@maudecode/talaria-web 1.17.2 → 1.18.0

package/dist/tools/wiki.js

@@ -0,0 +1,413 @@
+/**
+ * LLM wiki status, browse, and page reads (Python `_llm_wiki_*` handlers). Only allowlisted pages are ever read: a
+ * `*.md` file under one of the page sections whose resolved path stays inside that section, with no dot segment, and
+ * a single link. Every read reopens the allowlisted real path with `O_NOFOLLOW` and requires the open file's
+ * `(dev, ino)` to match the identity captured when the allowlist was built.
+ */
+import { closeSync, constants, fstatSync, lstatSync, openSync, readdirSync, readFileSync, readSync, realpathSync, statSync } from 'node:fs';
+import { basename, isAbsolute, join, relative, sep } from 'node:path';
+import { parseDotenv } from '../cli/dotenv.js';
+import { isDict } from '../config/agent-config.js';
+import { HttpFailure } from '../sessions/service.js';
+import { expandHome, isWithin, resolvePathLikePython } from '../workspace/paths.js';
+export const WIKI_DOCS_URL = 'https://hermes-agent.nousresearch.com/docs/user-guide/skills/bundled/research/research-llm-wiki';
+const SECTIONS = ['entities', 'concepts', 'comparisons', 'queries'];
+/** Bounds a walk when `WIKI_PATH` points somewhere huge; real wikis hold a few thousand files. */
+const MAX_FILES = 10_000;
+export const MAX_PAGE_BYTES = 2 * 1024 * 1024;
+const FORBIDDEN_ROOTS = new Set(['/', '/etc', '/usr', '/var', '/opt', '/sys', '/proc'].map((p) => resolvePathLikePython(p)));
+const TOGGLE_REASON = 'Hermes Agent exposes WIKI_PATH/wiki.path for location, but no stable on/off config flag is currently available.';
+const O_READ = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
+const sameFile = (st, entry) => st.dev === entry.dev && st.ino === entry.ino;
+const isClean = (rel) => rel !== '' && !rel.split(sep).some((part) => part.startsWith('.'));
+const realpath = (path) => { try {
+    return realpathSync.native(path);
+}
+catch {
+    return null;
+} };
+/** `stat` / `lstat` answering `undefined` for any failure (missing, unreadable, not a directory): such an entry is never listed or read. */
+const stat = (path) => { try {
+    return statSync(path);
+}
+catch {
+    return undefined;
+} };
+const lstat = (path) => { try {
+    return lstatSync(path);
+}
+catch {
+    return undefined;
+} };
+/** Python `os.path.expandvars`: `$NAME` and `${NAME}` from `env`; unknown names stay as written. */
+function expandVars(text, env) {
+    return text.replace(/\$(\w+|\{[^}]*\})/g, (match, name) => env[name.startsWith('{') ? name.slice(1, -1) : name] ?? match);
+}
+/** A dotted config key, accepted flat (`'wiki.path': …`) or nested. */
+function configValue(config, dotted) {
+    let value = config[dotted];
+    if (!value) {
+        value = config;
+        for (const part of dotted.split('.'))
+            value = isDict(value) ? value[part] : undefined;
+    }
+    return value && (typeof value === 'string' || typeof value === 'number') ? String(value) : null;
+}
+/**
+ * Python `_llm_wiki_resolve_path`: `WIKI_PATH` from the env, then from `<profile home>/.env`, then config
+ * `skills.config.wiki.path` or `wiki.path`, else `~/wiki`; env vars and `~` expanded.
+ */
+export function resolveWikiLocation(env, profileHome, config, home) {
+    let raw = env.WIKI_PATH || homeDotenvWikiPath(profileHome);
+    let source = raw ? 'WIKI_PATH' : 'default';
+    if (!raw) {
+        raw = configValue(config, 'skills.config.wiki.path') ?? configValue(config, 'wiki.path');
+        if (raw)
+            source = 'skills.config.wiki.path';
+    }
+    return { path: expandHome(expandVars(raw || '~/wiki', env), home), source, configured: source !== 'default' };
+}
+function homeDotenvWikiPath(profileHome) {
+    try {
+        return parseDotenv(readFileSync(join(profileHome, '.env'), 'utf8')).WIKI_PATH || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Python `datetime.fromtimestamp(ts, utc).isoformat()` with `Z`: microseconds only when nonzero. */
+function isoSeconds(ms) {
+    const micros = Math.round(ms * 1000);
+    const base = new Date(Math.floor(micros / 1000)).toISOString().slice(0, 19);
+    const fraction = ((micros % 1_000_000) + 1_000_000) % 1_000_000;
+    return `${base}${fraction ? `.${String(fraction).padStart(6, '0')}` : ''}Z`;
+}
+/**
+ * Entries under `dir`, like `Path.rglob`: directory symlinks are not followed; dot directories (never listed) are
+ * skipped. Every entry spends one unit of `budget`, so a huge tree cannot hold the event loop.
