@agenttool/telescope 0.1.0

package/dist/archive.js

@@ -0,0 +1,477 @@
+import { createHash } from "node:crypto";
+import { open } from "node:fs/promises";
+import { Transform } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createGunzip } from "node:zlib";
+import { isExactSemver, isNpmPackageName, isRecord } from "./parsers/common.js";
+const TAR_BLOCK_BYTES = 512;
+const MAX_ARCHIVE_ENTRIES = 10_000;
+const MAX_UNCOMPRESSED_BYTES = 512 * 1024 * 1024;
+const MAX_PACKAGE_JSON_BYTES = 1024 * 1024;
+const MAX_ARCHIVE_PATH_BYTES = 4_096;
+const MAX_ARCHIVE_PATH_DEPTH = 32;
+const MAX_ARCHIVE_PATH_COMPONENTS = 100_000;
+const MAX_COMPRESSED_BYTES = 512 * 1024 * 1024;
+const MAX_ARCHIVE_ENTRY_BYTES = 256 * 1024 * 1024;
+class ArchiveFormatError extends Error {
+}
+class ArchiveIntegrityError extends Error {
+}
+class ArchiveReadError extends Error {
+}
+function readTarString(field) {
+    const nul = field.indexOf(0);
+    const bytes = nul === -1 ? field : field.subarray(0, nul);
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new ArchiveFormatError("invalid tar text");
+    }
+}
+function readTarOctal(field) {
+    if ((field[0] ?? 0) >= 0x80) {
+        throw new ArchiveFormatError("base-256 tar numbers are unsupported");
+    }
+    const value = readTarString(field).trim();
+    if (!/^[0-7]+$/.test(value))
+        throw new ArchiveFormatError("invalid tar number");
+    const parsed = Number.parseInt(value, 8);
+    if (!Number.isSafeInteger(parsed) || parsed < 0) {
+        throw new ArchiveFormatError("unsafe tar number");
+    }
+    return parsed;
+}
+function allZero(bytes) {
+    return bytes.every((value) => value === 0);
+}
+function verifyTarChecksum(header) {
+    const expected = readTarOctal(header.subarray(148, 156));
+    let actual = 0;
+    for (let index = 0; index < TAR_BLOCK_BYTES; index += 1) {
+        actual += index >= 148 && index < 156 ? 0x20 : (header[index] ?? 0);
+    }
+    if (actual !== expected)
+        throw new ArchiveFormatError("tar checksum mismatch");
+}
+function safeArchivePath(path) {
+    const normalized = path;
+    if (normalized.length === 0 ||
+        new TextEncoder().encode(normalized).byteLength > MAX_ARCHIVE_PATH_BYTES ||
+        normalized.startsWith("/") ||
+        normalized.endsWith("/") ||
+        normalized.includes("\\") ||
+        /[\u0000-\u001f\u007f]/.test(normalized)) {
+        throw new ArchiveFormatError("unsafe archive path");
+    }
+    const segments = normalized.split("/");
+    if (segments.length > MAX_ARCHIVE_PATH_DEPTH ||
+        segments.some((segment) => segment.length === 0 || segment === "." || segment === "..") ||
+        segments[0] !== "package") {
+        throw new ArchiveFormatError("archive left package root");
+    }
+    for (const segment of segments.slice(1)) {
+        const windowsStem = segment.replace(/[. ]+$/g, "").split(".", 1)[0] ?? "";
+        if (segment.includes(":") ||
+            /[. ]$/.test(segment) ||
+            /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(windowsStem)) {
+            throw new ArchiveFormatError("Windows-unsafe archive path");
+        }
+    }
+    return normalized;
+}
+function parseHeader(header) {
+    verifyTarChecksum(header);
+    const magic = readTarString(header.subarray(257, 263));
+    if (magic !== "ustar")
+        throw new ArchiveFormatError("unsupported tar profile");
+    const typeByte = header[156] ?? 0;
+    const type = typeByte === 0 ? "0" : String.fromCharCode(typeByte);
+    if (type !== "0" && type !== "5") {
+        throw new ArchiveFormatError("links and special archive entries are rejected");
+    }
+    const name = readTarString(header.subarray(0, 100));
+    const prefix = readTarString(header.subarray(345, 500));
+    const path = safeArchivePath(prefix ? `${prefix}/${name}` : name);
+    const size = readTarOctal(header.subarray(124, 136));
+    const mode = readTarOctal(header.subarray(100, 108));
+    if ((mode & 0o6000) !== 0 || size > MAX_ARCHIVE_ENTRY_BYTES) {
+        throw new ArchiveFormatError("unsafe mode or oversized archive entry");
+    }
+    if (path === "package" && type !== "5") {
+        throw new ArchiveFormatError("package root must be a directory");
+    }
+    if (type === "5" && size !== 0) {
+        throw new ArchiveFormatError("directory entry has data");
+    }
+    return {
+        path,
+        size,
+        directory: type === "5",
+        capturePackageJson: type === "0" && path === "package/package.json",
+    };
+}
+async function inspectArchive(gunzip) {
