@bevel-software/platform-core-backend 0.15.1 → 0.19.0

package/dist/shared/redact-secret.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Scrub credentials from anything that reaches a log or an error message:
+ * the token in effect wherever it appears, URL userinfo — a remote spelled
+ * `https://user:pass@host` would otherwise leak `pass` verbatim through every
+ * git failure that quotes the URL back — and URL query strings, where a
+ * presigned remote keeps its credential.
+ *
+ * "The token in effect" is every place one can come from: each environment
+ * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
+ * boot, but a later write to one of them is not normalised), plus whatever the
+ * caller knows about — the settings-stored token, a token a request brought
+ * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
+ * so a secret that contains another is not half-scrubbed.
+ *
+ * Shared, not a module's own: the KB startup phase and the setup routes both
+ * log git's words, and one scrub is the only way they cannot disagree about
+ * what a secret is.
+ */
+export declare function redactSecret(text: string, secrets?: readonly (string | null | undefined)[]): string;
+/**
+ * A remote's query, named as literal secrets for {@link redactSecret}: the
+ * query as written and each value in it, raw and percent-decoded.
+ *
+ * `redactSecret` drops a query that FOLLOWS a URL. Naming the values as well
+ * scrubs them wherever else they turn up — decoded, or on their own — where no
+ * URL pattern can see them. Values too short to be a credential are left alone,
+ * so a `3600` in the query does not garble every number in the log.
+ */
+export declare function urlQuerySecrets(url: string | null | undefined): string[];
+//# sourceMappingURL=redact-secret.d.ts.map

package/dist/shared/redact-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-secret.d.ts","sourceRoot":"","sources":["../../src/shared/redact-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,EAAO,GAAG,MAAM,CAsDvG;AAYD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAgBxE"}

package/dist/shared/redact-secret.js

@@ -0,0 +1,114 @@
+/**
+ * Scrub credentials from anything that reaches a log or an error message:
+ * the token in effect wherever it appears, URL userinfo — a remote spelled
+ * `https://user:pass@host` would otherwise leak `pass` verbatim through every
+ * git failure that quotes the URL back — and URL query strings, where a
+ * presigned remote keeps its credential.
+ *
+ * "The token in effect" is every place one can come from: each environment
+ * spelling `CoreConfig` accepts (it normalises them onto `GITHUB_TOKEN` at
+ * boot, but a later write to one of them is not normalised), plus whatever the
+ * caller knows about — the settings-stored token, a token a request brought
+ * along, or a remote's query values ({@link urlQuerySecrets}). Longest first,
+ * so a secret that contains another is not half-scrubbed.
+ *
+ * Shared, not a module's own: the KB startup phase and the setup routes both
+ * log git's words, and one scrub is the only way they cannot disagree about
+ * what a secret is.
+ */
+export function redactSecret(text, secrets = []) {
+    const tokens = [
+        process.env.GITHUB_TOKEN,
+        process.env.GIT_TOKEN,
+        process.env.GH_TOKEN,
+        ...secrets,
+    ]
+        .map((t) => t?.trim())
+        .filter((t) => !!t);
+    let scrubbed = text;
+    const ordered = [...new Set(tokens)].sort((a, b) => b.length - a.length);
+    // Every whole value first, then every echoed PREFIX. Git and the providers
+    // elide the middle of a token they quote back (`ghp_abcdef…`), and an exact
+    // match would leave that head on screen — enough of a secret to be one.
+    // Both can be in one text (the value in a URL, the elided form in the
+    // host's reply), so the prefix pass runs whether or not the whole was
+    // found — but only once every whole value is gone, or the head two tokens
+    // share (`ghp_from…`) would garble the second before its own turn came.
+    // Down to a floor, so a short common head (`ghp_`) does not garble every
+    // other token in the log.
