@rcrsr/rill 0.7.2 → 0.8.1

package/dist/ext/fs/index.js

@@ -0,0 +1,560 @@
+/**
+ * fs Extension Factory
+ *
+ * Provides sandboxed filesystem operations via mount-based access control.
+ * All 12 functions implement path validation, permission checks, and glob filtering.
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { RuntimeError } from '../../error-classes.js';
+import { resolvePath, matchesGlob, initializeMount, } from './sandbox.js';
+// ============================================================
+// FACTORY
+// ============================================================
+/**
+ * Create filesystem extension with sandboxed operations.
+ *
+ * Initializes all mounts by resolving paths at creation time.
+ * Returns 12 functions: read, write, append, list, find, exists, remove, stat, mkdir, copy, move, mounts.
+ *
+ * @param config - Mount configuration and defaults
+ * @returns ExtensionResult with 12 filesystem functions
+ * @throws RuntimeError if mount initialization fails
+ *
+ * @example
+ * ```typescript
+ * const fsExt = createFsExtension({
+ *   mounts: {
+ *     workspace: { path: '/home/user/project', mode: 'read-write' }
+ *   }
+ * });
+ * ```
+ */
+export function createFsExtension(config) {
+    // Apply defaults
+    const maxFileSize = config.maxFileSize ?? 10485760; // 10MB
+    const encoding = config.encoding ?? 'utf-8';
+    // Initialize all mounts (resolve paths at creation time)
+    const mounts = { ...config.mounts };
+    const initPromises = Object.values(mounts).map((mount) => initializeMount(mount));
+    // Block on initialization to catch config errors early
+    // This is a sync factory, so we use a promise wrapper pattern
+    let initError;
+    Promise.all(initPromises).catch((err) => {
+        initError = err;
+    });
+    // Helper: check for initialization errors before operations
+    const ensureInitialized = async () => {
+        if (initError)
+            throw initError;
+        await Promise.all(initPromises); // Wait for completion
+    };
+    // Helper: get effective max file size (mount-specific or global)
+    const getMaxFileSize = (mountName) => {
+        const mount = mounts[mountName];
+        return mount?.maxFileSize ?? maxFileSize;
+    };
+    // Helper: check file size against limit
+    const checkFileSize = (size, max, filePath) => {
+        if (size > max) {
+            throw new RuntimeError('RILL-R004', `file exceeds size limit (${size} > ${max})`, undefined, { path: filePath, size, max });
+        }
+    };
+    // ============================================================
+    // FUNCTIONS
+    // ============================================================
+    /**
+     * Read file contents.
+     * IR-1, EC-5 (file not found), EC-6 (size limit)
+     */
+    const read = async (args
+    // ctx and location not used but required by CallableFn signature
+    ) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const filePath = args[1];
+        // EC-5: Catch file not found from resolvePath
+        let resolvedPath;
+        try {
+            resolvedPath = await resolvePath(mountName, filePath, mounts, 'read');
+        }
+        catch (error) {
+            if (error instanceof RuntimeError) {
+                // Convert RILL-R021 (sandbox error) to RILL-R004 (extension error)
+                throw new RuntimeError('RILL-R004', `file not found: ${filePath}`, undefined, { path: filePath });
+            }
+            throw error;
+        }
+        // Check file size before reading
+        const stats = await fs.stat(resolvedPath);
+        const max = getMaxFileSize(mountName);
+        checkFileSize(stats.size, max, resolvedPath);
+        return await fs.readFile(resolvedPath, encoding);
+    };
+    /**
+     * Write file contents, replacing if exists.
+     * IR-2
+     */
+    const write = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const filePath = args[1];
+        const content = args[2];
+        const resolvedPath = await resolvePath(mountName, filePath, mounts, 'write', true // createMode: resolve parent directory
+        );
+        // Check content size before writing
+        const contentSize = Buffer.byteLength(content, encoding);
+        const max = getMaxFileSize(mountName);
+        checkFileSize(contentSize, max, resolvedPath);
+        await fs.writeFile(resolvedPath, content, encoding);
+        // Return bytes written as string
+        return String(contentSize);
+    };
+    /**
+     * Append content to file.