+    let pending = Buffer.alloc(0);
+    let state = "header";
+    let remaining = 0;
+    let padding = 0;
+    let capture = false;
+    let captureLength = 0;
+    let captureChunks = [];
+    let packageJsonBytes = null;
+    let entries = 0;
+    let zeroBlocks = 0;
+    let uncompressedBytes = 0;
+    let pathComponents = 0;
+    const paths = new Set();
+    const requiredDirectories = new Set();
+    const finishEntry = () => {
+        if (capture) {
+            if (packageJsonBytes)
+                throw new ArchiveFormatError("duplicate package.json");
+            packageJsonBytes = Buffer.concat(captureChunks, captureLength);
+        }
+        capture = false;
+        captureLength = 0;
+        captureChunks = [];
+    };
+    for await (const incoming of gunzip) {
+        const chunk = incoming;
+        uncompressedBytes += chunk.byteLength;
+        if (uncompressedBytes > MAX_UNCOMPRESSED_BYTES) {
+            throw new ArchiveFormatError("archive expands beyond limit");
+        }
+        pending = pending.length === 0 ? chunk : Buffer.concat([pending, chunk]);
+        while (pending.length > 0) {
+            if (state === "ended") {
+                if (!allZero(pending))
+                    throw new ArchiveFormatError("data after tar end");
+                pending = Buffer.alloc(0);
+                continue;
+            }
+            if (state === "header") {
+                if (pending.length < TAR_BLOCK_BYTES)
+                    break;
+                const header = pending.subarray(0, TAR_BLOCK_BYTES);
+                pending = pending.subarray(TAR_BLOCK_BYTES);
+                if (allZero(header)) {
+                    zeroBlocks += 1;
+                    if (zeroBlocks === 2)
+                        state = "ended";
+                    continue;
+                }
+                if (zeroBlocks !== 0) {
+                    throw new ArchiveFormatError("incomplete tar end marker");
+                }
+                const parsed = parseHeader(header);
+                entries += 1;
+                const portablePathKey = parsed.path.normalize("NFC").toLowerCase();
+                const pathSegments = portablePathKey.split("/");
+                pathComponents += pathSegments.length;
+                if (pathComponents > MAX_ARCHIVE_PATH_COMPONENTS) {
+                    throw new ArchiveFormatError("archive path-component limit exceeded");
+                }
+                const ancestors = [];
+                let ancestor = "";
+                for (const segment of pathSegments.slice(0, -1)) {
+                    ancestor = ancestor ? `${ancestor}/${segment}` : segment;
+                    ancestors.push(ancestor);
+                }
+                if (entries > MAX_ARCHIVE_ENTRIES ||
+                    paths.has(portablePathKey) ||
+                    ancestors.some((ancestor) => paths.has(ancestor) && !requiredDirectories.has(ancestor)) ||
+                    (!parsed.directory && requiredDirectories.has(portablePathKey))) {
+                    throw new ArchiveFormatError("archive entry limit or duplicate path");
+                }
+                paths.add(portablePathKey);
+                if (parsed.directory)
+                    requiredDirectories.add(portablePathKey);
+                for (const ancestor of ancestors)
+                    requiredDirectories.add(ancestor);
+                remaining = parsed.size;
+                padding =
+                    (TAR_BLOCK_BYTES - (parsed.size % TAR_BLOCK_BYTES)) % TAR_BLOCK_BYTES;
+                capture = parsed.capturePackageJson;
+                if (capture && parsed.size > MAX_PACKAGE_JSON_BYTES) {
+                    throw new ArchiveFormatError("package.json exceeds limit");
+                }
+                state = remaining === 0 ? "padding" : "data";
+                if (remaining === 0)
+                    finishEntry();
+                continue;
+            }
+            if (state === "data") {
+                const take = Math.min(remaining, pending.length);
+                if (capture && take > 0) {
+                    const bytes = Buffer.from(pending.subarray(0, take));
+                    captureChunks.push(bytes);
+                    captureLength += bytes.byteLength;
+                }
+                pending = pending.subarray(take);
+                remaining -= take;
+                if (remaining === 0) {
+                    finishEntry();
+                    state = "padding";
+                }
+                continue;
+            }