+    for (const token of ordered)
+        scrubbed = scrubbed.replaceAll(token, '***');
+    // Every echoed prefix of every token, LONGEST FIRST ACROSS TOKENS — not
+    // token by token: two tokens can share a head longer than the floor
+    // (`ghp_abcdefgh…`), and one token's shorter prefix, taken first, would
+    // scrub that head out of the other's echo and leave the rest of it on
+    // screen (`***Y123…`). Longest first, the longer echo goes whole.
+    const prefixes = ordered.flatMap((token) => Array.from({ length: Math.max(0, token.length - MIN_ECHOED_PREFIX_LENGTH) }, (_, i) => token.slice(0, token.length - 1 - i)));
+    for (const prefix of [...new Set(prefixes)].sort((a, b) => b.length - a.length)) {
+        if (scrubbed.includes(prefix))
+            scrubbed = scrubbed.replaceAll(prefix, '***');
+    }
+    return (scrubbed
+        // Through the LAST `@` before the path: a password can carry an
+        // unencoded `@` of its own (`https://user:p@ss@host`), and stopping at
+        // the first would leave the rest of it in the log.
+        .replace(/:\/\/[^/\s]*@/g, '://***@')
+        // A presigned remote carries its credential in the query instead
+        // (`?X-Amz-Signature=…`, `?access_token=…`). A git remote has no query
+        // worth keeping in a log, so the whole of it goes — up to whitespace or
+        // a fragment, not to the first quote: a credential can carry a quote
+        // of its own, and stopping there would leave the rest of it in the log.
+        // When git quoted the URL, the LAST quote of that kind before the next
+        // space is the one closing it, and what follows it (`': 403`) is kept.
+        .replace(/(\bhttps?:\/\/[^\s?#'"]+)\?([^\s#]*)/gi, (_m, url, query, offset, whole) => {
+        const opener = whole[offset - 1];
+        const closing = opener === "'" || opener === '"' ? query.lastIndexOf(opener) : -1;
+        return `${url}?***${closing === -1 ? '' : query.slice(closing)}`;
+    }));
+}
+/** Shorter than this, a query value is not a credential (`X-Amz-Expires=3600`). */
+const MIN_SECRET_LENGTH = 8;
+/**
+ * The shortest head of a token that is still scrubbed when only a prefix of
+ * it was echoed — the same floor the connection probe's redactor uses. Below
+ * it a head is a vendor's common prefix, not a secret.
+ */
+const MIN_ECHOED_PREFIX_LENGTH = 8;
+/**
+ * A remote's query, named as literal secrets for {@link redactSecret}: the
+ * query as written and each value in it, raw and percent-decoded.
+ *
+ * `redactSecret` drops a query that FOLLOWS a URL. Naming the values as well
+ * scrubs them wherever else they turn up — decoded, or on their own — where no
+ * URL pattern can see them. Values too short to be a credential are left alone,
+ * so a `3600` in the query does not garble every number in the log.
+ */
+export function urlQuerySecrets(url) {
+    let query;
+    try {
+        query = url ? new URL(url.trim()).search.slice(1) : '';
+    }
+    catch {
+        return [];
+    }
+    const secrets = new Set();
+    if (query.length >= MIN_SECRET_LENGTH)
+        secrets.add(query);
+    for (const part of query.split('&')) {
+        const raw = part.slice(part.indexOf('=') + 1);
+        for (const value of [raw, decoded(raw)]) {
+            if (value.length >= MIN_SECRET_LENGTH)
+                secrets.add(value);
+        }
+    }
+    return [...secrets];
+}
+function decoded(value) {
+    try {
+        return decodeURIComponent(value.replace(/\+/g, ' '));
+    }
+    catch {
+        return value;
+    }
+}
+//# sourceMappingURL=redact-secret.js.map

package/dist/shared/redact-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-secret.js","sourceRoot":"","sources":["../../src/shared/redact-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,UAAkD,EAAE;IAC7F,MAAM,MAAM,GAAG;QACb,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,OAAO,CAAC,GAAG,CAAC,SAAS;QACrB,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,GAAG,OAAO;KACX;SACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,0BAA0B;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1E,wEAAwE;IACxE,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACzC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7H,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,CACL,QAAQ;QACN,gEAAgE;QAChE,uEAAuE;QACvE,mDAAmD;SAClD,OAAO,CAAC,gBAAgB,EAAE,SAAS,CAAC;QACrC,iEAAiE;QACjE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;SACtE,OAAO,CACN,wCAAwC,EACxC,CAAC,EAAE,EAAE,GAAW,EAAE,KAAa,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,GAAG,GAAG,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC,CACF,CACJ,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,GAA8B;IAC5D,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,IAAI,iBAAiB;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/shared/rename-no-replace.d.ts

@@ -0,0 +1,119 @@
+import type { Stats } from 'node:fs';
+import { type ExistingEntryKind } from '@bevel-software/platform-shared';
+/**
+ * A move or copy refused because its destination is taken. Carries the kind
+ * so the caller can raise it as whatever its surface answers with — the
+ * workspace service's `EntryExistsError` (409 to the sidebar), a `ToolError`
+ * (409 to the agent) — without re-deriving the sentence.
