@lzehrung/codegraph 2.3.20 → 2.3.22

package/dist/util/bloom-filter.js

@@ -0,0 +1,206 @@
+/**
+ * Simple bloom filter implementation for fast reference pre-filtering
+ *
+ * Used to quickly determine if a file MIGHT contain references to a symbol,
+ * allowing us to skip files that definitely don't contain the symbol.
+ */
+import { BLOOM_FILTER_IDENTIFIER_SOURCE } from "./identifiers.js";
+import { fileIdentityKey } from "./paths.js";
+import crypto from "node:crypto";
+/**
+ * Calculate optimal bloom filter parameters for a target false positive rate.
+ * @param expectedItems - Expected number of items to be added
+ * @param falsePositiveRate - Target false positive rate (default: 0.01 = 1%)
+ * @returns Optimal size in bits and hash count
+ */
+export function calculateOptimalBloomParams(expectedItems, falsePositiveRate = 0.01) {
+    // Ensure reasonable bounds
+    const n = Math.max(1, expectedItems);
+    const p = Math.max(0.0001, Math.min(0.5, falsePositiveRate));
+    // Optimal size: m = -n * ln(p) / (ln(2)^2)
+    const ln2 = Math.LN2;
+    const ln2Squared = ln2 * ln2;
+    const optimalSize = Math.ceil((-n * Math.log(p)) / ln2Squared);
+    // Optimal hash count: k = (m/n) * ln(2)
+    const optimalHashCount = Math.max(1, Math.round((optimalSize / n) * ln2));
+    // Clamp to reasonable bounds
+    const size = Math.max(1000, Math.min(1000000, optimalSize)); // 1KB to 125KB
+    const hashCount = Math.max(1, Math.min(10, optimalHashCount));
+    return { size, hashCount };
+}
+export class BloomFilter {
+    bits;
+    size;
+    hashCount;
+    itemCount = 0;
+    /**
+     * Create a bloom filter
+     * @param size - Number of bits in the filter (default: 10000)
+     * @param hashCount - Number of hash functions to use (default: 3)
+     */
+    constructor(size = 10000, hashCount = 3) {
+        this.size = size;
+        this.hashCount = hashCount;
+        this.bits = new Uint8Array(Math.ceil(size / 8));
+    }
+    /**
+     * Create an optimally-sized bloom filter for the expected number of items.
+     * @param expectedItems - Expected number of items to be added
+     * @param falsePositiveRate - Target false positive rate (default: 0.01 = 1%)
+     */
+    static createOptimal(expectedItems, falsePositiveRate = 0.01) {
+        const { size, hashCount } = calculateOptimalBloomParams(expectedItems, falsePositiveRate);
+        return new BloomFilter(size, hashCount);
+    }
+    /**
+     * Add an item to the bloom filter
+     */
+    add(item) {
+        // Set all bits first, only increment count if all operations succeed
+        for (const hash of this.getHashes(item)) {
+            const byteIndex = Math.floor(hash / 8);
+            const bitIndex = hash % 8;
+            if (byteIndex < 0 || byteIndex >= this.bits.length)
+                return;
+            const currentByte = this.bits[byteIndex];
+            if (currentByte !== undefined) {
+                this.bits[byteIndex] = currentByte | (1 << bitIndex);
+            }
+        }
+        // Only increment after successful addition
+        this.itemCount++;
+    }
+    /**
+     * Get the number of items added to the filter
+     */
+    getItemCount() {
+        return this.itemCount;
+    }
+    /**
+     * Get the current estimated false positive rate based on items added
+     */
+    getCurrentFalsePositiveRate() {
+        return this.getFalsePositiveRate(this.itemCount);
+    }
+    /**
+     * Check if an item might be in the set
+     * Returns false if definitely not present, true if might be present
+     */
+    mightContain(item) {
+        for (const hash of this.getHashes(item)) {
+            const byteIndex = Math.floor(hash / 8);
+            const bitIndex = hash % 8;
+            if (byteIndex < 0 || byteIndex >= this.bits.length)
+                return false;
+            const currentByte = this.bits[byteIndex];
+            if (currentByte === undefined || (currentByte & (1 << bitIndex)) === 0) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Generate multiple hash values for an item
+     */
+    *getHashes(item) {
+        // Use a single hash and derive multiple values from it
+        const hash = crypto.createHash("sha256").update(item).digest();
+        for (let i = 0; i < this.hashCount; i++) {
+            // Take different 4-byte segments of the hash
+            const offset = (i * 4) % (hash.length - 4);
+            const value = hash.readUInt32LE(offset);
+            yield value % this.size;
+        }
+    }
+    /**
+     * Get the approximate false positive rate
+     */
+    getFalsePositiveRate(itemCount) {
+        // Formula: (1 - e^(-k*n/m))^k
+        // where k = hashCount, n = itemCount, m = size
+        const exp = Math.exp((-this.hashCount * itemCount) / this.size);
+        return Math.pow(1 - exp, this.hashCount);
+    }
+    /**
+     * Serialize to buffer for caching
+     */
+    toBuffer() {
+        return Buffer.from(this.bits);
+    }
+    /**
+     * Deserialize from buffer
+     */
+    static fromBuffer(buffer, size, hashCount, itemCount = 0) {
+        const filter = new BloomFilter(size, hashCount);
+        filter.bits = new Uint8Array(buffer);
+        filter.itemCount = itemCount;
+        return filter;
+    }
+    /**
+     * Get metadata for serialization
+     */
+    getMetadata() {
+        return { size: this.size, hashCount: this.hashCount };
+    }
+}
+/**
+ * Build a bloom filter from source code with auto-sizing.
+ * Extracts all identifiers and adds them to an optimally-sized filter.
+ * @param source - The source code to analyze
+ * @param support - The language support for the source file
+ * @param falsePositiveRate - Target false positive rate (default: 0.01 = 1%)
+ */
+export function buildBloomFilterFromSource(source, support, falsePositiveRate = 0.01) {
+    const identifierPattern = new RegExp(BLOOM_FILTER_IDENTIFIER_SOURCE, "gu");
+    const matches = source.match(identifierPattern);
+    const unique = new Set();
+    for (const identifier of matches ?? []) {
+        unique.add(support.normalizeIdentifier(identifier));
+    }
+    const filter = BloomFilter.createOptimal(unique.size || 100, falsePositiveRate);
+    for (const identifier of unique) {
+        filter.add(identifier);
+    }
+    return filter;
+}
+/**
+ * Cache of bloom filters per file
+ */
+export class BloomFilterCache {
+    filters = new Map();
+    set(file, filter) {
+        this.filters.set(fileIdentityKey(file), filter);
+    }
+    get(file) {
+        return this.filters.get(fileIdentityKey(file));
+    }
+    has(file) {
+        return this.filters.has(fileIdentityKey(file));
+    }
+    /**
+     * Check if a symbol might be in any of the provided files
+     * Returns only files that might contain the symbol
+     */
+    filterFiles(symbol, files) {
+        const candidates = [];
+        for (const file of files) {
+            const filter = this.filters.get(fileIdentityKey(file));
+            if (!filter) {
+                // If no filter exists, assume it might contain the symbol
+                candidates.push(file);
+            }
+            else if (filter.mightContain(symbol)) {
+                candidates.push(file);
+            }
+            // If filter exists and definitely doesn't contain symbol, skip
+        }
+        return candidates;
+    }
+    clear() {
+        this.filters.clear();
+    }
+    size() {
+        return this.filters.size;
+    }
+}
+//# sourceMappingURL=bloom-filter.js.map