+     * IR-3
+     */
+    const append = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const filePath = args[1];
+        const content = args[2];
+        const resolvedPath = await resolvePath(mountName, filePath, mounts, 'write', true // createMode: allow new files
+        );
+        // Check content size before appending
+        const contentSize = Buffer.byteLength(content, encoding);
+        const max = getMaxFileSize(mountName);
+        // Check total size after append (current + new content)
+        try {
+            const stats = await fs.stat(resolvedPath);
+            checkFileSize(stats.size + contentSize, max, resolvedPath);
+        }
+        catch (error) {
+            // File doesn't exist yet - just check new content size
+            if (error && typeof error === 'object' && 'code' in error) {
+                if (error.code === 'ENOENT') {
+                    checkFileSize(contentSize, max, resolvedPath);
+                }
+                else {
+                    throw error;
+                }
+            }
+            else {
+                throw error;
+            }
+        }
+        await fs.appendFile(resolvedPath, content, encoding);
+        // Return bytes written as string
+        return String(contentSize);
+    };
+    /**
+     * List directory contents.
+     * IR-4, returns list of dicts with name, type, size.
+     */
+    const list = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const dirPath = args[1] ?? '';
+        const resolvedPath = await resolvePath(mountName, dirPath, mounts, 'read');
+        const entries = await fs.readdir(resolvedPath, { withFileTypes: true });
+        const result = [];
+        for (const entry of entries) {
+            const fullPath = path.join(resolvedPath, entry.name);
+            const stats = await fs.stat(fullPath);
+            result.push({
+                name: entry.name,
+                type: entry.isDirectory() ? 'directory' : 'file',
+                size: stats.size,
+            });
+        }
+        return result;
+    };
+    /**
+     * Recursive file search with optional glob pattern.
+     * IR-5
+     */
+    const find = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const pattern = args[1] ?? '*';
+        const mount = mounts[mountName];
+        if (!mount || !mount.resolvedPath) {
+            throw new RuntimeError('RILL-R004', `mount "${mountName}" not configured`, undefined, { mountName });
+        }
+        const basePath = mount.resolvedPath;
+        const results = [];
+        // Recursive directory traversal
+        const traverse = async (currentPath) => {
+            const entries = await fs.readdir(currentPath, { withFileTypes: true });
+            for (const entry of entries) {
+                const fullPath = path.join(currentPath, entry.name);
+                if (entry.isDirectory()) {
+                    await traverse(fullPath);
+                }
+                else if (matchesGlob(entry.name, pattern)) {
+                    // Return path relative to mount base
+                    const relativePath = path.relative(basePath, fullPath);
+                    results.push(relativePath);
+                }
+            }
+        };
+        await traverse(basePath);
+        return results;
+    };
+    /**
+     * Check file existence.
+     * IR-6
+     */
+    const exists = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const filePath = args[1];
+        try {
+            await resolvePath(mountName, filePath, mounts, 'read');
+            return true;
+        }
+        catch (error) {
+            if (error instanceof RuntimeError) {
+                // File not found or path escape - return false
+                return false;
+            }
+            throw error;
+        }
+    };
+    /**
+     * Delete file.
+     * IR-7
+     */
+    const remove = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const filePath = args[1];
+        // Catch file not found from resolvePath
+        let resolvedPath;
+        try {
+            resolvedPath = await resolvePath(mountName, filePath, mounts, 'write');
+        }
+        catch (error) {
+            if (error instanceof RuntimeError) {
+                // File not found - return false
+                return false;
+            }
+            throw error;
+        }
+        try {
+            await fs.rm(resolvedPath);
+            return true;
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error) {
+                if (error.code === 'ENOENT') {
+                    return false;
+                }
+            }
+            throw error;
+        }
+    };
+    /**
+     * Get file metadata.
