@codeworksh/plugin 0.1.0-canary.19.1.gbef2d437 → 0.1.0-canary.21.1.gd0108197

package/{event-mKxToqmh.d.mts → event-6sTQ_4bq.d.mts}

@@ -156,14 +156,19 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
     type: "image";
     data: string;
     mimeType: string;
+  } | {
+    type: "thinking";
+    thinking: string;
+    thinkingSignature?: string;
+    redacted?: boolean;
   } | {
     addedToolNames?: string[];
     arguments: Record<string, any>;
     callID: string;
     name: string;
     namespace?: string;
-    result: {
-      content: ({
+    partial?: {
+      content?: ({
         type: "text";
         text: string;
         textSignature?: string;
@@ -173,9 +178,8 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
         mimeType: string;
       })[];
       details?: any;
-      isError: false;
     };
-    status: "completed";
+    status: "running";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -199,9 +203,9 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
         mimeType: string;
       })[];
       details?: any;
-      isError: true;
+      isError: false;
     };
-    status: "error";
+    status: "completed";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -227,7 +231,7 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
       details?: any;
       isError: true;
     };
-    status: "skipped";
+    status: "error";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -253,26 +257,21 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
       details?: any;
       isError: true;
     };
-    status: "aborted";
+    status: "skipped";
     thoughtSignature?: string;
     time: {
       start: number;
       end: number;
     };
     type: "toolCall";
-  } | {
-    type: "thinking";
-    thinking: string;
-    thinkingSignature?: string;
-    redacted?: boolean;
   } | {
     addedToolNames?: string[];
     arguments: Record<string, any>;
     callID: string;
     name: string;
     namespace?: string;
-    partial?: {
-      content?: ({
+    result: {
+      content: ({
         type: "text";
         text: string;
         textSignature?: string;
@@ -282,8 +281,9 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
         mimeType: string;
       })[];
       details?: any;
+      isError: true;
     };
-    status: "running";
+    status: "aborted";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -458,14 +458,19 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
     type: "image";
     data: string;
     mimeType: string;
+  } | {
+    type: "thinking";
+    thinking: string;
+    thinkingSignature?: string;
+    redacted?: boolean;
   } | {
     addedToolNames?: string[];
     arguments: Record<string, any>;
     callID: string;
     name: string;
     namespace?: string;
-    result: {
-      content: ({
+    partial?: {
+      content?: ({
         type: "text";
         text: string;
         textSignature?: string;
@@ -475,9 +480,8 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
         mimeType: string;
       })[];
       details?: any;
-      isError: false;
     };
-    status: "completed";
+    status: "running";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -501,9 +505,9 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
         mimeType: string;
       })[];
       details?: any;
-      isError: true;
+      isError: false;
     };
-    status: "error";
+    status: "completed";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -529,7 +533,7 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
       details?: any;
       isError: true;
     };
-    status: "skipped";
+    status: "error";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -555,26 +559,21 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
       details?: any;
       isError: true;
     };
-    status: "aborted";
+    status: "skipped";
     thoughtSignature?: string;
     time: {
       start: number;
       end: number;
     };
     type: "toolCall";
-  } | {
-    type: "thinking";
-    thinking: string;
-    thinkingSignature?: string;
-    redacted?: boolean;
   } | {
     addedToolNames?: string[];
     arguments: Record<string, any>;
     callID: string;
     name: string;
     namespace?: string;
-    partial?: {
-      content?: ({
+    result: {
+      content: ({
         type: "text";
         text: string;
         textSignature?: string;
@@ -584,8 +583,9 @@ declare const AikitAssistantMessage: Schema.decodeTo<Schema.declare<{
         mimeType: string;
       })[];
       details?: any;
+      isError: true;
     };
-    status: "running";
+    status: "aborted";
     thoughtSignature?: string;
     time: {
       start: number;
@@ -896,4 +896,4 @@ declare function durable<const Definitions extends ReadonlyArray<Definition>>(de
 declare function latest(definitions: ReadonlyArray<Definition>): ReadonlyMap<string, Definition<string, Schema.Codec<unknown, unknown, never, never>>>;
 //#endregion
 export { ID as a, define as c, inventory as d, latest as f, Definition as i, durable as l, AikitToolCallTerminalPart as n, Payload as o, versionedType as p, Data as r, PublishOptions as s, AikitAssistantMessage as t, event_d_exports as u };
-//# sourceMappingURL=event-mKxToqmh.d.mts.map
+//# sourceMappingURL=event-6sTQ_4bq.d.mts.map

package/event.d.mts

@@ -1,2 +1,2 @@
-import { a as ID, c as define, d as inventory, f as latest, i as Definition, l as durable, n as AikitToolCallTerminalPart, o as Payload, p as versionedType, r as Data, s as PublishOptions, t as AikitAssistantMessage, u as event_d_exports } from "./event-mKxToqmh.mjs";
+import { a as ID, c as define, d as inventory, f as latest, i as Definition, l as durable, n as AikitToolCallTerminalPart, o as Payload, p as versionedType, r as Data, s as PublishOptions, t as AikitAssistantMessage, u as event_d_exports } from "./event-6sTQ_4bq.mjs";
 export { AikitAssistantMessage, AikitToolCallTerminalPart, Data, Definition, event_d_exports as EventSchema, ID, Payload, PublishOptions, define, durable, inventory, latest, versionedType };

package/filesystem-BFCKzgND.mjs

@@ -0,0 +1,347 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import { posix } from "./posix.mjs";
+import { Context, Effect, Schema } from "effect";
+//#region src/sandbox/scan.ts
+var scan_exports = /* @__PURE__ */ __exportAll({
+	LineScanner: () => LineScanner,
+	parse: () => parse,
+	script: () => script,
+	scriptArgs: () => scriptArgs,
+	validate: () => validate,
+	viaShell: () => viaShell
+});
+/** A defect, not a file error: callers derive these from already-validated input. */
+const validate = (options) => {
+	const { startLine, endLine, maxBytes } = options;
+	if (!Number.isSafeInteger(startLine) || startLine < 0) throw new RangeError(`Invalid startLine: ${startLine}`);
+	if (endLine !== void 0 && (!Number.isSafeInteger(endLine) || endLine <= startLine)) throw new RangeError(`Invalid endLine: ${endLine}`);
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError(`Invalid maxBytes: ${maxBytes}`);
+};
+const NEWLINE = 10;
+const BOM = [
+	239,
+	187,
+	191
+];
+/**
+* Computes a {@link LineScan} from a file's bytes fed in order, in memory
+* bounded by `maxBytes`. Feed at most the file size observed when the read
+* started, so a file that keeps growing cannot keep the scan going.