+ */
+export declare class DestinationTakenError extends Error {
+    readonly entryKind: ExistingEntryKind;
+    readonly destination: string;
+    readonly status = 409;
+    constructor(entryKind: ExistingEntryKind, destination: string);
+}
+/** What is at the destination, as far as a move from `oldPath` is concerned. */
+export type DestinationVerdict = 
+/** Nothing is there; the move may land. */
+{
+    state: 'free';
+}
+/**
+ * The entry there IS the source: a case-insensitive filesystem opening
+ * `Notes.md` and `notes.md` as one file. That is the rename that was asked
+ * for, not a clash.
+ */
+ | {
+    state: 'self';
+}
+/** Something else has the name. */
+ | {
+    state: 'taken';
+    kind: ExistingEntryKind;
+};
+/** The entry at `absolutePath` without following a link, or null when nothing is there. */
+export declare function lstatOrNull(absolutePath: string): Promise<Stats | null>;
+/** What the reading needs of an entry: which one it is, and whether it is a folder. */
+export interface EntryIdentity {
+    dev: number;
+    ino: number;
+    isDirectory(): boolean;
+}
+/**
+ * The two filesystem facts a destination reading is made of: what is at a
+ * path, and what a folder lists.
+ *
+ * It is a seam for ONE reason, stated plainly because it is the only thing
+ * that justifies it: the reading's whole case-folding half — every answer of
+ * `self`, which is what "a case-only rename is not a clash" means — can be
+ * produced only by a case-insensitive volume, and there is none on the Linux
+ * that CI and the container run. No `mount` and no `mkfs.vfat` in the
+ * container either, so one cannot be made. Gated behind a `foldsCase()` probe,
+ * those branches were executed by nothing on any machine that runs the suite,
+ * while four review rounds reshaped them. A probe standing in for a folding
+ * volume runs them everywhere.
+ *
+ * Deliberately narrow: the facts the reading consults, and nothing else. The
+ * MOVE itself — `link`, `mkdir`, `rename`, `unlink` — has no seam and takes no
+ * probe. Those calls are the guarantee, and a guarantee that can be faked in a
+ * test is not one.
+ */
+export interface DestinationProbe {
+    /** What is at `absolutePath` itself, a link as a link; null when nothing is there. */
+    lstat(absolutePath: string): Promise<EntryIdentity | null>;
+    /** The names `folder` lists; rejects when it cannot be read. */
+    readdir(folder: string): Promise<string[]>;
+}
+/** The real disk — what every caller uses. */
+export declare const diskProbe: DestinationProbe;
+/**
+ * The one reading of "is this destination the source under another name?".
+ *
+ * `lstat`, never `stat`: a link at the destination is an entry in its own
+ * right.
+ */
+export declare function inspectDestination(oldAbsolute: string, newAbsolute: string, probe?: DestinationProbe): Promise<DestinationVerdict>;
+/**
+ * Move `oldAbsolute` to `newAbsolute`, refusing rather than replacing whatever
+ * is already at the new name. `destinationLabel` is the path the refusal names
+ * — workspace-relative, so the user reads the name they typed and the folder
+ * they aimed at, not a path on our disk.
