@oscharko-dev/keiko-tools 0.2.8 → 0.2.9

package/dist/git-worktree-adapter.d.ts

@@ -0,0 +1,78 @@
+import type { CommandRule, SandboxPolicy } from "./types.js";
+import { type ExecutableResolver, type HomeProvider, type SpawnFn } from "./exec.js";
+import type { WorkspaceInfo } from "@oscharko-dev/keiko-workspace";
+export declare const GIT_WORKTREE_COMMAND_RULES: readonly CommandRule[];
+export declare class GitWorktreeOperandError extends Error {
+    constructor(message: string);
+}
+export declare class GitWorktreeSpawnError extends Error {
+    constructor(message: string);
+}
+export declare function isSafeGitRefName(value: string): boolean;
+export declare function isSafeWorktreePathOperand(value: string): boolean;
+export interface AddWorktreeOperands {
+    readonly worktreePath: string;
+    readonly taskBranch: string;
+    readonly baseRef: string;
+}
+export declare function buildAddWorktreeArgv(operands: AddWorktreeOperands): readonly string[];
+export interface AddExistingBranchOperands {
+    readonly worktreePath: string;
+    readonly branch: string;
+}
+export declare function buildAddExistingBranchArgv(operands: AddExistingBranchOperands): readonly string[];
+export declare function buildListWorktreesArgv(): readonly string[];
+export interface RemoveWorktreeOperands {
+    readonly worktreePath: string;
+    readonly force: boolean;
+}
+export declare function buildRemoveWorktreeArgv(operands: RemoveWorktreeOperands): readonly string[];
+export declare function buildPruneWorktreesArgv(): readonly string[];
+export declare function buildWorktreeStatusArgv(): readonly string[];
+export declare function buildShowToplevelArgv(): readonly string[];
+export declare function buildRefResolvesArgv(ref: string): readonly string[];
+export declare function buildLocalBranchExistsArgv(branch: string): readonly string[];
+export interface WorktreeListEntry {
+    readonly path: string;
+    readonly head?: string;
+    readonly branch?: string;
+    readonly bare: boolean;
+    readonly detached: boolean;
+    readonly locked: boolean;
+}
+export declare function parseWorktreeListPorcelain(stdout: string): readonly WorktreeListEntry[];
+export interface WorktreeOperationResult {
+    readonly ok: boolean;
+    readonly exitCode: number | null;
+    readonly durationMs: number;
+    readonly timedOut: boolean;
+    readonly truncated: boolean;
+}
+export interface WorktreeStatusResult {
+    readonly ok: boolean;
+    readonly dirty: boolean;
+}
+export interface GitWorktreeAdapter {
+    readonly resolveRepositoryRoot: () => Promise<string | undefined>;
+    readonly refResolves: (ref: string) => Promise<boolean>;
+    readonly localBranchExists: (branch: string) => Promise<boolean>;
+    readonly listWorktrees: () => Promise<readonly WorktreeListEntry[]>;
+    readonly worktreeStatus: () => Promise<WorktreeStatusResult>;
+    readonly addWorktree: (operands: AddWorktreeOperands) => Promise<WorktreeOperationResult>;
+    readonly addWorktreeForExistingBranch: (operands: AddExistingBranchOperands) => Promise<WorktreeOperationResult>;
+    readonly removeWorktree: (operands: RemoveWorktreeOperands) => Promise<WorktreeOperationResult>;
+    readonly pruneWorktrees: () => Promise<WorktreeOperationResult>;
+}
+export interface NodeGitWorktreeAdapterDeps {
+    readonly workspace: WorkspaceInfo;
+    readonly processEnv?: NodeJS.ProcessEnv | undefined;
+    readonly now?: (() => number) | undefined;
+    readonly spawn?: SpawnFn | undefined;
+    readonly policy?: SandboxPolicy | undefined;
+    readonly resolveExecutable?: ExecutableResolver | undefined;
+    readonly home?: HomeProvider | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly timeoutMs?: number | undefined;
+}
+export declare function createNodeGitWorktreeAdapter(deps: NodeGitWorktreeAdapterDeps): GitWorktreeAdapter;
+//# sourceMappingURL=git-worktree-adapter.d.ts.map

package/dist/git-worktree-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-worktree-adapter.d.ts","sourceRoot":"","sources":["../src/git-worktree-adapter.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAiB,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAEjB,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAQnE,eAAO,MAAM,0BAA0B,EAAE,SAAS,WAAW,EA0B3D,CAAC;AAKH,qBAAa,uBAAwB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAInC;AAID,qBAAa,qBAAsB,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAInC;AAqBD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAUvD;AAMD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKhE;AAkBD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAKD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,MAAM,EAAE,CAKrF;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAKD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,yBAAyB,GAAG,SAAS,MAAM,EAAE,CAIjG;AAED,wBAAgB,sBAAsB,IAAI,SAAS,MAAM,EAAE,CAE1D;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAKD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,sBAAsB,GAAG,SAAS,MAAM,EAAE,CAG3F;AAED,wBAAgB,uBAAuB,IAAI,SAAS,MAAM,EAAE,CAE3D;AAKD,wBAAgB,uBAAuB,IAAI,SAAS,MAAM,EAAE,CAE3D;AAED,wBAAgB,qBAAqB,IAAI,SAAS,MAAM,EAAE,CAEzD;AAID,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGnE;AAID,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAG5E;AAID,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAmCD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,iBAAiB,EAAE,CAoBvF;AAID,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAKD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAClE,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IAEpE,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,mBAAmB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1F,QAAQ,CAAC,4BAA4B,EAAE,CACrC,QAAQ,EAAE,yBAAyB,KAChC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,sBAAsB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAChG,QAAQ,CAAC,cAAc,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AAkDD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B,GAAG,kBAAkB,CAkCjG"}

package/dist/git-worktree-adapter.js

@@ -0,0 +1,300 @@
+// Narrow managed-worktree adapter for governed task workspaces (Issue #445, Epic #443).
