modwire 10.0.0__tar.gz → 10.1.0__tar.gz

{modwire-10.0.0 → modwire-10.1.0}/.dev/modwire.egg-info/SOURCES.txt

@@ -291,6 +291,7 @@ src/modwire/shared/code/models/source_inheritance.py
 src/modwire/shared/code/models/source_interface.py
 src/modwire/shared/code/models/source_item_result.py
 src/modwire/shared/code/models/source_manifest.py
+src/modwire/shared/code/models/source_manifest_identity.py
 src/modwire/shared/code/models/source_member_kind.py
 src/modwire/shared/code/models/source_parameter.py
 src/modwire/shared/code/models/source_relation_kind.py
@@ -315,6 +316,7 @@ tests/application/test_01_attacks.py
 tests/application/test_06_happy_path.py
 tests/application/test_07_cache.py
 tests/application/test_08_implementation_manifest.py
+tests/application/test_09_source_manifest_identity.py
 tests/architecture/__init__.py
 tests/architecture/base_test.py
 tests/architecture/boundaries/__init__.py

{modwire-10.0.0 → modwire-10.1.0}/.github/workflows/ci.yml

@@ -33,4 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "20"
       - run: make extractor-check

{modwire-10.0.0 → modwire-10.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modwire
-Version: 10.0.0
+Version: 10.1.0
 Summary: Code extraction, architecture analysis and the Modwire CLI.
 Author: Tomasz Szpak
 License-Expression: MIT
@@ -88,6 +88,10 @@ Return a queryable code map with content-addressed persistent reuse.
 
 Return a queryable code map and public outcomes for every applicable cache stage.
 
+### `source_manifest_identity`
+
+Observe the current canonical source-manifest identity without parsing source.
+
 ### `implementation_manifest`
 
 Publish a deterministic, provenance-bearing implementation manifest.
@@ -154,6 +158,10 @@ Generic persistent-cache settings supplied by a caller.
 
 Caller-owned filesystem traversal policy with explicit exclusions and opt-in symlink following.
 
+## `SourceManifestIdentity`
+
+Canonical identity of one observed source manifest.
+
 ## `SourceMemberKind`
 
 Ownership kind for a declared class or type member.

{modwire-10.0.0 → modwire-10.1.0}/README.md

@@ -60,6 +60,10 @@ Return a queryable code map with content-addressed persistent reuse.
 
 Return a queryable code map and public outcomes for every applicable cache stage.
 
+### `source_manifest_identity`
+
+Observe the current canonical source-manifest identity without parsing source.
+
 ### `implementation_manifest`
 
 Publish a deterministic, provenance-bearing implementation manifest.
@@ -126,6 +130,10 @@ Generic persistent-cache settings supplied by a caller.
 
 Caller-owned filesystem traversal policy with explicit exclusions and opt-in symlink following.
 
+## `SourceManifestIdentity`
+
+Canonical identity of one observed source manifest.
+
 ## `SourceMemberKind`
 
 Ownership kind for a declared class or type member.

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/application.py

@@ -29,6 +29,7 @@ from .shared.code.models.declaration_identity import DeclarationIdentity
 from .shared.code.models.fact_capability import FactCapability
 from .shared.code.models.queryable_code_map import QueryableCodeMap
 from .shared.code.models.scan_policy import ScanPolicy
+from .shared.code.models.source_manifest_identity import SourceManifestIdentity
 from .shared.code.models.source_member_kind import SourceMemberKind
 from .shared.code.models.source_relation_kind import SourceRelationKind
 
@@ -51,6 +52,7 @@ __all__ = [
     "QueryableCodeMap",
     "ScanPolicy",
     "SourceMemberKind",
+    "SourceManifestIdentity",
     "SourceRelationKind",
 ]
 
@@ -189,6 +191,12 @@ class ModwireApplication:
         cached = self.generate_map_cached_with_diagnostics(language, root, policy, options)
         return CachedResult(value=QueryableCodeMap(code_map=cached.value), outcomes=cached.outcomes)
 
+    def source_manifest_identity(self, language: str, root: str, policy: ScanPolicy) -> SourceManifestIdentity:
+        """Observe the current canonical source-manifest identity without parsing source."""
+
+        request = self.extraction.request(language, str(root))
+        return self.cli.source_manifest_identity(request, policy)
+
     def implementation_manifest(self, code_map: CodeMap, format: ManifestFormat) -> ImplementationManifestDocument:
         """Publish a deterministic, provenance-bearing implementation manifest."""
 