+*/
+var LineScanner = class {
+	start;
+	end;
+	maxBytes;
+	decoder = new TextDecoder("utf-8", { ignoreBOM: true });
+	/** The first bytes, held until it is known whether they are a byte-order mark. */
+	head = [];
+	totalBytes = 0;
+	line = 0;
+	lineLength = 0;
+	lineOpen = false;
+	/** The current line's bytes, kept only while it is selected and could still fit. */
+	pieces = [];
+	selected = [];
+	selectedBytes = 0;
+	firstLineBytes = 0;
+	full = false;
+	constructor(options) {
+		validate(options);
+		this.start = options.startLine;
+		this.end = options.endLine ?? Number.POSITIVE_INFINITY;
+		this.maxBytes = options.maxBytes;
+	}
+	push(chunk) {
+		this.totalBytes += chunk.length;
+		if (this.head !== void 0) {
+			const take = Math.min(BOM.length - this.head.length, chunk.length);
+			this.head.push(...chunk.subarray(0, take));
+			if (this.head.length < BOM.length) return;
+			this.releaseHead();
+			chunk = chunk.subarray(take);
+		}
+		this.scan(chunk);
+	}
+	finish() {
+		if (this.head !== void 0) this.releaseHead();
+		if (this.lineOpen) this.endLine();
+		return {
+			text: this.selected.map((line) => this.decoder.decode(line)).join("\n"),
+			lines: this.selected.length,
+			totalLines: this.line,
+			totalBytes: this.totalBytes,
+			firstLineBytes: this.firstLineBytes
+		};
+	}
+	releaseHead() {
+		const head = Uint8Array.from(this.head ?? []);
+		this.head = void 0;
+		if (!(head.length === BOM.length && BOM.every((byte, index) => head[index] === byte))) this.scan(head);
+	}
+	scan(chunk) {
+		let from = 0;
+		while (from < chunk.length) {
+			const newline = chunk.indexOf(NEWLINE, from);
+			const to = newline === -1 ? chunk.length : newline;
+			this.append(chunk.subarray(from, to));
+			if (newline === -1) return;
+			this.endLine();
+			from = newline + 1;
+		}
+	}
+	isSelected() {
+		return !this.full && this.line >= this.start && this.line < this.end;
+	}
+	append(bytes) {
+		if (bytes.length === 0) {
+			this.lineOpen = true;
+			return;
+		}
+		this.lineOpen = true;
+		if (this.isSelected() && this.lineLength + bytes.length <= this.maxBytes) this.pieces.push(new Uint8Array(bytes));
+		this.lineLength += bytes.length;
+	}
+	endLine() {
+		if (this.isSelected()) {
+			const first = this.selected.length === 0;
+			if (first) this.firstLineBytes = this.lineLength;
+			const added = first ? this.lineLength : this.lineLength + 1;
+			if (this.selectedBytes + added > this.maxBytes) this.full = true;
+			else {
+				this.selected.push(concat(this.pieces, this.lineLength));
+				this.selectedBytes += added;
+			}
+		}
+		this.pieces = [];
+		this.lineLength = 0;
+		this.lineOpen = false;
+		this.line++;
+	}
+};
+const concat = (pieces, length) => {
+	if (pieces.length === 1) return pieces[0];
+	const out = new Uint8Array(length);
+	let offset = 0;
+	for (const piece of pieces) {
+		out.set(piece, offset);
+		offset += piece.length;
+	}
+	return out;
+};
+/**
+* {@link LineScanner} as a POSIX shell script, for backends that only expose a
+* process API. Run as `sh -c <script> _ <path> <startLine> <endLine|-1> <maxBytes>`.
+* The whole file is read inside the sandbox; only the window is printed, after a
+* header line `<lines> <totalLines> <totalBytes> <firstLineBytes>` and before a
+* closing `|` — see {@link parse}.
+* Exits 2 when the path does not exist.
+*/
+const script = [
+	"[ -e \"$1\" ] || exit 2",
+	"size=$(($(wc -c < \"$1\"))) || exit 1",
+	"head -c \"$size\" -- \"$1\" | LC_ALL=C awk -v s=\"$2\" -v e=\"$3\" -v m=\"$4\" -v size=\"$size\" '",
+	"NR == 1 && $0 == \"\\357\\273\\277\" && size == 3 { exit }",
+	"NR == 1 && substr($0, 1, 3) == \"\\357\\273\\277\" { $0 = substr($0, 4) }",
+	"{ total = NR }",
+	"NR > s && (e < 0 || NR <= e) && !full {",
+	"  len = length($0)",
+	"  added = lines == 0 ? len : len + 1",
+	"  if (lines == 0 && !seen) { seen = 1; first = len }",
+	"  if (bytes + added > m) { full = 1; next }",
+	"  out = lines == 0 ? $0 : out \"\\n\" $0",
+	"  bytes += added; lines++",
+	"}",
+	"END { printf \"%.0f %.0f %.0f %.0f\\n%s|\", lines, total, size, first, out }",
+	"'"
+].join("\n");
+/** Arguments for {@link script} after the path. */
+const scriptArgs = (options) => {
+	validate(options);
+	return [
+		String(options.startLine),
+		String(options.endLine ?? -1),
+		String(options.maxBytes)
+	];
+};
+/** Read {@link script}'s output. */
+const parse = (stdout) => {
+	const body = stdout.trimEnd();
+	const newline = body.indexOf("\n");
+	const header = (newline === -1 ? "" : body.slice(0, newline)).trim().split(/\s+/).map(Number);
+	const [lines, totalLines, totalBytes, firstLineBytes] = header;
+	if (!body.endsWith("|") || header.length !== 4 || header.some((value) => !Number.isSafeInteger(value))) throw new Error(`Unexpected scanLines output: ${stdout.slice(0, 200)}`);
+	return {
+		text: body.slice(newline + 1, -1),
+		lines,
+		totalLines,
+		totalBytes,
+		firstLineBytes
+	};
+};
+/**
+* `Provider.scanLines` for a backend that runs an argument vector and collects
+* its output: runs {@link script} in the sandbox and reads the result. A missing
+* path rejects with `ENOENT`, the shape `isNotFoundError` recognises.
+*/
+const viaShell = (run) => async (path, options) => {
+	const result = await run([
+		"sh",
+		"-c",
+		script,
+		"_",
+		path,
+		...scriptArgs(options)
+	]);
+	if (result.exitCode === 2) throw Object.assign(/* @__PURE__ */ new Error(`ENOENT: no such file or directory, scanLines '${path}'`), { code: "ENOENT" });
+	if (result.exitCode !== 0) throw new Error(`scanLines failed (exit ${result.exitCode}): ${(result.stderr ?? result.stdout).trim()}`);
+	return parse(result.stdout);
+};
+//#endregion
+//#region src/sandbox/filesystem.ts
+var filesystem_exports = /* @__PURE__ */ __exportAll({
+	FileSystemError: () => FileSystemError,
+	OperationUnsupportedError: () => OperationUnsupportedError,
+	SandboxFileSystem: () => filesystem_exports,
+	Scan: () => scan_exports,
+	Service: () => Service,
+	fromProvider: () => fromProvider,
+	isNotFoundError: () => isNotFoundError,
+	realpathScripts: () => realpathScripts,
+	validateRmOptions: () => validateRmOptions,
+	withCwd: () => withCwd
+});
+/**
+* The runtime filesystem contract, independent of any backend.
+*
+* Two surfaces, deliberately:
+* - {@link Provider} is what a backend implements — plain promises that reject,
+*   matching every SDK we wrap.
+* - {@link Interface} is what the harness consumes — Effect with a typed error
+*   channel and tracing spans. {@link fromProvider} bridges the two exactly
+*   once, so no consumer ever writes `Effect.tryPromise` against a filesystem.
+*
+* Implementations:
+* - Local:
+* implement it over a VFS (`./local`);
+* local filesystem use OS primitives; hence have broader filesytem capabilities.
+*
+* - Remote:
+* implement it over a provider (`./remote`).
+* remote filesytems depends on the interface provided by the remote provider; hence can have limited filesytem capabilities.
+*
+* `isFile`/`isDirectory` are required booleans; size, mtime, and isSymbolicLink are omitted when the
+* backend cannot report them — never fabricated.
+*
+* **Paths are POSIX, and the harness is Unix-only (for now!).** Every path uses `/`
+* separators on both the host and inside a sandbox — Windows is not supported,
+* so no translation layer exists. Consumers must use the shared Effect POSIX
+* path implementation, never the platform default, or a host running the harness would
+* impose its own flavour on a remote sandbox's paths. Relative paths resolve
+* against the backend's configured `cwd`.
