isolating package scripts.
+ *
+ * npm launches every manifest script in a fresh shell, so scalar evidence from
+ * one body can never attest a publish in another body. A workflow file's `run:`
+ * blocks are dedented first — before {@link joinContinuations} and heredoc
+ * detection — because that is what happens to them before bash sees the text:
+ * YAML strips the block indentation when it delivers the value. The order
+ * matters: `dedentRunBlocks` reads the raw YAML line structure to find block
+ * headers and strip their indentation, and `joinContinuations` would merge a
+ * `run:` header with the next line when a backslash continuation sits between
+ * them, destroying the header the dedent needs to see. Heredoc detection runs
+ * after both, because a heredoc terminator must match at the start of the line
+ * bash receives — which is the dedented, continuation-joined text. The one
+ * scanner rule that is whitespace-sensitive is the heredoc terminator, so
+ * dedenting before that rule runs is what makes a `run: |2` block's heredoc
+ * terminator match instead of swallowing the rest of the file.
+ *
+ * @param source - The file's path and contents.
+ * @returns The publish invocations found, in file and script order.
+ */
+export function publishInvocationsIn(source) {
+    const bodies = MANIFEST_PATH.test(source.file)
+        ? manifestCommandBodies(source.text)
+        : isWorkflowYaml(source.file)
+            ? [dedentRunBlocks(source.text)]
+            : [source.text];
+    return bodies.flatMap((body) => publishInvocationsInShell(source, body));
+}
+/**
+ * Render an invocation back to a readable command for a report line.
+ *
+ * @param command - The invocation's tokens.
+ * @returns The command as a single space-separated string.
+ */
+export function renderCommand(command) {
+    return command.map((token) => token.value).join(" ").slice(0, 160);
+}
+/**
+ * Audit every publish invocation across the given files.
+ *
+ * An absent invocation is a failure rather than a pass: a scan that finds
+ * nothing has either been pointed at the wrong files or outlived the workflow
+ * it guards, and both look identical to a clean result unless said out loud.
+ *
+ * A publisher other than npm fails outright rather than being checked for a
+ * flag. This repository's attested path is npm's `--provenance`; no equivalent
+ * is configured for yarn, pnpm or bun, so such an invocation is an unattested
+ * publish path regardless of the flags it carries, and guessing at another
+ * tool's spelling would be a gate that only looked strict.
+ *
+ * @param sources - The tracked files to scan.
+ * @returns Failures and per-file notes.
+ */
+export function auditPublishAttestation(sources) {
+    const invocations = sources.flatMap(publishInvocationsIn);
+    const failures = [];
+    const counted = new Map();
+    for (const invocation of invocations) {
+        const tally = counted.get(invocation.file) ?? { total: 0, unflagged: 0 };
+        tally.total += 1;
+        if (invocation.program !== "npm") {
+            tally.unflagged += 1;
+            failures.push(`${invocation.file}: \`${invocation.program} publish\` is a publish path with no attested`
+                + ` equivalent configured in this repository: ${renderCommand(invocation.command)}`);
+        }
+        else if (!attestationEnabled(invocation.command)) {
+            tally.unflagged += 1;
+            failures.push(`${invocation.file}: a publish invocation does not enable ${ATTESTATION_FLAG}, so it would`
+                + ` publish an unattested artifact: ${renderCommand(invocation.command)}`);
+        }
+        counted.set(invocation.file, tally);
+    }
+    if (invocations.length === 0) {
+        failures.push("no npm publish invocation was found in any tracked file - the scan is looking in the wrong place");
+    }
+    const notes = [];
+    for (const [file, tally] of counted) {
+        if (tally.unflagged > 0)
+            continue;
+        notes.push(`ok - ${file}: ${tally.total} publish invocation(s), each carrying ${ATTESTATION_FLAG}`);
+    }
+    return {
+        failures,
+        notes,
+        recognition: invocations.length === 0
+            ? { kind: "none" }
+            : { kind: "recognized", count: invocations.length },
+    };
+}
+/**
+ * Decide whether a tracked path can run a command.
+ *
+ * The previous enumeration named two paths -- `.github/workflows` and
+ * `package.json` -- which meant a publish added to any tracked script was never
+ * audited, and because the workflow's own attested publish satisfied the
+ * non-vacuity check the gate still reported that every invocation was attested.
+ * Auditing every shape that can execute closes that, and a shebang is honoured
+ * so an extensionless tracked script is not a blind spot either.
