@dreamtree-org/graphify 1.0.0 → 1.1.1

package/dist/chunk-5ANIDX3G.js

@@ -1,364 +0,0 @@
-// src/security.ts
-import { createHash } from "crypto";
-import * as dns from "dns";
-import * as http from "http";
-import * as https from "https";
-import * as fs from "fs";
-import * as net from "net";
-import * as nodePath from "path";
-var ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
-var MAX_FETCH_BYTES = 50 * 1024 * 1024;
-var MAX_TEXT_BYTES = 10 * 1024 * 1024;
-var MAX_LABEL_LEN = 256;
-var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
-  "metadata.google.internal",
-  "metadata.internal",
-  "metadata",
-  "metadata.azure.com",
-  "instance-data",
-  "instance-data.ec2.internal"
-]);
-function ipv4ToInt(ip) {
-  const parts = ip.split(".");
-  if (parts.length !== 4) return null;
-  let result = 0;
-  for (const part of parts) {
-    if (!/^\d{1,3}$/.test(part)) return null;
-    const n = Number(part);
-    if (n > 255) return null;
-    result = result << 8 | n;
-  }
-  return result >>> 0;
-}
-function ipv4InCidr(ipInt, cidr) {
-  const [base, prefixStr] = cidr.split("/");
-  const prefix = Number(prefixStr);
-  const baseInt = ipv4ToInt(base ?? "");
-  if (baseInt === null) return false;
-  const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
-  return (ipInt & mask) >>> 0 === (baseInt & mask) >>> 0;
-}
-var BLOCKED_IPV4_CIDRS = [
-  "0.0.0.0/8",
-  // "this" network
-  "10.0.0.0/8",
-  // private
-  "100.64.0.0/10",
-  // carrier-grade NAT (CGN)
-  "127.0.0.0/8",
-  // loopback
-  "169.254.0.0/16",
-  // link-local (covers 169.254.169.254 cloud metadata)
-  "172.16.0.0/12",
-  // private
-  "192.0.0.0/24",
-  // IETF protocol assignments
-  "192.0.2.0/24",
-  // TEST-NET-1
-  "192.168.0.0/16",
-  // private
-  "198.18.0.0/15",
-  // benchmarking
-  "198.51.100.0/24",
-  // TEST-NET-2
-  "203.0.113.0/24",
-  // TEST-NET-3
-  "224.0.0.0/4",
-  // multicast
-  "240.0.0.0/4",
-  // reserved
-  "255.255.255.255/32"
-  // broadcast
-];
-function isForbiddenIpv4(ip) {
-  const ipInt = ipv4ToInt(ip);
-  if (ipInt === null) return true;
-  return BLOCKED_IPV4_CIDRS.some((cidr) => ipv4InCidr(ipInt, cidr));
-}
-function expandIpv6(ip) {
-  const withoutZone = ip.split("%")[0] ?? "";
-  const parts = withoutZone.split("::");
-  if (parts.length > 2) return null;
-  const head = parts[0] ? parts[0].split(":").filter((s) => s.length > 0) : [];
-  const tail = parts.length === 2 && parts[1] ? parts[1].split(":").filter((s) => s.length > 0) : [];
-  let missing = 0;
-  if (parts.length === 2) {
-    missing = 8 - head.length - tail.length;
-    if (missing < 0) return null;
-  } else if (head.length + tail.length !== 8) {
-    return null;
-  }
-  const groupsHex = [...head, ...Array(missing).fill("0"), ...tail];
-  if (groupsHex.length !== 8) return null;
-  const groups = [];
-  for (const g of groupsHex) {
-    if (!/^[0-9a-fA-F]{1,4}$/.test(g)) return null;
-    groups.push(parseInt(g, 16));
-  }
-  return groups;
-}
-function isForbiddenIpv6(ip) {
-  const lower = ip.toLowerCase();
-  if (lower === "::1" || lower === "::") return true;
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-  if (mapped) return isForbiddenIpv4(mapped[1]);
-  const groups = expandIpv6(lower);
-  if (groups === null) return true;
-  const first = groups[0];
-  if ((first & 65472) === 65152) return true;
-  if ((first & 65024) === 64512) return true;
-  if ((first & 65280) === 65280) return true;
-  if (groups.every((g) => g === 0)) return true;
-  return false;
-}
-function isForbiddenIp(ip) {
-  return net.isIPv6(ip) ? isForbiddenIpv6(ip) : isForbiddenIpv4(ip);
-}
-function validateUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Invalid URL: ${url}`);
-  }
-  if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
-    throw new Error(
-      `URL scheme not allowed: "${parsed.protocol}" (allowed: ${[...ALLOWED_SCHEMES].join(", ")})`
-    );
-  }
-  const hostname = parsed.hostname.toLowerCase();
-  if (BLOCKED_HOSTNAMES.has(hostname)) {
-    throw new Error(`URL targets a blocked host: ${hostname}`);
-  }
-  const bareHost = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  if (net.isIP(bareHost) && isForbiddenIp(bareHost)) {
-    throw new Error(`URL targets a forbidden IP address: ${bareHost}`);
-  }
-  return parsed.toString();
-}
-function validateGraphPath(path2, base) {
-  const baseDir = base ?? nodePath.join(process.cwd(), "graphify-out");
-  let resolvedBase;
-  try {
-    resolvedBase = fs.realpathSync(baseDir);
-  } catch {
-    throw new Error(`Base directory does not exist: ${baseDir}`);
-  }
-  const candidate = nodePath.isAbsolute(path2) ? path2 : nodePath.join(resolvedBase, path2);
-  const resolvedCandidate = nodePath.resolve(candidate);
-  let realCandidate = resolvedCandidate;
-  try {
-    realCandidate = fs.realpathSync(resolvedCandidate);
-  } catch {
-  }
-  const relative2 = nodePath.relative(resolvedBase, realCandidate);
-  const escapes = relative2 === ".." || relative2.startsWith(`..${nodePath.sep}`) || nodePath.isAbsolute(relative2);
-  if (escapes) {
-    throw new Error(`Path escapes graphify-out/: ${path2}`);
-  }
-  return realCandidate;
-}
-function sanitizeLabel(text) {
-  if (text == null) return "";
-  const stripped = String(text).replace(/[\x00-\x1f\x7f]/g, "");
-  return stripped.slice(0, MAX_LABEL_LEN);
-}
-function escapeHtml(text) {
-  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-
-// src/graphStore.ts
-import * as fs2 from "fs/promises";
-import * as path from "path";
-import Graph from "graphology";
-async function loadGraph(outDir = path.join(process.cwd(), "graphify-out")) {
-  const jsonPath = validateGraphPath("graph.json", outDir);
-  const raw = await fs2.readFile(jsonPath, "utf-8");
-  const data = JSON.parse(raw);
-  return Graph.from(data);
-}
-
-// src/query.ts
-var STOPWORDS = /* @__PURE__ */ new Set([
-  "a",
-  "an",
-  "the",
-  "is",
-  "are",