+*/
+var OperationUnsupportedError = class extends Schema.TaggedError()("OperationUnsupportedError", {
+	operation: Schema.String,
+	message: Schema.String
+}) {};
+/** A backend operation failed. `cause` carries the provider's own rejection. */
+var FileSystemError = class extends Schema.TaggedError()("SandboxFileSystemError", {
+	method: Schema.String,
+	path: Schema.String,
+	cause: Schema.optional(Schema.Defect())
+}) {};
+/** Whether a provider failure means the path itself is definitively absent. */
+const isNotFoundError = (cause) => {
+	const code = cause?.code;
+	return code === "ENOENT" || code === "ENOTDIR";
+};
+/**
+* Shell forms of `realpath` for backends that only expose a process API. Run as
+* `sh -c <script> _ <path>`, trying each in turn. `realpath -e` (coreutils)
+* resolves every component, a symlinked file included, and fails on a missing
+* path. Where it is absent, `pwd -P` is the portable primitive: directories
+* resolve directly, anything else resolves its parent and keeps the final name
+* as given — so a symlinked *file* stays unresolved there.
+*/
+const realpathScripts = [
+	"realpath -e -- \"$1\"",
+	"cd -- \"$1\" && pwd -P",
+	"cd -- \"$(dirname -- \"$1\")\" && printf '%s/%s' \"$(pwd -P)\" \"$(basename -- \"$1\")\""
+];
+/** The runtime filesystem service — the live {@link Interface} for the active sandbox. */
+var Service = class extends Context.Service()("@codeworksh/plugin/sandbox/filesystem/Service") {};
+/**
+* Reject `rm` options a provider does not implement, before any mutation. Only
+* `recursive` and `force` are part of the contract; anything else is refused
+* loudly rather than silently ignored.
+*/
+const validateRmOptions = (options, operation = "rm") => Effect.suspend(() => {
+	for (const option of Object.keys(options ?? {})) {
+		if (option === "recursive" || option === "force") continue;
+		return Effect.fail(new OperationUnsupportedError({
+			operation,
+			message: `Unsupported rm option: ${option}`
+		}));
+	}
+	return Effect.void;
+});
+/**
+* Lift a {@link Provider} into the runtime {@link Interface}: one place that
+* converts rejections into {@link FileSystemError}, validates `rm` options,
+* creates missing parents on write, and names a tracing span per operation.
+*/
+const fromProvider = (provider) => {
+	const attempt = (method, path, run) => Effect.tryPromise({
+		try: run,
+		catch: (cause) => new FileSystemError({
+			method,
+			path,
+			cause
+		})
+	});
+	const writeCreatingParents = (path, content) => {
+		const write = attempt("writeFile", path, () => provider.writeFile(path, content));
+		const parent = posix.dirname(path);
+		return write.pipe(Effect.catch(() => attempt("mkdir", parent, () => provider.mkdir(parent, { recursive: true })).pipe(Effect.ignore, Effect.andThen(write))));
+	};
+	return {
+		readFile: Effect.fn("SandboxFileSystem.readFile")((path) => attempt("readFile", path, () => provider.readFile(path))),
+		readFileBuffer: Effect.fn("SandboxFileSystem.readFileBuffer")((path) => attempt("readFileBuffer", path, () => provider.readFileBuffer(path))),
+		writeFile: Effect.fn("SandboxFileSystem.writeFile")(writeCreatingParents),
+		stat: Effect.fn("SandboxFileSystem.stat")((path) => attempt("stat", path, () => provider.stat(path))),
+		...provider.lstat === void 0 ? {} : { lstat: Effect.fn("SandboxFileSystem.lstat")((path) => attempt("lstat", path, () => provider.lstat(path))) },
+		readdir: Effect.fn("SandboxFileSystem.readdir")((path) => attempt("readdir", path, () => provider.readdir(path))),
+		exists: Effect.fn("SandboxFileSystem.exists")((path) => attempt("exists", path, () => provider.exists(path))),
+		mkdir: Effect.fn("SandboxFileSystem.mkdir")((path, options) => attempt("mkdir", path, () => provider.mkdir(path, options))),
+		rm: Effect.fn("SandboxFileSystem.rm")((path, options) => validateRmOptions(options).pipe(Effect.andThen(attempt("rm", path, () => provider.rm(path, options))))),
+		realpath: Effect.fn("SandboxFileSystem.realpath")((path) => attempt("realpath", path, () => provider.realpath(path))),
+		scanLines: Effect.fn("SandboxFileSystem.scanLines")((path, options) => Effect.sync(() => validate(options)).pipe(Effect.andThen(attempt("scanLines", path, () => provider.scanLines(path, options)))))
+	};
+};
+/**
+* Bind a cwd-neutral filesystem to one mount's working directory.
+*
+* The counterpart of `Shell.withCwd`, and the reason relative paths mean the
+* same thing to both: a shared transport stays rooted at the namespace root, so
+* resolution happens here, per mount, rather than inside a VFS whose `chdir` is
+* global state two mounts would fight over.
+*/
+const withCwd = (fs, cwd) => {
+	const at = (path) => posix.resolve(cwd, path);
+	return {
+		readFile: (path) => fs.readFile(at(path)),
+		readFileBuffer: (path) => fs.readFileBuffer(at(path)),
+		writeFile: (path, content) => fs.writeFile(at(path), content),
+		stat: (path) => fs.stat(at(path)),
+		readdir: (path) => fs.readdir(at(path)),
+		exists: (path) => fs.exists(at(path)),
+		mkdir: (path, options) => fs.mkdir(at(path), options),
+		rm: (path, options) => fs.rm(at(path), options),
+		realpath: (path) => fs.realpath(at(path)),
+		scanLines: (path, options) => fs.scanLines(at(path), options),
+		...fs.lstat === void 0 ? {} : { lstat: (path) => fs.lstat(at(path)) }
+	};
+};
+//#endregion
+export { fromProvider as a, validateRmOptions as c, filesystem_exports as i, withCwd as l, OperationUnsupportedError as n, isNotFoundError as o, Service as r, realpathScripts as s, FileSystemError as t, scan_exports as u };
+
+//# sourceMappingURL=filesystem-BFCKzgND.mjs.map