+     * IR-8, returns dict with name, type, size, created, modified (ISO 8601).
+     */
+    const stat = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const filePath = args[1];
+        // Catch file not found from resolvePath
+        let resolvedPath;
+        try {
+            resolvedPath = await resolvePath(mountName, filePath, mounts, 'read');
+        }
+        catch (error) {
+            if (error instanceof RuntimeError) {
+                // Convert RILL-R021 to RILL-R004
+                throw new RuntimeError('RILL-R004', `file not found: ${filePath}`, undefined, { path: filePath });
+            }
+            throw error;
+        }
+        const stats = await fs.stat(resolvedPath);
+        const filename = path.basename(resolvedPath);
+        return {
+            name: filename,
+            type: stats.isDirectory() ? 'directory' : 'file',
+            size: stats.size,
+            created: stats.birthtime.toISOString(),
+            modified: stats.mtime.toISOString(),
+        };
+    };
+    /**
+     * Create directory.
+     * IR-9
+     */
+    const mkdir = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const dirPath = args[1];
+        const mount = mounts[mountName];
+        if (!mount || !mount.resolvedPath) {
+            throw new RuntimeError('RILL-R004', `mount "${mountName}" not configured`, undefined, { mountName });
+        }
+        // For mkdir, build path manually to avoid parent directory checks
+        const mountBase = mount.resolvedPath;
+        const joined = path.join(mountBase, dirPath);
+        const normalized = path.resolve(joined);
+        // Verify path is within mount boundary
+        if (!normalized.startsWith(mountBase + path.sep) &&
+            normalized !== mountBase) {
+            throw new RuntimeError('RILL-R004', 'path escapes mount boundary', undefined, { mountName, path: dirPath, normalized, mountBase });
+        }
+        // Check if already exists
+        try {
+            const stats = await fs.stat(normalized);
+            if (stats.isDirectory()) {
+                return false; // Already exists
+            }
+        }
+        catch (error) {
+            // ENOENT is expected - directory doesn't exist yet
+            if (error &&
+                typeof error === 'object' &&
+                'code' in error &&
+                error.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+        try {
+            await fs.mkdir(normalized, { recursive: true });
+            return true;
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error) {
+                if (error.code === 'EEXIST') {
+                    return false;
+                }
+            }
+            throw error;
+        }
+    };
+    /**
+     * Copy file within mount.
+     * IR-10
+     */
+    const copy = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const srcPath = args[1];
+        const destPath = args[2];
+        const resolvedSrc = await resolvePath(mountName, srcPath, mounts, 'read');
+        const resolvedDest = await resolvePath(mountName, destPath, mounts, 'write', true // createMode
+        );
+        // Check file size before copying
+        const stats = await fs.stat(resolvedSrc);
+        const max = getMaxFileSize(mountName);
+        checkFileSize(stats.size, max, resolvedDest);
+        try {
+            await fs.copyFile(resolvedSrc, resolvedDest);
+            return true;
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error) {
+                if (error.code === 'ENOENT') {
+                    throw new RuntimeError('RILL-R004', `file not found: ${srcPath}`, undefined, { path: resolvedSrc });
+                }
+            }
+            throw error;
+        }
+    };
+    /**
+     * Move file within mount.
+     * IR-11
+     */
+    const move = async (args) => {
+        await ensureInitialized();
+        const mountName = args[0];
+        const srcPath = args[1];
+        const destPath = args[2];
+        const resolvedSrc = await resolvePath(mountName, srcPath, mounts, 'read');
+        const resolvedDest = await resolvePath(mountName, destPath, mounts, 'write', true // createMode
+        );
+        try {
+            await fs.rename(resolvedSrc, resolvedDest);
+            return true;
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error) {
+                if (error.code === 'ENOENT') {
+                    throw new RuntimeError('RILL-R004', `file not found: ${srcPath}`, undefined, { path: resolvedSrc });
+                }
+            }
+            throw error;
+        }
+    };
+    /**
+     * List configured mounts.
