@knowzai/cli 0.1.0 → 0.2.0

package/dist/lib/release-package-graph.js

@@ -0,0 +1,249 @@
+/**
+ * Release package-graph contract (CLI_SecurityReleaseReadiness H1 + H2).
+ *
+ * H1 — the release/CI workflows must address the CLI package by its CANONICAL
+ * published name, read from `packages/cli/package.json`. A stale `--filter`
+ * (e.g. the pre-rename `@knowz/cli`) makes every build/publish step a silent
+ * no-op: pnpm exits 0 having matched zero projects, so a release can "succeed"
+ * without ever building, packing, or publishing the CLI.
+ *
+ * H2 — `@knowzai/cli` depends on seven sibling workspace packages via
+ * `workspace:*`. Publishing only the CLI produces an UNINSTALLABLE package: the
+ * `workspace:*` specifiers are rewritten to the siblings' own (unstamped)
+ * versions, which were never published. The whole runtime graph must therefore
+ * be stamped to one version and published in dependency order, and a
+ * pack/install smoke must prove resolution with no `workspace:` leakage.
+ *
+ * This module is pure (filesystem reads only) so both the CI scripts and the
+ * unit tests drive exactly the same logic.
+ */
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+/** Directory name, under `packages/`, of the package that ships the `knowz` bin. */
+export const CLI_PACKAGE_DIR = 'cli';
+/** Dependency fields that describe what an installed consumer must be able to resolve. */
+const RUNTIME_DEPENDENCY_FIELDS = ['dependencies', 'optionalDependencies'];
+function readManifest(path) {
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+/** Read every `packages/*` manifest that declares a name. */
+export function readWorkspacePackages(packagesDir) {
+    const packages = [];
+    for (const dir of readdirSync(packagesDir).sort()) {
+        const path = join(packagesDir, dir);
+        const manifestPath = join(path, 'package.json');
+        if (!existsSync(manifestPath))
+            continue;
+        const manifest = readManifest(manifestPath);
+        if (typeof manifest.name !== 'string' || !manifest.name)
+            continue;
+        packages.push({ name: manifest.name, dir, path, manifest });
+    }
+    return packages;
+}
+/**
+ * The one true CLI package name. Everything else (workflow filters, publish
+ * order, install smoke) is derived from this rather than hardcoded, so a future
+ * rename cannot leave a workflow silently addressing a package that no longer
+ * exists.
+ */
+export function canonicalCliPackageName(packagesDir) {
+    const manifest = readManifest(join(packagesDir, CLI_PACKAGE_DIR, 'package.json'));
+    if (typeof manifest.name !== 'string' || !manifest.name) {
+        throw new Error(`packages/${CLI_PACKAGE_DIR}/package.json does not declare a name`);
+    }
+    return manifest.name;
+}
+/** The npm scope shared by every internal package, derived from the CLI name. */
+export function canonicalScope(cliPackageName) {
+    const scope = cliPackageName.startsWith('@') ? cliPackageName.split('/')[0] : undefined;
+    if (!scope)
+        throw new Error(`CLI package name is not scoped: ${cliPackageName}`);
+    return scope;
+}
+/** Internal (workspace-resident) runtime dependencies declared by one manifest. */
+export function internalRuntimeDependencies(manifest, internalNames) {
+    const found = new Set();
+    for (const field of RUNTIME_DEPENDENCY_FIELDS) {
+        for (const name of Object.keys(manifest[field] ?? {})) {
+            if (internalNames.has(name))
+                found.add(name);
+        }
+    }
+    return [...found].sort();
+}
+/**
+ * Dependency-ordered publish plan for the runtime graph reachable from `rootName`.
+ * Dependencies always precede their dependents, so each `npm publish` lands only
+ * after everything it declares is already resolvable on the registry.
