@senior-skills/installer 1.0.0

package/dist/atomic-installer.d.ts

@@ -0,0 +1,71 @@
+import { type AgentTarget, type Clock, type FileSystem, type Hasher, type InstallRequest, type InstallResult, type InstallationEngine, type InstalledSkill, type Logger, type UninstallRequest, type UninstallResult } from '@senior-skills/core';
+export interface AtomicInstallerOptions {
+    readonly fs: FileSystem;
+    readonly hasher: Hasher;
+    readonly clock: Clock;
+    readonly logger: Logger;
+    /** Recorded in receipts, e.g. `@senior-skills/cli@1.0.0`. */
+    readonly toolVersion: string;
+}
+/**
+ * The only component in the system that writes into an agent's skill directory.
+ *
+ * Concentrating writes here is what makes the security and atomicity guarantees checkable:
+ * every adapter, present and future, gets the same hardened commit path for free, and the
+ * adversarial tests only have to cover one implementation.
+ *
+ * Commit sequence:
+ *
+ *   1. stage into `<root>/.senior-skills-staging-xxxx` — same filesystem as the target, so
+ *      the final move is a rename and not a copy
+ *   2. move any existing install aside to `<root>/.senior-skills-retired-xxxx`
+ *   3. rename staging into place
+ *   4. delete the retired copy
+ *
+ * A crash at any step leaves either the old version or the new one intact. Step 2 is undone
+ * if step 3 fails, so a failed install never destroys a working skill.
+ */
+export declare class AtomicInstaller implements InstallationEngine {
+    private readonly fs;
+    private readonly hasher;
+    private readonly clock;
+    private readonly logger;
+    private readonly toolVersion;
+    constructor(options: AtomicInstallerOptions);
+    install(request: InstallRequest): Promise<InstallResult>;
+    /**
+     * Swap the staged directory into place, keeping the previous install recoverable until the
+     * new one is committed.
+     */
+    private commit;
+    /**
+     * A `file`-shaped layout must project to exactly one file; the installer names it, so the
+     * entry's own path is not used.
+     */
+    private planSingleFile;
+    private planFiles;
+    private buildReceipt;
+    /**
+     * A second copy of the receipt lives in the skill root rather than only inside the skill
+     * directory, so `list` and `doctor` can enumerate installs with one directory read instead
+     * of descending into every skill.
+     */
+    private writeRootReceipt;
+    private result;
+    uninstall(request: UninstallRequest): Promise<UninstallResult>;
+    /**
+     * Depth-first removal of directories that became empty, stopping at the first that did not.
+     * Returns true when `directory` itself was removed.
+     */
+    private pruneEmptyDirectories;
+    list(target: AgentTarget): Promise<readonly InstalledSkill[]>;
+    /** The package name a root entry stands for, or undefined when it is not one. */
+    private nameOf;
+    /** Where the receipt's file paths are relative to: the package directory, or the root. */
+    private baseFor;
+    read(target: AgentTarget, name: string): Promise<InstalledSkill | undefined>;
+    private describe;
+    private hasDrifted;
+    private readReceipt;
+}
+//# sourceMappingURL=atomic-installer.d.ts.map

package/dist/atomic-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-installer.d.ts","sourceRoot":"","sources":["../src/atomic-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,MAAM,EAEX,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEnB,KAAK,MAAM,EAEX,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAM7B,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,eAAgB,YAAW,kBAAkB;IACxD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,OAAO,EAAE,sBAAsB;IAQrC,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA0F9D;;;OAGG;YACW,MAAM;IA2BpB;;;OAGG;IACH,OAAO,CAAC,cAAc;IA+BtB,OAAO,CAAC,SAAS;IA0CjB,OAAO,CAAC,YAAY;IA0BpB;;;;OAIG;YACW,gBAAgB;IAM9B,OAAO,CAAC,MAAM;IAqBR,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqEpE;;;OAGG;YACW,qBAAqB;IAsB7B,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC;IAiBnE,iFAAiF;IACjF,OAAO,CAAC,MAAM;IAMd,0FAA0F;IAC1F,OAAO,CAAC,OAAO;IAIT,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAMpE,QAAQ;YAkCR,UAAU;YAUV,WAAW;CAc1B"}