+//
+// This is the ONLY authority for the `git worktree` lifecycle. It runs strictly through the SAME
+// no-shell, allowlist-only spawn boundary as the read snapshot reader and the #470 mutation kernel
+// (keiko-tools `runCommand`), but with its OWN dedicated command allowlist that is STRUCTURALLY
+// SEPARATE from `GIT_MUTATION_COMMAND_RULES`. Its allowlist permits only the git `worktree` verb plus
+// the read-only `rev-parse` / `show-ref` inspection verbs — it can NEVER reach `branch`, `switch`,
+// `commit`, `add`, `restore`, `push`, `merge`, `pull`, `fetch`, or any other write subcommand. This
+// is the AC5 property: the adapter does not widen terminal Git mutation authority and cannot
+// duplicate the #470 branch/commit/publish/PR/merge execution surface.
+//
+// Every operand (branch name, base ref, worktree path) is validated BEFORE argv construction, so a
+// value can never masquerade as a flag or smuggle a shell metacharacter. The worktree path supplied
+// by the caller is an ABSOLUTE path the server has already proven realpath-contained inside the
+// Keiko-owned managed root; the adapter additionally rejects any operand that begins with `-`.
+//
+// Output is content-free to the caller: operation results carry exit code / duration / flags only.
+// `listWorktrees` parses `--porcelain` output into structured entries whose paths stay in-process for
+// idempotency and drift inference and are never persisted into evidence (mirrors `readStagedPaths`).
+import { isAbsolute } from "node:path";
+import { DEFAULT_SANDBOX_POLICY } from "./types.js";
+import { nodeSpawnFn, runCommand, } from "./exec.js";
+// The dedicated worktree-lifecycle allowlist. `worktree` covers add/list/remove/prune (the second
+// token is fixed by the builder, never caller-supplied); `rev-parse` and `show-ref` are read-only
+// inspection used for repository-root resolution, base-ref resolvability, and branch-conflict
+// detection. No write subcommand is reachable. Defense-in-depth `denyFlags` block the global flags
+// that would shift git's cwd, git-dir, or config (`-C`, `-c`, `--git-dir`, …) before subcommand
+// resolution, and `valueFlags` ensure such a flag's value can never be reinterpreted as the verb.
+export const GIT_WORKTREE_COMMAND_RULES = Object.freeze([
+    {
+        executable: "git",
+        // `status` (#448) is the read-only working-tree probe for live dirty detection. Like `rev-parse`
+        // and `show-ref` it cannot mutate, so adding it keeps the structural separation from
+        // GIT_MUTATION_COMMAND_RULES (no write subcommand is reachable) while letting the cleanup gate see
+        // uncommitted/untracked work before removing a worktree.
+        allowedSubcommands: Object.freeze(["worktree", "rev-parse", "show-ref", "status"]),
+        valueFlags: Object.freeze([
+            "-C",
+            "-c",
+            "--git-dir",
+            "--work-tree",
+            "--namespace",
+            "--exec-path",
+        ]),
+        denyFlags: Object.freeze([
+            "-C",
+            "-c",
+            "--config-env",
+            "--git-dir",
+            "--work-tree",
+            "--namespace",
+            "--exec-path",
+        ]),
+    },
+]);
+// Thrown by the pure argv builders when an operand fails validation BEFORE any spawn. The server
+// maps this to a content-free `unsafe-path` / `invalid-request` failure rather than leaking the
+// offending value.
+export class GitWorktreeOperandError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GitWorktreeOperandError";
+    }
+}
+// Thrown when a worktree command fails to spawn. A non-zero EXIT is NOT an exception — it is returned
+// as `{ ok: false, exitCode }` so the caller can classify it (e.g. branch conflict vs. dirty target).
