@anionex/dsh-vision-toolkit 0.1.5

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AACzF,OAAO,EACL,MAAM,EACN,iCAAiC,EACjC,aAAa,GAEd,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAEtD,MAAM,CAAC,MAAM,IAAI,GAAG,6BAA6B,CAAA;AAEjD,OAAO,EAAE,MAAM,EAAE,CAAA;AAEjB,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;AAExG,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAY,EAAE,SAA8B,EAAE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,iCAAiC,EAAE,MAAM,EAAE;QAChF,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC;KAC9C,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,MAAM,wBAAwB,EAAE,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAA;IACvC,MAAM,SAAS,GAAsB,EAAE,CAAA;IACvC,IAAI,oBAAyG,CAAA;IAE7G,MAAM,iBAAiB,GAAG,GAAS,EAAE;QACnC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,oBAAoB,KAAK,SAAS;YAAE,OAAM;QAChE,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAClE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EACvB,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAC1C,SAAS,CAAC,MAAM,CACjB,CAAC,CAAA;QACF,IAAI,cAAwC,CAAA;QAC5C,IAAI,gBAA0C,CAAA;QAC9C,IAAI,KAA+B,CAAA;QACnC,IAAI,CAAC;YACH,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;YAC5D,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;YAC/C,gBAAgB,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;YACrC,oBAAoB,GAAG,EAAE,cAAc,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAA;YAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAA;YAC9C,GAAG,CAAC,MAAM,CAAC,IAAI,CACb,6DAA6D,EAC7D,cAAc,EACd,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,CACV,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gBAAgB,EAAE,EAAE,CAAA;YACpB,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,EAAE,CAAA;YAChC,cAAc,EAAE,EAAE,CAAA;YAClB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC,CAAA;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAA;QACxC,iBAAiB,EAAE,CAAA;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,oLAAoL,EACpL,cAAc,EACd,OAAO,CACR,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAA;IACvF,MAAM,YAAY,GAAG,IAAI,kBAAkB,CAAC,GAAG,EAAE;QAC/C,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,aAAa,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,aAAa;KACjH,CAAC,CAAA;IACF,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;IAC9D,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;YAC/B,iBAAiB,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,0FAA0F,EAAE,OAAO,CAAC,CAAA;QACvH,CAAC;IACH,CAAC,CAAC,CAAC,CAAA;IAEH,OAAO,GAAG,EAAE;QACV,SAAS,CAAC,KAAK,EAAE,CAAA;QACjB,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,oBAAoB,CAAC,QAAQ,EAAE,CAAA;YAC/B,oBAAoB,CAAC,cAAc,EAAE,CAAA;YACrC,oBAAoB,CAAC,KAAK,EAAE,CAAA;YAC5B,oBAAoB,GAAG,SAAS,CAAA;QAClC,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,CAAA;IACtD,CAAC,CAAA;AACH,CAAC"}

package/lib/paste-images.js

@@ -0,0 +1,199 @@
+/** Workspace-local storage for images pasted into the DSH Web composer. */
+import { createHash, randomUUID } from 'node:crypto';
+import { lstat, mkdir, open, realpath, rename, rm } from 'node:fs/promises';
+import { basename, extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { sameOriginPost } from "./web-request.js";
+/** Exact route used by the browser paste integration. */
+export const PASTE_IMAGES_ROUTE = '/_dsh/vision-toolkit/paste-images';
+const MAX_NAME_BYTES = 180;
+function responseJson(res, status, body) {
+    const bytes = Buffer.from(JSON.stringify(body));
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('Content-Length', String(bytes.length));
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
+    res.writeHead(status);
+    res.end(bytes);
+}
+function requestError(res, status, code, message) {
+    responseJson(res, status, { ok: false, error: { code, message } });
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function singleQuery(url, key) {
+    const values = url.searchParams.getAll(key);
+    if (values.length !== 1 || values[0] === undefined || values[0] === '') {
+        throw new TypeError(`${key} is required exactly once`);
+    }
+    return values[0];
+}
+function declaredSize(url) {
+    const value = Number(singleQuery(url, 'size'));
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new TypeError('size must be a positive safe integer');
+    return value;
+}
+function imageMediaType(req) {
+    const value = req.headers['content-type']?.split(';', 1)[0]?.trim().toLowerCase();
+    if (value === undefined || !value.startsWith('image/'))
+        throw new TypeError('Content-Type must be image/*');
+    return value;
+}
+function extensionFor(mediaType) {
+    switch (mediaType) {
+        case 'image/jpeg': return '.jpg';
+        case 'image/png': return '.png';
+        case 'image/gif': return '.gif';
+        case 'image/webp': return '.webp';