+ */
+export function resolvePublishOrder(packages, rootName) {
+    const byName = new Map(packages.map((p) => [p.name, p]));
+    const internalNames = new Set(byName.keys());
+    if (!byName.has(rootName)) {
+        throw new Error(`Root package ${rootName} is not a workspace package`);
+    }
+    const order = [];
+    const done = new Set();
+    const onStack = new Set();
+    const visit = (name, trail) => {
+        if (done.has(name))
+            return;
+        if (onStack.has(name)) {
+            throw new Error(`Cyclic internal dependency: ${[...trail, name].join(' -> ')}`);
+        }
+        const pkg = byName.get(name);
+        if (!pkg)
+            throw new Error(`Internal dependency ${name} has no workspace package`);
+        onStack.add(name);
+        for (const dep of internalRuntimeDependencies(pkg.manifest, internalNames)) {
+            visit(dep, [...trail, name]);
+        }
+        onStack.delete(name);
+        done.add(name);
+        order.push(pkg);
+    };
+    visit(rootName, []);
+    return order;
+}
+/**
+ * Every `pnpm --filter <@scope/name>` use in a workflow. Both `--filter x` and
+ * `--filter=x` spellings are recognised; unscoped filters (paths, globs) are
+ * ignored because only the scoped package identity is under contract here.
+ */
+export function findWorkflowPackageFilters(source) {
+    const uses = [];
+    const lines = source.split(/\r?\n/);
+    const pattern = /--filter[= ]+(@[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*)/g;
+    lines.forEach((line, index) => {
+        for (const match of line.matchAll(pattern)) {
+            uses.push({ line: index + 1, filter: match[1] });
+        }
+    });
+    return uses;
+}
+/**
+ * VERIFY H1 — fail when any workflow filter diverges from the canonical package
+ * identity. Returns human-readable failures (empty ⇒ pass) so both the CI script
+ * and the unit test can assert on the same values.
+ */
+export function assertCanonicalWorkflowFilters(workflows, knownPackageNames) {
+    const failures = [];
+    const canonicalCli = [...knownPackageNames].find((name) => name.endsWith('/cli'));
+    for (const workflow of workflows) {
+        for (const use of findWorkflowPackageFilters(workflow.source)) {
+            if (knownPackageNames.has(use.filter) && (!canonicalCli || use.filter === canonicalCli))
+                continue;
+            failures.push(`${workflow.path}:${use.line}: --filter ${use.filter} diverges from the canonical CLI package ` +
+                `${canonicalCli ?? '(unknown)'}.`);
+        }
+    }
+    return failures;
+}
+/**
+ * VERIFY H1 (stronger half) — the workflows must actually address the canonical
+ * CLI package somewhere, so a filter that is simply deleted is caught too.
+ */
+export function assertCliPackageIsAddressed(workflows, cliPackageName) {
+    const addressed = workflows.some((workflow) => findWorkflowPackageFilters(workflow.source).some((use) => use.filter === cliPackageName));
+    return addressed
+        ? []
+        : [`${workflows.map((workflow) => workflow.path).join(', ')}: never addresses the canonical CLI package ${cliPackageName}`];
+}
+/**
+ * VERIFY H2 — a manifest that is about to be packed/published must not leak a
+ * `workspace:` specifier, and every internal dependency must be pinned to the
+ * exact release version (they are published together, so a range would let a
+ * consumer resolve a sibling from a different release).
+ */
+export function assertPublishableManifest(manifest, opts) {
+    const failures = [];
+    if (manifest.version !== opts.version) {
+        failures.push(`${opts.label}: version is ${manifest.version ?? '(none)'}, expected ${opts.version}`);
+    }
+    for (const field of RUNTIME_DEPENDENCY_FIELDS) {
+        for (const [name, range] of Object.entries(manifest[field] ?? {})) {
+            if (range.startsWith('workspace:')) {
+                failures.push(`${opts.label}: ${field}.${name} still uses the unpublishable specifier "${range}"`);
+                continue;
+            }
+            if (opts.internalNames.has(name) && range !== opts.version) {
+                failures.push(`${opts.label}: ${field}.${name} is "${range}", expected the co-released version ${opts.version}`);
+            }
+        }
+    }
+    return failures;
+}
+/** A semver prerelease is anything with a `-` pre-release segment (`1.2.3-rc.1`). */
+export function isPrereleaseVersion(version) {
+    // Strip build metadata first — `1.2.3+build-1` has a hyphen but is a release.
+    const core = version.split('+')[0] ?? version;
+    return core.includes('-');
+}
+/**
+ * Decide the npm dist-tag for a publish run, and REFUSE rather than guess.
+ *
+ * npm's default when no `--tag` is given is `latest`, which is the tag `npm
+ * install @knowzai/cli` resolves. Publishing `1.2.3-rc.1` with that default
+ * hands every user of the plain install command an unreleased build — and the
+ * only way back is to re-point `latest` at the previous version by hand.