package/filesystem-BFCKzgND.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-BFCKzgND.mjs","names":["validateScan"],"sources":["../../src/sandbox/scan.ts","../../src/sandbox/filesystem.ts"],"sourcesContent":["/**\n * Bounded line reads: one pass over a file that returns a window of its lines\n * without ever holding more than that window.\n *\n * Lines are the file split on `\\n`, where a trailing newline ends the last line\n * rather than starting an empty one: `\"\"` has 0 lines, `\"a\"` and `\"a\\n\"` have 1,\n * `\"a\\n\\n\"` has 2. A UTF-8 byte-order mark at the start of the file is not part\n * of the first line. Line lengths are in bytes.\n *\n * Two implementations share these rules, and a backend uses whichever fits:\n * {@link LineScanner} over a byte stream, or {@link script} run inside the\n * sandbox so only the window crosses the network.\n */\n\nexport interface LineScanOptions {\n\t/** First selected line, 0-based. */\n\treadonly startLine: number;\n\t/** End of the selection, exclusive; absent selects to the end of the file. */\n\treadonly endLine?: number;\n\t/** Most UTF-8 bytes of selected text to return; selection stops at the last whole line that fits. */\n\treadonly maxBytes: number;\n}\n\nexport interface LineScan {\n\t/**\n\t * The selected whole lines that fit `maxBytes`, joined with `\\n`. Invalid\n\t * UTF-8 becomes U+FFFD; how many per bad sequence depends on the decoder of\n\t * the backend's transport.\n\t */\n\treadonly text: string;\n\t/** Lines in {@link text}. */\n\treadonly lines: number;\n\t/** Lines in the whole file. */\n\treadonly totalLines: number;\n\t/** Bytes in the whole file, byte-order mark included. */\n\treadonly totalBytes: number;\n\t/**\n\t * Bytes of the first selected line, 0 when nothing is selected. Larger than\n\t * `maxBytes` exactly when that line alone does not fit, and `text` is empty.\n\t */\n\treadonly firstLineBytes: number;\n}\n\n/** A defect, not a file error: callers derive these from already-validated input. */\nexport const validate = (options: LineScanOptions): void => {\n\tconst { startLine, endLine, maxBytes } = options;\n\tif (!Number.isSafeInteger(startLine) || startLine < 0) throw new RangeError(`Invalid startLine: ${startLine}`);\n\tif (endLine !== undefined && (!Number.isSafeInteger(endLine) || endLine <= startLine))\n\t\tthrow new RangeError(`Invalid endLine: ${endLine}`);\n\tif (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError(`Invalid maxBytes: ${maxBytes}`);\n};\n\nconst NEWLINE = 0x0a;\nconst BOM = [0xef, 0xbb, 0xbf] as const;\n\n/**\n * Computes a {@link LineScan} from a file's bytes fed in order, in memory\n * bounded by `maxBytes`. Feed at most the file size observed when the read\n * started, so a file that keeps growing cannot keep the scan going.\n */\nexport class LineScanner {\n\tprivate readonly start: number;\n\tprivate readonly end: number;\n\tprivate readonly maxBytes: number;\n\t// Only a mark at the very start of the file is dropped, and that happens on\n\t// the bytes; one starting a later line is text.\n\tprivate readonly decoder = new TextDecoder(\"utf-8\", { ignoreBOM: true });\n\n\t/** The first bytes, held until it is known whether they are a byte-order mark. */\n\tprivate head: Array<number> | undefined = [];\n\tprivate totalBytes = 0;\n\tprivate line = 0;\n\tprivate lineLength = 0;\n\tprivate lineOpen = false;\n\t/** The current line's bytes, kept only while it is selected and could still fit. */\n\tprivate pieces: Array<Uint8Array> = [];\n\tprivate selected: Array<Uint8Array> = [];\n\tprivate selectedBytes = 0;\n\tprivate firstLineBytes = 0;\n\tprivate full = false;\n\n\tconstructor(options: LineScanOptions) {\n\t\tvalidate(options);\n\t\tthis.start = options.startLine;\n\t\tthis.end = options.endLine ?? Number.POSITIVE_INFINITY;\n\t\tthis.maxBytes = options.maxBytes;\n\t}\n\n\tpush(chunk: Uint8Array): void {\n\t\tthis.totalBytes += chunk.length;\n\t\tif (this.head !== undefined) {\n\t\t\tconst take = Math.min(BOM.length - this.head.length, chunk.length);\n\t\t\tthis.head.push(...chunk.subarray(0, take));\n\t\t\tif (this.head.length < BOM.length) return;\n\t\t\tthis.releaseHead();\n\t\t\tchunk = chunk.subarray(take);\n\t\t}\n\t\tthis.scan(chunk);\n\t}\n\n\tfinish(): LineScan {\n\t\tif (this.head !== undefined) this.releaseHead();\n\t\tif (this.lineOpen) this.endLine();\n\t\tconst text = this.selected.map((line) => this.decoder.decode(line)).join(\"\\n\");\n\t\treturn {\n\t\t\ttext,\n\t\t\tlines: this.selected.length,\n\t\t\ttotalLines: this.line,\n\t\t\ttotalBytes: this.totalBytes,\n\t\t\tfirstLineBytes: this.firstLineBytes,\n\t\t};\n\t}\n\n\tprivate releaseHead(): void {\n\t\tconst head = Uint8Array.from(this.head ?? []);\n\t\tthis.head = undefined;\n\t\tconst bom = head.length === BOM.length && BOM.every((byte, index) => head[index] === byte);\n\t\tif (!bom) this.scan(head);\n\t}\n\n\tprivate scan(chunk: Uint8Array): void {\n\t\tlet from = 0;\n\t\twhile (from < chunk.length) {\n\t\t\tconst newline = chunk.indexOf(NEWLINE, from);\n\t\t\tconst to = newline === -1 ? chunk.length : newline;\n\t\t\tthis.append(chunk.subarray(from, to));\n\t\t\tif (newline === -1) return;\n\t\t\tthis.endLine();\n\t\t\tfrom = newline + 1;\n\t\t}\n\t}\n\n\tprivate isSelected(): boolean {\n\t\treturn !this.full && this.line >= this.start && this.line < this.end;\n\t}\n\n\tprivate append(bytes: Uint8Array): void {\n\t\tif (bytes.length === 0) {\n\t\t\tthis.lineOpen = true;\n\t\t\treturn;\n\t\t}\n\t\tthis.lineOpen = true;\n\t\t// Past `maxBytes` the line cannot fit, so its bytes are only counted. Copied,\n\t\t// not sliced: a Node `Buffer` slice is a view the reader may overwrite.\n\t\tif (this.isSelected() && this.lineLength + bytes.length <= this.maxBytes) this.pieces.push(new Uint8Array(bytes));\n\t\tthis.lineLength += bytes.length;\n\t}\n\n\tprivate endLine(): void {\n\t\tif (this.isSelected()) {\n\t\t\tconst first = this.selected.length === 0;\n\t\t\tif (first) this.firstLineBytes = this.lineLength;\n\t\t\tconst added = first ? this.lineLength : this.lineLength + 1;\n\t\t\tif (this.selectedBytes + added > this.maxBytes) this.full = true;\n\t\t\telse {\n\t\t\t\tthis.selected.push(concat(this.pieces, this.lineLength));\n\t\t\t\tthis.selectedBytes += added;\n\t\t\t}\n\t\t}\n\t\tthis.pieces = [];\n\t\tthis.lineLength = 0;\n\t\tthis.lineOpen = false;\n\t\tthis.line++;\n\t}\n}\n\nconst concat = (pieces: ReadonlyArray<Uint8Array>, length: number): Uint8Array => {\n\tif (pieces.length === 1) return pieces[0]!;\n\tconst out = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const piece of pieces) {\n\t\tout.set(piece, offset);\n\t\toffset += piece.length;\n\t}\n\treturn out;\n};\n\n/**\n * {@link LineScanner} as a POSIX shell script, for backends that only expose a\n * process API. Run as `sh -c <script> _ <path> <startLine> <endLine|-1> <maxBytes>`.