+            const take = Math.min(padding, pending.length);
+            if (!allZero(pending.subarray(0, take))) {
+                throw new ArchiveFormatError("non-zero tar padding");
+            }
+            pending = pending.subarray(take);
+            padding -= take;
+            if (padding === 0)
+                state = "header";
+        }
+    }
+    if (state !== "ended" || !packageJsonBytes || entries === 0) {
+        throw new ArchiveFormatError("incomplete npm tarball");
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(packageJsonBytes));
+    }
+    catch {
+        throw new ArchiveFormatError("invalid package.json");
+    }
+    if (!isRecord(packageJson))
+        throw new ArchiveFormatError("package.json is not an object");
+    return { entries, packageJson };
+}
+async function hashOpenedFile(handle, size) {
+    const hash = createHash("sha256");
+    let observed = 0;
+    const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, Math.max(1, size)));
+    while (observed < size) {
+        let bytesRead;
+        try {
+            ({ bytesRead } = await handle.read(buffer, 0, Math.min(buffer.byteLength, size - observed), observed));
+        }
+        catch {
+            throw new ArchiveReadError("local artifact read failed");
+        }
+        if (bytesRead === 0)
+            break;
+        hash.update(buffer.subarray(0, bytesRead));
+        observed += bytesRead;
+    }
+    if (observed === size) {
+        const probe = Buffer.allocUnsafe(1);
+        let bytesRead;
+        try {
+            ({ bytesRead } = await handle.read(probe, 0, 1, observed));
+        }
+        catch {
+            throw new ArchiveReadError("local artifact read failed");
+        }
+        if (bytesRead !== 0)
+            observed += 1;
+    }
+    return {
+        size: observed,
+        sha256: observed > size ? null : hash.digest("hex"),
+    };
+}
+async function* openedFileChunks(handle, size, readState) {
+    let position = 0;
+    const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, Math.max(1, size)));
+    while (position < size) {
+        let bytesRead;
+        try {
+            ({ bytesRead } = await handle.read(buffer, 0, Math.min(buffer.byteLength, size - position), position));
+        }
+        catch {
+            readState.operational_failure = true;
+            throw new ArchiveReadError("local artifact read failed");
+        }
+        if (bytesRead === 0) {
+            throw new ArchiveIntegrityError("compressed artifact ended early");
+        }
+        position += bytesRead;
+        yield Buffer.from(buffer.subarray(0, bytesRead));
+    }
+    const probe = Buffer.allocUnsafe(1);
+    let bytesRead;
+    try {
+        ({ bytesRead } = await handle.read(probe, 0, 1, position));
+    }
+    catch {
+        readState.operational_failure = true;
+        throw new ArchiveReadError("local artifact read failed");
+    }
+    if (bytesRead !== 0) {
+        throw new ArchiveIntegrityError("compressed artifact grew during verification");
+    }
+}
+function sameStableMetadata(before, after) {
+    return (after.isFile() &&
+        before.dev === after.dev &&
+        before.ino === after.ino &&
+        before.mode === after.mode &&
+        before.size === after.size &&
+        before.mtimeMs === after.mtimeMs &&
+        before.ctimeMs === after.ctimeMs);
+}
+function emptyArchiveResult() {
+    return {
+        entries: null,
+        package_name: null,
+        package_version: null,
+        install_lifecycle_scripts_present: null,
+    };
+}
+export async function verifyNpmTarballFile(path, expected) {
+    if (!isNpmPackageName(expected.name) || !isExactSemver(expected.version)) {
+        throw new TypeError("Expected package name and exact SemVer must be valid.");
+    }
+    if (!Number.isSafeInteger(expected.size) ||
+        expected.size <= 0 ||
+        expected.size > MAX_COMPRESSED_BYTES ||
+        !/^[0-9a-f]{64}$/.test(expected.sha256)) {
+        throw new TypeError("Expected npm tarball size and lowercase SHA-256 must fit Telescope's verifier limits.");
+    }
+    const handle = await open(path, "r");
+    let firstActual = {
+        size: null,
+        sha256: null,
+    };
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() || metadata.size !== expected.size) {
+            return {
+                expected,
+                actual: {
+                    size: metadata.isFile() ? metadata.size : null,
+                    sha256: null,
+                },
+                ok: false,