package/dist/atomic-installer.js

@@ -0,0 +1,392 @@
+import { AgentSkillsError, ErrorCode, RECEIPT_DIRNAME, classifyChange, entryNameFor, parseReceipt, posix, receiptPath, stringifyReceipt, } from '@senior-skills/core';
+import { assertContained, safeRelativePath } from "./safe-path.js";
+const STAGING_PREFIX = '.senior-skills-staging-';
+const RETIRED_PREFIX = '.senior-skills-retired-';
+/**
+ * The only component in the system that writes into an agent's skill directory.
+ *
+ * Concentrating writes here is what makes the security and atomicity guarantees checkable:
+ * every adapter, present and future, gets the same hardened commit path for free, and the
+ * adversarial tests only have to cover one implementation.
+ *
+ * Commit sequence:
+ *
+ *   1. stage into `<root>/.senior-skills-staging-xxxx` — same filesystem as the target, so
+ *      the final move is a rename and not a copy
+ *   2. move any existing install aside to `<root>/.senior-skills-retired-xxxx`
+ *   3. rename staging into place
+ *   4. delete the retired copy
+ *
+ * A crash at any step leaves either the old version or the new one intact. Step 2 is undone
+ * if step 3 fails, so a failed install never destroys a working skill.
+ */
+export class AtomicInstaller {
+    fs;
+    hasher;
+    clock;
+    logger;
+    toolVersion;
+    constructor(options) {
+        this.fs = options.fs;
+        this.hasher = options.hasher;
+        this.clock = options.clock;
+        this.logger = options.logger;
+        this.toolVersion = options.toolVersion;
+    }
+    async install(request) {
+        const { adapter, target, pkg } = request;
+        const layout = adapter.layoutFor(pkg);
+        const entryName = safeRelativePath(entryNameFor(target, pkg.manifest.name), `${adapter.id} layout`);
+        const destination = this.fs.join(target.root, entryName);
+        const previous = await this.read(target, pkg.manifest.name);
+        if (previous !== undefined && previous.unmanaged && !request.force) {
+            throw new AgentSkillsError(ErrorCode.MODIFIED_INSTALL, `${destination} already exists and was not installed by senior-skills`, {
+                details: ['Overwriting it would destroy content this tool does not own.'],
+                hints: [`senior-skills install ${pkg.manifest.name} --force   to replace it anyway`],
+                data: { name: pkg.manifest.name, directory: destination },
+            });
+        }
+        if (previous !== undefined && previous.modified && !request.force) {
+            throw new AgentSkillsError(ErrorCode.MODIFIED_INSTALL, `${pkg.manifest.name} has local modifications in ${destination}`, {
+                details: ['Files have changed since they were installed.'],
+                hints: [`senior-skills install ${pkg.manifest.name} --force   to discard the changes`],
+                data: { name: pkg.manifest.name, directory: destination },
+            });
+        }
+        // File-shaped installs record their one file relative to the root, because there is no
+        // package directory for it to be relative to.
+        const files = target.shape === 'file'
+            ? this.planSingleFile(layout.entries, pkg, entryName, adapter.id)
+            : this.planFiles(layout.entries, pkg, destination);
+        const outcome = decideOutcome(previous, request);
+        if (request.dryRun) {
+            return this.result(request, destination, files, previous, outcome, this.buildReceipt(request, destination, files));
+        }
+        await this.fs.mkdirp(target.root);
+        const staging = await this.fs.makeTempDir(target.root, STAGING_PREFIX);
+        try {
+            for (const file of files) {
+                const absolute = this.fs.join(staging, ...file.path.split('/'));
+                assertContained(staging, this.fs.resolve(absolute), this.fs.separator);
+                await this.fs.mkdirp(this.fs.dirname(absolute));
+                // Written without an executable bit: `scripts/` ships as data, and this installer
+                // never runs anything a package contains.
+                await this.fs.writeFile(absolute, file.bytes);
+            }
+            const receipt = this.buildReceipt(request, destination, files);
+            if (target.shape === 'directory') {
+                await this.fs.writeFile(this.fs.join(staging, RECEIPT_DIRNAME, 'receipt.json'), stringifyReceipt(receipt));
+            }
+            // Both shapes commit by rename: a directory moves as a whole, a single file replaces
+            // the previous one, and the staging directory is left empty behind it.
+            await this.commit(target.shape === 'file' ? this.fs.join(staging, entryName) : staging, destination, target.root);
+            if (target.shape === 'file')
+                await this.fs.remove(staging).catch(() => undefined);
+            await this.writeRootReceipt(target, receipt);
+            return this.result(request, destination, files, previous, outcome, receipt);
+        }
+        catch (error) {
+            await this.fs.remove(staging).catch(() => undefined);
+            throw error;
+        }
+    }
+    /**
+     * Swap the staged directory into place, keeping the previous install recoverable until the
+     * new one is committed.
+     */
+    async commit(staging, destination, root) {
+        const exists = await this.fs.exists(destination);
+        let retired;
+        if (exists) {
+            retired = this.fs.join(root, `${RETIRED_PREFIX}${Date.now().toString(36)}`);
+            await this.fs.rename(destination, retired);
+        }
+        try {
+            await this.fs.rename(staging, destination);
+        }
+        catch (error) {
+            // Put the old version back before surfacing the failure: the invariant is that a failed
+            // install leaves the existing version untouched.
+            if (retired !== undefined) {
+                await this.fs.rename(retired, destination).catch(() => {