-  "was",
-  "were",
-  "do",
-  "does",
-  "did",
-  "how",
-  "what",
-  "where",
-  "when",
-  "why",
-  "who",
-  "which",
-  "to",
-  "of",
-  "in",
-  "on",
-  "for",
-  "and",
-  "or",
-  "this",
-  "that",
-  "it",
-  "does",
-  "that's"
-]);
-function tokenize(text) {
-  return text.toLowerCase().split(/[^a-z0-9_.]+/).filter((token) => token.length > 1 && !STOPWORDS.has(token));
-}
-function scoreNodes(graph, query) {
-  const tokens = tokenize(query);
-  const matches = [];
-  graph.forEachNode((id, attributes) => {
-    const label = attributes.label ?? id;
-    const haystack = `${label} ${id}`.toLowerCase();
-    let score = 0;
-    for (const token of tokens) {
-      if (haystack.includes(token)) score += 1;
-    }
-    if (score > 0) matches.push({ id, label, score });
-  });
-  matches.sort((a, b) => b.score - a.score || a.id.localeCompare(b.id));
-  return matches;
-}
-function resolveNode(graph, query) {
-  const matches = scoreNodes(graph, query);
-  return matches[0] ?? null;
-}
-var DEFAULT_MAX_DEPTH = 2;
-var DEFAULT_MAX_SEEDS = 5;
-var DEFAULT_BUDGET = 40;
-function queryGraph(graph, question, options = {}) {
-  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const maxSeeds = options.maxSeeds ?? DEFAULT_MAX_SEEDS;
-  const budget = options.budget ?? DEFAULT_BUDGET;
-  const allMatches = scoreNodes(graph, question);
-  const seeds = allMatches.length > 0 ? allMatches.slice(0, maxSeeds) : [];
-  const visited = /* @__PURE__ */ new Map();
-  const frontier = seeds.map((s) => ({ id: s.id, depth: 0 }));
-  for (const seed of seeds) visited.set(seed.id, 0);
-  while (frontier.length > 0 && visited.size < budget) {
-    const current = options.dfs ? frontier.pop() : frontier.shift();
-    if (current.depth >= maxDepth) continue;
-    const neighbors = [...graph.neighbors(current.id)].sort((a, b) => a.localeCompare(b));
-    for (const neighbor of neighbors) {
-      if (visited.has(neighbor) || visited.size >= budget) continue;
-      visited.set(neighbor, current.depth + 1);
-      frontier.push({ id: neighbor, depth: current.depth + 1 });
-    }
-  }
-  const visitedNodes = [...visited.entries()].map(([id, depth]) => {
-    const attrs = graph.getNodeAttributes(id);
-    return {
-      id,
-      label: attrs.label ?? id,
-      sourceFile: attrs.sourceFile ?? "",
-      sourceLocation: attrs.sourceLocation ?? "",
-      depth
-    };
-  }).sort((a, b) => a.depth - b.depth || a.id.localeCompare(b.id));
-  const edges = [];
-  graph.forEachEdge((_edge, attrs, source, target) => {
-    if (visited.has(source) && visited.has(target)) {
-      edges.push({
-        source,
-        target,
-        relation: String(attrs.relation),
-        confidence: String(attrs.confidence)
-      });
-    }
-  });
-  edges.sort(
-    (a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target) || a.relation.localeCompare(b.relation)
-  );
-  return { seeds, visited: visitedNodes, edges };
-}
-function shortestPath(graph, fromQuery, toQuery) {
-  const from = resolveNode(graph, fromQuery);
-  const to = resolveNode(graph, toQuery);
-  if (!from || !to) return null;
-  if (from.id === to.id) {
-    return { from, to, found: true, path: [from.id], edges: [] };
-  }
-  const predecessor = /* @__PURE__ */ new Map();
-  const visited = /* @__PURE__ */ new Set([from.id]);
-  const queue = [from.id];
-  while (queue.length > 0) {
-    const current = queue.shift();
-    if (current === to.id) break;
-    const neighbors = [...graph.neighbors(current)].sort((a, b) => a.localeCompare(b));
-    for (const neighbor of neighbors) {
-      if (visited.has(neighbor)) continue;
-      visited.add(neighbor);
-      predecessor.set(neighbor, current);
-      queue.push(neighbor);
-    }
-  }
-  if (!visited.has(to.id)) {
-    return { from, to, found: false, path: [], edges: [] };
-  }
-  const path2 = [to.id];
-  let cursor = to.id;
-  while (cursor !== from.id) {
-    const prev = predecessor.get(cursor);
-    if (!prev) break;
-    path2.unshift(prev);
-    cursor = prev;
-  }
-  const edges = [];
-  for (let i = 0; i < path2.length - 1; i++) {
-    const a = path2[i];
-    const b = path2[i + 1];
-    const key = graph.edges(a, b)[0] ?? graph.edges(b, a)[0];
-    if (key) {
-      const attrs = graph.getEdgeAttributes(key);
-      edges.push({ source: a, target: b, relation: String(attrs.relation), confidence: String(attrs.confidence) });
-    }
-  }
-  return { from, to, found: true, path: path2, edges };
-}
-function explainNode(graph, query) {
-  const match = resolveNode(graph, query);
-  if (!match) return null;
-  const attrs = graph.getNodeAttributes(match.id);
-  const outgoing = [];
-  const incoming = [];
-  graph.forEachOutEdge(match.id, (_edge, edgeAttrs, source, target) => {
-    outgoing.push({ source, target, relation: String(edgeAttrs.relation), confidence: String(edgeAttrs.confidence) });
-  });
-  graph.forEachInEdge(match.id, (_edge, edgeAttrs, source, target) => {
-    incoming.push({ source, target, relation: String(edgeAttrs.relation), confidence: String(edgeAttrs.confidence) });
-  });
-  outgoing.sort((a, b) => a.target.localeCompare(b.target) || a.relation.localeCompare(b.relation));
-  incoming.sort((a, b) => a.source.localeCompare(b.source) || a.relation.localeCompare(b.relation));
-  return {
-    id: match.id,
-    label: match.label,
-    sourceFile: attrs.sourceFile ?? "",
-    sourceLocation: attrs.sourceLocation ?? "",
-    communityLabel: attrs.communityLabel,
-    outgoing,
-    incoming
-  };
-}
-
-export {
-  validateUrl,
-  validateGraphPath,
-  sanitizeLabel,
-  escapeHtml,
-  loadGraph,
-  scoreNodes,
-  resolveNode,
-  queryGraph,
-  shortestPath,
-  explainNode
-};
-//# sourceMappingURL=chunk-5ANIDX3G.js.map

