@nanonets/graft 0.23.1 → 0.24.0

package/dist/trace/state.js

@@ -0,0 +1,98 @@
+/**
+ * Where Trail keeps what it knows about one live session on this machine:
+ * `~/.trail/sessions/<id>.json` (the transcript offset, the epoch, a pending
+ * offer). Only offsets, ids and counts go there, never what anyone typed.
+ * Folders are 0700 and files 0600: a session file says what someone was
+ * working on.
+ */
+import { createHash } from "node:crypto";
+import { chmodSync, closeSync, constants, fchmodSync, lstatSync, mkdirSync, openSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { trailHome } from "../notes/trail-home.js";
+import { writeJsonAtomic } from "../util/state.js";
+const POSIX = process.platform !== "win32";
+/** Opens a folder, and refuses a link (ELOOP) where the platform has O_NOFOLLOW. */
+const DIR_NOFOLLOW = constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | (constants.O_NOFOLLOW ?? 0);
+/**
+ * A folder only its owner can open, made if missing and tightened if it was
+ * looser. A link is left as it is: a chmod would follow it and tighten what
+ * it points to, which may be a folder that isn't Trail's (a person's dotfiles
+ * can link the Trail home; skills/own-folder.ts refuses links in place of
+ * Trail's own folders before anything is written). The mode is set through a
+ * descriptor that refuses a link, so one swapped in after the check isn't
+ * followed either.
+ */
+export function ensurePrivateDir(dir) {
+    try {
+        if (lstatSync(dir).isSymbolicLink())
+            return;
+    }
+    catch {
+        /* missing: made below */
+    }
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (!POSIX || constants.O_NOFOLLOW === undefined)
+        return;
+    try {
+        const fd = openSync(dir, DIR_NOFOLLOW);
+        try {
+            fchmodSync(fd, 0o700);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch (e) {
+        // A folder its owner can't read can't be opened, but can still be tightened.
+        if (e.code !== "EACCES")
+            return;
+        try {
+            if (!lstatSync(dir).isSymbolicLink())
+                chmodSync(dir, 0o700);
+        }
+        catch {
+            /* not ours to change */
+        }
+    }
+}
+/**
+ * JSON only its owner can read, written whole or not at all. Folders it has
+ * to make are made private; a folder that already exists is left as it is
+ * (a cursor kept beside a caller's own files must not lock them away).
+ */
+export function writePrivateJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeJsonAtomic(path, value, true, 0o600);
+}
+/**
+ * A session id as a file name. Hosts send UUIDs; anything else (a path, a
+ * dot, a very long string) is hashed, so a payload can never point the file
+ * outside the folder.
+ */
+function fileId(sessionId) {
+    if (/^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/.test(sessionId))
+        return sessionId;
+    return `h-${createHash("sha256").update(String(sessionId)).digest("hex").slice(0, 16)}`;
+}
+/** `~/.trail/sessions/<id>.json`; the folder exists (0700) once this returns, when it can be made. */
+export function sessionStatePath(sessionId) {
+    const dir = join(trailHome(), "sessions");
+    try {
+        ensurePrivateDir(dir);
+    }
+    catch {
+        /* read-only home: the caller's write fails and it fails open */
+    }
+    return join(dir, `${fileId(sessionId)}.json`);
+}
+/**
+ * `~/.trail/sessions/<id>.hooks.json`: where the turn-end hooks keep their
+ * own transcript cursor and what they carry between reads (the reply in
+ * progress, the responses already billed). Apart from `<id>.json`, whose
+ * cursor belongs to the skills catch-up, so neither reader moves the
+ * other's offset.
+ */
+export function hookCursorPath(sessionId) {
+    return sessionStatePath(sessionId).replace(/\.json$/, ".hooks.json");
+}
+//# sourceMappingURL=state.js.map

package/dist/trace/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/trace/state.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC3C,oFAAoF;AACpF,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;AAErG;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;YAAE,OAAO;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,6EAA6E;QAC7E,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC3D,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;gBAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC3D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,SAAiB;IAC/B,IAAI,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AACvE,CAAC"}