+ *
+ * The caller is expected to have made the destination's parent already; this
+ * only performs the move itself, so a refusal cannot leave folders behind.
+ */
+export declare function renameNoReplace(oldAbsolute: string, newAbsolute: string, destinationLabel: string): Promise<void>;
+/**
+ * The no-clobber move for a file on a filesystem with no hard links: `wx`
+ * claims the name — `open` with `O_EXCL`, which every filesystem Node runs on
+ * implements atomically and which fails with `EEXIST` if anything is there —
+ * and the rename then replaces the empty file we own rather than someone
+ * else's. A rename that fails anyway gives the claim back.
+ *
+ * The cost against `link` + `unlink` is that the destination is briefly an
+ * empty file, which is why this is the fallback and not the first choice.
+ *
+ * Exported for the same reason as {@link landFolder}: the path only runs on
+ * filesystems without hard links, so a test has to call it directly to cover
+ * it at all.
+ */
+export declare function claimThenRename(oldAbsolute: string, newAbsolute: string, destinationLabel: string): Promise<void>;
+/**
+ * `mkdir` claims the name — atomically, failing with `EEXIST` if anything at
+ * all is there — and the rename then replaces the empty folder we own. Should
+ * the rename fail anyway (someone wrote INTO our empty folder in between, and
+ * `rename` answers `ENOTEMPTY`), the claim is given back so a failed move
+ * leaves no folder behind.
+ *
+ * Windows cannot rename onto an existing directory even when it is empty, so
+ * the claim would make every folder move fail. It does not need one: its
+ * `rename` refuses a taken destination for directories by itself.
+ *
+ * Exported without the look `renameNoReplace` does first, so the claim and its
+ * rollback — the half that only runs when a name is taken in the moment
+ * between the two — can be driven directly by a test instead of by a race.
+ */
+export declare function landFolder(oldAbsolute: string, newAbsolute: string, destinationLabel: string): Promise<void>;
+/** The refusal, with the kind read off whatever is actually in the way. */
+export declare function takenError(newAbsolute: string, destinationLabel: string): Promise<Error>;
+//# sourceMappingURL=rename-no-replace.d.ts.map

package/dist/shared/rename-no-replace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename-no-replace.d.ts","sourceRoot":"","sources":["../../src/shared/rename-no-replace.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAG7F;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAElC,QAAQ,CAAC,SAAS,EAAE,iBAAiB;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IAD/E,QAAQ,CAAC,MAAM,OAAO;gBACD,SAAS,EAAE,iBAAiB,EAAW,WAAW,EAAE,MAAM;CAIhF;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB;AAC5B,2CAA2C;AACzC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE;AACnB;;;;GAIG;GACD;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE;AACnB,mCAAmC;GACjC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEhD,2FAA2F;AAC3F,wBAAsB,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAO7E;AAED,uFAAuF;AACvF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,IAAI,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC3D,gEAAgE;IAChE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5C;AAED,8CAA8C;AAC9C,eAAO,MAAM,SAAS,EAAE,gBAGvB,CAAC;AAEF;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,gBAA4B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAS7B;AAqFD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAgBf;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAuBD,2EAA2E;AAC3E,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAG9F"}

package/dist/shared/rename-no-replace.js

@@ -0,0 +1,323 @@
+/**
+ * A move that CANNOT replace what is at its destination, whatever happens
+ * between the look and the move.
