@rpamis/comet 0.4.0-beta.5 → 0.4.0-beta.7

package/dist/domains/comet-native/native-artifacts.js

@@ -0,0 +1,204 @@
+import { promises as fs } from 'fs';
+import path from 'path';
+import { nativeChangeDir } from './native-change.js';
+import { DEFAULT_NATIVE_ARTIFACT_MAX_BYTES, readNativeBoundedTextFile, } from './native-bounded-file.js';
+import { sha256File } from './native-hash.js';
+import { isInsidePath, resolveContainedNativePath } from './native-paths.js';
+const BRIEF_REQUIRED = ['Outcome', 'Scope', 'Non-goals', 'Acceptance examples'];
+const BRIEF_ALL = [
+    ...BRIEF_REQUIRED,
+    'Constraints and invariants',
+    'Decisions',
+    'Open questions',
+    'Verification expectations',
+];
+const VERIFICATION_ALL = [
+    'Acceptance evidence',
+    'Commands and results',
+    'Skipped checks',
+    'Spec consistency',
+    'Known limitations and risks',
+    'Conclusion',
+];
+export const NATIVE_ARTIFACT_VALIDATION_LIMITS = {
+    maxFileBytes: DEFAULT_NATIVE_ARTIFACT_MAX_BYTES,
+};
+function markdownSections(source) {
+    const sections = new Map();
+    let heading = null;
+    let body = [];
+    const flush = () => {
+        if (heading !== null)
+            sections.set(heading, body.join('\n').trim());
+    };
+    for (const line of source.split(/\r?\n/u)) {
+        const match = /^# ([^#].*)$/u.exec(line);
+        if (match) {
+            flush();
+            heading = match[1].trim();
+            body = [];
+        }
+        else if (heading !== null) {
+            body.push(line);
+        }
+    }
+    flush();
+    return sections;
+}
+async function readContainedFile(root, relativeRef) {
+    const target = path.resolve(root, ...relativeRef.split(/[\\/]/u));
+    if (!isInsidePath(root, target))
+        throw new Error(`Artifact escapes Native change: ${relativeRef}`);
+    const realRoot = await fs.realpath(root);
+    const realTarget = await fs.realpath(target);
+    if (!isInsidePath(realRoot, realTarget)) {
+        throw new Error(`Artifact symlink escapes Native change: ${relativeRef}`);
+    }
+    if (!(await fs.stat(realTarget)).isFile())
+        throw new Error(`Artifact is not a file: ${relativeRef}`);
+    return realTarget;
+}
+function result(findings) {
+    return { valid: findings.length === 0, findings };
+}
+export async function validateNativeBrief(changeDir, briefRef) {
+    const findings = [];
+    let source;
+    try {
+        source = (await readNativeBoundedTextFile({
+            root: changeDir,
+            ref: briefRef,
+            maxBytes: NATIVE_ARTIFACT_VALIDATION_LIMITS.maxFileBytes,
+        })).text;
+    }
+    catch (error) {
+        return result([{ code: 'brief-missing', message: error.message, path: briefRef }]);
+    }
+    const sections = markdownSections(source);
+    for (const heading of BRIEF_ALL) {
+        if (!sections.has(heading)) {
+            findings.push({
+                code: 'brief-section-missing',
+                message: `Missing brief section: ${heading}`,
+                path: briefRef,
+            });
+        }
+    }
+    for (const heading of BRIEF_REQUIRED) {
+        if ((sections.get(heading) ?? '').length === 0) {
+            findings.push({
+                code: 'brief-section-empty',
+                message: `Brief section is empty: ${heading}`,
+                path: briefRef,
+            });
+        }
+    }
+    const openQuestions = sections.get('Open questions') ?? '';
+    if (/^\s*-\s*\[blocking\]/imu.test(openQuestions)) {
+        findings.push({
+            code: 'brief-blocking-question',
+            message: 'Brief has a blocking open question',
+            path: briefRef,
+        });
+    }
+    return result(findings);
+}
+export async function validateNativeVerification(changeDir, reportRef) {
+    const findings = [];
+    let source;
+    try {
+        source = (await readNativeBoundedTextFile({
+            root: changeDir,
+            ref: reportRef,
+            maxBytes: NATIVE_ARTIFACT_VALIDATION_LIMITS.maxFileBytes,
+        })).text;
+    }
+    catch (error) {
+        return result([
+            { code: 'verification-missing', message: error.message, path: reportRef },
+        ]);
+    }
+    const sections = markdownSections(source);
+    for (const heading of VERIFICATION_ALL) {
+        if (!sections.has(heading)) {
+            findings.push({
+                code: 'verification-section-missing',
+                message: `Missing verification section: ${heading}`,
+                path: reportRef,
+            });
+        }
+        else if ((sections.get(heading) ?? '').length === 0) {
+            findings.push({
+                code: 'verification-section-empty',
+                message: `Verification section is empty: ${heading}`,
+                path: reportRef,
+            });
+        }
+    }
+    return result(findings);
+}
+export function canonicalSpecPath(paths, capability) {
+    return path.join(paths.specsDir, capability, 'spec.md');
+}
+export async function validateNativeSpecChanges(paths, state) {
+    const findings = [];
+    const changeDir = nativeChangeDir(paths, state.name);
+    for (const change of state.spec_changes) {
+        const canonical = canonicalSpecPath(paths, change.capability);
+        let canonicalHash = null;
+        try {
+            await resolveContainedNativePath(paths.nativeRoot, canonical);
+            canonicalHash = await sha256File(canonical);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                findings.push({
+                    code: 'spec-canonical-unsafe',
+                    message: error.message,
+                    path: canonical,
+                });
+                continue;
+            }
+        }
+        if (change.operation === 'create' && canonicalHash !== null) {
+            findings.push({
+                code: 'spec-create-exists',
+                message: `Canonical spec already exists: ${change.capability}`,
+                path: canonical,
+            });
+        }
+        if (change.operation !== 'create' && canonicalHash === null) {
+            findings.push({
+                code: 'spec-base-missing',
+                message: `Canonical spec is missing: ${change.capability}`,
+                path: canonical,
+            });
+        }
+        if (change.operation !== 'create' &&
+            canonicalHash !== null &&
+            canonicalHash !== change.base_hash) {
+            findings.push({
+                code: 'spec-base-conflict',
+                message: `Canonical spec changed for ${change.capability}: expected ${change.base_hash}, actual ${canonicalHash}`,
+                path: canonical,
+            });
+        }
+        if (change.source) {
+            try {
+                await readContainedFile(changeDir, change.source);
+            }
+            catch (error) {
+                findings.push({
+                    code: 'spec-source-invalid',
+                    message: error.message,
+                    path: change.source,
+                });
+            }
+        }
+    }
+    return result(findings);
+}
+export async function resolveNativeArtifactFile(changeDir, relativeRef) {
+    return readContainedFile(changeDir, relativeRef);
+}
+//# sourceMappingURL=native-artifacts.js.map