package/dist/trace/tamper-code.d.ts

@@ -0,0 +1,9 @@
+export declare const SHELLS: RegExp;
+/** Program code that hands a guarded path to a call that writes it. `guardedLiteral`: a string literal names one. */
+export declare function codeWrites(code: string, guardedLiteral: (literal: string) => boolean): boolean;
+/**
+ * The code an interpreter or shell runs from its own words (`-c`, `-e`), else from its stdin: a here-string, its
+ * heredoc bodies, or what the pipeline's earlier stages hand it (`piped`, g5 review); null when it runs a file.
+ */
+export declare function programCode(prog: string, w: string[], bodies: string[], piped?: string | null): string | null;
+//# sourceMappingURL=tamper-code.d.ts.map

package/dist/trace/tamper-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tamper-code.d.ts","sourceRoot":"","sources":["../../src/trace/tamper-code.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,MAAM,QAAqB,CAAC;AAuEzC,qHAAqH;AACrH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAgC9F;AAcD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,GAAE,MAAM,GAAG,IAAW,GAAG,MAAM,GAAG,IAAI,CAqBnH"}

package/dist/trace/tamper-code.js

@@ -0,0 +1,174 @@
+/**
+ * The tamper check's reading of program code (design 4.1, split from
+ * `tamper.ts`): whether code an interpreter runs hands a protected path to a
+ * call that writes it, and where that code comes from (`-c`/`-e`, a heredoc,
+ * a here-string, or the pipeline feeding its stdin). A literal path is judged
+ * by the caller (`guardedLiteral`); a home folder joined with `.trail` or the
+ * host's transcripts folder is judged here.
+ */
+import { unquote } from './shell-scan.js';
+export const SHELLS = /^(?:ba|z|da)?sh$/;
+const HOME_REF = /\b(?:homedir\(\)|Path\.home\(\)|expanduser\(|environ(?:\.get\(|\[)\s*['"]HOME|process\.env\.HOME\b|getenv\(\s*['"]HOME|ENV\[\s*['"]HOME|Dir\.home\b|ENV\{\s*['"]?HOME)/;
+const TRAIL_PART = /['"`/]\.trail(?![\w.-])/;
+/** The host's transcripts joined onto a home folder, outside a project's memory/ folder (Claude Code's own notes). */
+const PROJECTS_PART = /['"`/]\.claude\/projects\b(?![^'"`\n]*\/memory\/)/;
+const TRAIL_ENV = /\b(?:environ(?:\.get\(|\[)\s*['"]TRAIL_HOME|process\.env\.TRAIL_HOME\b|getenv\(\s*['"]TRAIL_HOME|ENV\[\s*['"]TRAIL_HOME)/;
+const ASSIGNMENT = /^\s*(?:(?:const|let|var|my|local)\s+)?\$?([A-Za-z_]\w*)\s*(?::\s*[\w.[\]]+\s*)?=(?!=)\s*([^\n]+)$/;
+/** Calls that build a path around what they are given: `Path(`, `os.path.expanduser(`, `path.join(`. */
+const WRAPS = String.raw `^\s*(?:(?:[\w.]+\.)?(?:Path|PurePath|expanduser|expandvars|abspath|realpath|join|resolve|expand_path|normpath)\(\s*)*`;
+const PATHY_LITERAL = new RegExp(`${WRAPS}[frbFRB]?(['"\`])((?:(?!\\1)[^\\\\\\n]|\\\\.)*)\\1`);
+/** A path expression that starts from a variable: `os.path.join(base, 'x')`, `root / 'runs'`. */
+const HELD_FROM = new RegExp(`${WRAPS}([A-Za-z_]\\w*)\\b`);
+/** What may follow the path in a path expression: closing parens, joins, more parts; never a read or a parse. */
+const PATH_REST = /^(?:[\s)/+,\w]|\.(?:resolve|expanduser|absolute)\(\)|'[^'\n]*'|"[^"\n]*")*$/;
+/** Calls whose path argument(s) they write: `first` arg, both of the first `two` (copy, move), or a write `mode`. */
+const ARG_CALLS = [
+    [/\b(?:open|fopen|openSync)\(/g, 'mode'],
+    [/\b(?:writeFile|appendFile|createWriteStream|outputFile|writeJson|truncate|rmSync|rmdir|unlink|mkdir|makedirs|removedirs|remove|rmtree|to_csv|to_json|to_parquet|to_excel)(?:Sync)?\(/g, 'first'],
+    [/\b(?:fs|fsp|promises)\.rm\(/g, 'first'],
+    [/\bFile\.(?:write|delete|unlink)\(/g, 'first'],
+    [/\b(?:rename|renameSync|copyFile|copyFileSync|cpSync|copy|copy2|copyfile|copytree|move|symlink|symlinkSync|link)\(/g, 'two'],
+    [/\b(?:fs|fsp|promises)\.cp\(|\bos\.replace\(|\bFileUtils\.\w+\(/g, 'two'],
+];
+/** Methods that write their receiver: `Path(x).write_text(...)`. */
+const RECEIVER_CALLS = /\.(?:write_text|write_bytes|unlink|touch|mkdir|rmdir|rename|open)\(/g;
+const WRITE_MODE = /^\s*(?:mode\s*=\s*)?[rbuf]?['"][^'"]*[wax+]/;
+/** The arguments of the call whose `(` is at `open`, split at top-level commas (at most 2000 characters read). */
+function callArgs(code, open) {
+    const out = [];
+    let depth = 0;
+    let from = open + 1;
+    const end = Math.min(code.length, open + 2000);
+    for (let i = open + 1; i < end; i++) {
+        const c = code[i];
+        if (c === '"' || c === "'" || c === '`') {
+            for (i++; i < end && code[i] !== c; i++)
+                if (code[i] === '\\')
+                    i++;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{')
+            depth++;
+        else if (c === ')' || c === ']' || c === '}') {
+            if (depth === 0) {