+ *
+ * Build output is excluded. `dist/` is generated from sources this scan already
+ * reads, it is regenerated and compared byte-for-byte on the release path, and
+ * including it would audit a bundled copy of a command rather than the command.
+ *
+ * @param path - Repository-relative path.
+ * @param firstLine - The file's first line, for shebang detection.
+ * @returns True when the file should be scanned.
+ */
+export function isExecutableSource(path, firstLine) {
+    if (GENERATED_PREFIXES.some((prefix) => path.startsWith(prefix)))
+        return false;
+    if (firstLine.startsWith("#!"))
+        return true;
+    return EXECUTABLE_PATHS.some((pattern) => pattern.test(path));
+}
+/**
+ * Read the first two bytes of a file, or nothing when it cannot be read.
+ *
+ * Only a shebang is being looked for, so the whole file is never loaded --
+ * `git ls-files` can name a large tracked asset, and this runs once per
+ * candidate. A tracked path that cannot be opened at all (a dangling symlink,
+ * a file removed from the working tree but still in the index) is not a
+ * publish path and must not take the gate down; it reads as empty.
+ *
+ * The handle is closed by an inner `finally` rather than one wrapping the
+ * catch, so there is no unreachable fall-through for the coverage gate to
+ * report as an untested branch.
+ *
+ * @param file - Absolute path to read.
+ * @returns The first two bytes as text, or an empty string.
+ */
+function firstBytes(file) {
+    try {
+        const handle = openSync(file, "r");
+        try {
+            const buffer = Buffer.alloc(2);
+            readSync(handle, buffer, 0, 2, 0);
+            return buffer.toString("utf8");
+        }
+        finally {
+            closeSync(handle);
+        }
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * List the tracked files that can run a publish.
+ *
+ * Git is asked rather than the filesystem walked, so an untracked scratch copy
+ * of a workflow cannot satisfy or fail the gate. `-z` is used because a tracked
+ * path may legally contain a newline, and splitting such a listing on newlines
+ * invents two paths that do not exist and drops the one that does.
+ *
+ * @param root - Repository root.
+ * @returns Repository-relative paths of every tracked file that can execute.
+ */
+export function trackedPublishSources(root) {
+    const listed = execFileSync("git", ["ls-files", "-z"], {
+        cwd: root,
+        encoding: "utf8",
+        maxBuffer: 64 * 1024 * 1024,
+    });
+    return listed
+        .split("\0")
+        .filter((path) => path.length > 0)
+        .filter((path) => isExecutableSource(path, firstBytes(resolve(root, path))));
+}
+/**
+ * Read the tracked sources and audit them.
+ *
+ * @param root - Repository root to verify.
+ * @returns Failures and notes for the whole repository.
+ */
+export function verify(root) {
+    const sources = trackedPublishSources(root).map((file) => ({
+        file,
+        text: readFileSync(resolve(root, file), "utf8"),
+    }));
+    return auditPublishAttestation(sources);
+}
+/**
+ * Print a result and set a failing exit code when it failed.
+ *
+ * @param result - The audit outcome.
+ * @param write - Sink for the report lines.
+ * @param exit - Called with the process exit code when there were failures.