+ *
+ * A release version keeps `latest`. A prerelease MUST name its own tag: the
+ * caller is the one that knows whether this is an `rc`, a `next`, or a `canary`,
+ * and a default here would just reintroduce the same silent choice one layer
+ * down. So a prerelease with no tag is an error, not a fallback.
+ */
+export function resolveDistTag(opts) {
+    if (opts.tag)
+        return opts.tag;
+    if (isPrereleaseVersion(opts.version)) {
+        throw new Error(`${opts.version} is a prerelease: pass an explicit --tag (e.g. --tag next). ` +
+            'Publishing it without one would move the "latest" dist-tag and ship a prerelease ' +
+            'to everyone running `npm install @knowzai/cli`.');
+    }
+    return 'latest';
+}
+/**
+ * H2 (resumability) — decide whether one package still needs publishing.
+ *
+ * A publish run is not atomic: eight packages go out one at a time, and a
+ * network blip, an OTP timeout, or a rate limit can strand the run halfway.
+ * Re-running used to be impossible — npm rejects a republish of an existing
+ * `name@version` with E403, so the retry died on the first already-published
+ * package and the remaining ones stayed unpublished. Recovering meant bumping
+ * every version for no reason.
+ *
+ * So an exact `name@version` that is ALREADY on the registry is not an error:
+ * it is work that is already done. It is verified against the same contract a
+ * fresh publish must satisfy (no `workspace:` leakage, internal deps pinned to
+ * the release version) and then skipped. A published copy that does NOT satisfy
+ * that contract is the one case that must stop the run — silently accepting it
+ * would ship a graph whose consumers cannot resolve.
+ *
+ * Pure so the script and the tests exercise identical logic; the caller owns the
+ * registry lookup and passes `null` for "not published".
+ */
+export function decidePublishStep(opts) {
+    const target = `${opts.name}@${opts.version}`;
+    if (!opts.registryManifest) {
+        return { action: 'publish', reason: `${target} is not on the registry`, failures: [] };
+    }
+    const failures = [];
+    if (opts.registryManifest.name !== opts.name) {
+        failures.push(`${target}: registry returned a manifest for ${opts.registryManifest.name ?? '(unnamed)'}`);
+    }
+    failures.push(...assertPublishableManifest(opts.registryManifest, {
+        version: opts.version,
+        internalNames: opts.internalNames,
+        label: target,
+    }));
+    if (failures.length > 0) {
+        return {
+            action: 'fail',
+            reason: `${target} is already published but does not match this release`,
+            failures,
+        };
+    }
+    return { action: 'skip', reason: `${target} is already published and verified`, failures: [] };
+}
+//# sourceMappingURL=release-package-graph.js.map

package/dist/lib/release-package-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-package-graph.js","sourceRoot":"","sources":["../../src/lib/release-package-graph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AAErC,0FAA0F;AAC1F,MAAM,yBAAyB,GAAG,CAAC,cAAc,EAAE,sBAAsB,CAAU,CAAC;AAoCpF,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;AACnE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC5C,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI;YAAE,SAAS;QAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAmB;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IAClF,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,YAAY,eAAe,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,cAAsB;IACnD,MAAM,KAAK,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,EAAE,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CACzC,QAAyB,EACzB,aAAkC;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACtD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAqC,EACrC,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,6BAA6B,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,KAAe,EAAQ,EAAE;QACpD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,2BAA2B,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,GAAG,IAAI,2BAA2B,CAAC,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YAC3E,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAc;IACvD,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,yEAAyE,CAAC;IAC1F,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAoC,EACpC,iBAAsC;IAEtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC;gBAAE,SAAS;YAClG,QAAQ,CAAC,IAAI,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,cAAc,GAAG,CAAC,MAAM,2CAA2C;gBAC7F,GAAG,YAAY,IAAI,WAAW,GAAG,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAoC,EACpC,cAAsB;IAEtB,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC5C,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,cAAc,CAAC,CACzF,CAAC;IACF,OAAO,SAAS;QACd,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+CAA+C,cAAc,EAAE,CAAC,CAAC;AAChI,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAyB,EACzB,IAA4E;IAE5E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,gBAAgB,QAAQ,CAAC,OAAO,IAAI,QAAQ,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,4CAA4C,KAAK,GAAG,CAAC,CAAC;gBACnG,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,uCAAuC,IAAI,CAAC,OAAO,EAAE,CAClG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,8EAA8E;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;IAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuC;IACpE,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IAC9B,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,OAAO,8DAA8D;YAC3E,mFAAmF;YACnF,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAaD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAMjC;IACC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,yBAAyB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,sCAAsC,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,WAAW,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CACX,GAAG,yBAAyB,CAAC,IAAI,CAAC,gBAAgB,EAAE;QAClD,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,MAAM;KACd,CAAC,CACH,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,MAAM,uDAAuD;YACxE,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,oCAAoC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACjG,CAAC"}

package/dist/lib/repo-binding.d.ts

@@ -13,8 +13,9 @@ export interface RepoBinding {
     version: 1;
     repoRoot: string;
     profile: string;
-    apiUrl: string;
+    apiUrl?: string;
     vaultId: string;
+    scopeKind: 'local' | 'hosted';
     vaultName?: string;
     dbPath: string;
     graphPath: string;
@@ -33,8 +34,9 @@ export interface FoundRepoBinding {
 export interface RepoBindingInput {
     repoRoot: string;
     profile: string;
-    apiUrl: string;
+    apiUrl?: string;
     vaultId: string;
+    scopeKind?: 'local' | 'hosted';
     vaultName?: string;
     dbPath?: string;
     graphPath?: string;
@@ -45,6 +47,9 @@ export declare function repoBindingPath(repoRoot: string): string;
 export declare function normalizeRepoRoot(path?: string): string;
 export declare function defaultRepoBinding(input: RepoBindingInput): RepoBinding;
 export declare function resolveRepoPath(binding: Pick<RepoBinding, 'repoRoot'>, path: string): string;
+export declare function resolveConfinedRepoPath(repoRoot: string, candidate: string, opts?: {
+    allowMissingLeaf?: boolean;
+}): string;
 export declare function saveRepoBinding(binding: RepoBinding): void;
 export declare function loadRepoBinding(path?: string): RepoBinding;
 export declare function findRepoBinding(path?: string): FoundRepoBinding | undefined;

package/dist/lib/repo-binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-binding.d.ts","sourceRoot":"","sources":["../../src/lib/repo-binding.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,SAAM,GAAG,MAAM,CAOpD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW,CAmBvE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAI1D;AAED,wBAAgB,eAAe,CAAC,IAAI,SAAM,GAAG,WAAW,CAMvD;AAED,wBAAgB,eAAe,CAAC,IAAI,SAAM,GAAG,gBAAgB,GAAG,SAAS,CAaxE;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,SAA2B,GAC7B,WAAW,CAMb;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAU7E"}
+{"version":3,"file":"repo-binding.d.ts","sourceRoot":"","sources":["../../src/lib/repo-binding.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAQ3D,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,KAAK,EAAE,qBAAqB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,SAAM,GAAG,MAAM,CAOpD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW,CAoBvE;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,MAAM,CA0BR;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAkB1D;AAED,wBAAgB,eAAe,CAAC,IAAI,SAAM,GAAG,WAAW,CAMvD;AAED,wBAAgB,eAAe,CAAC,IAAI,SAAM,GAAG,gBAAgB,GAAG,SAAS,CAqBxE;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,qBAAqB,EAC5B,GAAG,SAA2B,GAC7B,WAAW,CAMb;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAW7E"}

package/dist/lib/repo-binding.js

@@ -1,9 +1,16 @@
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, join, resolve } from 'node:path';
+import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { ExitCode, KnowzError } from '@knowzai/core';
 export const REPO_BINDING_VERSION = 1;
 export const DEFAULT_REPO_DB_PATH = '.knowz/knowz.sqlite';
 export const DEFAULT_REPO_GRAPH_PATH = '.knowz/graph.json';
+const MAX_BINDING_BYTES = 64 * 1024;
+const O_NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+const KNOWN_BINDING_KEYS = new Set([
+    'version', 'repoRoot', 'profile', 'apiUrl', 'vaultId', 'scopeKind', 'vaultName',
+    'dbPath', 'graphPath', 'sync', 'index', 'createdAt', 'updatedAt',
+]);
 export function repoBindingPath(repoRoot) {
     return join(repoRoot, '.knowz', 'repo.json');
 }
@@ -13,7 +20,7 @@ export function normalizeRepoRoot(path = '.') {