+                code: "integrity_mismatch",
+                archive: emptyArchiveResult(),
+            };
+        }
+        firstActual = await hashOpenedFile(handle, metadata.size);
+        if (firstActual.size !== expected.size ||
+            firstActual.sha256 !== expected.sha256) {
+            return {
+                expected,
+                actual: firstActual,
+                ok: false,
+                code: "integrity_mismatch",
+                archive: emptyArchiveResult(),
+            };
+        }
+        const gunzip = createGunzip();
+        const readState = { operational_failure: false };
+        const secondHash = createHash("sha256");
+        let secondSize = 0;
+        const tap = new Transform({
+            transform(chunk, _encoding, callback) {
+                secondSize += chunk.byteLength;
+                if (secondSize > expected.size) {
+                    callback(new ArchiveFormatError("compressed artifact changed size"));
+                    return;
+                }
+                secondHash.update(chunk);
+                callback(null, chunk);
+            },
+        });
+        const pipe = pipeline(openedFileChunks(handle, expected.size, readState), tap, gunzip);
+        let inspected;
+        try {
+            inspected = await inspectArchive(gunzip);
+            await pipe;
+        }
+        catch (error) {
+            tap.destroy();
+            gunzip.destroy();
+            await pipe.catch(() => undefined);
+            if (!(error instanceof Error))
+                throw error;
+            if (readState.operational_failure || error instanceof ArchiveReadError) {
+                throw new ArchiveReadError("local artifact read failed");
+            }
+            return {
+                expected,
+                actual: { size: null, sha256: null },
+                ok: false,
+                code: error instanceof ArchiveIntegrityError
+                    ? "integrity_mismatch"
+                    : "invalid_or_unsupported_npm_tarball",
+                archive: emptyArchiveResult(),
+            };
+        }
+        const secondActual = {
+            size: secondSize,
+            sha256: secondHash.digest("hex"),
+        };
+        if (secondActual.size !== expected.size ||
+            secondActual.sha256 !== expected.sha256) {
+            return {
+                expected,
+                actual: secondActual,
+                ok: false,
+                code: "integrity_mismatch",
+                archive: emptyArchiveResult(),
+            };
+        }
+        const finalMetadata = await handle.stat();
+        if (!sameStableMetadata(metadata, finalMetadata)) {
+            return {
+                expected,
+                actual: {
+                    size: finalMetadata.isFile() ? finalMetadata.size : null,
+                    sha256: null,
+                },
+                ok: false,
+                code: "integrity_mismatch",
+                archive: emptyArchiveResult(),
+            };
+        }
+        const packageName = typeof inspected.packageJson.name === "string"
+            ? inspected.packageJson.name
+            : null;
+        const packageVersion = typeof inspected.packageJson.version === "string"
+            ? inspected.packageJson.version
+            : null;
+        const scripts = isRecord(inspected.packageJson.scripts)
+            ? inspected.packageJson.scripts
+            : {};
+        const installLifecycleScriptsPresent = [
+            "preinstall",
+            "install",
+            "postinstall",
+            "prepublish",
+            "preprepare",
+            "prepare",
+            "postprepare",
+        ].some((name) => typeof scripts[name] === "string");
+        const archive = {
+            entries: inspected.entries,
+            package_name: packageName,
+            package_version: packageVersion,
+            install_lifecycle_scripts_present: installLifecycleScriptsPresent,
+        };
+        if (packageName !== expected.name || packageVersion !== expected.version) {
+            return {
+                expected,
+                actual: secondActual,
+                ok: false,
+                code: "embedded_package_identity_mismatch",
+                archive,
+            };
+        }
+        return {
+            expected,
+            actual: secondActual,
+            ok: true,
+            code: "verified_npm_tarball",
+            archive,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=archive.js.map