+ *
+ * Looking first and then calling `fs.rename` is not enough on its own:
+ * `rename` replaces an existing file on every platform, so two moves aiming at
+ * the same free name can both be told it is free and the second one silently
+ * eats what the first one landed. The window is small and the loss is total,
+ * which is the worst pair. This module closes it with filesystem calls that
+ * fail-by-design when the name is taken, so the refusal does not depend on
+ * timing at all:
+ *
+ *   - A FILE moves as `link` + `unlink`. `link` is the atomic no-clobber
+ *     primitive POSIX gives us: it fails with `EEXIST` if anything is at the
+ *     new name, and the two names address one inode in between, so nothing is
+ *     ever half-moved. A filesystem without hard links claims the name with
+ *     `open(…, 'wx')` instead and renames onto its own claim — never a plain
+ *     `rename`, which would put the overwrite back exactly where it is hardest
+ *     to notice.
+ *   - A FOLDER claims its name with `mkdir` first, which fails with `EEXIST`
+ *     the same way, and then renames onto the empty folder it just made
+ *     (POSIX lets a directory rename replace an EMPTY directory, and only an
+ *     empty one). Windows will not do that, so there the plain `rename` is
+ *     used — it refuses a taken destination for directories natively.
+ *
+ * The look still happens first, because it is what produces the sentence the
+ * user reads: "A file named Notes.md already exists in Sales." names the kind
+ * of thing in the way, which `EEXIST` alone does not tell us. The atomic call
+ * is the backstop under it, and when the backstop is the one that fires the
+ * destination is re-examined so the same sentence comes out.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { entryExistsMessage } from '@bevel-software/platform-shared';
+import { isAbsence } from './fs.contract.js';
+/**
+ * A move or copy refused because its destination is taken. Carries the kind
+ * so the caller can raise it as whatever its surface answers with — the
+ * workspace service's `EntryExistsError` (409 to the sidebar), a `ToolError`
+ * (409 to the agent) — without re-deriving the sentence.
+ */
+export class DestinationTakenError extends Error {
+    entryKind;
+    destination;
+    status = 409;
+    constructor(entryKind, destination) {
+        super(entryExistsMessage(entryKind, destination));
+        this.entryKind = entryKind;
+        this.destination = destination;
+        this.name = 'DestinationTakenError';
+    }
+}
+/** The entry at `absolutePath` without following a link, or null when nothing is there. */
+export async function lstatOrNull(absolutePath) {
+    try {
+        return await fs.lstat(absolutePath);
+    }
+    catch (err) {
+        if (isAbsence(err))
+            return null;
+        throw err;
+    }
+}
+/** The real disk — what every caller uses. */
+export const diskProbe = {
+    lstat: lstatOrNull,
+    readdir: (folder) => fs.readdir(folder),
+};
+/**
+ * The one reading of "is this destination the source under another name?".
+ *
+ * `lstat`, never `stat`: a link at the destination is an entry in its own
+ * right.
+ */
+export async function inspectDestination(oldAbsolute, newAbsolute, probe = diskProbe) {
+    const destination = await probe.lstat(newAbsolute);
+    if (destination === null)
+        return { state: 'free' };
+    const source = await probe.lstat(oldAbsolute);
+    // A source that is not there is left to the move's own ENOENT — "there is
+    // nothing to move" is the truer answer than "the name is taken".
+    if (source === null)
+        return { state: 'free' };
+    if (await isSelfRename(oldAbsolute, newAbsolute, source, destination, probe))
+        return { state: 'self' };
+    return { state: 'taken', kind: destination.isDirectory() ? 'folder' : 'file' };
+}
+/**
+ * Whether the destination is the SOURCE, seen under a second spelling of the
+ * one name — the thing a case-insensitive filesystem does and the only reason
+ * a move onto an existing entry is ever allowed.
+ *
+ * Identity alone (same device, same inode) does not show it: two hard links
+ * are one inode under two names a user sees separately in the tree, and a
+ * move onto one of them takes that name away. Neither does folded path
+ * equality on its own, for the same reason in the other direction — on a
+ * CASE-SENSITIVE disk `deal.md` and `Deal.md` fold together as strings while
+ * being two real entries, hard-linked or not.
+ *
+ * What actually distinguishes them is the directory: a filesystem that folds
+ * the two spellings has ONE entry to list, and a filesystem that does not has
+ * two. So the parent is read and the two spellings are counted. One entry
+ * means the filesystem handed us the source itself, whatever spelling was
+ * asked for; two means two names, and the move is a clash.
