wingfoil 0.2.1

package/dist/validation/errors.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Shared validation error types and exit codes (spec-009-validation-strategy §3).
+ *
+ * A single {@link ValidationError} carries the full list of mapped issues from one validation run
+ * so no failure is ever silently dropped. Its {@link ValidationError.exitCode} follows spec-009 §3,
+ * which keys the code on the **nature** of the failure, not on the pass that detects it: parse and
+ * system-integrity failures exit `2`; every other validation failure — field-level, mapped, generic,
+ * and business-rule failures detected in Pass 2 (e.g. `E_INVALID_TRANSITION`, `E_INVALID_STATE`) —
+ * exits `1`, matching spec-008's exit-code table.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ValidationError = exports.E_VALIDATION = exports.E_YAML_PARSE_ERROR = exports.EXIT_INTEGRITY = exports.EXIT_VALIDATION = void 0;
+/**
+ * Process exit code for a validation failure whose worst issue is a mapped `E_INVALID_*` /
+ * `E_INVALID_*_SCHEMA` or the generic `E_VALIDATION` fallback (spec-009 §3, spec-008 exit table).
+ */
+exports.EXIT_VALIDATION = 1;
+/**
+ * Process exit code for a parse or system-integrity failure — `E_YAML_PARSE_ERROR`, and the
+ * cross-file integrity checks that presuppose a parseable tree: the input could not be understood,
+ * or the installation is inconsistent (spec-009 §3, spec-008 exit table). **Not** every Pass-2
+ * failure: spec-009 §3 keys exit codes on the nature of the failure, not the pass, so a business-rule
+ * failure found in Pass 2 (an illegal transition, an invalid state) exits {@link EXIT_VALIDATION}.
+ */
+exports.EXIT_INTEGRITY = 2;
+/** `E_*` code emitted when a file cannot be parsed as YAML at all, before Zod runs (spec-009 §3). */
+exports.E_YAML_PARSE_ERROR = 'E_YAML_PARSE_ERROR';
+/** Generic fallback code for any issue with no explicit `ErrorMap` entry (spec-009 §3). */
+exports.E_VALIDATION = 'E_VALIDATION';
+/**
+ * The single error type thrown by every validation path. Extends {@link Error} so it integrates
+ * with normal throw/catch, but always carries the structured {@link issues} list and the process
+ * {@link exitCode} the CLI/MCP surface should exit with.
+ */
+class ValidationError extends Error {
+    issues;
+    exitCode;
+    constructor(issues, exitCode = exports.EXIT_VALIDATION) {
+        super(issues.length > 0
+            ? issues.map((i) => `${i.code} ${i.path ? `${i.path} ` : ''}(${i.file}): ${i.message}`).join('; ')
+            : 'validation failed');
+        this.name = 'ValidationError';
+        this.issues = issues;
+        this.exitCode = exitCode;
+        // Restore the prototype chain so `instanceof ValidationError` holds after transpilation.
+        Object.setPrototypeOf(this, ValidationError.prototype);
+    }
+    /**
+     * Build a pre-parse YAML failure. Exits `2` (integrity) because it means the file could not even
+     * be turned into a data structure — Zod never ran.
+     */
+    static yamlParse(filePath, message) {
+        return new ValidationError([{ code: exports.E_YAML_PARSE_ERROR, path: '', file: filePath, message }], exports.EXIT_INTEGRITY);
+    }
+    /**
+     * Build a **system-integrity** failure detected after parsing. Exits `2` ({@link EXIT_INTEGRITY}).
+     * Use it only when the input could not be understood or the installation is inconsistent (e.g. a
+     * loader's cross-file check, a malformed `id_pattern`). It is **not** the constructor for every
+     * Pass-2 check: spec-009 §3 keys exit codes on the nature of the failure, not the detecting pass,
+     * so a business-rule failure found in Pass 2 (`E_INVALID_TRANSITION`, `E_INVALID_STATE`) is built
+     * with the plain constructor and exits `1`.