+export class GitWorktreeSpawnError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GitWorktreeSpawnError";
+    }
+}
+// ─── Operand validation (pure) ───────────────────────────────────────────────────────────────────
+function hasControlOrNul(value) {
+    // Reject NUL and any C0 control character (incl. newline/tab) — none are legal in a git ref or in
+    // a path operand we are willing to pass to git. Iterating code points avoids a control-character
+    // regex literal.
+    for (let index = 0; index < value.length; index += 1) {
+        if (value.charCodeAt(index) <= 0x1f)
+            return true;
+    }
+    return false;
+}
+const UNSAFE_REF_PREFIXES = ["-", "/", "."];
+const UNSAFE_REF_SUFFIXES = ["/", ".", ".lock"];
+const UNSAFE_REF_SUBSTRINGS = ["..", "//", "@{"];
+// Conservative git ref-name allowlist. Stricter than `git check-ref-format` on purpose: refs Keiko
+// creates are server-derived, so we only need to accept the deterministic shape we emit and reject
+// anything that could be an option, a path traversal, or a refspec/glob metacharacter.
+export function isSafeGitRefName(value) {
+    if (value.length === 0 || value.length > 255 || hasControlOrNul(value))
+        return false;
+    if (UNSAFE_REF_PREFIXES.some((prefix) => value.startsWith(prefix)))
+        return false;
+    if (UNSAFE_REF_SUFFIXES.some((suffix) => value.endsWith(suffix)))
+        return false;
+    if (UNSAFE_REF_SUBSTRINGS.some((part) => value.includes(part)))
+        return false;
+    // Allowed: letters, digits, and a bounded punctuation set used by our `keiko/task/<id>` scheme.
+    if (!/^[A-Za-z0-9._\-/]+$/u.test(value))
+        return false;
+    // No git ref metacharacters: space ~ ^ : ? * [ \ are excluded by the allowlist above; this also
+    // rejects them defensively for readers of this predicate.
+    return !/[~^:?*[\\ ]/u.test(value);
+}
+// A worktree path operand must be an absolute path with no control bytes and must not begin with a
+// dash (so it cannot be parsed as an option). Containment inside the managed root is enforced by the
+// server BEFORE this adapter is called; this is the last-line argv guard, and it self-documents the
+// absolute-path invariant rather than relying on every caller to supply one.
+export function isSafeWorktreePathOperand(value) {
+    if (value.length === 0 || value.length > 4096)
+        return false;
+    if (hasControlOrNul(value))
+        return false;
+    if (value.startsWith("-"))
+        return false;
+    return isAbsolute(value);
+}
+function requireSafeRef(value, label) {
+    if (!isSafeGitRefName(value)) {
+        throw new GitWorktreeOperandError(`unsafe ${label}`);
+    }
+    return value;
+}
+function requireSafePath(value, label) {
+    if (!isSafeWorktreePathOperand(value)) {
+        throw new GitWorktreeOperandError(`unsafe ${label}`);
+    }
+    return value;
+}
+// `git worktree add -b <taskBranch> <path> <baseRef>` — atomically creates the dedicated task branch
+// from the approved base ref AND the managed worktree in one governed call. `--no-track` keeps the
+// new branch local-only (no implicit upstream); publish/track stays owned by #470.
+export function buildAddWorktreeArgv(operands) {
+    const branch = requireSafeRef(operands.taskBranch, "task branch name");
+    const base = requireSafeRef(operands.baseRef, "base ref");
+    const path = requireSafePath(operands.worktreePath, "worktree path");
+    return ["worktree", "add", "--no-track", "-b", branch, path, base];
+}
+// `git worktree add <path> <branch>` — reattaches an EXISTING managed branch to a fresh worktree
+// directory. Used only for retry-safe completion of a partially provisioned workspace whose branch
+// already exists but whose worktree directory is missing.
+export function buildAddExistingBranchArgv(operands) {
+    const branch = requireSafeRef(operands.branch, "branch name");
+    const path = requireSafePath(operands.worktreePath, "worktree path");
+    return ["worktree", "add", path, branch];
+}
+export function buildListWorktreesArgv() {
+    return ["worktree", "list", "--porcelain"];
+}
+// `git worktree remove [--force] <path>` — removes a managed worktree directory. Used for retry-safe
+// rollback of partial provisioning; `--force` is required to remove a worktree that git considers
+// dirty (a half-created checkout), and is server-decided, never caller-supplied.
+export function buildRemoveWorktreeArgv(operands) {
+    const path = requireSafePath(operands.worktreePath, "worktree path");
+    return operands.force ? ["worktree", "remove", "--force", path] : ["worktree", "remove", path];
+}
+export function buildPruneWorktreesArgv() {
+    return ["worktree", "prune"];
+}
+// `git status --porcelain` — the read-only working-tree probe (#448). Exit 0 with any output means the
+// worktree has uncommitted OR untracked changes (the conservative signal for a deletion gate). The
+// porcelain lines themselves never leave the adapter: the caller receives only a `dirty` boolean.