+ *
+ * Paths in different folders are two entries by definition — but "different
+ * folder" is itself a question for the filesystem and not for the strings: the
+ * same volume that folds `notes.md` into `Notes.md` folds `Sales` into
+ * `sales`, so `Sales/notes.md` → `sales/Notes.md` is one folder, one entry and
+ * one rename. The parents are compared by identity for that reason.
+ *
+ * Two cases never reach the listing at all, because there are no two
+ * spellings in them to count: `oldAbsolute === newAbsolute`, and the pair
+ * whose basenames are identical and whose only difference is the parent's
+ * spelling. Both are one entry by construction.
+ *
+ * Everything above happens only on a volume that folds case, so on the Linux
+ * this is built and tested on it is reached by nothing real. That is what
+ * {@link DestinationProbe} is for — read its note before changing any of this,
+ * because the tests that hold these rules up run against a stand-in volume,
+ * not against the disk under them.
+ */
+async function isSelfRename(oldAbsolute, newAbsolute, source, destination, probe) {
+    if (source.dev !== destination.dev || source.ino !== destination.ino)
+        return false;
+    if (oldAbsolute === newAbsolute)
+        return true;
+    if (!foldsTogether(oldAbsolute, newAbsolute))
+        return false;
+    const folder = path.dirname(oldAbsolute);
+    if (!(await sameFolder(folder, path.dirname(newAbsolute), probe)))
+        return false;
+    // One folder and one NAME: only the parent's spelling changed
+    // (`Sales/notes.md` → `sales/notes.md`), so there is nothing for the listing
+    // to count — asking it whether two identical basenames are both present
+    // would answer yes and read the entry as a clash with itself.
+    if (path.basename(oldAbsolute) === path.basename(newAbsolute))
+        return true;
+    let entries;
+    try {
+        entries = await probe.readdir(folder);
+    }
+    catch {
+        // The parent cannot be listed, so nothing here can be shown to be one
+        // entry. Refusing is the safe reading: at worst a case-only rename on an
+        // unreadable folder is turned away, and nothing is ever overwritten.
+        return false;
+    }
+    const listed = new Set(entries);
+    return !(listed.has(path.basename(oldAbsolute)) && listed.has(path.basename(newAbsolute)));
+}
+/**
+ * Whether two directory paths are the one directory. String equality first,
+ * because that is the answer almost every time and costs nothing; otherwise
+ * the filesystem decides, so a volume that folds `Sales` and `sales` is not
+ * read as two folders.
+ */
+async function sameFolder(a, b, probe) {
+    if (a === b)
+        return true;
+    const [statA, statB] = await Promise.all([probe.lstat(a), probe.lstat(b)]);
+    if (statA === null || statB === null)
+        return false;
+    return statA.dev === statB.dev && statA.ino === statB.ino;
+}
+/** The two paths are one name on a case-insensitive filesystem. */
+function foldsTogether(a, b) {
+    return a.toLowerCase() === b.toLowerCase();
+}
+/**
+ * Move `oldAbsolute` to `newAbsolute`, refusing rather than replacing whatever
+ * is already at the new name. `destinationLabel` is the path the refusal names
+ * — workspace-relative, so the user reads the name they typed and the folder
+ * they aimed at, not a path on our disk.
+ *
+ * The caller is expected to have made the destination's parent already; this
+ * only performs the move itself, so a refusal cannot leave folders behind.
+ */
+export async function renameNoReplace(oldAbsolute, newAbsolute, destinationLabel) {
+    const verdict = await inspectDestination(oldAbsolute, newAbsolute);
+    if (verdict.state === 'taken')
+        throw new DestinationTakenError(verdict.kind, destinationLabel);
+    // A case-only rename has the source itself at the destination, so no
+    // no-clobber call can be used — every one of them would see the name taken.
+    // `rename` is right here: it replaces the source with the source.