         throw new KnowzError(`Path not found: ${root}`, ExitCode.NotFound);
     }
     const st = statSync(root);
-    return st.isDirectory() ? root : dirname(root);
+    return realpathSync(st.isDirectory() ? root : dirname(root));
 }
 export function defaultRepoBinding(input) {
     const repoRoot = normalizeRepoRoot(input.repoRoot);
@@ -22,13 +29,14 @@ export function defaultRepoBinding(input) {
         version: REPO_BINDING_VERSION,
         repoRoot,
         profile: input.profile,
-        apiUrl: input.apiUrl,
+        ...(input.apiUrl ? { apiUrl: input.apiUrl } : {}),
         vaultId: input.vaultId,
+        scopeKind: input.scopeKind ?? 'hosted',
         ...(input.vaultName ? { vaultName: input.vaultName } : {}),
         dbPath: input.dbPath ?? DEFAULT_REPO_DB_PATH,
         graphPath: input.graphPath ?? DEFAULT_REPO_GRAPH_PATH,
         sync: {
-            enabled: input.syncEnabled ?? false,
+            enabled: input.scopeKind === 'local' ? false : (input.syncEnabled ?? false),
         },
         index: {},
         createdAt: now,
@@ -36,12 +44,56 @@ export function defaultRepoBinding(input) {
     };
 }
 export function resolveRepoPath(binding, path) {
-    return isAbsolute(path) ? path : join(binding.repoRoot, path);
+    return resolveConfinedRepoPath(binding.repoRoot, path, { allowMissingLeaf: true });
+}
+export function resolveConfinedRepoPath(repoRoot, candidate, opts = {}) {
+    if (isAbsolute(candidate)) {
+        throw new KnowzError(`Absolute path is not allowed in a repo binding: ${candidate}`, ExitCode.Usage);
+    }
+    const root = realpathSync(repoRoot);
+    const target = resolve(root, candidate);
+    assertInside(root, target);
+    const parts = relative(root, target).split(sep).filter(Boolean);
+    let current = root;
+    for (let index = 0; index < parts.length; index++) {
+        current = join(current, parts[index]);
+        if (!existsSync(current)) {
+            // The closest existing ancestor has already been canonicalized and
+            // confined. Callers that create a path must re-run this check at open.
+            if (opts.allowMissingLeaf)
+                return target;
+            throw new KnowzError(`Repo path does not exist: ${candidate}`, ExitCode.NotFound);
+        }
+        const stat = lstatSync(current);
+        if (stat.isSymbolicLink() && index === parts.length - 1) {
+            throw new KnowzError(`Unsafe symbolic link in repo path: ${candidate}`, ExitCode.Usage);
+        }
+        const canonical = realpathSync(current);
+        assertInside(root, canonical);
+    }
+    return target;
 }
 export function saveRepoBinding(binding) {
     const path = repoBindingPath(binding.repoRoot);
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, `${JSON.stringify(binding, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    if (existsSync(path) && lstatSync(path).isSymbolicLink()) {
+        throw new KnowzError(`Unsafe symbolic link at ${path}`, ExitCode.Usage);
+    }
+    const temp = join(dirname(path), `.repo.json.${randomUUID()}.tmp`);
+    try {
+        const fd = openSync(temp, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 0o600);
+        try {
+            writeFileSync(fd, `${JSON.stringify(binding, null, 2)}\n`, 'utf8');
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(temp, path);
+    }
+    finally {
+        if (existsSync(temp))
+            unlinkSync(temp);
+    }
 }
 export function loadRepoBinding(path = '.') {
     const found = findRepoBinding(path);
@@ -53,10 +105,18 @@ export function loadRepoBinding(path = '.') {
 export function findRepoBinding(path = '.') {
     let current = normalizeExistingStart(path);
     for (;;) {
+        if (existsSync(current) && lstatSync(current).isSymbolicLink()) {
+            throw new KnowzError(`Unsafe symbolic link in repository path: ${current}`, ExitCode.Usage);
+        }
         const bindingPath = repoBindingPath(current);
         if (existsSync(bindingPath)) {
-            const binding = parseBinding(bindingPath);
-            const repoRoot = current;
+            const knowzDirectory = dirname(bindingPath);
+            const knowzStat = lstatSync(knowzDirectory);
+            if (knowzStat.isSymbolicLink() || !knowzStat.isDirectory()) {
+                throw new KnowzError(`Unsafe symbolic link in repository binding path: ${knowzDirectory}`, ExitCode.Usage);
+            }
+            const repoRoot = realpathSync(current);
+            const binding = parseBinding(bindingPath, repoRoot);
             return { repoRoot, bindingPath, binding: { ...binding, repoRoot } };
         }
         const parent = dirname(current);
@@ -74,8 +134,9 @@ export function updateRepoBindingIndex(binding, index, now = new Date().toISOStr
 }
 export function equivalentRepoBinding(a, b) {
     return (a.profile === b.profile &&