+ */
+function* walk(dir, budget) {
+    let names;
+    try {
+        names = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const d of names) {
+        if (budget.left-- <= 0)
+            return;
+        const path = join(dir, d.name);
+        yield { path, name: d.name, dir: d.isDirectory() };
+        if (d.isDirectory() && !d.name.startsWith('.'))
+            yield* walk(path, budget);
+    }
+}
+/** Python `_llm_wiki_count_files`: regular files under `raw/` outside dot segments. */
+function countRawFiles(root) {
+    const real = realpath(root);
+    if (!real || FORBIDDEN_ROOTS.has(real) || !stat(real)?.isDirectory())
+        return 0;
+    let count = 0;
+    for (const item of walk(root, { left: MAX_FILES })) {
+        if (!item.dir && !item.name.startsWith('.') && stat(item.path)?.isFile())
+            count++;
+    }
+    return count;
+}
+export class WikiPages {
+    opts;
+    cache = new Map();
+    constructor(opts = {}) {
+        this.opts = opts;
+    }
+    /** Change signature over the section directories only: `(dev, ino, mtime_ns)` each, or missing. */
+    signature(root) {
+        return SECTIONS.map((s) => {
+            try {
+                const st = lstatSync(join(root, s), { bigint: true });
+                return `${s}:${String(st.dev)}:${String(st.ino)}:${String(st.mtimeNs)}`;
+            }
+            catch {
+                return `${s}:-`;
+            }
+        }).join('|');
+    }
+    /** Python `_llm_wiki_page_files_uncached`. */
+    pageFilesUncached(root) {
+        const pages = [];
+        const rootReal = realpath(root);
+        if (!rootReal || FORBIDDEN_ROOTS.has(rootReal))
+            return pages;
+        const budget = { left: this.opts.maxFiles ?? MAX_FILES };
+        for (const name of SECTIONS) {
+            const section = join(root, name);
+            const sectionReal = realpath(section);
+            // A symlinked section must still resolve under the wiki root, so it cannot expose an outside tree.
+            if (!sectionReal || !stat(sectionReal)?.isDirectory() || !isWithin(sectionReal, rootReal))
+                continue;
+            for (const item of walk(section, budget)) {
+                if (!item.name.endsWith('.md') || !isClean(relative(section, item.path)))
+                    continue;
+                try {
+                    // A hard link at a clean page name can carry any inode, and the identity check at read time cannot tell it apart.
+                    if (!statSync(item.path).isFile() || lstatSync(item.path).nlink > 1)
+                        continue;
+                    const itemReal = realpathSync.native(item.path);
+                    if (isWithin(itemReal, sectionReal) && isClean(relative(rootReal, itemReal)))
+                        pages.push(item.path);
+                }
+                catch { /* vanished */ }
+            }
+        }
+        return pages;
+    }
+    /**
+     * Python `_llm_wiki_page_files`: the allowlisted page paths, cached 5 s per resolved root while no section's
+     * `(dev, ino, mtime_ns)` changes. A page swapped inside a nested directory leaves the signature unchanged, so every
+     * reader rechecks each cached path (`allowlistedEntries`). Trust boundary: a hard link created at a listed name
+     * before the snapshot carries that page's identity; the wiki directory is operator-controlled, so that is accepted.