+export function buildWorktreeStatusArgv() {
+    return ["status", "--porcelain"];
+}
+export function buildShowToplevelArgv() {
+    return ["rev-parse", "--show-toplevel"];
+}
+// `git rev-parse --verify --quiet <ref>^{commit}` — exit 0 iff the ref resolves to a commit. Used to
+// confirm the approved base branch exists/resolves before provisioning.
+export function buildRefResolvesArgv(ref) {
+    const safe = requireSafeRef(ref, "base ref");
+    return ["rev-parse", "--verify", "--quiet", `${safe}^{commit}`];
+}
+// `git show-ref --verify --quiet refs/heads/<branch>` — exit 0 iff a LOCAL branch of that exact name
+// exists. Used to detect a branch-name conflict before creating the task branch.
+export function buildLocalBranchExistsArgv(branch) {
+    const safe = requireSafeRef(branch, "branch name");
+    return ["show-ref", "--verify", "--quiet", `refs/heads/${safe}`];
+}
+function blockToEntry(block) {
+    if (block === null)
+        return undefined;
+    return {
+        path: block.path,
+        ...(block.head !== undefined ? { head: block.head } : {}),
+        ...(block.branch !== undefined ? { branch: block.branch } : {}),
+        bare: block.bare,
+        detached: block.detached,
+        locked: block.locked,
+    };
+}
+// Applies one non-`worktree` attribute line to the current block. Unknown lines are ignored.
+function applyAttributeLine(block, line) {
+    if (line.startsWith("HEAD "))
+        block.head = line.slice("HEAD ".length);
+    else if (line.startsWith("branch "))
+        block.branch = line.slice("branch ".length);
+    else if (line === "bare")
+        block.bare = true;
+    else if (line === "detached")
+        block.detached = true;
+    else if (line.startsWith("locked"))
+        block.locked = true;
+}
+// Parses `git worktree list --porcelain`. Blocks are separated by a blank line; each block starts
+// with `worktree <path>` followed by optional `HEAD <sha>`, `branch <ref>`, and the bare/detached/
+// locked markers.
+export function parseWorktreeListPorcelain(stdout) {
+    const entries = [];
+    let block = null;
+    for (const raw of stdout.split("\n")) {
+        const line = raw.replace(/\r$/u, "");
+        if (line.startsWith("worktree ")) {
+            const previous = blockToEntry(block);
+            if (previous !== undefined)
+                entries.push(previous);
+            block = { path: line.slice("worktree ".length), bare: false, detached: false, locked: false };
+        }
+        else if (line.length === 0) {
+            const previous = blockToEntry(block);
+            if (previous !== undefined)
+                entries.push(previous);
+            block = null;
+        }
+        else if (block !== null) {
+            applyAttributeLine(block, line);
+        }
+    }
+    const last = blockToEntry(block);
+    if (last !== undefined)
+        entries.push(last);
+    return entries;
+}
+function buildAdapterContext(deps) {
+    return {
+        runDeps: {
+            workspace: deps.workspace,
+            policy: deps.policy ?? DEFAULT_SANDBOX_POLICY,
+            commandRules: GIT_WORKTREE_COMMAND_RULES,
+            spawn: deps.spawn ?? nodeSpawnFn,
+            processEnv: deps.processEnv ?? process.env,
+            now: deps.now ?? Date.now,
+            ...(deps.resolveExecutable !== undefined
+                ? { resolveExecutable: deps.resolveExecutable }
+                : {}),
+            ...(deps.home !== undefined ? { home: deps.home } : {}),
+        },
+        signal: deps.signal ?? new AbortController().signal,
+        timeoutMs: deps.timeoutMs,
+    };
+}
+async function runGit(ctx, argv) {
+    try {
+        return await runCommand({ command: "git", args: argv, cwd: undefined, timeoutMs: ctx.timeoutMs, signal: ctx.signal }, ctx.runDeps);
+    }
+    catch (error) {
+        throw new GitWorktreeSpawnError(`git ${argv[0] ?? "?"} failed to run: ${error instanceof Error ? error.name : "unknown"}`);
+    }
+}
+function toOperationResult(result) {
+    return {
+        ok: result.exitCode === 0,
+        exitCode: result.exitCode,
+        durationMs: result.durationMs,
+        timedOut: result.timedOut,
+        truncated: result.truncated,
+    };
+}
+export function createNodeGitWorktreeAdapter(deps) {
+    const ctx = buildAdapterContext(deps);
+    return {
+        resolveRepositoryRoot: async () => {
+            const result = await runGit(ctx, buildShowToplevelArgv());
+            if (result.exitCode !== 0)
+                return undefined;
+            const top = result.stdout.split(/\r?\n/u)[0]?.trim();
+            return top !== undefined && top.length > 0 ? top : undefined;
+        },