+     */
+    static semantic(issues) {
+        return new ValidationError(issues, exports.EXIT_INTEGRITY);
+    }
+}
+exports.ValidationError = ValidationError;
+//# sourceMappingURL=errors.js.map

package/dist/validation/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/validation/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAoBH;;;GAGG;AACU,QAAA,eAAe,GAAG,CAAC,CAAC;AAEjC;;;;;;GAMG;AACU,QAAA,cAAc,GAAG,CAAC,CAAC;AAEhC,qGAAqG;AACxF,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,2FAA2F;AAC9E,QAAA,YAAY,GAAG,cAAc,CAAC;AAE3C;;;;GAIG;AACH,MAAa,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAA6B;IACnC,QAAQ,CAAS;IAE1B,YAAY,MAAyB,EAAE,WAAmB,uBAAe;QACvE,KAAK,CACH,MAAM,CAAC,MAAM,GAAG,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAClG,CAAC,CAAC,mBAAmB,CACxB,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,yFAAyF;QACzF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,SAAS,CAAC,QAAgB,EAAE,OAAe;QAChD,OAAO,IAAI,eAAe,CACxB,CAAC,EAAE,IAAI,EAAE,0BAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EACjE,sBAAc,CACf,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CAAC,MAAyB;QACvC,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,sBAAc,CAAC,CAAC;IACrD,CAAC;CACF;AAvCD,0CAuCC"}

package/dist/validation/id.d.ts

@@ -0,0 +1,16 @@
+/** The shared ID character class (spec-009 §1): lowercase alphanumerics, `-`, and `.`. */
+export declare const ID_CHAR_CLASS = "a-z0-9-.";
+/**
+ * Build the RegExp an ID produced from `pattern` must match: literals are matched verbatim, numeric
+ * tokens as `[0-9]+`, and every other token as a hyphen-separated `[a-z0-9.]` slug.
+ */
+export declare function patternToRegExp(pattern: string): RegExp;
+/**
+ * Generate a concrete ID from `pattern` and `values`.
+ *
+ * @throws {@link ValidationError} `E_INVALID_ID_PATTERN_CHARS` (exit 2) if the pattern's literals
+ *   leave the ID character class, or `E_INVALID_ID` (exit 1) if a value is missing, mistyped, or
+ *   would produce an ID outside `[a-z0-9-.]`.
+ */
+export declare function generateId(pattern: string, values: Record<string, string | number>): string;
+//# sourceMappingURL=id.d.ts.map

package/dist/validation/id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/validation/id.ts"],"names":[],"mappings":"AAoBA,0FAA0F;AAC1F,eAAO,MAAM,aAAa,aAAa,CAAC;AAkDxC;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYvD;AAeD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,CA2D3F"}

package/dist/validation/id.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ID_CHAR_CLASS = void 0;
+exports.patternToRegExp = patternToRegExp;
+exports.generateId = generateId;
+/**
+ * ID-generation engine (task-002-validation-id-engine, acceptance criteria 5).
+ *
+ * Generates a concrete Memory-element ID from a type's `id_pattern` (declared in
+ * `docs/self/.wingfoil/memory.yaml`, e.g. `task-{n}-{slug}`) plus values for its `{placeholder}`
+ * tokens. It enforces the shared ID character class `[a-z0-9-.]` that spec-009-validation-strategy
+ * §1 frames as a Pass-2 rule owned by "the shared ID constants":
+ *
+ *  - Every literal character of the pattern (outside `{...}` tokens) must be in `[a-z0-9-.]`;
+ *    otherwise `E_INVALID_ID_PATTERN_CHARS` (integrity failure, exit 2 — the pattern itself is
+ *    malformed).
+ *  - Every rendered value must keep the produced ID inside `[a-z0-9-.]`; otherwise `E_INVALID_ID`
+ *    (field-level failure, exit 1).
+ *
+ * It lives under `src/validation` (not `src/core`) because spec-009 §1 co-locates the id-character
+ * rule with the validation module, and `runValidation`'s Pass-2 id-pattern check consumes the same
+ * character class exported here — keeping one source of truth for what a legal ID looks like.