package/dist/chunk-5ANIDX3G.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/security.ts","../src/graphStore.ts","../src/query.ts"],"sourcesContent":["/**\n * Security helpers — URL validation, SSRF-guarded fetch, path guards, label\n * sanitization, prompt-injection defenses. Every control listed in\n * SECURITY.md must have a corresponding function here and a unit test in\n * tests/security.test.ts. See the master prompt §5 for the full checklist.\n */\n\nimport { createHash } from 'node:crypto';\nimport * as dns from 'node:dns';\nimport * as http from 'node:http';\nimport * as https from 'node:https';\nimport * as fs from 'node:fs';\nimport * as net from 'node:net';\nimport * as nodePath from 'node:path';\n\nconst ALLOWED_SCHEMES = new Set(['http:', 'https:']);\nconst MAX_FETCH_BYTES = 50 * 1024 * 1024;\nconst MAX_TEXT_BYTES = 10 * 1024 * 1024;\nconst MAX_LABEL_LEN = 256;\nconst MAX_REDIRECTS = 5;\nconst REQUEST_TIMEOUT_MS = 15_000;\n\n/** Hostnames that must never be reachable, regardless of what they resolve to. */\nconst BLOCKED_HOSTNAMES = new Set([\n  'metadata.google.internal',\n  'metadata.internal',\n  'metadata',\n  'metadata.azure.com',\n  'instance-data',\n  'instance-data.ec2.internal',\n]);\n\n// ---------------------------------------------------------------------------\n// IP range checks (SSRF guard core). Implemented without extra dependencies.\n// ---------------------------------------------------------------------------\n\nfunction ipv4ToInt(ip: string): number | null {\n  const parts = ip.split('.');\n  if (parts.length !== 4) return null;\n  let result = 0;\n  for (const part of parts) {\n    if (!/^\\d{1,3}$/.test(part)) return null;\n    const n = Number(part);\n    if (n > 255) return null;\n    result = (result << 8) | n;\n  }\n  return result >>> 0;\n}\n\nfunction ipv4InCidr(ipInt: number, cidr: string): boolean {\n  const [base, prefixStr] = cidr.split('/');\n  const prefix = Number(prefixStr);\n  const baseInt = ipv4ToInt(base ?? '');\n  if (baseInt === null) return false;\n  const mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;\n  return (ipInt & mask) >>> 0 === (baseInt & mask) >>> 0;\n}\n\n/** IPv4 ranges that must never be connected to from a server-side fetch. */\nconst BLOCKED_IPV4_CIDRS = [\n  '0.0.0.0/8', // \"this\" network\n  '10.0.0.0/8', // private\n  '100.64.0.0/10', // carrier-grade NAT (CGN)\n  '127.0.0.0/8', // loopback\n  '169.254.0.0/16', // link-local (covers 169.254.169.254 cloud metadata)\n  '172.16.0.0/12', // private\n  '192.0.0.0/24', // IETF protocol assignments\n  '192.0.2.0/24', // TEST-NET-1\n  '192.168.0.0/16', // private\n  '198.18.0.0/15', // benchmarking\n  '198.51.100.0/24', // TEST-NET-2\n  '203.0.113.0/24', // TEST-NET-3\n  '224.0.0.0/4', // multicast\n  '240.0.0.0/4', // reserved\n  '255.255.255.255/32', // broadcast\n];\n\nexport function isForbiddenIpv4(ip: string): boolean {\n  const ipInt = ipv4ToInt(ip);\n  if (ipInt === null) return true; // malformed -> treat as forbidden, fail closed\n  return BLOCKED_IPV4_CIDRS.some((cidr) => ipv4InCidr(ipInt, cidr));\n}\n\n/** Expand a (possibly `::`-compressed) IPv6 address into 8 16-bit groups. */\nfunction expandIpv6(ip: string): number[] | null {\n  const withoutZone = ip.split('%')[0] ?? '';\n  const parts = withoutZone.split('::');\n  if (parts.length > 2) return null;\n\n  const head = parts[0] ? parts[0].split(':').filter((s) => s.length > 0) : [];\n  const tail = parts.length === 2 && parts[1] ? parts[1].split(':').filter((s) => s.length > 0) : [];\n\n  let missing = 0;\n  if (parts.length === 2) {\n    missing = 8 - head.length - tail.length;\n    if (missing < 0) return null;\n  } else if (head.length + tail.length !== 8) {\n    return null;\n  }\n\n  const groupsHex = [...head, ...Array(missing).fill('0'), ...tail];\n  if (groupsHex.length !== 8) return null;\n\n  const groups: number[] = [];\n  for (const g of groupsHex) {\n    if (!/^[0-9a-fA-F]{1,4}$/.test(g)) return null;\n    groups.push(parseInt(g, 16));\n  }\n  return groups;\n}\n\nexport function isForbiddenIpv6(ip: string): boolean {\n  const lower = ip.toLowerCase();\n  if (lower === '::1' || lower === '::') return true;\n\n  const mapped = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(lower);\n  if (mapped) return isForbiddenIpv4(mapped[1] as string);\n\n  const groups = expandIpv6(lower);\n  if (groups === null) return true; // unparsable -> fail closed\n  const first = groups[0] as number;\n  if ((first & 0xffc0) === 0xfe80) return true; // fe80::/10 link-local\n  if ((first & 0xfe00) === 0xfc00) return true; // fc00::/7 unique local\n  if ((first & 0xff00) === 0xff00) return true; // ff00::/8 multicast\n  if (groups.every((g) => g === 0)) return true; // unspecified/all-zero\n  return false;\n}\n\nexport function isForbiddenIp(ip: string): boolean {\n  return net.isIPv6(ip) ? isForbiddenIpv6(ip) : isForbiddenIpv4(ip);\n}\n\n// ---------------------------------------------------------------------------\n// URL validation\n// ---------------------------------------------------------------------------\n\n/**\n * Validate a URL is http/https and, when the hostname is itself a literal\n * IP or a known cloud-metadata hostname, reject it synchronously. DNS-bound\n * hostnames are re-validated at connect time by safeFetch() (see below) —\n * this function alone cannot rule out DNS rebinding for a hostname that\n * currently resolves to a public IP.\n */\nexport function validateUrl(url: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`Invalid URL: ${url}`);\n  }\n\n  if (!ALLOWED_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `URL scheme not allowed: \"${parsed.protocol}\" (allowed: ${[...ALLOWED_SCHEMES].join(', ')})`,\n    );\n  }\n\n  const hostname = parsed.hostname.toLowerCase();\n  if (BLOCKED_HOSTNAMES.has(hostname)) {\n    throw new Error(`URL targets a blocked host: ${hostname}`);\n  }\n\n  // WHATWG URL keeps the brackets on an IPv6 literal host (e.g. \"[::1]\") —\n  // strip them before checking net.isIP()/isForbiddenIp().