+     */
+    pageFiles(root) {
+        const key = realpath(root) ?? root;
+        const signature = this.signature(key);
+        const now = (this.opts.now ?? Date.now)();
+        const cached = this.cache.get(key);
+        if (cached?.signature === signature && now < cached.expiresAt)
+            return [...cached.files];
+        const files = this.pageFilesUncached(key);
+        this.cache.set(key, { signature, expiresAt: now + (this.opts.ttlMs ?? 5000), files });
+        return [...files];
+    }
+    /** Python `_llm_wiki_allowlisted_entries`: listed relpaths (posix) mapped to their real path and identity, rechecked now. */
+    allowlistedEntries(root) {
+        const entries = new Map();
+        const rootReal = realpath(root);
+        if (!rootReal)
+            return entries;
+        for (const listed of this.pageFiles(rootReal)) {
+            try {
+                const rel = relative(rootReal, listed);
+                if (!isClean(rel) || rel.includes('\\'))
+                    continue;
+                const sectionReal = realpathSync.native(join(rootReal, rel.split(sep)[0] ?? ''));
+                const target = realpathSync.native(listed);
+                if (!isWithin(sectionReal, rootReal) || !isWithin(target, sectionReal) || !isClean(relative(rootReal, target)))
+                    continue;
+                const st = statSync(target);
+                if (!st.isFile() || st.nlink > 1 || realpathSync.native(listed) !== target)
+                    continue;
+                entries.set(rel.split(sep).join('/'), { target, dev: st.dev, ino: st.ino });
+            }
+            catch { /* vanished */ }
+        }
+        return entries;
+    }
+    /** The single open used for every wiki read: no symlink at the final component, and a FIFO cannot block. */
+    openNoFollow(path) {
+        return openSync(path, O_READ);
+    }
+    /** Open `path` and require the open file to be `identity`; `null` when it changed or vanished. */
+    openVerified(path, identity) {
+        let fd;
+        try {
+            fd = this.openNoFollow(path);
+        }
+        catch {
+            return null;
+        }
+        try {
+            if (sameFile(fstatSync(fd), identity))
+                return fd;
+        }
+        catch { /* closed below */ }
+        closeSync(fd);
+        return null;
+    }
+    /** Lines from an open file (UTF-8 with replacement), at most `maxLines`, reading at most `MAX_PAGE_BYTES`. */
+    *lines(fd, maxLines) {
+        const decoder = new TextDecoder('utf-8', { ignoreBOM: true });
+        const buf = Buffer.alloc(64 * 1024);
+        let pending = '';
+        let read = 0;
+        let emitted = 0;
+        for (;;) {
+            const n = read < MAX_PAGE_BYTES ? readSync(fd, buf, 0, Math.min(buf.length, MAX_PAGE_BYTES - read), null) : 0;
+            read += n;
+            pending += n ? decoder.decode(buf.subarray(0, n), { stream: true }) : decoder.decode();
+            let nl;
+            while ((nl = pending.indexOf('\n')) >= 0) {
+                if (emitted++ >= maxLines)
+                    return;
+                yield pending.slice(0, nl + 1);
+                pending = pending.slice(nl + 1);
+            }
+            if (!n) {
+                if (pending && emitted < maxLines)
+                    yield pending;
+                return;
+            }
+        }
+    }
+    /** A top-level status file (`SCHEMA.md`, `index.md`, `log.md`), opened only while it is a regular file inside the wiki. */
+    openStatusFile(root, name) {
+        const path = join(root, name);
+        const real = realpath(path);
+        const rootReal = realpath(root);
+        if (!real || !rootReal || !isWithin(real, rootReal))
+            return null;
+        const entry = lstat(path);
+        return entry?.isFile() ? this.openVerified(path, entry) : null;
+    }
+    statusFileMtime(root, name) {
+        const fd = this.openStatusFile(root, name);
+        if (fd === null)
+            return undefined;
+        try {
+            return fstatSync(fd).mtimeMs;
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    /**
+     * Python `_llm_wiki_last_writer`: `updated_by` / `writer` / `author` from the newest page's frontmatter (200 lines),
+     * else the first `## [date] action |` heading in `log.md` (5,000 lines) as `ai-agent (<action>)`, else `ai-agent`.
+     */
+    lastWriter(root, pages) {
+        const rootReal = realpath(root) ?? root;
+        let latest = null;
+        let latestMtime = -1;
+        for (const page of pages) {
+            const real = realpath(page.target);
+            const st = real && isWithin(real, rootReal) ? stat(page.target) : undefined;
+            if (st && sameFile(st, page) && st.mtimeMs > latestMtime) {
+                latest = page;
+                latestMtime = st.mtimeMs;
+            }
+        }