+ */
+const errors_1 = require("./errors");
+/** The shared ID character class (spec-009 §1): lowercase alphanumerics, `-`, and `.`. */
+exports.ID_CHAR_CLASS = 'a-z0-9-.';
+/** A rendered ID (or ID piece) must match this end-to-end. `-` is placed last to avoid a range. */
+const ID_PIECE_RE = /^[a-z0-9.-]+$/;
+/** A literal pattern segment: every character must be a member of the ID character class. */
+const LITERAL_RE = /^[a-z0-9.-]+$/;
+/** A numeric token is one written purely as `n` (e.g. `{n}`, `{nn}`, `{nnn}`). */
+const NUMERIC_TOKEN_RE = /^n+$/;
+/** Minimum zero-pad width for numeric tokens (observed convention: task-001, adr-005, spec-009). */
+const DEFAULT_PAD_WIDTH = 3;
+const TOKEN_RE = /\{([^{}]+)\}/g;
+/** Split a pattern into ordered literal / token segments. */
+function parsePattern(pattern) {
+    const segments = [];
+    let lastIndex = 0;
+    TOKEN_RE.lastIndex = 0;
+    let match;
+    while ((match = TOKEN_RE.exec(pattern)) !== null) {
+        if (match.index > lastIndex) {
+            segments.push({ kind: 'literal', value: pattern.slice(lastIndex, match.index) });
+        }
+        segments.push({ kind: 'token', value: match[1] ?? '' });
+        lastIndex = match.index + match[0].length;
+    }
+    if (lastIndex < pattern.length) {
+        segments.push({ kind: 'literal', value: pattern.slice(lastIndex) });
+    }
+    return segments;
+}
+function isNumericToken(token) {
+    return NUMERIC_TOKEN_RE.test(token);
+}
+/** Escape a literal segment for safe insertion into a RegExp source. */
+function escapeLiteral(literal) {
+    return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Build the RegExp an ID produced from `pattern` must match: literals are matched verbatim, numeric
+ * tokens as `[0-9]+`, and every other token as a hyphen-separated `[a-z0-9.]` slug.
+ */
+function patternToRegExp(pattern) {
+    const segments = parsePattern(pattern);
+    let source = '^';
+    for (const segment of segments) {
+        if (segment.kind === 'literal') {
+            source += escapeLiteral(segment.value);
+        }
+        else {
+            source += isNumericToken(segment.value) ? '[0-9]+' : '[a-z0-9.]+(?:-[a-z0-9.]+)*';
+        }
+    }
+    source += '$';
+    return new RegExp(source);
+}
+/** Collect, in order of first appearance, the characters of `literal` outside the ID class. */
+function offendingChars(literal) {
+    const seen = new Set();
+    const out = [];
+    for (const ch of literal) {
+        if (!LITERAL_RE.test(ch) && !seen.has(ch)) {
+            seen.add(ch);
+            out.push(ch);
+        }
+    }
+    return out;
+}
+/**
+ * Generate a concrete ID from `pattern` and `values`.
+ *
+ * @throws {@link ValidationError} `E_INVALID_ID_PATTERN_CHARS` (exit 2) if the pattern's literals
+ *   leave the ID character class, or `E_INVALID_ID` (exit 1) if a value is missing, mistyped, or
+ *   would produce an ID outside `[a-z0-9-.]`.
+ */
+function generateId(pattern, values) {
+    const segments = parsePattern(pattern);
+    // Pass A — pattern literals must all be inside the ID character class (integrity failure).
+    const badChars = new Set();
+    for (const segment of segments) {
+        if (segment.kind === 'literal') {
+            for (const ch of offendingChars(segment.value))
+                badChars.add(ch);
+        }
+    }
+    if (badChars.size > 0) {
+        throw errors_1.ValidationError.semantic([
+            {
+                code: 'E_INVALID_ID_PATTERN_CHARS',
+                path: 'id_pattern',
+                file: pattern,
+                message: `pattern contains character(s) outside [${exports.ID_CHAR_CLASS}]: ${[...badChars].join(', ')}`,
+            },
+        ]);
+    }
+    // Pass B — render each token, collecting value-level failures.