+        refResolves: async (ref) => (await runGit(ctx, buildRefResolvesArgv(ref))).exitCode === 0,
+        localBranchExists: async (branch) => (await runGit(ctx, buildLocalBranchExistsArgv(branch))).exitCode === 0,
+        listWorktrees: async () => {
+            const result = await runGit(ctx, buildListWorktreesArgv());
+            if (result.exitCode !== 0)
+                return [];
+            return parseWorktreeListPorcelain(result.stdout);
+        },
+        worktreeStatus: async () => {
+            const result = await runGit(ctx, buildWorktreeStatusArgv());
+            if (result.exitCode !== 0)
+                return { ok: false, dirty: false };
+            return { ok: true, dirty: result.stdout.trim().length > 0 };
+        },
+        addWorktree: async (operands) => toOperationResult(await runGit(ctx, buildAddWorktreeArgv(operands))),
+        addWorktreeForExistingBranch: async (operands) => toOperationResult(await runGit(ctx, buildAddExistingBranchArgv(operands))),
+        removeWorktree: async (operands) => toOperationResult(await runGit(ctx, buildRemoveWorktreeArgv(operands))),
+        pruneWorktrees: async () => toOperationResult(await runGit(ctx, buildPruneWorktreesArgv())),
+    };
+}

package/dist/git-worktree-snapshot-node.d.ts

@@ -0,0 +1,31 @@
+import type { WorkspaceInfo } from "@oscharko-dev/keiko-workspace";
+import type { CommandRule, SandboxPolicy } from "./types.js";
+import { type ExecutableResolver, type HomeProvider, type SpawnFn } from "./exec.js";
+import type { GitWorktreeSnapshot } from "./git-mutation-preflight.js";
+export declare const GIT_WORKTREE_READ_COMMAND_RULES: readonly CommandRule[];
+export interface NodeGitWorktreeReaderDeps {
+    readonly workspace: WorkspaceInfo;
+    readonly processEnv?: NodeJS.ProcessEnv | undefined;
+    readonly now?: (() => number) | undefined;
+    readonly spawn?: SpawnFn | undefined;
+    readonly policy?: SandboxPolicy | undefined;
+    readonly resolveExecutable?: ExecutableResolver | undefined;
+    readonly home?: HomeProvider | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly timeoutMs?: number | undefined;
+}
+export declare class GitWorktreeReadError extends Error {
+    constructor(message: string);
+}
+/**
+ * Reads the live worktree into a content-free `GitWorktreeSnapshot` via read-only git inspection.
+ * `operationInProgress` is not probed by this reader (it affects only advisory preflight findings for
+ * the local branch/stage/commit flow); abort/recovery flows that require it are out of #475 scope.
+ */
+export declare function readGitWorktreeSnapshot(deps: NodeGitWorktreeReaderDeps): Promise<GitWorktreeSnapshot>;
+/**
+ * Reads the relative paths currently staged for commit (`git diff --cached --name-only`). Used by the
+ * server for commit-intent scope inference; the paths stay in-process and are never persisted.
+ */
+export declare function readStagedPaths(deps: NodeGitWorktreeReaderDeps): Promise<readonly string[]>;
+//# sourceMappingURL=git-worktree-snapshot-node.d.ts.map

package/dist/git-worktree-snapshot-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-worktree-snapshot-node.d.ts","sourceRoot":"","sources":["../src/git-worktree-snapshot-node.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAiB,aAAa,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,EAGL,KAAK,kBAAkB,EACvB,KAAK,YAAY,EAEjB,KAAK,OAAO,EACb,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAIvE,eAAO,MAAM,+BAA+B,EAAE,SAAS,WAAW,EA2BhE,CAAC;AAEH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzC;AA6BD,qBAAa,oBAAqB,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAInC;AA6FD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAoB9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAIjG"}

package/dist/git-worktree-snapshot-node.js

@@ -0,0 +1,189 @@
+// Read-only worktree snapshot reader for governed local Git flows (Issue #475, Epic #470).
+//
+// The #472 mutation kernel is PURE over an injected `GitWorktreeSnapshot`: it never reads the live
+// repository itself. For the end-user-visible local flows (#475) the SERVER must build a TRUSTWORTHY
+// snapshot from the real worktree before driving the kernel — a client must not be able to assert,
+// e.g., a staged-file count that would slip a commit past preflight. This module is that reader.
+//
+// It runs ONLY read-only `git` inspection (status / rev-parse / branch / remote / diff) through the
+// SAME no-shell spawn boundary as the mutation adapter, but with its OWN dedicated allowlist that is
+// STRUCTURALLY SEPARATE from `GIT_MUTATION_COMMAND_RULES` — it can never reach a write subcommand, and
+// the mutation rules can never reach a read subcommand. No generic exec, no shell, no direct FS.