\n  const bareHost =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  if (net.isIP(bareHost) && isForbiddenIp(bareHost)) {\n    throw new Error(`URL targets a forbidden IP address: ${bareHost}`);\n  }\n\n  return parsed.toString();\n}\n\n// ---------------------------------------------------------------------------\n// safeFetch — SSRF-guarded, size-capped, redirect-revalidating fetch\n// ---------------------------------------------------------------------------\n\nexport type LookupFn = (hostname: string) => Promise<{ address: string; family: number }>;\n\n/**\n * Resolve a hostname (or pass through a literal IP) and validate the\n * result. `lookup` defaults to the real `dns.promises.lookup` — tests\n * substitute a fake to exercise the rebind guard deterministically without\n * making a real DNS query.\n */\nexport async function resolveAndValidate(\n  hostname: string,\n  lookup: LookupFn = dns.promises.lookup,\n): Promise<{ address: string; family: number }> {\n  if (net.isIP(hostname)) {\n    if (isForbiddenIp(hostname)) {\n      throw new Error(`Refusing to connect to forbidden IP: ${hostname}`);\n    }\n    return { address: hostname, family: net.isIPv6(hostname) ? 6 : 4 };\n  }\n  const result = await lookup(hostname);\n  if (isForbiddenIp(result.address)) {\n    throw new Error(`Refusing to connect to forbidden IP: ${hostname} -> ${result.address}`);\n  }\n  return result;\n}\n\nexport interface RawResponse {\n  statusCode: number;\n  headers: http.IncomingHttpHeaders;\n  body: Buffer;\n}\n\n/** Minimal shape of the `http`/`https` modules that requestOnce() needs — narrow on purpose so tests can substitute a fake transport instead of mocking network I/O. */\nexport type RequestTransport = Pick<typeof http, 'request'>;\n\n/**\n * Issue a single HTTP(S) request, connecting to `resolvedAddress` directly\n * (via a `lookup` override) rather than re-resolving DNS at connect time —\n * this is what prevents a DNS-rebind attacker from swapping the target\n * between validation and connection (TOCTOU). Streams the body and aborts\n * once it exceeds the byte cap for its declared content type.\n */\nexport function requestOnce(\n  target: URL,\n  resolvedAddress: string,\n  resolvedFamily: number,\n  transport: RequestTransport = target.protocol === 'https:' ? https : http,\n): Promise<RawResponse> {\n  return new Promise((resolve, reject) => {\n    const req = transport.request(\n      {\n        protocol: target.protocol,\n        hostname: target.hostname,\n        host: target.hostname,\n        port: target.port || (target.protocol === 'https:' ? 443 : 80),\n        path: `${target.pathname}${target.search}`,\n        method: 'GET',\n        timeout: REQUEST_TIMEOUT_MS,\n        headers: { 'user-agent': 'graphify/0.1', accept: '*/*' },\n        // Force the connection to the address we already validated — do not\n        // let Node re-resolve `target.hostname` at connect time.\n        lookup: (\n          _hostname: string,\n          options: unknown,\n          callback: (err: NodeJS.ErrnoException | null, address: string, family: number) => void,\n        ) => {\n          callback(null, resolvedAddress, resolvedFamily);\n        },\n      } as http.RequestOptions,\n      (res) => {\n        const statusCode = res.statusCode ?? 0;\n        const contentType = String(res.headers['content-type'] ?? '');\n        const isTextual = /^text\\/|json|xml|html|charset=/i.test(contentType);\n        const cap = isTextual ? MAX_TEXT_BYTES : MAX_FETCH_BYTES;\n\n        const chunks: Buffer[] = [];\n        let total = 0;\n        let aborted = false;\n\n        res.on('data', (chunk: Buffer) => {\n          total += chunk.length;\n          if (total > cap) {\n            aborted = true;\n            res.destroy();\n            req.destroy();\n            reject(new Error(`Response exceeded ${cap} byte cap (content-type: ${contentType})`));\n            return;\n          }\n          chunks.push(chunk);\n        });\n        res.on('end', () => {\n          if (aborted) return;\n          resolve({ statusCode, headers: res.headers, body: Buffer.concat(chunks) });\n        });\n        res.on('error', (err) => {\n          if (!aborted) reject(err);\n        });\n      },\n    );\n\n    req.on('timeout', () => {\n      req.destroy(new Error(`Request timed out after ${REQUEST_TIMEOUT_MS}ms`));\n    });\n    req.on('error', reject);\n    req.end();\n  });\n}\n\nexport interface SafeFetchDeps {\n  /** Override DNS resolution + IP validation (default: resolveAndValidate). */\n  resolve?: (hostname: string) => Promise<{ address: string; family: number }>;\n  /** Override the actual request (default: requestOnce against real http/https). */\n  request?: (target: URL, address: string, family: number) => Promise<RawResponse>;\n}\n\n/**\n * Fetch a URL with the SSRF guards from validateUrl() plus streaming size\n * caps (MAX_FETCH_BYTES / MAX_TEXT_BYTES) and a hard error on non-2xx\n * status. Every redirect hop is independently validated and re-resolved —\n * a redirect to a private/loopback/metadata address is rejected exactly\n * like a direct request would be.\n *\n * `deps` exists so tests can substitute the DNS/network collaborators with\n * deterministic fakes (see tests/security.test.ts) instead of mocking\n * Node's core modules or hitting real sockets — production callers should\n * never need to pass it.