+    const issues = [];
+    let id = '';
+    for (const segment of segments) {
+        if (segment.kind === 'literal') {
+            id += segment.value;
+            continue;
+        }
+        const token = segment.value;
+        const value = values[token];
+        if (value === undefined) {
+            issues.push(invalidId(pattern, `missing value for token {${token}}`));
+            continue;
+        }
+        if (isNumericToken(token)) {
+            const rendered = renderNumeric(token, value);
+            if (rendered === null) {
+                issues.push(invalidId(pattern, `token {${token}} expects a non-negative integer, got "${String(value)}"`));
+                continue;
+            }
+            id += rendered;
+        }
+        else {
+            if (typeof value !== 'string' || !ID_PIECE_RE.test(value)) {
+                issues.push(invalidId(pattern, `value for token {${token}} is not a valid [${exports.ID_CHAR_CLASS}] piece: "${String(value)}"`));
+                continue;
+            }
+            id += value;
+        }
+    }
+    if (issues.length > 0) {
+        throw new errors_1.ValidationError(issues);
+    }
+    // Pass C — final safety net: the assembled ID must match the pattern and the ID character class.
+    if (!ID_PIECE_RE.test(id) || !patternToRegExp(pattern).test(id)) {
+        throw new errors_1.ValidationError([invalidId(pattern, `generated id "${id}" does not conform to pattern`)]);
+    }
+    return id;
+}
+function invalidId(pattern, message) {
+    return { code: 'E_INVALID_ID', path: 'id', file: pattern, message };
+}
+/** Render a numeric token, zero-padded to at least the token width (min 3). `null` if not numeric. */
+function renderNumeric(token, value) {
+    let n;
+    if (typeof value === 'number') {
+        n = value;
+    }
+    else if (/^\d+$/.test(value)) {
+        n = Number(value);
+    }
+    else {
+        return null;
+    }
+    if (!Number.isInteger(n) || n < 0)
+        return null;
+    const width = Math.max(DEFAULT_PAD_WIDTH, token.length);
+    return String(n).padStart(width, '0');
+}
+//# sourceMappingURL=id.js.map

package/dist/validation/id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../../src/validation/id.ts"],"names":[],"mappings":";;;AA2EA,0CAYC;AAsBD,gCA2DC;AAxKD;;;;;;;;;;;;;;;;;GAiBG;AACH,qCAA4D;AAE5D,0FAA0F;AAC7E,QAAA,aAAa,GAAG,UAAU,CAAC;AAExC,mGAAmG;AACnG,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC,6FAA6F;AAC7F,MAAM,UAAU,GAAG,eAAe,CAAC;AAEnC,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,oGAAoG;AACpG,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAQ5B,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,6DAA6D;AAC7D,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACvB,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxD,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,CAAC;IACD,IAAI,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,wEAAwE;AACxE,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,4BAA4B,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,+FAA+F;AAC/F,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CAAC,OAAe,EAAE,MAAuC;IACjF,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEvC,2FAA2F;IAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,wBAAe,CAAC,QAAQ,CAAC;YAC7B;gBACE,IAAI,EAAE,4BAA4B;gBAClC,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,0CAA0C,qBAAa,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACjG;SACF,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,4BAA4B,KAAK,GAAG,CAAC,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,KAAK,0CAA0C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC3G,SAAS;YACX,CAAC;YACD,EAAE,IAAI,QAAQ,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,KAAK,qBAAqB,qBAAa,aAAa,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1H,SAAS;YACX,CAAC;YACD,EAAE,IAAI,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,wBAAe,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,iGAAiG;IACjG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,wBAAe,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,iBAAiB,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,OAAe;IACjD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,sGAAsG;AACtG,SAAS,aAAa,CAAC,KAAa,EAAE,KAAsB;IAC1D,IAAI,CAAS,CAAC;IACd,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,CAAC,GAAG,KAAK,CAAC;IACZ,CAAC;SAAM,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/dist/validation/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `src/validation` — the shared validation & ID module (spec-009-validation-strategy,
+ * task-002-validation-id-engine). Single entry point every schema (spec-001/002/003 and the
+ * frontmatter schema) and CLI/MCP surface (spec-008) calls, so parsing, unknown-field handling,
+ * error-code naming, and ID generation stay uniform project-wide.