+        case 'image/bmp': return '.bmp';
+        case 'image/tiff': return '.tiff';
+        case 'image/avif': return '.avif';
+        case 'image/heic': return '.heic';
+        case 'image/heif': return '.heif';
+        case 'image/svg+xml': return '.svg';
+        default: return '.img';
+    }
+}
+/** Convert an untrusted browser label into one portable leaf filename. */
+export function safePastedImageName(raw, mediaType) {
+    const leaf = basename(raw.replaceAll('\\', '/')).normalize('NFC');
+    let cleaned = leaf
+        .replace(/[<>:"|?*\u0000-\u001f/\\]/gu, '_')
+        .replace(/\s+/gu, ' ')
+        .replace(/^\.+/u, '')
+        .trim()
+        .replace(/[. ]+$/u, '');
+    if (/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu.test(cleaned))
+        cleaned = `_${cleaned}`;
+    const fallback = `clipboard-image${extensionFor(mediaType)}`;
+    const candidate = cleaned === '' || cleaned === '.' || cleaned === '..' ? fallback : cleaned;
+    if (Buffer.byteLength(candidate) <= MAX_NAME_BYTES)
+        return candidate;
+    const extension = extname(candidate).slice(0, 20);
+    const budget = Math.max(1, MAX_NAME_BYTES - Buffer.byteLength(extension));
+    let stem = candidate.slice(0, Math.max(1, candidate.length - extension.length));
+    while (Buffer.byteLength(stem) > budget)
+        stem = stem.slice(0, -1);
+    return `${stem}${extension}`;
+}
+/** Reject a resolved path that is not rooted below the expected directory. */
+export function ensurePathInside(root, target) {
+    const rel = relative(root, target);
+    if (rel !== '' && (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel))) {
+        throw new Error(`resolved pasted-image path escapes its workspace root: ${target}`);
+    }
+}
+async function ensureManagedDirectory(workspace, path) {
+    try {
+        await mkdir(path, { mode: 0o700 });
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'EEXIST'))
+            throw error;
+    }
+    const entry = await lstat(path);
+    if (entry.isSymbolicLink()) {
+        throw new Error(`resolved pasted-image path escapes its workspace root: symbolic link ${path}`);
+    }
+    if (!entry.isDirectory())
+        throw new Error(`pasted-image path is not a directory: ${path}`);
+    const canonical = await realpath(path);
+    ensurePathInside(workspace, canonical);
+    return canonical;
+}
+async function sessionPasteRoot(ctx, sessionId) {
+    const session = ctx.sessions.get(sessionId);
+    if (session === undefined)
+        throw new Error(`live Session not found: ${sessionId}`);
+    const cwd = session.header.cwd;
+    if (cwd === undefined || !isAbsolute(cwd))
+        throw new Error(`Session has no absolute workspace: ${sessionId}`);
+    const visibleWorkspace = resolve(cwd);
+    const workspace = await realpath(visibleWorkspace);
+    const pluginRoot = join(visibleWorkspace, '.dsh-vision-toolkit');
+    await ensureManagedDirectory(workspace, pluginRoot);
+    const temporaryRoot = join(pluginRoot, 'tmp');
+    await ensureManagedDirectory(workspace, temporaryRoot);
+    const requestedRoot = join(temporaryRoot, 'pasted-images');
+    const root = await ensureManagedDirectory(workspace, requestedRoot);
+    const sessionKey = createHash('sha256').update(sessionId).digest('hex').slice(0, 20);
+    const requestedSessionRoot = join(requestedRoot, sessionKey);
+    const sessionRoot = await ensureManagedDirectory(root, requestedSessionRoot);
+    ensurePathInside(root, sessionRoot);
+    return { writeRoot: sessionRoot, visibleRoot: requestedSessionRoot };
+}
+async function writeImage(req, directory, filename, expectedBytes, maxBytes) {
+    if (expectedBytes > maxBytes)
+        throw new RangeError(`image exceeds the ${maxBytes}-byte paste limit`);
+    const id = randomUUID();
+    const finalPath = join(directory, `${id}-${filename}`);
+    const stagingPath = join(directory, `.${id}.partial`);
+    ensurePathInside(directory, finalPath);
+    ensurePathInside(directory, stagingPath);
+    const handle = await open(stagingPath, 'wx', 0o600);
+    let received = 0;
+    try {
+        for await (const chunk of req) {
+            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            received += bytes.length;
+            if (received > expectedBytes || received > maxBytes)
+                throw new RangeError('pasted image body exceeds its declared size');
+            await handle.write(bytes);
+        }
+        if (received !== expectedBytes) {
+            throw new Error(`pasted image body size mismatch: expected ${expectedBytes}, received ${received}`);
+        }
+        await handle.sync();
+        await handle.close();
+        await rename(stagingPath, finalPath);
+        return finalPath;
+    }
+    catch (error) {