package/dist/domains/comet-native/native-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-artifacts.js","sourceRoot":"","sources":["../../../domains/comet-native/native-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,iCAAiC,EACjC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAQ7E,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;AAChF,MAAM,SAAS,GAAG;IAChB,GAAG,cAAc;IACjB,4BAA4B;IAC5B,WAAW;IACX,gBAAgB;IAChB,2BAA2B;CAC5B,CAAC;AACF,MAAM,gBAAgB,GAAG;IACvB,qBAAqB;IACrB,sBAAsB;IACtB,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,YAAY;CACb,CAAC;AAEF,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,YAAY,EAAE,iCAAiC;CACvC,CAAC;AAEX,SAAS,gBAAgB,CAAC,MAAc;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,OAAO,KAAK,IAAI;YAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,EAAE,CAAC;YACR,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;aAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,WAAmB;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mCAAmC,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2CAA2C,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE;QACvC,MAAM,IAAI,KAAK,CAAC,2BAA2B,WAAW,EAAE,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,QAAyB;IACvC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,QAAgB;IAEhB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,CACP,MAAM,yBAAyB,CAAC;YAC9B,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,iCAAiC,CAAC,YAAY;SACzD,CAAC,CACH,CAAC,IAAI,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,0BAA0B,OAAO,EAAE;gBAC5C,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,2BAA2B,OAAO,EAAE;gBAC7C,IAAI,EAAE,QAAQ;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,yBAAyB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,oCAAoC;YAC7C,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,SAAiB,EACjB,SAAiB;IAEjB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,CACP,MAAM,yBAAyB,CAAC;YAC9B,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,iCAAiC,CAAC,YAAY;SACzD,CAAC,CACH,CAAC,IAAI,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;YACZ,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,iCAAiC,OAAO,EAAE;gBACnD,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,kCAAkC,OAAO,EAAE;gBACpD,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAyB,EAAE,UAAkB;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB,EACzB,KAAwB;IAExB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,aAAa,GAAkB,IAAI,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,0BAA0B,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC9D,aAAa,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAG,KAAe,CAAC,OAAO;oBACjC,IAAI,EAAE,SAAS;iBAChB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kCAAkC,MAAM,CAAC,UAAU,EAAE;gBAC9D,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,8BAA8B,MAAM,CAAC,UAAU,EAAE;gBAC1D,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IACE,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC7B,aAAa,KAAK,IAAI;YACtB,aAAa,KAAK,MAAM,CAAC,SAAS,EAClC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,8BAA8B,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,SAAS,YAAY,aAAa,EAAE;gBACjH,IAAI,EAAE,SAAS;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAG,KAAe,CAAC,OAAO;oBACjC,IAAI,EAAE,MAAM,CAAC,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,WAAmB;IAEnB,OAAO,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC"}