+        const fd = latest ? this.openVerified(latest.target, latest) : null;
+        if (fd !== null) {
+            try {
+                const lines = this.lines(fd, 201);
+                const first = lines.next();
+                if (!first.done && first.value.trim() === '---') {
+                    for (const line of lines) {
+                        const stripped = line.trim();
+                        if (stripped === '---')
+                            break;
+                        const key = ['updated_by', 'writer', 'author'].find((k) => stripped.toLowerCase().startsWith(`${k}:`));
+                        const value = key ? stripped.slice(stripped.indexOf(':') + 1).trim() : '';
+                        if (value)
+                            return value;
+                    }
+                }
+            }
+            catch { /* unreadable */ }
+            finally {
+                closeSync(fd);
+            }
+        }
+        const logFd = this.openStatusFile(root, 'log.md');
+        if (logFd !== null) {
+            try {
+                for (const line of this.lines(logFd, 5000)) {
+                    const stripped = line.trim();
+                    if (!stripped.startsWith('## [') || !stripped.includes('|'))
+                        continue;
+                    const tail = stripped.includes(']') ? stripped.slice(stripped.indexOf(']') + 1).trim() : '';
+                    return `ai-agent (${tail ? (tail.split(/\s+/)[0] ?? 'update') : 'update'})`;
+                }
+            }
+            catch { /* unreadable */ }
+            finally {
+                closeSync(logFd);
+            }
+        }
+        return 'ai-agent';
+    }
+    /** Python `_build_llm_wiki_status`: always answers, never with page bodies or the wiki path. */
+    status(location) {
+        const base = { available: false, enabled: false, status: 'missing', entry_count: 0, page_count: 0, raw_source_count: 0, last_updated: null, last_writer: 'ai-agent', path_configured: location.configured, path_source: location.source, toggle_available: false, toggle_reason: TOGGLE_REASON, docs_url: WIKI_DOCS_URL };
+        try {
+            const root = location.path;
+            const rootStat = stat(root);
+            if (!rootStat)
+                return base;
+            if (!rootStat.isDirectory())
+                return { ...base, status: 'not_directory' };
+            const verified = [];
+            for (const entry of this.allowlistedEntries(root).values()) {
+                const st = stat(entry.target);
+                if (st && sameFile(st, entry))
+                    verified.push({ entry, st });
+            }
+            const mtimes = [...['SCHEMA.md', 'index.md', 'log.md'].map((n) => this.statusFileMtime(root, n)), ...verified.map((v) => v.st.mtimeMs)].filter((m) => m !== undefined);
+            const latest = mtimes.length ? Math.max(...mtimes) : 0;
+            return {
+                ...base, available: true, enabled: true, status: verified.length ? 'ready' : 'empty', entry_count: verified.length, page_count: verified.length,
+                raw_source_count: countRawFiles(join(root, 'raw')), last_updated: latest ? isoSeconds(latest) : null, last_writer: this.lastWriter(root, verified.map((v) => v.entry)),
+            };
+        }
+        catch (error) {
+            return { ...base, path_configured: false, path_source: 'unknown', toggle_reason: 'Unable to inspect LLM Wiki status safely.', status: 'error', error: error instanceof Error ? error.constructor.name : 'Error' };
+        }
+    }
+    /** `GET /api/wiki/browse`: listed pages sorted case-insensitively, skipping any whose identity changed. */
+    browse(location) {
+        if (!stat(location.path)?.isDirectory())
+            throw new HttpFailure(404, 'Wiki not configured or directory not found');
+        const pages = [];
+        const key = (rel) => rel.toLowerCase();
+        for (const [rel, entry] of [...this.allowlistedEntries(location.path)].sort(([a], [b]) => (key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0))) {
+            const st = stat(entry.target);
+            if (st && sameFile(st, entry))
+                pages.push({ name: basename(rel), path: rel, size: st.size, mtime: Math.floor(st.mtimeMs / 1000) });
+        }
+        return { pages };
+    }
+    /** `GET /api/wiki/page`: one canonical, allowlisted relpath, read through the identity-checked open, cut at 2 MiB. */
+    page(location, path) {
+        const root = location.path;
+        if (!path)
+            throw new HttpFailure(400, 'Wiki not configured or path not provided');
+        const parts = path.split('/');
+        // A `..` or empty or `.` segment is refused; `v1..v2.md` is a legitimate name.
+        if (path.includes('\\') || isAbsolute(path) || parts.some((p) => p === '..' || p === '' || p === '.'))