+        await handle.close().catch(() => { });
+        await rm(stagingPath, { force: true }).catch(() => { });
+        throw error;
+    }
+}
+/** Same-origin, live-Session-bound image upload endpoint. */
+export class PastedImageBackend {
+    ctx;
+    runtime;
+    constructor(ctx, runtime) {
+        this.ctx = ctx;
+        this.runtime = runtime;
+    }
+    async handle(req, res) {
+        if (req.method !== 'POST') {
+            res.setHeader('Allow', 'POST');
+            requestError(res, 405, 'method-not-allowed', 'Use POST');
+            return;
+        }
+        if (!sameOriginPost(req)) {
+            requestError(res, 403, 'origin-rejected', 'The request must originate from this DSH Web application');
+            return;
+        }
+        try {
+            const url = new URL(req.url ?? PASTE_IMAGES_ROUTE, 'http://dsh.internal');
+            const sessionId = singleQuery(url, 'sessionId');
+            const size = declaredSize(url);
+            const mediaType = imageMediaType(req);
+            const filename = safePastedImageName(singleQuery(url, 'name'), mediaType);
+            const contentLength = req.headers['content-length'];
+            if (contentLength !== undefined && Number(contentLength) !== size) {
+                throw new TypeError('Content-Length does not match the declared size');
+            }
+            const directory = await sessionPasteRoot(this.ctx, sessionId);
+            const writtenPath = await writeImage(req, directory.writeRoot, filename, size, this.runtime.maxImageBytes());
+            const absolutePath = join(directory.visibleRoot, basename(writtenPath));
+            responseJson(res, 201, { ok: true, value: { absolutePath, filename, bytes: size } });
+        }
+        catch (error) {
+            const status = error instanceof RangeError ? 413 : 400;
+            this.ctx.logger.warn('dsh-vision-toolkit pasted image rejected: %s', message(error));
+            requestError(res, status, 'paste-image-rejected', message(error));
+        }
+    }
+}
+//# sourceMappingURL=paste-images.js.map

package/lib/paste-images.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paste-images.js","sourceRoot":"","sources":["../src/paste-images.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AAE3E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAGvF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAG,mCAAmC,CAAA;AAErE,MAAM,cAAc,GAAG,GAAG,CAAA;AAc1B,SAAS,YAAY,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAsB;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAA;IAChE,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAA;IAC1C,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;IAClD,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,4CAA4C,CAAC,CAAA;IACtF,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACrB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAY,EAAE,OAAe;IACtF,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ,EAAE,GAAW;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,GAAG,GAAG,2BAA2B,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,GAAQ;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAA;IAC1G,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACjF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAA;IAC3G,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,YAAY,CAAC,CAAC,OAAO,MAAM,CAAA;QAChC,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,CAAA;QAC/B,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,CAAA;QAC/B,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,CAAA;QACjC,KAAK,WAAW,CAAC,CAAC,OAAO,MAAM,CAAA;QAC/B,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,CAAA;QACjC,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,CAAA;QACjC,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,CAAA;QACjC,KAAK,YAAY,CAAC,CAAC,OAAO,OAAO,CAAA;QACjC,KAAK,eAAe,CAAC,CAAC,OAAO,MAAM,CAAA;QACnC,OAAO,CAAC,CAAC,OAAO,MAAM,CAAA;IACxB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACjE,IAAI,OAAO,GAAG,IAAI;SACf,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC;SAC3C,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACzB,IAAI,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7F,MAAM,QAAQ,GAAG,kBAAkB,YAAY,CAAC,SAAS,CAAC,EAAE,CAAA;IAC5D,MAAM,SAAS,GAAG,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAA;IAC5F,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,cAAc;QAAE,OAAO,SAAS,CAAA;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACzE,IAAI,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/E,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,CAAA;AAC9B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,0DAA0D,MAAM,EAAE,CAAC,CAAA;IACrF,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,sBAAsB,CAAC,SAAiB,EAAE,IAAY;IACnE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