+                    this.logger.error(`Install failed and the previous version could not be restored. It is preserved at ${retired}`);
+                });
+            }
+            throw error;
+        }
+        if (retired !== undefined)
+            await this.fs.remove(retired).catch(() => undefined);
+    }
+    /**
+     * A `file`-shaped layout must project to exactly one file; the installer names it, so the
+     * entry's own path is not used.
+     */
+    planSingleFile(entries, pkg, entryName, agentId) {
+        if (entries.length !== 1) {
+            throw new AgentSkillsError(ErrorCode.INTERNAL, `Adapter "${agentId}" projected ${entries.length} files onto a single-file target`, { data: { agentId, entries: entries.length } });
+        }
+        const entry = entries[0];
+        let bytes;
+        if (entry.content !== undefined) {
+            bytes = entry.content;
+        }
+        else {
+            const source = pkg.files.find((file) => file.path === posix.normalize(entry.copyFrom));
+            if (source === undefined) {
+                throw new AgentSkillsError(ErrorCode.INTERNAL, `Adapter asked to copy "${entry.copyFrom}", which is not in the package`, { data: { path: entry.copyFrom } });
+            }
+            bytes = source.bytes;
+        }
+        return [{ path: entryName, bytes }];
+    }
+    planFiles(entries, pkg, destination) {
+        const planned = new Map();
+        for (const entry of entries) {
+            const relative = safeRelativePath(entry.path, destination);
+            if (posix.segments(relative)[0] === RECEIPT_DIRNAME) {
+                throw new AgentSkillsError(ErrorCode.UNSAFE_PATH, `A package may not write into ${RECEIPT_DIRNAME}/`, {
+                    details: [`Offending path: ${entry.path}`, 'That directory holds install bookkeeping.'],
+                    data: { path: entry.path },
+                });
+            }
+            let bytes;
+            if (entry.content !== undefined) {
+                bytes = entry.content;
+            }
+            else {
+                const source = pkg.files.find((file) => file.path === posix.normalize(entry.copyFrom));
+                if (source === undefined) {
+                    throw new AgentSkillsError(ErrorCode.INTERNAL, `Adapter asked to copy "${entry.copyFrom}", which is not in the package`, { data: { path: entry.copyFrom } });
+                }
+                bytes = source.bytes;
+            }
+            planned.set(relative, { path: relative, bytes });
+        }
+        return [...planned.values()].sort((a, b) => a.path.localeCompare(b.path));
+    }
+    buildReceipt(request, destination, files) {
+        return {
+            receiptVersion: 1,
+            name: request.pkg.manifest.name,
+            version: request.pkg.manifest.version,
+            agentId: request.target.agentId,
+            scope: request.target.scope,
+            registry: request.registry,
+            resolved: request.resolved,
+            integrity: request.integrity,
+            installedAt: this.clock.now().toISOString(),
+            installedWith: this.toolVersion,
+            directory: destination,
+            files: files.map((file) => ({
+                path: file.path,
+                integrity: this.hasher.hash(file.bytes),
+                size: file.bytes.byteLength,
+            })),
+            dependencyOf: request.dependencyOf,
+        };
+    }
+    /**
+     * A second copy of the receipt lives in the skill root rather than only inside the skill
+     * directory, so `list` and `doctor` can enumerate installs with one directory read instead
+     * of descending into every skill.
+     */
+    async writeRootReceipt(target, receipt) {
+        const path = this.fs.join(target.root, ...receiptPath(receipt.name).split('/'));
+        await this.fs.mkdirp(this.fs.dirname(path));
+        await this.fs.writeFile(path, stringifyReceipt(receipt));
+    }
+    result(request, destination, files, previous, outcome, receipt) {
+        return {
+            outcome,
+            name: request.pkg.manifest.name,
+            version: request.pkg.manifest.version,
+            ...(previous === undefined ? {} : { previousVersion: previous.version }),
+            agentId: request.target.agentId,
+            scope: request.target.scope,
+            directory: destination,
+            files: files.map((file) => file.path),
+            receipt,
+        };
+    }
+    async uninstall(request) {
+        const { target, name } = request;
+        const installed = await this.read(target, name);
+        if (installed === undefined) {
+            throw new AgentSkillsError(ErrorCode.NOT_INSTALLED, `"${name}" is not installed for ${target.agentId}`, {
+                data: { name, agentId: target.agentId, root: target.root },
+            });
+        }
+        if (installed.unmanaged) {
+            throw new AgentSkillsError(ErrorCode.MODIFIED_INSTALL, `${installed.directory} was not installed by senior-skills`, {
+                details: ['Refusing to delete files this tool does not own.'],
+                hints: ['Remove the directory manually if you are sure'],
+                data: { name, directory: installed.directory },
+            });
+        }
+        const receipt = await this.readReceipt(target, name);
+        const removed = [];
+        const preserved = [];
+        const base = this.baseFor(target, installed.directory);
+        for (const file of receipt?.files ?? []) {
+            const absolute = this.fs.join(base, ...file.path.split('/'));
+            if (!(await this.fs.exists(absolute)))
+                continue;
+            // Only delete what still matches what we wrote. Anything the user edited is theirs.
+            const current = await this.hasher.hashFile(absolute).catch(() => undefined);
+            if (current !== file.integrity && !request.force) {
+                preserved.push(file.path);
+                continue;
+            }
+            if (!request.dryRun)
+                await this.fs.remove(absolute);