+//
+// Output is content-free by construction (counts, flags, branch/remote NAMES only) for the snapshot;
+// `readStagedPaths` additionally returns the staged relative paths, which stay inside the server for
+// scope inference and are never persisted into evidence.
+import { DEFAULT_SANDBOX_POLICY } from "./types.js";
+import { nodeSpawnFn, runCommand, } from "./exec.js";
+// The dedicated READ-ONLY allowlist. Mirrors the mutation rules' defence-in-depth flag denials but
+// permits only inspection subcommands — no `branch <name>`, no `add`, no `commit`, no network verb.
+export const GIT_WORKTREE_READ_COMMAND_RULES = Object.freeze([
+    {
+        executable: "git",
+        allowedSubcommands: Object.freeze(["status", "rev-parse", "branch", "remote", "diff"]),
+        valueFlags: Object.freeze([
+            "-C",
+            "-c",
+            "--git-dir",
+            "--work-tree",
+            "--namespace",
+            "--exec-path",
+        ]),
+        denyFlags: Object.freeze([
+            "-C",
+            "-c",
+            "--config-env",
+            "--git-dir",
+            "--work-tree",
+            "--namespace",
+            "--exec-path",
+            "--ext-diff",
+            "--textconv",
+            "--no-index",
+            "--contents",
+            "--output",
+        ]),
+    },
+]);
+function buildReadContext(deps) {
+    return {
+        runDeps: {
+            workspace: deps.workspace,
+            policy: deps.policy ?? DEFAULT_SANDBOX_POLICY,
+            commandRules: GIT_WORKTREE_READ_COMMAND_RULES,
+            spawn: deps.spawn ?? nodeSpawnFn,
+            processEnv: deps.processEnv ?? process.env,
+            now: deps.now ?? Date.now,
+            ...(deps.resolveExecutable !== undefined
+                ? { resolveExecutable: deps.resolveExecutable }
+                : {}),
+            ...(deps.home !== undefined ? { home: deps.home } : {}),
+        },
+        signal: deps.signal ?? new AbortController().signal,
+        timeoutMs: deps.timeoutMs,
+    };
+}
+// Thrown when a read-only inspection command exits non-zero (e.g. not a git repository). The caller
+// translates this into a content-free server error rather than leaking git's stderr.
+export class GitWorktreeReadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "GitWorktreeReadError";
+    }
+}
+async function runRead(ctx, argv) {
+    let result;
+    try {
+        result = await runCommand({ command: "git", args: argv, cwd: undefined, timeoutMs: ctx.timeoutMs, signal: ctx.signal }, ctx.runDeps);
+    }
+    catch {
+        throw new GitWorktreeReadError(`git ${argv[0] ?? "?"} failed to run`);
+    }
+    if (result.exitCode !== 0) {
+        throw new GitWorktreeReadError(`git ${argv[0] ?? "?"} exited ${String(result.exitCode)}`);
+    }
+    return result.stdout;
+}
+function parseAheadBehind(value, counts) {
+    // Format: "+<ahead> -<behind>"
+    for (const token of value.trim().split(/\s+/)) {
+        const n = Number.parseInt(token.slice(1), 10);
+        if (token.startsWith("+") && Number.isFinite(n))
+            counts.ahead = Math.max(0, n);
+        if (token.startsWith("-") && Number.isFinite(n))
+            counts.behind = Math.max(0, n);
+    }
+}
+function applyHeaderLine(line, counts) {
+    if (line.startsWith("# branch.head ")) {
+        const head = line.slice("# branch.head ".length).trim();
+        if (head === "(detached)")
+            counts.headDetached = true;
+        else
+            counts.currentBranchName = head;
+    }
+    else if (line.startsWith("# branch.upstream ")) {
+        counts.hasUpstream = true;
+    }
+    else if (line.startsWith("# branch.ab ")) {
+        parseAheadBehind(line.slice("# branch.ab ".length), counts);
+    }
+}
+// A "1"/"2" entry carries a two-char XY status field after the type token: X = index (staged), Y =
+// worktree (unstaged). A "." in a slot means "unmodified there".
+function applyChangedEntry(line, counts) {
+    const xy = line.slice(2, 4);
+    const staged = xy[0] ?? ".";
+    const worktree = xy[1] ?? ".";
+    if (staged !== ".")
+        counts.staged += 1;
+    if (worktree !== ".")