;YAAE,MAAM,KAAK,CAAA;IAC1F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wEAAwE,IAAI,EAAE,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAA;IAC1F,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACtC,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAY,EAAE,SAAiB;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAkB,CAAC,CAAA;IACpD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAA;IAClF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAA;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAA;IAE7G,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,CAAA;IAChE,MAAM,sBAAsB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACnD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC7C,MAAM,sBAAsB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IACtD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAEnE,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpF,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAA;IAC5E,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACnC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAA;AACtE,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,SAAiB,EACjB,QAAgB,EAChB,aAAqB,EACrB,QAAgB;IAEhB,IAAI,aAAa,GAAG,QAAQ;QAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,QAAQ,mBAAmB,CAAC,CAAA;IACpG,MAAM,EAAE,GAAG,UAAU,EAAE,CAAA;IACvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAA;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IACrD,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACtC,gBAAgB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAExC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACnD,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACjE,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAA;YACxB,IAAI,QAAQ,GAAG,aAAa,IAAI,QAAQ,GAAG,QAAQ;gBAAE,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAA;YACxH,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,6CAA6C,aAAa,cAAc,QAAQ,EAAE,CAAC,CAAA;QACrG,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;QACpB,MAAM,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACpC,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACtD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAOD,6DAA6D;AAC7D,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,GAAY,EACZ,OAA0B;QAD1B,QAAG,GAAH,GAAG,CAAS;QACZ,YAAO,GAAP,OAAO,CAAmB;IAC1C,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QACpD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC9B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAA;YACxD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,0DAA0D,CAAC,CAAA;YACrG,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;YACzE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;YAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;YAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAA;YACzE,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;YACnD,IAAI,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;gBAClE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;YACxE,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC7D,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;YAC5G,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;YACvE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;YACtD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;YACpF,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,sBAAsB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;CACF"}

package/lib/paths.js

@@ -0,0 +1,325 @@
+/**
+ * Path fence shared by every tool: inputs must live in the workspace or an
+ * explicitly authorized directory, outputs stay inside the plugin-managed
+ * output directory, and a symbolic link is allowed only when its real target
+ * stays inside the fence.
+ * @module dsh-vision-toolkit/paths
+ */
+import { randomUUID } from 'node:crypto';
+import { cp, link, lstat, mkdir, readdir, realpath, rename, rm, stat } from 'node:fs/promises';
+import { extname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { VisionToolkitError } from "./errors.js";
+/** Supported input image extensions (the upstream client's allowlist). */
+export const SUPPORTED_IMAGE_EXTENSIONS = ['.png', '.jpg', '.jpeg', '.gif', '.webp'];
+/** Whether `child` equals or lies under `parent` on the same path root. */
+export function isWithin(parent, child) {
+    const rel = relative(parent, child);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`) && !isAbsolute(rel));
+}
+function expandUserHome(raw) {
+    if (raw === '~')
+        return homedir();
+    if (raw.startsWith('~/') || raw.startsWith(`~${sep}`))
+        return join(homedir(), raw.slice(2));
+    return raw;
+}
+/**
+ * Build the per-invocation path policy: realpath the workspace, resolve and
+ * realpath allowed directories, and create the output directory inside the
+ * fence.