+            removed.push(file.path);
+        }
+        if (!request.dryRun) {
+            await this.fs
+                .remove(this.fs.join(target.root, ...receiptPath(name).split('/')))
+                .catch(() => undefined);
+            if (target.shape === 'directory') {
+                await this.fs
+                    .remove(this.fs.join(installed.directory, RECEIPT_DIRNAME))
+                    .catch(() => undefined);
+                // Prune only what is now empty. A blanket delete of the skill directory would take
+                // files the user added after installation, which the receipt never claimed.
+                await this.pruneEmptyDirectories(installed.directory);
+            }
+        }
+        return {
+            name,
+            ...(receipt === undefined ? {} : { version: receipt.version }),
+            agentId: target.agentId,
+            scope: target.scope,
+            directory: installed.directory,
+            removed: removed.sort(),
+            preserved: preserved.sort(),
+        };
+    }
+    /**
+     * Depth-first removal of directories that became empty, stopping at the first that did not.
+     * Returns true when `directory` itself was removed.
+     */
+    async pruneEmptyDirectories(directory) {
+        if (!(await this.fs.exists(directory)))
+            return true;
+        let entries;
+        try {
+            entries = await this.fs.readDir(directory);
+        }
+        catch {
+            return false;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory)
+                continue;
+            await this.pruneEmptyDirectories(this.fs.join(directory, entry.name));
+        }
+        const remaining = await this.fs.readDir(directory).catch(() => [{ name: 'unknown' }]);
+        if (remaining.length > 0)
+            return false;
+        await this.fs.remove(directory).catch(() => undefined);
+        return true;
+    }
+    async list(target) {
+        if (!(await this.fs.exists(target.root)))
+            return [];
+        const skills = [];
+        for (const entry of await this.fs.readDir(target.root)) {
+            if (entry.name.startsWith('.'))
+                continue; // .senior-skills, staging and retired leftovers
+            const name = this.nameOf(target, entry.name, entry.isDirectory);
+            if (name === undefined)
+                continue;
+            const skill = await this.describe(target, name);
+            if (skill !== undefined)
+                skills.push(skill);
+        }
+        return skills.sort((a, b) => a.name.localeCompare(b.name));
+    }
+    /** The package name a root entry stands for, or undefined when it is not one. */
+    nameOf(target, entryName, isDirectory) {
+        if (target.shape === 'directory')
+            return isDirectory ? entryName : undefined;
+        if (isDirectory || !entryName.endsWith(target.extension))
+            return undefined;
+        return entryName.slice(0, entryName.length - target.extension.length);
+    }
+    /** Where the receipt's file paths are relative to: the package directory, or the root. */
+    baseFor(target, destination) {
+        return target.shape === 'file' ? target.root : destination;
+    }
+    async read(target, name) {
+        const directory = this.fs.join(target.root, entryNameFor(target, name));
+        if (!(await this.fs.exists(directory)))
+            return undefined;
+        return this.describe(target, name);
+    }
+    async describe(target, name) {
+        const directory = this.fs.join(target.root, entryNameFor(target, name));
+        const receipt = await this.readReceipt(target, name);
+        if (receipt === undefined) {
+            // A skill directory the tool has no receipt for. Reported, never touched.
+            return {
+                name,
+                version: '0.0.0',
+                agentId: target.agentId,
+                scope: target.scope,
+                directory,
+                registry: 'unknown',
+                installedAt: '',
+                unmanaged: true,
+                modified: false,
+                dependencyOf: [],
+            };
+        }
+        return {
+            name: receipt.name,
+            version: receipt.version,
+            agentId: target.agentId,
+            scope: target.scope,
+            directory,
+            registry: receipt.registry,
+            installedAt: receipt.installedAt,
+            unmanaged: false,
+            modified: await this.hasDrifted(this.baseFor(target, directory), receipt),
+            dependencyOf: receipt.dependencyOf,
+        };
+    }
+    async hasDrifted(base, receipt) {
+        for (const file of receipt.files) {
+            const absolute = this.fs.join(base, ...file.path.split('/'));
+            if (!(await this.fs.exists(absolute)))
+                return true;
+            const current = await this.hasher.hashFile(absolute).catch(() => undefined);
+            if (current !== file.integrity)
+                return true;
+        }
+        return false;
+    }
+    async readReceipt(target, name) {
+        const path = this.fs.join(target.root, ...receiptPath(name).split('/'));
+        if (!(await this.fs.exists(path)))
+            return undefined;
+        try {
+            return parseReceipt(await this.fs.readTextFile(path), path);
+        }
+        catch (error) {
+            this.logger.warn(`Ignoring unreadable install receipt ${path}`);
+            this.logger.debug(String(error));
+            return undefined;
+        }
+    }
+}
+function decideOutcome(previous, request) {
+    if (previous === undefined || previous.unmanaged)
+        return 'installed';
+    const change = classifyChange(previous.version, request.pkg.manifest.version);
+    if (change === 'downgrade')
+        return 'downgraded';
+    if (change === 'same')
+        return previous.modified ? 'reinstalled' : 'unchanged';
+    return 'upgraded';
+}
+//# sourceMappingURL=atomic-installer.js.map