package/dist/util/bloom-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bloom-filter.js","sourceRoot":"","sources":["../../src/util/bloom-filter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,aAAqB,EACrB,iBAAiB,GAAG,IAAI;IAExB,2BAA2B;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE7D,2CAA2C;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,UAAU,GAAG,GAAG,GAAG,GAAG,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAE/D,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAE1E,6BAA6B;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,WAAW;IACd,IAAI,CAAa;IACjB,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,SAAS,GAAW,CAAC,CAAC;IAE9B;;;;OAIG;IACH,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,GAAG,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,aAAqB,EAAE,iBAAiB,GAAG,IAAI;QAClE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAC1F,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY;QACd,qEAAqE;QACrE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC;YAC1B,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,IAAY;QACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC;YAC1B,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,CAAC,SAAS,CAAC,IAAY;QAC7B,uDAAuD;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,6CAA6C;YAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,SAAiB;QACpC,8BAA8B;QAC9B,+CAA+C;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,SAAiB,EAAE,SAAS,GAAG,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACxD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,OAAqD,EACrD,iBAAiB,GAAG,IAAI;IAExB,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,UAAU,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAChF,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEjD,GAAG,CAAC,IAAY,EAAE,MAAmB;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAc,EAAE,KAAe;QACzC,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,0DAA0D;gBAC1D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,+DAA+D;QACjE,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}

