@dsh-enhanced/plugin-control-plane 0.1.32 → 0.1.34

package/lib/source-versioning.js

@@ -0,0 +1,213 @@
+import { constants as fsConstants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { ControlPlaneCliError } from './errors.js';
+import { assertPluginModificationAllowed, runLocalBuffer, runLocalCommand, validateScopedPluginFiles } from './source-workspace.js';
+const NAME = /^(?=.{1,64}$)[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const STABLE_VERSION = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/u;
+const MAX_FILE_BYTES = 65_536;
+function inputName(name) {
+    const normalized = name.normalize('NFC').trim();
+    if (normalized !== name || !NAME.test(name))
+        throw new ControlPlaneCliError('INVALID_ARGUMENT', 'managed version plugin name is invalid');
+    assertPluginModificationAllowed(name);
+    return name;
+}
+function nextStablePatch(version) {
+    const match = STABLE_VERSION.exec(version);
+    if (match === null)
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base must be a stable x.y.z version');
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    const patch = Number(match[3]);
+    if (![major, minor, patch].every(Number.isSafeInteger) || patch >= Number.MAX_SAFE_INTEGER) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base patch is outside the safe increment range');
+    }
+    return `${major}.${minor}.${patch + 1}`;
+}
+function parseManifest(bytes, label) {
+    if (bytes.length === 0 || bytes.length > MAX_FILE_BYTES || bytes.includes(0))
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', `${label} exceeds the managed version read bound`);
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', `${label} is not strict UTF-8`);
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', `${label} is not valid JSON`);
+    }
+    if (value === null || typeof value !== 'object' || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', `${label} must be a JSON object`);
+    }
+    return value;
+}
+function assertBaseManifest(manifest, name) {
+    if (manifest.name !== `@dsh-enhanced/${name}` || manifest.version === undefined || typeof manifest.version !== 'string'
+        || !('dsh' in manifest) || (manifest.dsh === null || typeof manifest.dsh !== 'object' || Array.isArray(manifest.dsh))
+        || manifest.dsh.bundle === null || typeof manifest.dsh.bundle !== 'object'
+        || Array.isArray(manifest.dsh.bundle)
+        || (manifest.dsh.bundle.patch !== './cordis.patch.yml')) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base manifest identity or bundle patch is invalid');
+    }
+    nextStablePatch(manifest.version);
+    return manifest.version;
+}
+function manifestWithVersion(manifest, version) {
+    return `${JSON.stringify({ ...manifest, version }, null, 2)}\n`;
+}
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map(key => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(',')}}`;
+}
+function equalExceptVersion(base, current, version) {
+    if (current.version !== version)
+        return false;
+    const { version: _baseVersion, ...baseRest } = base;
+    const { version: _currentVersion, ...currentRest } = current;
+    return canonicalJson(baseRest) === canonicalJson(currentRest);
+}
+async function readCurrentRegularFile(worktree, path) {
+    const expected = resolve(worktree, path);
+    const root = resolve(worktree);
+    if (relative(root, expected).startsWith('..') || !isAbsolute(expected))
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version path escapes its worktree');
+    const canonical = await realpath(expected);
+    if (canonical !== expected)
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version current file must be canonical');
+    const parent = await lstat(dirname(canonical));
+    const before = await lstat(canonical);
+    const uid = process.getuid?.();
+    if (!parent.isDirectory() || parent.isSymbolicLink() || (parent.mode & 0o022) !== 0
+        || !before.isFile() || before.isSymbolicLink() || before.nlink !== 1 || before.size > MAX_FILE_BYTES || (before.mode & 0o022) !== 0
+        || (uid !== undefined && before.uid !== 0 && before.uid !== uid)) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version current file is not an owner-safe bounded regular file');
+    }
+    const handle = await open(canonical, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+    try {
+        const descriptor = await handle.stat();
+        const bytes = await handle.readFile();
+        const after = await lstat(canonical);
+        if (!descriptor.isFile() || descriptor.nlink !== 1 || descriptor.dev !== before.dev || descriptor.ino !== before.ino
+            || after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || bytes.length !== before.size) {
+            throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version current file changed while being read');
+        }
+        return bytes;
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readBaseFiles(input) {
+    const name = inputName(input.name);
+    if (!COMMIT.test(input.baseCommit))
+        throw new ControlPlaneCliError('INVALID_ARGUMENT', 'managed version base commit is invalid');
+    const signal = input.signal ?? new AbortController().signal;