\n * The whole file is read inside the sandbox; only the window is printed, after a\n * header line `<lines> <totalLines> <totalBytes> <firstLineBytes>` and before a\n * closing `|` — see {@link parse}.\n * Exits 2 when the path does not exist.\n */\nexport const script = [\n\t'[ -e \"$1\" ] || exit 2',\n\t// Arithmetic expansion drops the padding some `wc` builds print.\n\t'size=$(($(wc -c < \"$1\"))) || exit 1',\n\t// `C` makes awk's `length` count bytes; `head -c` bounds a file that is still growing.\n\t'head -c \"$size\" -- \"$1\" | LC_ALL=C awk -v s=\"$2\" -v e=\"$3\" -v m=\"$4\" -v size=\"$size\" \\'',\n\t// A file that is only a byte-order mark has no lines; anything after one keeps its own.\n\t'NR == 1 && $0 == \"\\\\357\\\\273\\\\277\" && size == 3 { exit }',\n\t'NR == 1 && substr($0, 1, 3) == \"\\\\357\\\\273\\\\277\" { $0 = substr($0, 4) }',\n\t\"{ total = NR }\",\n\t\"NR > s && (e < 0 || NR <= e) && !full {\",\n\t\"  len = length($0)\",\n\t\"  added = lines == 0 ? len : len + 1\",\n\t\"  if (lines == 0 && !seen) { seen = 1; first = len }\",\n\t\"  if (bytes + added > m) { full = 1; next }\",\n\t'  out = lines == 0 ? $0 : out \"\\\\n\" $0',\n\t\"  bytes += added; lines++\",\n\t\"}\",\n\t// The trailing `|` survives a transport that trims trailing whitespace off stdout.\n\t// `%.0f`, not `%d`: some mawk builds clamp `%d` to a 32-bit integer.\n\t'END { printf \"%.0f %.0f %.0f %.0f\\\\n%s|\", lines, total, size, first, out }',\n\t\"'\",\n].join(\"\\n\");\n\n/** Arguments for {@link script} after the path. */\nexport const scriptArgs = (options: LineScanOptions): Array<string> => {\n\tvalidate(options);\n\treturn [String(options.startLine), String(options.endLine ?? -1), String(options.maxBytes)];\n};\n\n/** Read {@link script}'s output. */\nexport const parse = (stdout: string): LineScan => {\n\tconst body = stdout.trimEnd();\n\tconst newline = body.indexOf(\"\\n\");\n\tconst header = (newline === -1 ? \"\" : body.slice(0, newline)).trim().split(/\\s+/).map(Number);\n\tconst [lines, totalLines, totalBytes, firstLineBytes] = header;\n\tif (!body.endsWith(\"|\") || header.length !== 4 || header.some((value) => !Number.isSafeInteger(value)))\n\t\tthrow new Error(`Unexpected scanLines output: ${stdout.slice(0, 200)}`);\n\treturn {\n\t\ttext: body.slice(newline + 1, -1),\n\t\tlines: lines!,\n\t\ttotalLines: totalLines!,\n\t\ttotalBytes: totalBytes!,\n\t\tfirstLineBytes: firstLineBytes!,\n\t};\n};\n\nexport interface ShellRun {\n\treadonly exitCode: number;\n\treadonly stdout: string;\n\treadonly stderr?: string;\n}\n\n/**\n * `Provider.scanLines` for a backend that runs an argument vector and collects\n * its output: runs {@link script} in the sandbox and reads the result. A missing\n * path rejects with `ENOENT`, the shape `isNotFoundError` recognises.\n */\nexport const viaShell =\n\t(run: (argv: ReadonlyArray<string>) => Promise<ShellRun>) =>\n\t// oxlint-disable-next-line effecttsgo/async-function -- the Provider contract is Promise-based\n\tasync (path: string, options: LineScanOptions): Promise<LineScan> => {\n\t\tconst result = await run([\"sh\", \"-c\", script, \"_\", path, ...scriptArgs(options)]);\n\t\tif (result.exitCode === 2)\n\t\t\tthrow Object.assign(new Error(`ENOENT: no such file or directory, scanLines '${path}'`), { code: \"ENOENT\" });\n\t\tif (result.exitCode !== 0)\n\t\t\tthrow new Error(`scanLines failed (exit ${result.exitCode}): ${(result.stderr ?? result.stdout).trim()}`);\n\t\treturn parse(result.stdout);\n\t};\n","import { Context, Effect, Schema } from \"effect\";\nimport { posix } from \"../posix.ts\";\nimport { type LineScan, type LineScanOptions, validate as validateScan } from \"./scan.ts\";\n\nexport type { LineScan, LineScanOptions } from \"./scan.ts\";\n/** The shared line-scan rules: `LineScanner` for byte streams, `script` for shell-only backends. */\nexport * as Scan from \"./scan.ts\";\n\n/**\n * The runtime filesystem contract, independent of any backend.\n *\n * Two surfaces, deliberately:\n * - {@link Provider} is what a backend implements — plain promises that reject,\n *   matching every SDK we wrap.\n * - {@link Interface} is what the harness consumes — Effect with a typed error\n *   channel and tracing spans. {@link fromProvider} bridges the two exactly\n *   once, so no consumer ever writes `Effect.tryPromise` against a filesystem.\n *\n * Implementations:\n * - Local:\n * implement it over a VFS (`./local`);\n * local filesystem use OS primitives; hence have broader filesytem capabilities.\n *\n * - Remote:\n * implement it over a provider (`./remote`).\n * remote filesytems depends on the interface provided by the remote provider; hence can have limited filesytem capabilities.\n *\n * `isFile`/`isDirectory` are required booleans; size, mtime, and isSymbolicLink are omitted when the\n * backend cannot report them — never fabricated.\n *\n * **Paths are POSIX, and the harness is Unix-only (for now!).** Every path uses `/`\n * separators on both the host and inside a sandbox — Windows is not supported,\n * so no translation layer exists. Consumers must use the shared Effect POSIX\n * path implementation, never the platform default, or a host running the harness would\n * impose its own flavour on a remote sandbox's paths. Relative paths resolve\n * against the backend's configured `cwd`.