package/dist/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../src/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAmB,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGhF,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAC5C,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,uBAAuB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AA2BlD,MAAM,kBAAmB,SAAQ,KAAK;CAAG;AACzC,MAAM,qBAAsB,SAAQ,KAAK;CAAG;AAC5C,MAAM,gBAAiB,SAAQ,KAAK;CAAG;AAEvC,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAiB;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAkB;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,eAAe,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ;QACrB,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,UAAU,GAAG,IAAI,CAAC;IACxB,IACE,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,UAAU,GAAG,sBAAsB;QACxE,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QACxB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IACE,QAAQ,CAAC,MAAM,GAAG,sBAAsB;QACxC,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CACzE;QACD,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,EACzB,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YACrB,0CAA0C,CAAC,IAAI,CAAC,WAAW,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AASD,SAAS,WAAW,CAAC,MAAkB;IACrC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,OAAO;QACnB,MAAM,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAC1B,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,uBAAuB,EAAE,CAAC;QAC5D,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACvC,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,SAAS,EAAE,IAAI,KAAK,GAAG;QACvB,kBAAkB,EAAE,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,sBAAsB;KACpE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAA8B;IAI1D,IAAI,OAAO,GAA4B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,IAAI,KAAK,GAA4C,QAAQ,CAAC;IAC9D,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAa,GAAa,EAAE,CAAC;IACjC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,gBAAgB;gBAClB,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;YACzD,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,GAAG,KAAK,CAAC;QAChB,aAAa,GAAG,CAAC,CAAC;QAClB,aAAa,GAAG,EAAE,CAAC;IACrB,CAAC,CAAC;IAEF,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAkB,CAAC;QACjC,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,sBAAsB,EAAE,CAAC;YAC/C,MAAM,IAAI,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAEzE,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;oBACnB,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;gBACrD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe;oBAAE,MAAM;gBAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;gBACpD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;gBAC5C,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpB,UAAU,IAAI,CAAC,CAAC;oBAChB,IAAI,UAAU,KAAK,CAAC;wBAAE,KAAK,GAAG,OAAO,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;gBAC5D,CAAC;gBACD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBACnC,OAAO,IAAI,CAAC,CAAC;gBACb,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,MAAM,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChD,cAAc,IAAI,YAAY,CAAC,MAAM,CAAC;gBACtC,IAAI,cAAc,GAAG,2BAA2B,EAAE,CAAC;oBACjD,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,SAAS,GAAa,EAAE,CAAC;gBAC/B,IAAI,QAAQ,GAAG,EAAE,CAAC;gBAClB,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;oBACzD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3B,CAAC;gBACD,IACE,OAAO,GAAG,mBAAmB;oBAC7B,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;oBAC1B,SAAS,CAAC,IAAI,CACZ,CAAC,QAAQ,EAAE,EAAE,CACX,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC5D;oBACD,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAC/D,CAAC;oBACD,MAAM,IAAI,kBAAkB,CAAC,uCAAuC,CAAC,CAAC;gBACxE,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC3B,IAAI,MAAM,CAAC,SAAS;oBAAE,mBAAmB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC/D,KAAK,MAAM,QAAQ,IAAI,SAAS;oBAAE,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACpE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;gBACxB,OAAO;oBACL,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,GAAG,eAAe,CAAC;gBACxE,OAAO,GAAG,MAAM,CAAC,kBAAkB,CAAC;gBACpC,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,sBAAsB,EAAE,CAAC;oBACpD,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;gBAC7D,CAAC;gBACD,KAAK,GAAG,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC7C,IAAI,SAAS,KAAK,CAAC;oBAAE,WAAW,EAAE,CAAC;gBACnC,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,OAAO,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;oBACrD,