+    const check = async () => { signal.throwIfAborted(); await input.assertCurrent?.(); signal.throwIfAborted(); };
+    await check();
+    const worktree = await realpath(input.worktree);
+    if (worktree !== resolve(input.worktree))
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version worktree must be canonical');
+    await check();
+    const root = (await runLocalCommand('git', ['rev-parse', '--show-toplevel'], worktree, input.environment, { capture: true, maximumOutput: 4_096, timeoutMs: 15_000, signal })).trim();
+    if (root !== worktree)
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version worktree must be the Git top-level');
+    const verified = (await runLocalCommand('git', ['rev-parse', '--verify', `${input.baseCommit}^{commit}`], worktree, input.environment, { capture: true, maximumOutput: 4_096, timeoutMs: 15_000, signal })).trim();
+    if (verified !== input.baseCommit)
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base commit did not resolve exactly');
+    const paths = [`plugins/${name}/package.json`, `plugins/${name}/src/version.ts`];
+    await check();
+    const listed = await runLocalCommand('git', ['--literal-pathspecs', 'ls-tree', '-l', '-z', input.baseCommit, '--', ...paths], worktree, input.environment, { capture: true, maximumOutput: 8_192, timeoutMs: 15_000, signal });
+    const entries = new Map();
+    for (const record of listed.split('\0').filter(Boolean)) {
+        const match = /^(100644|100755) blob ([a-f0-9]{40}) +(\d+)\t(.+)$/u.exec(record);
+        if (match === null || !paths.includes(match[4]) || Number(match[3]) > MAX_FILE_BYTES || entries.has(match[4])) {
+            throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base file is unavailable, unsafe, or too large');
+        }
+        entries.set(match[4], { hash: match[2], bytes: Number(match[3]) });
+    }
+    if (entries.size !== paths.length)
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base files must be tracked regular blobs');
+    const read = async (path) => {
+        const entry = entries.get(path);
+        await check();
+        const bytes = await runLocalBuffer('git', ['cat-file', 'blob', entry.hash], worktree, input.environment, { maximumOutput: MAX_FILE_BYTES, timeoutMs: 15_000, signal });
+        if (bytes.length !== entry.bytes)
+            throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base blob changed while being read');
+        return bytes;
+    };
+    const manifest = parseManifest(await read(paths[0]), 'managed version base manifest');
+    const baseVersion = assertBaseManifest(manifest, name);
+    const source = await read(paths[1]);
+    let versionSource;
+    try {
+        versionSource = new TextDecoder('utf-8', { fatal: true }).decode(source);
+    }
+    catch {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base runtime version is not strict UTF-8');
+    }
+    if (versionSource !== `export const version = '${baseVersion}'\n`) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version base runtime version must be the canonical constant');
+    }
+    await check();
+    return { baseManifest: manifest, baseVersion, versionSource };
+}
+/** Derive, but never write, the Host-reserved patch-version file contents. */
+export async function managedPatchVersionFiles(input) {
+    const { baseManifest, baseVersion } = await readBaseFiles(input);
+    const version = nextStablePatch(baseVersion);
+    return Object.freeze({ baseVersion, version, files: Object.freeze([
+            Object.freeze({ path: 'package.json', content: manifestWithVersion(baseManifest, version) }),
+            Object.freeze({ path: 'src/version.ts', content: `export const version = '${version}'\n` }),
+        ]) });
+}
+/** Re-read current files and prove that only the Host-reserved version fields changed. */
+export async function verifyManagedPatchVersion(input) {
+    const { baseManifest, baseVersion } = await readBaseFiles(input);
+    const version = nextStablePatch(baseVersion);
+    const signal = input.signal ?? new AbortController().signal;
+    const check = async () => { signal.throwIfAborted(); await input.assertCurrent?.(); signal.throwIfAborted(); };
+    await check();
+    const worktree = await realpath(input.worktree);
+    await check();
+    const manifest = parseManifest(await readCurrentRegularFile(worktree, `plugins/${input.name}/package.json`), 'managed version current manifest');
+    await check();
+    const source = await readCurrentRegularFile(worktree, `plugins/${input.name}/src/version.ts`);
+    let versionSource;
+    try {
+        versionSource = new TextDecoder('utf-8', { fatal: true }).decode(source);
+    }
+    catch {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version current runtime version is not strict UTF-8');
+    }
+    if (!equalExceptVersion(baseManifest, manifest, version) || versionSource !== `export const version = '${version}'\n`) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version current files differ from the base except for the reserved patch version');
+    }
+    await check();
+    return Object.freeze({ baseVersion, version });
+}
+/** Candidate source files may never replace Host-reserved version fields. */