+ */
+export function report(result, write, exit) {
+    for (const note of result.notes)
+        write(note);
+    for (const failure of result.failures)
+        write(`FAIL - ${failure}`);
+    if (result.failures.length > 0) {
+        write(`verify-release-publish-attestation: ${result.failures.length} failure(s).`);
+        exit(1);
+        return;
+    }
+    write("verify-release-publish-attestation: every publish invocation is attested.");
+}
+//# sourceMappingURL=attestation.js.map

package/dist/attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation.js","sourceRoot":"","sources":["../attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,EACjB,wBAAwB,EACxB,gBAAgB,EAGhB,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,GAEX,MAAM,iBAAiB,CAAC;AAEzB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAuB/C,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnE,sFAAsF;AACtF,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;AAE1F;;;;;;GAMG;AACH,MAAM,cAAc,GAAG;IACrB,qCAAqC;IACrC,0EAA0E;IAC1E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,+DAA+D;IAC/D,sBAAsB;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CAC/C,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAEvD,8FAA8F;AAC9F,MAAM,gBAAgB,GAAG;IACvB,GAAG,cAAc;IACjB,sBAAsB;IACtB,sBAAsB;IACtB,wCAAwC;IACxC,OAAO;IACP,+BAA+B;IAC/B,0CAA0C;CAC3C,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAI,MAAgC,CAAC,OAAO,CAAC;IAC1D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,OAAkC,CAAC;SACrD,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,2EAA2E;IAC3E,6EAA6E;IAC7E,OAAO,qBAAqB,CAAC,IAAI,CAAC;SAC/B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI;IAC/D,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY;IACrE,mBAAmB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW;CACtE,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC;QAC3B,yEAAyE;QACzE,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,KAAK,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClE,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1C,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAqB;IACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAE,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,KAAK,QAAQ,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAClD,OAAO,GAAG,KAAK,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC;YACpC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC;gBAC1B,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uEAAuE;AACvE,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACvD,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB,CAAC,MAAkB,EAAE,GAAW;IAChE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2C,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACnE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,cAAc,GAAG,GAAwB,EAAE;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;gBACpC,IAAI,OAAO,KAAK,SAAS;oBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;oBAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAC7C,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,IAAI,MAAM,CAAC,SAAS,CAAE,EAAE,CAAC;YACvB,OAAO,aAAa,CAAC,SAAS,CAAE;gBAC9B,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;gBAC7D,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAExC,IAAI,kBAAkB,GAAG,IAAI,CAAC;QAC9B,IAAI,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;QACnD,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACxC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBAChD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,kBAAkB,EAAE,CAAC;oBACjD,qEAAqE;oBACrE,iEAAiE;oBACjE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,yBAAyB,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC7F,CAAC;gBACD,kBAAkB,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC/B,kBAAkB,GAAG,OAAO,KAAK,GAAG,CAAC;gBACrC,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,4CAA4C;YAC5C,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YAC5C,yEAAyE;YACzE,mEAAmE;YACnE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,2CAA2C;YAC3C,MAAM,eAAe,GAAG,SAAS,CAAC;YAClC,MAAM,UAAU,GAAG,SAAS,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACrD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;oBACpE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAG,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;oBAC1C,qEAAqE;oBACrE,oEAAoE;oBACpE,0DAA0D;oBAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;wBACrC,IAAI,OAAO,KAAK,SAAS;4BAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACzD,CAAC;gBACH,CAAC;YACH,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;YAEhD,yEAAyE;YACzE,wEAAwE;YACxE,8DAA8D;YAC9D,EAAE;YACF,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,uEAAuE;YACvE,yDAAyD;YACzD,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,0EAA0E;YAC1E,4DAA4D;YAC5D,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5F,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;gBAChD,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;gBAC9E,YAAY,CAAC,KAAK,EAAE,CAAC;gBACrB,uEAAuE;gBACvE,yEAAyE;gBACzE,8DAA8D;gBAC9D,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,SAAS;oBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC;YAChF,kBAAkB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;YACvD,yBAAyB,GAAG,kBAAkB,CAAC;YAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAChD,KAAK,MAAM,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC;oBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5E,CAAC;YACD,kBAAkB,GAAG,KAAK,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACjD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAwB,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,kDAAkD;QAClD,KAAK,MAAM,SAAS,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB;gBAAE,SAAS;YAC1F,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC3C,0EAA0E;YAC1E,0EAA0E;YAC1E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;kDAOkD;AAClD,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC;QACpC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAqB;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgD,CAAC;IACxE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACzE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACjC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,IAAI,OAAO,UAAU,CAAC,OAAO,+CAA+C;kBACxF,8CAA8C,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;aAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,IAAI,0CAA0C,gBAAgB,eAAe;kBACzF,oCAAoC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAC1E,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC;YAAE,SAAS;QAClC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,CAAC,KAAK,yCAAyC,gBAAgB,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,OAAO;QACL,QAAQ;QACR,KAAK;QACL,WAAW,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;YACnC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE;YAClB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAiB;IAChE,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE;QACrD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,MAAM,OAAO,GAAiB,qBAAqB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI;QACJ,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC;KAChD,CAAC,CAAC,CAAC;IACJ,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CACpB,MAAsB,EACtB,KAA6B,EAC7B,IAA4B;IAE5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,uCAAuC,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,CAAC,CAAC;QACR,OAAO;IACT,CAAC;IACD,KAAK,CAAC,2EAA2E,CAAC,CAAC;AACrF,CAAC"}