+    if (verdict.state === 'self') {
+        await fs.rename(oldAbsolute, newAbsolute);
+        return;
+    }
+    const source = await lstatOrNull(oldAbsolute);
+    if (source?.isDirectory() === true) {
+        await landFolder(oldAbsolute, newAbsolute, destinationLabel);
+        return;
+    }
+    await linkThenUnlink(oldAbsolute, newAbsolute, destinationLabel);
+}
+/**
+ * `link` + `unlink`: the destination is created atomically or not at all, and
+ * the source only goes away once it exists under both names, so no reader ever
+ * sees a partial file at the new name.
+ *
+ * Where hard links are unavailable — `EPERM` or `ENOSYS` on some network and
+ * FUSE mounts, FAT — the fallback is `claimThenRename`, NOT a plain rename: a
+ * rename replaces, and falling back to one would hand back exactly the
+ * overwrite this module exists to prevent, on the filesystems least likely to
+ * be tested.
+ */
+async function linkThenUnlink(oldAbsolute, newAbsolute, destinationLabel) {
+    try {
+        await fs.link(oldAbsolute, newAbsolute);
+    }
+    catch (err) {
+        if (codeOf(err) === 'EEXIST')
+            throw await takenError(newAbsolute, destinationLabel);
+        if (codeOf(err) === 'ENOENT')
+            throw err; // No source: the caller's own ENOENT.
+        await claimThenRename(oldAbsolute, newAbsolute, destinationLabel);
+        return;
+    }
+    await fs.unlink(oldAbsolute);
+}
+/**
+ * The no-clobber move for a file on a filesystem with no hard links: `wx`
+ * claims the name — `open` with `O_EXCL`, which every filesystem Node runs on
+ * implements atomically and which fails with `EEXIST` if anything is there —
+ * and the rename then replaces the empty file we own rather than someone
+ * else's. A rename that fails anyway gives the claim back.
+ *
+ * The cost against `link` + `unlink` is that the destination is briefly an
+ * empty file, which is why this is the fallback and not the first choice.
+ *
+ * Exported for the same reason as {@link landFolder}: the path only runs on
+ * filesystems without hard links, so a test has to call it directly to cover
+ * it at all.
+ */
+export async function claimThenRename(oldAbsolute, newAbsolute, destinationLabel) {
+    let claim;
+    try {
+        claim = await fs.open(newAbsolute, 'wx');
+    }
+    catch (err) {
+        if (codeOf(err) === 'EEXIST')
+            throw await takenError(newAbsolute, destinationLabel);
+        throw err;
+    }
+    await claim.close();
+    try {
+        await fs.rename(oldAbsolute, newAbsolute);
+    }
+    catch (err) {
+        await fs.unlink(newAbsolute).catch(() => undefined);
+        throw err;
+    }
+}
+/**
+ * `mkdir` claims the name — atomically, failing with `EEXIST` if anything at
+ * all is there — and the rename then replaces the empty folder we own. Should
+ * the rename fail anyway (someone wrote INTO our empty folder in between, and
+ * `rename` answers `ENOTEMPTY`), the claim is given back so a failed move
+ * leaves no folder behind.
+ *
+ * Windows cannot rename onto an existing directory even when it is empty, so
+ * the claim would make every folder move fail. It does not need one: its
+ * `rename` refuses a taken destination for directories by itself.
+ *
+ * Exported without the look `renameNoReplace` does first, so the claim and its
+ * rollback — the half that only runs when a name is taken in the moment
+ * between the two — can be driven directly by a test instead of by a race.