\n */\nexport async function safeFetch(url: string, deps: SafeFetchDeps = {}): Promise<Buffer> {\n  const resolve = deps.resolve ?? resolveAndValidate;\n  const doRequest = deps.request ?? requestOnce;\n\n  let current = validateUrl(url);\n  for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {\n    const target = new URL(current);\n    const { address, family } = await resolve(target.hostname);\n    const response = await doRequest(target, address, family);\n\n    if (response.statusCode >= 300 && response.statusCode < 400) {\n      const location = response.headers.location;\n      if (!location) {\n        throw new Error(`Redirect response (${response.statusCode}) missing Location header`);\n      }\n      const next = new URL(location, target).toString();\n      current = validateUrl(next);\n      continue;\n    }\n\n    if (response.statusCode < 200 || response.statusCode >= 300) {\n      throw new Error(`Non-2xx response: ${response.statusCode}`);\n    }\n\n    return response.body;\n  }\n  throw new Error(`Too many redirects (> ${MAX_REDIRECTS}) while fetching ${url}`);\n}\n\n// ---------------------------------------------------------------------------\n// Path traversal guard\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve `path` and require it stays inside `base` (defaults to\n * `<cwd>/graphify-out`). `base` must already exist. Throws on traversal\n * attempts (`../`, absolute escapes, symlink-resolved escapes).\n */\nexport function validateGraphPath(path: string, base?: string): string {\n  const baseDir = base ?? nodePath.join(process.cwd(), 'graphify-out');\n\n  let resolvedBase: string;\n  try {\n    resolvedBase = fs.realpathSync(baseDir);\n  } catch {\n    throw new Error(`Base directory does not exist: ${baseDir}`);\n  }\n\n  const candidate = nodePath.isAbsolute(path) ? path : nodePath.join(resolvedBase, path);\n  const resolvedCandidate = nodePath.resolve(candidate);\n\n  // Resolve symlinks for whichever is the deepest existing ancestor, so a\n  // symlink inside an otherwise-valid path can't escape the base dir either.\n  let realCandidate = resolvedCandidate;\n  try {\n    realCandidate = fs.realpathSync(resolvedCandidate);\n  } catch {\n    // Path (or part of it) may not exist yet (e.g. a file we're about to\n    // write) — fall back to the lexically-resolved path for the check.\n  }\n\n  const relative = nodePath.relative(resolvedBase, realCandidate);\n  const escapes = relative === '..' || relative.startsWith(`..${nodePath.sep}`) || nodePath.isAbsolute(relative);\n  if (escapes) {\n    throw new Error(`Path escapes graphify-out/: ${path}`);\n  }\n\n  return realCandidate;\n}\n\n// ---------------------------------------------------------------------------\n// Label sanitization (unchanged reference implementation) + HTML escaping\n// ---------------------------------------------------------------------------\n\n/** Strip control characters, cap length. Apply to every node/edge label. */\nexport function sanitizeLabel(text: string | null | undefined): string {\n  if (text == null) return '';\n  // eslint-disable-next-line no-control-regex -- intentional: stripping raw control chars\n  const stripped = String(text).replace(/[\\x00-\\x1f\\x7f]/g, '');\n  return stripped.slice(0, MAX_LABEL_LEN);\n}\n\n/**\n * HTML-escape a string. Callers must run sanitizeLabel() first for\n * length/control-char stripping, then escapeHtml() immediately before\n * embedding into graph.html (XSS control, see SECURITY.md).\n */\nexport function escapeHtml(text: string): string {\n  return text\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#39;');\n}\n\n// ---------------------------------------------------------------------------\n// Prompt-injection defenses for LLM-bound file content\n// ---------------------------------------------------------------------------\n\n/**\n * Known jailbreak / chat-template sentinels that must never reach a prompt\n * unescaped, whether they occur in source files or are forged to spoof our\n * own <untrusted_source> delimiter.\n */\nconst SENTINEL_PATTERNS: RegExp[] = [\n  /<\\|im_start\\|>/gi,\n  /<\\|im_end\\|>/gi,\n  /<\\|system\\|>/gi,\n  /\\[INST\\]/gi,\n  /\\[\\/INST\\]/gi,\n  /<<SYS>>/gi,\n  /<<\\/SYS>>/gi,\n  /<\\/untrusted_source>/gi,\n  /<untrusted_source/gi,\n];\n\n/**\n * Render brackets as fullwidth lookalikes (＜ ＞ ［ ］) so the defanged\n * echo is human-visible but no longer byte-identical to the original\n * sentinel — a naive downstream scan for the literal delimiter/sentinel\n * text will not re-match our own \"we found one\" marker.\n */\nfunction toFullwidthBrackets(text: string): string {\n  return text\n    .replace(/</g, '＜')\n    .replace(/>/g, '＞')\n    .replace(/\\[/g, '［')\n    .replace(/\\]/g, '］');\n}\n\n/**\n * Replace known jailbreak/chat-template sentinels with a visibly defanged\n * form — never silently stripped (silent stripping can itself be an\n * injection vector if it changes meaning unexpectedly).\n */\nfunction defangSentinels(content: string): string {\n  let result = content;\n  for (const pattern of SENTINEL_PATTERNS) {\n    result = result.replace(pattern, (match) => `[DEFANGED:${toFullwidthBrackets(match)}]`);\n  }\n  return result;\n}\n\n/**\n * Wrap file content for LLM prompts in a hash-stamped untrusted-source\n * delimiter and neutralize known jailbreak/chat-template sentinels. This\n * raises the bar against prompt injection; it does not eliminate it —\n * document that plainly wherever this is referenced.\n */\nexport function wrapUntrustedSource(path: string, content: string): string {\n  const sha256 = createHash('sha256').update(content, 'utf8').digest('hex');\n  const safePath = escapeHtml(sanitizeLabel(path));\n  const defanged = defangSentinels(content);\n  return `<untrusted_source path=\"${safePath}\" sha256=\"${sha256}\">\\n${defanged}\\n</untrusted_source>`;\n}\n","import * as fs from 'node:fs/promises';\nimport * as path from 'node:path';\nimport Graph from 'graphology';\nimport { validateGraphPath } from './security.js';\n\n/**\n * Load a previously-exported graph.json back into a graphology Graph.\n * Always goes through security.validateGraphPath() (path-traversal guard —\n * see SECURITY.md) so a caller-supplied `outDir`/CLI arg can never make\n * this read outside the graphify-out/ directory it resolves to.