+            throw new HttpFailure(400, 'Invalid path');
+        const resolved = resolvePathLikePython(join(root, path));
+        if (!isWithin(resolved, resolvePathLikePython(root)))
+            throw new HttpFailure(400, 'Invalid path');
+        const entry = this.allowlistedEntries(resolvePathLikePython(root)).get(path);
+        if (entry?.target !== resolved)
+            throw new HttpFailure(404, 'Page not found');
+        let fd;
+        try {
+            fd = this.openNoFollow(entry.target);
+        }
+        catch (error) {
+            const code = error.code;
+            throw new HttpFailure(404, code === 'ENOENT' || code === 'EISDIR' ? 'Page not found' : 'Could not read page');
+        }
+        try {
+            if (!sameFile(fstatSync(fd), entry))
+                throw new HttpFailure(404, 'Page not found');
+            const buf = Buffer.alloc(MAX_PAGE_BYTES);
+            let total = 0;
+            for (let n = 1; n > 0 && total < buf.length; total += n)
+                n = readSync(fd, buf, total, buf.length - total, null);
+            return { content: buf.subarray(0, total).toString('utf8'), path };
+        }
+        catch (error) {
+            if (error instanceof HttpFailure)
+                throw error;
+            throw new HttpFailure(404, 'Could not read page');
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+}
+/** The process-wide allowlist cache shared by the wiki routes. */
+export const wikiPages = new WikiPages();
+//# sourceMappingURL=wiki.js.map

package/dist/tools/wiki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiki.js","sourceRoot":"","sources":["../../src/tools/wiki.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAc,MAAM,SAAS,CAAA;AACvJ,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAA0B,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,iGAAiG,CAAA;AAC9H,MAAM,QAAQ,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;AACnE,kGAAkG;AAClG,MAAM,SAAS,GAAG,MAAM,CAAA;AACxB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5H,MAAM,aAAa,GAAG,iHAAiH,CAAA;AACvI,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAA;AAM7F,MAAM,QAAQ,GAAG,CAAC,EAAS,EAAE,KAAmC,EAAW,EAAE,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAA;AAC1H,MAAM,OAAO,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5G,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAiB,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,IAAI,CAAA;AAAC,CAAC,CAAC,CAAC,CAAA;AACpH,4IAA4I;AAC5I,MAAM,IAAI,GAAG,CAAC,IAAY,EAAqB,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAA;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,SAAS,CAAA;AAAC,CAAC,CAAC,CAAC,CAAA;AAC9G,MAAM,KAAK,GAAG,CAAC,IAAY,EAAqB,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,SAAS,CAAA;AAAC,CAAC,CAAC,CAAC,CAAA;AAEhH,oGAAoG;AACpG,SAAS,UAAU,CAAC,IAAY,EAAE,GAAuC;IACvE,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAA;AACnI,CAAC;AAED,uEAAuE;AACvE,SAAS,WAAW,CAAC,MAAc,EAAE,MAAc;IACjD,IAAI,KAAK,GAAY,MAAM,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,MAAM,CAAA;QACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACvF,CAAC;IACD,OAAO,KAAK,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuC,EAAE,WAAmB,EAAE,MAAc,EAAE,IAAY;IAC5H,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,kBAAkB,CAAC,WAAW,CAAC,CAAA;IAC1D,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QACxF,IAAI,GAAG;YAAE,MAAM,GAAG,yBAAyB,CAAA;IAC7C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,GAAG,IAAI,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,SAAS,EAAE,CAAA;AAC/G,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,IAAI,CAAC;QAAC,OAAO,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AACrH,CAAC;AAED,qGAAqG;AACrG,SAAS,UAAU,CAAC,EAAU;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IAC/D,OAAO,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;AAC7E,CAAC;AAED;;;GAGG;AACH,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAW,EAAE,MAAwB;IAClD,IAAI,KAAK,CAAA;IACT,IAAI,CAAC;QAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAM;IAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,OAAM;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAA;QAClD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC3B,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE;QAAE,OAAO,CAAC,CAAA;IAC9E,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE;YAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,OAAO,SAAS;IAGS;IAFZ,KAAK,GAAG,IAAI,GAAG,EAAqE,CAAA;IAErG,YAA6B,OAAkE,EAAE;QAApE,SAAI,GAAJ,IAAI,CAAgE;IAAG,CAAC;IAErG,mGAAmG;IAC3F,SAAS,CAAC,IAAY;QAC5B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,IAAI,CAAC;gBAAC,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,GAAG,CAAC,IAAI,CAAA;YAAC,CAAC;QAClK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,8CAA8C;IAC9C,iBAAiB,CAAC,IAAY;QAC5B,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5D,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAA;QACxD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;YACrC,mGAAmG;YACnG,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAQ;YACnG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAE,SAAQ;gBAClF,IAAI,CAAC;oBACH,kHAAkH;oBAClH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC;wBAAE,SAAQ;oBAC7E,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC/C,IAAI,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;wBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACrG,CAAC;gBAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,IAAY;QACpB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI,GAAG,GAAG,MAAM,CAAC,SAAS;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QACrF,OAAO,CAAC,GAAG,KAAK,CAAC,CAAA;IACnB,CAAC;IAED,6HAA6H;IAC7H,kBAAkB,CAAC,IAAY;QAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAA;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAA;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;gBACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBACjD,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;gBAChF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC1C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAAE,SAAQ;gBACxH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;gBAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM;oBAAE,SAAQ;gBACpF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;YAC7E,CAAC;YAAC,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,4GAA4G;IAC5G,YAAY,CAAC,IAAY;QACvB,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC/B,CAAC;IAED,kGAAkG;IAC1F,YAAY,CAAC,IAAY,EAAE,QAAsC;QACvE,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAA;QAAC,CAAC;QAC1D,IAAI,CAAC;YAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;gBAAE,OAAO,EAAE,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACrF,SAAS,CAAC,EAAE,CAAC,