package/dist/domains/comet-native/native-atomic-file.d.ts

@@ -0,0 +1,10 @@
+export interface NativeAtomicWriteOptions {
+    containedRoot?: string;
+    beforeTemporaryOpen?: () => void | Promise<void>;
+    beforeCommit?: () => void | Promise<void>;
+    exclusive?: boolean;
+}
+export declare function atomicWriteText(file: string, content: string, options?: NativeAtomicWriteOptions): Promise<void>;
+export declare function atomicWriteBytes(file: string, content: Uint8Array, options?: NativeAtomicWriteOptions): Promise<void>;
+export declare function atomicWriteJson(file: string, value: unknown, options?: NativeAtomicWriteOptions): Promise<void>;
+//# sourceMappingURL=native-atomic-file.d.ts.map

package/dist/domains/comet-native/native-atomic-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-atomic-file.d.ts","sourceRoot":"","sources":["../../../domains/comet-native/native-atomic-file.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,wBAAwB;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA2LD,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,UAAU,EACnB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/domains/comet-native/native-atomic-file.js

@@ -0,0 +1,175 @@
+import { randomUUID } from 'crypto';
+import { promises as fs } from 'fs';
+import path from 'path';
+function isInside(parent, target) {
+    const relative = path.relative(parent, target);
+    return (relative === '' ||
+        (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`)));
+}
+function sameDirectoryIdentity(identity, stat) {
+    if (identity.dev !== 0 || identity.ino !== 0 || stat.dev !== 0 || stat.ino !== 0) {
+        return identity.dev === stat.dev && identity.ino === stat.ino;
+    }
+    return identity.birthtimeMs === stat.birthtimeMs;
+}
+function sameFileIdentity(left, right) {
+    if (left.dev !== 0 || left.ino !== 0 || right.dev !== 0 || right.ino !== 0) {
+        return left.dev === right.dev && left.ino === right.ino;
+    }
+    return (left.birthtimeMs === right.birthtimeMs &&
+        left.ctimeMs === right.ctimeMs &&
+        left.size === right.size);
+}
+async function captureDirectoryIdentity(directory) {
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(`Native atomic write parent must be a real directory: ${directory}`);
+    }
+    return {
+        path: directory,
+        realPath: await fs.realpath(directory),
+        dev: stat.dev,
+        ino: stat.ino,
+        birthtimeMs: stat.birthtimeMs,
+    };
+}
+async function verifyDirectoryChain(chain) {
+    for (const identity of chain) {
+        const stat = await fs.lstat(identity.path);
+        if (!stat.isDirectory() ||
+            stat.isSymbolicLink() ||
+            !sameDirectoryIdentity(identity, stat) ||
+            (await fs.realpath(identity.path)) !== identity.realPath) {
+            throw new Error(`Native atomic write parent changed before commit: ${identity.path}`);
+        }
+    }
+}
+async function prepareContainedDirectoryChain(root, directory) {
+    const lexicalRoot = path.resolve(root);
+    const lexicalDirectory = path.resolve(directory);
+    if (!isInside(lexicalRoot, lexicalDirectory)) {
+        throw new Error(`Native atomic write parent is outside its managed root: ${directory}`);
+    }
+    const chain = [await captureDirectoryIdentity(lexicalRoot)];
+    const segments = path.relative(lexicalRoot, lexicalDirectory).split(path.sep).filter(Boolean);
+    let cursor = lexicalRoot;
+    for (const segment of segments) {
+        await verifyDirectoryChain(chain);
+        cursor = path.join(cursor, segment);
+        try {
+            await fs.mkdir(cursor);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const identity = await captureDirectoryIdentity(cursor);
+        if (!isInside(chain[0].realPath, identity.realPath)) {
+            throw new Error(`Native atomic write parent resolves outside its managed root: ${cursor}`);
+        }
+        chain.push(identity);
+    }