+ */
+export { E_VALIDATION, E_YAML_PARSE_ERROR, EXIT_INTEGRITY, EXIT_VALIDATION, ValidationError, } from './errors';
+export type { ValidationIssue } from './errors';
+export { toValidationError } from './error-mapper';
+export { emitUnknownFieldWarning } from './warning';
+export type { HasShape } from './warning';
+export { runValidation } from './two-pass';
+export type { RunValidationOptions, SemanticCheck } from './two-pass';
+export { generateId, patternToRegExp, ID_CHAR_CLASS } from './id';
+export { parseYaml } from './yaml';
+export { SECRET_PATTERNS, SCAN_SURFACE_ROOTS, DEFAULT_IGNORE_FILE, scanText, scanProjectSurface, isBinaryContent, loadIgnoreGlobs, matchesIgnoreGlob, } from './secret-scan';
+export type { SecretSeverity, SecretPattern, ExemptReason, SecretFinding, ExemptFinding, ScanResult, ScanTextOptions, ScanProjectOptions, } from './secret-scan';
+//# sourceMappingURL=index.d.ts.map

package/dist/validation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,UAAU,EACV,eAAe,EACf,kBAAkB,GACnB,MAAM,eAAe,CAAC"}

package/dist/validation/index.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.matchesIgnoreGlob = exports.loadIgnoreGlobs = exports.isBinaryContent = exports.scanProjectSurface = exports.scanText = exports.DEFAULT_IGNORE_FILE = exports.SCAN_SURFACE_ROOTS = exports.SECRET_PATTERNS = exports.parseYaml = exports.ID_CHAR_CLASS = exports.patternToRegExp = exports.generateId = exports.runValidation = exports.emitUnknownFieldWarning = exports.toValidationError = exports.ValidationError = exports.EXIT_VALIDATION = exports.EXIT_INTEGRITY = exports.E_YAML_PARSE_ERROR = exports.E_VALIDATION = void 0;
+/**
+ * `src/validation` — the shared validation & ID module (spec-009-validation-strategy,
+ * task-002-validation-id-engine). Single entry point every schema (spec-001/002/003 and the
+ * frontmatter schema) and CLI/MCP surface (spec-008) calls, so parsing, unknown-field handling,
+ * error-code naming, and ID generation stay uniform project-wide.
+ */
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "E_VALIDATION", { enumerable: true, get: function () { return errors_1.E_VALIDATION; } });
+Object.defineProperty(exports, "E_YAML_PARSE_ERROR", { enumerable: true, get: function () { return errors_1.E_YAML_PARSE_ERROR; } });
+Object.defineProperty(exports, "EXIT_INTEGRITY", { enumerable: true, get: function () { return errors_1.EXIT_INTEGRITY; } });
+Object.defineProperty(exports, "EXIT_VALIDATION", { enumerable: true, get: function () { return errors_1.EXIT_VALIDATION; } });
+Object.defineProperty(exports, "ValidationError", { enumerable: true, get: function () { return errors_1.ValidationError; } });
+var error_mapper_1 = require("./error-mapper");
+Object.defineProperty(exports, "toValidationError", { enumerable: true, get: function () { return error_mapper_1.toValidationError; } });
+var warning_1 = require("./warning");
+Object.defineProperty(exports, "emitUnknownFieldWarning", { enumerable: true, get: function () { return warning_1.emitUnknownFieldWarning; } });
+var two_pass_1 = require("./two-pass");
+Object.defineProperty(exports, "runValidation", { enumerable: true, get: function () { return two_pass_1.runValidation; } });
+var id_1 = require("./id");
+Object.defineProperty(exports, "generateId", { enumerable: true, get: function () { return id_1.generateId; } });