+export function assertManagedVersionPaths(files) {
+    if (!Array.isArray(files))
+        throw new ControlPlaneCliError('INVALID_ARGUMENT', 'managed version files must be an array');
+    for (const file of files) {
+        if (file === null || typeof file !== 'object' || typeof file.path !== 'string' || file.path !== file.path.normalize('NFC')) {
+            throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'managed version file path is not canonical');
+        }
+    }
+    validateScopedPluginFiles(files);
+    if (files.some(file => file.path === 'package.json' || file.path === 'src/version.ts')) {
+        throw new ControlPlaneCliError('SOURCE_BOUNDARY', 'candidate source files cannot replace Host-managed version fields');
+    }
+}
+//# sourceMappingURL=source-versioning.js.map

package/lib/source-versioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-versioning.js","sourceRoot":"","sources":["../src/source-versioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,+BAA+B,EAAE,cAAc,EAAE,eAAe,EAAE,yBAAyB,EAAyB,MAAM,uBAAuB,CAAA;AAE1J,MAAM,IAAI,GAAG,8CAA8C,CAAA;AAC3D,MAAM,MAAM,GAAG,iBAAiB,CAAA;AAChC,MAAM,cAAc,GAAG,sDAAsD,CAAA;AAC7E,MAAM,cAAc,GAAG,MAAM,CAAA;AAiB7B,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAA;IACzI,+BAA+B,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAA;IAC5H,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9F,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC3F,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,gEAAgE,CAAC,CAAA;IACrH,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,KAAK,yCAAyC,CAAC,CAAA;IAClL,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,KAAK,sBAAsB,CAAC,CAAA;IAAC,CAAC;IAClK,IAAI,KAAc,CAAA;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAA;IAAC,CAAC;IAC1H,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7H,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiC,EAAE,IAAY;IACzE,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,IAAI,EAAE,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;WAClH,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WACjH,QAAQ,CAAC,GAA4B,CAAC,MAAM,KAAK,IAAI,IAAI,OAAQ,QAAQ,CAAC,GAA4B,CAAC,MAAM,KAAK,QAAQ;WAC3H,KAAK,CAAC,OAAO,CAAE,QAAQ,CAAC,GAA4B,CAAC,MAAM,CAAC;WAC5D,CAAE,QAAQ,CAAC,GAAuC,CAAC,MAAM,CAAC,KAAK,KAAK,oBAAoB,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAA;IACxH,CAAC;IACD,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,QAAQ,CAAC,OAAO,CAAA;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAiC,EAAE,OAAe;IAC7E,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC1E,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;AACvH,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA6B,EAAE,OAAgC,EAAE,OAAe;IAC1G,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAA;IACnD,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAA;IAC5D,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,aAAa,CAAC,WAAW,CAAC,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,IAAY;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9B,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAA;IACtK,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAA;IAC/H,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAA;IACrH,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WAC9E,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,cAAc,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;WAChI,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,wEAAwE,CAAC,CAAA;IAC7H,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,CAAA;IACnF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;QACnH,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,KAAK,KAAK,CAAC,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;eAC/G,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACxH,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,uDAAuD,CAAC,CAAA;QAC5G,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAA+B;IAC1D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAA;IAChI,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAA;IAC3D,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA,CAAC,CAAC,CAAA;IAC5H,MAAM,KAAK,EAAE,CAAA;IACb,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/C,IAAI,QAAQ,KAAK,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAA;IACzI,MAAM,KAAK,EAAE,CAAA;IACb,MAAM,IAAI,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EACtG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7E,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAA;IAC9H,MAAM,QAAQ,GAAG,CAAC,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,UAAU,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EACnI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC7E,IAAI,QAAQ,KAAK,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,qDAAqD,CAAC,CAAA;IAC3I,MAAM,KAAK,GAAG,CAAC,WAAW,IAAI,eAAe,EAAE,WAAW,IAAI,iBAAiB,CAAC,CAAA;IAChF,MAAM,KAAK,EAAE,CAAA;IACb,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,CAAC,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE,QAAQ,EACpI,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAA;IAClE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,qDAAqD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAChF,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAChH,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