+                out.push(code.slice(from, i));
+                return out;
+            }
+            depth--;
+        }
+        else if (c === ',' && depth === 0) {
+            out.push(code.slice(from, i));
+            from = i + 1;
+        }
+    }
+    out.push(code.slice(from, end));
+    return out;
+}
+/** The expression a method is called on: `Path(x)`, `(home / '.trail')`, `p`. */
+function receiverBefore(code, dot) {
+    let j = dot - 1;
+    while (j >= 0) {
+        const c = code[j];
+        if (c === ')' || c === ']') {
+            let depth = 0;
+            for (; j >= 0; j--) {
+                if (code[j] === ')' || code[j] === ']')
+                    depth++;
+                else if ((code[j] === '(' || code[j] === '[') && --depth === 0)
+                    break;
+            }
+            j--;
+        }
+        else if (/[\w.$]/.test(c))
+            j--;
+        else
+            break;
+    }
+    return code.slice(j + 1, dot);
+}
+/** Program code that hands a guarded path to a call that writes it. `guardedLiteral`: a string literal names one. */
+export function codeWrites(code, guardedLiteral) {
+    const pathy = (text) => {
+        const m = PATHY_LITERAL.exec(text);
+        const v = m?.[2];
+        if (v && PATH_REST.test(text.slice(m.index + m[0].length)) && guardedLiteral(v))
+            return true;
+        return (HOME_REF.test(text) && (TRAIL_PART.test(text) || PROJECTS_PART.test(text))) || TRAIL_ENV.test(text);
+    };
+    // Variables set to a guarded path, or a path built from one (assignments in order, twice for a late one).
+    const held = new Set();
+    const statements = code.split(/\n|;/);
+    for (let pass = 0; pass < 2; pass++) {
+        for (const s of statements) {
+            const m = ASSIGNMENT.exec(s);
+            if (!m || held.has(m[1]))
+                continue;
+            const value = m[2];
+            const from = HELD_FROM.exec(value);
+            if (pathy(value) || (from !== null && held.has(from[1]) && PATH_REST.test(value.slice(from[0].length))))
+                held.add(m[1]);
+        }
+    }
+    const mentionsHeld = (arg) => held.size > 0 && (arg.match(/[A-Za-z_]\w*/g) ?? []).some((id) => held.has(id));
+    const target = (arg) => arg !== undefined && (pathy(arg) || mentionsHeld(arg));
+    for (const [re, which] of ARG_CALLS) {
+        for (const m of code.matchAll(re)) {
+            const args = callArgs(code, m.index + m[0].length - 1);
+            if (which === 'mode' ? args.slice(1).some((a) => WRITE_MODE.test(a)) && target(args[0]) : target(args[0]) || (which === 'two' && target(args[1])))
+                return true;
+        }
+    }
+    for (const m of code.matchAll(RECEIVER_CALLS)) {
+        if (m[0] === '.open(' && !callArgs(code, m.index + m[0].length - 1).some((a) => WRITE_MODE.test(a)))
+            continue;
+        if (target(receiverBefore(code, m.index)))
+            return true;
+    }
+    return false;
+}
+/** Flags whose next word is the program, per interpreter family. */
+function codeFlag(prog, a) {
+    if (SHELLS.test(prog))
+        return /^-[a-z]*c$/.test(a);
+    if (/^python/.test(prog))
+        return a === '-c';
+    if (prog === 'php')
+        return a === '-r';
+    if (prog === 'ruby' || prog === 'perl')
+        return a === '-e' || a === '-E';
+    return a === '-e' || a === '--eval' || a === '-p' || a === '--print';
+}
+/** A redirect whose target is the next word (`>`, `2>`, `<<`), not one written onto it (`>out.txt`). */
+const BARE_REDIRECT = /^(?:\d+|&)?(?:>>?|>\||<<?|<>|&>>?)$/;
+/**
+ * The code an interpreter or shell runs from its own words (`-c`, `-e`), else from its stdin: a here-string, its
+ * heredoc bodies, or what the pipeline's earlier stages hand it (`piped`, g5 review); null when it runs a file.
+ */
+export function programCode(prog, w, bodies, piped = null) {
+    const parts = [];
+    let script = false;
+    let here = null;
+    for (let i = 1; i < w.length; i++) {
+        const a = w[i];
+        if (a.startsWith('<<<')) {
+            here = unquote(a.length > 3 ? a.slice(3) : (w[++i] ?? ''));
+            continue;
+        }
+        if (/^(?:\d*[<>]|&>)/.test(a)) {
+            if (BARE_REDIRECT.test(a))
+                i++;
+            continue;
+        }
+        if (codeFlag(prog, a) && w[i + 1] !== undefined)
+            parts.push(unquote(w[++i]));
+        else if (!a.startsWith('-'))
+            script = true;
+    }
+    if (parts.length)
+        return parts.join('\n');
+    if (script)
+        return null;
+    const stdin = [here, ...bodies, piped].filter((x) => !!x);
+    return stdin.length ? stdin.join('\n') : null;
+}
+//# sourceMappingURL=tamper-code.js.map