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAC1B,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;gBACpC,CAAC;gBACD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACjC,SAAS,IAAI,IAAI,CAAC;gBAClB,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;oBACpB,WAAW,EAAE,CAAC;oBACd,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO,IAAI,IAAI,CAAC;YAChB,IAAI,OAAO,KAAK,CAAC;gBAAE,KAAK,GAAG,QAAQ,CAAC;QACtC,CAAC;IACH,CAAC;IAED,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,gBAAgB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CACtB,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CACxD,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAkB,EAClB,IAAY;IAEZ,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,QAAQ,GAAG,IAAI,EAAE,CAAC;QACvB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,MAAM,EACN,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,CAAC,EAC5C,QAAQ,CACT,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,SAAS,KAAK,CAAC;YAAE,MAAM;QAC3B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3C,QAAQ,IAAI,SAAS,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,SAAS,KAAK,CAAC;YAAE,QAAQ,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,gBAAgB,CAC9B,MAAkB,EAClB,IAAY,EACZ,SAA2C;IAE3C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1E,OAAO,QAAQ,GAAG,IAAI,EAAE,CAAC;QACvB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,MAAM,EACN,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,CAAC,EAC5C,QAAQ,CACT,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,mBAAmB,GAAG,IAAI,CAAC;YACrC,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,IAAI,SAAS,CAAC;QACtB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,CAAC,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACrC,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,8CAA8C,CAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAa,EAAE,KAAY;IACrD,OAAO,CACL,KAAK,CAAC,MAAM,EAAE;QACd,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACxB,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACxB,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1B,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,IAAI;QACrB,iCAAiC,EAAE,IAAI;KAC/B,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,QAA+B;IAE/B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,SAAS,CACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAClB,QAAQ,CAAC,IAAI,GAAG,oBAAoB;QACpC,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACvC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,WAAW,GAAyC;QACtD,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1D,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBAC9C,MAAM,EAAE,IAAI;iBACb;gBACD,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kBAAkB,EAAE;aAC9B,CAAC;QACJ,CAAC;QAED,WAAW,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1D,IACE,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAClC,WAAW,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EACtC,CAAC;YACD,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE,WAAW;gBACnB,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kBAAkB,EAAE;aAC9B,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC;YACxB,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;gBAC1C,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC/B,IAAI,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,kBAAkB,CAAC,kCAAkC,CAAC,CAAC,CAAC;oBACrE,OAAO;gBACT,CAAC;gBACD,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CACnB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAClD,GAAG,EACH,MAAM,CACP,CAAC;QACF,IAAI,SAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC3C,IAAI,SAAS,CAAC,mBAAmB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACvE,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;gBACpC,EAAE,EAAE,KAAK;gBACT,IAAI,EACF,KAAK,YAAY,qBAAqB;oBACpC,CAAC,CAAC,oBAAoB;oBACtB,CAAC,CAAC,oCAAoC;gBAC1C,OAAO,EAAE,kBAAkB,EAAE;aAC9B,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG;YACnB,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;SACjC,CAAC;QACF,IACE,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YACnC,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EACvC,CAAC;YACD,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kBAAkB,EAAE;aAC9B,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YACjD,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE;oBACN,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;oBACxD,MAAM,EAAE,IAAI;iBACb;gBACD,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kBAAkB,EAAE;aAC9B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,OAAO,SAAS,