@@ -231,6 +239,7 @@ class ModwireApplication:
                 CachedResult,
                 CacheOptions,
                 ScanPolicy,
+                SourceManifestIdentity,
                 SourceMemberKind,
                 SourceRelationKind,
                 ImplementationManifest,

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/cli/facade.py

@@ -13,6 +13,7 @@ from ..shared.code.models.code_map import CodeMap
 from ..shared.code.models.queryable_code_map import QueryableCodeMap
 from ..shared.code.models.scan_policy import ScanPolicy
 from ..shared.code.models.source_extraction import SourceExtraction
+from ..shared.code.models.source_manifest_identity import SourceManifestIdentity
 from .cache.application import CacheApplication
 from .cache.models.cache_options import CacheOptions
 from .cache.models.cache_plan import CachePlan
@@ -49,6 +50,9 @@ class CliFacade:
     def extract(self, request: ExtractionRequest, policy: ScanPolicy) -> SourceExtraction:
         return self.pipeline.extract(request, policy)
 
+    def source_manifest_identity(self, request: ExtractionRequest, policy: ScanPolicy) -> SourceManifestIdentity:
+        return self.pipeline.source_manifest_identity(request, policy)
+
     def has_source_files(self, request: ExtractionRequest, policy: ScanPolicy) -> bool:
         return self.pipeline.has_source_files(request, policy)
 

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/cli/pipeline/application.py

@@ -9,6 +9,7 @@ from ...architecture.report.models.report_node import ReportNode
 from ...extraction.extractors.models.extraction_request import ExtractionRequest
 from ...shared.code.models.scan_policy import ScanPolicy
 from ...shared.code.models.source_extraction import SourceExtraction
+from ...shared.code.models.source_manifest_identity import SourceManifestIdentity
 from .domain import ReportPipelineStep, SourceReader
 from .models.command_request import CommandRequest
 from .models.extractor_command_input import ExtractorCommandInput
@@ -37,6 +38,14 @@ class PipelineApplication:
         self.reader.ensure_available(request.runtime)
         return self.reader.extract_source(request, policy)
 
+    def source_manifest_identity(self, request: ExtractionRequest, policy: ScanPolicy) -> SourceManifestIdentity:
+        self.reader.ensure_available(request.runtime)
+        manifest = self.reader.inventory(request, policy).manifest
+        return SourceManifestIdentity(
+            digest_algorithm=manifest.digest_algorithm,
+            digest=manifest.digest,
+        )
+
     def has_source_files(self, request: ExtractionRequest, policy: ScanPolicy) -> bool:
         self.reader.ensure_available(request.runtime)
         return self.reader.has_source_files(request, policy)

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/extraction/extractors/resources/typescript/build.py

@@ -12,7 +12,7 @@ class BuildAdapter:
         shutil.copytree(source, work, ignore=shutil.ignore_patterns("build.py", "__pycache__"))
         environment = dict(os.environ)
         environment["npm_config_cache"] = str(work.parent.parent / "cache/npm")
-        BuildAdapter.run(("npm", "ci"), cwd=work, environment=environment)
+        BuildAdapter.run(("npm", "ci", "--engine-strict"), cwd=work, environment=environment)
         BuildAdapter.run(("npm", "run", "check"), cwd=work, environment=environment)
         BuildAdapter.run(("npm", "run", "build"), cwd=work, environment=environment)
         if (work / "script.js").read_bytes() != (source / "script.js").read_bytes():

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/extraction/extractors/resources/typescript/package-lock.json

@@ -11,6 +11,9 @@
       "devDependencies": {
         "@types/node": "^24.0.7",
         "@vercel/ncc": "^0.38.3"
+      },
+      "engines": {
+        "node": "20 || >=22"
       }
     },
     "node_modules/@nodelib/fs.scandir": {
@@ -89,15 +92,15 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/braces": {

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/extraction/extractors/resources/typescript/package.json

@@ -1,6 +1,9 @@
 {
   "private": true,
   "type": "commonjs",
+  "engines": {
+    "node": "20 || >=22"
+  },
   "scripts": {
     "build": "node build.mjs",
     "check": "tsc --noEmit"

{modwire-10.0.0 → modwire-10.1.0}/src/modwire/extraction/extractors/resources/typescript/script.js