package/dist/trace/tamper-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tamper-code.js","sourceRoot":"","sources":["../../src/trace/tamper-code.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,MAAM,GAAG,kBAAkB,CAAC;AACzC,MAAM,QAAQ,GAAG,wKAAwK,CAAC;AAC1L,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,sHAAsH;AACtH,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAC1E,MAAM,SAAS,GAAG,0HAA0H,CAAC;AAC7I,MAAM,UAAU,GAAG,mGAAmG,CAAC;AACvH,wGAAwG;AACxG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA,uHAAuH,CAAC;AAChJ,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,oDAAoD,CAAC,CAAC;AAC/F,iGAAiG;AACjG,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;AAC3D,iHAAiH;AACjH,MAAM,SAAS,GAAG,6EAA6E,CAAC;AAEhG,qHAAqH;AACrH,MAAM,SAAS,GAA8C;IAC3D,CAAC,8BAA8B,EAAE,MAAM,CAAC;IACxC,CAAC,uLAAuL,EAAE,OAAO,CAAC;IAClM,CAAC,8BAA8B,EAAE,OAAO,CAAC;IACzC,CAAC,oCAAoC,EAAE,OAAO,CAAC;IAC/C,CAAC,oHAAoH,EAAE,KAAK,CAAC;IAC7H,CAAC,iEAAiE,EAAE,KAAK,CAAC;CAC3E,CAAC;AACF,oEAAoE;AACpE,MAAM,cAAc,GAAG,sEAAsE,CAAC;AAC9F,MAAM,UAAU,GAAG,6CAA6C,CAAC;AAEjE,kHAAkH;AAClH,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC;YAAC,CAAC;YAC/D,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,IAAY,EAAE,GAAW;IAC/C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;oBAAE,KAAK,EAAE,CAAC;qBAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;oBAAE,MAAM;YACxE,CAAC;YACD,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAC;;YAC5B,MAAM;IACb,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,cAA4C;IACnF,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAE,CAAC,KAAK,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/F,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9G,CAAC,CAAC;IACF,0GAA0G;IAC1G,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;gBAAE,SAAS;YACpC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACpB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,CAAC,GAAuB,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjK,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAC/G,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,IAAY,EAAE,CAAS;IACvC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5C,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtC,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC;IACxE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,CAAC;AACvE,CAAC;AAED,wGAAwG;AACxG,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAE5D;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,CAAW,EAAE,MAAgB,EAAE,QAAuB,IAAI;IAClG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC,CAAC;aACzE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC"}