+ */
+export async function landFolder(oldAbsolute, newAbsolute, destinationLabel) {
+    if (process.platform === 'win32') {
+        await renameOrTaken(oldAbsolute, newAbsolute, destinationLabel);
+        return;
+    }
+    try {
+        await fs.mkdir(newAbsolute);
+    }
+    catch (err) {
+        if (codeOf(err) === 'EEXIST')
+            throw await takenError(newAbsolute, destinationLabel);
+        throw err;
+    }
+    try {
+        await fs.rename(oldAbsolute, newAbsolute);
+    }
+    catch (err) {
+        await fs.rmdir(newAbsolute).catch(() => undefined);
+        if (codeOf(err) === 'ENOTEMPTY' || codeOf(err) === 'EEXIST') {
+            throw await takenError(newAbsolute, destinationLabel);
+        }
+        throw err;
+    }
+}
+/**
+ * The plain rename, with the one reading the caller needs of its failures: on
+ * any error, whatever is at the destination now decides. Something there means
+ * the name was taken after all (Windows answers `EPERM`, `EEXIST` or
+ * `EACCES` for that case, depending on the kind); nothing there means the
+ * failure was something else entirely and belongs to the caller.
+ */
+async function renameOrTaken(oldAbsolute, newAbsolute, destinationLabel) {
+    try {
+        await fs.rename(oldAbsolute, newAbsolute);
+    }
+    catch (err) {
+        const occupant = await lstatOrNull(newAbsolute);
+        if (occupant !== null)
+            throw new DestinationTakenError(kindOf(occupant), destinationLabel);
+        throw err;
+    }
+}
+/** The refusal, with the kind read off whatever is actually in the way. */
+export async function takenError(newAbsolute, destinationLabel) {
+    const occupant = await lstatOrNull(newAbsolute);
+    return new DestinationTakenError(occupant === null ? 'file' : kindOf(occupant), destinationLabel);
+}
+function kindOf(entry) {
+    return entry.isDirectory() ? 'folder' : 'file';
+}
+function codeOf(err) {
+    return err?.code;
+}
+//# sourceMappingURL=rename-no-replace.js.map

package/dist/shared/rename-no-replace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rename-no-replace.js","sourceRoot":"","sources":["../../src/shared/rename-no-replace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,kBAAkB,EAA0B,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAEzB;IAAuC;IADnD,MAAM,GAAG,GAAG,CAAC;IACtB,YAAqB,SAA4B,EAAW,WAAmB;QAC7E,KAAK,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QAD/B,cAAS,GAAT,SAAS,CAAmB;QAAW,gBAAW,GAAX,WAAW,CAAQ;QAE7E,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAeD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,YAAoB;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAmCD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,SAAS,GAAqB;IACzC,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACxC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,WAAmB,EACnB,QAA0B,SAAS;IAEnC,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,iEAAiE;IACjE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC9C,IAAI,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvG,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,KAAK,UAAU,YAAY,CACzB,WAAmB,EACnB,WAAmB,EACnB,MAAqB,EACrB,WAA0B,EAC1B,KAAuB;IAEvB,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,WAAW,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,WAAW,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,8DAA8D;IAC9D,6EAA6E;IAC7E,wEAAwE;IACxE,8DAA8D;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAS,EAAE,KAAuB;IACrE,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB,EACnB,WAAmB,EACnB,gBAAwB;IAExB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO;QAAE,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC/F,qEAAqE;IACrE,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,UAAU,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,cAAc,CAC3B,WAAmB,EACnB,WAAmB,EACnB,gBAAwB;IAExB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,MAAM,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACpF,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC,CAAC,sCAAsC;QAC/E,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAAmB,EACnB,WAAmB,EACnB,gBAAwB;IAExB,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,MAAM,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmB,EACnB,WAAmB,EACnB,gBAAwB;IAExB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,aAAa,CAAC,WAAW,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,MAAM,MAAM,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,MAAM,UAAU,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAC1B,WAAmB,EACnB,WAAmB,EACnB,gBAAwB;IAExB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAC3F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,gBAAwB;IAC5E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO,IAAI,qBAAqB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,MAAM,CAAC,KAAY;IAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;AACjD,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAQ,GAAoC,EAAE,IAAI,CAAC;AACrD,CAAC"}

package/dist/shared/ssrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/shared/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CA6BvD;AAgBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,GAAG,CAeL"}
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/shared/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiCvD;AAwCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,GAAG,CAeL"}