+Object.defineProperty(exports, "patternToRegExp", { enumerable: true, get: function () { return id_1.patternToRegExp; } });
+Object.defineProperty(exports, "ID_CHAR_CLASS", { enumerable: true, get: function () { return id_1.ID_CHAR_CLASS; } });
+var yaml_1 = require("./yaml");
+Object.defineProperty(exports, "parseYaml", { enumerable: true, get: function () { return yaml_1.parseYaml; } });
+var secret_scan_1 = require("./secret-scan");
+Object.defineProperty(exports, "SECRET_PATTERNS", { enumerable: true, get: function () { return secret_scan_1.SECRET_PATTERNS; } });
+Object.defineProperty(exports, "SCAN_SURFACE_ROOTS", { enumerable: true, get: function () { return secret_scan_1.SCAN_SURFACE_ROOTS; } });
+Object.defineProperty(exports, "DEFAULT_IGNORE_FILE", { enumerable: true, get: function () { return secret_scan_1.DEFAULT_IGNORE_FILE; } });
+Object.defineProperty(exports, "scanText", { enumerable: true, get: function () { return secret_scan_1.scanText; } });
+Object.defineProperty(exports, "scanProjectSurface", { enumerable: true, get: function () { return secret_scan_1.scanProjectSurface; } });
+Object.defineProperty(exports, "isBinaryContent", { enumerable: true, get: function () { return secret_scan_1.isBinaryContent; } });
+Object.defineProperty(exports, "loadIgnoreGlobs", { enumerable: true, get: function () { return secret_scan_1.loadIgnoreGlobs; } });
+Object.defineProperty(exports, "matchesIgnoreGlob", { enumerable: true, get: function () { return secret_scan_1.matchesIgnoreGlob; } });
+//# sourceMappingURL=index.js.map

package/dist/validation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/validation/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,mCAMkB;AALhB,sGAAA,YAAY,OAAA;AACZ,4GAAA,kBAAkB,OAAA;AAClB,wGAAA,cAAc,OAAA;AACd,yGAAA,eAAe,OAAA;AACf,yGAAA,eAAe,OAAA;AAGjB,+CAAmD;AAA1C,iHAAA,iBAAiB,OAAA;AAC1B,qCAAoD;AAA3C,kHAAA,uBAAuB,OAAA;AAEhC,uCAA2C;AAAlC,yGAAA,aAAa,OAAA;AAEtB,2BAAkE;AAAzD,gGAAA,UAAU,OAAA;AAAE,qGAAA,eAAe,OAAA;AAAE,mGAAA,aAAa,OAAA;AACnD,+BAAmC;AAA1B,iGAAA,SAAS,OAAA;AAClB,6CASuB;AARrB,8GAAA,eAAe,OAAA;AACf,iHAAA,kBAAkB,OAAA;AAClB,kHAAA,mBAAmB,OAAA;AACnB,uGAAA,QAAQ,OAAA;AACR,iHAAA,kBAAkB,OAAA;AAClB,8GAAA,eAAe,OAAA;AACf,8GAAA,eAAe,OAAA;AACf,gHAAA,iBAAiB,OAAA"}

package/dist/validation/secret-scan.d.ts

@@ -0,0 +1,129 @@
+/** A finding's severity (spec-007 §2): `block` fails the scan, `warn` is reported only. */
+export type SecretSeverity = 'block' | 'warn';
+/** One canonical secret-hygiene rule (spec-007 §2): `{id, regex, description, severity}`. */
+export interface SecretPattern {
+    /** Stable rule name, e.g. `private-key-pem` — also {@link SecretFinding.patternId}. */
+    readonly id: string;
+    /** Human-readable description of what the pattern targets. */
+    readonly description: string;
+    /** `block` fails the scan; `warn` is reported for human review only (spec-007 §2). */
+    readonly severity: SecretSeverity;
+    /** The compiled detection regex (case sensitivity mirrors spec-007's per-pattern `(?i)` marker). */
+    readonly regex: RegExp;
+}
+/**
+ * The canonical secret-hygiene pattern set (spec-007 §2), in the fixed declaration order every scan
+ * must evaluate patterns in (determinism, REQ-SYS-07, spec-007 §4 step 3). Adding, removing, or
+ * re-classifying a pattern is a revision to spec-007's §2 table, not a call-site code change.