\n */\n\nexport class OperationUnsupportedError extends Schema.TaggedError<OperationUnsupportedError>()(\n\t\"OperationUnsupportedError\",\n\t{\n\t\toperation: Schema.String,\n\t\tmessage: Schema.String,\n\t},\n) {}\n\n/** A backend operation failed. `cause` carries the provider's own rejection. */\nexport class FileSystemError extends Schema.TaggedError<FileSystemError>()(\"SandboxFileSystemError\", {\n\tmethod: Schema.String,\n\tpath: Schema.String,\n\tcause: Schema.optional(Schema.Defect()),\n}) {}\n\nexport interface FileStat {\n\treadonly isFile: boolean;\n\treadonly isDirectory: boolean;\n\treadonly isSymbolicLink?: boolean;\n\treadonly size?: number;\n\treadonly mtime?: Date;\n}\n\nexport interface RmOptions {\n\treadonly recursive?: boolean;\n\treadonly force?: boolean;\n}\n\n/** Whether a provider failure means the path itself is definitively absent. */\nexport const isNotFoundError = (cause: unknown) => {\n\tconst code = (cause as NodeJS.ErrnoException | undefined)?.code;\n\treturn code === \"ENOENT\" || code === \"ENOTDIR\";\n};\n\n/**\n * Shell forms of `realpath` for backends that only expose a process API. Run as\n * `sh -c <script> _ <path>`, trying each in turn. `realpath -e` (coreutils)\n * resolves every component, a symlinked file included, and fails on a missing\n * path. Where it is absent, `pwd -P` is the portable primitive: directories\n * resolve directly, anything else resolves its parent and keeps the final name\n * as given — so a symlinked *file* stays unresolved there.\n */\nexport const realpathScripts = [\n\t'realpath -e -- \"$1\"',\n\t'cd -- \"$1\" && pwd -P',\n\t'cd -- \"$(dirname -- \"$1\")\" && printf \\'%s/%s\\' \"$(pwd -P)\" \"$(basename -- \"$1\")\"',\n] as const;\n\n/**\n * The backend-facing contract. Backends author plain promises and let them\n * reject; {@link fromProvider} turns rejections into typed failures.\n */\nexport interface Provider {\n\treadonly readFile: (path: string) => Promise<string>;\n\treadonly readFileBuffer: (path: string) => Promise<Uint8Array>;\n\t/**\n\t * Write the file. Parents may be missing — do not create them here;\n\t * {@link fromProvider} owns that guarantee for every backend.\n\t */\n\treadonly writeFile: (path: string, content: string | Uint8Array) => Promise<void>;\n\treadonly stat: (path: string) => Promise<FileStat>;\n\treadonly readdir: (path: string) => Promise<string[]>;\n\treadonly exists: (path: string) => Promise<boolean>;\n\treadonly mkdir: (path: string, options?: { recursive?: boolean }) => Promise<void>;\n\treadonly rm: (path: string, options?: RmOptions) => Promise<void>;\n\t/** Canonical absolute path with symlinks resolved; rejects when the path does not exist. */\n\treadonly realpath: (path: string) => Promise<string>;\n\t/**\n\t * A window of the file's lines, by the rules in `Scan`. Bounded: never\n\t * returns, or holds, more than the window. A remote backend runs the scan\n\t * inside the sandbox (`Scan.script`) so only the window crosses the network.\n\t */\n\treadonly scanLines: (path: string, options: LineScanOptions) => Promise<LineScan>;\n\t/**\n\t * Metadata for the directory entry itself rather than a symlink's target.\n\t * Optional: a backend whose `stat` has mixed symlink semantics implements it\n\t * so symlink identity is asked for explicitly, never inferred.\n\t */\n\treadonly lstat?: (path: string) => Promise<FileStat>;\n}\n\n/**\n * The consumer-facing contract. `exists` distinguishes \"absent\" from \"could not\n * tell\": a backend failure is a typed failure, not `false`, so a caller acting\n * on absence never acts on a network blip. Use `SandboxFs.existsOrFalse` where\n * a best-effort answer really is wanted.\n */\nexport interface Interface {\n\treadonly readFile: (path: string) => Effect.Effect<string, FileSystemError>;\n\treadonly readFileBuffer: (path: string) => Effect.Effect<Uint8Array, FileSystemError>;\n\t/** Creates missing parent directories, on every backend. */\n\treadonly writeFile: (path: string, content: string | Uint8Array) => Effect.Effect<void, FileSystemError>;\n\treadonly stat: (path: string) => Effect.Effect<FileStat, FileSystemError>;\n\treadonly readdir: (path: string) => Effect.Effect<string[], FileSystemError>;\n\treadonly exists: (path: string) => Effect.Effect<boolean, FileSystemError>;\n\treadonly mkdir: (path: string, options?: { recursive?: boolean }) => Effect.Effect<void, FileSystemError>;\n\treadonly rm: (path: string, options?: RmOptions) => Effect.Effect<void, FileSystemError | OperationUnsupportedError>;\n\t/** Canonical absolute path with symlinks resolved; fails when the path does not exist. */\n\treadonly realpath: (path: string) => Effect.Effect<string, FileSystemError>;\n\t/** A bounded window of the file's lines; see `Scan`. Invalid options are a defect. */\n\treadonly scanLines: (path: string, options: LineScanOptions) => Effect.Effect<LineScan, FileSystemError>;\n\t// `lstat` is present only when the backend supports it; check before calling.\n\treadonly lstat?: (path: string) => Effect.Effect<FileStat, FileSystemError>;\n}\n\n/** The runtime filesystem service — the live {@link Interface} for the active sandbox. */\nexport class Service extends Context.Service<Service, Interface>()(\"@codeworksh/plugin/sandbox/filesystem/Service\") {}\n\n/**\n * Reject `rm` options a provider does not implement, before any mutation. Only\n * `recursive` and `force` are part of the contract; anything else is refused\n * loudly rather than silently ignored.\n */\nexport const validateRmOptions = (\n\toptions: RmOptions | undefined,\n\toperation = \"rm\",\n): Effect.Effect<void, OperationUnsupportedError> =>\n\tEffect.suspend(() => {\n\t\tfor (const option of Object.keys((options ?? {}) as Record<string, unknown>)) {\n\t\t\tif (option === \"recursive\" || option === \"force\") continue;\n\t\t\treturn Effect.fail(new OperationUnsupportedError({ operation, message: `Unsupported rm option: ${option}` }));\n\t\t}\n\t\treturn Effect.void;\n\t});\n\n/**\n * Lift a {@link Provider} into the runtime {@link Interface}: one place that\n * converts rejections into {@link FileSystemError}, validates `rm` options,\n * creates missing parents on write, and names a tracing span per operation.