\n */\nexport async function loadGraph(outDir: string = path.join(process.cwd(), 'graphify-out')): Promise<Graph> {\n  const jsonPath = validateGraphPath('graph.json', outDir);\n  const raw = await fs.readFile(jsonPath, 'utf-8');\n  const data: unknown = JSON.parse(raw);\n  return Graph.from(data as Parameters<typeof Graph.from>[0]);\n}\n","import type Graph from 'graphology';\n\n/**\n * Library-level graph queries shared by the CLI (`graphify query/path/\n * explain`) and the MCP server tools of the same name. None of this is an\n * LLM call — it's lexical node matching + graph traversal, so it works\n * fully offline and deterministically.\n */\n\nconst STOPWORDS = new Set([\n  'a', 'an', 'the', 'is', 'are', 'was', 'were', 'do', 'does', 'did', 'how',\n  'what', 'where', 'when', 'why', 'who', 'which', 'to', 'of', 'in', 'on',\n  'for', 'and', 'or', 'this', 'that', 'it', 'does', 'that\\'s',\n]);\n\nfunction tokenize(text: string): string[] {\n  return text\n    .toLowerCase()\n    .split(/[^a-z0-9_.]+/)\n    .filter((token) => token.length > 1 && !STOPWORDS.has(token));\n}\n\nexport interface NodeMatch {\n  id: string;\n  label: string;\n  score: number;\n}\n\n/** Score every node by how many query tokens appear in its label or id. */\nexport function scoreNodes(graph: Graph, query: string): NodeMatch[] {\n  const tokens = tokenize(query);\n  const matches: NodeMatch[] = [];\n\n  graph.forEachNode((id, attributes) => {\n    const label = (attributes.label as string | undefined) ?? id;\n    const haystack = `${label} ${id}`.toLowerCase();\n    let score = 0;\n    for (const token of tokens) {\n      if (haystack.includes(token)) score += 1;\n    }\n    if (score > 0) matches.push({ id, label, score });\n  });\n\n  matches.sort((a, b) => b.score - a.score || a.id.localeCompare(b.id));\n  return matches;\n}\n\n/**\n * Best-effort single-node resolution: the highest-scoring lexical match,\n * or null if nothing in the graph matches at all. Deliberately does *not*\n * fall back to \"the most connected node\" — path/explain name a specific\n * node by intent, and silently substituting an unrelated one would be\n * more misleading than clearly saying \"no match\".\n */\nexport function resolveNode(graph: Graph, query: string): NodeMatch | null {\n  const matches = scoreNodes(graph, query);\n  return matches[0] ?? null;\n}\n\nexport interface VisitedNode {\n  id: string;\n  label: string;\n  sourceFile: string;\n  sourceLocation: string;\n  depth: number;\n}\n\nexport interface TraversalEdge {\n  source: string;\n  target: string;\n  relation: string;\n  confidence: string;\n}\n\nexport interface QueryResult {\n  seeds: NodeMatch[];\n  visited: VisitedNode[];\n  edges: TraversalEdge[];\n}\n\nexport interface QueryOptions {\n  dfs?: boolean;\n  /** Approximate cap on how many nodes to include (a stand-in for a true token budget — see docs). */\n  budget?: number;\n  maxDepth?: number;\n  maxSeeds?: number;\n}\n\nconst DEFAULT_MAX_DEPTH = 2;\nconst DEFAULT_MAX_SEEDS = 5;\nconst DEFAULT_BUDGET = 40;\n\n/**\n * BFS (default, broad context) or DFS (--dfs, trace a specific path)\n * traversal from the nodes whose label best matches `question`'s\n * keywords. This is lexical retrieval, not natural-language\n * understanding — it surfaces the neighborhood of the graph an agent (or\n * a human) should look at to answer the question, it does not itself\n * compose an answer.\n */\nexport function queryGraph(graph: Graph, question: string, options: QueryOptions = {}): QueryResult {\n  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;\n  const maxSeeds = options.maxSeeds ?? DEFAULT_MAX_SEEDS;\n  const budget = options.budget ?? DEFAULT_BUDGET;\n\n  const allMatches = scoreNodes(graph, question);\n  const seeds = allMatches.length > 0 ? allMatches.slice(0, maxSeeds) : [];\n\n  const visited = new Map<string, number>(); // id -> depth\n  const frontier: Array<{ id: string; depth: number }> = seeds.map((s) => ({ id: s.id, depth: 0 }));\n  for (const seed of seeds) visited.set(seed.id, 0);\n\n  while (frontier.length > 0 && visited.size < budget) {\n    const current = options.dfs ? (frontier.pop() as { id: string; depth: number }) : (frontier.shift() as { id: string; depth: number });\n    if (current.depth >= maxDepth) continue;\n\n    const neighbors = [...graph.neighbors(current.id)].sort((a, b) => a.localeCompare(b));\n    for (const neighbor of neighbors) {\n      if (visited.has(neighbor) || visited.size >= budget) continue;\n      visited.set(neighbor, current.depth + 1);\n      frontier.push({ id: neighbor, depth: current.depth + 1 });\n    }\n  }\n\n  const visitedNodes: VisitedNode[] = [...visited.entries()]\n    .map(([id, depth]) => {\n      const attrs = graph.getNodeAttributes(id);\n      return {\n        id,\n        label: (attrs.label as string | undefined) ?? id,\n        sourceFile: (attrs.sourceFile as string | undefined) ?? '',\n        sourceLocation: (attrs.sourceLocation as string | undefined) ?? '',\n        depth,\n      };\n    })\n    .sort((a, b) => a.depth - b.depth || a.id.localeCompare(b.id));\n\n  const edges: TraversalEdge[] = [];\n  graph.forEachEdge((_edge, attrs, source, target) => {\n    if (visited.has(source) && visited.has(target)) {\n      edges.push({\n        source,\n        target,\n        relation: String(attrs.relation),\n        confidence: String(attrs.confidence),\n      });\n    }\n  });\n  edges.sort(\n    (a, b) => a.source.localeCompare(b.source) || a.target.localeCompare(b.target) || a.relation.localeCompare(b.relation),\n  );\n\n  return { seeds, visited: visitedNodes, edges };\n}\n\nexport interface PathResult {\n  from: NodeMatch;\n  to: NodeMatch;\n  found: boolean;\n  path: string[];\n  edges: TraversalEdge[];\n}\n\n/** Shortest path between the nodes that best match `fromQuery` and `toQuery` (undirected BFS — connectivity, not call direction). */\nexport function shortestPath(graph: Graph, fromQuery: string, toQuery: string): PathResult | null {\n  const from = resolveNode(graph, fromQuery);\n  const to = resolveNode(graph, toQuery);\n  if (!from || !to) return null;\n\n  if (from.id === to.id) {\n    return { from, to, found: true, path: [from.id], edges: [] };\n  }\n\n  const predecessor = new Map<string, string>();\n  const visited = new Set<string>([from.id]);\n  const queue: string[] = [from.id];\n\n  while (queue.length > 0) {\n    const current = queue.shift() as string;\n    if (current === to.id) break;\n    const neighbors = [...graph.neighbors(current)].sort((a, b) => a.localeCompare(b));\n    for (const neighbor of neighbors) {\n      if (visited.has(neighbor)) continue;\n      visited.add(neighbor);\n      predecessor.set(neighbor, current);\n      queue.push(neighbor);\n    }\n  }\n\n  if (!visited.has(to.id)) {\n    return { from, to, found: false, path: [], edges: [] };\n  }\n\n  const path: string[] = [to.id];\n  let cursor = to.id;\n  while (cursor !