+ * @param workspaceRaw - session workspace (or process cwd fallback).
+ * @param allowedDirs - configured extra allowed roots.
+   * @param outputDirRaw - configured output directory (default `.dsh-vision-toolkit/artifacts`).
+ * @returns the resolved policy.
+ */
+export async function createPathPolicy(workspaceRaw, allowedDirs, outputDirRaw) {
+    let workspace;
+    try {
+        workspace = await realpath(expandUserHome(workspaceRaw));
+    }
+    catch (error) {
+        throw new VisionToolkitError('path', `workspace is not accessible: ${workspaceRaw}`, { cause: error });
+    }
+    const roots = [workspace];
+    for (const raw of allowedDirs) {
+        const candidate = expandUserHome(raw);
+        const target = isAbsolute(candidate) ? candidate : resolve(workspace, candidate);
+        try {
+            roots.push(await realpath(target));
+        }
+        catch (error) {
+            throw new VisionToolkitError('path', `allowedDirs entry is not accessible: ${raw}`, { cause: error });
+        }
+    }
+    const outputRaw = outputDirRaw === undefined || outputDirRaw.trim().length === 0
+        ? join(workspace, '.dsh-vision-toolkit', 'artifacts')
+        : resolve(workspace, expandUserHome(outputDirRaw));
+    if (!roots.some(root => isWithin(root, outputRaw))) {
+        throw new VisionToolkitError('path', 'output directory must stay inside the workspace or an allowedDirs entry');
+    }
+    let outputDir;
+    try {
+        await mkdir(outputRaw, { recursive: true });
+        outputDir = await realpath(outputRaw);
+    }
+    catch (error) {
+        throw new VisionToolkitError('path', `output directory is not writable: ${outputRaw}`, { cause: error });
+    }
+    return { workspace, allowedDirs: roots, outputDir };
+}
+/**
+ * Validate one input image path and return its fence-checked absolute path
+ * and byte size.
+ * @param raw - image path, resolved against the workspace.
+ * @param policy - active path fence.
+ * @returns absolute path and file size.
+ */
+export async function resolveInputFile(raw, policy) {
+    return resolveAuthorizedFile(raw, policy, SUPPORTED_IMAGE_EXTENSIONS, 'image');
+}
+/**
+ * Validate one authorized regular file against an explicit extension set.
+ * Realpath fencing makes local HTML and future non-image inputs follow the
+ * same symlink-safe policy as images.
+ * @param raw - path resolved against the workspace.
+ * @param policy - active path fence.
+ * @param extensions - accepted lowercase extensions including the leading dot.
+ * @param kind - user-facing noun used in stable errors.
+ * @returns absolute real path and file size.
+ */
+export async function resolveAuthorizedFile(raw, policy, extensions, kind) {
+    const candidate = expandUserHome(raw);
+    const target = isAbsolute(candidate) ? candidate : resolve(policy.workspace, candidate);
+    let real;
+    try {
+        real = await realpath(target);
+    }
+    catch (error) {
+        throw new VisionToolkitError('input', `${kind} not found: ${raw}`, { cause: error });
+    }
+    if (!policy.allowedDirs.some(root => isWithin(root, real))) {
+        throw new VisionToolkitError('path', `${kind} escapes the allowed directories: ${raw}`);
+    }
+    let info;
+    try {
+        info = await stat(real);
+    }
+    catch (error) {
+        throw new VisionToolkitError('input', `${kind} is not readable: ${raw}`, { cause: error });
+    }
+    if (!info.isFile())
+        throw new VisionToolkitError('input', `${kind} is not a regular file: ${raw}`);
+    const extension = real.slice(real.lastIndexOf('.')).toLowerCase();
+    if (!extensions.includes(extension)) {
+        throw new VisionToolkitError('input', `unsupported ${kind} format "${extension || '(none)'}"; supported: ${extensions.join(', ')}`);
+    }
+    return { path: real, bytes: info.size };
+}
+/** Validate a local HTML document; URL and data-URI inputs never reach Chrome. */
+export function resolveHtmlFile(raw, policy) {
+    return resolveAuthorizedFile(raw, policy, ['.html', '.htm'], 'HTML source');
+}
+/**
+ * Resolve an optional user-supplied output filename inside the plugin output
+ * directory. Absolute paths, `..` segments, and wrong extensions are rejected.