-        a.apiUrl === b.apiUrl &&
+        (a.apiUrl ?? '') === (b.apiUrl ?? '') &&
         a.vaultId === b.vaultId &&
+        a.scopeKind === b.scopeKind &&
         (a.vaultName ?? '') === (b.vaultName ?? '') &&
         a.dbPath === b.dbPath &&
         a.graphPath === b.graphPath &&
@@ -85,43 +146,95 @@ function normalizeExistingStart(path) {
     const start = resolve(path);
     if (!existsSync(start))
         return start;
-    const st = statSync(start);
+    const st = lstatSync(start);
+    if (st.isSymbolicLink()) {
+        throw new KnowzError(`Unsafe symbolic link in repository path: ${start}`, ExitCode.Usage);
+    }
     return st.isDirectory() ? start : dirname(start);
 }
-function parseBinding(path) {
+function parseBinding(path, authoritativeRepoRoot) {
     let parsed;
+    let fd;
     try {
-        parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (lstatSync(path).isSymbolicLink()) {
+            throw new KnowzError(`Unsafe symbolic link at ${path}`, ExitCode.Usage);
+        }
+        fd = openSync(path, fsConstants.O_RDONLY | O_NOFOLLOW);
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new KnowzError(`Invalid Knowz repo binding at ${path}`, ExitCode.Usage);
+        if (stat.size > MAX_BINDING_BYTES) {
+            throw new KnowzError(`Knowz repo binding exceeds 64 KiB at ${path}`, ExitCode.Usage);
+        }
+        parsed = JSON.parse(readFileSync(fd, 'utf8'));
     }
     catch (err) {
+        if (err instanceof KnowzError)
+            throw err;
         throw new KnowzError(`Invalid Knowz repo binding at ${path}`, ExitCode.Usage, { cause: err });
     }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
     if (!parsed || typeof parsed !== 'object') {
         throw new KnowzError(`Invalid Knowz repo binding at ${path}`, ExitCode.Usage);
     }
     const b = parsed;
+    validateUnknownBindingExtensions(parsed, authoritativeRepoRoot);
+    const scopeKind = b.scopeKind === undefined ? 'hosted' : b.scopeKind;
     if (b.version !== REPO_BINDING_VERSION ||
-        typeof b.repoRoot !== 'string' ||
         typeof b.profile !== 'string' ||
-        typeof b.apiUrl !== 'string' ||
+        (scopeKind === 'hosted' && typeof b.apiUrl !== 'string') ||
+        (scopeKind !== 'hosted' && scopeKind !== 'local') ||
         typeof b.vaultId !== 'string' ||
         typeof b.dbPath !== 'string' ||
         typeof b.graphPath !== 'string') {
         throw new KnowzError(`Invalid Knowz repo binding at ${path}`, ExitCode.Usage);
     }
     return {
+        ...parsed,
         version: REPO_BINDING_VERSION,
-        repoRoot: b.repoRoot,
+        repoRoot: authoritativeRepoRoot,
         profile: b.profile,
-        apiUrl: b.apiUrl,
+        ...(typeof b.apiUrl === 'string' ? { apiUrl: b.apiUrl } : {}),
         vaultId: b.vaultId,
+        scopeKind,
         ...(typeof b.vaultName === 'string' ? { vaultName: b.vaultName } : {}),
         dbPath: b.dbPath,
         graphPath: b.graphPath,
-        sync: { enabled: Boolean(b.sync?.enabled) },
+        sync: { enabled: scopeKind === 'local' ? false : Boolean(b.sync?.enabled) },
         index: b.index ?? {},
         createdAt: b.createdAt ?? new Date(0).toISOString(),
         updatedAt: b.updatedAt ?? new Date(0).toISOString(),
     };
 }
+function validateUnknownBindingExtensions(value, repoRoot) {
+    const visit = (candidate, key) => {
+        if (typeof candidate === 'string' && /(?:path|file|dir|root)$/i.test(key)) {
+            resolveConfinedRepoPath(repoRoot, candidate, { allowMissingLeaf: true });
+            return;
+        }
+        if (!candidate || typeof candidate !== 'object')
+            return;
+        if (Array.isArray(candidate)) {
+            for (const entry of candidate)
+                visit(entry, key);
+            return;
+        }
+        for (const [nestedKey, nestedValue] of Object.entries(candidate)) {
+            visit(nestedValue, nestedKey);
+        }
+    };
+    for (const [key, candidate] of Object.entries(value)) {
+        if (!KNOWN_BINDING_KEYS.has(key))
+            visit(candidate, key);
+    }
+}
+function assertInside(root, target) {
+    const rel = relative(root, target);
+    if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+        throw new KnowzError(`Path resolves outside repository root: ${target}`, ExitCode.Usage);
+    }
+}
 //# sourceMappingURL=repo-binding.js.map