+    await verifyDirectoryChain(chain);
+    return chain;
+}
+async function syncDirectory(directory) {
+    let handle;
+    try {
+        handle = await fs.open(directory, 'r');
+        await handle.sync();
+    }
+    catch (error) {
+        const code = error.code;
+        if (!['EACCES', 'EBADF', 'EINVAL', 'EISDIR', 'ENOTSUP', 'EPERM'].includes(code ?? '')) {
+            throw error;
+        }
+    }
+    finally {
+        await handle?.close();
+    }
+}
+async function atomicWrite(file, content, options = {}) {
+    const directory = path.dirname(file);
+    const directoryChain = options.containedRoot
+        ? await prepareContainedDirectoryChain(options.containedRoot, directory)
+        : null;
+    if (!directoryChain)
+        await fs.mkdir(directory, { recursive: true });
+    const temporary = path.join(directory, `.${path.basename(file)}.${randomUUID()}.tmp`);
+    let handle;
+    let temporaryIdentity;
+    try {
+        await options.beforeTemporaryOpen?.();
+        handle = await fs.open(temporary, 'wx');
+        temporaryIdentity = await handle.stat();
+        if (directoryChain) {
+            const [temporaryPathStat, temporaryRealPath] = await Promise.all([
+                fs.lstat(temporary),
+                fs.realpath(temporary),
+            ]);
+            await verifyDirectoryChain(directoryChain);
+            if (!temporaryPathStat.isFile() ||
+                temporaryPathStat.isSymbolicLink() ||
+                !sameFileIdentity(temporaryIdentity, temporaryPathStat) ||
+                !isInside(directoryChain[0].realPath, temporaryRealPath)) {
+                throw new Error('Native atomic write temporary file opened outside its managed parent');
+            }
+        }
+        if (typeof content === 'string')
+            await handle.writeFile(content, 'utf8');
+        else
+            await handle.writeFile(content);
+        await handle.sync();
+        if (!sameFileIdentity(temporaryIdentity, await handle.stat())) {
+            throw new Error('Native atomic write temporary file changed while writing');
+        }
+        await handle.close();
+        handle = undefined;
+        await options.beforeCommit?.();
+        if (directoryChain) {
+            await verifyDirectoryChain(directoryChain);
+            const temporaryStat = await fs.lstat(temporary);
+            if (!temporaryStat.isFile() ||
+                temporaryStat.isSymbolicLink() ||
+                !temporaryIdentity ||
+                !sameFileIdentity(temporaryStat, temporaryIdentity)) {
+                throw new Error('Native atomic write temporary file changed before commit');
+            }
+        }
+        if (options.exclusive) {
+            await fs.link(temporary, file);
+            await fs.unlink(temporary);
+        }
+        else {
+            await fs.rename(temporary, file);
+        }
+        await syncDirectory(directory);
+    }
+    catch (error) {
+        await handle?.close();
+        if (!directoryChain) {
+            await fs.rm(temporary, { force: true });
+        }
+        else {
+            try {
+                await verifyDirectoryChain(directoryChain);
+                await fs.rm(temporary, { force: true });
+            }
+            catch {
+                // The lexical path may now name an attacker-controlled parent. Leave the
+                // temporary file in the displaced managed directory for doctor cleanup.
+            }
+        }
+        throw error;
+    }
+}
+export async function atomicWriteText(file, content, options = {}) {
+    await atomicWrite(file, content, options);
+}
+export async function atomicWriteBytes(file, content, options = {}) {
+    await atomicWrite(file, content, options);
+}
+export async function atomicWriteJson(file, value, options = {}) {
+    await atomicWriteText(file, JSON.stringify(value, null, 2) + '\n', options);
+}
+//# sourceMappingURL=native-atomic-file.js.map