package/dist/util/confined-file.d.ts

@@ -0,0 +1,48 @@
+import { type BigIntStats } from "node:fs";
+import { type FileHandle } from "node:fs/promises";
+export type ConfinedReadableFile = {
+    handle: FileHandle;
+    realPath: string;
+    displayPath: string;
+    size: number;
+};
+type ConfinedFileTestHook = (realPath: string) => void | Promise<void>;
+type PreparedReadableFile = {
+    displayPath: string;
+    expectedStats: readonly BigIntStats[];
+    realPath: string;
+};
+/**
+ * Test-only seam after the trusted file identity is captured and before the descriptor opens.
+ * Production code must leave this unset.
+ */
+export declare function setAfterConfinedPathVerifiedForTests(hook: ConfinedFileTestHook | undefined): void;
+export declare function resolveReadableFile(realRoot: string, root: string, filePath: string): Promise<PreparedReadableFile>;
+/**
+ * Resolve a project path, open it, and verify the opened descriptor before any read.
+ *
+ * Flow: capture the lexical file identity (following any alias) -> realpath confinement -> capture
+ * the resolved regular file identity -> optional test hook -> open the realpath'd target -> `fstat`
+ * on that descriptor -> compare it to every pre-open identity -> callers read only through the
+ * returned handle (never re-resolve the path string).
+ *
+ * POSIX: open uses `O_RDONLY | O_NOFOLLOW` so a leaf symlink swap fails the open with ELOOP.
+ * win32: Node's `fs.open` has no portable `O_NOFOLLOW` (`fs.constants.O_NOFOLLOW` is absent).
+ * Guarantee there is post-open identity: `fstat.ino` must match every pre-open identity. `dev` is
+ * compared when both sides expose it. When win32 `lstat.dev` is zero while `fstat.dev` has the
+ * volume serial, the creation time must also match, so a cross-volume junction swap cannot pass
+ * on a colliding inode alone.
+ *
+ * In-root symlinks still work: confinement realpaths them first, then the open targets the
+ * resolved regular file inside the root, not the symlink leaf.
+ *
+ * A pre-existing in-root hard link remains indistinguishable from one whose other directory entry
+ * is outside the root. Pathname confinement proves the opened descriptor, not hard-link provenance.
+ */
+export declare function openConfinedReadableFile(realRoot: string, root: string, filePath: string): Promise<ConfinedReadableFile>;
+export declare function readConfinedUtf8File(realRoot: string, root: string, filePath: string): Promise<string>;
+export declare function resolveProjectFile(realRoot: string, root: string, filePath: string): Promise<string>;
+export declare function assertRealPathCandidateWithinRoot(realRoot: string, filePath: string, label: string): Promise<string>;
+export declare function findNearestExistingPath(filePath: string): Promise<string>;
+export {};
+//# sourceMappingURL=confined-file.d.ts.map

package/dist/util/confined-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confined-file.d.ts","sourceRoot":"","sources":["../../src/util/confined-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACrE,OAAW,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKvD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACvE,KAAK,oBAAoB,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF;;;GAGG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAEjG;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAW/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AACD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO5G;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1G;AAOD,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY/E"}