+     * IR-12, returns list of dicts with name, mode, glob.
+     */
+    const mountsList = async () => {
+        await ensureInitialized();
+        const result = [];
+        for (const [name, mount] of Object.entries(mounts)) {
+            result.push({
+                name,
+                mode: mount.mode,
+                glob: mount.glob ?? '',
+            });
+        }
+        return result;
+    };
+    // ============================================================
+    // EXTENSION RESULT
+    // ============================================================
+    return {
+        read: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'File path relative to mount',
+                },
+            ],
+            fn: read,
+            description: 'Read file contents',
+            returnType: 'string',
+        },
+        write: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'File path relative to mount',
+                },
+                { name: 'content', type: 'string', description: 'Content to write' },
+            ],
+            fn: write,
+            description: 'Write file, replacing if exists',
+            returnType: 'string',
+        },
+        append: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'File path relative to mount',
+                },
+                { name: 'content', type: 'string', description: 'Content to append' },
+            ],
+            fn: append,
+            description: 'Append content to file',
+            returnType: 'string',
+        },
+        list: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'Directory path relative to mount',
+                    defaultValue: '',
+                },
+            ],
+            fn: list,
+            description: 'List directory contents',
+            returnType: 'list',
+        },
+        find: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'pattern',
+                    type: 'string',
+                    description: 'Glob pattern for filtering',
+                    defaultValue: '*',
+                },
+            ],
+            fn: find,
+            description: 'Recursive file search',
+            returnType: 'list',
+        },
+        exists: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'File path relative to mount',
+                },
+            ],
+            fn: exists,
+            description: 'Check file existence',
+            returnType: 'bool',
+        },
+        remove: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'File path relative to mount',
+                },
+            ],
+            fn: remove,
+            description: 'Delete file',
+            returnType: 'bool',
+        },
+        stat: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'File path relative to mount',
+                },
+            ],
+            fn: stat,
+            description: 'Get file metadata',
+            returnType: 'dict',
+        },
+        mkdir: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                {
+                    name: 'path',
+                    type: 'string',
+                    description: 'Directory path relative to mount',
+                },
+            ],
+            fn: mkdir,
+            description: 'Create directory',
+            returnType: 'bool',
+        },
+        copy: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                { name: 'src', type: 'string', description: 'Source file path' },
+                { name: 'dest', type: 'string', description: 'Destination file path' },
+            ],
+            fn: copy,
+            description: 'Copy file within mount',
+            returnType: 'bool',
+        },
+        move: {
+            params: [
+                { name: 'mount', type: 'string', description: 'Mount name' },
+                { name: 'src', type: 'string', description: 'Source file path' },
+                { name: 'dest', type: 'string', description: 'Destination file path' },
+            ],
+            fn: move,
+            description: 'Move file within mount',
+            returnType: 'bool',
+        },
+        mounts: {
+            params: [],
+            fn: mountsList,
+            description: 'List configured mounts',
+            returnType: 'list',