package/dist/trace/tamper-git.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Which folders a git command writes, for the tamper check (D59e): `git -C ~/.trail commit`, `--git-dir`,
+ * a shell already sitting in Trail's home, a clone into it. Commands that only read (status, log, diff, the
+ * list forms of branch, tag, remote, config and stash) write nothing. Pure: words in, folders out.
+ */
+/**
+ * The folders a git command changes (D59e): the folder its `-C` chain names (or the shell's), its `--git-dir`
+ * and `--work-tree`, and the folder a clone or init makes. Empty when the command only reads. `pathOf` turns a
+ * word into an absolute path from a folder (null when only the shell could know it).
+ */
+export declare function gitWriteTargets(w: string[], folder: string | null, pathOf: (word: string, from: string | null) => string | null): Array<string | null>;
+//# sourceMappingURL=tamper-git.d.ts.map

package/dist/trace/tamper-git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tamper-git.d.ts","sourceRoot":"","sources":["../../src/trace/tamper-git.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkCH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBtJ"}

package/dist/trace/tamper-git.js

@@ -0,0 +1,77 @@
+/**
+ * Which folders a git command writes, for the tamper check (D59e): `git -C ~/.trail commit`, `--git-dir`,
+ * a shell already sitting in Trail's home, a clone into it. Commands that only read (status, log, diff, the
+ * list forms of branch, tag, remote, config and stash) write nothing. Pure: words in, folders out.
+ */
+/** git commands that only read the repository they run in (push and fetch leave its files as they are). */
+const GIT_READS = new Set(['status', 'log', 'diff', 'show', 'rev-parse', 'ls-files', 'ls-tree', 'ls-remote', 'cat-file', 'describe', 'blame',
+    'annotate', 'grep', 'shortlog', 'show-ref', 'for-each-ref', 'rev-list', 'merge-base', 'name-rev', 'whatchanged', 'version', 'help', 'var',
+    'check-ignore', 'check-attr', 'count-objects', 'verify-commit', 'verify-tag', 'cherry', 'range-diff', 'diff-tree', 'diff-files', 'diff-index',
+    'show-branch', 'fetch', 'push']);
+/** git's own options that take the next word. */
+const GIT_VALUE = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--exec-path', '--config-env', '--super-prefix']);
+const BRANCH_WRITE = /^(?:-[a-zA-Z]*[dDmMcCfu]|--(?:delete|move|copy|force|set-upstream-to|unset-upstream|edit-description|track|no-track|create-reflog))(?:=|$)/;
+const BRANCH_LIST = /^(?:-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at|--sort|--format)(?:=|$)/;
+const CONFIG_READ = /^(?:-l|--(?:get|get-all|get-regexp|get-urlmatch|list|get-color|get-colorbool))$/;
+const CONFIG_WRITE = /^(?:-e|--(?:unset|unset-all|add|replace-all|remove-section|rename-section|edit))$/;
+/** Whether `git <sub> <args>` changes the repository it runs in; the list forms of branch, tag, remote, config and stash read. */
+function gitSubWrites(sub, args) {
+    if (GIT_READS.has(sub))
+        return false;
+    const pos = args.filter((a) => !a.startsWith('-'));
+    const first = args[0] ?? '';
+    switch (sub) {
+        case 'branch': return args.some((a) => BRANCH_WRITE.test(a)) || (pos.length > 0 && !args.some((a) => BRANCH_LIST.test(a)));
+        case 'tag': return !(args.length === 0 || args.includes('-l') || args.includes('--list')) || args.some((a) => /^(?:-[a-zA-Z]*d|--delete)$/.test(a));
+        case 'remote': return !(args.length === 0 || ['-v', '--verbose', 'show', 'get-url'].includes(first));
+        case 'config':
+            if (args.includes('--global') || args.includes('--system'))