package/dist/atomic-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-installer.js","sourceRoot":"","sources":["../src/atomic-installer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,WAAW,EACX,gBAAgB,GAejB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEnE,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAWjD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,eAAe;IACT,EAAE,CAAa;IACf,MAAM,CAAS;IACf,KAAK,CAAQ;IACb,MAAM,CAAS;IACf,WAAW,CAAS;IAErC,YAAY,OAA+B;QACzC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,gBAAgB,CAChC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EACvC,GAAG,OAAO,CAAC,EAAE,SAAS,CACvB,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnE,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,gBAAgB,EAC1B,GAAG,WAAW,wDAAwD,EACtE;gBACE,OAAO,EAAE,CAAC,8DAA8D,CAAC;gBACzE,KAAK,EAAE,CAAC,yBAAyB,GAAG,CAAC,QAAQ,CAAC,IAAI,iCAAiC,CAAC;gBACpF,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClE,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,gBAAgB,EAC1B,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,+BAA+B,WAAW,EAAE,EAChE;gBACE,OAAO,EAAE,CAAC,+CAA+C,CAAC;gBAC1D,KAAK,EAAE,CAAC,yBAAyB,GAAG,CAAC,QAAQ,CAAC,IAAI,mCAAmC,CAAC;gBACtF,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;aAC1D,CACF,CAAC;QACJ,CAAC;QAED,uFAAuF;QACvF,8CAA8C;QAC9C,MAAM,KAAK,GACT,MAAM,CAAC,KAAK,KAAK,MAAM;YACrB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,MAAM,CAChB,OAAO,EACP,WAAW,EACX,KAAK,EACL,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEvE,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBACvE,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAChD,kFAAkF;gBAClF,0CAA0C;gBAC1C,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CACrB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,cAAc,CAAC,EACtD,gBAAgB,CAAC,OAAO,CAAC,CAC1B,CAAC;YACJ,CAAC;YAED,qFAAqF;YACrF,uEAAuE;YACvE,MAAM,IAAI,CAAC,MAAM,CACf,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EACpE,WAAW,EACX,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM;gBAAE,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClF,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,WAAmB,EAAE,IAAY;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,OAA2B,CAAC;QAEhC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wFAAwF;YACxF,iDAAiD;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qFAAqF,OAAO,EAAE,CAC/F,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACK,cAAc,CACpB,OAA+B,EAC/B,GAA0B,EAC1B,SAAiB,EACjB,OAAe;QAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,QAAQ,EAClB,YAAY,OAAO,eAAe,OAAO,CAAC,MAAM,kCAAkC,EAClF,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAC/C,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,IAAI,KAAiB,CAAC;QACtB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,QAAQ,EAClB,0BAA0B,KAAK,CAAC,QAAQ,gCAAgC,EACxE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CACnC,CAAC;YACJ,CAAC;YACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,SAAS,CACf,OAA+B,EAC/B,GAA0B,EAC1B,WAAmB;QAEnB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA+C,CAAC;QAEvE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAE3D,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACpD,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,WAAW,EACrB,gCAAgC,eAAe,GAAG,EAClD;oBACE,OAAO,EAAE,CAAC,mBAAmB,KAAK,CAAC,IAAI,EAAE,EAAE,2CAA2C,CAAC;oBACvF,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;iBAC3B,CACF,CAAC;YACJ,CAAC;YAED,IAAI,KAAiB,CAAC;YACtB,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,QAAQ,EAClB,0BAA0B,KAAK,CAAC,QAAQ,gCAAgC,EACxE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CACnC,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACvB,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,YAAY,CAClB,OAAuB,EACvB,WAAmB,EACnB,KAAqD;QAErD,OAAO;YACL,cAAc,EAAE,CAAC;YACjB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI;YAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO;YACrC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;YAC/B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAC3C,aAAa,EAAE,IAAI,CAAC,WAAW;YAC/B,SAAS,EAAE,WAAW;YACtB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAe,EAAE,CAAC,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;aAC5B,CAAC,CAAC;YACH,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,gBAAgB,CAAC,MAAmB,EAAE,OAAuB;QACzE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,MAAM,CACZ,OAAuB,EACvB,WAAmB,EACnB,KAAkC,EAClC,QAAoC,EACpC,OAAiC,EACjC,OAAuB;QAEvB,OAAO;YACL,OAAO;YACP,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI;YAC/B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO;YACrC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;YACxE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;YAC/B,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,SAAS,EAAE,WAAW;YACtB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,OAAO;SACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAEhD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,aAAa,EACvB,IAAI,IAAI,0BAA0B,MAAM,CAAC,OAAO,EAAE,EAClD;gBACE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aAC3D,CACF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,gBAAgB,EAC1B,GAAG,SAAS,CAAC,SAAS,qCAAqC,EAC3D;gBACE,OAAO,EAAE,CAAC,kDAAkD,CAAC;gBAC7D,KAAK,EAAE,CAAC,+CAA+C,CAAC;gBACxD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;aAC/C,CACF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAEvD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAEhD,oFAAoF;YACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,EAAE;iBACV,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;iBAClE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC1B,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,EAAE;qBACV,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;qBAC1D,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,mFAAmF;gBACnF,4EAA4E;gBAC5E,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,OAAO;YACL,IAAI;YACJ,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9D,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YACvB,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,qBAAqB,CAAC,SAAiB;QACnD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW;gBAAE,SAAS;YACjC,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC,CAAC,CAAC;QAC/F,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB;QAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAEpD,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,gDAAgD;YAE1F,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAChE,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YAEjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,iFAAiF;IACzE,MAAM,CAAC,MAAmB,EAAE,SAAiB,EAAE,WAAoB;QACzE,IAAI,MAAM,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC3E,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,0FAA0F;IAClF,OAAO,CAAC,MAAmB,EAAE,WAAmB;QACtD,OAAO,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAmB,EAAE,IAAY;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,MAAmB,EAAE,IAAY;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAErD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,OAAO;gBACL,IAAI;gBACJ,OAAO,EAAE,OAAoC;gBAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS;gBACT,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,EAAE;gBACf,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,EAAE;aACjB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC;YACzE,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,OAAuB;QAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,OAAO,KAAK,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAmB,EACnB,IAAY;QAEZ,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CACpB,QAAoC,EACpC,OAAuB;IAEvB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS;QAAE,OAAO,WAAW,CAAC;IAErE,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,MAAM,KAAK,WAAW;QAAE,OAAO,YAAY,CAAC;IAChD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9E,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `@senior-skills/installer` — the single write path into an agent's skill directory.
+ *
+ * Everything security-critical about turning an untrusted package into files on disk lives
+ * in this package: path safety, archive extraction limits, and the atomic commit.
+ */
+export { AtomicInstaller, type AtomicInstallerOptions } from './atomic-installer.ts';
+export { DEFAULT_EXTRACTION_LIMITS, SafeExtractor, type ExtractionLimits, } from './safe-extractor.ts';
+export { MAX_PATH_SEGMENTS, MAX_SEGMENT_LENGTH, assertContained, inspectPath, isSafePath, safeRelativePath, type UnsafePathReason, } from './safe-path.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAErF,OAAO,EACL,yBAAyB,EACzB,aAAa,EACb,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+/**
+ * `@senior-skills/installer` — the single write path into an agent's skill directory.
+ *
+ * Everything security-critical about turning an untrusted package into files on disk lives
+ * in this package: path safety, archive extraction limits, and the atomic commit.
+ */
+export { AtomicInstaller } from "./atomic-installer.js";
+export { DEFAULT_EXTRACTION_LIMITS, SafeExtractor, } from "./safe-extractor.js";
+export { MAX_PATH_SEGMENTS, MAX_SEGMENT_LENGTH, assertContained, inspectPath, isSafePath, safeRelativePath, } from "./safe-path.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAA+B,MAAM,uBAAuB,CAAC;AAErF,OAAO,EACL,yBAAyB,EACzB,aAAa,GAEd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,UAAU,EACV,gBAAgB,GAEjB,MAAM,gBAAgB,CAAC"}