package/dist/domains/comet-native/native-atomic-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-atomic-file.js","sourceRoot":"","sources":["../../../domains/comet-native/native-atomic-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAiBxB,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA2B,EAAE,IAAwB;IAClF,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB,EAAE,KAAyB;IAC3E,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;IAC1D,CAAC;IACD,OAAO,CACL,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAmC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,IACE,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,IAAY,EACZ,SAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,2DAA2D,SAAS,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,KAAK,GAAwB,CAAC,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,OAA4B,EAC5B,UAAoC,EAAE;IAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa;QAC1C,CAAC,CAAC,MAAM,8BAA8B,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;QACxE,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,cAAc;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACtF,IAAI,MAAuD,CAAC;IAC5D,IAAI,iBAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,iBAAiB,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC/D,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;gBACnB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;aACvB,CAAC,CAAC;YACH,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;YAC3C,IACE,CAAC,iBAAiB,CAAC,MAAM,EAAE;gBAC3B,iBAAiB,CAAC,cAAc,EAAE;gBAClC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;gBACvD,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EACxD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;;YACpE,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC/B,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,IACE,CAAC,aAAa,CAAC,MAAM,EAAE;gBACvB,aAAa,CAAC,cAAc,EAAE;gBAC9B,CAAC,iBAAiB;gBAClB,CAAC,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,CAAC,EACnD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC/B,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,wEAAwE;YAC1E,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,OAAe,EACf,UAAoC,EAAE;IAEtC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,OAAmB,EACnB,UAAoC,EAAE;IAEtC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,KAAc,EACd,UAAoC,EAAE;IAEtC,MAAM,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9E,CAAC"}

package/dist/domains/comet-native/native-bounded-file.d.ts

@@ -0,0 +1,19 @@
+export declare const DEFAULT_NATIVE_ARTIFACT_MAX_BYTES: number;
+export interface NativeBoundedFileReadHooks {
+    afterParentChainCaptured?: () => void | Promise<void>;
+    afterOpen?: () => void | Promise<void>;
+    beforeFinalCheck?: () => void | Promise<void>;
+}
+export interface NativeBoundedTextFile {
+    ref: string;
+    size: number;
+    hash: string;
+    text: string;
+}
+export declare function readNativeBoundedTextFile(options: {
+    root: string;
+    ref: string;
+    maxBytes?: number;
+    hooks?: NativeBoundedFileReadHooks;
+}): Promise<NativeBoundedTextFile>;
+//# sourceMappingURL=native-bounded-file.d.ts.map

package/dist/domains/comet-native/native-bounded-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-bounded-file.d.ts","sourceRoot":"","sources":["../../../domains/comet-native/native-bounded-file.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,iCAAiC,QAAc,CAAC;AAE7D,MAAM,WAAW,0BAA0B;IACzC,wBAAwB,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAgID,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,0BAA0B,CAAC;CACpC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA6EjC"}