+                return false; // not this repository's files
+            return args.some((a) => CONFIG_WRITE.test(a)) || (!args.some((a) => CONFIG_READ.test(a)) && pos.length >= 2);
+        case 'stash': return !['list', 'show'].includes(first);
+        case 'worktree': return first !== 'list';
+        case 'reflog':
+        case 'notes':
+        case 'submodule': return !(args.length === 0 || first.startsWith('-') || ['show', 'list', 'status', 'summary'].includes(first));
+        case 'archive': return args.some((a) => a === '-o' || a.startsWith('--output'));
+        default: return true;
+    }
+}
+/**
+ * The folders a git command changes (D59e): the folder its `-C` chain names (or the shell's), its `--git-dir`
+ * and `--work-tree`, and the folder a clone or init makes. Empty when the command only reads. `pathOf` turns a
+ * word into an absolute path from a folder (null when only the shell could know it).
+ */
+export function gitWriteTargets(w, folder, pathOf) {
+    let dir = folder;
+    const dirs = [];
+    let i = 1;
+    for (; i < w.length; i++) {
+        const a = w[i];
+        if (!a.startsWith('-'))
+            break;
+        const eq = a.startsWith('--') ? a.indexOf('=') : -1;
+        const name = eq > 0 ? a.slice(0, eq) : a;
+        const value = eq > 0 ? a.slice(eq + 1) : GIT_VALUE.has(a) ? w[++i] : undefined;
+        if (value === undefined)
+            continue;
+        if (name === '-C')
+            dir = pathOf(value, dir);
+        else if (name === '--git-dir' || name === '--work-tree')
+            dirs.push(pathOf(value, dir));
+    }
+    const sub = w[i];
+    if (sub === undefined)
+        return [];
+    const args = w.slice(i + 1);
+    if (!gitSubWrites(sub, args))
+        return [];
+    dirs.push(dir);
+    if (sub === 'clone' || sub === 'init') {
+        const target = args.filter((a) => !a.startsWith('-'))[sub === 'clone' ? 1 : 0];
+        if (target !== undefined)
+            dirs.push(pathOf(target, dir));
+    }
+    return dirs;
+}
+//# sourceMappingURL=tamper-git.js.map

package/dist/trace/tamper-git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tamper-git.js","sourceRoot":"","sources":["../../src/trace/tamper-git.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,2GAA2G;AAC3G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO;IAC1I,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;IACzI,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY;IAC7I,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACnC,iDAAiD;AACjD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACpI,MAAM,YAAY,GAAG,4IAA4I,CAAC;AAClK,MAAM,WAAW,GAAG,iGAAiG,CAAC;AACtH,MAAM,WAAW,GAAG,iFAAiF,CAAC;AACtG,MAAM,YAAY,GAAG,mFAAmF,CAAC;AAEzG,kIAAkI;AAClI,SAAS,YAAY,CAAC,GAAW,EAAE,IAAc;IAC/C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpJ,KAAK,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACrG,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,8BAA8B;YACxG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAC/G,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,KAAK,UAAU,CAAC,CAAC,OAAO,KAAK,KAAK,MAAM,CAAC;QACzC,KAAK,QAAQ,CAAC;QAAC,KAAK,OAAO,CAAC;QAAC,KAAK,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7J,KAAK,SAAS,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,CAAW,EAAE,MAAqB,EAAE,MAA4D;IAC9H,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,MAAM,IAAI,GAAyB,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM;QAC9B,MAAM,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,IAAI,KAAK,IAAI;YAAE,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aACvC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,aAAa;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}