+ * @param raw - output filename (workspace/outputDir-relative).
+ * @param policy - active path fence.
+ * @param defaultName - generated default filename.
+ * @param extensions - allowed extensions for this output kind.
+ * @returns absolute output path (not yet created).
+ */
+export function resolveOutputFile(raw, policy, defaultName, extensions) {
+    const name = raw === undefined || raw.trim().length === 0 ? defaultName : raw.trim();
+    const expanded = expandUserHome(name);
+    if (isAbsolute(expanded))
+        throw new VisionToolkitError('path', 'output must be a filename, not an absolute path');
+    const segments = expanded.split(/[\\/]/);
+    if (segments.length !== 1 || segments[0] === '' || segments[0] === '.' || segments[0] === '..') {
+        throw new VisionToolkitError('path', 'output must be one filename inside the output directory');
+    }
+    const extension = expanded.slice(expanded.lastIndexOf('.')).toLowerCase();
+    if (!extensions.includes(extension)) {
+        throw new VisionToolkitError('output', `output must use one of: ${extensions.join(', ')}`);
+    }
+    const target = resolve(policy.outputDir, expanded);
+    if (!isWithin(policy.outputDir, target)) {
+        throw new VisionToolkitError('path', 'output must stay inside the output directory');
+    }
+    return target;
+}
+/**
+ * Reserve a random, non-user-controlled staging path inside the real output
+ * directory. Upstream writes here so an existing destination symlink can
+ * never redirect the write outside the fence.
+ * @param policy - active path fence.
+ * @param extension - output extension including the leading dot.
+ * @returns absent staging path inside {@link PathPolicy.outputDir}.
+ */
+export function createStagedOutput(policy, extension) {
+    if (extension !== extname(`file${extension}`) || !/^\.[a-z0-9]+$/i.test(extension)) {
+        throw new VisionToolkitError('output', `invalid staging extension: ${extension}`);
+    }
+    return join(policy.outputDir, `.vision-toolkit-${randomUUID()}${extension}`);
+}
+/** Resolve one direct child directory of the managed artifact root. */
+export function resolveOutputDirectory(raw, policy, defaultName) {
+    const name = raw === undefined || raw.trim().length === 0 ? defaultName : raw.trim();
+    const expanded = expandUserHome(name);
+    if (isAbsolute(expanded))
+        throw new VisionToolkitError('path', 'artifact directory must not be an absolute path');
+    const segments = expanded.split(/[\\/]/);
+    if (segments.length !== 1
+        || segments[0] === ''
+        || segments[0] === '.'
+        || segments[0] === '..'
+        || expanded.startsWith('.vision-toolkit-')) {
+        throw new VisionToolkitError('path', 'artifact directory must be one visible directory name inside the output directory');
+    }
+    const target = resolve(policy.outputDir, expanded);
+    if (!isWithin(policy.outputDir, target)) {
+        throw new VisionToolkitError('path', 'artifact directory must stay inside the output directory');
+    }
+    return target;
+}
+/** Create a random staging directory that no upstream command can choose. */
+export async function createStagedDirectory(policy) {
+    const path = join(policy.outputDir, `.vision-toolkit-${randomUUID()}`);
+    await mkdir(path);
+    return path;
+}
+async function assertSafeDirectoryTree(root, current = root) {
+    for (const entry of await readdir(current, { withFileTypes: true })) {
+        const path = join(current, entry.name);
+        const info = await lstat(path);
+        if (info.isSymbolicLink()) {
+            throw new VisionToolkitError('path', `managed artifact directory contains a symbolic link: ${entry.name}`);
+        }
+        if (info.isDirectory()) {
+            await assertSafeDirectoryTree(root, path);
+            continue;
+        }
+        if (!info.isFile()) {
+            throw new VisionToolkitError('path', `managed artifact directory contains a non-regular entry: ${entry.name}`);
+        }
+        const real = await realpath(path);
+        if (!isWithin(root, real)) {
+            throw new VisionToolkitError('path', `managed artifact entry escaped its directory: ${entry.name}`);
+        }
+    }
+}
+/**
+ * Copy an existing managed run into staging for an explicit resume operation.