,gEAAgE,CAAC,CAAA;QACrH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,0DAA0D,CAAC,CAAA;IAChJ,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAChC,MAAM,KAAK,EAAE,CAAA;QACb,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EACrG,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;QAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAA;QACzI,OAAO,KAAK,CAAA;IACd,CAAC,CAAA;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,+BAA+B,CAAC,CAAA;IACtF,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAA;IACpC,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QAAC,aAAa,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,0DAA0D,CAAC,CAAA;IAAC,CAAC;IACxM,IAAI,aAAa,KAAK,2BAA2B,WAAW,KAAK,EAAE,CAAC;QAClE,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,qEAAqE,CAAC,CAAA;IAC1H,CAAC;IACD,MAAM,KAAK,EAAE,CAAA;IACb,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,CAAA;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAA+B;IAC5E,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAA;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YAChE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5F,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,2BAA2B,OAAO,KAAK,EAAE,CAAC;SAC5F,CAAC,EAAE,CAAC,CAAA;AACP,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAA+B;IAC7E,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAA;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC,MAAM,CAAA;IAC3D,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,CAAA,CAAC,CAAC,CAAA;IAC5H,MAAM,KAAK,EAAE,CAAA;IACb,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/C,MAAM,KAAK,EAAE,CAAA;IACb,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,KAAK,CAAC,IAAI,eAAe,CAAC,EAAE,kCAAkC,CAAC,CAAA;IAChJ,MAAM,KAAK,EAAE,CAAA;IACb,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,WAAW,KAAK,CAAC,IAAI,iBAAiB,CAAC,CAAA;IAC7F,IAAI,aAAqB,CAAA;IACzB,IAAI,CAAC;QAAC,aAAa,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,6DAA6D,CAAC,CAAA;IAAC,CAAC;IAC3M,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,aAAa,KAAK,2BAA2B,OAAO,KAAK,EAAE,CAAC;QACtH,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,0FAA0F,CAAC,CAAA;IAC/I,CAAC;IACD,MAAM,KAAK,EAAE,CAAA;IACb,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,yBAAyB,CAAC,KAAkC;IAC1E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAA;IACvH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3H,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAA;QACjG,CAAC;IACH,CAAC;IACD,yBAAyB,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,oBAAoB,CAAC,iBAAiB,EAAE,mEAAmE,CAAC,CAAA;IACxH,CAAC;AACH,CAAC"}

package/lib/source-workspace.d.ts

@@ -0,0 +1,117 @@
+import type { ControlPlaneStore } from './store.js';
+import type { PluginSourcePlan } from './types.js';
+/**
+ * T3 安全根插件绝不允许经成长执行体的隔离区窄口改写——即使产物只是待批
+ * pending plan。命中即拒绝，不进入 worktree 流程。
+ */
+export declare const PROTECTED_PLUGIN_DENYLIST: ReadonlySet<string>;
+export interface ScopedPluginFile {
+    /** 相对于 plugins/<name>/ 的 POSIX 相对路径，不允许 .. 或绝对路径。 */
+    path: string;
+    content: string;
+}
+export interface IsolatedWorktree {
+    worktree: string;
+    remove: () => Promise<void>;
+}
+export declare function assertPluginModificationAllowed(name: string): void;
+export declare function resolveLocalExecutable(command: 'git' | 'pnpm', environment: NodeJS.ProcessEnv): Promise<string>;
+export interface RunLocalOptions {
+    /** Capture stdout for the result (and bound it). When false, stdout is drained and discarded — exactly like the legacy localCommand, whose uncaptured output had no byte bound. */
+    capture?: boolean;
+    maximumOutput?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+export interface RunLocalResult {
+    stdout: string;
+    stdoutBuffer: Buffer;
+    stderrTail: string;
+    durationMs: number;
+    logDigest: string;
+}
+export declare function runLocalBuffer(command: 'git' | 'pnpm', args: readonly string[], cwd: string, environment: NodeJS.ProcessEnv, options?: RunLocalOptions): Promise<Buffer>;
+export declare function runLocalCommand(command: 'git' | 'pnpm', args: readonly string[], cwd: string, environment: NodeJS.ProcessEnv, options?: RunLocalOptions): Promise<string>;
+export declare function changedSourcePaths(worktree: string, baseCommit: string, environment: NodeJS.ProcessEnv, signal?: AbortSignal): Promise<readonly string[]>;
+export declare function sourcePathAllowed(path: string, name: string, mode?: 'create' | 'modify'): boolean;
+export declare function checkedSourceSnapshot(worktree: string, baseCommit: string, scopeInput: readonly string[], environment: NodeJS.ProcessEnv, preparedTree?: string, signal?: AbortSignal): Promise<{
+    checkedTreeDigest: string;
+    checkedPatchDigest: string;
+}>;
+/** Recheck the immutable prepared tree without rebuilding or executing candidate code. */
+export declare function verifyPreparedSourceWorktree(plan: PluginSourcePlan, environment: NodeJS.ProcessEnv, signal?: AbortSignal): Promise<{
+    checkedTreeDigest: string;
+    checkedPatchDigest: string;
+}>;
+/**
+ * Create a throwaway linked git worktree under the control-plane state root,
+ * detached at exactly baseCommit. Removal prunes the worktree registration and
+ * falls back to deleting the directory.