+ */
+export declare const SECRET_PATTERNS: readonly SecretPattern[];
+/** Why a would-be finding was downgraded to {@link ScanResult.info} instead of failing the scan. */
+export type ExemptReason = 'fenced-example' | 'placeholder-value' | 'ignore-path';
+/** One pattern match (spec-007 §4): `{pattern_id, severity, file, line, column, excerpt}`. */
+export interface SecretFinding {
+    /** {@link SecretPattern.id} of the rule that matched. */
+    readonly patternId: string;
+    /** The matching pattern's severity at declaration time (before any exclusion is applied). */
+    readonly severity: SecretSeverity;
+    /** Path of the file the finding was found in, as given to the scan call. */
+    readonly file: string;
+    /** 1-based line number. */
+    readonly line: number;
+    /** 1-based column of the match start. */
+    readonly column: number;
+    /** The matched substring. */
+    readonly excerpt: string;
+}
+/** A {@link SecretFinding} downgraded by one of spec-007 §3's exclusions — still reported, not failed. */
+export interface ExemptFinding extends SecretFinding {
+    /** Which §3 exclusion downgraded this finding. */
+    readonly exemptReason: ExemptReason;
+}
+/**
+ * The outcome of a scan (spec-007 §4): `blocking.length === 0` is required for a caller to proceed;
+ * `warnings` and `info` are always returned for display regardless of outcome (spec-007 §4 step 6).
+ */
+export interface ScanResult {
+    /** `block`-severity findings that survived exclusion — fail the scan. */
+    readonly blocking: readonly SecretFinding[];
+    /** `warn`-severity findings that survived exclusion — reported, do not fail the scan. */
+    readonly warnings: readonly SecretFinding[];
+    /** Findings downgraded by a spec-007 §3 exclusion — still listed, never fail the scan. */
+    readonly info: readonly ExemptFinding[];
+    /**
+     * How many files' text this result covers — `1` from {@link scanText}, the number of non-binary
+     * indexed files actually read from {@link scanProjectSurface} (binaries skipped per spec-007 §1
+     * are not counted, because their content was never examined).
+     *
+     * Without it an empty `blocking` list is ambiguous: a caller — or an assertion — cannot tell
+     * "every file was read and all were clean" from "no file was read at all" (a missing surface
+     * root, an empty index, a wrong `root`). Callers gating on `blocking.length === 0` should check
+     * that this is non-zero before trusting a clean verdict.
+     */
+    readonly filesScanned: number;
+}
+/** Options for {@link scanText}. */
+export interface ScanTextOptions {
+    /**
+     * When `true`, every finding in this file is downgraded to `info` with `exemptReason:
+     * 'ignore-path'` (spec-007 §3's `security-ignore` glob exclusion) — the file itself still gets
+     * scanned so the exemption is auditable rather than a silent skip.
+     */
+    readonly pathIgnored?: boolean;
+}
+/**
+ * Scan one file's already-decoded text content (spec-007 §4): evaluate {@link SECRET_PATTERNS} in
+ * declared order against every line, apply the §3 exclusions, and classify each surviving finding by
+ * severity. This is the seam a future commit-time gate or `task-044`'s `init` integrity check calls
+ * per file-about-to-be-written/committed (spec-007 §4 step 5).