+        counts.unstaged += 1;
+}
+function parsePorcelain(stdout) {
+    const counts = {
+        headDetached: false,
+        currentBranchName: undefined,
+        staged: 0,
+        unstaged: 0,
+        untracked: 0,
+        hasUpstream: false,
+        ahead: 0,
+        behind: 0,
+    };
+    for (const line of stdout.split("\n")) {
+        if (line.length === 0)
+            continue;
+        if (line.startsWith("# "))
+            applyHeaderLine(line, counts);
+        else if (line.startsWith("1 ") || line.startsWith("2 "))
+            applyChangedEntry(line, counts);
+        else if (line.startsWith("u "))
+            counts.unstaged += 1; // unmerged path: needs resolution
+        else if (line.startsWith("? "))
+            counts.untracked += 1;
+    }
+    return counts;
+}
+function parseLines(stdout) {
+    return stdout
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+// ─── Public reader ───────────────────────────────────────────────────────────────────────────
+/**
+ * Reads the live worktree into a content-free `GitWorktreeSnapshot` via read-only git inspection.
+ * `operationInProgress` is not probed by this reader (it affects only advisory preflight findings for
+ * the local branch/stage/commit flow); abort/recovery flows that require it are out of #475 scope.
+ */
+export async function readGitWorktreeSnapshot(deps) {
+    const ctx = buildReadContext(deps);
+    const [statusOut, branchOut, remoteOut] = await Promise.all([
+        runRead(ctx, ["status", "--porcelain=v2", "--branch"]),
+        runRead(ctx, ["branch", "--list", "--format=%(refname:short)"]),
+        runRead(ctx, ["remote"]),
+    ]);
+    const c = parsePorcelain(statusOut);
+    return {
+        headDetached: c.headDetached,
+        ...(c.currentBranchName !== undefined ? { currentBranchName: c.currentBranchName } : {}),
+        stagedFileCount: c.staged,
+        unstagedFileCount: c.unstaged,
+        untrackedFileCount: c.untracked,
+        hasUpstream: c.hasUpstream,
+        aheadCount: c.ahead,
+        behindCount: c.behind,
+        existingLocalBranchNames: parseLines(branchOut),
+        remoteAliases: parseLines(remoteOut),
+    };
+}
+/**
+ * Reads the relative paths currently staged for commit (`git diff --cached --name-only`). Used by the
+ * server for commit-intent scope inference; the paths stay in-process and are never persisted.
+ */
+export async function readStagedPaths(deps) {
+    const ctx = buildReadContext(deps);
+    const out = await runRead(ctx, ["diff", "--cached", "--name-only"]);
+    return parseLines(out);
+}

package/dist/index.d.ts

@@ -11,6 +11,15 @@ export { computeFileContent, type ApplyOutcome, type HunkConflict } from "./patc
 export { TOOL_DEFINITIONS } from "./schemas.js";
 export { WorkspaceToolHost } from "./registry.js";
 export * from "./terminal-policy.js";
+export { GIT_MUTATION_FAILURE_CATEGORIES, GIT_MUTATION_LIFECYCLE_PHASES, GIT_MUTATION_PHASE_ORDER, GIT_MUTATION_STATUSES, gitMutationCategoryForExecutionError, gitMutationCategoryForExecutionResult, gitMutationFailureIsRecoverable, isGitMutationFailureCategory, isGitMutationLifecyclePhase, isGitMutationStatus, type GitMutationFailureCategory, type GitMutationLifecyclePhase, type GitMutationStatus, } from "./git-mutation-taxonomy.js";
+export { evaluateGitPreflight, GIT_PREFLIGHT_FINDING_CODES, gitPreflightRemediationFor, isGitPreflightFindingCode, type GitPreflightFinding, type GitPreflightFindingCode, type GitPreflightRemediation, type GitPreflightReport, type GitPreflightSeverity, type GitWorktreeSnapshot, } from "./git-mutation-preflight.js";
+export { buildAbortArgv, buildBranchCreateArgv, buildBranchSwitchArgv, buildCommitArgv, buildRecoveryArgv, buildStageArgv, buildUnstageArgv, GIT_MUTATION_ALLOWED_SUBCOMMANDS, GIT_MUTATION_COMMAND_RULES, gitMutationPlanIsGoverned, GitMutationArgvError, type GitAbortExecRequest, type GitBranchCreateExecRequest, type GitBranchSwitchExecRequest, type GitCommitExecRequest, type GitLocalMutationAdapter, type GitMutationArgvPlan, type GitRecoveryExecRequest, type GitStageExecRequest, type GitUnstageExecRequest, } from "./git-mutation-adapter.js";
+export { createInMemoryGitMutationJournal, gitMutationOutcomeFailureCategory, runGitMutation, type GitAbortCommand, type GitBranchCreateCommand, type GitBranchSwitchCommand, type GitCommitCommand, type GitMutationCommand, type GitMutationJournal, type GitMutationLifecycleResult, type GitMutationOrchestratorDeps, type GitMutationOutcome, type GitMutationRequest, type GitRecoveryCommand, type GitStageCommand, type GitUnstageCommand, } from "./git-mutation-orchestrator.js";