+ * A missing destination is a normal first run; non-directory or symlink state
+ * fails closed instead of giving the upstream script an ambiguous workspace.
+ */
+export async function seedStagedDirectory(finalPath, staged, policy) {
+    let info;
+    try {
+        info = await lstat(finalPath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw new VisionToolkitError('path', 'existing artifact directory is not accessible', { cause: error });
+    }
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+        throw new VisionToolkitError('path', 'resume target must be a real managed artifact directory');
+    }
+    const real = await realpath(finalPath);
+    if (!isWithin(policy.outputDir, real)) {
+        throw new VisionToolkitError('path', 'resume target escaped the managed output directory');
+    }
+    await assertSafeDirectoryTree(real);
+    await cp(real, staged, { recursive: true, force: true });
+    await assertSafeDirectoryTree(staged);
+    return true;
+}
+/**
+ * Atomically replace one managed artifact directory, restoring the previous
+ * complete run if the final rename fails. The upstream only ever writes the
+ * random staging path.
+ */
+export async function commitStagedDirectory(staged, finalPath, policy) {
+    const stagedReal = await realpath(staged).catch((error) => {
+        throw new VisionToolkitError('output', 'upstream did not create the expected artifact directory', { cause: error });
+    });
+    if (!isWithin(policy.outputDir, stagedReal)) {
+        throw new VisionToolkitError('path', 'staged artifact directory escaped the managed output directory');
+    }
+    const stagedInfo = await lstat(stagedReal);
+    if (stagedInfo.isSymbolicLink() || !stagedInfo.isDirectory()) {
+        throw new VisionToolkitError('output', 'staged artifact output is not a real directory');
+    }
+    await assertSafeDirectoryTree(stagedReal);
+    const backup = join(policy.outputDir, `.vision-toolkit-backup-${randomUUID()}`);
+    let movedPrevious = false;
+    try {
+        try {
+            await rename(finalPath, backup);
+            movedPrevious = true;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        try {
+            await rename(stagedReal, finalPath);
+        }
+        catch (error) {
+            if (movedPrevious)
+                await rename(backup, finalPath).catch(() => { });
+            throw error;
+        }
+        if (movedPrevious)
+            await rm(backup, { recursive: true, force: true });
+    }
+    catch (error) {
+        throw new VisionToolkitError('output', 'could not commit the managed artifact directory', { cause: error });
+    }
+}
+/**
+ * Validate a staged regular file and atomically place it at the resolved final
+ * filename. Replacing an existing symlink replaces the link itself; upstream
+ * never opens the user-selected destination.
+ * @param staged - random staging path returned by {@link createStagedOutput}.
+ * @param finalPath - final path returned by {@link resolveOutputFile}.
+ * @param policy - active path fence.