\n */\nexport const fromProvider = (provider: Provider): Interface => {\n\tconst attempt = <A>(method: string, path: string, run: () => Promise<A>) =>\n\t\tEffect.tryPromise({ try: run, catch: (cause) => new FileSystemError({ method, path, cause }) });\n\n\t// The parent-creation guarantee, installed once for every backend instead of\n\t// re-implemented per provider: anything that reaches `Interface` reaches it\n\t// through here, so a backend cannot forget it.\n\t//\n\t// Lazy by design — try the write first, so the happy path stays a single call\n\t// and no remote backend pays a round-trip per write. A failure is usually a\n\t// missing parent, so create it and retry once. The mkdir's own error is\n\t// dropped on purpose: when the write failed for some other reason (EACCES,\n\t// EROFS, a dropped connection), the retry reproduces it, and *that* is the\n\t// failure the caller must see rather than a misleading mkdir error standing\n\t// in for it.\n\tconst writeCreatingParents = (path: string, content: string | Uint8Array) => {\n\t\tconst write = attempt(\"writeFile\", path, () => provider.writeFile(path, content));\n\t\tconst parent = posix.dirname(path);\n\t\treturn write.pipe(\n\t\t\tEffect.catch(() =>\n\t\t\t\tattempt(\"mkdir\", parent, () => provider.mkdir(parent, { recursive: true })).pipe(\n\t\t\t\t\tEffect.ignore,\n\t\t\t\t\tEffect.andThen(write),\n\t\t\t\t),\n\t\t\t),\n\t\t);\n\t};\n\n\treturn {\n\t\treadFile: Effect.fn(\"SandboxFileSystem.readFile\")((path: string) =>\n\t\t\tattempt(\"readFile\", path, () => provider.readFile(path)),\n\t\t),\n\t\treadFileBuffer: Effect.fn(\"SandboxFileSystem.readFileBuffer\")((path: string) =>\n\t\t\tattempt(\"readFileBuffer\", path, () => provider.readFileBuffer(path)),\n\t\t),\n\t\twriteFile: Effect.fn(\"SandboxFileSystem.writeFile\")(writeCreatingParents),\n\t\tstat: Effect.fn(\"SandboxFileSystem.stat\")((path: string) => attempt(\"stat\", path, () => provider.stat(path))),\n\t\t// carried through only when the backend actually implements it\n\t\t...(provider.lstat === undefined\n\t\t\t? {}\n\t\t\t: {\n\t\t\t\t\tlstat: Effect.fn(\"SandboxFileSystem.lstat\")((path: string) =>\n\t\t\t\t\t\tattempt(\"lstat\", path, () => provider.lstat!(path)),\n\t\t\t\t\t),\n\t\t\t\t}),\n\t\treaddir: Effect.fn(\"SandboxFileSystem.readdir\")((path: string) =>\n\t\t\tattempt(\"readdir\", path, () => provider.readdir(path)),\n\t\t),\n\t\t// A backend that cannot answer fails; it does not report \"absent\". A\n\t\t// caller acting on absence — deleting a record, say — must not be told\n\t\t// the path is gone because a token expired or a request timed out.\n\t\texists: Effect.fn(\"SandboxFileSystem.exists\")((path: string) =>\n\t\t\tattempt(\"exists\", path, () => provider.exists(path)),\n\t\t),\n\t\tmkdir: Effect.fn(\"SandboxFileSystem.mkdir\")((path: string, options?: { recursive?: boolean }) =>\n\t\t\tattempt(\"mkdir\", path, () => provider.mkdir(path, options)),\n\t\t),\n\t\trm: Effect.fn(\"SandboxFileSystem.rm\")((path: string, options?: RmOptions) =>\n\t\t\tvalidateRmOptions(options).pipe(Effect.andThen(attempt(\"rm\", path, () => provider.rm(path, options)))),\n\t\t),\n\t\trealpath: Effect.fn(\"SandboxFileSystem.realpath\")((path: string) =>\n\t\t\tattempt(\"realpath\", path, () => provider.realpath(path)),\n\t\t),\n\t\tscanLines: Effect.fn(\"SandboxFileSystem.scanLines\")((path: string, options: LineScanOptions) =>\n\t\t\tEffect.sync(() => validateScan(options)).pipe(\n\t\t\t\tEffect.andThen(attempt(\"scanLines\", path, () => provider.scanLines(path, options))),\n\t\t\t),\n\t\t),\n\t};\n};\n\n/**\n * Bind a cwd-neutral filesystem to one mount's working directory.\n *\n * The counterpart of `Shell.withCwd`, and the reason relative paths mean the\n * same thing to both: a shared transport stays rooted at the namespace root, so\n * resolution happens here, per mount, rather than inside a VFS whose `chdir` is\n * global state two mounts would fight over.\n */\nexport const withCwd = (fs: Interface, cwd: string): Interface => {\n\tconst at = (path: string) => posix.resolve(cwd, path);\n\treturn {\n\t\treadFile: (path) => fs.readFile(at(path)),\n\t\treadFileBuffer: (path) => fs.readFileBuffer(at(path)),\n\t\twriteFile: (path, content) => fs.writeFile(at(path), content),\n\t\tstat: (path) => fs.stat(at(path)),\n\t\treaddir: (path) => fs.readdir(at(path)),\n\t\texists: (path) => fs.exists(at(path)),\n\t\tmkdir: (path, options) => fs.mkdir(at(path), options),\n\t\trm: (path, options) => fs.rm(at(path), options),\n\t\trealpath: (path) => fs.realpath(at(path)),\n\t\tscanLines: (path, options) => fs.scanLines(at(path), options),\n\t\t// carried through only when the backend implements it, so a caller can\n\t\t// still detect absence by checking the property\n\t\t...(fs.lstat === undefined ? {} : { lstat: (path: string) => fs.lstat!(at(path)) }),\n\t};\n};\n\nexport * as SandboxFileSystem from \"./filesystem.ts\";\n"],"mappings":";;;;;;;;;;;;;AA4CA,MAAa,YAAY,YAAmC;CAC3D,MAAM,EAAE,WAAW,SAAS,aAAa;CACzC,IAAI,CAAC,OAAO,cAAc,SAAS,KAAK,YAAY,GAAG,MAAM,IAAI,WAAW,sBAAsB,WAAW;CAC7G,IAAI,YAAY,KAAA,MAAc,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,YAC1E,MAAM,IAAI,WAAW,oBAAoB,SAAS;CACnD,IAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,YAAY,GAAG,MAAM,IAAI,WAAW,qBAAqB,UAAU;AAC3G;AAEA,MAAM,UAAU;AAChB,MAAM,MAAM;CAAC;CAAM;CAAM;AAAI;;;;;;AAO7B,IAAa,cAAb,MAAyB;CACxB;CACA;CACA;CAGA,UAA2B,IAAI,YAAY,SAAS,EAAE,WAAW,KAAK,CAAC;;CAGvE,OAA0C,CAAC;CAC3C,aAAqB;CACrB,OAAe;CACf,aAAqB;CACrB,WAAmB;;CAEnB,SAAoC,CAAC;CACrC,WAAsC,CAAC;CACvC,gBAAwB;CACxB,iBAAyB;CACzB,OAAe;CAEf,YAAY,SAA0B;EACrC,SAAS,OAAO;EAChB,KAAK,QAAQ,QAAQ;EACrB,KAAK,MAAM,QAAQ,WAAW,OAAO;EACrC,KAAK,WAAW,QAAQ;CACzB;CAEA,KAAK,OAAyB;EAC7B,KAAK,cAAc,MAAM;EACzB,IAAI,KAAK,SAAS,KAAA,GAAW;GAC5B,MAAM,OAAO,KAAK,IAAI,IAAI,SAAS,KAAK,KAAK,QAAQ,MAAM,MAAM;GACjE,KAAK,KAAK,KAAK,GAAG,MAAM,SAAS,GAAG,IAAI,CAAC;GACzC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ;GACnC,KAAK,YAAY;GACjB,QAAQ,MAAM,SAAS,IAAI;EAC5B;EACA,KAAK,KAAK,KAAK;CAChB;CAEA,SAAmB;EAClB,IAAI,KAAK,SAAS,KAAA,GAAW,KAAK,YAAY;EAC9C,IAAI,KAAK,UAAU,KAAK,QAAQ;EAEhC,OAAO;GACN,MAFY,KAAK,SAAS,KAAK,SAAS,KAAK,QAAQ,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,IAErE;GACH,OAAO,KAAK,SAAS;GACrB,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,gBAAgB,KAAK;EACtB;CACD;CAEA,cAA4B;EAC3B,MAAM,OAAO,WAAW,KAAK,KAAK,QAAQ,CAAC,CAAC;EAC5C,KAAK,OAAO,KAAA;EAEZ,IAAI,EADQ,KAAK,WAAW,IAAI,UAAU,IAAI,OAAO,MAAM,UAAU,KAAK,WAAW,IAAI,IAC/E,KAAK,KAAK,IAAI;CACzB;CAEA,KAAa,OAAyB;EACrC,IAAI,OAAO;EACX,OAAO,OAAO,MAAM,QAAQ;GAC3B,MAAM,UAAU,MAAM,QAAQ,SAAS,IAAI;GAC3C,MAAM,KAAK,YAAY,KAAK,MAAM,SAAS;GAC3C,KAAK,OAAO,MAAM,SAAS,MAAM,EAAE,CAAC;GACpC,IAAI,YAAY,IAAI;GACpB,KAAK,QAAQ;GACb,OAAO,UAAU;EAClB;CACD;CAEA,aAA8B;EAC7B,OAAO,CAAC,KAAK,QAAQ,KAAK,QAAQ,KAAK,SAAS,KAAK,OAAO,KAAK;CAClE;CAEA,OAAe,OAAyB;EACvC,IAAI,MAAM,WAAW,GAAG;GACvB,KAAK,WAAW;GAChB;EACD;EACA,KAAK,WAAW;EAGhB,IAAI,KAAK,WAAW,KAAK,KAAK,aAAa,MAAM,UAAU,KAAK,UAAU,KAAK,OAAO,KAAK,IAAI,WAAW,KAAK,CAAC;EAChH,KAAK,cAAc,MAAM;CAC1B;CAEA,UAAwB;EACvB,IAAI,KAAK,WAAW,GAAG;GACtB,MAAM,QAAQ,KAAK,SAAS,WAAW;GACvC,IAAI,OAAO,KAAK,iBAAiB,KAAK;GACtC,MAAM,QAAQ,QAAQ,KAAK,aAAa,KAAK,aAAa;GAC1D,IAAI,KAAK,gBAAgB,QAAQ,KAAK,UAAU,KAAK,OAAO;QACvD;IACJ,KAAK,SAAS,KAAK,OAAO,KAAK,QAAQ,KAAK,UAAU,CAAC;IACvD,KAAK,iBAAiB;GACvB;EACD;EACA,KAAK,SAAS,CAAC;EACf,KAAK,aAAa;EAClB,KAAK,WAAW;EAChB,KAAK;CACN;AACD;AAEA,MAAM,UAAU,QAAmC,WAA+B;CACjF,IAAI,OAAO,WAAW,GAAG,OAAO,OAAO;CACvC,MAAM,MAAM,IAAI,WAAW,MAAM;CACjC,IAAI,SAAS;CACb,KAAK,MAAM,SAAS,QAAQ;EAC3B,IAAI,IAAI,OAAO,MAAM;EACrB,UAAU,MAAM;CACjB;CACA,OAAO;AACR;;;;;;;;;AAUA,MAAa,SAAS;CACrB;CAEA;CAEA;CAEA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;AACD,CAAC,CAAC,KAAK,IAAI;;AAGX,MAAa,cAAc,YAA4C;CACtE,SAAS,OAAO;CAChB,OAAO;EAAC,OAAO,QAAQ,SAAS;EAAG,OAAO,QAAQ,WAAW,EAAE;EAAG,OAAO,QAAQ,QAAQ;CAAC;AAC3F;;AAGA,MAAa,SAAS,WAA6B;CAClD,MAAM,OAAO,OAAO,QAAQ;CAC5B,MAAM,UAAU,KAAK,QAAQ,IAAI;CACjC,MAAM,UAAU,YAAY,KAAK,KAAK,KAAK,MAAM,GAAG,OAAO,EAAA,CAAG,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM;CAC5F,MAAM,CAAC,OAAO,YAAY,YAAY,kBAAkB;CACxD,IAAI,CAAC,KAAK,SAAS,GAAG,KAAK,OAAO,WAAW,KAAK,OAAO,MAAM,UAAU,CAAC,OAAO,cAAc,KAAK,CAAC,GACpG,MAAM,IAAI,MAAM,gCAAgC,OAAO,MAAM,GAAG,GAAG,GAAG;CACvE,OAAO;EACN,MAAM,KAAK,MAAM,UAAU,GAAG,EAAE;EACzB;EACK;EACA;EACI;CACjB;AACD;;;;;;AAaA,MAAa,YACX,QAED,OAAO,MAAc,YAAgD;CACpE,MAAM,SAAS,MAAM,IAAI;EAAC;EAAM;EAAM;EAAQ;EAAK;EAAM,GAAG,WAAW,OAAO;CAAC,CAAC;CAChF,IAAI,OAAO,aAAa,GACvB,MAAM,OAAO,uBAAO,IAAI,MAAM,iDAAiD,KAAK,EAAE,GAAG,EAAE,MAAM,SAAS,CAAC;CAC5G,IAAI,OAAO,aAAa,GACvB,MAAM,IAAI,MAAM,0BAA0B,OAAO,SAAS,MAAM,OAAO,UAAU,OAAO,OAAA,CAAQ,KAAK,GAAG;CACzG,OAAO,MAAM,OAAO,MAAM;AAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACvND,IAAa,4BAAb,cAA+C,OAAO,YAAuC,CAAC,CAC7F,6BACA;CACC,WAAW,OAAO;CAClB,SAAS,OAAO;AACjB,CACD,CAAC,CAAC,CAAC;;AAGH,IAAa,kBAAb,cAAqC,OAAO,YAA6B,CAAC,CAAC,0BAA0B;CACpG,QAAQ,OAAO;CACf,MAAM,OAAO;CACb,OAAO,OAAO,SAAS,OAAO,OAAO,CAAC;AACvC,CAAC,CAAC,CAAC,CAAC;;AAgBJ,MAAa,mBAAmB,UAAmB;CAClD,MAAM,OAAQ,OAA6C;CAC3D,OAAO,SAAS,YAAY,SAAS;AACtC;;;;;;;;;AAUA,MAAa,kBAAkB;CAC9B;CACA;CACA;AACD;;AA4DA,IAAa,UAAb,cAA6B,QAAQ,QAA4B,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC;;;;;;AAOrH,MAAa,qBACZ,SACA,YAAY,SAEZ,OAAO,cAAc;CACpB,KAAK,MAAM,UAAU,OAAO,KAAM,WAAW,CAAC,CAA6B,GAAG;EAC7E,IAAI,WAAW,eAAe,WAAW,SAAS;EAClD,OAAO,OAAO,KAAK,IAAI,0BAA0B;GAAE;GAAW,SAAS,0BAA0B;EAAS,CAAC,CAAC;CAC7G;CACA,OAAO,OAAO;AACf,CAAC;;;;;;AAOF,MAAa,gBAAgB,aAAkC;CAC9D,MAAM,WAAc,QAAgB,MAAc,QACjD,OAAO,WAAW;EAAE,KAAK;EAAK,QAAQ,UAAU,IAAI,gBAAgB;GAAE;GAAQ;GAAM;EAAM,CAAC;CAAE,CAAC;CAa/F,MAAM,wBAAwB,MAAc,YAAiC;EAC5E,MAAM,QAAQ,QAAQ,aAAa,YAAY,SAAS,UAAU,MAAM,OAAO,CAAC;EAChF,MAAM,SAAS,MAAM,QAAQ,IAAI;EACjC,OAAO,MAAM,KACZ,OAAO,YACN,QAAQ,SAAS,cAAc,SAAS,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,KAC3E,OAAO,QACP,OAAO,QAAQ,KAAK,CACrB,CACD,CACD;CACD;CAEA,OAAO;EACN,UAAU,OAAO,GAAG,4BAA4B,CAAC,EAAE,SAClD,QAAQ,YAAY,YAAY,SAAS,SAAS,IAAI,CAAC,CACxD;EACA,gBAAgB,OAAO,GAAG,kCAAkC,CAAC,EAAE,SAC9D,QAAQ,kBAAkB,YAAY,SAAS,eAAe,IAAI,CAAC,CACpE;EACA,WAAW,OAAO,GAAG,6BAA6B,CAAC,CAAC,oBAAoB;EACxE,MAAM,OAAO,GAAG,wBAAwB,CAAC,EAAE,SAAiB,QAAQ,QAAQ,YAAY,SAAS,KAAK,IAAI,CAAC,CAAC;EAE5G,GAAI,SAAS,UAAU,KAAA,IACpB,CAAC,IACD,EACA,OAAO,OAAO,GAAG,yBAAyB,CAAC,EAAE,SAC5C,QAAQ,SAAS,YAAY,SAAS,MAAO,IAAI,CAAC,CACnD,EACD;EACF,SAAS,OAAO,GAAG,2BAA2B,CAAC,EAAE,SAChD,QAAQ,WAAW,YAAY,SAAS,QAAQ,IAAI,CAAC,CACtD;EAIA,QAAQ,OAAO,GAAG,0BAA0B,CAAC,EAAE,SAC9C,QAAQ,UAAU,YAAY,SAAS,OAAO,IAAI,CAAC,CACpD;EACA,OAAO,OAAO,GAAG,yBAAyB,CAAC,EAAE,MAAc,YAC1D,QAAQ,SAAS,YAAY,SAAS,MAAM,MAAM,OAAO,CAAC,CAC3D;EACA,IAAI,OAAO,GAAG,sBAAsB,CAAC,EAAE,MAAc,YACpD,kBAAkB,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,QAAQ,MAAM,YAAY,SAAS,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CACtG;EACA,UAAU,OAAO,GAAG,4BAA4B,CAAC,EAAE,SAClD,QAAQ,YAAY,YAAY,SAAS,SAAS,IAAI,CAAC,CACxD;EACA,WAAW,OAAO,GAAG,6BAA6B,CAAC,EAAE,MAAc,YAClE,OAAO,WAAWA,SAAa,OAAO,CAAC,CAAC,CAAC,KACxC,OAAO,QAAQ,QAAQ,aAAa,YAAY,SAAS,UAAU,MAAM,OAAO,CAAC,CAAC,CACnF,CACD;CACD;AACD;;;;;;;;;AAUA,MAAa,WAAW,IAAe,QAA2B;CACjE,MAAM,MAAM,SAAiB,MAAM,QAAQ,KAAK,IAAI;CACpD,OAAO;EACN,WAAW,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;EACxC,iBAAiB,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC;EACpD,YAAY,MAAM,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO;EAC5D,OAAO,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;EAChC,UAAU,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC;EACtC,SAAS,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC;EACpC,QAAQ,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO;EACpD,KAAK,MAAM,YAAY,GAAG,GAAG,GAAG,IAAI,GAAG,OAAO;EAC9C,WAAW,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;EACxC,YAAY,MAAM,YAAY,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO;EAG5D,GAAI,GAAG,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,SAAiB,GAAG,MAAO,GAAG,IAAI,CAAC,EAAE;CAClF;AACD"}