+export { buildGitDeliveryEvidenceRecord, type GitDeliveryEvidenceBuildDeps, type GitDeliveryEvidenceBuildInput, type GitDeliveryEvidenceSnapshot, } from "./git-mutation-evidence.js";
+export { buildPushArgv, classifyGitPublishRejection, evaluateGitPublishEffectivePolicy, GIT_PUBLISH_ALLOWED_SUBCOMMANDS, GIT_PUBLISH_COMMAND_RULES, GIT_PUBLISH_REJECTION_REASONS, gitPublishArgvIsGoverned, gitPublishRejectionFor, gitPublishRejectionToErrorCode, GitPublishArgvError, isGitPublishRejectionReason, runGitPublish, type GitPublishEffectivePolicy, type GitPublishExecRequest, type GitPublishExecResult, type GitPublishLifecycleResult, type GitPublishOrchestratorDeps, type GitPublishRejection, type GitPublishRejectionReason, type GitPublishRequest, type GitPushCommand, type GitRemotePublishAdapter, } from "./git-publish-gateway.js";
+export { buildPrConvertDraftGraphqlArgv, buildPrCreateArgv, buildPrMarkReadyGraphqlArgv, buildPrUpdateArgv, classifyGitPullRequestRejection, evaluateGitPullRequestEffectivePolicy, GIT_PULL_REQUEST_ALLOWED_SUBCOMMANDS, GIT_PULL_REQUEST_COMMAND_RULES, gitPrArgvIsGoverned, gitPrRejectionToErrorCode, gitPullRequestRejectionFor, GitPrArgvError, runGitPullRequest, type GitPrCreateCommand, type GitPrCreateExecRequest, type GitPrExecResult, type GitPrUpdateCommand, type GitPrUpdateExecRequest, type GitPullRequestAdapter, type GitPullRequestCommand, type GitPullRequestEffectivePolicy, type GitPullRequestLifecycleResult, type GitPullRequestOrchestratorDeps, type GitPullRequestRejection, type GitPullRequestRequest, } from "./git-pr-gateway.js";
+export { buildDeleteMergedBranchArgv, buildHeadStatusArgv, buildMergeArgv, buildMergeReadinessArgv, buildRepoMergeConfigArgv, classifyGitMergeRejection, evaluateGitMergeEffectivePolicy, GIT_MERGE_ALLOWED_SUBCOMMANDS, GIT_MERGE_COMMAND_RULES, gitMergeArgvIsGoverned, gitMergeRejectionToErrorCode, GitMergeArgvError, mapRawMergeReadiness, runGitMerge, type GitMergeAdapter, type GitMergeCommand, type GitMergeEffectivePolicy, type GitMergeExecRequest, type GitMergeExecResult, type GitMergeLifecycleResult, type GitMergeOrchestratorDeps, type GitMergeProviderReadiness, type GitMergeReadinessRequest, type GitMergeRequest, type RawMergeReadiness, } from "./git-merge-gateway.js";
+export { MAX_COMMIT_SUMMARY_AREAS, summarizeStagedChangeset } from "./git-commit-intent-node.js";
 export { BROWSER_ERROR_CODES, BrowserToolError, type BrowserErrorCode } from "./browser/errors.js";
 export { isLoopbackHost, isLoopbackUrl, normalizeCdpPort, normalizeNavigateUrl, } from "./browser/validators.js";
 export type { BrowserContentResult, BrowserNavigateResult, BrowserScreenshotPersisted, BrowserScreenshotPreview, BrowserScreenshotResult, BrowserSessionMeta, BrowserSessionStatus, BrowserViewportPx, CdpReachability, NormalizedNavigateUrl, } from "./browser/types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EACL,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,KAAK,SAAS,EACd,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAKlD,cAAc,sBAAsB,CAAC;AAGrC,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EACL,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,SAAS,EACT,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,iBAAiB,EACjB,SAAS,EACT,gBAAgB,EAChB,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EACL,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,KAAK,SAAS,EACd,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9F,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAKlD,cAAc,sBAAsB,CAAC;AAOrC,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,EAC7B,wBAAwB,EACxB,qBAAqB,EACrB,oCAAoC,EACpC,qCAAqC,EACrC,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,0BAA0B,EAC1B,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gCAAgC,EAChC,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gCAAgC,EAChC,iCAAiC,EACjC,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,8BAA8B,EAC9B,KAAK,4BAA4B,EACjC,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AAQpC,OAAO,EACL,aAAa,EACb,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,2BAA2B,EAC3B,aAAa,EACb,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,EACjB,2BAA2B,EAC3B,iBAAiB,EACjB,+BAA+B,EAC/B,qCAAqC,EACrC,oCAAoC,EACpC,8BAA8B,EAC9B,mBAAmB,EACnB,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EACd,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,cAAc,EACd,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,+BAA+B,EAC/B,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,oBAAoB,EACpB,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGjG,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EACL,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,2BAA2B,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC"}