package/dist/safe-extractor.d.ts

@@ -0,0 +1,29 @@
+import { type ArchiveEntry, type ArchiveReader, type SkillPackage } from '@senior-skills/core';
+export interface ExtractionLimits {
+    readonly maxFiles: number;
+    readonly maxTotalBytes: number;
+    /** Reject archives whose uncompressed size exceeds this multiple of the compressed size. */
+    readonly maxCompressionRatio: number;
+}
+export declare const DEFAULT_EXTRACTION_LIMITS: ExtractionLimits;
+/**
+ * Turns an untrusted `.tar.gz` into a validated {@link SkillPackage} in memory.
+ *
+ * Nothing here writes to disk. Extraction happens entirely in memory, and only a package that
+ * survives every check is handed to the installer for staging — so a hostile archive never
+ * gets the chance to create a file at all, rather than being cleaned up after the fact.
+ *
+ * Rejected outright:
+ *   - symlinks and hardlinks (any entry type other than file or directory)
+ *   - paths that are absolute, traversing, UNC, drive-lettered, or Windows-hostile
+ *   - duplicate entries for the same path (last-write-wins is how a check gets bypassed)
+ *   - archives over the size, count or compression-ratio limits
+ */
+export declare class SafeExtractor {
+    private readonly archives;
+    private readonly limits;
+    constructor(archives: ArchiveReader, limits?: ExtractionLimits);
+    extract(data: Uint8Array, source: string): Promise<SkillPackage>;
+    fromEntries(entries: readonly ArchiveEntry[], source: string, compressedBytes: number): SkillPackage;
+}
+//# sourceMappingURL=safe-extractor.d.ts.map

package/dist/safe-extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-extractor.d.ts","sourceRoot":"","sources":["../src/safe-extractor.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,KAAK,YAAY,EACjB,KAAK,aAAa,EAElB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,4FAA4F;IAC5F,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,eAAO,MAAM,yBAAyB,EAAE,gBAIvC,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;gBAE9B,QAAQ,EAAE,aAAa,EAAE,MAAM,GAAE,gBAA4C;IAKnF,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKtE,WAAW,CACT,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,GACtB,YAAY;CAuFhB"}

package/dist/safe-extractor.js

@@ -0,0 +1,120 @@
+import { AgentSkillsError, ErrorCode, MANIFEST_FILENAME, buildSkillPackage, decodeText, parseManifest, } from '@senior-skills/core';
+import { safeRelativePath } from "./safe-path.js";
+export const DEFAULT_EXTRACTION_LIMITS = {
+    maxFiles: 2_000,
+    maxTotalBytes: 32 * 1024 * 1024,
+    maxCompressionRatio: 200,
+};
+/**
+ * Turns an untrusted `.tar.gz` into a validated {@link SkillPackage} in memory.
+ *
+ * Nothing here writes to disk. Extraction happens entirely in memory, and only a package that
+ * survives every check is handed to the installer for staging — so a hostile archive never
+ * gets the chance to create a file at all, rather than being cleaned up after the fact.
+ *
+ * Rejected outright:
+ *   - symlinks and hardlinks (any entry type other than file or directory)
+ *   - paths that are absolute, traversing, UNC, drive-lettered, or Windows-hostile
+ *   - duplicate entries for the same path (last-write-wins is how a check gets bypassed)
+ *   - archives over the size, count or compression-ratio limits
+ */
+export class SafeExtractor {
+    archives;
+    limits;
+    constructor(archives, limits = DEFAULT_EXTRACTION_LIMITS) {
+        this.archives = archives;
+        this.limits = limits;
+    }
+    async extract(data, source) {
+        const entries = await this.archives.read(data);
+        return this.fromEntries(entries, source, data.byteLength);
+    }
+    fromEntries(entries, source, compressedBytes) {
+        const files = new Map();
+        let totalBytes = 0;
+        const prefix = commonLeadingComponent(entries);
+        for (const entry of entries) {
+            if (entry.type === 'directory')
+                continue;
+            if (entry.type !== 'file') {
+                throw new AgentSkillsError(ErrorCode.UNSAFE_ARCHIVE, `Refusing archive: "${entry.path}" is a ${entry.type}`, {
+                    details: [
+                        entry.linkTarget === undefined ? '' : `-> ${entry.linkTarget}`,
+                        'Skill packages may contain regular files only.',
+                    ].filter((line) => line !== ''),
+                    hints: ['Links can redirect writes outside the install directory'],
+                    data: { source, path: entry.path, type: entry.type },
+                });
+            }
+            // Archives produced by GitHub and by `npm pack` wrap the package in one directory.
+            // Strip it only when *every* entry shares it, so a flat archive is left alone.
+            const relative = safeRelativePath(stripPrefix(entry.path, prefix), source);
+            if (files.has(relative)) {
+                throw new AgentSkillsError(ErrorCode.UNSAFE_ARCHIVE, `Refusing archive: duplicate entry "${relative}"`, {
+                    details: ['A duplicated path lets a later entry overwrite an already-checked file.'],
+                    data: { source, path: relative },
+                });
+            }
+            totalBytes += entry.bytes.byteLength;
+            if (files.size >= this.limits.maxFiles) {
+                throw new AgentSkillsError(ErrorCode.UNSAFE_ARCHIVE, `Refusing archive: more than ${this.limits.maxFiles} files`, { data: { source, maxFiles: this.limits.maxFiles } });
+            }
+            if (totalBytes > this.limits.maxTotalBytes) {
+                throw new AgentSkillsError(ErrorCode.UNSAFE_ARCHIVE, `Refusing archive: expands to more than ${this.limits.maxTotalBytes} bytes`, { data: { source, maxTotalBytes: this.limits.maxTotalBytes } });
+            }
+            files.set(relative, { path: relative, bytes: entry.bytes });
+        }
+        if (compressedBytes > 0 && totalBytes / compressedBytes > this.limits.maxCompressionRatio) {
+            throw new AgentSkillsError(ErrorCode.UNSAFE_ARCHIVE, 'Refusing archive: compression ratio looks like a decompression bomb', {
+                details: [
+                    `compressed:   ${compressedBytes} bytes`,
+                    `uncompressed: ${totalBytes} bytes`,
+                    `ratio:        ${Math.round(totalBytes / compressedBytes)}:1 (limit ${this.limits.maxCompressionRatio}:1)`,
+                ],
+                data: { source, compressedBytes, totalBytes },
+            });
+        }
+        const manifestFile = files.get(MANIFEST_FILENAME);
+        if (manifestFile === undefined) {
+            throw new AgentSkillsError(ErrorCode.INVALID_PACKAGE, `Archive from ${source} contains no ${MANIFEST_FILENAME}`, { data: { source, entries: [...files.keys()] } });
+        }
+        const { manifest } = parseManifest(decodeText(manifestFile.bytes), {
+            source: `${source}/${MANIFEST_FILENAME}`,
+        });
+        return buildSkillPackage(manifest, [...files.values()]);
+    }
+}
+function unify(path) {
+    return path.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+/**
+ * The single directory every entry lives under, or undefined when there is not exactly one.
+ *
+ * A traversal component is never treated as a strippable prefix: `../evil` must reach the
+ * safety check intact rather than being quietly turned into `evil`.
+ */
+function commonLeadingComponent(entries) {
+    const heads = new Set();
+    for (const entry of entries) {
+        if (entry.type !== 'file')
+            continue;
+        const unified = unify(entry.path);
+        const slash = unified.indexOf('/');
+        if (slash <= 0)
+            return undefined; // a root-level file means there is nothing to strip
+        heads.add(unified.slice(0, slash));
+        if (heads.size > 1)
+            return undefined;
+    }
+    const [only] = [...heads];
+    if (only === undefined || only === '.' || only === '..')
+        return undefined;
+    return only;
+}
+function stripPrefix(path, prefix) {
+    const unified = unify(path);
+    if (prefix === undefined)
+        return unified;
+    return unified.startsWith(`${prefix}/`) ? unified.slice(prefix.length + 1) : unified;
+}
+//# sourceMappingURL=safe-extractor.js.map