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ;YAC5C,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI;YAC5B,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,cAAc,GAClB,OAAO,SAAS,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ;YAC/C,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO;YAC/B,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC;YACrD,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO;YAC/B,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,8BAA8B,GAAG;YACrC,YAAY;YACZ,SAAS;YACT,aAAa;YACb,YAAY;YACZ,YAAY;YACZ,SAAS;YACT,aAAa;SACd,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,YAAY,EAAE,WAAW;YACzB,eAAe,EAAE,cAAc;YAC/B,iCAAiC,EAAE,8BAA8B;SAClE,CAAC;QACF,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,cAAc,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzE,OAAO;gBACL,QAAQ;gBACR,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,oCAAoC;gBAC1C,OAAO;aACR,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,YAAY;YACpB,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,sBAAsB;YAC5B,OAAO;SACR,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/cli-core.d.ts

@@ -0,0 +1,7 @@
+interface CliIo {
+    stdout: Pick<NodeJS.WriteStream, "write">;
+    stderr: Pick<NodeJS.WriteStream, "write">;
+}
+export declare function runCli(argv: readonly string[], io?: CliIo): Promise<number>;
+export {};
+//# sourceMappingURL=cli-core.d.ts.map

package/dist/cli-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-core.d.ts","sourceRoot":"","sources":["../src/cli-core.ts"],"names":[],"mappings":"AAsBA,UAAU,KAAK;IACb,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC3C;AAuBD,wBAAsB,MAAM,CAC1B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,GAAE,KAA0D,GAC7D,OAAO,CAAC,MAAM,CAAC,CA8IjB"}

package/dist/cli-core.js

@@ -0,0 +1,154 @@
+import { DEFAULT_LIMITS, TOOL_VERSION } from "./constants.js";
+import { verifyNpmTarballFile } from "./archive.js";
+import { TargetInputError } from "./errors.js";
+import { escapeTerminalText, formatTelescopeReport } from "./format.js";
+import { inspectTarget } from "./scan.js";
+import { verifyArtifactFile } from "./verify.js";
+const HELP = `agenttool-telescope — read-only agent discovery evidence mapper
+
+Usage:
+  agenttool-telescope scan <domain-or-https-origin> [--json] [--timeout-ms N] [--max-bytes N]
+  agenttool-telescope <domain-or-https-origin> [--json] [--timeout-ms N] [--max-bytes N]
+  agenttool-telescope verify <file> --size <bytes> --sha256 <lowercase-hex> [--json]
+  agenttool-telescope verify-package <file> --size <bytes> --sha256 <lowercase-hex> --name <npm-name> --version <semver> [--json]
+  agenttool-telescope --help
+  agenttool-telescope --version
+
+Scan performs bounded public HTTPS GETs with no credentials. It reports
+publisher claims and produces commands, but never invokes protocols, downloads
+artifacts, installs packages, or runs generated commands.
+`;
+function integer(value, flag) {
+    if (!value || !/^[0-9]+$/.test(value)) {
+        throw new TargetInputError("invalid_cli_value", `${flag} requires a non-negative integer.`);
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        throw new TargetInputError("invalid_cli_value", `${flag} is outside the safe integer range.`);
+    }
+    return parsed;
+}
+function jsonError(error) {
+    return `${JSON.stringify({ error: { code: error.code, message: error.message } })}\n`;
+}
+export async function runCli(argv, io = { stdout: process.stdout, stderr: process.stderr }) {
+    const args = [...argv];
+    if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+        io.stdout.write(HELP);
+        return 0;
+    }
+    if (args[0] === "--version" || args[0] === "-v") {
+        io.stdout.write(`${TOOL_VERSION}\n`);
+        return 0;
+    }
+    const command = ["scan", "verify", "verify-package"].includes(args[0] ?? "")
+        ? args.shift()
+        : "scan";
+    let json = false;
+    try {
+        if (command === "verify" || command === "verify-package") {
+            const file = args.shift();
+            if (!file || file.startsWith("--")) {
+                throw new TargetInputError("missing_file", "verify requires a file path.");
+            }
+            let size = null;
+            let sha256 = null;
+            let packageName = null;
+            let packageVersion = null;
+            while (args.length > 0) {
+                const flag = args.shift();
+                if (flag === "--json")
+                    json = true;
+                else if (flag === "--size")
+                    size = integer(args.shift(), "--size");