package/dist/lib/repo-binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-binding.js","sourceRoot":"","sources":["../../src/lib/repo-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AA8C3D,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,GAAG;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,oBAAoB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,uBAAuB;QACrD,IAAI,EAAE;YACJ,OAAO,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK;SACpC;QACD,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAsC,EAAE,IAAY;IAClF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,GAAG;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,4DAA4D,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,GAAG;IACxC,IAAI,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC;QACR,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC;YACzB,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,KAA4B,EAC5B,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAE9B,OAAO;QACL,GAAG,OAAO;QACV,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,GAAG,EAAE;QAChF,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAc,EAAE,CAAc;IAClE,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QAC3C,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,CAAC,GAAG,MAA8B,CAAC;IACzC,IACE,CAAC,CAAC,OAAO,KAAK,oBAAoB;QAClC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAC/B,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QAC3C,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACnD,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACpD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"repo-binding.js","sourceRoot":"","sources":["../../src/lib/repo-binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAC3D,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,CAAC;AACpC,MAAM,UAAU,GAAI,WAAuC,CAAC,UAAU,IAAI,CAAC,CAAC;AAC5E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW;IAC/E,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW;CACjE,CAAC,CAAC;AAgDH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,GAAG;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,mBAAmB,IAAI,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO;QACL,OAAO,EAAE,oBAAoB;QAC7B,QAAQ;QACR,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,QAAQ;QACtC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,oBAAoB;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,uBAAuB;QACrD,IAAI,EAAE;YACJ,OAAO,EAAE,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC;SAC5E;QACD,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAsC,EAAE,IAAY;IAClF,OAAO,uBAAuB,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,SAAiB,EACjB,OAAuC,EAAE;IAEzC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,mDAAmD,SAAS,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,IAAI,CAAC,gBAAgB;gBAAE,OAAO,MAAM,CAAC;YACzC,MAAM,IAAI,UAAU,CAAC,6BAA6B,SAAS,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,UAAU,CAAC,sCAAsC,SAAS,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,UAAU,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClG,IAAI,CAAC;YACH,aAAa,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,GAAG;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,4DAA4D,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAI,GAAG,GAAG;IACxC,IAAI,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,UAAU,CAAC,4CAA4C,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5B,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;YAC5C,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC3D,MAAM,IAAI,UAAU,CAAC,oDAAoD,cAAc,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,KAA4B,EAC5B,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAE9B,OAAO;QACL,GAAG,OAAO;QACV,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,GAAG,EAAE;QAChF,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,CAAc,EAAE,CAAc;IAClE,OAAO,CACL,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QACvB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QAC3C,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QACrB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAClC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,UAAU,CAAC,4CAA4C,KAAK,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,qBAA6B;IAC/D,IAAI,MAAe,CAAC;IACpB,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,UAAU,CAAC,2BAA2B,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1E,CAAC;QACD,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClG,IAAI,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,wCAAwC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,UAAU;YAAE,MAAM,GAAG,CAAC;QACzC,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChG,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,CAAC,GAAG,MAA8B,CAAC;IACzC,gCAAgC,CAAC,MAAiC,EAAE,qBAAqB,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IACE,CAAC,CAAC,OAAO,KAAK,oBAAoB;QAClC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;QACxD,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,CAAC;QACjD,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,EAC/B,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,iCAAiC,IAAI,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC;IACD,OAAO;QACL,GAAI,MAAkC;QACtC,OAAO,EAAE,oBAAoB;QAC7B,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,SAAS;QACT,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE;QAC3E,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACnD,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CAAC,KAA8B,EAAE,QAAgB;IACxF,MAAM,KAAK,GAAG,CAAC,SAAkB,EAAE,GAAW,EAAQ,EAAE;QACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1E,uBAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,KAAK,MAAM,KAAK,IAAI,SAAS;gBAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;YAC5F,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,UAAU,CAAC,0CAA0C,MAAM,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC"}