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/ext/fs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ext/fs/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAEL,WAAW,EACX,WAAW,EACX,eAAe,GAChB,MAAM,cAAc,CAAC;AAmBtB,+DAA+D;AAC/D,UAAU;AACV,+DAA+D;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAgB;IAChD,iBAAiB;IACjB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,CAAC,OAAO;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC;IAE5C,yDAAyD;IACzD,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;IAEF,uDAAuD;IACvD,8DAA8D;IAC9D,IAAI,SAA4B,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACtC,SAAS,GAAG,GAAY,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE;QAClD,IAAI,SAAS;YAAE,MAAM,SAAS,CAAC;QAC/B,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB;IACzD,CAAC,CAAC;IAEF,iEAAiE;IACjE,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAU,EAAE;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,KAAK,EAAE,WAAW,IAAI,WAAW,CAAC;IAC3C,CAAC,CAAC;IAEF,wCAAwC;IACxC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,QAAgB,EAAQ,EAAE;QAC1E,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACf,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,4BAA4B,IAAI,MAAM,GAAG,GAAG,EAC5C,SAAS,EACT,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAC9B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,+DAA+D;IAC/D,YAAY;IACZ,+DAA+D;IAE/D;;;OAGG;IACH,MAAM,IAAI,GAAG,KAAK,EAChB,IAAiB;IACjB,iEAAiE;MAChD,EAAE;QACnB,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAEnC,8CAA8C;QAC9C,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,mEAAmE;gBACnE,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,mBAAmB,QAAQ,EAAE,EAC7B,SAAS,EACT,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAE7C,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,KAAK,GAAG,KAAK,EAAE,IAAiB,EAAmB,EAAE;QACzD,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAElC,MAAM,YAAY,GAAG,MAAM,WAAW,CACpC,SAAS,EACT,QAAQ,EACR,MAAM,EACN,OAAO,EACP,IAAI,CAAC,uCAAuC;SAC7C,CAAC;QAEF,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAE9C,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEpD,iCAAiC;QACjC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,IAAiB,EAAmB,EAAE;QAC1D,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAElC,MAAM,YAAY,GAAG,MAAM,WAAW,CACpC,SAAS,EACT,QAAQ,EACR,MAAM,EACN,OAAO,EACP,IAAI,CAAC,8BAA8B;SACpC,CAAC;QAEF,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAEtC,wDAAwD;QACxD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC1C,aAAa,CAAC,KAAK,CAAC,IAAI,GAAG,WAAW,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uDAAuD;YACvD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC1D,IAAK,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClD,aAAa,CAAC,WAAW,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;gBAChD,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAErD,iCAAiC;QACjC,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,IAAiB,EAAwB,EAAE;QAC7D,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,OAAO,GAAI,IAAI,CAAC,CAAC,CAAwB,IAAI,EAAE,CAAC;QAEtD,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAExE,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEtC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;gBAChD,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,IAAiB,EAAwB,EAAE;QAC7D,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,OAAO,GAAI,IAAI,CAAC,CAAC,CAAwB,IAAI,GAAG,CAAC;QAEvD,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,UAAU,SAAS,kBAAkB,EACrC,SAAS,EACT,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC;QACpC,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,gCAAgC;QAChC,MAAM,QAAQ,GAAG,KAAK,EAAE,WAAmB,EAAiB,EAAE;YAC5D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAEvE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAEpD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;oBACxB,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC3B,CAAC;qBAAM,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;oBAC5C,qCAAqC;oBACrC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACvD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,IAAiB,EAAoB,EAAE;QAC3D,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,+CAA+C;gBAC/C,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,MAAM,GAAG,KAAK,EAAE,IAAiB,EAAoB,EAAE;QAC3D,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAEnC,wCAAwC;QACxC,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,gCAAgC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC1D,IAAK,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,IAAI,GAAG,KAAK,EAChB,IAAiB,EACmB,EAAE;QACtC,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAEnC,wCAAwC;QACxC,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,iCAAiC;gBACjC,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,mBAAmB,QAAQ,EAAE,EAC7B,SAAS,EACT,EAAE,IAAI,EAAE,QAAQ,EAAE,CACnB,