+                else if (flag === "--sha256")
+                    sha256 = args.shift() ?? null;
+                else if (flag === "--name" && command === "verify-package") {
+                    packageName = args.shift() ?? null;
+                }
+                else if (flag === "--version" && command === "verify-package") {
+                    packageVersion = args.shift() ?? null;
+                }
+                else
+                    throw new TargetInputError("unknown_option", `Unknown option: ${flag ?? ""}`);
+            }
+            if (size === null || !sha256 || !/^[0-9a-f]{64}$/.test(sha256)) {
+                throw new TargetInputError("invalid_expectation", "verify requires --size and a 64-character lowercase --sha256.");
+            }
+            if (command === "verify-package") {
+                if (!packageName || !packageVersion) {
+                    throw new TargetInputError("invalid_package_expectation", "verify-package requires --name and --version.");
+                }
+                const result = await verifyNpmTarballFile(file, {
+                    size,
+                    sha256,
+                    name: packageName,
+                    version: packageVersion,
+                });
+                if (json)
+                    io.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+                else {
+                    io.stdout.write(result.ok
+                        ? `verified npm tarball ${escapeTerminalText(file, 2_048)}: ${escapeTerminalText(packageName)}@${escapeTerminalText(packageVersion)}, ${result.archive.entries ?? 0} entries\n`
+                        : `npm tarball verification failed ${escapeTerminalText(file, 2_048)}: ${result.code}\n`);
+                }
+                return result.ok ? 0 : 1;
+            }
+            const result = await verifyArtifactFile(file, { size, sha256 });
+            if (json)
+                io.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+            else {
+                io.stdout.write(result.ok
+                    ? `verified ${escapeTerminalText(file, 2_048)}: ${result.actual.size} bytes, ${result.actual.sha256}\n`
+                    : `integrity mismatch ${escapeTerminalText(file, 2_048)}: ${result.actual.size} bytes, ${result.actual.sha256}\n`);
+            }
+            return result.ok ? 0 : 1;
+        }
+        const target = args.shift();
+        if (!target || target.startsWith("--")) {
+            throw new TargetInputError("missing_target", "scan requires a domain or HTTPS origin.");
+        }
+        let timeoutMs;
+        let maxBytes;
+        while (args.length > 0) {
+            const flag = args.shift();
+            if (flag === "--json")
+                json = true;
+            else if (flag === "--timeout-ms")
+                timeoutMs = integer(args.shift(), "--timeout-ms");
+            else if (flag === "--max-bytes")
+                maxBytes = integer(args.shift(), "--max-bytes");
+            else
+                throw new TargetInputError("unknown_option", `Unknown option: ${flag ?? ""}`);
+        }
+        const limits = {
+            ...(timeoutMs === undefined ? {} : { timeout_ms: timeoutMs }),
+            ...(maxBytes === undefined
+                ? {}
+                : {
+                    max_response_bytes: maxBytes,
+                    max_total_bytes: Math.max(DEFAULT_LIMITS.max_total_bytes, maxBytes),
+                }),
+        };
+        const report = await inspectTarget(target, { limits });
+        io.stdout.write(formatTelescopeReport(report, json ? "json" : "human"));
+        return report.status === "inconclusive" ? 1 : 0;
+    }
+    catch (error) {
+        if (error instanceof TargetInputError || error instanceof TypeError) {
+            const normalized = error instanceof TargetInputError
+                ? error
+                : new TargetInputError("invalid_input", error.message);
+            (json ? io.stdout : io.stderr).write(json
+                ? jsonError(normalized)
+                : `agenttool-telescope: ${escapeTerminalText(normalized.message, 2_048)}\n`);
+            return 2;
+        }
+        const normalized = new TargetInputError("operation_failed", "The requested local operation could not be completed.");
+        (json ? io.stdout : io.stderr).write(json
+            ? jsonError(normalized)
+            : `agenttool-telescope: ${escapeTerminalText(normalized.message, 2_048)}\n`);
+        return 1;
+    }
+}
+//# sourceMappingURL=cli-core.js.map