package/dist/domains/comet-native/native-bounded-file.js

@@ -0,0 +1,180 @@
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { TextDecoder } from 'node:util';
+import { nativeSensitiveRelativePathReason } from './native-sensitive-paths.js';
+export const DEFAULT_NATIVE_ARTIFACT_MAX_BYTES = 1024 * 1024;
+function isInside(parent, target) {
+    const relative = path.relative(parent, target);
+    return (relative === '' ||
+        (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`)));
+}
+function portableArtifactRef(value) {
+    const normalized = path.posix.normalize(value);
+    if (value.length === 0 ||
+        value !== value.trim() ||
+        value.includes('\\') ||
+        Array.from(value).some((character) => {
+            const code = character.codePointAt(0) ?? 0;
+            return code <= 0x1f || code === 0x7f;
+        }) ||
+        path.posix.isAbsolute(normalized) ||
+        /^(?:[A-Za-z]:|~)/u.test(value) ||
+        value.split('/').includes('..') ||
+        normalized !== value ||
+        normalized === '.' ||
+        value.endsWith('/')) {
+        throw new Error(`Native artifact ref must be normalized and relative: ${value}`);
+    }
+    const lower = value.toLowerCase();
+    const sensitiveReason = nativeSensitiveRelativePathReason(value);
+    if (sensitiveReason || lower === 'runtime' || lower.startsWith('runtime/')) {
+        throw new Error(`Native artifact ref is excluded as sensitive (${sensitiveReason ?? 'native-runtime'}): ${value}`);
+    }
+    return value;
+}
+function positiveLimit(value) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new Error('Native artifact byte limit must be a positive integer');
+    }
+    return value;
+}
+function sameDirectoryIdentity(identity, stat) {
+    if (identity.dev !== 0 || identity.ino !== 0 || stat.dev !== 0 || stat.ino !== 0) {
+        return identity.dev === stat.dev && identity.ino === stat.ino;
+    }
+    return identity.birthtimeMs === stat.birthtimeMs;
+}
+function sameFileIdentity(left, right) {
+    if (left.dev !== 0 || left.ino !== 0 || right.dev !== 0 || right.ino !== 0) {
+        return left.dev === right.dev && left.ino === right.ino;
+    }
+    return (left.birthtimeMs === right.birthtimeMs &&
+        left.ctimeMs === right.ctimeMs &&
+        left.size === right.size);
+}
+async function directoryIdentity(directory) {
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(`Native artifact parent must be a real directory: ${directory}`);
+    }
+    return {
+        path: directory,
+        realPath: await fs.realpath(directory),
+        dev: stat.dev,
+        ino: stat.ino,
+        birthtimeMs: stat.birthtimeMs,
+    };
+}
+async function captureDirectoryChain(root, directory) {
+    const lexicalRoot = path.resolve(root);
+    const lexicalDirectory = path.resolve(directory);
+    if (!isInside(lexicalRoot, lexicalDirectory)) {
+        throw new Error('Native artifact path is outside its root');
+    }
+    const chain = [await directoryIdentity(lexicalRoot)];
+    let cursor = lexicalRoot;
+    for (const segment of path
+        .relative(lexicalRoot, lexicalDirectory)
+        .split(path.sep)
+        .filter(Boolean)) {
+        cursor = path.join(cursor, segment);
+        const identity = await directoryIdentity(cursor);
+        if (!isInside(chain[0].realPath, identity.realPath)) {
+            throw new Error(`Native artifact parent resolves outside its root: ${cursor}`);
+        }
+        chain.push(identity);
+    }
+    return chain;
+}
+async function verifyDirectoryChain(chain) {
+    for (const identity of chain) {
+        const stat = await fs.lstat(identity.path);
+        if (!stat.isDirectory() ||
+            stat.isSymbolicLink() ||
+            !sameDirectoryIdentity(identity, stat) ||
+            (await fs.realpath(identity.path)) !== identity.realPath) {
+            throw new Error(`Native artifact parent changed while reading: ${identity.path}`);
+        }
+    }
+}
+export async function readNativeBoundedTextFile(options) {
+    const ref = portableArtifactRef(options.ref);
+    const maxBytes = positiveLimit(options.maxBytes ?? DEFAULT_NATIVE_ARTIFACT_MAX_BYTES);
+    const file = path.resolve(options.root, ...ref.split('/'));
+    const chain = await captureDirectoryChain(options.root, path.dirname(file));
+    await options.hooks?.afterParentChainCaptured?.();
+    const before = await fs.lstat(file);
+    if (!before.isFile() || before.isSymbolicLink()) {
+        throw new Error(`Native artifact must be a regular file: ${ref}`);
+    }
+    if (before.size > maxBytes)
+        throw new Error(`Native artifact exceeds ${maxBytes} bytes: ${ref}`);
+    const realPath = await fs.realpath(file);
+    if (!isInside(chain[0].realPath, realPath)) {
+        throw new Error(`Native artifact resolves outside its root: ${ref}`);
+    }
+    const handle = await fs.open(file, 'r');
+    try {
+        const [opened, afterOpenPath, afterOpenRealPath] = await Promise.all([
+            handle.stat(),
+            fs.lstat(file),
+            fs.realpath(file),
+        ]);
+        await verifyDirectoryChain(chain);
+        if (!opened.isFile() ||
+            !afterOpenPath.isFile() ||
+            afterOpenPath.isSymbolicLink() ||
+            afterOpenRealPath !== realPath ||
+            !sameFileIdentity(before, opened) ||
+            !sameFileIdentity(opened, afterOpenPath)) {
+            throw new Error(`Native artifact changed while opening: ${ref}`);
+        }
+        await options.hooks?.afterOpen?.();
+        const chunks = [];
+        let total = 0;
+        const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1));
+        while (true) {
+            const remaining = maxBytes + 1 - total;
+            const result = await handle.read(buffer, 0, Math.min(buffer.length, remaining), null);
+            if (result.bytesRead === 0)
+                break;
+            total += result.bytesRead;
+            if (total > maxBytes)
+                throw new Error(`Native artifact exceeds ${maxBytes} bytes: ${ref}`);
+            chunks.push(Buffer.from(buffer.subarray(0, result.bytesRead)));
+        }
+        await options.hooks?.beforeFinalCheck?.();
+        const [afterHandle, afterPath, afterRealPath] = await Promise.all([
+            handle.stat(),
+            fs.lstat(file),
+            fs.realpath(file),
+        ]);
+        await verifyDirectoryChain(chain);
+        if (!afterPath.isFile() ||
+            afterPath.isSymbolicLink() ||
+            afterRealPath !== realPath ||
+            !sameFileIdentity(opened, afterHandle) ||
+            !sameFileIdentity(opened, afterPath)) {
+            throw new Error(`Native artifact changed while reading: ${ref}`);
+        }
+        const bytes = Buffer.concat(chunks, total);
+        let text;
+        try {
+            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        }
+        catch (error) {
+            throw new Error(`Native artifact is not valid UTF-8: ${ref}`, { cause: error });
+        }
+        return {
+            ref,
+            size: total,
+            hash: createHash('sha256').update(bytes).digest('hex'),
+            text,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=native-bounded-file.js.map