== from.id) {\n    const prev = predecessor.get(cursor);\n    if (!prev) break;\n    path.unshift(prev);\n    cursor = prev;\n  }\n\n  const edges: TraversalEdge[] = [];\n  for (let i = 0; i < path.length - 1; i++) {\n    const a = path[i] as string;\n    const b = path[i + 1] as string;\n    const key = graph.edges(a, b)[0] ?? graph.edges(b, a)[0];\n    if (key) {\n      const attrs = graph.getEdgeAttributes(key);\n      edges.push({ source: a, target: b, relation: String(attrs.relation), confidence: String(attrs.confidence) });\n    }\n  }\n\n  return { from, to, found: true, path, edges };\n}\n\nexport interface ExplainResult {\n  id: string;\n  label: string;\n  sourceFile: string;\n  sourceLocation: string;\n  communityLabel?: string;\n  outgoing: TraversalEdge[];\n  incoming: TraversalEdge[];\n}\n\n/** Plain-language-ready explanation of the node that best matches `query`. */\nexport function explainNode(graph: Graph, query: string): ExplainResult | null {\n  const match = resolveNode(graph, query);\n  if (!match) return null;\n\n  const attrs = graph.getNodeAttributes(match.id);\n  const outgoing: TraversalEdge[] = [];\n  const incoming: TraversalEdge[] = [];\n\n  graph.forEachOutEdge(match.id, (_edge, edgeAttrs, source, target) => {\n    outgoing.push({ source, target, relation: String(edgeAttrs.relation), confidence: String(edgeAttrs.confidence) });\n  });\n  graph.forEachInEdge(match.id, (_edge, edgeAttrs, source, target) => {\n    incoming.push({ source, target, relation: String(edgeAttrs.relation), confidence: String(edgeAttrs.confidence) });\n  });\n\n  outgoing.sort((a, b) => a.target.localeCompare(b.target) || a.relation.localeCompare(b.relation));\n  incoming.sort((a, b) => a.source.localeCompare(b.source) || a.relation.localeCompare(b.relation));\n\n  return {\n    id: match.id,\n    label: match.label,\n    sourceFile: (attrs.sourceFile as string | undefined) ?? '',\n    sourceLocation: (attrs.sourceLocation as string | undefined) ?? '',\n    communityLabel: attrs.communityLabel as string | undefined,\n    outgoing,\n    incoming,\n  };\n}\n"],"mappings":";AAOA,SAAS,kBAAkB;AAC3B,YAAY,SAAS;AACrB,YAAY,UAAU;AACtB,YAAY,WAAW;AACvB,YAAY,QAAQ;AACpB,YAAY,SAAS;AACrB,YAAY,cAAc;AAE1B,IAAM,kBAAkB,oBAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;AACnD,IAAM,kBAAkB,KAAK,OAAO;AACpC,IAAM,iBAAiB,KAAK,OAAO;AACnC,IAAM,gBAAgB;AAKtB,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMD,SAAS,UAAU,IAA2B;AAC5C,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,SAAS;AACb,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,YAAY,KAAK,IAAI,EAAG,QAAO;AACpC,UAAM,IAAI,OAAO,IAAI;AACrB,QAAI,IAAI,IAAK,QAAO;AACpB,aAAU,UAAU,IAAK;AAAA,EAC3B;AACA,SAAO,WAAW;AACpB;AAEA,SAAS,WAAW,OAAe,MAAuB;AACxD,QAAM,CAAC,MAAM,SAAS,IAAI,KAAK,MAAM,GAAG;AACxC,QAAM,SAAS,OAAO,SAAS;AAC/B,QAAM,UAAU,UAAU,QAAQ,EAAE;AACpC,MAAI,YAAY,KAAM,QAAO;AAC7B,QAAM,OAAO,WAAW,IAAI,IAAK,CAAC,KAAM,KAAK,WAAa;AAC1D,UAAQ,QAAQ,UAAU,OAAO,UAAU,UAAU;AACvD;AAGA,IAAM,qBAAqB;AAAA,EACzB;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF;AAEO,SAAS,gBAAgB,IAAqB;AACnD,QAAM,QAAQ,UAAU,EAAE;AAC1B,MAAI,UAAU,KAAM,QAAO;AAC3B,SAAO,mBAAmB,KAAK,CAAC,SAAS,WAAW,OAAO,IAAI,CAAC;AAClE;AAGA,SAAS,WAAW,IAA6B;AAC/C,QAAM,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK;AACxC,QAAM,QAAQ,YAAY,MAAM,IAAI;AACpC,MAAI,MAAM,SAAS,EAAG,QAAO;AAE7B,QAAM,OAAO,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;AAC3E,QAAM,OAAO,MAAM,WAAW,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;AAEjG,MAAI,UAAU;AACd,MAAI,MAAM,WAAW,GAAG;AACtB,cAAU,IAAI,KAAK,SAAS,KAAK;AACjC,QAAI,UAAU,EAAG,QAAO;AAAA,EAC1B,WAAW,KAAK,SAAS,KAAK,WAAW,GAAG;AAC1C,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,CAAC,GAAG,MAAM,GAAG,MAAM,OAAO,EAAE,KAAK,GAAG,GAAG,GAAG,IAAI;AAChE,MAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,QAAM,SAAmB,CAAC;AAC1B,aAAW,KAAK,WAAW;AACzB,QAAI,CAAC,qBAAqB,KAAK,CAAC,EAAG,QAAO;AAC1C,WAAO,KAAK,SAAS,GAAG,EAAE,CAAC;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,IAAqB;AACnD,QAAM,QAAQ,GAAG,YAAY;AAC7B,MAAI,UAAU,SAAS,UAAU,KAAM,QAAO;AAE9C,QAAM,SAAS,gCAAgC,KAAK,KAAK;AACzD,MAAI,OAAQ,QAAO,gBAAgB,OAAO,CAAC,CAAW;AAEtD,QAAM,SAAS,WAAW,KAAK;AAC/B,MAAI,WAAW,KAAM,QAAO;AAC5B,QAAM,QAAQ,OAAO,CAAC;AACtB,OAAK,QAAQ,WAAY,MAAQ,QAAO;AACxC,OAAK,QAAQ,WAAY,MAAQ,QAAO;AACxC,OAAK,QAAQ,WAAY,MAAQ,QAAO;AACxC,MAAI,OAAO,MAAM,CAAC,MAAM,MAAM,CAAC,EAAG,QAAO;AACzC,SAAO;AACT;AAEO,SAAS,cAAc,IAAqB;AACjD,SAAW,WAAO,EAAE,IAAI,gBAAgB,EAAE,IAAI,gBAAgB,EAAE;AAClE;AAaO,SAAS,YAAY,KAAqB;AAC/C,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,MAAM,gBAAgB,GAAG,EAAE;AAAA,EACvC;AAEA,MAAI,CAAC,gBAAgB,IAAI,OAAO,QAAQ,GAAG;AACzC,UAAM,IAAI;AAAA,MACR,4BAA4B,OAAO,QAAQ,eAAe,CAAC,GAAG,eAAe,EAAE,KAAK,IAAI,CAAC;AAAA,IAC3F;AAAA,EACF;AAEA,QAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,MAAI,kBAAkB,IAAI,QAAQ,GAAG;AACnC,UAAM,IAAI,MAAM,+BAA+B,QAAQ,EAAE;AAAA,EAC3D;AAIA,QAAM,WACJ,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC/E,MAAQ,SAAK,QAAQ,KAAK,cAAc,QAAQ,GAAG;AACjD,UAAM,IAAI,MAAM,uCAAuC,QAAQ,EAAE;AAAA,EACnE;AAEA,SAAO,OAAO,SAAS;AACzB;AA0KO,SAAS,kBAAkBA,OAAc,MAAuB;AACrE,QAAM,UAAU,QAAiB,cAAK,QAAQ,IAAI,GAAG,