package/dist/util/confined-file.js

@@ -0,0 +1,164 @@
+import { constants as fsConstants } from "node:fs";
+import fs, {} from "node:fs/promises";
+import path from "node:path";
+import { isFilePathWithinRoot, normalizePath, toProjectRelativePath } from "./paths.js";
+let afterConfinedPathVerifiedForTests;
+/**
+ * Test-only seam after the trusted file identity is captured and before the descriptor opens.
+ * Production code must leave this unset.
+ */
+export function setAfterConfinedPathVerifiedForTests(hook) {
+    afterConfinedPathVerifiedForTests = hook;
+}
+export async function resolveReadableFile(realRoot, root, filePath) {
+    const candidatePath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(root, filePath);
+    assertCandidatePathWithinRoot(realRoot, root, candidatePath, "File");
+    const candidateStat = await fs.stat(candidatePath, { bigint: true });
+    assertRegularFileStat(candidateStat, candidatePath);
+    const realPath = await assertRealPathCandidateWithinRoot(realRoot, candidatePath, "File");
+    const expectedStat = await fs.lstat(realPath, { bigint: true });
+    assertRegularFileStat(expectedStat, realPath);
+    const displayPath = toProjectRelativePath(root, candidatePath) ?? toProjectRelativePath(realRoot, realPath) ?? normalizePath(realPath);
+    return { realPath, displayPath, expectedStats: [candidateStat, expectedStat] };
+}
+/**
+ * Resolve a project path, open it, and verify the opened descriptor before any read.
+ *
+ * Flow: capture the lexical file identity (following any alias) -> realpath confinement -> capture
+ * the resolved regular file identity -> optional test hook -> open the realpath'd target -> `fstat`
+ * on that descriptor -> compare it to every pre-open identity -> callers read only through the
+ * returned handle (never re-resolve the path string).
+ *
+ * POSIX: open uses `O_RDONLY | O_NOFOLLOW` so a leaf symlink swap fails the open with ELOOP.
+ * win32: Node's `fs.open` has no portable `O_NOFOLLOW` (`fs.constants.O_NOFOLLOW` is absent).
+ * Guarantee there is post-open identity: `fstat.ino` must match every pre-open identity. `dev` is
+ * compared when both sides expose it. When win32 `lstat.dev` is zero while `fstat.dev` has the
+ * volume serial, the creation time must also match, so a cross-volume junction swap cannot pass
+ * on a colliding inode alone.
+ *
+ * In-root symlinks still work: confinement realpaths them first, then the open targets the
+ * resolved regular file inside the root, not the symlink leaf.
+ *
+ * A pre-existing in-root hard link remains indistinguishable from one whose other directory entry
+ * is outside the root. Pathname confinement proves the opened descriptor, not hard-link provenance.
+ */
+export async function openConfinedReadableFile(realRoot, root, filePath) {
+    const { realPath, displayPath, expectedStats } = await resolveReadableFile(realRoot, root, filePath);
+    if (afterConfinedPathVerifiedForTests) {
+        await afterConfinedPathVerifiedForTests(realPath);
+    }
+    const { handle, size } = await openVerifiedRegularFile(realPath, expectedStats);
+    return { handle, realPath, displayPath, size };
+}
+export async function readConfinedUtf8File(realRoot, root, filePath) {
+    const confined = await openConfinedReadableFile(realRoot, root, filePath);
+    try {
+        return await confined.handle.readFile({ encoding: "utf8" });
+    }
+    finally {
+        await confined.handle.close();
+    }
+}
+export async function resolveProjectFile(realRoot, root, filePath) {
+    const candidatePath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(root, filePath);
+    assertCandidatePathWithinRoot(realRoot, root, candidatePath, "File");
+    const realPath = await assertRealPathCandidateWithinRoot(realRoot, candidatePath, "File");
+    const lexicalRelativePath = toProjectRelativePath(root, candidatePath);
+    if (lexicalRelativePath)
+        return normalizePath(path.resolve(root, lexicalRelativePath));
+    const realRelativePath = toProjectRelativePath(realRoot, realPath);
+    if (realRelativePath)
+        return normalizePath(path.resolve(root, realRelativePath));
+    throw new Error(`File is outside project root: ${normalizePath(realPath)} (root: ${normalizePath(realRoot)})`);
+}
+function assertCandidatePathWithinRoot(realRoot, root, candidatePath, label) {
+    if (isFilePathWithinRoot(root, candidatePath) || isFilePathWithinRoot(realRoot, candidatePath))
+        return;
+    throw new Error(`${label} is outside project root: ${normalizePath(candidatePath)} (root: ${normalizePath(root)})`);
+}
+export async function assertRealPathCandidateWithinRoot(realRoot, filePath, label) {
+    const existingPath = await findNearestExistingPath(filePath);
+    const realExistingPath = await fs.realpath(existingPath);
+    const relativeSuffix = path.relative(existingPath, filePath);
+    const realTargetPath = path.resolve(realExistingPath, relativeSuffix);
+    if (!isFilePathWithinRoot(realRoot, realTargetPath)) {
+        throw new Error(`${label} is outside project root: ${normalizePath(realTargetPath)} (root: ${normalizePath(realRoot)})`);
+    }
+    const finalRealPath = await fs.realpath(filePath);
+    if (!isFilePathWithinRoot(realRoot, finalRealPath)) {
+        throw new Error(`${label} is outside project root: ${normalizePath(finalRealPath)} (root: ${normalizePath(realRoot)})`);
+    }
+    return finalRealPath;
+}
+export async function findNearestExistingPath(filePath) {
+    let current = filePath;
+    while (current !== path.dirname(current)) {
+        try {
+            await fs.stat(current);
+            return current;
+        }
+        catch (error) {
+            if (!isMissingPathError(error))
+                throw error;
+            current = path.dirname(current);
+        }
+    }
+    return current;
+}
+async function openVerifiedRegularFile(realPath, expectedStats) {
+    // O_NONBLOCK guards against a verified regular file being swapped for a FIFO before this open:
+    // without it, opening a FIFO for O_RDONLY blocks until a writer connects, hanging the caller
+    // before the fstat() below can reject the non-regular target. POSIX ignores O_NONBLOCK on
+    // regular files, so normal reads through the returned handle are unaffected.
+    const openFlags = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0);
+    let handle;
+    try {
+        handle = await fs.open(realPath, openFlags);
+    }
+    catch (error) {
+        throw rewriteNoFollowOpenError(error, realPath);
+    }
+    try {
+        const postStat = await handle.stat({ bigint: true });
+        assertRegularFileStat(postStat, realPath);
+        if (!expectedStats.every((expectedStat) => sameFileIdentity(expectedStat, postStat))) {
+            throw new Error(`File changed between verification and open: ${normalizePath(realPath)} (possible path confinement race)`);
+        }
+        return { handle, size: Number(postStat.size) };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+function sameFileIdentity(preStat, postStat) {
+    if (preStat.ino !== postStat.ino)
+        return false;
+    // Birth time (nanosecond precision) must always match: an unlink+recreate on the same
+    // filesystem can reuse the same inode, and no descriptor is held open across the pre-open
+    // checks to pin identity, so ino/dev equality alone cannot prove it is the same file.
+    if (preStat.birthtimeNs !== postStat.birthtimeNs)
+        return false;
+    if (preStat.dev === 0n || postStat.dev === 0n)
+        return true;
+    return preStat.dev === postStat.dev;
+}
+function assertRegularFileStat(stat, filePath) {
+    if (stat.isFile())
+        return;
+    throw new Error(`Confined file target is not a file: ${normalizePath(filePath)}`);
+}
+function rewriteNoFollowOpenError(error, filePath) {
+    if (error instanceof Error &&
+        "code" in error &&
+        (error.code === "ELOOP" || error.code === "EMLINK" || error.code === "EINVAL")) {
+        return new Error(`File changed between verification and open: ${normalizePath(filePath)} (possible path confinement race)`);
+    }
+    if (error instanceof Error)
+        return error;
+    return new Error(String(error));
+}
+function isMissingPathError(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+//# sourceMappingURL=confined-file.js.map