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8GAA8G;IACtG,CAAC,KAAK,CAAC,EAAU,EAAE,QAAgB;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAA;QACnC,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7G,IAAI,IAAI,CAAC,CAAA;YACT,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAA;YACtF,IAAI,EAAE,CAAA;YACN,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,OAAO,EAAE,IAAI,QAAQ;oBAAE,OAAM;gBACjC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;gBAC9B,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;YACjC,CAAC;YACD,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,IAAI,OAAO,IAAI,OAAO,GAAG,QAAQ;oBAAE,MAAM,OAAO,CAAA;gBAChD,OAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,2HAA2H;IACnH,cAAc,CAAC,IAAY,EAAE,IAAY;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;QACzB,OAAO,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,CAAC;IAEO,eAAe,CAAC,IAAY,EAAE,IAAY;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QACjC,IAAI,CAAC;YAAC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,KAAkB;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;QACvC,IAAI,MAAM,GAAqB,IAAI,CAAA;QACnC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAA;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAClC,MAAM,EAAE,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3E,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,GAAG,WAAW,EAAE,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,WAAW,GAAG,EAAE,CAAC,OAAO,CAAA;YAAC,CAAC;QACvG,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACnE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;gBACjC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;gBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;oBAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;wBAC5B,IAAI,QAAQ,KAAK,KAAK;4BAAE,MAAK;wBAC7B,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;wBACtG,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;wBACzE,IAAI,KAAK;4BAAE,OAAO,KAAK,CAAA;oBACzB,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAAS,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YAAC,CAAC;QACxD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;oBAC5B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,SAAQ;oBACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;oBAC3F,OAAO,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAA;gBAC7E,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;oBAAS,CAAC;gBAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAAC,CAAC;QAC3D,CAAC;QACD,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,QAAsB;QAC3B,MAAM,IAAI,GAAS,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAA;QAC/T,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;YAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3B,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAC1B,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAAE,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;YACxE,MAAM,QAAQ,GAAsC,EAAE,CAAA;YACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC3D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBAC7B,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;YAC7D,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;YACnL,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACtD,OAAO;gBACL,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM;gBAC/I,gBAAgB,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;aACvK,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,2CAA2C,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;QACnN,CAAC;IACH,CAAC;IAED,2GAA2G;IAC3G,MAAM,CAAC,QAAsB;QAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,4CAA4C,CAAC,CAAA;QACjH,MAAM,KAAK,GAAW,EAAE,CAAA;QACxB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAA;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5I,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC7B,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAA;QACpI,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAA;IAClB,CAAC;IAED,sHAAsH;IACtH,IAAI,CAAC,QAAsB,EAAE,IAAY;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAA;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC7B,+EAA+E;QAC/E,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QACjJ,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QACxD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;QAChG,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5E,IAAI,KAAK,EAAE,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;QAC5E,IAAI,EAAU,CAAA;QACd,IAAI,CAAC;YAAC,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;YAClD,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAA;QAC/G,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;YACjF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;YACxC,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC;gBAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,IAAI,CAAC,CAAA;YAC/G,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAA;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,KAAK,CAAA;YAC7C,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;QACnD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAA;QACf,CAAC;IACH,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAA"}

package/dist/workspace/escape.d.ts

@@ -0,0 +1,61 @@
+import { type DirEntry } from './fs.js';
+import { type FilePreview } from './preview.js';
+export declare const ESCAPE_GRANT_TTL_SECONDS = 300;
+/** Any failed re-check: the client asks for a new grant (403). */
+export declare class EscapeGrantExpired extends Error {
+    constructor();
+}
+interface RootId {
+    dev: number;
+    ino: number;
+}
+export interface EscapeRequest {
+    surfacePath: string;
+    requestPath: string;
+    externalRoot: string;
+    rootId: RootId;
+    externalRel: string;
+}
+/** Run `fn` with every anchored open of the grant root held to the inode the grant was minted for. */
+export declare function anchoredAt<T>(req: EscapeRequest, fn: () => T): T;
+/** Python `_normalize_workspace_rel_path`: POSIX-normalised and workspace-relative; `..` and absolute paths fail. */
+export declare function normalizeWorkspaceRelPath(rel: string): string;
+export declare class EscapeGrants {
+    private readonly now;
+    private readonly grants;
+    constructor(now: () => number);
+    /** Mint a grant for one surfaced escape-target symlink. */
+    authorize(workspace: string, sessionId: string, profile: string | null, rel: string): {
+        token: string;
+        path: string;
+        is_dir: boolean;
+        expires_at: number;
+        expires_in: number;
+        read_only: true;
+    };
+    /**
+     * Python `resolve_authorized_escape_request`: re-check the grant, then re-root a request path under the link onto
+     * the grant root. A path outside the link answers "Path traversal blocked".