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAE7C,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;YAChD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YACtC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,KAAK,GAAG,KAAK,EAAE,IAAiB,EAAoB,EAAE;QAC1D,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAElC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,UAAU,SAAS,kBAAkB,EACrC,SAAS,EACT,EAAE,SAAS,EAAE,CACd,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,MAAM,SAAS,GAAG,KAAK,CAAC,YAAY,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAExC,uCAAuC;QACvC,IACE,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;YAC5C,UAAU,KAAK,SAAS,EACxB,CAAC;YACD,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,6BAA6B,EAC7B,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CACpD,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,iBAAiB;YACjC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mDAAmD;YACnD,IACE,KAAK;gBACL,OAAO,KAAK,KAAK,QAAQ;gBACzB,MAAM,IAAI,KAAK;gBACd,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAC7C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC1D,IAAK,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClD,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,IAAiB,EAAoB,EAAE;QACzD,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAEnC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,MAAM,WAAW,CACpC,SAAS,EACT,QAAQ,EACR,MAAM,EACN,OAAO,EACP,IAAI,CAAC,aAAa;SACnB,CAAC;QAEF,iCAAiC;QACjC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC1D,IAAK,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,mBAAmB,OAAO,EAAE,EAC5B,SAAS,EACT,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,IAAI,GAAG,KAAK,EAAE,IAAiB,EAAoB,EAAE;QACzD,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAEnC,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,MAAM,WAAW,CACpC,SAAS,EACT,QAAQ,EACR,MAAM,EACN,OAAO,EACP,IAAI,CAAC,aAAa;SACnB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBAC1D,IAAK,KAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,YAAY,CACpB,WAAW,EACX,mBAAmB,OAAO,EAAE,EAC5B,SAAS,EACT,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,UAAU,GAAG,KAAK,IAA0B,EAAE;QAClD,MAAM,iBAAiB,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAgB,EAAE,CAAC;QAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,+DAA+D;IAC/D,mBAAmB;IACnB,+DAA+D;IAE/D,OAAO;QACL,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,oBAAoB;YACjC,UAAU,EAAE,QAAQ;SACrB;QACD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;gBACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;aACrE;YACD,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,iCAAiC;YAC9C,UAAU,EAAE,QAAQ;SACrB;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;gBACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mBAAmB,EAAE;aACtE;YACD,EAAE,EAAE,MAAM;YACV,WAAW,EAAE,wBAAwB;YACrC,UAAU,EAAE,QAAQ;SACrB;QACD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kCAAkC;oBAC/C,YAAY,EAAE,EAAE;iBACjB;aACF;YACD,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,yBAAyB;YACtC,UAAU,EAAE,MAAM;SACnB;QACD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4BAA4B;oBACzC,YAAY,EAAE,GAAG;iBAClB;aACF;YACD,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,uBAAuB;YACpC,UAAU,EAAE,MAAM;SACnB;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,EAAE,EAAE,MAAM;YACV,WAAW,EAAE,sBAAsB;YACnC,UAAU,EAAE,MAAM;SACnB;QACD,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,EAAE,EAAE,MAAM;YACV,WAAW,EAAE,aAAa;YAC1B,UAAU,EAAE,MAAM;SACnB;QACD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF;YACD,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,mBAAmB;YAChC,UAAU,EAAE,MAAM;SACnB;QACD,KAAK,EAAE;YACL,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kCAAkC;iBAChD;aACF;YACD,EAAE,EAAE,KAAK;YACT,WAAW,EAAE,kBAAkB;YAC/B,UAAU,EAAE,MAAM;SACnB;QACD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBAChE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;aACvE;YACD,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,wBAAwB;YACrC,UAAU,EAAE,MAAM;SACnB;QACD,IAAI,EAAE;YACJ,MAAM,EAAE;gBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;gBAC5D,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE;gBAChE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;aACvE;YACD,EAAE,EAAE,IAAI;YACR,WAAW,EAAE,wBAAwB;YACrC,UAAU,EAAE,MAAM;SACnB;QACD,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,EAAE,EAAE,UAAU;YACd,WAAW,EAAE,wBAAwB;YACrC,UAAU,EAAE,MAAM;SACnB;KACF,CAAC;AACJ,CAAC"}

package/dist/ext/fs/sandbox.d.ts

@@ -0,0 +1,78 @@
+/**
+ * fs Extension Sandbox Module
+ *
+ * Path resolution and validation implementing 9-step security sequence.