package/dist/util/confined-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confined-file.js","sourceRoot":"","sources":["../../src/util/confined-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAoB,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,EAAE,EAAmB,MAAM,kBAAkB,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAgBxF,IAAI,iCAAmE,CAAC;AAExE;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,IAAsC;IACzF,iCAAiC,GAAG,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAY,EACZ,QAAgB;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,qBAAqB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GACf,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,IAAY,EACZ,QAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrG,IAAI,iCAAiC,EAAE,CAAC;QACtC,MAAM,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAY,EAAE,QAAgB;IACzF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAAY,EAAE,QAAgB;IACvF,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1F,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvE,IAAI,mBAAmB;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,gBAAgB;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,aAAa,CAAC,QAAQ,CAAC,WAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB,EAAE,IAAY,EAAE,aAAqB,EAAE,KAAa;IACzG,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,OAAO;IACvG,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,aAAa,CAAC,aAAa,CAAC,WAAW,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,QAAgB,EAChB,QAAgB,EAChB,KAAa;IAEb,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6BAA6B,aAAa,CAAC,cAAc,CAAC,WAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6BAA6B,aAAa,CAAC,aAAa,CAAC,WAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,OAAO,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,aAAqC;IAErC,+FAA+F;IAC/F,6FAA6F;IAC7F,0FAA0F;IAC1F,6EAA6E;IAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IACvG,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CACb,+CAA+C,aAAa,CAAC,QAAQ,CAAC,mCAAmC,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB,EAAE,QAAqB;IACnE,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/C,sFAAsF;IACtF,0FAA0F;IAC1F,sFAAsF;IACtF,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB,EAAE,QAAgB;IAChE,IAAI,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO;IAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,QAAgB;IAChE,IACE,KAAK,YAAY,KAAK;QACtB,MAAM,IAAI,KAAK;QACf,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAC9E,CAAC;QACD,OAAO,IAAI,KAAK,CACd,+CAA+C,aAAa,CAAC,QAAQ,CAAC,mCAAmC,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC"}