package/dist/lib/repo-command-support.d.ts

@@ -1,6 +1,8 @@
 import type { RepoBinding, FoundRepoBinding } from './repo-binding.js';
 export declare function requireRepoBinding(found: FoundRepoBinding | undefined): RepoBinding;
-export declare function buildHostedMcpCommand(binding: Pick<RepoBinding, 'apiUrl' | 'vaultId'>): string;
+export declare function buildHostedMcpCommand(binding: Pick<RepoBinding, 'vaultId'> & {
+    apiUrl: string;
+}): string;
 export declare function installRepoHooks(settingsPath: string, opts: {
     binding: RepoBinding;
     dbPath: string;

package/dist/lib/repo-command-support.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-command-support.d.ts","sourceRoot":"","sources":["../../src/lib/repo-command-support.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGvE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAAG,WAAW,CAKnF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,SAAS,CAAC,GAAG,MAAM,CAc9F;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChF,MAAM,CAoBR"}
+{"version":3,"file":"repo-command-support.d.ts","sourceRoot":"","sources":["../../src/lib/repo-command-support.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGvE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,SAAS,GAAG,WAAW,CAKnF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAcxG;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAChF,MAAM,CAoBR"}

package/dist/lib/repo-command-support.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-command-support.js","sourceRoot":"","sources":["../../src/lib/repo-command-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,UAAU,kBAAkB,CAAC,KAAmC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,4DAA4D,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgD;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAClG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO;QACL,QAAQ;QACR,KAAK;QACL,KAAK;QACL,aAAa;QACb,MAAM;QACN,OAAO;QACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,UAAU;QACV,QAAQ,CAAC,sCAAsC,CAAC;KACjD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,IAAqE;IAErE,OAAO,kBAAkB,CACvB,YAAY,EACZ,cAAc,CAAC;QACb,MAAM,EAAE,IAAI,CAAC,aAAa;QAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;KAC9B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,IAAiF;IAEjF,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,sBAAsB;QACtB,SAAS,OAAO,CAAC,QAAQ,EAAE;QAC3B,UAAU,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QAC9E,aAAa,IAAI,CAAC,MAAM,EAAE;QAC1B,UAAU,IAAI,CAAC,SAAS,EAAE;QAC1B,eAAe,WAAW,EAAE;QAC5B,EAAE;QACF,wFAAwF;QACxF,4CAA4C,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACxE,sBAAsB,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB;QACxE,uBAAuB,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACnD,EAAE;QACF,+EAA+E;QAC/E,IAAI,CAAC,UAAU;QACf,uBAAuB;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC"}
+{"version":3,"file":"repo-command-support.js","sourceRoot":"","sources":["../../src/lib/repo-command-support.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,UAAU,kBAAkB,CAAC,KAAmC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,UAAU,CAAC,4DAA4D,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAA0D;IAC9F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAClG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO;QACL,QAAQ;QACR,KAAK;QACL,KAAK;QACL,aAAa;QACb,MAAM;QACN,OAAO;QACP,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,UAAU;QACV,QAAQ,CAAC,sCAAsC,CAAC;KACjD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,IAAqE;IAErE,OAAO,kBAAkB,CACvB,YAAY,EACZ,cAAc,CAAC;QACb,MAAM,EAAE,IAAI,CAAC,aAAa;QAC1B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;QAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;KAC9B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoB,EACpB,IAAiF;IAEjF,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG;QACX,sBAAsB;QACtB,SAAS,OAAO,CAAC,QAAQ,EAAE;QAC3B,UAAU,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;QAC9E,aAAa,IAAI,CAAC,MAAM,EAAE;QAC1B,UAAU,IAAI,CAAC,SAAS,EAAE;QAC1B,eAAe,WAAW,EAAE;QAC5B,EAAE;QACF,wFAAwF;QACxF,4CAA4C,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACxE,sBAAsB,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB;QACxE,uBAAuB,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACnD,EAAE;QACF,+EAA+E;QAC/E,IAAI,CAAC,UAAU;QACf,uBAAuB;KACxB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC"}