package/dist/domains/comet-native/native-bounded-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-bounded-file.js","sourceRoot":"","sources":["../../../domains/comet-native/native-bounded-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,GAAG,IAAI,CAAC;AAuB7D,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE;QACtB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3C,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;QACvC,CAAC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC;QACjC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC/B,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,GAAG;QAClB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,eAAe,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,eAAe,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,iDAAiD,eAAe,IAAI,gBAAgB,MAAM,KAAK,EAAE,CAClG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA2B,EAC3B,IAA6B;IAE7B,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA6B,EAAE,KAA8B;IACrF,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC;IAC1D,CAAC;IACD,OAAO,CACL,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,oDAAoD,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,SAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,IAAI;SACvB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;SACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;SACf,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnB,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAmC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,IACE,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAK/C;IACC,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,IAAI,iCAAiC,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,CAAC,KAAK,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACnE,MAAM,CAAC,IAAI,EAAE;YACb,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACd,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClC,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,CAAC,aAAa,CAAC,MAAM,EAAE;YACvB,aAAa,CAAC,cAAc,EAAE;YAC9B,iBAAiB,KAAK,QAAQ;YAC9B,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YACjC,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;gBAAE,MAAM;YAClC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,WAAW,GAAG,EAAE,CAAC,CAAC;YAC3F,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,MAAM,CAAC,IAAI,EAAE;YACb,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACd,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClC,IACE,CAAC,SAAS,CAAC,MAAM,EAAE;YACnB,SAAS,CAAC,cAAc,EAAE;YAC1B,aAAa,KAAK,QAAQ;YAC1B,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtC,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO;YACL,GAAG;YACH,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACtD,IAAI;SACL,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}