package/dist/safe-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-extractor.js","sourceRoot":"","sources":["../src/safe-extractor.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,iBAAiB,EACjB,iBAAiB,EACjB,UAAU,EACV,aAAa,GAKd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AASlD,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IACzD,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,mBAAmB,EAAE,GAAG;CACzB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,aAAa;IACP,QAAQ,CAAgB;IACxB,MAAM,CAAmB;IAE1C,YAAY,QAAuB,EAAE,SAA2B,yBAAyB;QACvF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAgB,EAAE,MAAc;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5D,CAAC;IAED,WAAW,CACT,OAAgC,EAChC,MAAc,EACd,eAAuB;QAEvB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;QAC7C,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAE/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YAEzC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,cAAc,EACxB,sBAAsB,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,IAAI,EAAE,EACtD;oBACE,OAAO,EAAE;wBACP,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE;wBAC9D,gDAAgD;qBACjD,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;oBAC/B,KAAK,EAAE,CAAC,yDAAyD,CAAC;oBAClE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;iBACrD,CACF,CAAC;YACJ,CAAC;YAED,mFAAmF;YACnF,+EAA+E;YAC/E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAE3E,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,cAAc,EACxB,sCAAsC,QAAQ,GAAG,EACjD;oBACE,OAAO,EAAE,CAAC,yEAAyE,CAAC;oBACpF,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACjC,CACF,CAAC;YACJ,CAAC;YAED,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,cAAc,EACxB,+BAA+B,IAAI,CAAC,MAAM,CAAC,QAAQ,QAAQ,EAC3D,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CACrD,CAAC;YACJ,CAAC;YACD,IAAI,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,cAAc,EACxB,0CAA0C,IAAI,CAAC,MAAM,CAAC,aAAa,QAAQ,EAC3E,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAC/D,CAAC;YACJ,CAAC;YAED,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,IAAI,UAAU,GAAG,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC1F,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,cAAc,EACxB,qEAAqE,EACrE;gBACE,OAAO,EAAE;oBACP,iBAAiB,eAAe,QAAQ;oBACxC,iBAAiB,UAAU,QAAQ;oBACnC,iBAAiB,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,eAAe,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK;iBAC3G;gBACD,IAAI,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE;aAC9C,CACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAClD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,eAAe,EACzB,gBAAgB,MAAM,gBAAgB,iBAAiB,EAAE,EACzD,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE;YACjE,MAAM,EAAE,GAAG,MAAM,IAAI,iBAAiB,EAAE;SACzC,CAAC,CAAC;QAEH,OAAO,iBAAiB,CAAC,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,OAAgC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;QACtF,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAA0B;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AACvF,CAAC"}