package/dist/util/discovery-path.d.ts

@@ -0,0 +1,3 @@
+export declare function isRelativePathInside(relativePath: string): boolean;
+export declare function matchesDiscoveryGlob(absolutePath: string, projectRoot: string, matcher: (relativePath: string) => boolean): boolean;
+//# sourceMappingURL=discovery-path.d.ts.map

package/dist/util/discovery-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-path.d.ts","sourceRoot":"","sources":["../../src/util/discovery-path.ts"],"names":[],"mappings":"AAGA,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAUlE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GACzC,OAAO,CAMT"}

package/dist/util/discovery-path.js

@@ -0,0 +1,19 @@
+import path from "node:path";
+import { normalizePath } from "./paths.js";
+export function isRelativePathInside(relativePath) {
+    const normalized = normalizePath(relativePath);
+    return (!!normalized &&
+        normalized !== ".." &&
+        !normalized.startsWith("../") &&
+        !path.isAbsolute(relativePath) &&
+        !path.win32.isAbsolute(relativePath) &&
+        !path.posix.isAbsolute(relativePath));
+}
+export function matchesDiscoveryGlob(absolutePath, projectRoot, matcher) {
+    const relativePath = path.relative(projectRoot, absolutePath);
+    if (!isRelativePathInside(relativePath)) {
+        return false;
+    }
+    return matcher(normalizePath(relativePath));
+}
+//# sourceMappingURL=discovery-path.js.map

package/dist/util/discovery-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-path.js","sourceRoot":"","sources":["../../src/util/discovery-path.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,CACL,CAAC,CAAC,UAAU;QACZ,UAAU,KAAK,IAAI;QACnB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7B,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QACpC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,WAAmB,EACnB,OAA0C;IAE1C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/util/git.d.ts