+ */
+export async function commitStagedOutput(staged, finalPath, policy) {
+    const real = await realpath(staged).catch((error) => {
+        throw new VisionToolkitError('output', 'upstream did not create the expected output file', { cause: error });
+    });
+    if (!isWithin(policy.outputDir, real)) {
+        throw new VisionToolkitError('path', 'staged output escaped the managed output directory');
+    }
+    const info = await stat(real);
+    if (!info.isFile())
+        throw new VisionToolkitError('output', 'upstream output is not a regular file');
+    try {
+        await rename(real, finalPath);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code !== 'EEXIST' && code !== 'EPERM')
+            throw error;
+        await rm(finalPath, { force: true });
+        try {
+            await link(real, finalPath);
+        }
+        catch (linkError) {
+            if (linkError.code === 'EEXIST') {
+                throw new VisionToolkitError('path', 'output destination changed while the staged file was being committed', { cause: linkError });
+            }
+            throw linkError;
+        }
+        await rm(real, { force: true });
+    }
+}
+/** Reject an output that would overwrite its own input file. */
+export function assertDistinctOutput(input, output) {
+    if (input === output) {
+        throw new VisionToolkitError('input', 'output would overwrite the input image');
+    }
+}
+//# sourceMappingURL=paths.js.map

package/lib/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC9F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAU,CAAA;AAY7F,2EAA2E;AAC3E,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,KAAa;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IACnC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IACjC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3F,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAoB,EACpB,WAA8B,EAC9B,YAAqB;IAErB,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,gCAAgC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAChF,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,wCAAwC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACvG,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC9E,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,EAAE,WAAW,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,YAAY,CAAC,CAAC,CAAA;IACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,yEAAyE,CAAC,CAAA;IACjH,CAAC;IACD,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,qCAAqC,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAkB;IACpE,OAAO,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,CAAC,CAAA;AAChF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,MAAkB,EAClB,UAA6B,EAC7B,IAAY;IAEZ,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACvF,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,GAAG,IAAI,eAAe,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,GAAG,IAAI,qCAAqC,GAAG,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,GAAG,IAAI,qBAAqB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,GAAG,IAAI,2BAA2B,GAAG,EAAE,CAAC,CAAA;IAClG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAC1B,OAAO,EACP,eAAe,IAAI,YAAY,SAAS,IAAI,QAAQ,iBAAiB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AACzC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,MAAkB;IAC7D,OAAO,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAuB,EACvB,MAAkB,EAClB,WAAmB,EACnB,UAA6B;IAE7B,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACpF,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAA;IACjH,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/F,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,yDAAyD,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IACzE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,2BAA2B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,SAAiB;IACtE,IAAI,SAAS,KAAK,OAAO,CAAC,OAAO,SAAS,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,8BAA8B,SAAS,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CAAC,GAAuB,EAAE,MAAkB,EAAE,WAAmB;IACrG,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;IACpF,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,iDAAiD,CAAC,CAAA;IACjH,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IACxC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;WAClB,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE;WAClB,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG;WACnB,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI;WACpB,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,mFAAmF,CAAC,CAAA;IAC3H,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAA;IAClG,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAkB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,UAAU,EAAE,EAAE,CAAC,CAAA;IACtE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;IACjB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,OAAO,GAAG,IAAI;IACjE,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,wDAAwD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5G,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,MAAM,uBAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,4DAA4D,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QAChH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,iDAAiD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;QACrG,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,MAAkB;IAC7F,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAA;QACpE,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,+CAA+C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACzG,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,yDAAyD,CAAC,CAAA;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,oDAAoD,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,uBAAuB,CAAC,IAAI,CAAC,CAAA;IACnC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAA;IACrC,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAiB,EAAE,MAAkB;IAC/F,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACjE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,yDAAyD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACrH,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,gEAAgE,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,0BAA0B,UAAU,EAAE,EAAE,CAAC,CAAA;IAC/E,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YAC/B,aAAa,GAAG,IAAI,CAAA;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;QACrE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,aAAa;gBAAE,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAClE,MAAM,KAAK,CAAA;QACb,CAAC;QACD,IAAI,aAAa;YAAE,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,iDAAiD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7G,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB,EAAE,MAAkB;IAC5F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC3D,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,kDAAkD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9G,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,oDAAoD,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAA;IACnG,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;YAAE,MAAM,KAAK,CAAA;QACtD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7B,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,IAAK,SAAmC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3D,MAAM,IAAI,kBAAkB,CAAC,MAAM,EAAE,sEAAsE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YACpI,CAAC;YACD,MAAM,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,MAAc;IAChE,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,kBAAkB,CAAC,OAAO,EAAE,wCAAwC,CAAC,CAAA;IACjF,CAAC;AACH,CAAC"}