package/dist/safe-path.d.ts

@@ -0,0 +1,24 @@
+import { inspectPath, isSafePath, MAX_PATH_SEGMENTS, MAX_SEGMENT_LENGTH, type PathSafetyViolation } from '@senior-skills/core';
+/**
+ * Path safety at the extraction boundary.
+ *
+ * The rules themselves live in `@senior-skills/core` so that `validate` and the extractor
+ * cannot disagree about what is safe. This module adds what only the installer needs: turning
+ * a violation into a thrown security error, and proving containment against a real directory.
+ */
+export { MAX_PATH_SEGMENTS, MAX_SEGMENT_LENGTH, inspectPath, isSafePath };
+export type UnsafePathReason = PathSafetyViolation;
+/**
+ * Validates and normalises an untrusted path to a POSIX relative path.
+ * Throws rather than sanitising: silently rewriting a hostile path hides the attack.
+ */
+export declare function safeRelativePath(raw: string, context?: string): string;
+/**
+ * Second line of defence: proves the *resolved* destination is still inside the root.
+ *
+ * The lexical rules cannot see through a symlinked parent directory, so the installer also
+ * compares resolved paths before writing. Belt and braces, because the cost of being wrong
+ * here is arbitrary file overwrite.
+ */
+export declare function assertContained(root: string, candidate: string, separator: string): void;
+//# sourceMappingURL=safe-path.d.ts.map

package/dist/safe-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-path.d.ts","sourceRoot":"","sources":["../src/safe-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,WAAW,EACX,UAAU,EAEV,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;GAMG;AACH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAC1E,MAAM,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAUtE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAgBxF"}

package/dist/safe-path.js

@@ -0,0 +1,51 @@
+import { AgentSkillsError, ErrorCode, inspectPath, isSafePath, normalizeSafePath, MAX_PATH_SEGMENTS, MAX_SEGMENT_LENGTH, } from '@senior-skills/core';
+/**
+ * Path safety at the extraction boundary.
+ *
+ * The rules themselves live in `@senior-skills/core` so that `validate` and the extractor
+ * cannot disagree about what is safe. This module adds what only the installer needs: turning
+ * a violation into a thrown security error, and proving containment against a real directory.
+ */
+export { MAX_PATH_SEGMENTS, MAX_SEGMENT_LENGTH, inspectPath, isSafePath };
+/**
+ * Validates and normalises an untrusted path to a POSIX relative path.
+ * Throws rather than sanitising: silently rewriting a hostile path hides the attack.
+ */
+export function safeRelativePath(raw, context) {
+    const reason = inspectPath(raw);
+    if (reason !== undefined) {
+        throw new AgentSkillsError(ErrorCode.UNSAFE_PATH, `Refusing unsafe path: ${truncate(raw)}`, {
+            details: [reason.message, ...(context === undefined ? [] : [`In: ${context}`])],
+            hints: ['This package is malformed or hostile; do not install it'],
+            data: { path: raw, rule: reason.rule, ...(context === undefined ? {} : { context }) },
+        });
+    }
+    return normalizeSafePath(raw);
+}
+/**
+ * Second line of defence: proves the *resolved* destination is still inside the root.
+ *
+ * The lexical rules cannot see through a symlinked parent directory, so the installer also
+ * compares resolved paths before writing. Belt and braces, because the cost of being wrong
+ * here is arbitrary file overwrite.
+ */
+export function assertContained(root, candidate, separator) {
+    const normalizedRoot = stripTrailing(root, separator);
+    const normalizedCandidate = stripTrailing(candidate, separator);
+    if (normalizedCandidate === normalizedRoot)
+        return;
+    if (normalizedCandidate.startsWith(normalizedRoot + separator))
+        return;
+    throw new AgentSkillsError(ErrorCode.UNSAFE_PATH, 'Refusing to write outside the destination directory', {
+        details: [`destination: ${normalizedRoot}`, `resolved to:  ${normalizedCandidate}`],
+        hints: ['A symlink in the target path may be redirecting the install'],
+        data: { root: normalizedRoot, candidate: normalizedCandidate },
+    });
+}
+function stripTrailing(value, separator) {
+    return value.endsWith(separator) ? value.slice(0, -separator.length) : value;
+}
+function truncate(value) {
+    return value.length > 120 ? `${value.slice(0, 117)}...` : value;
+}
+//# sourceMappingURL=safe-path.js.map

package/dist/safe-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-path.js","sourceRoot":"","sources":["../src/safe-path.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GAEnB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;GAMG;AACH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAG1E;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAgB;IAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,yBAAyB,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE;YAC1F,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC;YAC/E,KAAK,EAAE,CAAC,yDAAyD,CAAC;YAClE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;SACtF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB;IAChF,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhE,IAAI,mBAAmB,KAAK,cAAc;QAAE,OAAO;IACnD,IAAI,mBAAmB,CAAC,UAAU,CAAC,cAAc,GAAG,SAAS,CAAC;QAAE,OAAO;IAEvE,MAAM,IAAI,gBAAgB,CACxB,SAAS,CAAC,WAAW,EACrB,qDAAqD,EACrD;QACE,OAAO,EAAE,CAAC,gBAAgB,cAAc,EAAE,EAAE,iBAAiB,mBAAmB,EAAE,CAAC;QACnF,KAAK,EAAE,CAAC,6DAA6D,CAAC;QACtE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE;KAC/D,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,SAAiB;IACrD,OAAO,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAClE,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@senior-skills/installer",
+  "version": "1.0.0",
+  "description": "Atomic, rollback-safe skill installation engine",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/robsonkades/senior-skills.git",
+    "directory": "packages/installer"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@senior-skills/core": "1.0.0"
+  }
+}