@@ -10,6 +10,14 @@ type GitExcludeFile = {
     baseDir: string;
     priority: number;
 };
+/** Git facts shared only by callers in the same discovery operation. */
+export type GitDiscoveryCache = {
+    repositories: Map<string, Promise<boolean>>;
+    ignoredRoots: Map<string, Promise<boolean>>;
+    excludeFiles: Map<string, Promise<GitExcludeFile[]>>;
+    untrackedFiles: Map<string, Promise<string[]>>;
+};
+export declare function createGitDiscoveryCache(): GitDiscoveryCache;
 /** Decodes Git's optional C-style quoted pathname representation without trimming legal path bytes. */
 export declare function decodeGitPath(rawPath: string): string;
 /**
@@ -28,10 +36,6 @@ export type RunGitOptions = {
         pid?: number;
     }) => void) | undefined;
 };
-/** Test-only: drop memoized Git repository checks. */
-export declare function clearGitRepositoryCheckCacheForTests(): void;
-/** Test-only: drop memoized Git discovery facts. */
-export declare function clearGitDiscoveryCacheForTests(): void;
 /**
  * Central bounded Git execution: timeout + optional AbortSignal, always kills the child.
  * Preserves stderr/stdout in rejection messages for diagnosis.
@@ -45,15 +49,12 @@ export declare function isGitIndexSentinel(value: string): boolean;
 export declare function assertSafeRevision(value: string, label: string): string;
 export declare function gitDiffArgs(base: string, head: string, extraArgs?: string[]): string[];
 export declare function getGitHead(projectRoot: string): Promise<string | null>;
-export declare function isGitRepo(projectRoot: string): Promise<boolean>;
+export declare function isGitRepo(projectRoot: string, cache?: GitDiscoveryCache): Promise<boolean>;
 export declare function getGitRepositoryRoot(projectRoot: string): Promise<string | null>;
 export declare function isGitPathTracked(projectRoot: string, file: string): Promise<boolean>;
 export declare function isGitPathIgnored(projectRoot: string, file: string): Promise<boolean>;
-/**
- * Whether Git ignores the requested project root. This value is static for a root during
- * process lifetime and lets repeated discovery avoid spawning `git check-ignore`.
- */
-export declare function isGitProjectRootIgnored(projectRoot: string): Promise<boolean>;
+/** Whether Git ignores the requested root in this discovery operation. */
+export declare function isGitProjectRootIgnored(projectRoot: string, cache?: GitDiscoveryCache): Promise<boolean>;
 export declare function getGitBlobHashes(projectRoot: string, files: string[], opts?: {
     gitAvailable?: boolean;
     logLevel?: LogLevel;
@@ -137,6 +138,7 @@ export declare function listGitSubmoduleDirectories(projectRoot: string, opts?:
  */
 export declare function listGitExcludeFiles(projectRoot: string, opts?: {
     gitAvailable?: boolean;
+    discoveryCache?: GitDiscoveryCache;
 }): Promise<GitExcludeFile[]>;
 /**
  * List files in the working tree that Git does not track (new, uncommitted files).
@@ -152,6 +154,7 @@ export declare function listGitExcludeFiles(projectRoot: string, opts?: {
 export declare function listUntrackedFiles(projectRoot: string, opts?: {
     gitAvailable?: boolean;
     respectGitignore?: boolean;
+    discoveryCache?: GitDiscoveryCache;
 }): Promise<string[]>;
 /**
  * Get unified diff text from Git.

package/dist/util/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/util/git.ts"],"names":[],"mappings":"AAOA,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAqB1E,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqCrD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,GAAE,SAAS,MAAM,EAAO,GAAG,IAAI,CAG5G;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC3D,CAAC;AAEF,sDAAsD;AACtD,wBAAgB,oCAAoC,IAAI,IAAI,CAE3D;AAED,oDAAoD;AACpD,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD;AA2DD;;;GAGG;AACH,wBAAsB,MAAM,CAC1B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA2I7C;AAOD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAgB1F;AAED,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ5E;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQtF;AAED,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1F;AAED,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1F;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnF;AAiBD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,GACrD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsD9B;AAsCD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B,GACA,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAwBD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;AACD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACtE,OAAO,CAAC,MAAM,EAAE,CAAC,CAyBnB;AAED,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAkBF;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD,OAAO,CAAC,oBAAoB,CAAC,CAsB/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,EAAE,CAAC,CAEnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAmDD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5D,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBnB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B,GACA,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/util/git.ts"],"names":[],"mappings":"AAOA,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1E,wEAAwE;AACxE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACrD,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAgB,uBAAuB,IAAI,iBAAiB,CAO3D;AAkBD,uGAAuG;AACvG,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAqCrD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,GAAE,SAAS,MAAM,EAAO,GAAG,IAAI,CAG5G;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC3D,CAAC;AA2DF;;;GAGG;AACH,wBAAsB,MAAM,CAC1B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA2I7C;AAOD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGzD;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAgB1F;AAED,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQ5E;AAED,wBAAsB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAchG;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQtF;AAED,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1F;AAED,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE1F;AAED,0EAA0E;AAC1E,wBAAsB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9G;AAiBD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EAAE,EACf,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAE,GACrD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsD9B;AAsCD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B,GACA,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAwBD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GAClF,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;AACD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACtE,OAAO,CAAC,MAAM,EAAE,CAAC,CAyBnB;AAED,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAkBF;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD,OAAO,CAAC,oBAAoB,CAAC,CAsB/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACnD,OAAO,CAAC,MAAM,EAAE,CAAC,CAEnB;AAED;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,iBAAiB,CAAA;CAAE,GACpE,OAAO,CAAC,cAAc,EAAE,CAAC,CAQ3B;AAmDD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAChG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWnB;AAsBD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B,GACA,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGzD"}