+     */
+    resolve(workspace: string, sessionId: string, profile: string | null, token: string, rel: string): EscapeRequest;
+    /** Python `list_authorized_escape_dir`: entries re-pathed under the link; a target outside the grant root is dropped. */
+    list(req: EscapeRequest): {
+        path: string;
+        entries: (DirEntry & {
+            escape_read_only: true;
+        })[];
+        signature: string;
+        virtual_root: string;
+        read_only: true;
+    };
+    /** Python `read_authorized_escape_file_content`, with the `/api/file` preview kind. */
+    read(req: EscapeRequest): FilePreview & {
+        escape_read_only: true;
+    };
+    /** Python `raw_authorized_escape_target`: the file to serve, anchored at the grant root. */
+    rawTarget(req: EscapeRequest): string;
+    /** Python `_escape_authorization_record`: the link must still escape to the same reachable, non-system target and root inode. */
+    private check;
+    private prune;
+}
+export {};

package/dist/workspace/escape.js

@@ -0,0 +1,149 @@
+/**
+ * Read-only escape grants (Python `workspace.py` `authorize_escape_target` and friends, TAL-263): a workspace symlink
+ * whose target sits outside the workspace opens through a short-lived token scoped to that one link. A directory
+ * target anchors the grant at the target; a file target anchors it at the parent with the file as the only reachable
+ * entry. Every use re-checks the link, and every read stays anchored at the grant root, so nested escaping links stay
+ * display-only.
+ */
+import { randomBytes } from 'node:crypto';
+import { lstatSync, statSync } from 'node:fs';
+import { basename, dirname, join, posix, relative } from 'node:path';
+import { stripSurroundingQuotes, isBlockedSystemPath } from './workspaces.js';
+import { isWithin, resolvePathLikePython } from './paths.js';
+import { dirSignature, listDir, NotFoundError, PathTraversalError, safeResolveWs, withPinnedRoot } from './fs.js';
+import { readFilePreview } from './preview.js';
+export const ESCAPE_GRANT_TTL_SECONDS = 300;
+/** Any failed re-check: the client asks for a new grant (403). */
+export class EscapeGrantExpired extends Error {
+    constructor() { super('Escape authorization expired'); }
+}
+/** Run `fn` with every anchored open of the grant root held to the inode the grant was minted for. */
+export function anchoredAt(req, fn) {
+    return withPinnedRoot(req.externalRoot, req.rootId, fn);
+}
+/** Python `_normalize_workspace_rel_path`: POSIX-normalised and workspace-relative; `..` and absolute paths fail. */
+export function normalizeWorkspaceRelPath(rel) {
+    const raw = stripSurroundingQuotes(rel).trim().replaceAll('\\', '/');
+    if (!raw || raw === '.')
+        return '.';
+    const norm = posix.normalize(raw).replace(/(.)\/+$/, '$1');
+    if (norm === '.')
+        return '.';
+    if (norm === '..' || norm.startsWith('../') || norm.startsWith('/'))
+        throw new PathTraversalError(`Path traversal blocked: ${rel}`);
+    return norm;
+}
+function virtualPath(root, rel) {
+    if (root === '.')