+ */
+export declare function scanText(content: string, filePath: string, options?: ScanTextOptions): ScanResult;
+/** Null-byte sniff on the first 8KB (spec-007 §1) — binary files are out of scan scope. */
+export declare function isBinaryContent(buf: Buffer): boolean;
+/**
+ * Default scan-surface roots (spec-007 §1): `.wingfoil/` once `init` exists, plus the current
+ * self-hosted analog (`docs/self/.wingfoil/`, `docs/self/docs/04_memory/`) "applied by analogy until
+ * the tool-managed root exists". A root with no indexed files contributes nothing, so
+ * {@link scanProjectSurface} is safe to call before `init` has ever run.
+ */
+export declare const SCAN_SURFACE_ROOTS: readonly [".wingfoil", "docs/self/.wingfoil", "docs/self/docs/04_memory"];
+/** Default path (root-relative) of the `security-ignore` glob list (spec-007 §3). */
+export declare const DEFAULT_IGNORE_FILE = ".wingfoil/security-ignore";
+/**
+ * Parse a `security-ignore` file (spec-007 §3): one glob per line, git-attribute-style — blank lines
+ * and lines starting with `#` are ignored. Returns `[]` when `ignoreFilePath` does not exist (no
+ * ignore list configured is not an error).
+ */
+export declare function loadIgnoreGlobs(ignoreFilePath: string): string[];
+/** True when root-relative `filePath` matches any glob in `globs` (spec-007 §3 ignore-path exclusion). */
+export declare function matchesIgnoreGlob(filePath: string, globs: readonly string[]): boolean;
+/** Options for {@link scanProjectSurface}. */
+export interface ScanProjectOptions {
+    /** Override the default scan-surface roots ({@link SCAN_SURFACE_ROOTS}). */
+    readonly surfaceRoots?: readonly string[];
+    /** Root-relative path to the `security-ignore` glob list (default {@link DEFAULT_IGNORE_FILE}). */
+    readonly ignoreFilePath?: string;
+}
+/**
+ * Run the full scan procedure (spec-007 §4) over `root`'s tracked/staged content under the scan
+ * surface (§1): list the indexed blobs via `git ls-files -s`, read them from the object store, skip
+ * binaries (§1), apply the `security-ignore` list (§3) as a per-file `pathIgnored` flag, and scan every
+ * remaining file's text with {@link scanText}.
+ *
+ * **Contract — the git index, not the working tree (`bug-015`).** Both the file list and the content
+ * come from the index: the scan judges exactly what the next commit would contain, which is what the
+ * pre-commit / pre-publish gate of spec-007 §4 step 5 must judge. So a file deleted on disk but still
+ * indexed is scanned from its staged blob; a staged deletion is not listed; an unstaged edit — clean or
+ * leaky — is not seen until it is staged. (Before `bug-015` the list came from the index but the bytes
+ * from disk, so an unstaged deletion threw `ENOENT` and took the whole scan down.) The
+ * `security-ignore` file itself is read from disk: it configures the scan, it is not scanned content.
+ * `root` must be a git work tree.
+ *
+ * This is the concrete entry point the REQ-SEC-08 Fit Criterion ("a scan of committed `.wingfoil/`
+ * content matches 0 known secret patterns") is checkable against: `scanProjectSurface(root).blocking`
+ * must be empty for a hygienic project. Pair that with {@link ScanResult.filesScanned} — an empty
+ * `blocking` list only means "clean" once it is known that files were actually read; `filesScanned`
+ * is `0` when no surface root exists or the index is empty under it.
+ */
+export declare function scanProjectSurface(root: string, options?: ScanProjectOptions): ScanResult;
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/validation/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../../src/validation/secret-scan.ts"],"names":[],"mappings":"AAmBA,2FAA2F;AAC3F,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC;AAE9C,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,aAAa,EA8EnD,CAAC;AAEF,oGAAoG;AACpG,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,aAAa,CAAC;AAElF,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,0GAA0G;AAC1G,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,SAAS,aAAa,EAAE,CAAC;IACxC;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAwDD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,UAAU,CA2CrG;AAYD,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,2EAA4E,CAAC;AAE5G,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAoE/D;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAMhE;AA8BD,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAErF;AAED,8CAA8C;AAC9C,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,mGAAmG;IACnG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,UAAU,CAY7F"}