+ * Prevents path traversal and symlink attacks via realpath() defense.
+ */
+/** Mount configuration defining sandbox boundaries */
+export interface MountConfig {
+    /** Absolute or relative path on host filesystem */
+    path: string;
+    /** Access mode for this mount */
+    mode: 'read' | 'write' | 'read-write';
+    /** Optional file pattern filter (simple glob) */
+    glob?: string | undefined;
+    /** Override file size limit per-mount (bytes) */
+    maxFileSize?: number | undefined;
+    /** Resolved canonical path (set during mount initialization) */
+    resolvedPath?: string | undefined;
+}
+/** Operation type for mode validation */
+export type Operation = 'read' | 'write';
+/**
+ * Resolves and validates path within mount boundaries.
+ *
+ * 9-step path resolution sequence (spec lines 331-342):
+ * 1. Resolve mount name to MountConfig
+ * 2. Use mount's resolved physical path (from creation time)
+ * 3. Join resolved mount base with script's relative path argument
+ * 4. Normalize with path.resolve() to collapse .. segments
+ * 5. Resolve final path with fs.realpath() (symlink defense)
+ * 6. Verify resolved path starts with mount's resolved base (startsWith())
+ * 7. If glob set, verify filename matches pattern
+ * 8. Check mode permits operation
+ * 9. Return validated path for node:fs operation
+ *
+ * @param mountName - Mount identifier from script
+ * @param relativePath - Script-provided path relative to mount
+ * @param mounts - Mount configuration map
+ * @param operation - Operation type for mode validation
+ * @param createMode - For write operations creating new files (checks parent dir)
+ * @returns Validated absolute path
+ * @throws RuntimeError - EC-1 (unknown mount), EC-2 (path escape), EC-3 (glob), EC-4 (mode), EC-7 (permission)
+ */
+export declare function resolvePath(mountName: string, relativePath: string, mounts: Record<string, MountConfig>, operation: Operation, createMode?: boolean): Promise<string>;
+/**
+ * Simple glob pattern matching (spec lines 346-354).
+ *
+ * Supported patterns:
+ * - *.csv - Files ending in .csv
+ * - *.{json,yaml} - Files ending in .json or .yaml
+ * - * - All files (default when omitted)
+ * - **\/*.csv - CSV files at any depth (for find() only)
+ *
+ * No third-party glob library. Uses path.extname() checks.
+ *
+ * @param filename - Filename to match (basename only)
+ * @param pattern - Glob pattern
+ * @returns true if filename matches pattern
+ */
+export declare function matchesGlob(filename: string, pattern: string): boolean;
+/**
+ * Checks if mount mode permits operation.
+ *
+ * @param mode - Mount access mode
+ * @param operation - Operation type
+ * @returns true if operation permitted
+ */
+export declare function checkMode(mode: 'read' | 'write' | 'read-write', operation: Operation): boolean;
+/**
+ * Resolves mount path at creation time (Step 2 of sequence).
+ *
+ * Mutates MountConfig to set resolvedPath field.
+ *
+ * @param mount - Mount configuration
+ * @throws RuntimeError - If mount path invalid or inaccessible
+ */
+export declare function initializeMount(mount: MountConfig): Promise<void>;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/ext/fs/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/ext/fs/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH,sDAAsD;AACtD,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,YAAY,CAAC;IACtC,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,yCAAyC;AACzC,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAMzC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACnC,SAAS,EAAE,SAAS,EACpB,UAAU,UAAQ,GACjB,OAAO,CAAC,MAAM,CAAC,CAyIjB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CA2BtE;AAMD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,YAAY,EACrC,SAAS,EAAE,SAAS,GACnB,OAAO,CAKT;AAMD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BvE"}