@@ -230989,7 +230989,7 @@ exports.range = range;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_REWRITES = exports.EXPANSION_MAX_DEPTH = exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = __nccwpck_require__(2649);
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -231008,6 +231008,35 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+exports.EXPANSION_MAX_LENGTH = 4_000_000;
+// `expand_` recurses once per level of brace *nesting* - both when expanding a
+// set's comma members and when re-wrapping a set whose body is a single part.
+// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
+// level per chained group), which left nesting depth unbounded: about 3,100
+// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
+// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
+// will follow nesting. It sits far above any realistic pattern and well below
+// the depth at which the stack runs out.
+exports.EXPANSION_MAX_DEPTH = 1_000;
+// Bash keeps a quirk where a brace group followed by a comma set still expands
+// (`{a},b}`). The parser implements it by rewriting the string and restarting
+// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
+// full passes over a string that itself grows by one `escClose` sentinel each
+// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
+// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
+// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
+// times the scan may restart. Real `{a},b}` input needs a handful.
+exports.EXPANSION_MAX_REWRITES = 1_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -231027,37 +231056,52 @@ function unescapeBraces(str) {
         .replace(escCommaPattern, ',')
         .replace(escPeriodPattern, '.');
 }
+// Like `target.push(...items)` but doesn't overflow the stack
+function pushAll(target, items) {
+    for (let i = 0; i < items.length; i++) {
+        target.push(items[i]);
+    }
+}
 /**
  * Basically just str.split(","), but handling cases
  * where we have nested braced sections, which should be
  * treated as individual members, like {a,{b,c},d}
  */
 function parseCommaParts(str) {
-    if (!str) {
-        return [''];
-    }
     const parts = [];
-    const m = (0, balanced_match_1.balanced)('{', '}', str);
-    if (!m) {
-        return str.split(',');
-    }
-    const { pre, body, post } = m;
-    const p = pre.split(',');
-    p[p.length - 1] += '{' + body + '}';
-    const postParts = parseCommaParts(post);
-    if (post.length) {
-        ;
-        p[p.length - 1] += postParts.shift();
-        p.push.apply(p, postParts);
-    }
-    parts.push.apply(parts, p);
-    return parts;
+    // Walk the brace groups iteratively. Recursing on `post` once per group let a
+    // chain of them exhaust the stack - the parsing-side counterpart to
+    // the `expand_` overflow fixed for CVE-2026-14257, and not something `max` or
+    // `maxLength` can bound, since it happens before expansion.
+    //
+    // The part the next chunk continues
+    let carry = '';
+    for (;;) {
+        const m = (0, balanced_match_1.balanced)('{', '}', str);
+        if (!m) {
+            const tail = str.split(',');
+            tail[0] = carry + tail[0];
+            pushAll(parts, tail);
+            return parts;
+        }
+        const { pre, body, post } = m;
+        const p = pre.split(',');
+        p[0] = carry + p[0];
+        p[p.length - 1] += '{' + body + '}';
+        if (!post.length) {
+            pushAll(parts, p);
+            return parts;
+        }
+        carry = p.pop();
+        pushAll(parts, p);
+        str = post;
+    }
 }
 function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH, maxDepth = exports.EXPANSION_MAX_DEPTH, maxRewrites = exports.EXPANSION_MAX_REWRITES, } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -231067,7 +231111,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -231081,25 +231125,125 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
+    // Too deeply nested to keep following: treat the rest as literal, the same
+    // way a group that cannot expand is already handled. Truncating rather than
+    // throwing keeps `expand` total, matching `max` and `maxLength`.
+    if (depth > maxDepth) {
+        return [str];
+    }
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    // How many times the `{a},b}` rewrite below has restarted the scan. Each pass
+    // re-reads the whole string, so leaving this unbounded is quadratic.
+    let rewrites = 0;
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = (0, balanced_match_1.balanced)('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -231107,95 +231251,73 @@ function expand_(str, max, isTop) {
         const isOptions = m.body.indexOf(',') >= 0;
         if (!isSequence && !isOptions) {
             // {a},b}
-            if (m.post.match(/,(?!,).*\}/)) {
+            if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+                rewrites++;
                 str = m.pre + '{' + m.body + escClose + m.post;
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
+        }
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max ||
+                        valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
 

modwire-10.1.0/src/modwire/shared/code/models/source_manifest_identity.py

@@ -0,0 +1,10 @@
+from pydantic import Field
+
+from ...values.models.value_model import ValueModel
+
+
+class SourceManifestIdentity(ValueModel):
+    """Canonical identity of one observed source manifest."""
+
+    digest_algorithm: str = Field(pattern="^sha256$")
+    digest: str = Field(pattern="^[0-9a-f]{64}$")