+ */
+export declare function createIsolatedWorktree(input: {
+    stateRoot: string;
+    repository: string;
+    baseCommit: string;
+    environment: NodeJS.ProcessEnv;
+    worktreeName?: string;
+}): Promise<IsolatedWorktree>;
+/** Host-only reconciliation of the exact durable resource; never rebuilds it. */
+export declare function removeSourceJobWorktree(input: {
+    stateRoot: string;
+    repository: string;
+    worktree: string;
+    baseCommit: string;
+    environment: NodeJS.ProcessEnv;
+}): Promise<void>;
+/**
+ * Write a bounded set of plugin files through O_NOFOLLOW handles. Every path is
+ * constrained to plugins/<name>/; the plugin root must already exist at the
+ * base commit (modify never creates a plugin root, and never touches
+ * plugins/README.md).
+ */
+export declare function writeScopedPluginFiles(input: {
+    worktree: string;
+    name: string;
+    files: readonly ScopedPluginFile[];
+}): Promise<void>;
+/** Validate bytes and paths before persisting a durable source job. */
+export declare function validateScopedPluginFiles(files: readonly ScopedPluginFile[]): void;
+/**
+ * A prepared modify worktree is garbage only while its plan is still waiting on
+ * the owner (pending/approved) and the plan's TTL has elapsed. Plans that
+ * reached ready-for-human-review or a release phase are retained for the
+ * owner's release workflow.
+ */
+export declare function preparedWorktreeIsGarbage(plan: {
+    status: string;
+    expiresAt: number;
+}, now: number): boolean;
+/** Parse `git worktree list --porcelain` into canonical linked-worktree paths. */
+export declare function linkedWorktrees(repository: string, environment: NodeJS.ProcessEnv): Promise<readonly string[]>;
+/**
+ * Remove a prepared worktree registered against `repository`. Idempotent: an
+ * already-unregistered or missing directory resolves successfully after
+ * pruning. The caller is responsible for proving the path is still inside the
+ * control-plane state root.
+ */
+export declare function pruneRegisteredWorktree(input: {
+    repository: string;
+    worktree: string;
+    environment: NodeJS.ProcessEnv;
+}): Promise<void>;
+/**
+ * Remove prepared modify worktrees whose plans expired while still waiting on
+ * the owner. Every removed path must (1) belong to a modify plan, (2) be a
+ * descendant of the control-plane state root and (3) still be a linked
+ * worktree of the plan's repository; anything outside those proofs is left
+ * untouched. Idempotent. Shared by the service and the owner CLI.
+ */
+export declare function gcPreparedModifyWorktrees(input: {
+    store: ControlPlaneStore;
+    statePath: string;
+    environment: NodeJS.ProcessEnv;
+    now: number;
+}): Promise<{
+    removed: readonly string[];
+}>;
+//# sourceMappingURL=source-workspace.d.ts.map

package/lib/source-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-workspace.d.ts","sourceRoot":"","sources":["../src/source-workspace.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAqBlD;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAWxD,CAAA;AAEF,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIlE;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAYrH;AAKD,MAAM,WAAW,eAAe;IAC9B,mLAAmL;IACnL,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AA0DD,wBAAsB,cAAc,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAChG,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhF;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EACjG,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGhF;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM/J;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,QAAQ,GAAG,QAAmB,GAAG,OAAO,CAI3G;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7G,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBjJ;AAED,0FAA0F;AAC1F,wBAAsB,4BAA4B,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EACvG,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB1F;AAYD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CACjH,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAwC5B;AAED,iFAAiF;AACjF,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;CAC5G,GAAG,OAAO,CAAC,IAAI,CAAC,CAgChB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACnE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAED,uEAAuE;AACvE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,GAAG,IAAI,CAwBlF;AAsDD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE3G;AAED,kFAAkF;AAClF,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAIpH;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;CACrE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,iBAAiB,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAe1C"}