cAAc;AAEnE,MAAI;AACJ,MAAI;AACF,mBAAkB,gBAAa,OAAO;AAAA,EACxC,QAAQ;AACN,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AAEA,QAAM,YAAqB,oBAAWA,KAAI,IAAIA,QAAgB,cAAK,cAAcA,KAAI;AACrF,QAAM,oBAA6B,iBAAQ,SAAS;AAIpD,MAAI,gBAAgB;AACpB,MAAI;AACF,oBAAmB,gBAAa,iBAAiB;AAAA,EACnD,QAAQ;AAAA,EAGR;AAEA,QAAMC,YAAoB,kBAAS,cAAc,aAAa;AAC9D,QAAM,UAAUA,cAAa,QAAQA,UAAS,WAAW,KAAc,YAAG,EAAE,KAAc,oBAAWA,SAAQ;AAC7G,MAAI,SAAS;AACX,UAAM,IAAI,MAAM,+BAA+BD,KAAI,EAAE;AAAA,EACvD;AAEA,SAAO;AACT;AAOO,SAAS,cAAc,MAAyC;AACrE,MAAI,QAAQ,KAAM,QAAO;AAEzB,QAAM,WAAW,OAAO,IAAI,EAAE,QAAQ,oBAAoB,EAAE;AAC5D,SAAO,SAAS,MAAM,GAAG,aAAa;AACxC;AAOO,SAAS,WAAW,MAAsB;AAC/C,SAAO,KACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,OAAO;AAC1B;;;AC7YA,YAAYE,SAAQ;AACpB,YAAY,UAAU;AACtB,OAAO,WAAW;AASlB,eAAsB,UAAU,SAAsB,UAAK,QAAQ,IAAI,GAAG,cAAc,GAAmB;AACzG,QAAM,WAAW,kBAAkB,cAAc,MAAM;AACvD,QAAM,MAAM,MAAS,aAAS,UAAU,OAAO;AAC/C,QAAM,OAAgB,KAAK,MAAM,GAAG;AACpC,SAAO,MAAM,KAAK,IAAwC;AAC5D;;;ACPA,IAAM,YAAY,oBAAI,IAAI;AAAA,EACxB;AAAA,EAAK;AAAA,EAAM;AAAA,EAAO;AAAA,EAAM;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAO;AAAA,EACnE;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAM;AAAA,EAAM;AAAA,EAAM;AAAA,EAClE;AAAA,EAAO;AAAA,EAAO;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAQ;AACpD,CAAC;AAED,SAAS,SAAS,MAAwB;AACxC,SAAO,KACJ,YAAY,EACZ,MAAM,cAAc,EACpB,OAAO,CAAC,UAAU,MAAM,SAAS,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC;AAChE;AASO,SAAS,WAAW,OAAc,OAA4B;AACnE,QAAM,SAAS,SAAS,KAAK;AAC7B,QAAM,UAAuB,CAAC;AAE9B,QAAM,YAAY,CAAC,IAAI,eAAe;AACpC,UAAM,QAAS,WAAW,SAAgC;AAC1D,UAAM,WAAW,GAAG,KAAK,IAAI,EAAE,GAAG,YAAY;AAC9C,QAAI,QAAQ;AACZ,eAAW,SAAS,QAAQ;AAC1B,UAAI,SAAS,SAAS,KAAK,EAAG,UAAS;AAAA,IACzC;AACA,QAAI,QAAQ,EAAG,SAAQ,KAAK,EAAE,IAAI,OAAO,MAAM,CAAC;AAAA,EAClD,CAAC;AAED,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AACpE,SAAO;AACT;AASO,SAAS,YAAY,OAAc,OAAiC;AACzE,QAAM,UAAU,WAAW,OAAO,KAAK;AACvC,SAAO,QAAQ,CAAC,KAAK;AACvB;AA+BA,IAAM,oBAAoB;AAC1B,IAAM,oBAAoB;AAC1B,IAAM,iBAAiB;AAUhB,SAAS,WAAW,OAAc,UAAkB,UAAwB,CAAC,GAAgB;AAClG,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,SAAS,QAAQ,UAAU;AAEjC,QAAM,aAAa,WAAW,OAAO,QAAQ;AAC7C,QAAM,QAAQ,WAAW,SAAS,IAAI,WAAW,MAAM,GAAG,QAAQ,IAAI,CAAC;AAEvE,QAAM,UAAU,oBAAI,IAAoB;AACxC,QAAM,WAAiD,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,EAAE;AAChG,aAAW,QAAQ,MAAO,SAAQ,IAAI,KAAK,IAAI,CAAC;AAEhD,SAAO,SAAS,SAAS,KAAK,QAAQ,OAAO,QAAQ;AACnD,UAAM,UAAU,QAAQ,MAAO,SAAS,IAAI,IAAuC,SAAS,MAAM;AAClG,QAAI,QAAQ,SAAS,SAAU;AAE/B,UAAM,YAAY,CAAC,GAAG,MAAM,UAAU,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACpF,eAAW,YAAY,WAAW;AAChC,UAAI,QAAQ,IAAI,QAAQ,KAAK,QAAQ,QAAQ,OAAQ;AACrD,cAAQ,IAAI,UAAU,QAAQ,QAAQ,CAAC;AACvC,eAAS,KAAK,EAAE,IAAI,UAAU,OAAO,QAAQ,QAAQ,EAAE,CAAC;AAAA,IAC1D;AAAA,EACF;AAEA,QAAM,eAA8B,CAAC,GAAG,QAAQ,QAAQ,CAAC,EACtD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;AACpB,UAAM,QAAQ,MAAM,kBAAkB,EAAE;AACxC,WAAO;AAAA,MACL;AAAA,MACA,OAAQ,MAAM,SAAgC;AAAA,MAC9C,YAAa,MAAM,cAAqC;AAAA,MACxD,gBAAiB,MAAM,kBAAyC;AAAA,MAChE;AAAA,IACF;AAAA,EACF,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AAE/D,QAAM,QAAyB,CAAC;AAChC,QAAM,YAAY,CAAC,OAAO,OAAO,QAAQ,WAAW;AAClD,QAAI,QAAQ,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG;AAC9C,YAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA,UAAU,OAAO,MAAM,QAAQ;AAAA,QAC/B,YAAY,OAAO,MAAM,UAAU;AAAA,MACrC,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACD,QAAM;AAAA,IACJ,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,SAAS,cAAc,EAAE,QAAQ;AAAA,EACvH;AAEA,SAAO,EAAE,OAAO,SAAS,cAAc,MAAM;AAC/C;AAWO,SAAS,aAAa,OAAc,WAAmB,SAAoC;AAChG,QAAM,OAAO,YAAY,OAAO,SAAS;AACzC,QAAM,KAAK,YAAY,OAAO,OAAO;AACrC,MAAI,CAAC,QAAQ,CAAC,GAAI,QAAO;AAEzB,MAAI,KAAK,OAAO,GAAG,IAAI;AACrB,WAAO,EAAE,MAAM,IAAI,OAAO,MAAM,MAAM,CAAC,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE;AAAA,EAC7D;AAEA,QAAM,cAAc,oBAAI,IAAoB;AAC5C,QAAM,UAAU,oBAAI,IAAY,CAAC,KAAK,EAAE,CAAC;AACzC,QAAM,QAAkB,CAAC,KAAK,EAAE;AAEhC,SAAO,MAAM,SAAS,GAAG;AACvB,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,YAAY,GAAG,GAAI;AACvB,UAAM,YAAY,CAAC,GAAG,MAAM,UAAU,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AACjF,eAAW,YAAY,WAAW;AAChC,UAAI,QAAQ,IAAI,QAAQ,EAAG;AAC3B,cAAQ,IAAI,QAAQ;AACpB,kBAAY,IAAI,UAAU,OAAO;AACjC,YAAM,KAAK,QAAQ;AAAA,IACrB;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,IAAI,GAAG,EAAE,GAAG;AACvB,WAAO,EAAE,MAAM,IAAI,OAAO,OAAO,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE;AAAA,EACvD;AAEA,QAAMC,QAAiB,CAAC,GAAG,EAAE;AAC7B,MAAI,SAAS,GAAG;AAChB,SAAO,WAAW,KAAK,IAAI;AACzB,UAAM,OAAO,YAAY,IAAI,MAAM;AACnC,QAAI,CAAC,KAAM;AACX,IAAAA,MAAK,QAAQ,IAAI;AACjB,aAAS;AAAA,EACX;AAEA,QAAM,QAAyB,CAAC;AAChC,WAAS,IAAI,GAAG,IAAIA,MAAK,SAAS,GAAG,KAAK;AACxC,UAAM,IAAIA,MAAK,CAAC;AAChB,UAAM,IAAIA,MAAK,IAAI,CAAC;AACpB,UAAM,MAAM,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM,MAAM,GAAG,CAAC,EAAE,CAAC;AACvD,QAAI,KAAK;AACP,YAAM,QAAQ,MAAM,kBAAkB,GAAG;AACzC,YAAM,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,OAAO,MAAM,QAAQ,GAAG,YAAY,OAAO,MAAM,UAAU,EAAE,CAAC;AAAA,IAC7G;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,IAAI,OAAO,MAAM,MAAAA,OAAM,MAAM;AAC9C;AAaO,SAAS,YAAY,OAAc,OAAqC;AAC7E,QAAM,QAAQ,YAAY,OAAO,KAAK;AACtC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,QAAQ,MAAM,kBAAkB,MAAM,EAAE;AAC9C,QAAM,WAA4B,CAAC;AACnC,QAAM,WAA4B,CAAC;AAEnC,QAAM,eAAe,MAAM,IAAI,CAAC,OAAO,WAAW,QAAQ,WAAW;AACnE,aAAS,KAAK,EAAE,QAAQ,QAAQ,UAAU,OAAO,UAAU,QAAQ,GAAG,YAAY,OAAO,UAAU,UAAU,EAAE,CAAC;AAAA,EAClH,CAAC;AACD,QAAM,cAAc,MAAM,IAAI,CAAC,OAAO,WAAW,QAAQ,WAAW;AAClE,aAAS,KAAK,EAAE,QAAQ,QAAQ,UAAU,OAAO,UAAU,QAAQ,GAAG,YAAY,OAAO,UAAU,UAAU,EAAE,CAAC;AAAA,EAClH,CAAC;AAED,WAAS,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAChG,WAAS,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,KAAK,EAAE,SAAS,cAAc,EAAE,QAAQ,CAAC;AAEhG,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,OAAO,MAAM;AAAA,IACb,YAAa,MAAM,cAAqC;AAAA,IACxD,gBAAiB,MAAM,kBAAyC;AAAA,IAChE,gBAAgB,MAAM;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACF;","names":["path","relative","fs","path"]}