+        return rel;
+    return rel === '.' ? root : `${root}/${rel}`;
+}
+/** Python `_escape_surface_target`: the resolved target of an escaping, reachable, non-system workspace symlink. */
+function surfaceTarget(workspaceRoot, rel) {
+    const surfaceRel = normalizeWorkspaceRelPath(rel);
+    const parentRel = posix.dirname(surfaceRel);
+    const parent = parentRel === '.' ? workspaceRoot : safeResolveWs(workspaceRoot, parentRel);
+    const surface = join(parent, posix.basename(surfaceRel));
+    let isLink = false;
+    try {
+        isLink = lstatSync(surface).isSymbolicLink();
+    }
+    catch { /* missing */ }
+    if (!isLink)
+        throw new NotFoundError(`Path is not an escape-target symlink: ${rel}`);
+    let target;
+    try {
+        target = resolvePathLikePython(surface);
+        statSync(target);
+    }
+    catch {
+        throw new NotFoundError(`Path is no longer reachable: ${rel}`);
+    }
+    if (isWithin(target, workspaceRoot))
+        throw new NotFoundError(`Path does not escape workspace: ${rel}`);
+    if (isBlockedSystemPath(target))
+        throw new NotFoundError(`Path points to a system directory: ${target}`);
+    return target;
+}
+export class EscapeGrants {
+    now;
+    grants = new Map();
+    constructor(now) {
+        this.now = now;
+    }
+    /** Mint a grant for one surfaced escape-target symlink. */
+    authorize(workspace, sessionId, profile, rel) {
+        const workspaceRoot = resolvePathLikePython(workspace);
+        const target = surfaceTarget(workspaceRoot, rel);
+        const isDir = statSync(target).isDirectory();
+        const externalRoot = isDir ? target : dirname(target);
+        const { dev, ino } = statSync(externalRoot);
+        const token = randomBytes(24).toString('base64url');
+        const expiresAt = this.now() + ESCAPE_GRANT_TTL_SECONDS;
+        const surfacePath = normalizeWorkspaceRelPath(rel);
+        this.prune();
+        this.grants.set(token, { sessionId, profile, workspaceRoot, surfacePath, externalRoot, rootId: { dev, ino }, externalEntryRel: isDir ? '.' : basename(target), surfaceTarget: target, expiresAt });
+        return { token, path: surfacePath, is_dir: isDir, expires_at: expiresAt, expires_in: ESCAPE_GRANT_TTL_SECONDS, read_only: true };
+    }
+    /**
+     * Python `resolve_authorized_escape_request`: re-check the grant, then re-root a request path under the link onto
+     * the grant root. A path outside the link answers "Path traversal blocked".
+     */
+    resolve(workspace, sessionId, profile, token, rel) {
+        const grant = this.check(workspace, sessionId, profile, token);
+        const requestPath = normalizeWorkspaceRelPath(rel);
+        const under = grant.surfacePath === '.' ? requestPath : requestPath === grant.surfacePath ? '.' : requestPath.startsWith(`${grant.surfacePath}/`) ? requestPath.slice(grant.surfacePath.length + 1) : null;
+        if (under === null)
+            throw new PathTraversalError(`Path traversal blocked: ${rel}`);
+        const externalRel = grant.externalEntryRel === '.' ? under : under === '.' ? grant.externalEntryRel : `${grant.externalEntryRel}/${under}`;
+        return { surfacePath: grant.surfacePath, requestPath, externalRoot: grant.externalRoot, rootId: grant.rootId, externalRel };
+    }
+    /** Python `list_authorized_escape_dir`: entries re-pathed under the link; a target outside the grant root is dropped. */
+    list(req) {
+        const entries = anchoredAt(req, () => listDir(req.externalRoot, req.externalRel)).map((entry) => {
+            const out = { ...entry, path: virtualPath(req.surfacePath, entry.path), escape_read_only: true };
+            if (entry.target === undefined)
+                return out;
+            delete out.target;
+            if (isWithin(entry.target, req.externalRoot))
+                out.target = virtualPath(req.surfacePath, relative(req.externalRoot, entry.target) || '.');
+            return out;
+        });
+        return { path: req.requestPath, entries, signature: dirSignature(req.externalRoot, req.externalRel, entries), virtual_root: req.surfacePath, read_only: true };
+    }
+    /** Python `read_authorized_escape_file_content`, with the `/api/file` preview kind. */
+    read(req) {
+        return { ...anchoredAt(req, () => readFilePreview(req.externalRoot, req.externalRel)), path: req.requestPath, escape_read_only: true };
+    }
+    /** Python `raw_authorized_escape_target`: the file to serve, anchored at the grant root. */
+    rawTarget(req) {
+        return safeResolveWs(req.externalRoot, req.externalRel);
+    }
+    /** Python `_escape_authorization_record`: the link must still escape to the same reachable, non-system target and root inode. */
+    check(workspace, sessionId, profile, token) {
+        this.prune();
+        const grant = this.grants.get(token);
+        if (grant?.sessionId !== sessionId || grant.profile !== profile || grant.workspaceRoot !== resolvePathLikePython(workspace))
+            throw new EscapeGrantExpired();
+        try {
+            if (surfaceTarget(grant.workspaceRoot, grant.surfacePath) !== grant.surfaceTarget)
+                throw new EscapeGrantExpired();
+            const root = statSync(grant.externalRoot);
+            if (root.dev !== grant.rootId.dev || root.ino !== grant.rootId.ino)
+                throw new EscapeGrantExpired();
+        }
+        catch {
+            // A retargeted link kills the grant for good, even if it later points back.
+            this.grants.delete(token);
+            throw new EscapeGrantExpired();
+        }
+        return grant;
+    }
+    prune() {
+        const now = this.now();
+        for (const [token, grant] of this.grants)
+            if (grant.expiresAt <= now)
+                this.grants.delete(token);
+    }
+}
+//# sourceMappingURL=escape.js.map